talon-agent 3.33.0 → 3.33.2

package/src/frontend/shared/access.ts

@@ -0,0 +1,152 @@
+/**
+ * Access-gate primitives shared by the chat frontends.
+ *
+ * Telegram and Discord each carried their own copy of the same three
+ * mechanisms — a per-sender sliding-window rate limiter, a bounded
+ * first-seen set for "new DM user" logging, and a keyed cooldown for
+ * unauthorized-access notices — differing only in the sender-id type.
+ * The copies had identical bodies and identical magic numbers; this is
+ * the one implementation, generic over the id.
+ *
+ * What is NOT here: the allow/deny semantics themselves. Telegram gates
+ * on a user allowlist/denylist plus admin group membership; Discord on
+ * users, guilds, channels, and a respond mode. Those are platform
+ * policy and stay with each frontend.
+ */
+
+import { appendDailyLog } from "../../storage/daily-log.js";
+import { log, logDebug } from "../../util/log.js";
+
+// ── Rate limiter ────────────────────────────────────────────────────────────
+
+export interface RateLimiterOptions {
+  /** Sliding window length. */
+  windowMs: number;
+  /** Messages allowed per sender inside one window. */
+  maxMessages: number;
+  /**
+   * When the tracked-sender map grows past this, senders idle for
+   * `staleAfterMs` are evicted until the map is at `evictTo` or the scan
+   * completes. Bounds memory under a flood of distinct senders.
+   */
+  evictAbove?: number;
+  evictTo?: number;
+  staleAfterMs?: number;
+}
+
+export interface RateLimiter<Id> {
+  /**
+   * Record one message from `id` and report whether it exceeded the
+   * window. A limited message is NOT recorded, so the sender is admitted
+   * again as soon as the oldest timestamp ages out.
+   */
+  isLimited(id: Id): boolean;
+}
+
+export function createRateLimiter<Id>(
+  options: RateLimiterOptions,
+): RateLimiter<Id> {
+  const {
+    windowMs,
+    maxMessages,
+    evictAbove = 5_000,
+    evictTo = 2_500,
+    staleAfterMs = 10 * 60_000,
+  } = options;
+  const timestamps = new Map<Id, number[]>();
+
+  return {
+    isLimited(id) {
+      const now = Date.now();
+      let ts = timestamps.get(id);
+      if (!ts) {
+        ts = [];
+        timestamps.set(id, ts);
+      }
+      // Drop entries that have aged out of the window.
+      while (ts.length > 0 && ts[0] < now - windowMs) ts.shift();
+
+      if (ts.length >= maxMessages) {
+        logDebug("bot", `Rate-limited user ${String(id)}`);
+        return true;
+      }
+      ts.push(now);
+
+      if (timestamps.size > evictAbove) {
+        const cutoff = now - staleAfterMs;
+        for (const [sender, list] of timestamps) {
+          if (list.length === 0 || list[list.length - 1] < cutoff) {
+            timestamps.delete(sender);
+          }
+          if (timestamps.size <= evictTo) break;
+        }
+      }
+      return false;
+    },
+  };
+}
+
+// ── First-seen DM users ─────────────────────────────────────────────────────
+
+export interface DmUserTracker<Id> {
+  /**
+   * Log the first message from a sender (talon.log + daily log). No-op
+   * for senders already seen. `tag` is an optional handle rendered in
+   * parentheses after the name, e.g. `@alice`.
+   */
+  track(id: Id, senderName: string, tag?: string): void;
+}
+
+/**
+ * Insertion-ordered set capped at `cap`; on overflow the oldest 10% are
+ * evicted so a flood of one-off senders cannot grow it without bound.
+ */
+export function createDmUserTracker<Id>(cap: number): DmUserTracker<Id> {
+  const seen = new Set<Id>();
+  return {
+    track(id, senderName, tag) {
+      if (seen.has(id)) return;
+      if (seen.size >= cap) {
+        const evictCount = Math.floor(cap * 0.1);
+        const iter = seen.values();
+        for (let i = 0; i < evictCount; i++) {
+          seen.delete(iter.next().value as Id);
+        }
+      }
+      seen.add(id);
+      const tagStr = tag ? ` (${tag})` : "";
+      const line = `New DM user: ${senderName}${tagStr} [id:${String(id)}]`;
+      log("users", line);
+      appendDailyLog("System", line);
+    },
+  };
+}
+
+// ── Notice cooldown ─────────────────────────────────────────────────────────
+
+export interface NoticeCooldown {
+  /**
+   * Whether a notice for `key` should fire now. Returns true at most once
+   * per `ttlMs` per key, recording the send. The map is cleared outright
+   * at `cap` entries — cheaper than an LRU and the worst case is one
+   * extra notice per key.
+   */
+  shouldNotify(key: string): boolean;
+}
+
+export function createNoticeCooldown(options: {
+  ttlMs: number;
+  cap: number;
+}): NoticeCooldown {
+  const last = new Map<string, number>();
+  return {
+    shouldNotify(key) {
+      const now = Date.now();
+      const previous = last.get(key);
+      if (previous && now - previous < options.ttlMs) return false;
+      if (last.size >= options.cap) last.clear();
+      last.set(key, now);
+      return true;
+    },
+  };
+}

package/src/frontend/telegram/handlers/access.ts

@@ -8,15 +8,12 @@ import { appendDailyLog } from "../../../storage/daily-log.js";
 import { log, logWarn } from "../../../util/log.js";
 import { getSenderName } from "./context.js";
 import {
-  knownDmUsers,
-  KNOWN_DM_USERS_CAP,
+  dmUsers,
   accessConfig,
   verifiedGroups,
   MAX_VERIFIED_GROUPS,
   VERIFIED_GROUP_TTL_MS,
-  unauthorizedCooldown,
-  UNAUTHORIZED_COOLDOWN_MS,
-  MAX_UNAUTHORIZED_COOLDOWNS,
+  unauthorizedNotices,
 } from "./state.js";
 
 export function trackDmUser(
@@ -24,19 +21,11 @@ export function trackDmUser(
   senderName: string,
   senderUsername?: string,
 ): void {
-  if (knownDmUsers.has(senderId)) return;
-  // Evict oldest 10% when cap reached (Set maintains insertion order)
-  if (knownDmUsers.size >= KNOWN_DM_USERS_CAP) {
-    const evictCount = Math.floor(KNOWN_DM_USERS_CAP * 0.1);
-    const iter = knownDmUsers.values();
-    for (let i = 0; i < evictCount; i++) {
-      knownDmUsers.delete(iter.next().value as number);
-    }
-  }
-  knownDmUsers.add(senderId);
-  const tag = senderUsername ? ` (@${senderUsername})` : "";
-  log("users", `New DM user: ${senderName}${tag} [id:${senderId}]`);
-  appendDailyLog("System", `New DM user: ${senderName}${tag} [id:${senderId}]`);
+  dmUsers.track(
+    senderId,
+    senderName,
+    senderUsername ? `@${senderUsername}` : undefined,
+  );
 }
 
 export function setAccessControl(cfg: {
@@ -274,13 +263,7 @@ async function notifyUnauthorized(
   }
 
   const key = type === "dm" ? `dm:${ctx.from?.id}` : `group:${ctx.chat?.id}`;
-  const now = Date.now();
-  const lastWarned = unauthorizedCooldown.get(key);
-  if (lastWarned && now - lastWarned < UNAUTHORIZED_COOLDOWN_MS) return;
-  if (unauthorizedCooldown.size >= MAX_UNAUTHORIZED_COOLDOWNS) {
-    unauthorizedCooldown.clear();
-  }
-  unauthorizedCooldown.set(key, now);
+  if (!unauthorizedNotices.shouldNotify(key)) return;
 
   // Warn the user
   try {

package/src/frontend/telegram/handlers/queue.ts

@@ -24,52 +24,20 @@ import {
   recordMessageReceived,
   recordError,
 } from "../../../util/watchdog.js";
-import { log, logError, logWarn, logDebug } from "../../../util/log.js";
+import { log, logError, logWarn } from "../../../util/log.js";
 import { appendDailyLog } from "../../../storage/daily-log.js";
 import { processAndReply, sendHtml } from "./delivery.js";
 import {
   messageQueues,
   lastHandledMessageIdByChat,
-  userMessageTimestamps,
+  rateLimiter,
   DEBOUNCE_MS,
   MAX_QUEUED_PER_CHAT,
-  RATE_LIMIT_WINDOW_MS,
-  RATE_LIMIT_MAX_MESSAGES,
   type QueuedMessage,
 } from "./state.js";
 
 export function isUserRateLimited(senderId: number): boolean {
-  const now = Date.now();
-  let timestamps = userMessageTimestamps.get(senderId);
-  if (!timestamps) {
-    timestamps = [];
-    userMessageTimestamps.set(senderId, timestamps);
-  }
-
-  // Remove old entries outside the window
-  while (timestamps.length > 0 && timestamps[0] < now - RATE_LIMIT_WINDOW_MS) {
-    timestamps.shift();
-  }
-
-  if (timestamps.length >= RATE_LIMIT_MAX_MESSAGES) {
-    logDebug("bot", `Rate-limited user ${senderId}`);
-    return true;
-  }
-
-  timestamps.push(now);
-
-  // Evict stale entries — remove users who haven't messaged in 10+ minutes
-  if (userMessageTimestamps.size > 5_000) {
-    const cutoff = now - 10 * 60_000;
-    for (const [userId, ts] of userMessageTimestamps) {
-      if (ts.length === 0 || ts[ts.length - 1] < cutoff) {
-        userMessageTimestamps.delete(userId);
-      }
-      if (userMessageTimestamps.size <= 2_500) break; // evict down to half
-    }
-  }
-
-  return false;
+  return rateLimiter.isLimited(senderId);
 }
 
 /**

package/src/frontend/telegram/handlers/state.ts

@@ -9,11 +9,15 @@
 
 import type { Bot } from "grammy";
 import type { TalonConfig } from "../../../util/config.js";
+import {
+  createDmUserTracker,
+  createNoticeCooldown,
+  createRateLimiter,
+} from "../../shared/access.js";
 
 // ── First-time DM user tracking ──────────────────────────────────────────────
 
-export const knownDmUsers = new Set<number>();
-export const KNOWN_DM_USERS_CAP = 10_000;
+export const dmUsers = createDmUserTracker<number>(10_000);
 
 // ── Access control ──────────────────────────────────────────────────────────
 
@@ -37,9 +41,10 @@ export const MAX_VERIFIED_GROUPS = 1000;
 export const VERIFIED_GROUP_TTL_MS = 10 * 60 * 1000; // 10 minutes
 
 // Rate-limit unauthorized access warnings (one per user/group per 10 minutes)
-export const unauthorizedCooldown = new Map<string, number>();
-export const UNAUTHORIZED_COOLDOWN_MS = 10 * 60 * 1000;
-export const MAX_UNAUTHORIZED_COOLDOWNS = 5000;
+export const unauthorizedNotices = createNoticeCooldown({
+  ttlMs: 10 * 60 * 1000,
+  cap: 5000,
+});
 
 // ── Message queue (debounce rapid-fire messages per chat) ─────────────────────
 
@@ -72,6 +77,8 @@ export const lastHandledMessageIdByChat = new Map<string, number>();
 
 // ── Per-user rate limiting ──────────────────────────────────────────────────
 
-export const userMessageTimestamps = new Map<number, number[]>();
-export const RATE_LIMIT_WINDOW_MS = 60_000; // 1 minute window
-export const RATE_LIMIT_MAX_MESSAGES = 15; // max 15 messages per minute per user
+/** 15 messages per minute per user. */
+export const rateLimiter = createRateLimiter<number>({
+  windowMs: 60_000,
+  maxMessages: 15,
+});

package/src/backend/kilo/events.ts

@@ -1,60 +0,0 @@
-/**
- * Kilo SSE event processing — thin wrapper around
- * `backend/remote-server/events.ts` that binds the Kilo-specific
- * `extractPartsSummary` extractor.
- *
- * The wire-format and event-driven state machine is identical between
- * OpenCode and Kilo (Kilo is a fork of OpenCode and shares the same
- * SSE schema). All the logic lives in the shared module; this file is
- * the Kilo-side configurator + re-export surface for back-compat with
- * existing imports from `./events.js`.
- */
-
-import {
-  finalizePartsIntoState as finalizePartsIntoStateShared,
-  processStreamEvent as processStreamEventShared,
-  STREAM_INTERVAL_MS,
-  maybeFireStreamDelta,
-  type EventProcessingContext as SharedEventContext,
-  type FinalizePartsInputs as SharedFinalizeInputs,
-  type ProcessEventOutcome,
-} from "../remote-server/events.js";
-import { extractPartsSummary } from "./sessions.js";
-
-// ── Re-exports ─────────────────────────────────────────────────────────────
-
-export { STREAM_INTERVAL_MS, maybeFireStreamDelta };
-export type { ProcessEventOutcome };
-
-/** Context type, with `backendLabel` defaulted to "Kilo" via the wrappers. */
-export type EventProcessingContext = Omit<SharedEventContext, "backendLabel">;
-
-/**
- * Process one Kilo SSE event. Delegates to the shared processor with the
- * Kilo backend label.
- */
-export function processStreamEvent(
-  event: { type?: string; properties?: Record<string, unknown> },
-  ctx: EventProcessingContext,
-): Promise<ProcessEventOutcome> {
-  return processStreamEventShared(event, { ...ctx, backendLabel: "Kilo" });
-}
-
-/** Inputs for the Kilo-side `finalizePartsIntoState`. */
-export type FinalizePartsInputs = Omit<
-  SharedFinalizeInputs,
-  "extractPartsSummary"
->;
-
-/**
- * Drain Kilo's authoritative `session.messages` parts list into the
- * stream state. Delegates to the shared finalizer with the Kilo
- * `extractPartsSummary` extractor (which understands Kilo's
- * `synthetic: true` text-part flag).
- */
-export function finalizePartsIntoState(inputs: FinalizePartsInputs): {
-  toolsProcessed: number;
-  syntheticErrorText?: string;
-} {
-  return finalizePartsIntoStateShared({ ...inputs, extractPartsSummary });
-}

package/src/backend/kilo/handler/state.ts

@@ -1,9 +0,0 @@
-/**
- * Active-turn session registry for Kilo.
- *
- * Tracks the in-flight Kilo session id per chat for the duration of a
- * turn: `message.ts` records the id on entry and clears it in its finally
- * block, and `turn.ts` matches incoming SSE events against it.
- */
-
-export const activeSessions = new Map<string, string>();

package/src/backend/opencode/handler/state.ts

@@ -1,9 +0,0 @@
-/**
- * Active-turn session registry for OpenCode.
- *
- * Tracks the in-flight OpenCode session id per chat for the duration of a
- * turn: `message.ts` records the id on entry and clears it in its finally
- * block, and `turn.ts` matches incoming SSE events against it.
- */
-
-export const activeSessions = new Map<string, string>();