talon-agent 3.8.2 → 3.9.1

package/src/frontend/telegram/actions/messaging.ts

@@ -18,6 +18,99 @@ import {
 import { sendText, toPositiveId } from "./shared.js";
 import { TELEGRAM_MAX_TEXT, type TelegramActionHandlers } from "./types.js";
 
+// ── Inline keyboards ─────────────────────────────────────────────────────────
+
+/**
+ * Telegram caps `callback_data` at 64 BYTES, not characters
+ * (https://core.telegram.org/bots/api#inlinekeyboardbutton). Exceeding it
+ * fails the whole sendMessage with BUTTON_DATA_INVALID — the message never
+ * arrives, buttons and all.
+ *
+ * Bytes rather than chars matters: a 21-character Japanese label is already
+ * over budget, so non-Latin keyboards break far sooner than English ones.
+ */
+const CALLBACK_DATA_MAX_BYTES = 64;
+
+type ButtonSpec = { text: string; url?: string; callback_data?: string };
+
+/** The two inline-button shapes this module emits. */
+type BuiltButton =
+  { text: string; url: string } | { text: string; callback_data: string };
+
+/** Byte length of `text` when UTF-8 encoded. */
+function utf8Bytes(text: string): number {
+  return Buffer.byteLength(text, "utf8");
+}
+
+/** Longest prefix of `text` that fits `maxBytes`, never splitting a code point. */
+function truncateUtf8(text: string, maxBytes: number): string {
+  if (utf8Bytes(text) <= maxBytes) return text;
+  let out = "";
+  let used = 0;
+  for (const char of text) {
+    const size = utf8Bytes(char);
+    if (used + size > maxBytes) break;
+    out += char;
+    used += size;
+  }
+  return out;
+}
+
+/**
+ * Resolve one button's callback data.
+ *
+ * An EXPLICIT `callback_data` is semantic — the model dispatches on the exact
+ * value it chose — so an over-long one is reported rather than truncated;
+ * handing the callback handler a different string than the model expects
+ * would be a silent behaviour change. The `text` fallback carries no such
+ * contract, so it is truncated to fit.
+ */
+function callbackDataFor(
+  btn: ButtonSpec,
+): { data: string } | { error: string } {
+  if (btn.callback_data !== undefined) {
+    const bytes = utf8Bytes(btn.callback_data);
+    if (bytes > CALLBACK_DATA_MAX_BYTES) {
+      return {
+        error:
+          `callback_data for button "${btn.text}" is ${bytes} bytes; ` +
+          `Telegram allows at most ${CALLBACK_DATA_MAX_BYTES}. Use a short ` +
+          `token (e.g. "opt_a") and keep the wording in the button text.`,
+      };
+    }
+    return { data: btn.callback_data };
+  }
+  return { data: truncateUtf8(btn.text, CALLBACK_DATA_MAX_BYTES) };
+}
+
+/**
+ * Build an inline keyboard from button rows, enforcing the callback_data
+ * cap. Returns an error message instead of a keyboard when the model
+ * supplied explicit data that cannot be sent.
+ *
+ * Exported as a unit seam — every button path in this module routes
+ * through it, so the cap is testable without a live Bot.
+ */
+export function buildInlineKeyboard(
+  rows: ButtonSpec[][],
+): { keyboard: BuiltButton[][] } | { error: string } {
+  const keyboard: BuiltButton[][] = [];
+  for (const row of rows) {
+    const built: BuiltButton[] = [];
+    for (const btn of row) {
+      if (btn.url) {
+        built.push({ text: btn.text, url: btn.url });
+        continue;
+      }
+      const resolved = callbackDataFor(btn);
+      if ("error" in resolved) return { error: resolved.error };
+      built.push({ text: btn.text, callback_data: resolved.data });
+    }
+    keyboard.push(built);
+  }
+  return { keyboard };
+}
+
 // ── Scheduled sends (persistent) ─────────────────────────────────────────────
 
 /** Longest schedulable delay: 24h. Timers re-arm from the store on boot. */
@@ -26,23 +119,29 @@ const MAX_DELAY_SEC = 24 * 60 * 60;
 /** Deliver one scheduled entry (shared by the live timer and restore). */
 async function fireScheduled(bot: Bot, entry: ScheduledMessage): Promise<void> {
   const chatId = Number(entry.chatId);
+  // `replyTo` is stored in the owning frontend's native shape (Discord keeps
+  // snowflake strings there); Telegram's API wants a number.
+  const replyTo = toPositiveId(entry.replyTo);
   if (entry.rows) {
-    const keyboard = entry.rows.map((row) =>
-      row.map((btn) =>
-        btn.url
-          ? { text: btn.text, url: btn.url }
-          : { text: btn.text, callback_data: btn.callback_data ?? btn.text },
-      ),
-    );
+    // Validated at schedule time; rebuilt here so entries persisted by an
+    // older build (or edited on disk) still can't fail the send.
+    const built = buildInlineKeyboard(entry.rows);
+    if ("error" in built) {
+      logWarn(
+        "bot",
+        `Scheduled message ${entry.id} has bad buttons: ${built.error}`,
+      );
+      await sendText(bot, chatId, entry.text, replyTo);
+      return;
+    }
+    const keyboard = built.keyboard;
     await bot.api.sendMessage(chatId, markdownToTelegramHtml(entry.text), {
       parse_mode: "HTML",
       reply_markup: { inline_keyboard: keyboard },
-      reply_parameters: entry.replyTo
-        ? { message_id: entry.replyTo }
-        : undefined,
+      reply_parameters: replyTo ? { message_id: replyTo } : undefined,
     });
   } else {
-    await sendText(bot, chatId, entry.text, entry.replyTo);
+    await sendText(bot, chatId, entry.text, replyTo);
   }
 }
 
@@ -211,20 +310,11 @@ export const messagingHandlers: TelegramActionHandlers = {
     if (text.length > TELEGRAM_MAX_TEXT)
       return { ok: false, error: `Text too long` };
     const html = markdownToTelegramHtml(text);
-    const rows = body.rows as Array<
-      Array<{ text: string; url?: string; callback_data?: string }>
-    >;
+    const rows = body.rows as ButtonSpec[][];
+    const built = buildInlineKeyboard(rows);
+    if ("error" in built) return { ok: false, error: built.error };
+    const keyboard = built.keyboard;
     gateway.incrementMessages(chatId);
-    const keyboard = rows.map((row) =>
-      row.map((btn) =>
-        btn.url
-          ? { text: btn.text, url: btn.url }
-          : {
-              text: btn.text,
-              callback_data: btn.callback_data ?? btn.text,
-            },
-      ),
-    );
     try {
       const sent = await bot.api.sendMessage(chatId, html, {
         parse_mode: "HTML",
@@ -243,6 +333,12 @@ export const messagingHandlers: TelegramActionHandlers = {
     const text = String(body.text ?? "");
     const replyTo = toPositiveId(body.reply_to_message_id);
     const rows = body.rows as ScheduledMessage["rows"];
+    // Validate buttons now rather than at fire time — a rejection minutes
+    // later, with the turn long over, is invisible to the model.
+    if (rows) {
+      const built = buildInlineKeyboard(rows);
+      if ("error" in built) return { ok: false, error: built.error };
+    }
     // NaN (e.g. delay_seconds: "5m") must fall back to the default, not
     // propagate: setTimeout(fn, NaN) fires immediately.
     const requested = Number(body.delay_seconds ?? 60);

package/src/frontend/telegram/callbacks/metrics.ts

@@ -7,7 +7,7 @@
  */
 
 import type { Context } from "grammy";
-import { getMetrics, getTodayMetrics } from "../../../util/metrics.js";
+import { getMetrics, getTodayMetrics } from "../../../storage/metrics.js";
 import {
   renderMetricsKeyboard,
   renderMetricsPanel,

package/src/frontend/telegram/commands/admin.ts

@@ -24,7 +24,7 @@ import {
 } from "../helpers/index.js";
 import { collectDoctorReport } from "../../../core/doctor.js";
 import { handleAdminCommand } from "../admin.js";
-import { getTodayMetrics } from "../../../util/metrics.js";
+import { getTodayMetrics } from "../../../storage/metrics.js";
 import { isAuthorizedAdmin, type RegisterDeps } from "./state.js";
 import { telegramCommandMenu } from "./definitions.js";
 

package/src/frontend/telegram/formatting.ts

@@ -25,11 +25,67 @@ export function escapeHtml(text: string): string {
   return escapeNative(text);
 }
 
+/**
+ * True when every tag in `html` is closed in the order it was opened.
+ *
+ * The inline formatters below are independent regex passes with no
+ * knowledge of each other's spans, so interleaved delimiters
+ * (`**a _b** c_`) emit crossed tags like `<b><i>x</b></i>`. Telegram
+ * refuses to parse those and 400s the whole message, so the caller
+ * checks before committing to the formatted rendering.
+ *
+ * Only tags this module generates are possible here — everything else
+ * was entity-escaped in step 3 — so a plain stack is sufficient.
+ */
+function isWellFormedHtml(html: string): boolean {
+  const stack: string[] = [];
+  const tag = /<(\/?)([a-zA-Z]+)(?:\s[^>]*)?>/g;
+  let match: RegExpExecArray | null;
+  while ((match = tag.exec(html)) !== null) {
+    const [, closing, name] = match;
+    if (closing) {
+      if (stack.pop() !== name) return false;
+    } else {
+      stack.push(name!);
+    }
+  }
+  return stack.length === 0;
+}
+
+/** Apply the inline delimiter passes to already-escaped text. */
+function applyInlineFormatting(input: string): string {
+  let out = input;
+  // Bold+italic: ***text*** — must run before the ** and * passes, which
+  // would otherwise split it into the crossed pair `<b><i>x</b></i>`.
+  out = out.replace(/\*\*\*(.+?)\*\*\*/g, "<b><i>$1</i></b>");
+  // Bold: **text**
+  out = out.replace(/\*\*(.+?)\*\*/g, "<b>$1</b>");
+  // Italic: *text* (not preceded by another *)
+  out = out.replace(/(?<!\*)\*(?!\*)(.+?)(?<!\*)\*(?!\*)/g, "<i>$1</i>");
+  // Italic: _text_ (surrounded by non-word or start/end)
+  out = out.replace(/(?<!\w)_(.+?)_(?!\w)/g, "<i>$1</i>");
+  // Links: [text](url) — only safe URL schemes become anchors. Both text
+  // and url were already HTML-escaped by step 3 (quotes included, so the
+  // href attribute can't be broken out of); escaping again here corrupted
+  // every & in a query string into &amp;amp;.
+  out = out.replace(/\[([^\]]+)\]\(([^)]+)\)/g, (_, text, url) =>
+    /^https?:\/\//i.test(url) ? `<a href="${url}">${text}</a>` : text,
+  );
+  // Strikethrough: ~~text~~
+  out = out.replace(/~~(.+?)~~/g, "<s>$1</s>");
+  return out;
+}
+
 /**
  * Convert Markdown output to Telegram-safe HTML.
  *
  * Handles: bold, italic, inline code, fenced code blocks, links.
  * Escapes HTML entities in non-formatted text.
+ *
+ * Guarantees well-formed output: when the inline passes would produce
+ * crossed tags, the formatting is dropped rather than emitted, because
+ * Telegram rejects the entire message on a parse error and the caller's
+ * only recourse is a second round-trip with no formatting at all.
  */
 export function markdownToTelegramHtml(text: string): string {
   // Step 1: Extract fenced code blocks to avoid processing their contents.
@@ -59,25 +115,14 @@ export function markdownToTelegramHtml(text: string): string {
   // oxlint-disable-next-line no-control-regex
   processed = processed.replace(/[^`\x00]+/g, (segment) => escapeHtml(segment));
 
-  // Step 4: Apply inline formatting.
-  // Bold: **text**
-  processed = processed.replace(/\*\*(.+?)\*\*/g, "<b>$1</b>");
-  // Italic: *text* (not preceded by another *)
-  processed = processed.replace(
-    /(?<!\*)\*(?!\*)(.+?)(?<!\*)\*(?!\*)/g,
-    "<i>$1</i>",
-  );
-  // Italic: _text_ (surrounded by non-word or start/end)
-  processed = processed.replace(/(?<!\w)_(.+?)_(?!\w)/g, "<i>$1</i>");
-  // Links: [text](url) — only safe URL schemes become anchors. Both text
-  // and url were already HTML-escaped by step 3 (quotes included, so the
-  // href attribute can't be broken out of); escaping again here corrupted
-  // every & in a query string into &amp;amp;.
-  processed = processed.replace(/\[([^\]]+)\]\(([^)]+)\)/g, (_, text, url) =>
-    /^https?:\/\//i.test(url) ? `<a href="${url}">${text}</a>` : text,
-  );
-  // Strikethrough: ~~text~~
-  processed = processed.replace(/~~(.+?)~~/g, "<s>$1</s>");
+  // Step 4: Apply inline formatting, but only keep it if the result is
+  // actually parseable. `processed` at this point holds escaped text plus
+  // tag-free placeholders, so it is a safe unformatted fallback.
+  const unformatted = processed;
+  processed = applyInlineFormatting(processed);
+  if (!isWellFormedHtml(processed)) {
+    processed = unformatted;
+  }
 
   // Steps 5+6: Restore code spans and fenced blocks. The replacement MUST
   // go through a function: with a string, String.replace interprets $-

package/src/frontend/terminal/commands.ts

@@ -15,7 +15,15 @@ import {
   resolveModel as coreResolveModel,
   getModels,
 } from "../../core/models/catalog.js";
-import { buildCacheDisplay } from "../shared/status-context.js";
+import {
+  buildCacheDisplay,
+  buildContextDisplay,
+} from "../shared/status-context.js";
+import {
+  formatDuration,
+  formatTokenCount,
+  formatUsd,
+} from "../shared/format.js";
 import {
   getChatSettings,
   setChatModel,
@@ -282,7 +290,7 @@ export function registerBuiltinCommands(): void {
       let displayCacheRead = u.totalCacheRead;
       let displayCacheWrite = u.totalCacheWrite;
       let backendModelLine = "";
-      let backendContextLine = "";
+      let contextWindow = u.contextWindow;
       ctx.renderer.writeln();
       const nameStr = info.sessionName ? `"${info.sessionName}"  ·  ` : "";
 
@@ -313,25 +321,55 @@ export function registerBuiltinCommands(): void {
         if (modelInfo) {
           backendModelLine = `  ${pc.bold(label)}  ${modelInfo.displayName}  ·  ${modelInfo.providerName}${modelInfo.free ? " · free" : ""}`;
           if (modelInfo.contextWindow) {
-            backendContextLine = cache
-              ? `  ${pc.dim(`context window ${modelInfo.contextWindow.toLocaleString()}  ·  cache ${cache.read.toLocaleString()} / ${cache.write.toLocaleString()}`)}`
-              : `  ${pc.dim(`context window ${modelInfo.contextWindow.toLocaleString()}`)}`;
+            contextWindow ||= modelInfo.contextWindow;
           }
         }
       }
 
+      const context = buildContextDisplay({
+        contextTokens: u.contextTokens,
+        lastPromptTokens: u.lastPromptTokens,
+        contextWindow,
+      });
+      const contextUsed = context.known
+        ? formatTokenCount(context.used)
+        : "unknown";
+      const contextMax = context.max
+        ? formatTokenCount(context.max)
+        : "unknown";
+      const avgResponseMs =
+        info.turns > 0 && u.totalResponseMs
+          ? Math.round(u.totalResponseMs / info.turns)
+          : 0;
+      const fastestResponseMs =
+        Number.isFinite(u.fastestResponseMs) && u.fastestResponseMs > 0
+          ? u.fastestResponseMs
+          : 0;
+
       ctx.renderer.writeln(
         `  ${pc.bold("Session")}  ${nameStr}turns ${info.turns}${cache ? `  ·  ${cache.hitPct}% cache` : ""}`,
       );
       ctx.renderer.writeln(
         `  ${pc.dim(`in ${displayInputTokens.toLocaleString()}  ·  out ${displayOutputTokens.toLocaleString()} tokens`)}`,
       );
+      ctx.renderer.writeln();
+      ctx.renderer.writeln(
+        `  ${pc.bold("Context")}  ${contextUsed} / ${contextMax} (${context.known ? `${context.pct}%` : "unknown"})${context.warn ? pc.yellow("  nearing limit") : ""}`,
+      );
+      ctx.renderer.writeln(
+        `  ${context.warn ? pc.yellow(context.bar) : pc.dim(context.bar)}`,
+      );
+      ctx.renderer.writeln(
+        `  ${pc.dim(`response last ${u.lastResponseMs ? formatDuration(u.lastResponseMs) : "—"}  ·  avg ${avgResponseMs ? formatDuration(avgResponseMs) : "—"}  ·  best ${fastestResponseMs ? formatDuration(fastestResponseMs) : "—"}`)}`,
+      );
+      if (u.estimatedCostUsd > 0) {
+        ctx.renderer.writeln(
+          `  ${pc.dim(`estimated session cost ${formatUsd(u.estimatedCostUsd)}`)}`,
+        );
+      }
       if (backendModelLine) {
         ctx.renderer.writeln();
         ctx.renderer.writeln(backendModelLine);
-        if (backendContextLine) {
-          ctx.renderer.writeln(backendContextLine);
-        }
       }
 
       const plugins = getLoadedPlugins();

package/src/frontend/terminal/input.ts

@@ -3,7 +3,7 @@
  *
  * Input is a list of parts: text segments and collapsed paste blocks.
  * You can type, paste, type more, paste again. Backspace removes from the end.
- * Enter submits everything. Ctrl+U clears all.
+ * Enter submits everything. Ctrl+U clears all. Up/Down walk prompt history.
  */
 
 import pc from "picocolors";
@@ -19,9 +19,10 @@ export type InputHandler = {
   resume(): void;
 };
 
-type TextPart = { type: "text"; content: string };
-type PastePart = { type: "paste"; content: string };
-type Part = TextPart | PastePart;
+export type InputPart =
+  { type: "text"; content: string } | { type: "paste"; content: string };
+type TextPart = Extract<InputPart, { type: "text" }>;
+type PastePart = Extract<InputPart, { type: "paste" }>;
 
 // ── Constants ────────────────────────────────────────────────────────────────
 
@@ -29,6 +30,79 @@ const PASTE_COLLAPSE_LINES = 3;
 const PASTE_COLLAPSE_CHARS = 150;
 const PASTE_START = "\x1b[200~";
 const PASTE_END = "\x1b[201~";
+const MAX_HISTORY_ITEMS = 100;
+
+function cloneParts(parts: readonly InputPart[]): InputPart[] {
+  return parts.map((part) => ({ ...part }));
+}
+
+function partsText(parts: readonly InputPart[]): string {
+  return parts
+    .map((part) => part.content)
+    .join("\n")
+    .trim();
+}
+
+/**
+ * In-process prompt history. Keeping this out of the persistent stores avoids
+ * creating a second plaintext transcript while still giving terminal users
+ * the expected Up/Down workflow.
+ */
+export class PromptHistory {
+  private readonly entries: InputPart[][] = [];
+  private cursor = 0;
+  private draft: InputPart[] | null = null;
+
+  constructor(private readonly maxItems = MAX_HISTORY_ITEMS) {}
+
+  add(parts: readonly InputPart[]): void {
+    const text = partsText(parts);
+    if (!text) return;
+
+    const latest = this.entries.at(-1);
+    if (!latest || partsText(latest) !== text) {
+      this.entries.push(cloneParts(parts));
+      if (this.entries.length > this.maxItems) this.entries.shift();
+    }
+    this.resetNavigation();
+  }
+
+  move(
+    direction: "previous" | "next",
+    current: readonly InputPart[],
+  ): InputPart[] | undefined {
+    if (this.entries.length === 0) return undefined;
+
+    if (direction === "previous") {
+      if (this.cursor === this.entries.length) {
+        this.draft = cloneParts(current);
+      }
+      if (this.cursor > 0) this.cursor--;
+      return cloneParts(this.entries[this.cursor]!);
+    }
+
+    if (this.cursor === this.entries.length) return undefined;
+    if (this.cursor < this.entries.length - 1) {
+      this.cursor++;
+      return cloneParts(this.entries[this.cursor]!);
+    }
+
+    this.cursor = this.entries.length;
+    return cloneParts(this.draft ?? [{ type: "text", content: "" }]);
+  }
+
+  /** Preserve an edited recalled prompt as the current draft. */
+  detach(parts: readonly InputPart[]): void {
+    if (this.cursor === this.entries.length) return;
+    this.cursor = this.entries.length;
+    this.draft = cloneParts(parts);
+  }
+
+  resetNavigation(): void {
+    this.cursor = this.entries.length;
+    this.draft = null;
+  }
+}
 
 // ── Factory ──────────────────────────────────────────────────────────────────
 
@@ -38,7 +112,8 @@ export function createInput(promptStr: string): InputHandler {
   let paused = false;
 
   // Input is an ordered list of parts
-  let parts: Part[] = [{ type: "text", content: "" }];
+  let parts: InputPart[] = [{ type: "text", content: "" }];
+  const history = new PromptHistory();
 
   // Bracketed paste accumulation
   let inPaste = false;
@@ -46,7 +121,7 @@ export function createInput(promptStr: string): InputHandler {
 
   // ── Helpers ──
 
-  function lastPart(): Part {
+  function lastPart(): InputPart {
     return parts[parts.length - 1]!;
   }
 
@@ -99,18 +174,17 @@ export function createInput(promptStr: string): InputHandler {
   }
 
   function getFullText(): string {
-    return parts
-      .map((p) => p.content)
-      .join("\n")
-      .trim();
+    return partsText(parts);
   }
 
   function clear(): void {
     parts = [{ type: "text", content: "" }];
+    history.resetNavigation();
   }
 
   function submit(): void {
     const text = getFullText();
+    if (!pendingResolve) history.add(parts);
     clear();
     process.stdout.write("\n");
 
@@ -135,6 +209,7 @@ export function createInput(promptStr: string): InputHandler {
       // Short paste — inline into current text part
       ensureTrailingText().content += text.replace(/\n/g, " ");
     }
+    history.detach(parts);
     redraw();
   }
 
@@ -160,6 +235,14 @@ export function createInput(promptStr: string): InputHandler {
       if (parts.length === 0) parts.push({ type: "text", content: "" });
       ensureTrailingText();
     }
+    history.detach(parts);
+    redraw();
+  }
+
+  function navigateHistory(direction: "previous" | "next"): void {
+    const recalled = history.move(direction, parts);
+    if (!recalled) return;
+    parts = recalled;
     redraw();
   }
 
@@ -236,9 +319,22 @@ export function createInput(promptStr: string): InputHandler {
 
       if (code === 0x1b) {
         if (i + 1 < chunk.length && chunk[i + 1] === "[") {
-          // ANSI escape sequence (arrows, etc.) — skip
+          // CSI escape sequence. Up/Down navigate history; the rest are
+          // ignored until cursor editing is implemented.
+          let end = i + 2;
+          while (end < chunk.length && chunk.charCodeAt(end) < 0x40) end++;
+          const final = chunk[end];
+          if (final === "A") navigateHistory("previous");
+          if (final === "B") navigateHistory("next");
+          i = end;
+        } else if (
+          i + 2 < chunk.length &&
+          chunk[i + 1] === "O" &&
+          (chunk[i + 2] === "A" || chunk[i + 2] === "B")
+        ) {
+          // Some terminals use application-cursor sequences (ESC O A/B).
+          navigateHistory(chunk[i + 2] === "A" ? "previous" : "next");
           i += 2;
-          while (i < chunk.length && chunk.charCodeAt(i) < 0x40) i++;
         } else if (pendingResolve) {
           // Bare Escape during waitForInput — cancel
           const resolve = pendingResolve;
@@ -253,6 +349,7 @@ export function createInput(promptStr: string): InputHandler {
       if (code === 0x09) {
         // Tab
         ensureTrailingText().content += "  ";
+        history.detach(parts);
         redraw();
         continue;
       }
@@ -261,6 +358,7 @@ export function createInput(promptStr: string): InputHandler {
 
       // Printable char
       ensureTrailingText().content += ch;
+      history.detach(parts);
       redraw();
     }
   });

package/src/frontend/terminal/renderer.ts

@@ -7,6 +7,7 @@
  */
 
 import pc from "picocolors";
+import { formatUsd } from "../shared/format.js";
 
 // ── Types ────────────────────────────────────────────────────────────────────
 
@@ -193,6 +194,7 @@ export function createRenderer(cols?: number, displayName = "Talon"): Renderer {
     if (typeof info.cacheHitPct === "number") {
       p.push(`${info.cacheHitPct}% cache`);
     }
+    if (info.costUsd > 0) p.push(formatUsd(info.costUsd));
     if (tools > 0) p.push(`${tools} tool${tools > 1 ? "s" : ""}`);
     writeln();
     writeln(`  ${pc.dim(p.join("  ·  "))}`);

package/src/{util → storage}/metrics.ts

@@ -8,7 +8,7 @@ import {
   todayUtc,
   type MetricsGrain,
   type MetricsLatencyAgg,
-} from "../storage/sessions.js";
+} from "./sessions.js";
 
 const legacyCounters = new Map<string, number>();
 

package/src/storage/scheduled-store.ts

@@ -40,9 +40,12 @@ export type ScheduledMessage = {
   /** Epoch ms when the message should be sent. */
   fireAt: number;
   createdAt: number;
-  /** Telegram: numeric message id to reply to. */
-  replyTo?: number;
-  /** Telegram: inline keyboard rows. */
+  /**
+   * Message id to reply to, in the owning frontend's native shape:
+   * numeric for Telegram, a snowflake string for Discord.
+   */
+  replyTo?: number | string;
+  /** Inline keyboard / button rows to replay at fire time. */
   rows?: ScheduledButtonRow[];
 };
 

package/src/util/config.ts

@@ -173,6 +173,14 @@ const nativeConfigSchema = z
      * (~/.talon/keys/bridge-token) — the network never gets an open bridge.
      */
     token: z.string().optional(),
+    /**
+     * Origins allowed to call the bridge from a BROWSER. Native clients
+     * (Electron main, Flutter, curl, talon-node) send no Origin header and
+     * never need an entry here. Anything listed gets a matching
+     * Access-Control-Allow-Origin; everything else is refused 403, so a
+     * random web page cannot drive the agent API on the user's machine.
+     */
+    allowedOrigins: z.array(z.string().min(1)).optional(),
     /**
      * Serve the bridge over TLS with a persistent self-signed certificate
      * (~/.talon/keys/); clients pin its SHA-256 fingerprint on first

package/src/util/log.ts

@@ -53,6 +53,7 @@ export type LogComponent =
   | "teams"
   | "discord"
   | "native"
+  | "mesh"
   | "config"
   | "access"
   | "github"