talon-agent 3.15.1 → 3.15.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "talon-agent",
-  "version": "3.15.1",
+  "version": "3.15.2",
   "description": "Multi-frontend AI agent with full tool access, streaming, cron jobs, and plugin system",
   "author": "Dylan Neve",
   "license": "MIT",

package/src/frontend/telegram/admin.ts

@@ -70,7 +70,9 @@ export async function handleAdminCommand(
         const model = formatModelLabel(
           getChatSettings(s.chatId).model ?? config.model,
         );
-        return `<b>${escapeHtml(title)}</b> <code>${s.chatId}</code>\n  ${s.info.turns} turns | ${age} | ${model}`;
+        // `model` is a catalog id (OpenRouter/Kilo ids are free-form), so
+        // it gets the same escaping the title already had.
+        return `<b>${escapeHtml(title)}</b> <code>${s.chatId}</code>\n  ${s.info.turns} turns | ${age} | ${escapeHtml(model)}`;
       });
       await ctx.reply(
         `<b>Active chats (${sessions.length})</b>\n\n` + lines.join("\n\n"),

package/src/frontend/telegram/commands/info.ts

@@ -132,11 +132,17 @@ export function registerInfoCommands(bot: Bot): void {
       return;
     }
     const lines = plugins.map((p) => {
-      const ver = p.plugin.version ? ` v${p.plugin.version}` : "";
-      const desc = p.plugin.description ? ` — ${p.plugin.description}` : "";
+      // Every field here is author-supplied manifest text, not just the
+      // name. A description like "R&D tools" or "<beta>" would otherwise
+      // reach Telegram as markup and 400 the whole listing, so `/plugins`
+      // would look dead rather than show one odd line.
+      const ver = p.plugin.version ? ` v${escapeHtml(p.plugin.version)}` : "";
+      const desc = p.plugin.description
+        ? ` — ${escapeHtml(p.plugin.description)}`
+        : "";
       const mcp = p.plugin.mcpServerPath ? " [MCP]" : "";
       const fe = p.plugin.frontends?.length
-        ? ` (${p.plugin.frontends.join(", ")})`
+        ? ` (${escapeHtml(p.plugin.frontends.join(", "))})`
         : "";
       return `• <b>${escapeHtml(p.plugin.name)}</b>${ver}${mcp}${fe}${desc}`;
     });

package/src/frontend/telegram/handlers/queue.ts

@@ -122,10 +122,16 @@ async function flushQueue(chatId: string): Promise<void> {
   // Clear hourglass reactions on queued messages now that we're processing
   for (const msgId of queuedReactionMsgIds) {
     bot.api.setMessageReaction(numericChatId, msgId, []).catch((err) => {
-      logWarn(
-        "bot",
-        `Failed to clear reaction on msg ${msgId}: ${err instanceof Error ? err.message : err}`,
-      );
+      const detail = err instanceof Error ? err.message : String(err);
+      // The id is recorded optimistically — the hourglass `setMessageReaction`
+      // above is fire-and-forget, so we queue the clear before knowing the set
+      // landed. When it didn't, clearing a reaction that was never there comes
+      // back as REACTION_EMPTY. The end state we wanted (no reaction) already
+      // holds, so that is a no-op, not a failure. Keeping the optimistic push
+      // matters: gating it on the set resolving would race the flush and strand
+      // a ⏳ on the message. Anything else is still worth surfacing.
+      if (detail.includes("REACTION_EMPTY")) return;
+      logWarn("bot", `Failed to clear reaction on msg ${msgId}: ${detail}`);
     });
   }