talon-agent 3.29.0 → 3.30.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "talon-agent",
-  "version": "3.29.0",
+  "version": "3.30.0",
   "description": "Multi-frontend AI agent with full tool access, streaming, cron jobs, and plugin system",
   "author": "Dylan Neve",
   "license": "MIT",

package/src/frontend/telegram/handlers/access.ts

@@ -41,14 +41,31 @@ export function trackDmUser(
 
 export function setAccessControl(cfg: {
   allowedUsers?: number[];
+  blockedUsers?: number[];
   adminUserId?: number;
 }): void {
   accessConfig.allowedUserIds = cfg.allowedUsers?.length
     ? new Set(cfg.allowedUsers)
     : null;
+  accessConfig.blockedUserIds = cfg.blockedUsers?.length
+    ? new Set(cfg.blockedUsers)
+    : null;
   accessConfig.adminId = cfg.adminUserId ?? 0;
 }
 
+/**
+ * Blocked senders are dropped before any other check, in silence.
+ *
+ * The whitelist already stops an unknown sender being *acted on*, but it still
+ * answers them with a warning and pings the admin. For a spammer or a
+ * prompt-injection sender that reply is the payoff — it confirms a live bot is
+ * reading — and the admin ping is the cost. Blocking removes both.
+ */
+function isBlocked(senderId: number | undefined): boolean {
+  if (!accessConfig.blockedUserIds || senderId === undefined) return false;
+  return accessConfig.blockedUserIds.has(senderId);
+}
+
 /**
  * Check if a DM user is allowed. Returns true if no whitelist is set.
  */
@@ -114,15 +131,24 @@ export function shouldHandleInGroup(ctx: Context): boolean {
 }
 
 /**
- * Full access check: DM whitelist + group admin membership.
+ * Full access check: denylist, then DM whitelist + group admin membership.
  * Returns true if the message should be processed.
- * Warns unauthorized users and notifies the admin.
+ * Warns unauthorized users and notifies the admin — except blocked users,
+ * who are dropped silently.
  */
 export async function isAccessAllowed(
   ctx: Context,
   bot: Bot,
 ): Promise<boolean> {
   if (!ctx.chat) return false;
+
+  // Denylist wins over everything, including the group path: a blocked user
+  // gets no reply and generates no notification, anywhere.
+  if (isBlocked(ctx.from?.id)) {
+    log("users", `Dropped message from blocked user [id:${ctx.from?.id}]`);
+    return false;
+  }
+
   const isGroup = ctx.chat.type === "group" || ctx.chat.type === "supergroup";
 
   if (!isGroup) {

package/src/frontend/telegram/handlers/state.ts

@@ -20,9 +20,11 @@ export const KNOWN_DM_USERS_CAP = 10_000;
 /** Reassignable access config — holder object so setAccessControl can mutate. */
 export const accessConfig: {
   allowedUserIds: Set<number> | null; // null = no whitelist (allow all)
+  blockedUserIds: Set<number> | null; // null = no denylist
   adminId: number;
 } = {
   allowedUserIds: null,
+  blockedUserIds: null,
   adminId: 0,
 };
 

package/src/frontend/telegram/index.ts

@@ -87,6 +87,7 @@ export function createTelegramFrontend(
       setAdminUserId(config.adminUserId);
       setAccessControl({
         allowedUsers: config.allowedUsers,
+        blockedUsers: config.blockedUsers,
         adminUserId: config.adminUserId,
       });
 

package/src/frontend/whatsapp/index.ts

@@ -53,7 +53,7 @@ import {
   seedMessageStore,
 } from "./message-store.js";
 import { runTurnWithRecovery, shouldReplyToCatchUp } from "./turn-recovery.js";
-import { classifyClose, REPLACED_BACKOFF_MS } from "./pairing.js";
+import { classifyClose, isPaired, REPLACED_BACKOFF_MS } from "./pairing.js";
 import { isManualPairingActive, onPairingComplete } from "./pairing-lock.js";
 import { flushAuthWrites, useAtomicAuthState } from "./auth-state.js";
 import { makeWaLogger } from "./wa-logger.js";
@@ -527,11 +527,15 @@ export function createWhatsAppFrontend(
             case "logged-out":
               return resolve("logged-out");
             default:
-              // A socket that died without ever registering is a pairing
-              // window that expired — reconnecting would just open QR
+              // A socket that died without ever completing a login is a
+              // pairing window that expired — reconnecting would just open QR
               // session after QR session against WhatsApp's servers.
               // Park instead; /whatsapp pair opens the next one.
-              if (!state.creds.registered) return resolve("unpaired");
+              //
+              // Test with isPaired, not creds.registered: a QR-linked session
+              // never sets that flag, so the flag alone parks a healthy
+              // session on its first ordinary disconnect.
+              if (!isPaired(state.creds)) return resolve("unpaired");
               log(
                 "whatsapp",
                 `Connection closed (code ${code ?? "?"}) — reconnecting`,
@@ -556,7 +560,17 @@ export function createWhatsAppFrontend(
             resolvePath(dirs.whatsappAuth, "creds.json"),
             "utf-8",
           );
-          if ((JSON.parse(raw) as { registered?: boolean }).registered) return;
+          // Same trap as above: waiting on `registered` alone means a QR
+          // re-link can never end the park, because that flag stays false.
+          if (
+            isPaired(
+              JSON.parse(raw) as {
+                registered?: boolean;
+                me?: { id?: string } | null;
+              },
+            )
+          )
+            return;
         } catch {
           /* no creds yet — stay parked */
         }

package/src/frontend/whatsapp/pairing.ts

@@ -41,5 +41,24 @@ export function classifyClose(
   }
 }
 
+/**
+ * Has this auth state ever completed a login?
+ *
+ * `creds.registered` looks like the obvious test and is a trap: Baileys only
+ * sets it on the pairing-CODE path. A session linked by scanning the QR stays
+ * `registered: false` forever while being completely authenticated — it has
+ * `me`, `account`, app-state keys, and it sends and receives normally.
+ *
+ * Reading the flag alone therefore cannot tell a live QR session apart from a
+ * pairing window that expired without anyone scanning it, which is the
+ * distinction the reconnect loop actually needs.
+ */
+export function isPaired(creds: {
+  registered?: boolean;
+  me?: { id?: string } | null;
+}): boolean {
+  return Boolean(creds.registered || creds.me?.id);
+}
+
 /** How long to sit out after a 440 — another client owns the session. */
 export const REPLACED_BACKOFF_MS = 60_000;

package/src/util/config.ts

@@ -395,6 +395,10 @@ const configSchema = z.object({
   apiHash: z.string().optional(),
   adminUserId: z.number().int().optional(),
   allowedUsers: z.array(z.number().int()).optional(), // Whitelist of user IDs allowed to DM the bot
+  // Denylist of user IDs dropped in silence — no warning reply, no admin
+  // notification. For spam and prompt-injection senders, where the warning
+  // itself is the reward: it confirms a live bot is reading.
+  blockedUsers: z.array(z.number().int()).optional(),
   pulse: z.boolean().default(true),
   pulseIntervalMs: z.number().int().min(60000).default(300000),
   /**