talon-agent 3.14.0 → 3.15.1

package/src/backend/remote-server/sessions.ts

@@ -17,7 +17,12 @@ import {
 import { log, logWarn } from "../../util/log.js";
 import type { RemoteAgentClient, RemotePermissionRule } from "./client.js";
 import type { RemoteServerState } from "./state.js";
-import { TALON_MCP_SERVER_NAME, getChatMcpServerName } from "./mcp.js";
+import {
+  TALON_MCP_SERVER_NAME,
+  TALON_PLUGIN_MCP_SERVER_NAME,
+  getChatMcpServerName,
+  safeMcpNamePart,
+} from "./mcp.js";
 
 /**
  * Build the per-session permission ruleset Talon installs on every fresh
@@ -33,14 +38,13 @@ import { TALON_MCP_SERVER_NAME, getChatMcpServerName } from "./mcp.js";
  *      "No active chat context". Or in the cross-chat case where chat B
  *      IS active, the model in chat A could leak content into chat B.
  *      Deny pattern blocks both. (Visibility is also blocked at the
- *      MCP-registration layer via `ensureChatMcpServer`; this rule is
- *      defense in depth.)
+ *      prompt layer by `buildToolOverrides`; this rule is defense in depth.)
  *
- *   2. Auto-allow built-in tools (`tool *`, `edit *`, `bash *`) so they
+ *   2. Auto-allow built-in tools (`tool *`, `edit *`, `bash *`) and
+ *      workspace paths outside the server process's launch directory so they
  *      don't sit in `permission.asked` waiting for a reply that never
- *      arrives — Talon's question watchdog only handles `question.*`
- *      events, not `permission.*`. Without the allow rule the model's
- *      first `read` call hangs the entire turn.
+ *      arrives. The permission watchdog is a fallback for new categories;
+ *      this rule resolves the known path case without a polling round trip.
  *
  * Rules are evaluated in order; first match wins. (See upstream's
  * `PermissionRule` type — `permission` is the rule category, `pattern`
@@ -48,6 +52,7 @@ import { TALON_MCP_SERVER_NAME, getChatMcpServerName } from "./mcp.js";
  */
 export function buildPermissionRuleset(chatId: string): RemotePermissionRule[] {
   const ourServerName = getChatMcpServerName(chatId);
+  const ourPluginPrefix = `${TALON_PLUGIN_MCP_SERVER_NAME}-${safeMcpNamePart(chatId, "chat")}-`;
   return [
     { permission: "tool", pattern: `${ourServerName}_*`, action: "allow" },
     {
@@ -55,9 +60,16 @@ export function buildPermissionRuleset(chatId: string): RemotePermissionRule[] {
       pattern: `${TALON_MCP_SERVER_NAME}-*`,
       action: "deny",
     },
+    { permission: "tool", pattern: `${ourPluginPrefix}*`, action: "allow" },
+    {
+      permission: "tool",
+      pattern: `${TALON_PLUGIN_MCP_SERVER_NAME}-*`,
+      action: "deny",
+    },
     { permission: "tool", pattern: "*", action: "allow" },
     { permission: "edit", pattern: "*", action: "allow" },
     { permission: "bash", pattern: "*", action: "allow" },
+    { permission: "external_directory", pattern: "*", action: "allow" },
   ];
 }
 
@@ -106,3 +118,51 @@ export async function ensureRemoteSession<TClient extends RemoteAgentClient>(
 
   return newId;
 }
+
+/**
+ * The per-turn setup a warm-up front-loads. Both remote-server backends
+ * expose these under identical signatures; the shape lets the helper stay
+ * backend-agnostic without importing either SDK.
+ */
+export interface RemoteWarmDeps<TClient extends RemoteAgentClient> {
+  ensureServer(): Promise<TClient>;
+  ensureSession(client: TClient, chatId: string): Promise<string>;
+  ensureChatMcpServer(client: TClient, chatId: string): Promise<string>;
+  ensurePluginMcpServers(client: TClient, chatId: string): Promise<string[]>;
+}
+
+/**
+ * Pre-pay a chat's cold start: spawn the server if it isn't up, create (or
+ * resume) the session, and register the chat + plugin MCP servers.
+ *
+ * This is the remote-server analogue of the Claude backend's `warmSession`,
+ * and closes the last `sessions` capability gap between the two families.
+ * `performSessionReset` and the native frontend call it right after a reset,
+ * so the first turn on a fresh session doesn't serially pay session creation
+ * plus a full plugin-MCP registration sweep — the dominant cold-start cost
+ * here, since each plugin server is a separate connect.
+ *
+ * Best-effort by contract: `/reset` has already succeeded by the time this
+ * runs, and the same work is idempotent and repeated at the head of every
+ * turn. A failure must degrade to a slow first turn, never surface as a
+ * failed reset — so everything is caught and logged, not rethrown.
+ */
+export async function warmRemoteSession<TClient extends RemoteAgentClient>(
+  state: RemoteServerState<TClient>,
+  chatId: string,
+  deps: RemoteWarmDeps<TClient>,
+): Promise<void> {
+  try {
+    const client = await deps.ensureServer();
+    await deps.ensureSession(client, chatId);
+    await deps.ensureChatMcpServer(client, chatId);
+    await deps.ensurePluginMcpServers(client, chatId);
+    log("agent", `[${chatId}] Warmed ${state.label} session`);
+  } catch (err) {
+    logWarn(
+      "agent",
+      `[${chatId}] ${state.label} warm-up skipped (first turn pays cold start): ` +
+        `${err instanceof Error ? err.message : String(err)}`,
+    );
+  }
+}

package/src/backend/remote-server/sse-stream.ts

@@ -44,17 +44,24 @@ export async function subscribeSseStream(
   client: SseSubscribableClient,
   chatId: string,
 ): Promise<AsyncIterable<unknown> | undefined> {
-  let result: unknown;
-  try {
-    result = await client.global.event();
-  } catch (err) {
-    logWarn(
-      "agent",
-      `[${chatId}] SSE subscribe failed: ${err instanceof Error ? err.message : String(err)}`,
-    );
-    return undefined;
+  let lastError: unknown;
+  for (let attempt = 1; attempt <= 3; attempt++) {
+    try {
+      const stream = narrowSseResult(await client.global.event());
+      if (stream) return stream;
+      lastError = new Error("response did not contain an async event stream");
+    } catch (err) {
+      lastError = err;
+    }
+    if (attempt < 3) {
+      await new Promise((resolve) => setTimeout(resolve, 150 * attempt));
+    }
   }
-  return narrowSseResult(result);
+  logWarn(
+    "agent",
+    `[${chatId}] SSE subscribe failed after 3 attempts: ${lastError instanceof Error ? lastError.message : String(lastError)}`,
+  );
+  return undefined;
 }
 
 /**

package/src/backend/remote-server/state.ts

@@ -52,6 +52,10 @@ export interface RemoteServerState<TClient extends RemoteAgentClient> {
    * actual state, so we cache locally instead of trusting the server.
    */
   readonly registeredMcpServers: Set<string>;
+  /** Exact tool names exposed by each registered MCP server. */
+  readonly registeredMcpTools: Map<string, readonly string[]>;
+  /** Plugin-name → registered server-name mapping for each chat context. */
+  readonly pluginMcpServersByChat: Map<string, Map<string, string>>;
 }
 
 /** Inputs for {@link createRemoteServerState}. */
@@ -84,6 +88,8 @@ export function createRemoteServerState<TClient extends RemoteAgentClient>(
     serverHandle: null,
     modelProviderCache: new Map(),
     registeredMcpServers: new Set(),
+    registeredMcpTools: new Map(),
+    pluginMcpServersByChat: new Map(),
   };
 }
 

package/src/backend/remote-server/turn-timeout.ts

@@ -0,0 +1,71 @@
+/** Bounded turn execution for OpenCode/Kilo's long-lived HTTP servers. */
+
+import { logWarn } from "../../util/log.js";
+
+const DEFAULT_REMOTE_TURN_TIMEOUT_MS = 10 * 60_000;
+
+export function remoteTurnTimeoutMs(): number {
+  const configured = Number(process.env.TALON_REMOTE_TURN_TIMEOUT_MS);
+  return Number.isFinite(configured) && configured > 0
+    ? configured
+    : DEFAULT_REMOTE_TURN_TIMEOUT_MS;
+}
+
+export class RemoteTurnTimeoutError extends Error {
+  constructor(label: string, timeoutMs: number) {
+    super(`${label} turn timed out after ${Math.round(timeoutMs / 1000)}s`);
+    // Core error classification treats TimeoutError as a retryable transport
+    // failure, so the normal fallback-model path remains available.
+    this.name = "TimeoutError";
+  }
+}
+
+export interface RemoteTurnAbortClient {
+  session: {
+    abort(args: { sessionID: string }): Promise<unknown>;
+  };
+}
+
+/**
+ * Race a prompt+SSE turn against a hard deadline. On expiry, abort upstream
+ * generation before rejecting so the provider stops spending tokens and the
+ * session can be safely reset by the shared retry path.
+ */
+export async function awaitRemoteTurn<T>(
+  turn: Promise<T>,
+  inputs: {
+    client: RemoteTurnAbortClient;
+    sessionId: string;
+    chatId: string;
+    label: string;
+    timeoutMs?: number;
+  },
+): Promise<T> {
+  const timeoutMs = inputs.timeoutMs ?? remoteTurnTimeoutMs();
+  let timer: ReturnType<typeof setTimeout> | null = null;
+  try {
+    return await Promise.race([
+      turn,
+      new Promise<never>((_, reject) => {
+        timer = setTimeout(() => {
+          logWarn(
+            "agent",
+            `[${inputs.chatId}] ${inputs.label} turn exceeded ${Math.round(timeoutMs / 1000)}s; aborting`,
+          );
+          inputs.client.session
+            .abort({ sessionID: inputs.sessionId })
+            .catch((err) =>
+              logWarn(
+                "agent",
+                `[${inputs.chatId}] ${inputs.label} timeout abort failed: ${err instanceof Error ? err.message : String(err)}`,
+              ),
+            );
+          reject(new RemoteTurnTimeoutError(inputs.label, timeoutMs));
+        }, timeoutMs);
+        timer.unref?.();
+      }),
+    ]);
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}

package/src/core/mcp-hub/index.ts

@@ -104,6 +104,28 @@ export function hubPluginServerNames(only?: string[]): string[] {
   return Object.keys(getPluginMcpServers("", "hub-enum", only));
 }
 
+/**
+ * Enumerate one plugin server's tools through the same hub-managed child that
+ * serves MCP requests. Remote agent servers do not include dynamically-added
+ * MCP tools in their `/experimental/tool/ids` response, so OpenCode/Kilo need
+ * this authoritative list to build per-chat visibility overrides.
+ */
+export async function listHubPluginToolNames(
+  serverName: string,
+  chatId: string,
+  bridgeUrl: string,
+): Promise<string[]> {
+  const key =
+    serverName === "brave-search"
+      ? "brave-search"
+      : `${serverName}\u0000${chatId}`;
+  const child = await acquireChild(key, () =>
+    pluginSpec(serverName, chatId, bridgeUrl),
+  );
+  child.touch();
+  return (await child.listTools()).map((tool) => tool.name);
+}
+
 // ── Server construction per session ─────────────────────────────────────────
 
 type HubTarget =

package/src/frontend/shared/status-context.ts

@@ -1,5 +1,166 @@
 import type { CacheMetricsSupport } from "../../core/types.js";
 
+// ── /context breakdown ────────────────────────────────────────────────────────
+
+/**
+ * Rough token estimate — ~4 chars/token, the house heuristic used everywhere
+ * (soul/projector, cache-telemetry). No real tokenizer is wired, so every
+ * measured figure in the breakdown below is an estimate at this fidelity.
+ */
+export function estimateContextTokens(text: string): number {
+  return Math.ceil(text.length / 4);
+}
+
+export type ContextSegmentKey = "system" | "tools" | "conversation";
+
+interface ContextSegment {
+  key: ContextSegmentKey;
+  label: string;
+  tokens: number;
+  /** Share of the window (0–100) when the window is known, else share of used. */
+  pct: number;
+}
+
+export interface ContextBreakdown {
+  /** True once there is anything to show (a system prompt or a reported fill). */
+  known: boolean;
+  /** True when the window size is known — only then can free space be shown. */
+  windowKnown: boolean;
+  used: number;
+  max: number;
+  usedPct: number;
+  free: number;
+  freePct: number;
+  /** Fixed → variable order: System, Tools, Conversation. */
+  segments: ContextSegment[];
+  warn: boolean;
+}
+
+function posInt(n: number | undefined): number {
+  return typeof n === "number" && Number.isFinite(n) && n > 0
+    ? Math.round(n)
+    : 0;
+}
+
+function round1(n: number): number {
+  return Math.round(n * 10) / 10;
+}
+
+/**
+ * Decompose the context window into System / Tools / Conversation + free.
+ *
+ * The honesty this has to preserve: the backend reports exactly one
+ * authoritative number, `contextTokens` (the real last-turn fill). Nothing
+ * reports a per-category split, so:
+ *
+ *   - **System** is measured from the actual (frozen) system prompt — accurate,
+ *     and the part a user can act on.
+ *   - **Conversation** is estimated from stored history. It can overshoot what
+ *     is really in-window after compaction; when it does, it is clamped to fit.
+ *   - **Tools** is the residual: `used − system − conversation`. Tool schemas
+ *     (invisible to us — they live inside the SDK) dominate it, but it also
+ *     absorbs message-formatting overhead and estimation slack. Labelled as the
+ *     remainder, not claimed as exact.
+ *
+ * When the backend reports no fill, tools cannot be derived, so only the two
+ * measured/estimated parts are shown and the window's free space (if known) is
+ * whatever is left of it.
+ */
+export function buildContextBreakdown(input: {
+  contextTokens?: number;
+  contextWindow?: number;
+  systemTokens: number;
+  conversationTokens: number;
+}): ContextBreakdown {
+  const max = posInt(input.contextWindow);
+  const system = Math.max(0, Math.round(input.systemTokens));
+  let conversation = Math.max(0, Math.round(input.conversationTokens));
+  const fill = posInt(input.contextTokens);
+
+  const segments: ContextSegment[] = [];
+  let used: number;
+
+  if (fill > 0) {
+    used = fill;
+    // System is sent in full every turn; if our estimate exceeds the real fill
+    // that is estimation slack, not reality — clamp so parts never exceed used.
+    const sys = Math.min(system, used);
+    let tools = used - sys - conversation;
+    if (tools < 0) {
+      // Conversation overshot the real fill (compaction dropped in-window
+      // messages) — give the remainder back to conversation, zero the residual.
+      conversation = Math.max(0, used - sys);
+      tools = 0;
+    }
+    segments.push({ key: "system", label: "System", tokens: sys, pct: 0 });
+    segments.push({ key: "tools", label: "Tools", tokens: tools, pct: 0 });
+    segments.push({
+      key: "conversation",
+      label: "Conversation",
+      tokens: conversation,
+      pct: 0,
+    });
+  } else {
+    // No authoritative fill — show what we can measure; tools isn't derivable.
+    used = system + conversation;
+    segments.push({ key: "system", label: "System", tokens: system, pct: 0 });
+    segments.push({
+      key: "conversation",
+      label: "Conversation",
+      tokens: conversation,
+      pct: 0,
+    });
+  }
+
+  const windowKnown = max > 0;
+  const free = windowKnown ? Math.max(0, max - used) : 0;
+  const denom = windowKnown ? max : used;
+  for (const s of segments) {
+    s.pct = denom > 0 ? round1((s.tokens / denom) * 100) : 0;
+  }
+
+  return {
+    known: used > 0,
+    windowKnown,
+    used,
+    max,
+    usedPct: windowKnown ? Math.min(100, round1((used / max) * 100)) : 0,
+    free,
+    freePct: windowKnown ? round1((free / max) * 100) : 0,
+    segments,
+    warn: windowKnown && used / max >= 0.8,
+  };
+}
+
+/**
+ * Distribute `width` integer cells across `weights` proportionally, by the
+ * largest-remainder method — the cells sum to exactly `width` and no positive
+ * weight is systematically rounded to nothing before its peers. Zero weights
+ * get zero cells. Used to lay out the segmented bar so its coloured runs sum to
+ * the bar width regardless of rounding.
+ */
+export function apportionCells(
+  weights: readonly number[],
+  width: number,
+): number[] {
+  const total = weights.reduce((a, b) => a + b, 0);
+  if (total <= 0 || width <= 0) return weights.map(() => 0);
+  const exact = weights.map((w) => (Math.max(0, w) / total) * width);
+  const cells = exact.map((x) => Math.floor(x));
+  let remaining = width - cells.reduce((a, b) => a + b, 0);
+  const byRemainder = exact
+    .map((x, i) => ({ i, frac: x - Math.floor(x) }))
+    .sort((a, b) => b.frac - a.frac);
+  for (const { i } of byRemainder) {
+    if (remaining <= 0) break;
+    if (weights[i]! > 0) {
+      cells[i]!++;
+      remaining--;
+    }
+  }
+  return cells;
+}
+
 export interface ContextDisplay {
   known: boolean;
   used: number;

package/src/frontend/telegram/callbacks/model.ts

@@ -44,6 +44,47 @@ import {
   editOrIgnoreSame,
   type CallbackDeps,
 } from "./shared.js";
+import { logWarn } from "../../../util/log.js";
+
+/**
+ * Run the backend-side half of a chat's session handoff.
+ *
+ * A backend switch already clears Talon's own stores (session row,
+ * history, pulse checkpoint), but those are only half the state.
+ * `performSessionReset` also drives the backend capability slots, and
+ * the switch path skipped them entirely:
+ *
+ *   - the OUTGOING backend keeps in-process per-chat state that no
+ *     amount of clearing Talon's stores touches. openai-agents holds a
+ *     `MemorySession` map keyed by chat id, so switching away and back
+ *     resurrected the old conversation the operator meant to drop.
+ *   - the INCOMING backend was never warmed, so the first turn after a
+ *     switch paid the full cold start — on OpenCode/Kilo that is session
+ *     creation plus a per-plugin MCP registration sweep.
+ *
+ * The warm is deliberately fire-and-forget: it can take seconds, and the
+ * callback still has a toast to answer and a menu to redraw. Telegram
+ * expires an unanswered callback query, so blocking here would trade a
+ * cold first turn for a visibly stuck button.
+ */
+function handOffBackendSession(
+  chatId: string,
+  previousBackend: ReturnType<typeof resolveBackendForChat>,
+  gateway: CallbackDeps["gateway"],
+): void {
+  previousBackend?.sessions?.resetChat?.(chatId);
+  const nextBackend = resolveBackendForChat(chatId, gateway);
+  // Same instance on a no-op switch — warming it again is harmless
+  // (every step is idempotent) but pointless, so skip it.
+  if (!nextBackend || nextBackend === previousBackend) return;
+  void Promise.resolve(nextBackend.sessions?.warmSession?.(chatId)).catch(
+    (err) =>
+      logWarn(
+        "bot",
+        `[${chatId}] warm after backend switch failed: ${err instanceof Error ? err.message : String(err)}`,
+      ),
+  );
+}
 
 export async function handleModelCallback(
   ctx: Context,
@@ -171,6 +212,10 @@ export async function handleModelCallback(
       });
       return;
     }
+    // Resolve the outgoing backend BEFORE rebinding — afterwards this
+    // chat already points at the new one and the old in-process state
+    // would be unreachable.
+    const previousBackend = resolveBackendForChat(cid, gateway);
     const result = await rebindChat(cid, action.backendId, config);
     if (!result.ok) {
       await answerCallbackQuerySafe(ctx, {
@@ -188,6 +233,7 @@ export async function handleModelCallback(
     resetSession(cid);
     clearHistory(cid);
     resetPulseCheckpoint(cid);
+    handOffBackendSession(cid, previousBackend, gateway);
     const label =
       available.find((b) => b.id === action.backendId)?.label ??
       action.backendId;
@@ -210,11 +256,13 @@ export async function handleModelCallback(
     // global chat-role backend. Per-backend model picks are
     // preserved (modelByBackend stays intact) so reverting and
     // switching back later still restores prior choices.
+    const previousBackend = resolveBackendForChat(cid, gateway);
     await releaseChat(cid);
     setChatBackend(cid, undefined);
     resetSession(cid);
     clearHistory(cid);
     resetPulseCheckpoint(cid);
+    handOffBackendSession(cid, previousBackend, gateway);
     // Resolve the now-default backend's model for the toast.
     const defaultBackend = resolveBackendForChat(cid, gateway);
     const defaultBackendId = getBackendIdForChat(cid);

package/src/frontend/telegram/commands/settings.ts

@@ -112,10 +112,16 @@ export function registerSettingsCommands(
     if (be?.models?.resolveModelInfo) {
       const resolution = await be.models?.resolveModelInfo(arg);
       if (resolution.kind !== "exact") {
+        // Every backend's formatModelError returns plain text and
+        // interpolates the raw query, so escape at this boundary — the
+        // same fix as the model menu's status lines. `/model <name>`
+        // (which the OpenCode/Kilo hint literally tells you to type)
+        // otherwise reaches Telegram as an unsupported `<name>` tag and
+        // the whole reply 400s, leaving the command looking dead.
         const msg =
           be.models?.formatModelError?.(arg, resolution) ??
-          `No model matched "${escapeHtml(arg)}".`;
-        await ctx.reply(msg, { parse_mode: "HTML" });
+          `No model matched "${arg}".`;
+        await ctx.reply(escapeHtml(msg), { parse_mode: "HTML" });
         return;
       }
       if (!resolution.model.selectable) {

package/src/frontend/telegram/helpers/menu.ts

@@ -370,9 +370,12 @@ export function renderModelMenuText(state: ModelMenuState): string {
       `<i>Use the picker below to choose one — sending a message before picking will be refused.</i>`,
     );
   } else {
-    lines.push(`<b>Model:</b> <code>${state.activeDisplay}</code>`);
+    lines.push(`<b>Model:</b> <code>${escapeHtml(state.activeDisplay)}</code>`);
   }
-  for (const l of state.statusLines) lines.push(l);
+  // Display names and status lines are plain text from backend catalogs —
+  // a literal `<name>` in a hint (or a `<` in a model id) is otherwise
+  // parsed as an HTML tag and Telegram rejects the whole send with 400.
+  for (const l of state.statusLines) lines.push(escapeHtml(l));
   if (state.freeOnly && state.showFreeToggle) {
     lines.push("<i>Filtering to free-tier models when browsing.</i>");
   }