talon-agent 3.6.1 → 3.6.3

package/README.md

@@ -1,3 +1,7 @@
+<p align="center">
+  <img src="docs/assets/talon-hero.png" alt="Talon — multi-platform agentic AI harness" width="880">
+</p>
+
 # Talon
 
 [![Node.js](https://img.shields.io/badge/node-%3E%3D22-339933?logo=nodedotjs&logoColor=white)](https://nodejs.org)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "talon-agent",
-  "version": "3.6.1",
+  "version": "3.6.3",
   "description": "Multi-frontend AI agent with full tool access, streaming, cron jobs, and plugin system",
   "author": "Dylan Neve",
   "license": "MIT",
@@ -105,7 +105,7 @@
     "@openai/agents": "^0.13.0",
     "@openai/codex-sdk": "^0.145.0",
     "@opencode-ai/sdk": "^1.17.4",
-    "@playwright/mcp": "^0.0.78",
+    "@playwright/mcp": "0.0.56",
     "@types/cross-spawn": "^6.0.6",
     "big-integer": "^1.6.52",
     "cheerio": "^1.2.0",

package/src/app.ts

@@ -22,6 +22,7 @@ import {
   runStartupCatchup,
 } from "./core/background/cron.js";
 import { shutdownTriggers } from "./core/background/triggers/index.js";
+import { pruneSettledTriggers } from "./storage/trigger-store.js";
 import { startWatchdog, stopWatchdog } from "./util/watchdog.js";
 import { log, logError, logWarn } from "./util/log.js";
 import {
@@ -94,6 +95,7 @@ onBackendChange((holder, newBackend, info) => {
 // ── Graceful shutdown ────────────────────────────────────────────────────────
 
 let shuttingDown = false;
+let triggerPruneTimer: ReturnType<typeof setInterval> | null = null;
 
 const SHUTDOWN_TIMEOUT_MS = 15_000;
 const DRAIN_TIMEOUT_MS = 5_000;
@@ -167,6 +169,10 @@ async function gracefulShutdown(signal: string): Promise<void> {
     await awaitHeartbeat();
   });
   await shutdownStep("cron timer", stopCronTimer);
+  await shutdownStep("trigger prune timer", () => {
+    if (triggerPruneTimer) clearInterval(triggerPruneTimer);
+    triggerPruneTimer = null;
+  });
   await shutdownStep("triggers", shutdownTriggers);
   await shutdownStep("watchdog", stopWatchdog);
   await shutdownStep("upload cleanup", stopUploadCleanup);
@@ -225,6 +231,38 @@ async function main(): Promise<void> {
   startWatchdog(config.workspace);
   startUploadCleanup(config.workspace);
 
+  // Cron MUST start before the frontends are awaited: a long-polling
+  // frontend's start() blocks for the entire process lifetime, so anything
+  // sequenced after that await effectively runs at shutdown. (Regression
+  // #396→3.5.0: startCronTimer() sat after the frontend await and no
+  // scheduled job fired for 23 days.) Message delivery inside cron uses the
+  // frontend's send API, which works as soon as init() has completed —
+  // it does not depend on the polling loop being up.
+  //
+  // Catch-up replays runs that came due while Talon was down (per-job
+  // policy; default for new jobs is "once"). Kicking it off first gives it
+  // the ~60s head start to take each replayed job's in-flight lock before
+  // the first scheduled tick, so a replay can't race a scheduled run.
+  // Fire-and-forget so a slow replay never blocks startup.
+  runStartupCatchup().catch((err) =>
+    logError("cron", "startup catch-up failed", err),
+  );
+  startCronTimer();
+
+  // Sweep settled triggers (fired/errored/cancelled/timed_out/terminated)
+  // past their retention window so the trigger list doesn't accumulate
+  // corpses forever. Once at boot, then daily.
+  const pruned = pruneSettledTriggers();
+  if (pruned > 0) log("triggers", `Pruned ${pruned} settled trigger(s)`);
+  triggerPruneTimer = setInterval(
+    () => {
+      const n = pruneSettledTriggers();
+      if (n > 0) log("triggers", `Pruned ${n} settled trigger(s)`);
+    },
+    24 * 60 * 60_000,
+  );
+  triggerPruneTimer.unref();
+
   // A stdin-reading frontend (terminal) blocks in start() for the
   // process lifetime — run it without awaiting alongside the others.
   const stdinFrontends = frontends.filter(
@@ -248,15 +286,8 @@ async function main(): Promise<void> {
       );
   }
 
-  // Replay any runs that came due while Talon was down (per-job catch-up
-  // policy; default skip = fast no-op), THEN start the live cron tick. Kicking
-  // catch-up off first gives it the ~60s head start to take each replayed job's
-  // in-flight lock before the first scheduled tick, so a replay can't race a
-  // scheduled run. Fire-and-forget so a slow replay never blocks startup.
-  runStartupCatchup().catch((err) =>
-    logError("cron", "startup catch-up failed", err),
-  );
-  startCronTimer();
+  // NOTE: nothing may be sequenced after this point — the await above only
+  // resolves when the frontends stop (i.e. at shutdown).
 }
 
 main().catch((err) => {

package/src/core/background/cron.ts

@@ -116,30 +116,56 @@ const JOB_HEALTH: JobHealthOptions = {
 // fires a handful of times, not hundreds.
 const CATCHUP_MAX = 5;
 
+// Wall-clock watermark of the last fully-evaluated tick. Cron dueness is
+// window-based — "did a fire time land inside (watermark, now]?" — instead of
+// "does the current minute match?". setInterval ticks drift under event-loop
+// load, so a tick landing at :29:59 followed by one at :31:01 skips the :30
+// minute entirely under minute-equality; the window formulation cannot miss
+// it. Initialized to process start: anything earlier is startup-catch-up
+// territory (per-job catchup policy), not live-tick recovery.
+let lastTickMs = Date.now();
+
+// Hard cap on how far back a live tick will look. Bounds the window when the
+// watermark lags (load-shed ticks don't advance it) and keeps a pathological
+// stall from replaying ancient fire times outside the catch-up policy.
+const MAX_TICK_LOOKBACK_MS = 10 * 60_000;
+
 async function runCronTick(): Promise<void> {
   if (!deps) return;
-  if (getActiveCount() > 10) return; // safety valve — don't pile on if heavily loaded
+  // Safety valve — don't pile on if heavily loaded. The watermark is NOT
+  // advanced, so the skipped window is re-covered by the next tick (bounded
+  // by MAX_TICK_LOOKBACK_MS).
+  if (getActiveCount() > 10) return;
 
   const now = new Date();
   const nowMs = now.getTime();
+  const windowStartMs = Math.max(lastTickMs, nowMs - MAX_TICK_LOOKBACK_MS);
   const jobs = getAllCronJobs();
   pruneJobHealth(new Set(jobs.map((j) => j.id)));
 
+  let loadShed = false;
   for (const job of jobs) {
     if (!job.enabled) continue;
     // Expiry takes priority over dueness: a job past its end time is disabled
     // and skipped even if this minute would otherwise match.
     if (expireIfPast(job, nowMs)) continue;
     if (runningJobs.has(job.id)) continue; // already in-flight this tick or a previous one
-    if (!isDue(job, now)) continue;
+    if (!isDue(job, now, windowStartMs)) continue;
     if (!jobAllowsRun(job.id, nowMs, JOB_HEALTH)) {
       log("cron", `Skipping "${job.name}" [${job.id}] — breaker open`);
       continue;
     }
-    if (getActiveCount() > 10) break;
+    if (getActiveCount() > 10) {
+      loadShed = true;
+      break;
+    }
 
     await runScheduled(job);
   }
+
+  // Only advance the watermark when every job was evaluated — a load-shed
+  // break leaves it in place so unevaluated jobs keep their window.
+  if (!loadShed) lastTickMs = nowMs;
 }
 
 /**
@@ -343,7 +369,7 @@ export async function runJobNow(
 const warnedBadSchedule = new Set<string>();
 const MAX_WARNED_SCHEDULES = 200;
 
-function isDue(job: CronJob, now: Date): boolean {
+function isDue(job: CronJob, now: Date, windowStartMs: number): boolean {
   const nowMs = now.getTime();
 
   // Not-before gate (both modes): never fire before startAt.
@@ -354,7 +380,9 @@ function isDue(job: CronJob, now: Date): boolean {
   // a burst.
   if (job.lastRunAt !== undefined && job.lastRunAt > nowMs) return false;
 
-  return isIntervalJob(job) ? isIntervalDue(job, nowMs) : isCronDue(job, now);
+  return isIntervalJob(job)
+    ? isIntervalDue(job, nowMs)
+    : isCronDue(job, now, windowStartMs);
 }
 
 /**
@@ -366,11 +394,17 @@ function isIntervalDue(job: CronJob, nowMs: number): boolean {
   return nowMs - intervalAnchor(job) >= (job.everyMs as number);
 }
 
-/** Cron mode: due when the current minute matches a fire time. */
-function isCronDue(job: CronJob, now: Date): boolean {
+/**
+ * Cron mode: due when a scheduled fire time fell inside (floor, now], where
+ * the floor is the tick window start raised by lastRunAt (dedupe — never
+ * re-fire a slot that already ran) and startAt (never count fire times from
+ * before the job's not-before gate). Window semantics make dueness immune to
+ * tick drift: a fire time in a minute no tick landed on is still caught by
+ * the next tick, because the window spans the gap.
+ */
+function isCronDue(job: CronJob, now: Date, windowStartMs: number): boolean {
   if (!job.schedule) return false;
   try {
-    const oneMinuteAgo = new Date(now.getTime() - 60_000);
     const cron = new Cron(job.schedule, {
       timezone: job.timezone ?? undefined,
     });
@@ -380,12 +414,15 @@ function isCronDue(job: CronJob, now: Date): boolean {
     // the job is actually due right now)
     warnedBadSchedule.delete(job.id);
 
-    const next = cron.nextRun(oneMinuteAgo);
-    if (!next) return false;
-
-    const nowMinute = Math.floor(now.getTime() / 60_000);
-    const nextMinute = Math.floor(next.getTime() / 60_000);
-    if (nowMinute !== nextMinute) return false;
+    const floorMs = Math.max(
+      windowStartMs,
+      job.lastRunAt ?? 0,
+      job.startAt ?? 0,
+    );
+    // croner's nextRun is strictly-after its argument, so the fire time at
+    // exactly floorMs is excluded — (floor, now].
+    const next = cron.nextRun(new Date(floorMs));
+    if (!next || next.getTime() > now.getTime()) return false;
 
     // Prevent duplicate runs — ensure at least 55 seconds since last execution
     if (job.lastRunAt && now.getTime() - job.lastRunAt < 55_000) return false;
@@ -407,6 +444,14 @@ function isCronDue(job: CronJob, now: Date): boolean {
   }
 }
 
+// Internal exports for tests — window-based dueness is regression-critical
+// (a drifted tick must not skip a scheduled minute).
+export const _cronInternals = {
+  isDue,
+  isCronDue,
+  MAX_TICK_LOOKBACK_MS,
+};
+
 const CRON_JOB_TIMEOUT_MS = 10 * 60_000; // 10-minute max per job
 
 export async function executeJob(job: CronJob): Promise<ExecuteJobResult> {

package/src/core/engine/gateway-actions/cron.ts

@@ -198,8 +198,13 @@ export const cronHandlers: SharedActionHandlers = {
       maxRuns = m;
     }
 
-    // Missed-run catch-up policy.
-    let catchup: CatchupPolicy | undefined;
+    // Missed-run catch-up policy. New jobs default to "once": a run that
+    // came due while Talon was down (or while the scheduler was wedged)
+    // replays a single time at startup instead of being lost silently — a
+    // live audit found one-shot reminders that missed their date under the
+    // old "skip" default and quietly rolled over a full year. Explicit
+    // "skip" remains available for jobs where a late run is worthless.
+    let catchup: CatchupPolicy = "once";
     if (provided(body.catchup)) {
       catchup = String(body.catchup) as CatchupPolicy;
       if (!CATCHUP_POLICIES.has(catchup))
@@ -245,7 +250,7 @@ export const cronHandlers: SharedActionHandlers = {
       ...(startAt !== undefined ? { startAt } : {}),
       ...(endAt !== undefined ? { endAt } : {}),
       ...(maxRuns !== undefined ? { maxRuns } : {}),
-      ...(catchup ? { catchup } : {}),
+      catchup,
       ...(model ? { model } : {}),
       ...(provider ? { provider } : {}),
       ...(instructions ? { instructions } : {}),

package/src/core/tools/scheduling.ts

@@ -44,7 +44,7 @@ Lifecycle (all optional):
   • once: true        — run a single time, then auto-disable (a one-shot). For "run at 3pm tomorrow", pair a cron/interval that next fires then with once.
   • max_runs: N       — auto-disable after N runs.
   • start_at / end_at — ISO-8601 timestamp (or epoch ms). Don't fire before start_at; auto-disable after end_at.
-  • catchup           — what to do with runs missed while Talon was down: "skip" (default), "once" (one catch-up run), or "all" (replay each missed run, capped).
+  • catchup           — what to do with runs missed while Talon was down: "once" (default — one catch-up run), "skip" (drop missed runs), or "all" (replay each missed run, capped).
 
 Model: leave "model"/"provider" unset to use this chat's model. Set "model" for a valid model on this chat's backend, or set both "provider" and "model" for another backend that supports isolated jobs. "instructions" can provide a short system brief for query jobs.`,
     schema: {
@@ -95,7 +95,7 @@ Model: leave "model"/"provider" unset to use this chat's model. Set "model" for
         .enum(["skip", "once", "all"])
         .optional()
         .describe(
-          "Missed-run policy for downtime: skip (default), once, or all (capped).",
+          "Missed-run policy for downtime: once (default — one catch-up run), skip, or all (capped).",
         ),
       model: z
         .string()

package/src/plugins/playwright/index.ts

@@ -17,10 +17,22 @@
  *     "browser": "firefox",
  *     "endpointFile": "/home/dylan/camoufox-endpoint.txt"
  *   }
+ *
+ * VERSION COUPLING (endpoint mode): the WebSocket handshake requires the
+ * client (playwright-core bundled inside @playwright/mcp) and the remote
+ * browser server (e.g. the python-playwright process hosting Camoufox) to be
+ * on the SAME playwright minor version — a mismatch fails every tool call
+ * with "428 Precondition Required". @playwright/mcp is therefore pinned
+ * exactly in package.json (0.0.56 → playwright 1.58.x, matching python
+ * playwright 1.58 which hosts Camoufox — camoufox itself caps playwright at
+ * <1.61, so the node client cannot chase latest). Bump BOTH sides together,
+ * deliberately — do not let a routine dependency bump move one without the
+ * other.
  */
 
-import { existsSync, readFileSync } from "node:fs";
-import { resolve } from "node:path";
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { tmpdir } from "node:os";
 import type { TalonPlugin } from "../../core/plugin/types.js";
 import { log } from "../../util/log.js";
 
@@ -55,8 +67,24 @@ export function createPlaywrightPlugin(config: {
   const args: string[] = [];
 
   if (endpoint) {
-    // Connect to existing browser (e.g. Camoufox websocket server)
-    args.push("--endpoint", endpoint);
+    // Connect to the existing browser (e.g. the Camoufox websocket server)
+    // via a generated MCP config file: `browser.remoteEndpoint` is the
+    // stable, documented way to attach to a running Playwright server and —
+    // unlike the newer `--endpoint` flag — exists across the @playwright/mcp
+    // versions this repo can pin (the pin tracks the python playwright
+    // version hosting Camoufox; see the version-coupling note above).
+    const mcpConfig = {
+      browser: {
+        ...(browser !== "chromium" ? { browserName: browser } : {}),
+        remoteEndpoint: endpoint,
+      },
+    };
+    const configPath = join(
+      tmpdir(),
+      `talon-playwright-mcp-${process.pid}.json`,
+    );
+    writeFileSync(configPath, JSON.stringify(mcpConfig));
+    args.push("--config", configPath);
   } else {
     args.push("--no-sandbox");
 

package/src/storage/trigger-store.ts

@@ -243,6 +243,33 @@ export function updateTrigger(
   });
 }
 
+/**
+ * How long a settled trigger (fired/errored/cancelled/timed_out/terminated)
+ * is kept for post-mortem inspection before the daily sweep removes it.
+ * Without a sweep the trigger list accumulates corpses forever — a live
+ * audit found 12 of 14 listed triggers dead, some over a week old.
+ */
+export const SETTLED_TRIGGER_TTL_MS = 72 * 60 * 60_000; // 3 days
+
+/**
+ * Delete settled triggers whose terminal state is older than `ttlMs`
+ * (script + log files included, via deleteTrigger). Running/pending
+ * triggers are never touched. Returns how many were pruned.
+ */
+export function pruneSettledTriggers(
+  nowMs = Date.now(),
+  ttlMs = SETTLED_TRIGGER_TTL_MS,
+): number {
+  let pruned = 0;
+  for (const t of getAllTriggers()) {
+    if (t.status === "running" || t.status === "pending") continue;
+    const settledAt = t.endedAt ?? t.lastFireAt ?? t.startedAt ?? t.createdAt;
+    if (nowMs - settledAt < ttlMs) continue;
+    if (deleteTrigger(t.id)) pruned++;
+  }
+  return pruned;
+}
+
 /** Delete a trigger and best-effort clean up its on-disk script + log. */
 export function deleteTrigger(id: string): boolean {
   const t = repo.get(id);