talon-agent 3.1.0 → 3.2.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "talon-agent",
-  "version": "3.1.0",
+  "version": "3.2.0",
   "description": "Multi-frontend AI agent with full tool access, streaming, cron jobs, and plugin system",
   "author": "Dylan Neve",
   "license": "MIT",
@@ -71,7 +71,7 @@
     "test:openai-agents:backend": "vitest run --reporter=verbose --reporter=json --outputFile=openai-agents-backend-results.json src/__tests__/integration/openai-agents-live-discovery.test.ts",
     "build:sql": "tsx scripts/embed-sql.ts",
     "build:prompts": "tsx scripts/embed-prompts.ts",
-    "build:wasm": "node native/blake3-wasm/build.mjs",
+    "build:wasm": "node native/blake3-wasm/build.mjs && node native/strsim-wasm/build.mjs && node native/sqlguard-wasm/build.mjs && node native/htmlents-wasm/build.mjs",
     "tarball:check": "node .github/scripts/tarball-check.mjs",
     "build:stub-sea": "node src/__tests__/integration/stub-claude/build-sea.mjs",
     "test:watch": "vitest",
@@ -86,9 +86,7 @@
     "ci:protect": "node .github/scripts/enforce-ci-gate.mjs",
     "build:gleam": "cd native/scheduler-core && gleam build --target javascript && node embed.mjs",
     "build:zig": "node native/textops-wasm/build.mjs",
-    "build:c": "node native/strsim-c/build.mjs && node native/sqlguard-c/build.mjs",
-    "build:cpp": "node native/htmlents-cpp/build.mjs",
-    "build:native": "npm run build:wasm && npm run build:zig && npm run build:c && npm run build:cpp && npm run build:gleam",
+    "build:native": "npm run build:wasm && npm run build:zig && npm run build:gleam",
     "build:driver": "node native/talon-driver/build.mjs",
     "build:driver:all": "node native/talon-driver/build.mjs --all",
     "build:warden": "node native/talon-warden/build.mjs",
@@ -105,7 +103,7 @@
     "@kilocode/sdk": "^7.2.22",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@openai/agents": "^0.13.0",
-    "@openai/codex-sdk": "^0.144.0",
+    "@openai/codex-sdk": "^0.145.0",
     "@opencode-ai/sdk": "^1.17.4",
     "@playwright/mcp": "^0.0.78",
     "@types/cross-spawn": "^6.0.6",

package/src/cli/index.ts

@@ -172,7 +172,7 @@ export async function runCli(): Promise<void> {
       mainMenu();
       break;
     default: {
-      // "did you mean ...?" via the C similarity core (native/strsim-c).
+      // "did you mean ...?" via the native similarity core (native/strsim-wasm).
       const { closestMatch } = await import("../native/strsim.js");
       const suggestion = closestMatch(command, CLI_COMMANDS);
       const hint = suggestion

package/src/core/engine/gateway-actions/mesh.ts

@@ -57,4 +57,12 @@ export const meshHandlers: SharedActionHandlers = {
       body.apk_path,
       body.remote_path,
     ),
+  // Remote self-update for a headless talon-node: push a new binary and have
+  // the node verify, swap, and restart into it.
+  update_node: (body) =>
+    getMeshService().updateNodeBinary(
+      body.device,
+      body.binary_path,
+      body.remote_path,
+    ),
 };

package/src/core/mesh/service.ts

@@ -873,6 +873,87 @@ export class MeshService {
     };
   }
 
+  /**
+   * `update_node`: remote self-update for a headless talon-node. Streams a
+   * replacement binary to the node, then sends `update_node` so the node
+   * verifies the digest, atomically swaps its own binary, and restarts into
+   * it (an in-place execve under systemd/launchd, so the mesh connection
+   * returns on its own within seconds — the same UX as the Android path).
+   *
+   * The binary is hashed here and the digest travels with the command; the
+   * node re-hashes the pushed file and refuses to swap on a mismatch, so a
+   * truncated transfer can never be installed. Build the replacement for the
+   * node's platform/arch (talon-node-<os>-<arch>) before calling.
+   */
+  async updateNodeBinary(
+    query: unknown,
+    localBinaryPath: unknown,
+    remotePath?: unknown,
+  ): Promise<MeshToolResult> {
+    const local =
+      typeof localBinaryPath === "string" && localBinaryPath.trim()
+        ? resolve(dirs.workspace, localBinaryPath.trim())
+        : "";
+    if (!local) return { ok: false, text: "A local binary path is required." };
+    await this.load();
+    const resolved = this.resolveDevice(query);
+    if ("error" in resolved) return { ok: false, text: resolved.error };
+    const target = resolved.target;
+    if (target.capabilities && !target.capabilities.includes("update_node")) {
+      return {
+        ok: false,
+        text: `${target.name} can't self-update — it needs the update_node capability (a talon-node headless device).`,
+      };
+    }
+
+    let sha256: string;
+    let size: number;
+    try {
+      ({ sha256, size } = await hashFile(local));
+    } catch (err) {
+      return {
+        ok: false,
+        text: `Cannot read binary ${local}: ${(err as Error).message}`,
+      };
+    }
+    if (size === 0) return { ok: false, text: `Binary ${local} is empty.` };
+
+    // Default staging path is /tmp on unix nodes (the node re-stages next to
+    // its own executable before the atomic swap, so this is only transient).
+    const remote =
+      typeof remotePath === "string" && remotePath.trim()
+        ? remotePath.trim()
+        : "/tmp/talon-node.update";
+
+    // 1. Stream the new binary to the node.
+    const push = await this.pushFileToDevice(target.id, local, remote);
+    if (!push.ok) {
+      return { ok: false, text: `Update aborted — push failed: ${push.text}` };
+    }
+
+    // 2. Trigger the swap + restart (node verifies the digest first).
+    const dispatched = await this.dispatchCommand(
+      target.id,
+      "update_node",
+      { path: remote, sha256 },
+      this.commandTimeoutMs,
+    );
+    if ("error" in dispatched) return { ok: false, text: dispatched.error };
+    if (!dispatched.result.ok) {
+      return {
+        ok: false,
+        text: dispatched.result.message ?? `${target.name} refused the update.`,
+      };
+    }
+    return {
+      ok: true,
+      text:
+        `Pushed ${formatBytes(size)} and staged the update on ${target.name}. ` +
+        `${dispatched.result.message ?? "Restarting now."} ` +
+        `Confirm with get_device_status once it reconnects (appVersion should change).`,
+    };
+  }
+
   /**
    * Chunked read of a remote file into a Buffer. Loops `read_file` with
    * increasing offsets until the device reports EOF.

package/src/core/tools/mesh.ts

@@ -185,4 +185,25 @@ export const meshTools: ToolDefinition[] = [
     execute: (params, bridge) => bridge("update_device", params),
     tag: "mesh",
   },
+  {
+    name: "update_node",
+    description:
+      "Remotely update a headless talon-node (Linux/macOS/Windows server on the mesh): stream a new node binary from the daemon and have the node verify its hash, atomically swap its own binary, and restart into it. On Linux/macOS this is an in-place execve so the mesh connection returns within seconds; the node re-hashes the pushed file and refuses a truncated or mismatched binary. Build the replacement for the node's platform/arch first (talon-node-<os>-<arch>). Confirm success with get_device_status afterwards (appVersion should change). This is the node counterpart of update_device — use update_device for Android companions.",
+    schema: {
+      device: deviceParam,
+      binary_path: z
+        .string()
+        .describe(
+          "Path to the new talon-node binary, relative to the workspace (or absolute), built for the node's OS/arch.",
+        ),
+      remote_path: z
+        .string()
+        .optional()
+        .describe(
+          "Where to stage the binary on the node (default /tmp/talon-node.update; the node re-stages next to its own executable before the atomic swap).",
+        ),
+    },
+    execute: (params, bridge) => bridge("update_node", params),
+    tag: "mesh",
+  },
 ];

package/src/frontend/native/auth.ts

@@ -0,0 +1,52 @@
+/**
+ * Bridge auth token — the shared secret behind every non-/health route.
+ *
+ * The operator can set one explicitly (`native.token`); this module covers
+ * the case where they didn't but the bridge is about to bind a non-loopback
+ * host. Serving the full agent API unauthenticated to the LAN is never an
+ * acceptable default, so a token is minted once and persisted under
+ * ~/.talon/keys/ — stable across restarts so paired clients keep working.
+ *
+ * The token value itself never goes to the log (SECURITY.md treats
+ * credentials in logs as a vulnerability); same-machine clients pick it up
+ * from the 0600 discovery file, remote clients read it from the key file.
+ */
+
+import { randomBytes } from "node:crypto";
+import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { dirs } from "../../util/paths.js";
+import { log } from "../../util/log.js";
+
+const TOKEN_FILE = "bridge-token";
+/** 32 random bytes → 43 base64url chars; comfortably beyond brute force. */
+const TOKEN_BYTES = 32;
+
+/** Path of the persisted token, for operator-facing messages. */
+export function bridgeTokenPath(dir: string = dirs.keys): string {
+  return resolve(dir, TOKEN_FILE);
+}
+
+/**
+ * Load the persisted auto-generated bridge token, minting it on first use.
+ * Lives under ~/.talon/keys/ with owner-only permissions, like the TLS
+ * identity next to it.
+ */
+export function loadOrCreateBridgeToken(dir: string = dirs.keys): string {
+  const path = bridgeTokenPath(dir);
+  try {
+    const existing = readFileSync(path, "utf-8").trim();
+    if (existing) return existing;
+  } catch {
+    // first boot — nothing persisted yet
+  }
+  const token = randomBytes(TOKEN_BYTES).toString("base64url");
+  mkdirSync(dir, { recursive: true, mode: 0o700 });
+  writeFileSync(path, `${token}\n`, { mode: 0o600 });
+  chmodSync(path, 0o600); // mode above is ignored when the file exists
+  log(
+    "native",
+    `Minted bridge auth token (non-loopback bind with no native.token) — pair remote clients with the value in ${path}`,
+  );
+  return token;
+}

package/src/frontend/native/index.ts

@@ -75,6 +75,7 @@ import { createNativeActionHandler } from "./actions.js";
 import { getMeshService } from "../../core/mesh/index.js";
 import { removeBridgeDiscovery, writeBridgeDiscovery } from "./discovery.js";
 import { isLoopbackHost, loadOrCreateBridgeTlsIdentity } from "./tls.js";
+import { loadOrCreateBridgeToken } from "./auth.js";
 import { readLogEntries } from "./logs.js";
 import {
   BRIDGE_PROTOCOL_VERSION,
@@ -1200,11 +1201,16 @@ export function createNativeFrontend(
   // Encrypted by default the moment the bridge leaves the machine; loopback
   // stays plain HTTP unless explicitly opted in (`native.tls`).
   const bridgeTls = nativeCfg.tls ?? !isLoopbackHost(bridgeHost);
+  // Never serve the agent API to the network unauthenticated: a non-loopback
+  // bind with no configured token gets a persistent auto-minted one instead.
+  const bridgeToken =
+    nativeCfg.token ??
+    (isLoopbackHost(bridgeHost) ? undefined : loadOrCreateBridgeToken());
   const server = new BridgeServer(
     {
       host: bridgeHost,
       port: nativeCfg.port ?? 19880,
-      token: nativeCfg.token,
+      token: bridgeToken,
       startedAt,
       ...(bridgeTls ? { tls: () => loadOrCreateBridgeTlsIdentity() } : {}),
     },
@@ -1274,7 +1280,7 @@ export function createNativeFrontend(
       const fingerprint = server.getFingerprint();
       await writeBridgeDiscovery({
         port: server.getPort(),
-        token: nativeCfg.token,
+        token: bridgeToken,
         scheme: server.getScheme(),
         ...(fingerprint ? { fingerprint } : {}),
         startedAt: Date.parse(startedAt),

package/src/frontend/native/server.ts

@@ -25,7 +25,7 @@ import { createHash, timingSafeEqual } from "node:crypto";
 import { createReadStream } from "node:fs";
 import { stat } from "node:fs/promises";
 import { extname } from "node:path";
-import { log, logError, logDebug } from "../../util/log.js";
+import { log, logError, logDebug, logWarn } from "../../util/log.js";
 import { formatFingerprint, type BridgeTlsIdentity } from "./tls.js";
 import {
   BRIDGE_PROTOCOL_VERSION,
@@ -149,12 +149,32 @@ const MAX_BODY_BYTES = 256 * 1024;
 const MAX_UPLOAD_BYTES = 25 * 1024 * 1024;
 const PORT_FALLBACKS = 5;
 
+// Failed-auth lockout: after this many wrong tokens from one address inside
+// the window, that address gets 429s until the window lapses. The token's
+// 256 bits make brute force hopeless anyway — this is about not letting an
+// internet-facing bridge be hammered for free (and giving fail2ban-style
+// tooling a clean signal in the log). Only *presented-and-wrong* secrets
+// count: tokenless probes are just scanners finding a locked door.
+const AUTH_LOCKOUT_MAX_FAILURES = 20;
+const AUTH_LOCKOUT_WINDOW_MS = 15 * 60 * 1000;
+/** Hard cap on tracked addresses so the map can't become a memory lever. */
+const AUTH_LOCKOUT_MAX_TRACKED = 10_000;
+
+/**
+ * ok: request carries the right token (or none is required).
+ * anonymous: no credential presented — a pre-pairing probe, not an attack.
+ * bad: a credential was presented and it is wrong.
+ */
+type AuthState = "ok" | "anonymous" | "bad";
+
 export class BridgeServer {
   private server: Server | null = null;
   private clients = new Set<ServerResponse>();
   private pingTimer: ReturnType<typeof setInterval> | undefined;
   private port = 0;
   private tlsIdentity: BridgeTlsIdentity | null = null;
+  /** Wrong-token counts per remote address (behind a proxy: per proxy). */
+  private authFailures = new Map<string, { count: number; resetAt: number }>();
 
   constructor(
     private readonly opts: {
@@ -311,21 +331,43 @@ export class BridgeServer {
       return;
     }
 
+    const remote = req.socket.remoteAddress ?? "unknown";
+    if (this.authLockedOut(remote)) {
+      res.writeHead(429, {
+        ...this.jsonHeaders(),
+        "Retry-After": String(Math.ceil(AUTH_LOCKOUT_WINDOW_MS / 1000)),
+      });
+      res.end(
+        JSON.stringify({ ok: false, error: "Too many failed auth attempts" }),
+      );
+      return;
+    }
+
+    const auth = this.authState(req, url);
+    if (auth === "bad") this.recordAuthFailure(remote);
+    else if (auth === "ok") this.authFailures.delete(remote);
+
     // /health is unauthenticated so clients can discover/ping the bridge
-    // before they hold a token. It exposes no chat content.
+    // before they hold a token. Pre-auth it serves only what pairing needs
+    // (identity, protocol, fingerprint) — operational details like bot name,
+    // backend, and chat count are not for internet scanners to enumerate.
     if (method === "GET" && path === "/health") {
-      const s = this.handlers.status();
-      return this.json(res, 200, {
+      const base = {
         app: "talon-bridge",
         ok: true,
         protocol: BRIDGE_PROTOCOL_VERSION,
-        host: this.opts.host,
         port: this.port,
         scheme: this.getScheme(),
         // The certificate's own hash — public by definition (any TLS client
         // sees the certificate), surfaced so pairing UIs can display it.
         fingerprint: this.getFingerprint(),
         authRequired: Boolean(this.opts.token),
+      };
+      if (auth !== "ok") return this.json(res, 200, base);
+      const s = this.handlers.status();
+      return this.json(res, 200, {
+        ...base,
+        host: this.opts.host,
         startedAt: this.opts.startedAt,
         botName: s.botName,
         backend: s.backend,
@@ -335,7 +377,7 @@ export class BridgeServer {
       });
     }
 
-    if (!this.authOk(req, url)) {
+    if (auth !== "ok") {
       return this.json(res, 401, { ok: false, error: "Unauthorized" });
     }
 
@@ -677,17 +719,54 @@ export class BridgeServer {
 
   // ── Helpers ──────────────────────────────────────────────────────────────
 
-  private authOk(req: IncomingMessage, url: URL): boolean {
-    if (!this.opts.token) return true;
+  private authState(req: IncomingMessage, url: URL): AuthState {
+    if (!this.opts.token) return "ok";
     const header = req.headers["authorization"];
-    if (
-      typeof header === "string" &&
-      header.startsWith("Bearer ") &&
-      this.tokenMatches(header.slice("Bearer ".length))
-    )
-      return true;
+    const fromHeader =
+      typeof header === "string" && header.startsWith("Bearer ")
+        ? header.slice("Bearer ".length)
+        : null;
     // EventSource can't set headers, so SSE clients pass ?token=… instead.
-    return this.tokenMatches(url.searchParams.get("token"));
+    const candidate = fromHeader ?? url.searchParams.get("token");
+    if (candidate === null) return "anonymous";
+    return this.tokenMatches(candidate) ? "ok" : "bad";
+  }
+
+  private authLockedOut(remote: string): boolean {
+    const entry = this.authFailures.get(remote);
+    if (!entry) return false;
+    if (Date.now() >= entry.resetAt) {
+      this.authFailures.delete(remote);
+      return false;
+    }
+    return entry.count >= AUTH_LOCKOUT_MAX_FAILURES;
+  }
+
+  private recordAuthFailure(remote: string): void {
+    const now = Date.now();
+    const entry = this.authFailures.get(remote);
+    if (!entry || now >= entry.resetAt) {
+      if (this.authFailures.size >= AUTH_LOCKOUT_MAX_TRACKED) {
+        for (const [ip, e] of this.authFailures) {
+          if (now >= e.resetAt) this.authFailures.delete(ip);
+        }
+        // Still saturated after pruning live entries — under that much churn
+        // dropping the newest attacker beats unbounded growth.
+        if (this.authFailures.size >= AUTH_LOCKOUT_MAX_TRACKED) return;
+      }
+      this.authFailures.set(remote, {
+        count: 1,
+        resetAt: now + AUTH_LOCKOUT_WINDOW_MS,
+      });
+      return;
+    }
+    entry.count++;
+    if (entry.count === AUTH_LOCKOUT_MAX_FAILURES) {
+      logWarn(
+        "native",
+        `Bridge auth lockout for ${remote} (${AUTH_LOCKOUT_MAX_FAILURES} wrong tokens in ${AUTH_LOCKOUT_WINDOW_MS / 60_000}m)`,
+      );
+    }
   }
 
   /**
@@ -708,6 +787,8 @@ export class BridgeServer {
       "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
       "Access-Control-Allow-Headers": "Authorization, Content-Type",
       "Access-Control-Max-Age": "86400",
+      // Every response states its type; never let a browser guess one.
+      "X-Content-Type-Options": "nosniff",
     };
   }
 

package/src/frontend/telegram/commands/admin.ts

@@ -211,7 +211,7 @@ export function registerAdminCommands(
   }
 
   // Unknown /command → "did you mean ...?" via the C similarity core
-  // (native/strsim-c). Registered after every real command, so grammY
+  // (native/strsim-wasm). Registered after every real command, so grammY
   // only reaches this when nothing above matched. Only bare commands
   // are intercepted — a close miss gets a suggestion, anything else
   // keeps flowing to the agent as a normal message.

package/src/frontend/telegram/formatting.ts

@@ -18,7 +18,7 @@ export function splitMessage(text: string, max: number): string[] {
 /**
  * Escape HTML special characters for Telegram HTML parse mode.
  * Must be applied to all text that is NOT inside an HTML tag.
- * Delegates to the C++ core (native/htmlents-cpp): one pass over the
+ * Delegates to the Rust core (native/htmlents-wasm): one pass over the
  * bytes instead of the five chained regex passes this replaces.
  */
 export function escapeHtml(text: string): string {

package/src/native/htmlents-wasm-bytes.ts

@@ -1,7 +1,7 @@
 // Generated by native/shared/build-lib.mjs — do not edit by hand.
-// Rebuild with `npm run build:cpp` after changing the source.
-// Source: native/htmlents-cpp (1448 bytes of wasm32-freestanding).
+// Rebuild with `npm run build:wasm` after changing the source.
+// Source: native/htmlents-wasm (1195 bytes of wasm32-unknown-unknown).
 
-/** native/htmlents-cpp artifact, base64-encoded. Decoded + instantiated lazily by src/native/htmlents.ts. */
+/** native/htmlents-wasm artifact, base64-encoded. Decoded + instantiated lazily by src/native/htmlents.ts. */
 export const HTMLENTS_WASM_BASE64 =
-  "AGFzbQEAAAABEQNgAX8Bf2ACf38AYAJ/fwF/AwQDAAECBAUBcAEBAQUDAQARBgkBfwFBgIDAAAsHKgQGbWVtb3J5AgAFYWxsb2MAAAdkZWFsbG9jAAELZXNjYXBlX2h0bWwAAgruCQOPAQEDfwJAIAANAEEADwtBACEBQQBBACgCyIDAgAAiAkHQgMCAACACG0EHakF4cSICNgLIgMCAAAJAIAIgAGoiACACSQ0AAkAgAD8AQRB0IgNNDQAgACADa0H//wNqQRB2QABBf0YNAQtBACAANgLIgMCAAEEAQQAoAsyAwIAAQQFqNgLMgMCAACACIQELIAELQAACQCAARQ0AIAFFDQBBACgCzIDAgAAiAEUNAEEAIABBf2oiADYCzIDAgAAgAA0AQQBB0IDAgAA2AsiAwIAACwuZCAEJf0EAIQICQAJAIAENAEEMIQNBACEEDAELIAFBAXEhBQJAAkAgAUEBRw0AQQAhBEEAIQMMAQsgAUF+cSEGQQAhBEEAIQMDQEGAgMCAACEHQQEhCEEBIQkCQAJAAkACQAJAAkAgACADaiIKLQAAQV5qDh0CBQUFBAMFBQUFBQUFBQUFBQUFBQUFBQUFBQAFAQULQaiAwIAAIQcMAwtBsIDAgAAhBwwCC0G4gMCAACEHDAELQcCAwIAAIQcLIAcoAgQhCQsgCSAEaiEHQYCAwIAAIQkCQAJAAkACQAJAAkAgCkEBai0AAEFeag4dAQUFBQQABQUFBQUFBQUFBQUFBQUFBQUFBQUDBQIFC0HAgMCAACEJDAMLQbiAwIAAIQkMAgtBsIDAgAAhCQwBC0GogMCAACEJCyAJKAIEIQgLIAggB2ohBCAGIANBAmoiA0cNAAsLAkAgBUUNAEGAgMCAACEJQQEhCAJAAkACQAJAAkACQCAAIANqLQAAQV5qDh0BBQUFBAAFBQUFBQUFBQUFBQUFBQUFBQUFBQMFAgULQcCAwIAAIQkMAwtBuIDAgAAhCQwCC0GwgMCAACEJDAELQaiAwIAAIQkLIAkoAgQhCAsgCCAEaiEECyAEQQxqIgMNAEEADwtBAEEAKALIgMCAACIIQdCAwIAAIAgbQQdqQXhxIgU2AsiAwIAAAkAgBSADaiIIIAVJDQACQCAIPwBBEHQiCU0NACAIIAlrQf//A2pBEHZAAEF/Rg0BC0EAIQJBACAINgLIgMCAAEEAQQAoAsyAwIAAQQFqNgLMgMCAACAFRQ0AIAUgBDoACCAFQQE2AgQgBSADOgAAIAUgBEEYdjoACyAFIARBEHY6AAogBSAEQQh2OgAJIAUgA0EYdjoAAyAFIANBEHY6AAIgBSADQQh2OgABAkAgAUUNACAFQQxqIQNBACECA0BBgIDAgAAhCAJAAkACQAJAAkACQAJAIAAgAmotAAAiCUFeag4dAgUFBQQDBQUFBQUFBQUFBQUFBQUFBQUFBQUABQEFC0GogMCAACEIDAMLQbCAwIAAIQgMAgtBuIDAgAAhCAwBC0HAgMCAACEICyAIKAIEIglFDQEgCUEDcSEEIAgoAgAhCkEAIQgCQCAJQQRJDQAgCUF8cSEGQQAhCANAIAMgCGoiCSAKIAhqIgctAAA6AAAgCUEBaiAHQQFqLQAAOgAAIAlBAmogB0ECai0AADoAACAJQQNqIAdBA2otAAA6AAAgBiAIQQRqIghHDQALIAMgCGohAwsgBEUNASAKIAhqIQgDQCADIAgtAAA6AAAgCEEBaiEIIANBAWohAyAEQX9qIgQNAAwCCwsgAyAJOgAAIANBAWohAwsgAkEBaiICIAFHDQALCyAFIQILIAILC1EBAEGAgMAAC0gZABAABQAAACZxdW90OwAmbHQ7ACZndDsAJmFtcDsAJiMzOTsAAAAADwAQAAQAAAAUABAABAAAAAgAEAAGAAAAHwAQAAUAAAA=";
+  "AGFzbQEAAAABKQdgBX9/f39/AGADf39/AGACf38AYAR/f39/AGABfwF/YAJ/fwF/YAAAAwsKAAECAwIEAgUCBgUDAQARBhkDfwFBgIDAAAt/AEGggMAAC38AQaCAwAALB0UGBm1lbW9yeQIABWFsbG9jAAULX19oZWFwX2Jhc2UDAQdkZWFsbG9jAAYLZXNjYXBlX2h0bWwABwpfX2RhdGFfZW5kAwIK3gcKNQACQCACIAFJDQAgAiAESw0AIAAgAiABazYCBCAAIAMgAWo2AgAPCyABIAIgBBCBgICAAAALCQAQiYCAgAAAC40BAQJ/QQAhAgJAAkACQAJAAkACQAJAAkAgAUH/AXEiAUFeag4GBAcHBwEFAAsgAUFEag4DAQYCBgtBgIDAgAAhAgwEC0GFgMCAACECQQQhAwwEC0GJgMCAACECQQQhAwwDC0GNgMCAACECQQYhAwwCC0GTgMCAACECC0EFIQMLIAAgAzYCBCAAIAI2AgALKgACQCABIANHDQACQCABRQ0AIAAgAiAB/AoAAAsPCyABIAMQhICAgAAACwkAEImAgIAAAAuiAQEDfwJAIAANAEEADwtBACEBAkBBACgCmIDAgAAiAg0AQaCAwIAAIQJBAEGggMCAADYCmIDAgAALAkACQCACQQdqQXhxIgIgAGoiACACSQ0AIAA/AEEQdCIDTQ0BQQAhASAAIANrQRB2IABB//8DcUEAR2pAAEF/Rw0BCyABDwtBACAANgKYgMCAAEEAQQAoApyAwIAAQQFqNgKcgMCAACACC0AAAkAgAEUNACABRQ0AQQAoApyAwIAAIgBFDQBBACAAQX9qIgA2ApyAwIAAIAANAEEAQaCAwIAANgKYgMCAAAsL5AMBB38jgICAgABBwABrIgIkgICAgABBACEDQQAhBAJAIAFFDQBBACEEIAAhBSABIQYDQCACQTBqIAUtAAAQgoCAgAAgAigCNEEBIAIoAjAbIARqIQQgBUEBaiEFIAZBf2oiBg0ACwtBDCEFAkAgBEEMaiIHEIWAgIAAIghFDQAgAEEBIAEbIQYgAkEoakEAQQQgCCAHEICAgIAAIAIoAiwhAyACKAIoIQAgAiAHNgI8IAAgAyACQTxqQQQQg4CAgAAgAkEgakEEQQggCCAHEICAgIAAIAIoAiQhAyACKAIgIQAgAkEBNgI8IAAgAyACQTxqQQQQg4CAgAAgAkEYakEIQQwgCCAHEICAgIAAIAIoAhwhAyACKAIYIQAgAiAENgI8IAAgAyACQTxqQQQQg4CAgAADQAJAAkACQCABRQ0AIAJBEGogBi0AACIDEIKAgIAAIAIoAhAiBEUNASACQQhqIAUgAigCFCIDIAVqIgAgCCAHEICAgIAAIAIoAgggAigCDCAEIAMQg4CAgAAgACEFDAILIAghAwwDCwJAIAUgB08NACAIIAVqIAM6AAAgBUEBaiEFDAELIAUgBxCIgICAAAALIAZBAWohBiABQX9qIQEMAAsLIAJBwABqJICAgIAAIAMLCQAQiYCAgAAACwMAAAsLIQEAQYCAwAALGCZhbXA7Jmx0OyZndDsmcXVvdDsmIzM5Ow==";

package/src/native/htmlents.ts

@@ -1,10 +1,10 @@
 /**
- * HTML entity escaping — TypeScript boundary over the C++ wasm module.
+ * HTML entity escaping — TypeScript boundary over the Rust wasm module.
  *
  * One single-pass escaper for Telegram HTML parse mode, replacing the
  * five chained regex passes it supersedes. Every outbound Telegram
- * render flows through here (frontend/telegram/formatting.ts). The C++
- * source lives in native/htmlents-cpp and exports a three-function
+ * render flows through here (frontend/telegram/formatting.ts). The Rust
+ * source lives in native/htmlents-wasm and exports a three-function
  * C ABI (alloc / dealloc / escape_html) — see that module's README for
  * the contract, and src/native/runtime.ts for the embedding and memory
  * conventions shared by every native module.
@@ -24,7 +24,7 @@ import {
   type WasmCoreExports,
 } from "./runtime.js";
 
-/** The C-ABI surface exported by native/htmlents-cpp. */
+/** The C-ABI surface exported by native/htmlents-wasm. */
 interface HtmlentsExports extends WasmCoreExports {
   escape_html(inputPtr: number, len: number): number;
 }

package/src/native/registry.ts

@@ -75,9 +75,9 @@ export const NATIVE_MODULES: readonly NativeModuleSpec[] = [
   },
   {
     name: "strsim",
-    language: "C",
-    target: "wasm32-freestanding",
-    sourceDir: "native/strsim-c",
+    language: "Rust",
+    target: "wasm32-unknown-unknown",
+    sourceDir: "native/strsim-wasm",
     sizeBytes: async () =>
       base64ByteLength(
         (await import("./strsim-wasm-bytes.js")).STRSIM_WASM_BASE64,
@@ -90,9 +90,9 @@ export const NATIVE_MODULES: readonly NativeModuleSpec[] = [
   },
   {
     name: "sqlguard",
-    language: "C",
-    target: "wasm32-freestanding",
-    sourceDir: "native/sqlguard-c",
+    language: "Rust",
+    target: "wasm32-unknown-unknown",
+    sourceDir: "native/sqlguard-wasm",
     sizeBytes: async () =>
       base64ByteLength(
         (await import("./sqlguard-wasm-bytes.js")).SQLGUARD_WASM_BASE64,
@@ -107,9 +107,9 @@ export const NATIVE_MODULES: readonly NativeModuleSpec[] = [
   },
   {
     name: "htmlents",
-    language: "C++",
-    target: "wasm32-freestanding",
-    sourceDir: "native/htmlents-cpp",
+    language: "Rust",
+    target: "wasm32-unknown-unknown",
+    sourceDir: "native/htmlents-wasm",
     sizeBytes: async () =>
       base64ByteLength(
         (await import("./htmlents-wasm-bytes.js")).HTMLENTS_WASM_BASE64,

package/src/native/runtime.ts

@@ -2,8 +2,8 @@
  * Embedded-wasm runtime — the one place that knows how Talon's native
  * modules cross the JS boundary.
  *
- * Every wasm module in the native plane (Rust blake3, Zig textops,
- * C strsim, C++ htmlents) follows the same contract:
+ * Every wasm module in the native plane (Rust blake3, strsim,
+ * sqlguard, htmlents; Zig textops) follows the same contract:
  *
  *   - The artifact ships as base64 inside a generated `*-bytes.ts`
  *     module, so it survives `bun build --compile` single binaries —

package/src/native/sqlguard-wasm-bytes.ts

@@ -1,7 +1,7 @@
 // Generated by native/shared/build-lib.mjs — do not edit by hand.
-// Rebuild with `npm run build:c` after changing the source.
-// Source: native/sqlguard-c (2252 bytes of wasm32-freestanding).
+// Rebuild with `npm run build:wasm` after changing the source.
+// Source: native/sqlguard-wasm (1805 bytes of wasm32-unknown-unknown).
 
-/** native/sqlguard-c artifact, base64-encoded. Decoded + instantiated lazily by src/native/sqlguard.ts. */
+/** native/sqlguard-wasm artifact, base64-encoded. Decoded + instantiated lazily by src/native/sqlguard.ts. */
 export const SQLGUARD_WASM_BASE64 =
-  "AGFzbQEAAAABGARgAX8Bf2ACf38AYAJ/fwF/YAN/f38BfwMGBQABAgIDBAUBcAEBAQUDAQARBgkBfwFBgIDAAAsHNgUGbWVtb3J5AgAFYWxsb2MAAAdkZWFsbG9jAAELZXNjYXBlX2xpa2UAAglmdHNfcXVvdGUAAwrQEAWPAQEDfwJAIAANAEEADwtBACEBQQBBACgCgIDAgAAiAkGQgMCAACACG0EHakF4cSICNgKAgMCAAAJAIAIgAGoiACACSQ0AAkAgAD8AQRB0IgNNDQAgACADa0H//wNqQRB2QABBf0YNAQtBACAANgKAgMCAAEEAQQAoAoSAwIAAQQFqNgKEgMCAACACIQELIAELQAACQCAARQ0AIAFFDQBBACgChIDAgAAiAEUNAEEAIABBf2oiADYChIDAgAAgAA0AQQBBkIDAgAA2AoCAwIAACwuFBwEIf0EAIQICQAJAIAENAEEMIQNBACEEDAELIAFBAXEhBQJAAkAgAUEBRw0AQQAhBEEAIQMMAQsgAUF+cSEGQQAhBEEAIQMDQEECIQcCQCAAIANqIggtAAAiCUElRg0AQQIhByAJQdwARg0AQQJBASAJQd8ARhshBwsgByAEaiEEQQIhBwJAIAhBAWotAAAiCEElRg0AIAhB3ABGDQBBAkEBIAhB3wBGGyEHCyAHIARqIQQgBiADQQJqIgNHDQALCwJAIAVFDQBBAiEHAkAgACADai0AACIDQSVGDQAgA0HcAEYNAEECQQEgA0HfAEYbIQcLIAcgBGohBAsgBEEMaiIDDQBBAA8LQQBBACgCgIDAgAAiB0GQgMCAACAHG0EHakF4cSIGNgKAgMCAAAJAIAYgA2oiByAGSQ0AAkAgBz8AQRB0IghNDQAgByAIa0H//wNqQRB2QABBf0YNAQtBACECQQAgBzYCgIDAgABBAEEAKAKEgMCAAEEBajYChIDAgAAgBkUNACAGIAQ6AAggBkEBNgIEIAYgAzoAACAGIARBGHY6AAsgBiAEQRB2OgAKIAYgBEEIdjoACSAGIANBGHY6AAMgBiADQRB2OgACIAYgA0EIdjoAAQJAIAFFDQAgAUEDcSEJIAZBDGohA0EAIQgCQCABQQRJDQAgAUF8cSECQQAhCANAAkACQAJAIAAgCGoiBC0AACIHQaR/ag4EAQICAQALIAdBJUcNAQsgA0HcADoAACADQQFqIQMLIAMgBzoAACADQQFqIQcCQAJAAkAgBEEBai0AACIBQaR/ag4EAQICAQALIAFBJUcNAQsgA0HcADoAASADQQJqIQcLIAcgAToAACAHQQFqIQMCQAJAAkAgBEECai0AACIBQaR/ag4EAQICAQALIAFBJUcNAQsgB0HcADoAASAHQQJqIQMLIAMgAToAACADQQFqIQcCQAJAAkAgBEEDai0AACIEQaR/ag4EAQICAQALIARBJUcNAQsgA0HcADoAASADQQJqIQcLIAcgBDoAACAHQQFqIQMgAiAIQQRqIghHDQALCyAJRQ0AIAAgCGohBwNAAkACQAJAIActAAAiBEGkf2oOBAECAgEACyAEQSVHDQELIANB3AA6AAAgA0EBaiEDCyADIAQ6AAAgB0EBaiEHIANBAWohAyAJQX9qIgkNAAsLIAYhAgsgAgvuBAEGf0EAIQICQAJAIAENAEEMIQNBACEEDAELQQAhBEEAIQVBACEDAkADQAJAAkAgACADIAEQhICAgAAiBkUNACAGIANqIQMMAQsgBUEBaiEGIAQgBUEAR2pBAmohBAJAIAMgAU8NAANAIAAgAyABEISAgIAADQFBAkEBIAAgA2otAABBIkYbIARqIQQgASADQQFqIgNGDQQMAAsLIAYhBQsgAyABSQ0ACwsgBEEMaiIDDQBBAA8LQQBBACgCgIDAgAAiBkGQgMCAACAGG0EHakF4cSIHNgKAgMCAAAJAIAcgA2oiBiAHSQ0AAkAgBj8AQRB0IgVNDQAgBiAFa0H//wNqQRB2QABBf0YNAQtBACECQQAgBjYCgIDAgABBAEEAKAKEgMCAAEEBajYChIDAgAAgB0UNACAHIAQ6AAggB0EBNgIEIAcgAzoAACAHIARBGHY6AAsgByAEQRB2OgAKIAcgBEEIdjoACSAHIANBGHY6AAMgByADQRB2OgACIAcgA0EIdjoAAQJAIAFFDQAgB0EMaiEEQQAhAkEAIQMDQAJAAkAgACADIAEQhICAgAAiBkUNACAGIANqIQMMAQsCQCACRQ0AIARBIDoAACAEQQFqIQQLIARBIjoAACAEQQFqIQQCQCADIAFPDQADQCAAIAMgARCEgICAAA0BAkACQCAAIANqLQAAIgVBIkYNACAEQQFqIQYMAQsgBEEiOgABIARBAmohBgsgBCAFOgAAIAYhBCABIANBAWoiA0cNAAsgBiEEIAEhAwsgAkEBaiECIARBIjoAACAEQQFqIQQLIAMgAUkNAAsLIAchAgsgAguEAwEDfwJAIAAgAWoiAy0AACIEQXdqIgVBF0sNAEEBIAV0QZ+AgARxRQ0AQQEPCwJAAkACQAJAAkACQAJAAkAgBEG+fmoOLgAHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcBAgMHBwcHBwcHBwcHBwQHCyABQQFqIgEgAk8NBiAAIAFqLQAAQaABRw0GQQIPCyABQQJqIgEgAk8NBSADQQFqLQAAQZoBRw0FIAAgAWotAABBgAFHDQUMAwsgAUECaiIBIAJPDQQCQAJAIANBAWotAABBgH9qDgIAAQYLQQMhBSAAIAFqLAAAIgFBi39IDQQgAUH/AXFB2H5qIgFBB0sNBUEBIAF0QYMBcQ0EDAULIAAgAWotAABBnwFHDQQMAgsgAUECaiIBIAJPDQMgA0EBai0AAEGAAUcNAyAAIAFqLQAAQYABRw0DDAELIAFBAmoiASACTw0CIANBAWotAABBuwFHDQIgACABai0AAEG/AUcNAgtBAyEFCyAFDwtBAAs=";
+  "AGFzbQEAAAABJQdgAn9/AGABfwF/YAN/f38AYAN/f38Bf2ABfwBgAn9/AX9gAAADCwoAAQIDAAQABQUGBQMBABEGGQN/AUGAgMAAC38AQZCAwAALfwBBiIDAAAsHUQcGbWVtb3J5AgAFYWxsb2MAAQtfX2hlYXBfYmFzZQMBB2RlYWxsb2MABgtlc2NhcGVfbGlrZQAHCWZ0c19xdW90ZQAICl9fZGF0YV9lbmQDAgrbDApnAQJ/AkACQCABQQxqIgIQgYCAgAAiAw0AQQAhAgwBCyADQQQgAhCCgICAAEEBIQIgA0EEakEEQQEQgoCAgAAgA0EIakEEIAEQgoCAgAAgACADQQxqNgIIIAAgAzYCBAsgACACNgIAC6IBAQN/AkAgAA0AQQAPC0EAIQECQEEAKAKAgMCAACICDQBBkIDAgAAhAkEAQZCAwIAANgKAgMCAAAsCQAJAIAJBB2pBeHEiAiAAaiIAIAJJDQAgAD8AQRB0IgNNDQFBACEBIAAgA2tBEHYgAEH//wNxQQBHakAAQX9HDQELIAEPC0EAIAA2AoCAwIAAQQBBACgChIDAgABBAWo2AoSAwIAAIAILHAACQCABQQRGDQAgARCFgICAAAALIAAgAjYAAAvsAgEDfwJAAkAgAiABTw0AQQEhAwJAIAAgAmoiBC0AACIFQXdqQf8BcUEFSQ0AAkACQAJAAkACQAJAIAVBn35qDgMBAgMACyAFQSBGDQUgBUHvAUYNAyAFQcIBRw0HIAJBAWoiAiABTw0HIAAgAmotAABBoAFHDQdBAg8LIAJBAmoiAiABTw0GIAQtAAFBmgFHDQYgACACai0AAEGAAUcNBgwDCyACQQJqIgIgAU8NBQJAAkAgBC0AAUGAf2oOAgABBwtBAyEDIAAgAmosAAAiAkGLf0gNBCACQf8BcUHYfmoiAkEHSw0GQQEgAnRBgwFxRQ0GDAQLIAAgAmotAABBnwFHDQUMAgsgAkECaiICIAFPDQQgBC0AAUGAAUcNBCAAIAJqLQAAQYABRg0BDAQLIAJBAmoiAiABTw0DIAQtAAFBuwFHDQMgACACai0AAEG/AUcNAwtBAyEDCyADDwsgAiABEISAgIAAAAtBAAsJABCJgICAAAALCQAQiYCAgAAAC0AAAkAgAEUNACABRQ0AQQAoAoSAwIAAIgBFDQBBACAAQX9qIgA2AoSAwIAAIAANAEEAQZCAwIAANgKAgMCAAAsLrwIBBn8jgICAgABBEGsiAiSAgICAACAAQQEgARshA0EAIQQCQCABRQ0AIAMhACABIQUDQEECIQYCQAJAAkAgAC0AACIHQaR/ag4EAgEBAgALIAdBJUYNAQtBASEGCyAAQQFqIQAgBiAEaiEEIAVBf2oiBQ0ACwsgAkEEaiAEEICAgIAAAkACQCACKAIEQQFHDQAgAigCDCEFIAIoAgghB0EAIQADQCABRQ0CAkACQAJAAkAgAy0AACIGQaR/ag4EAQICAQALIAZBJUcNAQsgACAETw0BIAUgAGpB3AA6AAAgAEEBaiEACyAAIARPDQAgA0EBaiEDIAUgAGogBjoAACABQX9qIQEgAEEBaiEADAELCyAAIAQQhICAgAAAC0EAIQcLIAJBEGokgICAgAAgBwu3BAELfyOAgICAAEEQayICJICAgIAAIABBASABGyEDQQAhBEEAIQVBACEGAkACQAJAA0ACQCAEIgcgAUkNACACQQRqIAYQgICAgAAgAigCBEUNAyACKAIMIQggAigCCCEJQQAhCkEAIQVBACELA0AgCyIHIAFPDQUgACABIAcQg4CAgAAiBCAHaiELIAQNAAJAIApFDQAgBSAGTw0EIAggBWpBIDoAACAFQQFqIQULIAUgBk8NAyAKQQFqIQogCCAFakEiOgAAIAVBAWohBANAAkACQAJAAkACQAJAIAEgB0cNACABIQsMAQsgAyABIAcQg4CAgABFDQEgByELCyAEIAZPDQEgCCAEakEiOgAAIARBAWohBQwFCwJAIAMgB2otAAAiC0EiRg0AIAQgBk8NAUEBIQwgBCEFDAMLIAQgBkkNAQsgBCAGEISAgIAAAAtBIiELIAggBGpBIjoAAAJAIARBAWoiBSAGTw0AQQIhDAwBCyAFIAYQhICAgAAACyAIIAVqIAs6AAAgB0EBaiEHIAQgDGohBAwACwsLIAAgASAHEIOAgIAAIgsgB2ohBCALDQAgBUEBaiELIAYgBUEAR2pBAmohBgNAAkAgASAHRw0AIAEhBCALIQUMAgsCQCADIAEgBxCDgICAAEUNACAHIQQgCyEFDAILQQJBASADIAdqLQAAQSJGGyAGaiEGIAdBAWohBwwACwsLIAUgBhCEgICAAAALQQAhCQsgAkEQaiSAgICAACAJCwMAAAs=";

package/src/native/sqlguard.ts

@@ -6,7 +6,7 @@
  * pattern for a LIKE search (get_user_messages), and `ftsQuote` turns
  * free-form text into a literal FTS5 MATCH expression (search_history).
  *
- * The C source lives in native/sqlguard-c and exports a four-function
+ * The Rust source lives in native/sqlguard-wasm and exports a four-function
  * C ABI (alloc / dealloc / escape_like / fts_quote) — see that module's
  * README for the contract, and src/native/runtime.ts for the embedding
  * and memory conventions shared by every native module.
@@ -27,7 +27,7 @@ import {
 } from "./runtime.js";
 import { SQLGUARD_WASM_BASE64 } from "./sqlguard-wasm-bytes.js";
 
-/** The C-ABI surface exported by native/sqlguard-c. */
+/** The C-ABI surface exported by native/sqlguard-wasm. */
 interface SqlguardExports extends WasmCoreExports {
   escape_like(inputPtr: number, len: number): number;
   fts_quote(inputPtr: number, len: number): number;

package/src/native/strsim-wasm-bytes.ts

@@ -1,7 +1,7 @@
 // Generated by native/shared/build-lib.mjs — do not edit by hand.
-// Rebuild with `npm run build:c` after changing the source.
-// Source: native/strsim-c (775 bytes of wasm32-freestanding).
+// Rebuild with `npm run build:wasm` after changing the source.
+// Source: native/strsim-wasm (725 bytes of wasm32-unknown-unknown).
 
-/** native/strsim-c artifact, base64-encoded. Decoded + instantiated lazily by src/native/strsim.ts. */
+/** native/strsim-wasm artifact, base64-encoded. Decoded + instantiated lazily by src/native/strsim.ts. */
 export const STRSIM_WASM_BASE64 =
-  "AGFzbQEAAAABEwNgAX8Bf2ACf38AYAR/f39/AX8DBAMAAQIEBQFwAQEBBQMBABEGCQF/AUGAgMAACwcqBAZtZW1vcnkCAAVhbGxvYwAAB2RlYWxsb2MAAQtsZXZlbnNodGVpbgACCp4FA48BAQN/AkAgAA0AQQAPC0EAIQFBAEEAKAKAgMCAACICQaCgwIAAIAIbQQdqQXhxIgI2AoCAwIAAAkAgAiAAaiIAIAJJDQACQCAAPwBBEHQiA00NACAAIANrQf//A2pBEHZAAEF/Rg0BC0EAIAA2AoCAwIAAQQBBACgChIDAgABBAWo2AoSAwIAAIAIhAQsgAQtAAAJAIABFDQAgAUUNAEEAKAKEgMCAACIARQ0AQQAgAEF/aiIANgKEgMCAACAADQBBAEGgoMCAADYCgIDAgAALC8kDAQl/QX8hBAJAIAFBgAhLDQAgA0GACEsNAAJAIAENACADDwsCQCADDQAgAQ8LIANBAWoiBUEHcSEGQQAhBAJAIANBB0kNACAFQfgfcSEHQQAhBEGQgMCAACEFA0AgBSAENgIAIAVBHGogBEEHajYCACAFQRhqIARBBmo2AgAgBUEUaiAEQQVqNgIAIAVBEGogBEEEajYCACAFQQxqIARBA2o2AgAgBUEIaiAEQQJqNgIAIAVBBGogBEEBajYCACAFQSBqIQUgBEEIaiIEIAdHDQALCwJAIAZFDQAgBEECdEGQgMCAAGohBQNAIAUgBDYCACAFQQRqIQUgBEEBaiEEIAZBf2oiBg0ACwsgAEF/aiEIQQAoApCAwIAAIQZBASEFA0BBlIDAgAAhBCAIIAUiCWotAABB/wFxIQogAyEHIAIhBSAJIQADQCAEIABBAWoiACAEKAIAIgtBAWoiDCAGIAogBS0AAEdqIgYgDCAGSRsiBiAAIAZJGyIANgIAIARBBGohBCAFQQFqIQUgCyEGIAdBf2oiBw0ACyAJQQFqIQUgCSEGIAkgAUcNAAtBACAJNgKQgMCAACADQQJ0KAKQgMCAACEECyAECw==";
+  "AGFzbQEAAAABFgRgAX8Bf2ACf38AYAR/f39/AX9gAAADBgUAAQIBAwUDAQARBhkDfwFBgIDAAAt/AEGQoMAAC38AQYygwAALB0UGBm1lbW9yeQIABWFsbG9jAAALX19oZWFwX2Jhc2UDAQdkZWFsbG9jAAELbGV2ZW5zaHRlaW4AAgpfX2RhdGFfZW5kAwIKwwQFogEBA38CQCAADQBBAA8LQQAhAQJAQQAoAoSgwIAAIgINAEGQoMCAACECQQBBkKDAgAA2AoSgwIAACwJAAkAgAkEHakF4cSICIABqIgAgAkkNACAAPwBBEHQiA00NAUEAIQEgACADa0EQdiAAQf//A3FBAEdqQABBf0cNAQsgAQ8LQQAgADYChKDAgABBAEEAKAKIoMCAAEEBajYCiKDAgAAgAgtAAAJAIABFDQAgAUUNAEEAKAKIoMCAACIARQ0AQQAgAEF/aiIANgKIoMCAACAADQBBAEGQoMCAADYChKDAgAALC80CAQl/QX8hBAJAIAFBgAhLDQAgA0GACEsNAAJAIAENACADDwsCQCADDQAgAQ8LIANBAWohBUEAIQRBgIDAgAAhBgJAA0AgBSAERg0BIAYgBDYCACAGQQRqIQYgBEEBaiEEDAALCyAAIAFqIQdBACEIQQAoAoCAwIAAIQUCQANAIAAgB0YNASAALQAAIQFBACEEQQAgCEEBaiIINgKAgMCAACAAQQFqIQBBhIDAgAAhBiABQf8BcSEJIAghAQNAIAIgBGohCgJAIAMgBEcNACAIIQUMAgsgBEEBaiELAkAgBEGACEcNACALQYEIEIOAgIAAAAsgBiABQQFqIgQgBigCACIMQQFqIgEgBSAJIAotAABHaiIFIAEgBUkbIgUgBCAFSRsiATYCACAGQQRqIQYgCyEEIAwhBQwACwsLIANBAnQoAoCAwIAAIQQLIAQLCQAQhICAgAAACwMAAAs=";

package/src/native/strsim.ts

@@ -2,8 +2,8 @@
  * String similarity — TypeScript boundary over the C wasm module.
  *
  * Powers "did you mean ...?" suggestions for unknown Telegram slash
- * commands and unknown CLI subcommands. The C source lives in
- * native/strsim-c and exports a three-function C ABI (alloc / dealloc /
+ * commands and unknown CLI subcommands. The Rust source lives in
+ * native/strsim-wasm and exports a three-function C ABI (alloc / dealloc /
  * levenshtein) — see that module's README for the contract, and
  * src/native/runtime.ts for the embedding and memory conventions
  * shared by every native module.
@@ -29,7 +29,7 @@ import {
 /** Returned by the wasm side when either input exceeds its DP buffer. */
 const OVERFLOW = 0xffffffff;
 
-/** The C-ABI surface exported by native/strsim-c. */
+/** The C-ABI surface exported by native/strsim-wasm. */
 interface StrsimExports extends WasmCoreExports {
   levenshtein(aPtr: number, aLen: number, bPtr: number, bLen: number): number;
 }

package/src/storage/history.ts

@@ -155,7 +155,7 @@ export function getRecentFormatted(chatId: string, limit = 20): string {
  * Build an FTS5 MATCH expression from free-form user input. Every
  * token is double-quoted so FTS operators (AND, NEAR, *, ^) in user
  * text are treated as literals, not syntax. Delegates to the C core
- * (native/sqlguard-c) for byte-identical output.
+ * (native/sqlguard-wasm) for byte-identical output.
  */
 function ftsQuery(query: string): string {
   return ftsQuote(query);

package/src/util/config.ts

@@ -2,6 +2,7 @@ import { existsSync, readFileSync, mkdirSync } from "node:fs";
 import writeFileAtomic from "write-file-atomic";
 import { z } from "zod";
 import { dirs, files as pathFiles } from "./paths.js";
+import { hardenTalonPermissions } from "./harden.js";
 import { setTimezone } from "./time.js";
 import { BACKEND_IDS } from "../core/agent-runtime/model-ref.js";
 import {
@@ -137,6 +138,8 @@ const frontendEnum = z.enum([
  * Defaults are loopback-only and unauthenticated (single-machine use). To
  * reach Talon remotely, set `host: "0.0.0.0"` and a `token` — the bridge
  * then requires `Authorization: Bearer <token>` (or `?token=` for SSE).
+ * A non-loopback bind with no token auto-mints a persistent one
+ * (~/.talon/keys/bridge-token) rather than serving the LAN open.
  */
 const nativeConfigSchema = z
   .object({
@@ -150,8 +153,9 @@ const nativeConfigSchema = z
     host: z.string().default("127.0.0.1"),
     /**
      * Optional shared secret. When set, every request must present it as a
-     * bearer token (header) or `?token=` query param (SSE). Required in
-     * practice whenever `host` is not loopback.
+     * bearer token (header) or `?token=` query param (SSE). When unset on a
+     * non-loopback `host`, the bridge mints and persists one automatically
+     * (~/.talon/keys/bridge-token) — the network never gets an open bridge.
      */
     token: z.string().optional(),
     /**
@@ -596,9 +600,11 @@ function ensureConfigFile(): boolean {
   if (!existsSync(dirs.root)) mkdirSync(dirs.root, { recursive: true });
   if (!existsSync(dirs.data)) mkdirSync(dirs.data, { recursive: true });
   if (!existsSync(CONFIG_FILE)) {
+    // Owner-only from birth: the config accumulates bot tokens and API keys.
     writeFileAtomic.sync(
       CONFIG_FILE,
       JSON.stringify(DEFAULT_CONFIG, null, 2) + "\n",
+      { mode: 0o600 },
     );
     return true;
   }
@@ -613,6 +619,7 @@ function ensureConfigFile(): boolean {
 
 export function loadConfig(): TalonConfig {
   ensureConfigFile();
+  hardenTalonPermissions();
   const fileConfig = normalizeDeprecatedFrontendConfig(loadConfigFile());
 
   // Runtime frontend override (TALON_FRONTEND_OVERRIDE). Lets the native

package/src/util/harden.ts

@@ -0,0 +1,50 @@
+/**
+ * At-rest permission hardening for ~/.talon/.
+ *
+ * The tree holds credentials (config.json carries bot tokens, API keys and
+ * the bridge token; .user-session is a full Telegram login) plus chat
+ * history and logs. Node creates most of it with umask defaults, so on a
+ * multi-user machine everything is group/world readable. This pass clamps
+ * the sensitive surface to owner-only on every boot — idempotent, cheap,
+ * and it repairs installs created before the tightened modes existed.
+ *
+ * Best-effort by design: a missing path just hasn't been created yet, and
+ * a chmod failure (read-only mount, foreign owner) must never block boot.
+ * Windows has no POSIX modes worth mapping, so the pass is a no-op there.
+ */
+
+import { chmodSync } from "node:fs";
+import { dirs, files } from "./paths.js";
+
+const OWNER_DIR = 0o700;
+const OWNER_FILE = 0o600;
+
+/** Owner-only directories: everything under them inherits the protection. */
+const HARDENED_DIRS: readonly string[] = [dirs.root, dirs.data, dirs.keys];
+
+/** Belt-and-braces owner-only files, should they ever move out of the tree. */
+const HARDENED_FILES: readonly string[] = [
+  files.config,
+  files.log,
+  files.database,
+  files.userSession,
+];
+
+/** Clamp permissions on the sensitive parts of ~/.talon/. */
+export function hardenTalonPermissions(): void {
+  if (process.platform === "win32") return;
+  for (const dir of HARDENED_DIRS) {
+    try {
+      chmodSync(dir, OWNER_DIR);
+    } catch {
+      // absent or not ours — nothing to protect yet
+    }
+  }
+  for (const file of HARDENED_FILES) {
+    try {
+      chmodSync(file, OWNER_FILE);
+    } catch {
+      // absent or not ours — nothing to protect yet
+    }
+  }
+}

package/src/util/log.ts

@@ -137,7 +137,8 @@ if (!quiet) {
 if (!IS_VITEST) {
   streams.push({
     level: "trace",
-    stream: createWriteStream(LOG_FILE, { flags: "a" }),
+    // 0600: turns and tool output land here — same sensitivity as history.
+    stream: createWriteStream(LOG_FILE, { flags: "a", mode: 0o600 }),
   });
 }