talon-agent 3.1.1 → 3.2.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "talon-agent",
-  "version": "3.1.1",
+  "version": "3.2.0",
   "description": "Multi-frontend AI agent with full tool access, streaming, cron jobs, and plugin system",
   "author": "Dylan Neve",
   "license": "MIT",
@@ -103,7 +103,7 @@
     "@kilocode/sdk": "^7.2.22",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@openai/agents": "^0.13.0",
-    "@openai/codex-sdk": "^0.144.0",
+    "@openai/codex-sdk": "^0.145.0",
     "@opencode-ai/sdk": "^1.17.4",
     "@playwright/mcp": "^0.0.78",
     "@types/cross-spawn": "^6.0.6",

package/src/core/engine/gateway-actions/mesh.ts

@@ -57,4 +57,12 @@ export const meshHandlers: SharedActionHandlers = {
       body.apk_path,
       body.remote_path,
     ),
+  // Remote self-update for a headless talon-node: push a new binary and have
+  // the node verify, swap, and restart into it.
+  update_node: (body) =>
+    getMeshService().updateNodeBinary(
+      body.device,
+      body.binary_path,
+      body.remote_path,
+    ),
 };

package/src/core/mesh/service.ts

@@ -873,6 +873,87 @@ export class MeshService {
     };
   }
 
+  /**
+   * `update_node`: remote self-update for a headless talon-node. Streams a
+   * replacement binary to the node, then sends `update_node` so the node
+   * verifies the digest, atomically swaps its own binary, and restarts into
+   * it (an in-place execve under systemd/launchd, so the mesh connection
+   * returns on its own within seconds — the same UX as the Android path).
+   *
+   * The binary is hashed here and the digest travels with the command; the
+   * node re-hashes the pushed file and refuses to swap on a mismatch, so a
+   * truncated transfer can never be installed. Build the replacement for the
+   * node's platform/arch (talon-node-<os>-<arch>) before calling.
+   */
+  async updateNodeBinary(
+    query: unknown,
+    localBinaryPath: unknown,
+    remotePath?: unknown,
+  ): Promise<MeshToolResult> {
+    const local =
+      typeof localBinaryPath === "string" && localBinaryPath.trim()
+        ? resolve(dirs.workspace, localBinaryPath.trim())
+        : "";
+    if (!local) return { ok: false, text: "A local binary path is required." };
+    await this.load();
+    const resolved = this.resolveDevice(query);
+    if ("error" in resolved) return { ok: false, text: resolved.error };
+    const target = resolved.target;
+    if (target.capabilities && !target.capabilities.includes("update_node")) {
+      return {
+        ok: false,
+        text: `${target.name} can't self-update — it needs the update_node capability (a talon-node headless device).`,
+      };
+    }
+
+    let sha256: string;
+    let size: number;
+    try {
+      ({ sha256, size } = await hashFile(local));
+    } catch (err) {
+      return {
+        ok: false,
+        text: `Cannot read binary ${local}: ${(err as Error).message}`,
+      };
+    }
+    if (size === 0) return { ok: false, text: `Binary ${local} is empty.` };
+
+    // Default staging path is /tmp on unix nodes (the node re-stages next to
+    // its own executable before the atomic swap, so this is only transient).
+    const remote =
+      typeof remotePath === "string" && remotePath.trim()
+        ? remotePath.trim()
+        : "/tmp/talon-node.update";
+
+    // 1. Stream the new binary to the node.
+    const push = await this.pushFileToDevice(target.id, local, remote);
+    if (!push.ok) {
+      return { ok: false, text: `Update aborted — push failed: ${push.text}` };
+    }
+
+    // 2. Trigger the swap + restart (node verifies the digest first).
+    const dispatched = await this.dispatchCommand(
+      target.id,
+      "update_node",
+      { path: remote, sha256 },
+      this.commandTimeoutMs,
+    );
+    if ("error" in dispatched) return { ok: false, text: dispatched.error };
+    if (!dispatched.result.ok) {
+      return {
+        ok: false,
+        text: dispatched.result.message ?? `${target.name} refused the update.`,
+      };
+    }
+    return {
+      ok: true,
+      text:
+        `Pushed ${formatBytes(size)} and staged the update on ${target.name}. ` +
+        `${dispatched.result.message ?? "Restarting now."} ` +
+        `Confirm with get_device_status once it reconnects (appVersion should change).`,
+    };
+  }
+
   /**
    * Chunked read of a remote file into a Buffer. Loops `read_file` with
    * increasing offsets until the device reports EOF.

package/src/core/tools/mesh.ts

@@ -185,4 +185,25 @@ export const meshTools: ToolDefinition[] = [
     execute: (params, bridge) => bridge("update_device", params),
     tag: "mesh",
   },
+  {
+    name: "update_node",
+    description:
+      "Remotely update a headless talon-node (Linux/macOS/Windows server on the mesh): stream a new node binary from the daemon and have the node verify its hash, atomically swap its own binary, and restart into it. On Linux/macOS this is an in-place execve so the mesh connection returns within seconds; the node re-hashes the pushed file and refuses a truncated or mismatched binary. Build the replacement for the node's platform/arch first (talon-node-<os>-<arch>). Confirm success with get_device_status afterwards (appVersion should change). This is the node counterpart of update_device — use update_device for Android companions.",
+    schema: {
+      device: deviceParam,
+      binary_path: z
+        .string()
+        .describe(
+          "Path to the new talon-node binary, relative to the workspace (or absolute), built for the node's OS/arch.",
+        ),
+      remote_path: z
+        .string()
+        .optional()
+        .describe(
+          "Where to stage the binary on the node (default /tmp/talon-node.update; the node re-stages next to its own executable before the atomic swap).",
+        ),
+    },
+    execute: (params, bridge) => bridge("update_node", params),
+    tag: "mesh",
+  },
 ];