talon-agent 5.0.1 → 5.2.0

package/src/frontend/telegram/commands/info.ts

@@ -14,7 +14,7 @@ import {
 import { isAuthorizedAdmin } from "./state.js";
 import { getLoadedPlugins } from "../../../core/plugin/index.js";
 import { getMeshService } from "../../../core/mesh/index.js";
-import type { MeshPingResult } from "../../../core/mesh/service.js";
+import type { MeshPingResult } from "../../../core/mesh/devices/service.js";
 
 export function registerInfoCommands(bot: Bot): void {
   bot.command("start", (ctx) =>
@@ -113,6 +113,9 @@ export function registerInfoCommands(bot: Bot): void {
     }
   });
 
+  /** True only in a 1:1 chat with the bot — never a group or channel. */
+  const isPrivate = (ctx: Context): boolean => ctx.chat?.type === "private";
+
   /**
    * The bridge footer `/mesh` prints for this caller.
    *
@@ -121,10 +124,16 @@ export function registerInfoCommands(bot: Bot): void {
    * itself should get an answer rather than a scavenger hunt through config
    * files. Everyone else gets the address only: a group member reading the
    * fleet has no business holding the key to it.
+   *
+   * Being the admin is not enough on its own: the secrets are withheld in
+   * any room that isn't a 1:1 with the bot. A group message is readable by
+   * every member, forwardable out of the group, and retained in their
+   * clients — so "the admin asked" says nothing about who ends up holding
+   * the bearer token. The admin can re-run the command in a DM.
    */
   const bridgeFor = (ctx: Context): MeshReachability => {
     const reach = getMeshService().bridgeReachability();
-    if (!reach.ok || isAuthorizedAdmin(ctx)) return reach;
+    if (!reach.ok || (isAuthorizedAdmin(ctx) && isPrivate(ctx))) return reach;
     return {
       ok: true,
       url: reach.url,
@@ -137,24 +146,7 @@ export function registerInfoCommands(bot: Bot): void {
     // `/mesh link` mints a bridge credential and posts it into the chat, so
     // it is admin-gated even though plain `/mesh` is not — reading the fleet
     // is not the same act as handing out the keys to it.
-    if (/^(link|pair)\b/i.test(arg)) {
-      if (!isAuthorizedAdmin(ctx)) {
-        await ctx.reply("Only the configured admin can mint a pairing link.");
-        return;
-      }
-      // `/mesh link Car` names the connection on the phone; with no name it
-      // inherits the bot's, which is what the operator already calls this
-      // daemon everywhere else.
-      const named = arg.replace(/^(link|pair)\b/i, "").trim();
-      const minted = getMeshService().makeCompanionPairLink(
-        named || ctx.me.first_name,
-      );
-      await ctx.reply(renderMeshPairLink(minted), {
-        parse_mode: "HTML",
-        link_preview_options: { is_disabled: true },
-      });
-      return;
-    }
+    if (await handleMeshLinkCommand(bot, ctx, arg)) return;
 
     const sent = await ctx.reply("Pinging mesh devices…");
     let results: MeshPingResult[];
@@ -207,6 +199,55 @@ export function registerInfoCommands(bot: Bot): void {
   });
 }
 
+/**
+ * `/mesh link [name]` — mint and deliver a companion pairing link. Returns
+ * true when `arg` was a link request (handled here, reply sent), false when
+ * the caller should treat the command as a plain `/mesh` fleet ping.
+ */
+async function handleMeshLinkCommand(
+  bot: Bot,
+  ctx: Context & { match?: unknown },
+  arg: string,
+): Promise<boolean> {
+  if (!/^(link|pair)\b/i.test(arg)) return false;
+  if (!isAuthorizedAdmin(ctx)) {
+    await ctx.reply("Only the configured admin can mint a pairing link.");
+    return true;
+  }
+  // `/mesh link Car` names the connection on the phone; with no name it
+  // inherits the bot's, which is what the operator already calls this
+  // daemon everywhere else.
+  const named = arg.replace(/^(link|pair)\b/i, "").trim();
+  const minted = getMeshService().makeCompanionPairLink(
+    named || ctx.me.first_name,
+  );
+  const rendered = renderMeshPairLink(minted);
+  // The pairing block is a live credential: a single-use grant plus the
+  // bearer token and certificate for the manual fallback. In a group
+  // that is a key handed to every member, so deliver it to the admin's
+  // DM and leave only a receipt behind. The grant is minted either way,
+  // so a failed DM must say so rather than look like it worked.
+  if (ctx.chat?.type !== "private") {
+    try {
+      await bot.api.sendMessage(ctx.from!.id, rendered, {
+        parse_mode: "HTML",
+        link_preview_options: { is_disabled: true },
+      });
+      await ctx.reply("Sent the pairing link to your DM.");
+    } catch {
+      await ctx.reply(
+        "A pairing link carries the bridge token, so I won't post it in a group — and I couldn't DM you. Message me directly once, then run /mesh link there.",
+      );
+    }
+    return true;
+  }
+  await ctx.reply(rendered, {
+    parse_mode: "HTML",
+    link_preview_options: { is_disabled: true },
+  });
+  return true;
+}
+
 /** Edit the placeholder in place, falling back to a fresh reply. */
 async function editOrReply(
   bot: Bot,

package/src/frontend/telegram/index.ts

@@ -12,6 +12,7 @@ import { apiThrottler } from "@grammyjs/transformer-throttler";
 import type { TalonConfig } from "../../core/config/index.js";
 import type { ContextManager } from "../../core/types.js";
 import type { Gateway } from "../../core/engine/gateway.js";
+import { runUntilStopped } from "../../core/frontend-runtime/run-loop.js";
 import { createTelegramActionHandler, sendText } from "./actions/index.js";
 import { ambientThreadId } from "./topics.js";
 import { initUserClient, disconnectUserClient } from "./userbot.js";
@@ -56,6 +57,9 @@ export function createTelegramFrontend(
     getMessageCount: (chatId: number) => gateway.getMessageCount(chatId),
   };
 
+  /** The long-poll, from start() until stop() awaits it. */
+  let polling: Promise<void> | null = null;
+
   return {
     name: "telegram",
     context,
@@ -131,15 +135,34 @@ export function createTelegramFrontend(
         ...API_CONSTANTS.DEFAULT_UPDATE_TYPES,
         "chat_join_request" as const,
       ];
-      await bot.start({
-        allowed_updates: allowedUpdates,
-        onStart: (info) => log("bot", `Talon running as @${info.username}`),
-      });
+      // grammY's bot.start() promise is the long-poll: it resolves when
+      // POLLING STOPS, i.e. at shutdown. Readiness is onStart, which
+      // fires once getMe() succeeded and the first poll is out — so that
+      // is what start() waits for, while the poll itself is kept for
+      // stop().
+      const run = runUntilStopped(
+        (signalReady) =>
+          bot.start({
+            allowed_updates: allowedUpdates,
+            onStart: (info) => {
+              log("bot", `Talon running as @${info.username}`);
+              signalReady();
+            },
+          }),
+        (err) => logError("bot", "Long-poll ended with an error", err),
+      );
+      polling = run.stopped;
+      await run.ready;
     },
 
     async stop() {
       try {
         await bot.stop();
+        // The long-poll is the promise bot.start() returned — awaiting it
+        // here is what makes "stopped" mean stopped, before the offset is
+        // confirmed below.
+        await polling;
+        polling = null;
         // grammY advances the update offset on its NEXT poll, which never
         // comes once we are shutting down — so confirm it explicitly or
         // Telegram redelivers the command that triggered this shutdown.

package/src/frontend/telegram/render/reports.ts

@@ -9,7 +9,7 @@
 
 import { escapeHtml } from "../formatting.js";
 import type { DoctorReport } from "../../../core/doctor/index.js";
-import type { MeshPingResult } from "../../../core/mesh/service.js";
+import type { MeshPingResult } from "../../../core/mesh/devices/service.js";
 import type { BackendUsageEntry } from "../../presentation/plan-usage-report.js";
 import type { SettingsButton } from "./menu.js";
 import {

package/src/frontend/terminal/index.ts

@@ -6,6 +6,11 @@
  *   - User presses Enter → rl.pause() immediately → processing begins
  *   - Processing finishes → all output written → rl.resume() + rl.prompt()
  *   - Renderer NEVER touches readline. Only this file does.
+ *
+ * `start()` returns once that prompt is drawn — the frontend lifecycle
+ * contract (core/frontend-runtime/capabilities.ts). It used to park on a
+ * promise that never resolved, which is why the composition root had to
+ * special-case the terminal and start it without awaiting.
  */
 
 import pc from "picocolors";
@@ -287,8 +292,7 @@ export function createTerminalFrontend(
         }
       });
 
-      input.prompt();
-      await new Promise(() => {});
+      input.prompt(); // started: turns run from the input callbacks above
     },
 
     async stop() {

package/src/frontend/whatsapp/connection/connection.ts

@@ -132,8 +132,34 @@ function onClose(
   }
 }
 
-/** One socket lifetime. Resolves with what the caller should do next. */
-async function connectOnce(runtime: WhatsAppRuntime): Promise<ConnectOutcome> {
+/**
+ * Wait `ms`, or until `stop()` asks the loop to end — whichever comes
+ * first. A shutdown awaits this loop, so no wait may outlast it.
+ */
+function sleep(runtime: WhatsAppRuntime, ms: number): Promise<void> {
+  const { signal } = runtime.stopRequest;
+  if (signal.aborted || runtime.stopping) return Promise.resolve();
+  return new Promise((resolve) => {
+    const done = (): void => {
+      clearTimeout(timer);
+      signal.removeEventListener("abort", done);
+      resolve();
+    };
+    const timer = setTimeout(done, ms);
+    timer.unref?.();
+    signal.addEventListener("abort", done, { once: true });
+  });
+}
+
+/**
+ * One socket lifetime. Resolves with what the caller should do next.
+ * `onSocket` fires once the socket exists — that is the earliest honest
+ * "connecting", and what the frontend's `start()` resolves on.
+ */
+async function connectOnce(
+  runtime: WhatsAppRuntime,
+  onSocket: () => void,
+): Promise<ConnectOutcome> {
   // Atomic replacement for Baileys' useMultiFileAuthState — same disk
   // format, torn-write-proof (see auth-state.ts for why that matters).
   const { state, saveCreds } = await useAtomicAuthState(dirs.whatsappAuth);
@@ -155,6 +181,7 @@ async function connectOnce(runtime: WhatsAppRuntime): Promise<ConnectOutcome> {
     keepAliveIntervalMs: 25_000,
   });
   runtime.sock = socket;
+  onSocket();
   socket.ev.on("creds.update", saveCreds);
   bindInbound(runtime, socket);
 
@@ -204,40 +231,65 @@ async function parkUntilPaired(runtime: WhatsAppRuntime): Promise<void> {
     }
     const paired = await new Promise<boolean>((r) => {
       const off = onPairingComplete(() => {
-        clearTimeout(timer);
         off();
         r(true);
       });
-      const timer = setTimeout(() => {
+      // Wakes on the next poll, or at once when stop() aborts the wait.
+      void sleep(runtime, 30_000).then(() => {
         off();
         r(false);
-      }, 30_000);
-      timer.unref?.();
+      });
     });
     if (paired) return;
   }
 }
 
-/** The frontend's whole `start()`: connect, reconnect, park, until stopped. */
+/**
+ * The frontend's run loop: connect, reconnect, park, until stopped. It
+ * ends at shutdown, so it is NOT what `start()` resolves on —
+ * `signalReady` is: it fires as soon as the first socket exists, or as
+ * soon as the loop parks waiting for a human to pair, whichever comes
+ * first. A loop that ends without either still releases the boot
+ * (`finally`), because a boot may fail but must never hang.
+ */
 export async function runConnectionLoop(
   runtime: WhatsAppRuntime,
+  signalReady: () => void,
 ): Promise<void> {
   log("whatsapp", "WhatsApp frontend starting (Baileys multi-device)");
+  try {
+    await connectionLoop(runtime, signalReady);
+  } finally {
+    signalReady();
+    log("whatsapp", "WhatsApp connection loop ended");
+  }
+}
+
+async function connectionLoop(
+  runtime: WhatsAppRuntime,
+  signalReady: () => void,
+): Promise<void> {
   while (!runtime.stopping) {
     // A manual pairing attempt owns the auth dir: two sockets on one
     // keypair corrupt it and burn rate-limited pairing attempts.
     if (isManualPairingActive()) {
-      await new Promise((r) => setTimeout(r, 5_000));
+      // Boot is not held behind someone typing a pairing code.
+      signalReady();
+      await sleep(runtime, 5_000);
       continue;
     }
     let outcome: ConnectOutcome;
     try {
-      outcome = await connectOnce(runtime);
+      outcome = await connectOnce(runtime, signalReady);
     } catch (err) {
       logError(
         "whatsapp",
         `Socket error: ${err instanceof Error ? err.message : err}`,
       );
+      // Up and retrying is still up: a socket that cannot be built (a
+      // half-written auth dir, say) must not hold the boot open while
+      // the loop keeps trying.
+      signalReady();
       outcome = "reconnect";
     }
     runtime.sock = null;
@@ -270,11 +322,10 @@ export async function runConnectionLoop(
       runtime.reconnectDelay = RECONNECT_BASE_MS;
       continue;
     }
-    await new Promise((r) => setTimeout(r, runtime.reconnectDelay));
+    await sleep(runtime, runtime.reconnectDelay);
     runtime.reconnectDelay = Math.min(
       runtime.reconnectDelay * 2,
       RECONNECT_MAX_MS,
     );
   }
-  log("whatsapp", "WhatsApp connection loop ended");
 }

package/src/frontend/whatsapp/index.ts

@@ -35,6 +35,7 @@ import { flushAuthWrites } from "./connection/auth-state.js";
 import { registerPairingProvider } from "../../core/frontend-runtime/pairing-broker.js";
 import { beginPairingAttempt } from "./connection/pairing-service.js";
 import { runConnectionLoop } from "./connection/connection.js";
+import { runUntilStopped } from "../../core/frontend-runtime/run-loop.js";
 import { lookupWhatsAppChat, type WhatsAppChatInfo } from "./registry.js";
 import { createWhatsAppRuntime } from "./runtime.js";
 
@@ -75,6 +76,9 @@ export function createWhatsAppFrontend(
     getMessageCount: (chatId: number) => gateway.getMessageCount(chatId),
   };
 
+  /** The connection loop, from start() until stop() awaits it. */
+  let connectionLoop: Promise<void> | null = null;
+
   return {
     name: "whatsapp",
     context,
@@ -132,10 +136,28 @@ export function createWhatsAppFrontend(
       log("whatsapp", `Gateway on port ${port}`);
     },
 
-    start: () => runConnectionLoop(runtime),
+    // The connection loop reconnects and re-pairs for the whole process
+    // lifetime, so it is the run promise, not the start: start() is over
+    // once the first socket is up (or the loop has parked waiting to be
+    // paired), and stop() below awaits the loop itself.
+    async start() {
+      const run = runUntilStopped(
+        (signalReady) => runConnectionLoop(runtime, signalReady),
+        (err) =>
+          logError(
+            "whatsapp",
+            `Connection loop failed: ${err instanceof Error ? err.message : err}`,
+          ),
+      );
+      connectionLoop = run.stopped;
+      await run.ready;
+    },
 
     async stop() {
       runtime.stopping = true;
+      // Wakes the reconnect backoff and the park-until-paired wait, so
+      // the loop we are about to await ends now rather than on its timer.
+      runtime.stopRequest.abort();
       registerPairingProvider(null);
       try {
         runtime.sock?.end(undefined);
@@ -143,6 +165,8 @@ export function createWhatsAppFrontend(
         /* already closed */
       }
       runtime.sock = null;
+      await connectionLoop;
+      connectionLoop = null;
       // Drain queued credential writes before the process exits — a key
       // half-written at shutdown is invisible until the server starts
       // rejecting stanzas with it.

package/src/frontend/whatsapp/runtime.ts

@@ -38,6 +38,12 @@ export type WhatsAppRuntime = {
   /** The live socket. Reconnects replace it, so read it at each use. */
   sock: WASocket | null;
   stopping: boolean;
+  /**
+   * Aborted by `stop()`. The connection loop's waits (reconnect backoff,
+   * the park that holds an unpaired account) listen for it, so a
+   * shutdown that awaits the loop never sits out a timer it could skip.
+   */
+  readonly stopRequest: AbortController;
   reconnectDelay: number;
   /** One "not linked" admin note per outage, not one per QR window. */
   unpairedNotified: boolean;
@@ -67,6 +73,7 @@ export function createWhatsAppRuntime(
     groupAllowCache: new Map(),
     sock: null,
     stopping: false,
+    stopRequest: new AbortController(),
     reconnectDelay: RECONNECT_BASE_MS,
     unpairedNotified: false,
     selfIds: [],

package/src/util/log.ts

@@ -30,6 +30,7 @@ export type LogComponent =
   | "media"
   | "notify"
   | "agent"
+  | "agents"
   | "pulse"
   | "userbot"
   | "users"

package/src/backend/kilo/factory.ts

@@ -1,53 +0,0 @@
-/**
- * Kilo backend factory — wires Kilo into the registry.
- *
- * Side-effect import (`import "./factory.js"` from `bootstrap.ts`) calls
- * `registerBackend(...)` at module load, making Kilo available under
- * `config.backend === "kilo"`. The capability wiring is the shared
- * remote-server composition; only the bound functions are Kilo's.
- */
-
-import { registerBackend } from "../../core/agent-runtime/backend-registry.js";
-import { createRemoteBackendFactory } from "../remote-server/factory.js";
-import {
-  initKiloAgent,
-  stopKiloServer,
-  handleMessage,
-  runOneShotAgent,
-  getKiloSessionSnapshot,
-  resolveModel,
-  getModelInfo,
-  getSettingsPresentation,
-  getProviders,
-  getProviderModels,
-  formatModelError,
-  listModels,
-  refreshPluginMcpServers,
-  updateSystemPrompt,
-  warmSession,
-} from "./index.js";
-
-registerBackend(
-  createRemoteBackendFactory({
-    id: "kilo",
-    label: "Kilo",
-    sdkPackage: "@kilocode/sdk",
-    init: initKiloAgent,
-    stop: stopKiloServer,
-    handleMessage,
-    runOneShotAgent,
-    getSessionSnapshot: getKiloSessionSnapshot,
-    models: {
-      resolveModel,
-      getModelInfo,
-      getSettingsPresentation,
-      getProviders,
-      getProviderModels,
-      formatModelError,
-      listModels,
-    },
-    refreshPluginMcpServers,
-    warmSession,
-    updateSystemPrompt,
-  }),
-);

package/src/backend/kilo/handler/index.ts

@@ -1,2 +0,0 @@
-/** Kilo message handler barrel. */
-export { handleMessage } from "./message.js";

package/src/backend/kilo/handler/message.ts

@@ -1,44 +0,0 @@
-/**
- * Kilo main message handler — the shared remote-server chat turn bound to
- * Kilo's server bindings.
- */
-
-import type {
-  QueryParams,
-  QueryResult,
-} from "../../runtime/turn/handler-types.js";
-import { runRemoteChatTurn } from "../../remote-server/chat-turn.js";
-import {
-  ensureServer,
-  trackActiveTurn,
-  ensureSession,
-  ensureChatMcpServer,
-  ensurePluginMcpServers,
-  buildToolOverrides,
-  resolveProviderID,
-  parseStoredKiloModelSelection,
-  getConfig,
-  kiloSystemPromptSuffix,
-} from "../server.js";
-
-export function handleMessage(params: QueryParams): Promise<QueryResult> {
-  // Assembled per call, not at module load: tests mock `../server.js`
-  // with a partial surface and only touch the members they need.
-  return runRemoteChatTurn(
-    {
-      id: "kilo",
-      label: "Kilo",
-      getConfig,
-      ensureServer,
-      trackActiveTurn,
-      parseModelSelection: parseStoredKiloModelSelection,
-      resolveProviderID,
-      ensureSession,
-      ensureChatMcpServer,
-      ensurePluginMcpServers,
-      buildToolOverrides,
-      systemPromptSuffix: kiloSystemPromptSuffix,
-    },
-    params,
-  );
-}

package/src/backend/kilo/index.ts

@@ -1,61 +0,0 @@
-/**
- * Kilo backend — barrel re-export.
- *
- * Uses the `@kilocode/sdk` (a fork of `@opencode-ai/sdk`) and exposes a
- * Backend-compatible API. The implementation is split across
- * focused modules for readability:
- *
- *   - `models.ts`         — model catalog, search, resolution, presentation
- *   - `sessions.ts`       — message parsing, usage summaries, snapshots
- *   - `server.ts`         — server lifecycle, MCP, session management
- *   - `events.ts`         — Kilo-side configurator over shared SSE events
- *   - `handler.ts`        — main message handler (streaming, end_turn,
- *                           delivery routing)
- *   - `one-shot.ts`       — heartbeat / dream one-shot runner
- *   - `model-provider.ts` — adapts the catalog to the Backend interface
- *
- * Note: internal `OpenCode*` type names in `models.ts` (e.g.
- * `OpenCodeModelCatalogEntry`) are retained on purpose — Kilo's
- * provider-bucket API is forked from OpenCode's wire shape, so the
- * names match what the upstream actually emits.
- */
-
-// ── Models ─────────────────────────────────────────────────────────────────
-export {
-  getOpenCodeModelSelectionValue,
-  resolveOpenCodeModelInput,
-  getOpenCodeQuickPickModels,
-  formatOpenCodeSelectionError,
-} from "./models/index.js";
-
-// ── Sessions ───────────────────────────────────────────────────────────────
-export {
-  summarizeKiloAssistantMessages,
-  getKiloSessionSnapshot,
-} from "./sessions.js";
-
-// ── Server / lifecycle ─────────────────────────────────────────────────────
-export {
-  initKiloAgent,
-  stopKiloServer,
-  refreshPluginMcpServers,
-  updateSystemPrompt,
-  warmSession,
-} from "./server.js";
-
-// ── Handler ────────────────────────────────────────────────────────────────
-export { handleMessage } from "./handler/index.js";
-
-// ── Model provider (Backend adapter) ──────────────────────────────────
-export {
-  resolveModel,
-  getModelInfo,
-  getSettingsPresentation,
-  getProviders,
-  getProviderModels,
-  listModels,
-  formatModelError,
-} from "./model-provider.js";
-
-// ── One-shot agent runner ──────────────────────────────────────────────────
-export { runOneShotAgent } from "./one-shot.js";

package/src/backend/kilo/model-provider.ts

@@ -1,36 +0,0 @@
-/**
- * Kilo model provider — adapts the internal catalog to the Backend model
- * interface via the shared remote-server factory. Each export matches a
- * method on `Backend.models`.
- */
-
-import { createRemoteModelProvider } from "../remote-server/model-catalog/index.js";
-import {
-  getOpenCodeModelCatalog,
-  getOpenCodeModelInfo,
-  getOpenCodeModelSelectionValue,
-  resolveOpenCodeModelInput,
-  getOpenCodeSettingsPresentation,
-  formatOpenCodeUnavailableModel,
-} from "./models/index.js";
-
-const provider = createRemoteModelProvider({
-  label: "Kilo",
-  getCatalog: (forceRefresh) => getOpenCodeModelCatalog(forceRefresh),
-  getModelInfo: (id) => getOpenCodeModelInfo(id),
-  resolveModelInput: (query, catalog) =>
-    resolveOpenCodeModelInput(query, catalog),
-  getSelectionValue: (model, catalog) =>
-    getOpenCodeModelSelectionValue(model, catalog),
-  formatUnavailableModel: (model) => formatOpenCodeUnavailableModel(model),
-  getSettingsPresentation: (activeModel, callbackPrefix) =>
-    getOpenCodeSettingsPresentation(activeModel, callbackPrefix),
-});
-
-export const resolveModel = provider.resolveModel;
-export const getModelInfo = provider.getModelInfo;
-export const getSettingsPresentation = provider.getSettingsPresentation;
-export const getProviders = provider.getProviders;
-export const getProviderModels = provider.getProviderModels;
-export const listModels = provider.listModels;
-export const formatModelError = provider.formatModelError;