talon-agent 3.8.1 → 3.9.0

package/README.md

@@ -170,7 +170,7 @@ The `desktop` frontend turns the daemon into a **client bridge** — a versioned
 - **Remote (mobile/LAN):** point the app at `host:port` + token; the bridge requires `Authorization: Bearer …` (or `?token=` on the SSE stream) whenever a token is set.
 - **Encryption:** off-loopback binds serve **HTTPS by default** with a persistent self-signed certificate (`~/.talon/keys/`); the companion pins its SHA-256 fingerprint on first connect and refuses any change afterwards. The daemon logs the fingerprint at startup and `/health` advertises it. Opt out (or in, on loopback) with `"tls": false` / `true` in the `desktop` section.
 
-The app provides multi-chat history, live streaming with reasoning + tool-call visibility, per-chat model/effort/pulse/reset, and **settings sync** — read and change the daemon's own config (default model, display name, timezone, pulse/heartbeat/dream) and restart it. See [apps/companion/README.md](apps/companion/README.md).
+The app provides multi-chat history, live streaming with reasoning + tool-call visibility, per-chat model/effort/reset, and **settings sync** — read and change the daemon's own config (default model, display name, timezone, pulse/heartbeat/dream) and restart it. See [apps/companion/README.md](apps/companion/README.md).
 
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "talon-agent",
-  "version": "3.8.1",
+  "version": "3.9.0",
   "description": "Multi-frontend AI agent with full tool access, streaming, cron jobs, and plugin system",
   "author": "Dylan Neve",
   "license": "MIT",
@@ -131,7 +131,6 @@
     "zod": "^4.3.6"
   },
   "devDependencies": {
-    "@swc/core": "^1.15.46",
     "@types/node": "^26.0.0",
     "@types/write-file-atomic": "^4.0.3",
     "@vitest/coverage-v8": "^4.1.3",

package/src/backend/claude-sdk/handler.ts

@@ -22,7 +22,7 @@ import {
 } from "../../storage/sessions.js";
 import { log, logError, logWarn } from "../../util/log.js";
 import { traceMessage } from "../../util/trace.js";
-import { incrementCounter } from "../../util/metrics.js";
+import { incrementCounter } from "../../storage/metrics.js";
 import { isTurnTerminator } from "../../core/tools/index.js";
 
 import type { Query } from "@anthropic-ai/claude-agent-sdk";

package/src/backend/codex/handler/message.ts

@@ -22,7 +22,7 @@ import {
 import { getChatSettings } from "../../../storage/chat-settings.js";
 import { log, logError, logWarn } from "../../../util/log.js";
 import { traceMessage } from "../../../util/trace.js";
-import { incrementCounter } from "../../../util/metrics.js";
+import { incrementCounter } from "../../../storage/metrics.js";
 
 import {
   createStreamState,

package/src/backend/kilo/handler/index.ts

@@ -2,7 +2,7 @@
  * Kilo message handler.
  *
  * Split by responsibility:
- *   - `state`   — in-flight session registry (getActiveSession)
+ *   - `state`   — in-flight session registry (activeSessions)
  *   - `turn`    — runKiloTurn + SSE subscription + last-assistant lookup
  *   - `message` — the handleMessage entry point + post-loop accounting
  *
@@ -10,4 +10,3 @@
  */
 
 export { handleMessage } from "./message.js";
-export { getActiveSession } from "./state.js";

package/src/backend/kilo/handler/state.ts

@@ -1,14 +1,9 @@
 /**
  * Active-turn session registry for Kilo.
  *
- * Tracks the in-flight Kilo session id per chat so gateway actions (e.g.
- * abort on user `/cancel`, refresh MCP on plugin reload) can reach into a
- * running turn without going through chat state.
+ * Tracks the in-flight Kilo session id per chat for the duration of a
+ * turn: `message.ts` records the id on entry and clears it in its finally
+ * block, and `turn.ts` matches incoming SSE events against it.
  */
 
 export const activeSessions = new Map<string, string>();
-
-/** Get the in-flight Kilo session id for a chat, if a turn is running. */
-export function getActiveSession(chatId: string): string | undefined {
-  return activeSessions.get(chatId);
-}

package/src/backend/kilo/index.ts

@@ -26,51 +26,25 @@ export {
   type OpenCodeModelCatalog,
   type OpenCodeModelResolution,
   type ModelButton,
-  getOpenCodeModelCatalog,
-  getOpenCodeModelInfo,
   getOpenCodeModelSelectionValue,
   resolveOpenCodeModelInput,
   getOpenCodeQuickPickModels,
-  getOpenCodeSettingsPresentation,
-  renderOpenCodeModelSummary,
-  renderOpenCodeModelList,
   formatOpenCodeSelectionError,
-  formatOpenCodeUnavailableModel,
 } from "./models/index.js";
 
 // ── Sessions ───────────────────────────────────────────────────────────────
 export {
   summarizeKiloAssistantMessages,
   getKiloSessionSnapshot,
-  getKiloTurnSummary,
-  extractPartsSummary,
-  extractAssistantUsage,
-  rejectPendingQuestions,
   type KiloAssistantInfo,
   type KiloSessionSnapshot,
 } from "./sessions.js";
 
 // ── Server / lifecycle ─────────────────────────────────────────────────────
-export {
-  initKiloAgent,
-  stopKiloServer,
-  ensureServer,
-  ensureSession,
-  ensureChatMcpServer,
-  ensurePluginMcpServers,
-  buildToolOverrides,
-  disconnectChatMcpServer,
-  resolveProviderID,
-  parseStoredKiloModelSelection,
-  KILO_HOSTNAME,
-  KILO_PORT,
-  KILO_BASE_URL,
-  KILO_SYSTEM_PROMPT_SUFFIX,
-  TALON_MCP_SERVER_NAME,
-} from "./server.js";
+export { initKiloAgent, stopKiloServer } from "./server.js";
 
 // ── Handler ────────────────────────────────────────────────────────────────
-export { handleMessage, getActiveSession } from "./handler/index.js";
+export { handleMessage } from "./handler/index.js";
 
 // ── Model provider (Backend adapter) ──────────────────────────────────
 export {

package/src/backend/openai-agents/handler/message.ts

@@ -21,7 +21,7 @@ import { getChatSettings } from "../../../storage/chat-settings.js";
 import { classify } from "../../../core/errors.js";
 import { log, logError, logWarn } from "../../../util/log.js";
 import { traceMessage } from "../../../util/trace.js";
-import { incrementCounter } from "../../../util/metrics.js";
+import { incrementCounter } from "../../../storage/metrics.js";
 
 import {
   createStreamState,

package/src/backend/openai-agents/session.ts

@@ -42,7 +42,7 @@
 
 import { MemorySession } from "@openai/agents";
 import type { AgentInputItem } from "@openai/agents";
-import { incrementCounter } from "../../util/metrics.js";
+import { incrementCounter } from "../../storage/metrics.js";
 
 // ── Public types ───────────────────────────────────────────────────────────
 

package/src/backend/opencode/handler/index.ts

@@ -2,7 +2,7 @@
  * OpenCode message handler.
  *
  * Split by responsibility (parallel to the kilo handler/ layout):
- *   - `state`   — in-flight session registry (getActiveSession)
+ *   - `state`   — in-flight session registry (activeSessions)
  *   - `turn`    — runOpenCodeTurn + SSE subscription + last-assistant lookup
  *   - `message` — the handleMessage entry point + post-loop accounting
  *
@@ -10,4 +10,3 @@
  */
 
 export { handleMessage } from "./message.js";
-export { getActiveSession } from "./state.js";

package/src/backend/opencode/handler/state.ts

@@ -1,14 +1,9 @@
 /**
  * Active-turn session registry for OpenCode.
  *
- * Tracks the in-flight OpenCode session id per chat so gateway actions (e.g.
- * abort on user `/cancel`, refresh MCP on plugin reload) can reach into a
- * running turn without going through chat state.
+ * Tracks the in-flight OpenCode session id per chat for the duration of a
+ * turn: `message.ts` records the id on entry and clears it in its finally
+ * block, and `turn.ts` matches incoming SSE events against it.
  */
 
 export const activeSessions = new Map<string, string>();
-
-/** Get the in-flight OpenCode session id for a chat, if a turn is running. */
-export function getActiveSession(chatId: string): string | undefined {
-  return activeSessions.get(chatId);
-}

package/src/backend/opencode/index.ts

@@ -13,16 +13,9 @@ export {
   type OpenCodeModelCatalog,
   type OpenCodeModelResolution,
   type ModelButton,
-  getOpenCodeModelCatalog,
-  getOpenCodeModelInfo,
   getOpenCodeModelSelectionValue,
   resolveOpenCodeModelInput,
-  getOpenCodeQuickPickModels,
-  getOpenCodeSettingsPresentation,
-  renderOpenCodeModelSummary,
-  renderOpenCodeModelList,
   formatOpenCodeSelectionError,
-  formatOpenCodeUnavailableModel,
 } from "./models/index.js";
 
 export {

package/src/backend/shared/delivery.ts

@@ -30,7 +30,7 @@
 
 import type { StreamState } from "./stream-state.js";
 import { logWarn } from "../../util/log.js";
-import { incrementCounter } from "../../util/metrics.js";
+import { incrementCounter } from "../../storage/metrics.js";
 
 /** Route the delivery decision selected. */
 export type DeliveryRoute = "tool" | "text-part" | "synthetic-error" | "empty";

package/src/backend/shared/handle-retry.ts

@@ -25,7 +25,7 @@
 import type { QueryParams, QueryResult } from "./handler-types.js";
 import { classify, type TalonError } from "../../core/errors.js";
 import { logWarn } from "../../util/log.js";
-import { incrementCounter } from "../../util/metrics.js";
+import { incrementCounter } from "../../storage/metrics.js";
 import { resetSession } from "../../storage/sessions.js";
 import { classifyRetry } from "./model-retry.js";
 import type { AgentEvent } from "../../core/agent-runtime/events.js";

package/src/backend/shared/index.ts

@@ -15,7 +15,8 @@
  *     rollups, flow violations) with backend dimensions.
  *   - `prompt-format` — user-prompt formatter ([time] [Name] [msg_id:N]).
  *   - `frontends` — config `frontend` → messaging-frontend list.
- *   - `session-name` — first-message → short session title.
+ *   - `extractSessionName` — re-exported from `util/session-name` so the
+ *     backends keep one import site; the helper itself is frontend-neutral.
  *   - `usage` — cache-hit % + log summarisers.
  *   - `system-prompt` — per-session prompt snapshots + backend suffix
  *     (assembly itself lives in `core/prompt/`).
@@ -59,7 +60,7 @@ export {
   type DeliveryToolNames,
 } from "./delivery-contract.js";
 
-export { extractSessionName } from "./session-name.js";
+export { extractSessionName } from "../../util/session-name.js";
 
 export {
   cacheHitPercent,

package/src/backend/shared/turn-interrupt.ts

@@ -18,7 +18,7 @@
  */
 
 import { log, logWarn } from "../../util/log.js";
-import { incrementCounter } from "../../util/metrics.js";
+import { incrementCounter } from "../../storage/metrics.js";
 
 const interrupts = new Map<string, () => void | Promise<void>>();
 

package/src/cli/index.ts

@@ -38,14 +38,6 @@ import { mainMenu } from "./menu.js";
 
 export * from "./context.js";
 export * from "./config.js";
-export { runSetup } from "./setup.js";
-export { showStatus, formatUptime } from "./status.js";
-export { viewConfig } from "./config-view.js";
-export { tailLogs, formatLogLine } from "./logs.js";
-export { runDoctor } from "./doctor.js";
-export { startChat } from "./chat.js";
-export { daemonStart, daemonStop, daemonRestart } from "./daemon.js";
-export { mainMenu } from "./menu.js";
 
 /** Every dispatchable subcommand — the unknown-command suggester's vocabulary. */
 const CLI_COMMANDS = [

package/src/core/bus/index.ts

@@ -9,12 +9,4 @@
  */
 
 export { TalonBus, bus } from "./bus.js";
-export type {
-  PublishedEvent,
-  TalonEvent,
-  TalonEventType,
-  TaskSettledEvent,
-  TaskStartedEvent,
-  TurnCompletedEvent,
-  TurnStartedEvent,
-} from "./events.js";
+export type { PublishedEvent, TalonEvent } from "./events.js";

package/src/core/mesh/registry.ts

@@ -8,6 +8,7 @@
  */
 
 import { resolve } from "node:path";
+import { logWarn } from "../../util/log.js";
 import { dirs } from "../../util/paths.js";
 import { readArray, writePrivateJson } from "./persist.js";
 import {
@@ -32,6 +33,33 @@ const LOCATION_FILE = resolve(dirs.root, "mesh-locations.json");
 const HISTORY_FILE = resolve(dirs.root, "mesh-history.json");
 /** Newest fixes kept per device (~a day of 5-minute periodic reports). */
 const MAX_HISTORY_PER_DEVICE = 500;
+/**
+ * Registry bounds. Registrations and location reports are client-supplied
+ * strings that the daemon persists forever and rewrites in full on every
+ * heartbeat — without ceilings, one misbehaving (or malicious) client can
+ * grow the sidecars until every mesh operation crawls. The caps are far
+ * above anything a real device reports: ids are UUIDs (36 chars), names are
+ * human device names, versions are semver-ish.
+ */
+const MAX_ID_CHARS = 128;
+const MAX_NAME_CHARS = 128;
+const MAX_VERSION_CHARS = 64;
+const MAX_PROVIDER_CHARS = 32;
+/**
+ * Devices kept in the registry. Well past any plausible personal mesh, and
+ * with the per-device history bound it also caps the history sidecar.
+ * Reaching it evicts the least-recently-seen entry rather than refusing the
+ * newcomer: a live device re-registers every ~60s and takes its slot back,
+ * so the mesh stays usable even when the cap is being pushed against.
+ */
+const MAX_DEVICES = 128;
+/**
+ * Location entries for device ids that never registered. A fix can legitimately
+ * arrive just before the first registration lands, so these aren't refused —
+ * but they're the one path where an unknown id creates persisted state, so the
+ * set is kept tiny and the stalest orphan is evicted to make room.
+ */
+const MAX_UNREGISTERED_LOCATIONS = 16;
 const PLATFORMS = new Set<DevicePlatform>([
   "android",
   "macos",
@@ -72,6 +100,12 @@ export class MeshRegistry {
       .filter((l): l is DeviceLocation => l !== null)) {
       this.appendHistory(fix);
     }
+    // Sidecars written before the caps existed (or edited by hand) get
+    // trimmed on the way in, so an oversized file is a one-boot problem
+    // rather than permanent state. No write here — load() only reads; the
+    // next mutation persists the trimmed maps.
+    this.enforceDeviceCap();
+    this.enforceOrphanLocationCap();
   }
 
   async register(
@@ -107,6 +141,7 @@ export class MeshRegistry {
       this.history.delete(id);
       evicted = true;
     }
+    if (this.enforceDeviceCap()) evicted = true;
     await this.persistDevices();
     if (evicted) {
       await this.persistLocations();
@@ -159,11 +194,69 @@ export class MeshRegistry {
       await this.persistDevices();
     }
     this.appendHistory(loc);
+    this.enforceOrphanLocationCap();
     await this.persistLocations();
     await this.persistHistory();
     return loc;
   }
 
+  /**
+   * Drop least-recently-seen devices until the registry is inside MAX_DEVICES,
+   * taking their location + history with them (an evicted device leaves no
+   * residue). Returns whether anything went, so callers know the location and
+   * history sidecars need rewriting too.
+   */
+  private enforceDeviceCap(): boolean {
+    if (this.devices.size <= MAX_DEVICES) return false;
+    const stalest = [...this.devices.values()]
+      .sort((a, b) => a.lastSeen - b.lastSeen)
+      .slice(0, this.devices.size - MAX_DEVICES);
+    for (const device of stalest) {
+      this.devices.delete(device.id);
+      this.locations.delete(device.id);
+      this.history.delete(device.id);
+    }
+    logWarn(
+      "mesh",
+      `Device registry at its ${MAX_DEVICES}-device cap — evicted ${stalest
+        .map((d) => `${d.name} [${d.id}]`)
+        .join(", ")} (least recently seen)`,
+    );
+    return true;
+  }
+
+  /**
+   * Bound the state an id that never registered can create: locations for
+   * unknown device ids past MAX_UNREGISTERED_LOCATIONS are dropped
+   * stalest-first, with their history. Registered devices are untouched —
+   * their entries are already bounded by the device cap.
+   */
+  private enforceOrphanLocationCap(): boolean {
+    let dropped = false;
+    const orphans = [...this.locations.values()]
+      .filter((l) => !this.devices.has(l.deviceId))
+      .sort((a, b) => a.ts - b.ts);
+    if (orphans.length > MAX_UNREGISTERED_LOCATIONS) {
+      for (const loc of orphans.slice(
+        0,
+        orphans.length - MAX_UNREGISTERED_LOCATIONS,
+      )) {
+        this.locations.delete(loc.deviceId);
+        this.history.delete(loc.deviceId);
+      }
+      dropped = true;
+    }
+    // A fix always writes a location before its history entry, so a history
+    // key belonging to neither a device nor a location can only come from a
+    // hand-edited (or tampered) sidecar — it would otherwise be immortal.
+    for (const id of this.history.keys()) {
+      if (this.devices.has(id) || this.locations.has(id)) continue;
+      this.history.delete(id);
+      dropped = true;
+    }
+    return dropped;
+  }
+
   /** Fixes for one device since `sinceTs`, oldest first. */
   getHistory(deviceId: string, sinceTs = 0): DeviceLocation[] {
     return (this.history.get(deviceId) ?? [])
@@ -225,10 +318,16 @@ function sanitizeDevice(
   requireCore: boolean,
 ): DeviceInfo | null {
   const id = stringField(body.id);
-  const name = stringField(body.name);
-  const appVersion = stringField(body.appVersion);
+  // Display-only fields are clamped: an absurd name costs the device its
+  // label, not its place on the mesh. The id is the registry's identity key,
+  // so it is REFUSED rather than clamped — truncating it would quietly merge
+  // two devices (or a device and an attacker's near-miss) onto one entry.
+  const name = stringField(body.name)?.slice(0, MAX_NAME_CHARS);
+  const appVersion = stringField(body.appVersion)?.slice(0, MAX_VERSION_CHARS);
   const platform = stringField(body.platform) as DevicePlatform | undefined;
-  if ((requireCore || id !== undefined) && !id) return null;
+  if ((requireCore || id !== undefined) && (!id || id.length > MAX_ID_CHARS)) {
+    return null;
+  }
   if ((requireCore || name !== undefined) && !name) return null;
   if ((requireCore || appVersion !== undefined) && !appVersion) return null;
   if (
@@ -266,6 +365,9 @@ function sanitizeLocation(
   if (!deviceId || !Number.isFinite(lat) || !Number.isFinite(lon) || !ts) {
     return null;
   }
+  // Same identity-key reasoning as sanitizeDevice: a fix keyed by a clamped
+  // id would attach to the wrong device's timeline.
+  if (deviceId.length > MAX_ID_CHARS) return null;
   if (lat! < -90 || lat! > 90 || lon! < -180 || lon! > 180) return null;
   return toDeviceLocation({
     deviceId,
@@ -285,7 +387,7 @@ function sanitizeLocation(
       : {}),
     ts,
     ...(stringField(body.provider)
-      ? { provider: stringField(body.provider) }
+      ? { provider: stringField(body.provider)!.slice(0, MAX_PROVIDER_CHARS) }
       : {}),
     ...(numberField(body.batteryPct) !== undefined
       ? { batteryPct: numberField(body.batteryPct) }

package/src/core/mesh/service.ts

@@ -270,20 +270,31 @@ export class MeshService {
    *
    * The result must come from the device the command was sent to: a reply
    * whose deviceId names a DIFFERENT device is dropped (a confused or
-   * misbehaving companion must not be able to answer for its peers). A
-   * missing deviceId is tolerated for older app builds.
+   * misbehaving companion must not be able to answer for its peers).
+   *
+   * An ABSENT deviceId is dropped too. It used to be tolerated "for older app
+   * builds", but omitting the field skipped the ownership check entirely —
+   * which is exactly what a spoofer would do to feed the model fabricated
+   * exec stdout or a fake install success. The alternative (accept it when
+   * only one command is pending) was rejected: it still cannot attribute the
+   * reply, it merely narrows the window to whenever the mesh is idle, which
+   * is most of the time. Nothing real is lost — `deviceId` has always been
+   * part of the command-result wire contract (protocol/fixtures/mesh_v1.json,
+   * asserted by daemon, node and companion alike) and both shipped clients
+   * send it. An unattributable reply now leaves the command to time out with
+   * the honest "did not answer" rather than resolving with someone's data.
    */
   completeCommand(body: Record<string, unknown>): boolean {
     const commandId = typeof body.commandId === "string" ? body.commandId : "";
     const pending = this.pendingCommands.get(commandId);
     if (!pending) return false;
     const from = typeof body.deviceId === "string" ? body.deviceId : "";
-    if (from && from !== pending.deviceId) return false;
+    if (from !== pending.deviceId) return false;
     const { resolve } = pending;
     this.pendingCommands.delete(commandId);
     resolve({
       commandId,
-      deviceId: typeof body.deviceId === "string" ? body.deviceId : "",
+      deviceId: from,
       ok: body.ok === true,
       ...(typeof body.message === "string" && body.message.trim()
         ? { message: body.message.trim().slice(0, 2_000) }
@@ -587,21 +598,25 @@ export class MeshService {
 
   // ── Streaming transfer bridge surface ─────────────────────────────────────
   // The HTTP routes on the native bridge delegate here; the token is the
-  // entire authorization (single-use, device- and path-bound).
+  // entire authorization (single-use, device- and path-bound). `fromDeviceId`
+  // is the caller's self-declared identity — checked against the device the
+  // token was minted for, so a leaked token can't be redeemed by a peer.
 
   /** POST /devices/file — a device streams a pull's file body up. */
   acceptFileUpload(
     token: string,
     body: Readable,
+    fromDeviceId?: string,
   ): Promise<{ ok: true; bytes: number } | { ok: false; error: string }> {
-    return this.transfers.acceptUpload(token, body);
+    return this.transfers.acceptUpload(token, body, fromDeviceId);
   }
 
   /** GET /devices/file — a device asks for a push's file body. */
   openFileDownload(
     token: string,
+    fromDeviceId?: string,
   ): Promise<{ path: string; size: number } | null> {
-    return this.transfers.openDownload(token);
+    return this.transfers.openDownload(token, fromDeviceId);
   }
 
   /** Streaming is per-command capability — old app builds fall back. */

package/src/core/mesh/transfers.ts

@@ -26,6 +26,8 @@
  * The registry never trusts the HTTP caller with a path — the token IS the
  * authorization, and it only reaches the device over the authed mesh
  * channel (the HTTP routes additionally sit behind the bridge bearer token).
+ * The device binding is enforced on the HTTP leg too: a caller that names
+ * itself must name the device the token was minted for (see take()).
  */
 
 import { randomBytes } from "node:crypto";
@@ -115,12 +117,15 @@ export class TransferStore {
    * Bridge route: a device is streaming a pull's file body up. Writes to a
    * temp file and renames into place, so a dropped connection can't leave a
    * half-written destination. Resolves the pull's `done` promise.
+   *
+   * `fromDeviceId` is the device the HTTP caller says it is (see take()).
    */
   async acceptUpload(
     token: string,
     body: Readable,
+    fromDeviceId?: string,
   ): Promise<{ ok: true; bytes: number } | { ok: false; error: string }> {
-    const t = this.take(token, "pull");
+    const t = this.take(token, "pull", fromDeviceId);
     if (!t)
       return { ok: false, error: "Unknown or already-used transfer token." };
     const tmp = `${t.localPath}.part-${randomBytes(4).toString("hex")}`;
@@ -148,8 +153,9 @@ export class TransferStore {
    */
   async openDownload(
     token: string,
+    fromDeviceId?: string,
   ): Promise<{ path: string; size: number } | null> {
-    const t = this.take(token, "push");
+    const t = this.take(token, "push", fromDeviceId);
     if (!t) return null;
     try {
       const s = await stat(t.localPath);
@@ -164,11 +170,34 @@ export class TransferStore {
     }
   }
 
-  /** Validate + latch a token for its HTTP leg. */
-  private take(token: string, direction: Transfer["direction"]) {
+  /**
+   * Validate + latch a token for its HTTP leg.
+   *
+   * `fromDeviceId` is the device the caller claims to be (the `deviceId`
+   * query param on /devices/file). A token is minted for exactly one device,
+   * so a claim naming a DIFFERENT device is refused — a token that leaked to
+   * another mesh member can't be redeemed under that member's own identity.
+   * The refusal happens before the single-use latch, so a wrong claim can't
+   * burn the real device's token either.
+   *
+   * A caller that claims nothing is still served. Requiring the claim would
+   * break the transfer that ships the client build able to make it:
+   * `update_device`/`update_node` push the new binary over `download_file`,
+   * so a daemon upgraded ahead of its fleet would refuse the very transfer
+   * that updates the fleet. Since the token only ever reaches the target
+   * device (over the addressed command channel) and is single-use with a
+   * 10-minute TTL, tolerating an unclaimed leg costs little; once the fleet
+   * advertises the claim, dropping this line makes the binding mandatory.
+   */
+  private take(
+    token: string,
+    direction: Transfer["direction"],
+    fromDeviceId?: string,
+  ) {
     this.sweep();
     const t = this.transfers.get(token);
     if (!t || t.direction !== direction || t.consumed) return null;
+    if (fromDeviceId && fromDeviceId !== t.deviceId) return null;
     if (Date.now() - t.createdAt > TOKEN_TTL_MS) {
       this.cancel(token);
       return null;

package/src/core/plugin/index.ts

@@ -13,15 +13,6 @@
  * including the `_deps` test seam.
  */
 
-export type {
-  PluginPathEntry,
-  PluginMcpEntry,
-  PluginEntry,
-  TalonPlugin,
-  LoadedPlugin,
-  McpServerConfig,
-} from "./types.js";
-export { isPathPlugin, isMcpPlugin } from "./types.js";
 export { _deps } from "./registry.js";
 export {
   loadPlugins,

package/src/core/prompt/index.ts

@@ -12,19 +12,4 @@
  * `backend/shared/delivery-contract.ts`.
  */
 
-export {
-  assembleSystemPrompt,
-  joinSystemPromptParts,
-  MEMORY_INJECT_MAX_CHARS,
-  type AssemblePromptInputs,
-  type SystemPromptParts,
-} from "./assemble.js";
-
-export {
-  loadSystemTemplate,
-  renderTemplate,
-  clearTemplateCache,
-  type TemplateVars,
-} from "./templates.js";
-
-export { renderWorkspaceListing } from "./workspace-listing.js";
+export { loadSystemTemplate } from "./templates.js";