talon-agent 3.8.2 → 3.9.0

package/src/core/weaver/index.ts

@@ -1,13 +1,9 @@
-export { Thread, type Warp, type ThreadSnapshot } from "./thread.js";
-export { ThreadSession, type SessionSummary } from "./thread-session.js";
+export { Thread, type ThreadSnapshot } from "./thread.js";
+
 export { Loom, type ContextRegistry } from "./loom.js";
-export { carryTurnEvents, type EventSink } from "./shuttle.js";
-export { startTypingLoop, TYPING_REFRESH_MS } from "./typing-loop.js";
-export {
-  resolveWarp,
-  type WarpResolution,
-  type WarpResolverDeps,
-} from "./warp-resolver.js";
+export { carryTurnEvents } from "./shuttle.js";
+export { startTypingLoop } from "./typing-loop.js";
+export { resolveWarp } from "./warp-resolver.js";
 export {
   Weaver,
   getActiveLoom,

package/src/frontend/discord/actions/messaging.ts

@@ -6,7 +6,11 @@
 import type { Client } from "discord.js";
 import { withRetry } from "../../../core/engine/gateway.js";
 import { sendChunked } from "../handlers/index.js";
-import { suppressMentions, DISCORD_MAX_TEXT } from "../formatting.js";
+import {
+  suppressMentions,
+  splitMessage,
+  DISCORD_MAX_TEXT,
+} from "../formatting.js";
 import { log, logError } from "../../../util/log.js";
 import {
   saveScheduled,
@@ -24,6 +28,41 @@ import type { DiscordActionHandlers } from "./types.js";
 /** Longest schedulable delay: 24h. Timers re-arm from the store on boot. */
 const MAX_DELAY_SEC = 24 * 60 * 60;
 
+/**
+ * Deliver one scheduled entry, replaying whatever it was scheduled with.
+ *
+ * The `send` tool documents that "buttons and reply threading survive the
+ * delay — the schedule handler replays them at fire time". Discord's path
+ * used to call `sendChunked(c, entry.text)` and drop both, so a scheduled
+ * message with buttons arrived bare while the caller had been told ok:true.
+ */
+async function fireScheduled(
+  channel: Awaited<ReturnType<typeof resolveChannel>>,
+  entry: ScheduledMessage,
+): Promise<void> {
+  if (!channel) return;
+  const replyTo =
+    entry.replyTo !== undefined ? String(entry.replyTo) : undefined;
+  if (!entry.rows || entry.rows.length === 0) {
+    await sendChunked(channel, entry.text, replyTo);
+    return;
+  }
+  const components = buildButtonRows(entry.rows);
+  const chunks = splitMessage(suppressMentions(entry.text), DISCORD_MAX_TEXT);
+  for (let i = 0; i < chunks.length; i++) {
+    if (!channel.isSendable()) return;
+    const last = i === chunks.length - 1;
+    await channel.send({
+      content: chunks[i],
+      ...(last ? { components } : {}),
+      allowedMentions: { parse: [] },
+      ...(i === 0 && replyTo
+        ? { reply: { messageReference: replyTo, failIfNotExists: false } }
+        : {}),
+    });
+  }
+}
+
 /** Arm a timer for a stored entry; fires, then cleans up store + map. */
 function armScheduled(
   client: Client,
@@ -34,7 +73,7 @@ function armScheduled(
   const timer = setTimeout(async () => {
     try {
       const c = await resolveChannel(client, Number(entry.chatId));
-      if (c) await sendChunked(c, entry.text);
+      if (c) await fireScheduled(c, entry);
     } catch (err) {
       logError(
         "discord",
@@ -189,25 +228,44 @@ export const messagingHandlers: DiscordActionHandlers = {
       }>
     >;
     gateway.incrementMessages(chatId);
-    const components = buildButtonRows(rows);
-    const safe = suppressMentions(text).slice(0, DISCORD_MAX_TEXT);
     if (!channel!.isSendable())
       return { ok: false, error: "Channel not sendable" };
     return tryAction("send_message_with_buttons", async () => {
-      const sent = await withRetry(
-        () =>
-          channel!.send({
-            content: safe,
-            components,
-            allowedMentions: { parse: [] },
-          }) as Promise<{ id: string }>,
-      );
-      return { ok: true, message_id: sent.id };
+      // buildButtonRows is inside tryAction on purpose: it can still reject a
+      // row, and escaping here would bypass the action's error mapping and
+      // lose the text as well as the buttons.
+      const components = buildButtonRows(rows);
+      // Chunk rather than slice. `.slice(0, 2000)` dropped everything past
+      // the limit mid-word and still answered ok:true, so the model never
+      // learned its reply had been cut — while the SAME text without buttons
+      // went through sendChunked and arrived whole.
+      const chunks = splitMessage(suppressMentions(text), DISCORD_MAX_TEXT);
+      const ids: string[] = [];
+      for (let i = 0; i < chunks.length; i++) {
+        const last = i === chunks.length - 1;
+        const sent = await withRetry(
+          () =>
+            channel!.send({
+              content: chunks[i],
+              // Buttons belong on the final chunk: they act on the whole
+              // message, and Discord would render a set per chunk otherwise.
+              ...(last ? { components } : {}),
+              allowedMentions: { parse: [] },
+            }) as Promise<{ id: string }>,
+        );
+        ids.push(sent.id);
+      }
+      return { ok: true, message_id: ids[0], message_ids: ids };
     });
   },
 
   schedule_message: (body, chatId, { client, scheduledMessages }) => {
     const text = String(body.text ?? "");
+    const rows = body.rows as ScheduledMessage["rows"];
+    const replyTo =
+      typeof body.reply_to_message_id === "string"
+        ? body.reply_to_message_id
+        : undefined;
     // NaN (e.g. delay_seconds: "5m") must fall back to the default, not
     // propagate: setTimeout(fn, NaN) fires immediately.
     const requested = Number(body.delay_seconds ?? 60);
@@ -222,6 +280,8 @@ export const messagingHandlers: DiscordActionHandlers = {
       text,
       fireAt: Date.now() + delaySec * 1000,
       createdAt: Date.now(),
+      replyTo,
+      rows,
     };
     // Persist before arming: if we crash between the two, the restore
     // path delivers it; the reverse order could lose it forever.

package/src/frontend/discord/actions/shared.ts

@@ -70,11 +70,21 @@ export function buildButtonRows(
   >,
 ): ActionRowBuilder<ButtonBuilder>[] {
   const out: ActionRowBuilder<ButtonBuilder>[] = [];
+  // custom_id must be unique within a message or Discord rejects the send.
+  // Two buttons with the same label — or none at all, which both collapse to
+  // the bare `ai:` prefix — used to produce a duplicate pair.
+  const usedIds = new Set<string>();
   for (const row of rows.slice(0, 5)) {
     const arb = new ActionRowBuilder<ButtonBuilder>();
     for (const btn of row.slice(0, 5)) {
       const b = new ButtonBuilder().setLabel(safeSlice(btn.text || "•", 80));
-      if (btn.url) {
+      // Only http(s) can be a Link button. discord.js throws on anything
+      // else — a bare domain ("docs.example.com", a common model output) or
+      // a javascript: URL — and the throw escapes before the send, so ONE
+      // malformed URL discarded the reply text and every other button too.
+      // Downgrade to a plain non-link button instead: the label still says
+      // what it meant, and the rest of the message survives.
+      if (btn.url !== undefined && /^https?:\/\//i.test(btn.url)) {
         b.setStyle(ButtonStyle.Link).setURL(btn.url);
       } else {
         const styleMap: Record<string, ButtonStyle> = {
@@ -88,13 +98,21 @@ export function buildButtonRows(
         // Namespace AI-generated custom_ids under `ai:` so the callback router
         // never confuses them with system custom_ids like `settings:done`.
         // The router strips the prefix before forwarding to the agent.
+        //
+        // Budget is 100 UTF-16 units total (Discord's cap), so the raw part
+        // gets 100 minus the 3-unit prefix minus room for a de-dupe suffix.
         const raw = btn.callback_data || btn.text || "";
-        const id = `ai:${safeSlice(raw, 96)}`;
+        let id = `ai:${safeSlice(raw, 93)}`;
+        for (let n = 2; usedIds.has(id); n++)
+          id = `ai:${safeSlice(raw, 93)}#${n}`;
+        usedIds.add(id);
         b.setStyle(style).setCustomId(id);
       }
       arb.addComponents(b);
     }
-    out.push(arb);
+    // Discord requires at least one component per action row; an empty row
+    // (from an empty inner array) fails the whole message.
+    if (arb.components.length > 0) out.push(arb);
   }
   return out;
 }

package/src/frontend/discord/commands/admin.ts

@@ -9,7 +9,7 @@ import type { Gateway } from "../../../core/engine/gateway.js";
 import { respawnSelf } from "../../../util/respawn.js";
 import { forceDream } from "../../../core/background/dream.js";
 import { formatDuration, renderMetricsMessages } from "../helpers.js";
-import { getMetrics, getTodayMetrics } from "../../../util/metrics.js";
+import { getMetrics, getTodayMetrics } from "../../../storage/metrics.js";
 import { handleAdminSubcommand } from "../admin.js";
 import { isAdmin } from "../handlers/index.js";
 import { suppressMentions, DISCORD_MAX_TEXT } from "../formatting.js";

package/src/frontend/discord/errors.ts

@@ -18,13 +18,24 @@ type DiscordAPIErrorLike = {
   rawError?: { code?: number };
 };
 
-/** Extract numeric JSON error code, if this looks like a DiscordAPIError. */
-function discordErrorCode(err: unknown): number | null {
-  if (!err || typeof err !== "object") return null;
-  const e = err as DiscordAPIErrorLike;
+/**
+ * Extract numeric JSON error code, if this looks like a DiscordAPIError.
+ *
+ * Walks the `cause` chain, which is what makes this work at all on the
+ * primary send paths. Those run inside `withRetry`, which rethrows
+ * `classify(err)` — a TalonError carrying only the message, with the
+ * DiscordAPIError demoted to `cause`. A shallow look therefore found no
+ * code and every curated message below was dead on `send_message`,
+ * `reply_to`, `send_message_with_buttons`, the media sends, and
+ * forward/copy: the agent got a bare "Missing Permissions" instead of
+ * being told which permission and on what.
+ */
+function discordErrorCode(err: unknown, depth = 0): number | null {
+  if (depth > 5 || !err || typeof err !== "object") return null;
+  const e = err as DiscordAPIErrorLike & { cause?: unknown };
   if (typeof e.code === "number") return e.code;
   if (typeof e.rawError?.code === "number") return e.rawError.code;
-  return null;
+  return discordErrorCode(e.cause, depth + 1);
 }
 
 /**

package/src/frontend/discord/formatting.ts

@@ -58,12 +58,27 @@ export function suppressMentions(text: string): string {
 }
 
 /**
- * Slice a string to `max` user-visible characters without splitting multi-byte
- * code points (emoji, CJK) on a UTF-16 surrogate boundary. Used for Discord
- * `customId`, `label`, `value`, etc. where Discord measures char count.
+ * Slice a string so it satisfies a Discord length limit, without splitting a
+ * surrogate pair. Used for `customId`, `label`, `value`, etc.
+ *
+ * `max` counts UTF-16 code units, because that is what Discord (and
+ * discord.js's validators, which call `String.length`) measure. Counting
+ * code points instead — `Array.from(text).slice(0, max)` — silently
+ * overshoots for any astral character: 80 code points of emoji is 160 code
+ * units, so the guard passed and discord.js then threw
+ * `ExpectedConstraintError: Invalid string length`, taking the whole message
+ * with it. The guard worked precisely when it wasn't needed and failed when
+ * it was.
  */
 export function safeSlice(text: string, max: number): string {
-  return Array.from(text).slice(0, max).join("");
+  if (text.length <= max) return text;
+  let out = "";
+  // Iterating a string yields whole code points, so a pair is never split.
+  for (const char of text) {
+    if (out.length + char.length > max) break;
+    out += char;
+  }
+  return out;
 }
 
 /** Simple HTML-style escape used when displaying raw text inside code blocks. */

package/src/frontend/native/index.ts

@@ -69,7 +69,7 @@ import {
 } from "../../core/engine/backend-controller/index.js";
 import { getActiveReasoningLevels } from "../shared/reasoning-levels.js";
 import { NativeChats, DEFAULT_CHAT_TITLE, type ChatEntry } from "./chats.js";
-import { extractSessionName } from "../../backend/shared/session-name.js";
+import { extractSessionName } from "../../util/session-name.js";
 import { BridgeServer, type BridgeServerHandlers } from "./server.js";
 import { createNativeActionHandler } from "./actions.js";
 import { getMeshService } from "../../core/mesh/index.js";
@@ -1192,8 +1192,10 @@ export function createNativeFrontend(
     storeLocation: (body) => mesh.storeLocation(body),
     listDevices: () => mesh.list(),
     completeCommand: (body) => mesh.completeCommand(body),
-    acceptFileUpload: (token, body) => mesh.acceptFileUpload(token, body),
-    openFileDownload: (token) => mesh.openFileDownload(token),
+    acceptFileUpload: (token, body, fromDeviceId) =>
+      mesh.acceptFileUpload(token, body, fromDeviceId),
+    openFileDownload: (token, fromDeviceId) =>
+      mesh.openFileDownload(token, fromDeviceId),
     openNodeInstall: (token) => mesh.openNodeInstall(token),
     openNodeBinary: (token) => mesh.openNodeBinary(token),
   };
@@ -1205,14 +1207,22 @@ export function createNativeFrontend(
   const bridgeTls = nativeCfg.tls ?? !isLoopbackHost(bridgeHost);
   // Never serve the agent API to the network unauthenticated: a non-loopback
   // bind with no configured token gets a persistent auto-minted one instead.
+  // `?? ` alone would treat an empty string as a configured token and skip
+  // the mint, serving the LAN unauthenticated while looking configured —
+  // easy to hit from `"token": "${BRIDGE_TOKEN}"` with the var unset.
+  const configuredToken =
+    nativeCfg.token !== undefined && nativeCfg.token !== ""
+      ? nativeCfg.token
+      : undefined;
   const bridgeToken =
-    nativeCfg.token ??
+    configuredToken ??
     (isLoopbackHost(bridgeHost) ? undefined : loadOrCreateBridgeToken());
   const server = new BridgeServer(
     {
       host: bridgeHost,
       port: nativeCfg.port ?? 19880,
       token: bridgeToken,
+      allowedOrigins: nativeCfg.allowedOrigins,
       startedAt,
       ...(bridgeTls ? { tls: () => loadOrCreateBridgeTlsIdentity() } : {}),
     },
@@ -1249,13 +1259,17 @@ export function createNativeFrontend(
     async init() {
       await mesh.load();
       // Plug this bridge in as the mesh's transport: locates and device
-      // commands (from ANY frontend's mesh tool calls) fan out to every
-      // connected companion client as SSE events; each client filters by
-      // its own device id.
+      // commands (from ANY frontend's mesh tool calls) leave as SSE events.
+      //
+      // A locate is a bare "who's there?" — no secret in the frame, and
+      // pre-command app builds rely on receiving it — so it still fans out.
+      // A command is the opposite: its params carry transfer tokens, exec
+      // command lines and (on the chunked fallback) file bodies, so it goes
+      // to the target device's own client(s) only.
       unregisterMeshTransport = mesh.registerTransport({
         locate: (deviceId) => broadcast({ kind: "locate", deviceId }),
         command: (command) =>
-          broadcast({
+          server.sendToDevice(command.deviceId, {
             kind: "device_command",
             id: command.id,
             deviceId: command.deviceId,

package/src/frontend/native/protocol.ts

@@ -286,6 +286,12 @@ export type BridgeEvent =
    * target device executes it and answers via POST /devices/command-result
    * with the same `id` as `commandId`. Additive in v1 — app builds that
    * predate the command channel simply ignore the event.
+   *
+   * Addressed, not broadcast: params carry one-time transfer tokens, exec
+   * command lines and (on the chunked fallback) file bodies, so the frame
+   * goes only to the SSE client(s) that claimed this `deviceId` via
+   * `GET /events?deviceId=…`. Clients that claim no id still receive
+   * commands for devices nobody claimed, so pre-claim builds keep working.
    */
   | {
       kind: "device_command";

package/src/frontend/native/server.ts

@@ -133,14 +133,17 @@ export type BridgeServerHandlers = {
     | Promise<{ devices: DeviceInfo[]; locations: DeviceLocation[] }>;
   /** A device answered a device_command; true when a call was waiting. */
   completeCommand(body: Record<string, unknown>): boolean;
-  /** A device streams a pull-transfer's file body up (raw request body). */
+  /** A device streams a pull-transfer's file body up (raw request body).
+   *  `fromDeviceId` is the caller's claimed identity, when it sent one. */
   acceptFileUpload(
     token: string,
     body: IncomingMessage,
+    fromDeviceId?: string,
   ): Promise<{ ok: true; bytes: number } | { ok: false; error: string }>;
   /** Resolve a push-transfer token to the file to stream down, or null. */
   openFileDownload(
     token: string,
+    fromDeviceId?: string,
   ): Promise<{ path: string; size: number } | null>;
   /** Resolve a node-provisioning token to its installer script, or null. */
   openNodeInstall(token: string): { script: string; filename: string } | null;
@@ -152,6 +155,12 @@ const SSE_PING_MS = 25_000;
 const MAX_BODY_BYTES = 256 * 1024;
 const MAX_UPLOAD_BYTES = 25 * 1024 * 1024;
 const PORT_FALLBACKS = 5;
+/**
+ * Longest device id a client may claim (`?deviceId=…`). Matches the
+ * registry's own id cap — a longer id can never name a real device, and the
+ * claim is held for the life of a connection, so it stays a bounded key.
+ */
+const MAX_DEVICE_ID_CHARS = 128;
 
 // Failed-auth lockout: after this many wrong tokens from one address inside
 // the window, that address gets 429s until the window lapses. The token's
@@ -173,7 +182,13 @@ type AuthState = "ok" | "anonymous" | "bad";
 
 export class BridgeServer {
   private server: Server | null = null;
-  private clients = new Set<ServerResponse>();
+  /**
+   * Live SSE connections → the mesh device id each one claimed on connect
+   * (undefined for clients that didn't claim one: desktop UIs, and companion
+   * builds from before the claim existed). The claim is what makes
+   * `sendToDevice` addressable rather than a shout.
+   */
+  private clients = new Map<ServerResponse, string | undefined>();
   private pingTimer: ReturnType<typeof setInterval> | undefined;
   private port = 0;
   private tlsIdentity: BridgeTlsIdentity | null = null;
@@ -185,6 +200,9 @@ export class BridgeServer {
       host: string;
       port: number;
       token?: string;
+      /** Origins permitted to call the bridge from a browser. Empty by
+       *  default: native clients send no Origin and need no entry here. */
+      allowedOrigins?: readonly string[];
       startedAt: string;
       /**
        * When present, the bridge serves HTTPS with this identity. A provider
@@ -213,8 +231,50 @@ export class BridgeServer {
   /** Push an event to every connected SSE client. */
   broadcast(event: BridgeEvent): void {
     if (this.clients.size === 0) return;
+    this.write(this.clients.keys(), event);
+  }
+
+  /**
+   * Push an event to the client(s) that claimed `deviceId` — the delivery
+   * path for anything addressed to ONE device.
+   *
+   * Device commands are not public: their params carry one-time transfer
+   * tokens, exec command lines, remote paths, and — on the chunked fallback —
+   * whole base64 file bodies. Broadcasting them handed every connected client
+   * another device's secrets and relied on each client discarding what wasn't
+   * addressed to it, which is courtesy, not enforcement.
+   *
+   * A claim is an ADDRESS, not a credential: any client holding the bridge
+   * token could claim any id, and the bridge token is (still) the only trust
+   * boundary here. What this buys is that a device no longer passively
+   * receives traffic meant for its peers.
+   *
+   * Clients that claimed nothing are the fallback audience, and only when the
+   * target claimed nothing either: a companion build that predates the claim
+   * can't be addressed, and dropping its commands would take the mesh offline
+   * for it. So an updated device's traffic never reaches them — the fallback
+   * shrinks to nothing as the fleet updates.
+   */
+  sendToDevice(deviceId: string, event: BridgeEvent): void {
+    if (this.clients.size === 0) return;
+    const claimed: ServerResponse[] = [];
+    const unclaimed: ServerResponse[] = [];
+    for (const [res, id] of this.clients) {
+      if (id === deviceId) claimed.push(res);
+      else if (id === undefined) unclaimed.push(res);
+    }
+    if (claimed.length === 0) {
+      logDebug(
+        "native",
+        `No SSE client claims device ${deviceId} — delivering to ${unclaimed.length} unclaimed client(s)`,
+      );
+    }
+    this.write(claimed.length > 0 ? claimed : unclaimed, event);
+  }
+
+  private write(targets: Iterable<ServerResponse>, event: BridgeEvent): void {
     const payload = `data: ${JSON.stringify(event)}\n\n`;
-    for (const res of this.clients) {
+    for (const res of targets) {
       try {
         res.write(payload);
       } catch {
@@ -245,7 +305,7 @@ export class BridgeServer {
       : createServer(onRequest);
 
     this.pingTimer = setInterval(() => {
-      for (const res of this.clients) {
+      for (const res of this.clients.keys()) {
         try {
           res.write(": ping\n\n");
         } catch {
@@ -301,7 +361,7 @@ export class BridgeServer {
 
   async stop(): Promise<void> {
     clearInterval(this.pingTimer);
-    for (const res of this.clients) {
+    for (const res of this.clients.keys()) {
       try {
         res.end();
       } catch {
@@ -329,6 +389,29 @@ export class BridgeServer {
     const path = url.pathname;
     const method = req.method ?? "GET";
 
+    // Origin / Host guard runs before everything, including OPTIONS: a
+    // preflight that answers 204 to any origin is itself the permission
+    // slip the browser is asking for.
+    const origin =
+      typeof req.headers.origin === "string" ? req.headers.origin : undefined;
+    const refusal = this.originGuard(req);
+    if (refusal !== undefined) {
+      res.writeHead(403, {
+        ...this.corsHeaders(),
+        "Content-Type": "application/json",
+      });
+      res.end(JSON.stringify({ ok: false, error: refusal }));
+      return;
+    }
+    // Set once here rather than in corsHeaders(): setHeader values survive
+    // every later writeHead(code, {...}) that does not name the same key,
+    // so each of the ~8 response sites keeps the grant without threading
+    // the origin through all of them.
+    if (origin !== undefined && this.isAllowedOrigin(origin)) {
+      res.setHeader("Access-Control-Allow-Origin", origin);
+      res.setHeader("Vary", "Origin");
+    }
+
     if (method === "OPTIONS") {
       res.writeHead(204, this.corsHeaders());
       res.end();
@@ -425,7 +508,10 @@ export class BridgeServer {
     }
 
     try {
-      if (method === "GET" && path === "/events") return this.openStream(res);
+      // A mesh client names itself here so device-addressed events reach it
+      // alone (see sendToDevice); UI clients simply omit it.
+      if (method === "GET" && path === "/events")
+        return this.openStream(res, deviceIdParam(url));
 
       if (method === "GET" && path === "/chats")
         return this.json(res, 200, { chats: this.handlers.listChats() });
@@ -549,12 +635,15 @@ export class BridgeServer {
         const token = url.searchParams.get("transfer") ?? "";
         if (!token)
           return this.json(res, 400, { ok: false, error: "transfer required" });
+        // The caller names itself so the token's device binding can be
+        // checked (see core/mesh/transfers.ts take()).
+        const from = deviceIdParam(url);
         if (method === "POST") {
-          const result = await this.handlers.acceptFileUpload(token, req);
+          const result = await this.handlers.acceptFileUpload(token, req, from);
           return this.json(res, result.ok ? 200 : 409, result);
         }
         if (method === "GET") {
-          const file = await this.handlers.openFileDownload(token);
+          const file = await this.handlers.openFileDownload(token, from);
           if (!file)
             return this.json(res, 404, {
               ok: false,
@@ -725,7 +814,7 @@ export class BridgeServer {
     }
   }
 
-  private openStream(res: ServerResponse): void {
+  private openStream(res: ServerResponse, deviceId?: string): void {
     res.writeHead(200, {
       ...this.corsHeaders(),
       "Content-Type": "text/event-stream",
@@ -752,8 +841,11 @@ export class BridgeServer {
     } catch (err) {
       logError("native", "Failed to replay live turn to new client", err);
     }
-    this.clients.add(res);
-    logDebug("native", `SSE client connected (${this.clients.size} total)`);
+    this.clients.set(res, deviceId);
+    logDebug(
+      "native",
+      `SSE client connected${deviceId ? ` as device ${deviceId}` : ""} (${this.clients.size} total)`,
+    );
     res.on("close", () => {
       this.clients.delete(res);
       logDebug("native", `SSE client left (${this.clients.size} total)`);
@@ -824,9 +916,17 @@ export class BridgeServer {
     );
   }
 
+  /**
+   * CORS headers.
+   *
+   * Deliberately NOT `Access-Control-Allow-Origin: *`. The bridge's clients
+   * are native apps (Electron main process, Flutter, curl, talon-node),
+   * which send no `Origin` at all — a wildcard buys them nothing and hands
+   * every web page on the internet a readable cross-origin channel to the
+   * agent API. Only an explicitly configured origin is echoed back.
+   */
   private corsHeaders(): Record<string, string> {
     return {
-      "Access-Control-Allow-Origin": "*",
       "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
       "Access-Control-Allow-Headers": "Authorization, Content-Type",
       "Access-Control-Max-Age": "86400",
@@ -835,6 +935,55 @@ export class BridgeServer {
     };
   }
 
+  /** True when `origin` is on the operator's `native.allowedOrigins` list. */
+  private isAllowedOrigin(origin: string): boolean {
+    return this.opts.allowedOrigins?.includes(origin) ?? false;
+  }
+
+  /**
+   * Reject browser-driven cross-origin requests and DNS-rebinding.
+   *
+   * Two independent checks, because they stop different attacks:
+   *
+   *   - `Origin`: browsers attach it to every cross-origin request and
+   *     scripts cannot forge it. Native clients omit it entirely. So "an
+   *     Origin we did not allow" means "a web page is driving us" — which,
+   *     on the default unauthenticated loopback bind, would let any site
+   *     the user visits POST /send and run tools on this machine.
+   *   - `Host`: a name that resolves to 127.0.0.1 makes the request
+   *     SAME-origin, so no Origin header is sent and the check above never
+   *     fires. Pinning Host to loopback/the configured bind closes that.
+   *
+   * Returns an error string when the request must be refused.
+   */
+  private originGuard(req: IncomingMessage): string | undefined {
+    const origin = req.headers.origin;
+    if (typeof origin === "string" && origin !== "" && origin !== "null") {
+      if (!this.isAllowedOrigin(origin)) {
+        return `Origin ${origin} is not allowed. Add it to native.allowedOrigins to permit browser clients.`;
+      }
+    }
+
+    const host = req.headers.host;
+    if (typeof host === "string" && host !== "") {
+      // Strip the port; bracketed IPv6 keeps its brackets off.
+      const name = host.replace(/:\d+$/, "").replace(/^\[|\]$/g, "");
+      const allowed =
+        name === "127.0.0.1" ||
+        name === "localhost" ||
+        name === "::1" ||
+        name === this.opts.host ||
+        // A wildcard bind is reachable under every local name; the bearer
+        // token is the control there, not the Host header.
+        this.opts.host === "0.0.0.0" ||
+        this.opts.host === "::";
+      if (!allowed) {
+        return `Host ${host} is not recognised for this bridge (DNS-rebinding guard).`;
+      }
+    }
+    return undefined;
+  }
+
   private jsonHeaders(): Record<string, string> {
     return { ...this.corsHeaders(), "Content-Type": "application/json" };
   }
@@ -880,6 +1029,16 @@ function asString(v: unknown): string | undefined {
   return typeof v === "string" ? v : undefined;
 }
 
+/**
+ * The `deviceId` a mesh client claims on `/events` and `/devices/file`.
+ * Undefined when absent or blank — every consumer treats "no claim" as the
+ * legacy case, so an empty string must never look like a claimed id.
+ */
+function deviceIdParam(url: URL): string | undefined {
+  const raw = (url.searchParams.get("deviceId") ?? "").trim();
+  return raw ? raw.slice(0, MAX_DEVICE_ID_CHARS) : undefined;
+}
+
 /** Parse a positive-integer query param; undefined when absent/invalid. */
 function asPositiveInt(v: string | null): number | undefined {
   if (!v) return undefined;

package/src/frontend/shared/format.ts

@@ -38,6 +38,12 @@ export function formatTokenCount(n: number): string {
   return String(n);
 }
 
+/** Keep small model costs legible without making larger totals noisy. */
+export function formatUsd(cost: number): string {
+  const safeCost = Number.isFinite(cost) && cost > 0 ? cost : 0;
+  return `$${safeCost > 0.5 ? safeCost.toFixed(2) : safeCost.toFixed(4)}`;
+}
+
 export function formatBytes(bytes: number): string {
   if (bytes >= 1_073_741_824) return `${(bytes / 1_073_741_824).toFixed(1)} GB`;
   if (bytes >= 1_048_576) return `${(bytes / 1_048_576).toFixed(1)} MB`;