talon-agent 3.29.0 → 3.31.0

package/README.md

@@ -329,7 +329,7 @@ On first boot Talon creates a venv at `~/.talon/mempalace-venv` and installs the
     "backend": "mempalace",
     "mempalace": {
       "palacePath": "~/.talon/workspace/palace",
-      "version": "3.8.0",
+      "version": "3.9.0",
       "autoUpdate": true,
       "autoProvision": true
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "talon-agent",
-  "version": "3.29.0",
+  "version": "3.31.0",
   "description": "Multi-frontend AI agent with full tool access, streaming, cron jobs, and plugin system",
   "author": "Dylan Neve",
   "license": "MIT",
@@ -106,7 +106,7 @@
     "@kilocode/sdk": "^7.2.22",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@openai/agents": "^0.17.0",
-    "@openai/codex-sdk": "^0.149.0",
+    "@openai/codex-sdk": "^0.150.1",
     "@opencode-ai/sdk": "^1.17.4",
     "@playwright/mcp": "0.0.79",
     "@types/cross-spawn": "^6.0.6",

package/src/core/mesh/service.ts

@@ -888,7 +888,7 @@ export class MeshService {
 
   /**
    * `update_device`: remote self-update for the companion. Streams a new APK
-   * to the device, then tells it to silently install (via Shizuku) and
+   * to the device, then tells it to silently install (root or Shizuku) and
    * restart. The mesh foreground service's autoRunOnMyPackageReplaced brings
    * the connection back on its own — the link drops only for the seconds the
    * process is swapped, no manual reopen.
@@ -914,7 +914,7 @@ export class MeshService {
     if (target.capabilities && !target.capabilities.includes("install_apk")) {
       return {
         ok: false,
-        text: `${target.name} can't self-update — it needs a companion build with the install_apk capability and Shizuku enabled (device control on).`,
+        text: `${target.name} can't self-update — it needs a companion build with the install_apk capability and root or Shizuku enabled (device control on).`,
       };
     }
 

package/src/core/tools/mesh.ts

@@ -85,7 +85,7 @@ export const meshTools: ToolDefinition[] = [
   {
     name: "device_exec",
     description:
-      "Run a shell command ON a Talon companion device (e.g. the phone) and return its stdout/stderr/exit code. The device executes it in its own sandbox (Android: app UID, or elevated via Shizuku if available). Use for on-device tasks like tidying a folder. Prefer `teleport` for a sustained session. For persistent streams (log tailing, watchers), background with output redirected to a file — `cmd > /tmp/out.log 2>&1 &` returns immediately; poll the file with device_read_file.",
+      "Run a shell command ON a Talon companion device (e.g. the phone) and return its stdout/stderr/exit code. The device executes it at the highest privilege it has (Android: root if the device grants it, else Shizuku's shell UID, else the app UID; the result's `via` says which). Use for on-device tasks like tidying a folder. Prefer `teleport` for a sustained session. For persistent streams (log tailing, watchers), background with output redirected to a file — `cmd > /tmp/out.log 2>&1 &` returns immediately; poll the file with device_read_file.",
     schema: {
       device: deviceParam,
       cmd: z.string().describe("The shell command to run on the device."),
@@ -167,7 +167,7 @@ export const meshTools: ToolDefinition[] = [
   {
     name: "update_device",
     description:
-      "Remotely update a Talon companion (Android): stream a new APK from the daemon to the device and silently reinstall it via Shizuku, keeping app data. The companion's mesh runs in a foreground service that auto-restarts after the package is replaced, so the connection returns on its own within seconds — no manual reopen. The APK is hashed and the device verifies it before installing (a truncated push is refused; a differently-signed APK is refused by Android). Requires the device to have device control on and Shizuku granted. Confirm success with get_device_status afterwards (appVersion should change).",
+      "Remotely update a Talon companion (Android): stream a new APK from the daemon to the device and silently reinstall it at an elevated tier (root or Shizuku), keeping app data. The companion's mesh runs in a foreground service that auto-restarts after the package is replaced, so the connection returns on its own within seconds — no manual reopen. The APK is hashed and the device verifies it before installing (a truncated push is refused; a differently-signed APK is refused by Android). Requires the device to have device control on and either root or Shizuku granted. Confirm success with get_device_status afterwards (appVersion should change).",
     schema: {
       device: deviceParam,
       apk_path: z

package/src/frontend/telegram/handlers/access.ts

@@ -41,14 +41,31 @@ export function trackDmUser(
 
 export function setAccessControl(cfg: {
   allowedUsers?: number[];
+  blockedUsers?: number[];
   adminUserId?: number;
 }): void {
   accessConfig.allowedUserIds = cfg.allowedUsers?.length
     ? new Set(cfg.allowedUsers)
     : null;
+  accessConfig.blockedUserIds = cfg.blockedUsers?.length
+    ? new Set(cfg.blockedUsers)
+    : null;
   accessConfig.adminId = cfg.adminUserId ?? 0;
 }
 
+/**
+ * Blocked senders are dropped before any other check, in silence.
+ *
+ * The whitelist already stops an unknown sender being *acted on*, but it still
+ * answers them with a warning and pings the admin. For a spammer or a
+ * prompt-injection sender that reply is the payoff — it confirms a live bot is
+ * reading — and the admin ping is the cost. Blocking removes both.
+ */
+function isBlocked(senderId: number | undefined): boolean {
+  if (!accessConfig.blockedUserIds || senderId === undefined) return false;
+  return accessConfig.blockedUserIds.has(senderId);
+}
+
 /**
  * Check if a DM user is allowed. Returns true if no whitelist is set.
  */
@@ -114,15 +131,24 @@ export function shouldHandleInGroup(ctx: Context): boolean {
 }
 
 /**
- * Full access check: DM whitelist + group admin membership.
+ * Full access check: denylist, then DM whitelist + group admin membership.
  * Returns true if the message should be processed.
- * Warns unauthorized users and notifies the admin.
+ * Warns unauthorized users and notifies the admin — except blocked users,
+ * who are dropped silently.
  */
 export async function isAccessAllowed(
   ctx: Context,
   bot: Bot,
 ): Promise<boolean> {
   if (!ctx.chat) return false;
+
+  // Denylist wins over everything, including the group path: a blocked user
+  // gets no reply and generates no notification, anywhere.
+  if (isBlocked(ctx.from?.id)) {
+    log("users", `Dropped message from blocked user [id:${ctx.from?.id}]`);
+    return false;
+  }
+
   const isGroup = ctx.chat.type === "group" || ctx.chat.type === "supergroup";
 
   if (!isGroup) {

package/src/frontend/telegram/handlers/state.ts

@@ -20,9 +20,11 @@ export const KNOWN_DM_USERS_CAP = 10_000;
 /** Reassignable access config — holder object so setAccessControl can mutate. */
 export const accessConfig: {
   allowedUserIds: Set<number> | null; // null = no whitelist (allow all)
+  blockedUserIds: Set<number> | null; // null = no denylist
   adminId: number;
 } = {
   allowedUserIds: null,
+  blockedUserIds: null,
   adminId: 0,
 };
 

package/src/frontend/telegram/index.ts

@@ -87,6 +87,7 @@ export function createTelegramFrontend(
       setAdminUserId(config.adminUserId);
       setAccessControl({
         allowedUsers: config.allowedUsers,
+        blockedUsers: config.blockedUsers,
         adminUserId: config.adminUserId,
       });
 

package/src/frontend/whatsapp/index.ts

@@ -53,7 +53,7 @@ import {
   seedMessageStore,
 } from "./message-store.js";
 import { runTurnWithRecovery, shouldReplyToCatchUp } from "./turn-recovery.js";
-import { classifyClose, REPLACED_BACKOFF_MS } from "./pairing.js";
+import { classifyClose, isPaired, REPLACED_BACKOFF_MS } from "./pairing.js";
 import { isManualPairingActive, onPairingComplete } from "./pairing-lock.js";
 import { flushAuthWrites, useAtomicAuthState } from "./auth-state.js";
 import { makeWaLogger } from "./wa-logger.js";
@@ -527,11 +527,15 @@ export function createWhatsAppFrontend(
             case "logged-out":
               return resolve("logged-out");
             default:
-              // A socket that died without ever registering is a pairing
-              // window that expired — reconnecting would just open QR
+              // A socket that died without ever completing a login is a
+              // pairing window that expired — reconnecting would just open QR
               // session after QR session against WhatsApp's servers.
               // Park instead; /whatsapp pair opens the next one.
-              if (!state.creds.registered) return resolve("unpaired");
+              //
+              // Test with isPaired, not creds.registered: a QR-linked session
+              // never sets that flag, so the flag alone parks a healthy
+              // session on its first ordinary disconnect.
+              if (!isPaired(state.creds)) return resolve("unpaired");
               log(
                 "whatsapp",
                 `Connection closed (code ${code ?? "?"}) — reconnecting`,
@@ -556,7 +560,17 @@ export function createWhatsAppFrontend(
             resolvePath(dirs.whatsappAuth, "creds.json"),
             "utf-8",
           );
-          if ((JSON.parse(raw) as { registered?: boolean }).registered) return;
+          // Same trap as above: waiting on `registered` alone means a QR
+          // re-link can never end the park, because that flag stays false.
+          if (
+            isPaired(
+              JSON.parse(raw) as {
+                registered?: boolean;
+                me?: { id?: string } | null;
+              },
+            )
+          )
+            return;
         } catch {
           /* no creds yet — stay parked */
         }

package/src/frontend/whatsapp/pairing.ts

@@ -41,5 +41,24 @@ export function classifyClose(
   }
 }
 
+/**
+ * Has this auth state ever completed a login?
+ *
+ * `creds.registered` looks like the obvious test and is a trap: Baileys only
+ * sets it on the pairing-CODE path. A session linked by scanning the QR stays
+ * `registered: false` forever while being completely authenticated — it has
+ * `me`, `account`, app-state keys, and it sends and receives normally.
+ *
+ * Reading the flag alone therefore cannot tell a live QR session apart from a
+ * pairing window that expired without anyone scanning it, which is the
+ * distinction the reconnect loop actually needs.
+ */
+export function isPaired(creds: {
+  registered?: boolean;
+  me?: { id?: string } | null;
+}): boolean {
+  return Boolean(creds.registered || creds.me?.id);
+}
+
 /** How long to sit out after a 440 — another client owns the session. */
 export const REPLACED_BACKOFF_MS = 60_000;

package/src/plugins/mempalace/provision.ts

@@ -47,7 +47,7 @@ import { dirs, files } from "../../util/paths.js";
  * to. Bump deliberately, with the canary workflow green — see
  * .github/workflows/native-provision.yml.
  */
-export const MEMPALACE_PINNED_VERSION = "3.8.0";
+export const MEMPALACE_PINNED_VERSION = "3.9.0";
 
 /** Minimum python for the managed venv (matches mempalace's supported floor). */
 const PYTHON_MIN = { major: 3, minor: 10 };

package/src/util/config.ts

@@ -395,6 +395,10 @@ const configSchema = z.object({
   apiHash: z.string().optional(),
   adminUserId: z.number().int().optional(),
   allowedUsers: z.array(z.number().int()).optional(), // Whitelist of user IDs allowed to DM the bot
+  // Denylist of user IDs dropped in silence — no warning reply, no admin
+  // notification. For spam and prompt-injection senders, where the warning
+  // itself is the reward: it confirms a live bot is reading.
+  blockedUsers: z.array(z.number().int()).optional(),
   pulse: z.boolean().default(true),
   pulseIntervalMs: z.number().int().min(60000).default(300000),
   /**