talon-agent 5.10.0 → 5.11.0

package/README.md

@@ -508,6 +508,33 @@ Config file: `~/.talon/config.json`
 | `memory`                   | ---          | Long-term memory backend selection: `mempalace` or `mem0` (see above)                                                   |
 | `mempalace`                | ---          | Legacy MemPalace plugin config (prefer `memory`)                                                                        |
 | `playwright`               | ---          | Playwright plugin config (see above)                                                                                    |
+| `triggers`                 | ---          | Per-chat trigger caps, e.g. `{ "maxActivePerChat": 5, "maxPersistentPerChat": 3 }` ([Scaling limits](#scaling-limits)) |
+| `agents`                   | ---          | Sub-agent caps: `{ "maxConcurrent": 6, "maxDepth": 2, "defaultTimeoutMs": 900000 }` ([docs/agents.md](docs/agents.md)) |
+
+### Scaling limits
+
+Two caps bound how much background work Talon keeps alive. Both keep their
+historical defaults and are raised in `~/.talon/config.json`; the error a
+capped tool returns names the key to raise.
+
+| Key                             | Default | Bounds | What it caps                                                 |
+| ------------------------------- | ------- | ------ | ------------------------------------------------------------ |
+| `triggers.maxActivePerChat`     | `5`     | 1–50   | Active (running or pending) triggers per chat                |
+| `triggers.maxPersistentPerChat` | unset   | 1–50   | Optional separate budget for persistent triggers (see below) |
+| `agents.maxConcurrent`          | `6`     | 1–64   | Live sub-agents daemon-wide, children included               |
+
+With `maxPersistentPerChat` unset, persistent and ad-hoc triggers share
+`maxActivePerChat`, exactly as before. Set it and the two draw from separate
+budgets: persistent triggers count only against `maxPersistentPerChat`, and
+`maxActivePerChat` then bounds ad-hoc (non-persistent) triggers only — so a
+chat running long-lived watchers still has room for a short CI wait. Caps are
+checked at `trigger_create`; lowering one never kills a trigger already
+running, and persistent triggers resumed after a restart are not re-checked.
+
+```json
+"triggers": { "maxActivePerChat": 5, "maxPersistentPerChat": 6 },
+"agents": { "maxConcurrent": 12 }
+```
 
 ### Background reasoning effort
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "talon-agent",
-  "version": "5.10.0",
+  "version": "5.11.0",
   "description": "Multi-frontend AI agent with full tool access, streaming, cron jobs, and plugin system",
   "author": "Dylan Neve",
   "license": "MIT",

package/src/app.ts

@@ -6,7 +6,7 @@
  * are loaded dynamically — only the selected platform's dependencies are required.
  */
 
-import { getFrontends } from "./core/config/index.js";
+import { ConfigFileError, getFrontends } from "./core/config/index.js";
 import { startUploadCleanup, stopUploadCleanup } from "./core/vfs/workspace.js";
 import { flushDatabase } from "./storage/db.js";
 import { getActiveCount, stopAllTurns } from "./core/engine/dispatcher.js";
@@ -40,6 +40,7 @@ import {
   crashCleanup,
   crashStep,
   handleUncaughtException,
+  handleUnhandledRejection,
 } from "./core/daemon/crash.js";
 import { log, logError, logWarn } from "./util/log.js";
 import { bootPhase, bootReport } from "./core/daemon/boot-timer.js";
@@ -119,9 +120,31 @@ async function applyStagedRestore(): Promise<string | null> {
   );
 }
 
-const restoreReport = await bootPhase("staged restore", applyStagedRestore);
+/**
+ * A present-but-invalid config.json is fatal at startup: print the file
+ * path and every problem, then exit non-zero. Booting on defaults instead
+ * would put the daemon in a surprising state (wrong frontend, no plugins).
+ */
+async function withConfigGuard<T>(fn: () => Promise<T>): Promise<T> {
+  try {
+    return await fn();
+  } catch (err) {
+    if (err instanceof ConfigFileError) {
+      logError("config", err.message);
+      console.error(`talon: ${err.message}`);
+      process.exit(1);
+    }
+    throw err;
+  }
+}
+
+const restoreReport = await withConfigGuard(() =>
+  bootPhase("staged restore", applyStagedRestore),
+);
 
-const { config } = await bootPhase("bootstrap", () => bootstrap());
+const { config } = await withConfigGuard(() =>
+  bootPhase("bootstrap", () => bootstrap()),
+);
 
 // Record this process as the daemon. The gateway port is appended once
 // the gateway binds (it may fall back from the default on EADDRINUSE).
@@ -361,12 +384,7 @@ process.on("uncaughtException", (err) =>
   handleUncaughtException(err, crashHooks),
 );
 
-process.on("unhandledRejection", (reason) => {
-  logWarn(
-    "bot",
-    `Unhandled rejection: ${reason instanceof Error ? reason.message : reason}`,
-  );
-});
+process.on("unhandledRejection", handleUnhandledRejection);
 
 // ── Start ────────────────────────────────────────────────────────────────────
 

package/src/backend/claude-sdk/plan-usage.ts

@@ -21,7 +21,14 @@ import type {
   PlanWindow,
 } from "../../core/agent-runtime/capabilities.js";
 
-const USAGE_ENDPOINT = "https://api.anthropic.com/api/oauth/usage";
+// `cedar_ember=1` asks the endpoint to include banked limit resets (the
+// claude.ai "Reset for free" grants); `skip_spend=1` drops the spend block we
+// don't render. Resets are only reported to the CLI surface — any other
+// user agent gets `ineligible_reason: "surface"` — so the request identifies
+// as the CLI, which is what the Agent SDK runs anyway.
+const USAGE_ENDPOINT =
+  "https://api.anthropic.com/api/oauth/usage?cedar_ember=1&skip_spend=1";
+const CLI_USER_AGENT = "claude-cli/2.1.280 (external, cli)";
 const REQUEST_TIMEOUT_MS = 5_000;
 const CACHE_TTL_MS = 60_000;
 
@@ -77,6 +84,48 @@ function windowLabel(limit: RawLimit): string | undefined {
   return undefined;
 }
 
+interface RawResetGrant {
+  resets_left?: number;
+  ends_at?: string | null;
+  paused?: boolean;
+}
+
+/**
+ * Banked limit resets still usable: unpaused grants whose window hasn't
+ * closed. Returns the count and the soonest deadline among grants that still
+ * hold a reset, or undefined when there's nothing to offer.
+ */
+export function parseBankedResets(
+  body: unknown,
+  now = Date.now(),
+): { count: number; expiresAt?: string } | undefined {
+  const program = (body as { cedar_ember?: unknown } | null)?.cedar_ember as
+    { eligible?: boolean; grants?: unknown } | null | undefined;
+  if (!program || program.eligible === false || !Array.isArray(program.grants))
+    return undefined;
+
+  let count = 0;
+  let expiresAt: string | undefined;
+  for (const grant of program.grants as RawResetGrant[]) {
+    const left = grant.resets_left;
+    if (typeof left !== "number" || !Number.isFinite(left) || left <= 0)
+      continue;
+    if (grant.paused === true) continue;
+    const ends =
+      typeof grant.ends_at === "string" ? Date.parse(grant.ends_at) : NaN;
+    if (Number.isFinite(ends) && ends <= now) continue;
+    count += Math.floor(left);
+    if (
+      typeof grant.ends_at === "string" &&
+      Number.isFinite(ends) &&
+      (!expiresAt || ends < Date.parse(expiresAt))
+    )
+      expiresAt = grant.ends_at;
+  }
+  if (count <= 0) return undefined;
+  return { count, ...(expiresAt ? { expiresAt } : {}) };
+}
+
 export function parsePlanUsage(
   body: unknown,
   subscriptionType?: string,
@@ -103,9 +152,16 @@ export function parsePlanUsage(
   }
 
   if (windows.length === 0) return undefined;
+  const banked = parseBankedResets(body);
   return {
     ...(subscriptionType ? { plan: subscriptionType } : {}),
     windows,
+    ...(banked
+      ? {
+          resetsAvailable: banked.count,
+          ...(banked.expiresAt ? { resetsExpireAt: banked.expiresAt } : {}),
+        }
+      : {}),
     fetchedAt: Date.now(),
   };
 }
@@ -119,6 +175,7 @@ async function load(): Promise<PlanUsage | undefined> {
       headers: {
         Authorization: `Bearer ${creds.accessToken}`,
         "anthropic-beta": "oauth-2025-04-20",
+        "User-Agent": CLI_USER_AGENT,
       },
       signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
     });

package/src/bootstrap.ts

@@ -607,7 +607,10 @@ function initRecurringAgents(
  * same delivery shape, so they are wired together.
  */
 function initWakeSubsystems(config: TalonConfig): void {
-  initTriggers({ execute: dispatcherExecute });
+  initTriggers({
+    execute: dispatcherExecute,
+    ...(config.triggers ? { caps: config.triggers } : {}),
+  });
   initAgents({
     execute: dispatcherExecute,
     ...(config.agents ? { caps: config.agents } : {}),

package/src/core/agent-runtime/capabilities.ts

@@ -261,6 +261,8 @@ export interface PlanUsage {
   windows: PlanWindow[];
   /** How many one-shot rate-limit resets are still banked, when the plan has them. */
   resetsAvailable?: number;
+  /** ISO time the soonest-expiring banked reset must be used by, when the plan says. */
+  resetsExpireAt?: string;
   /** Epoch ms of the read, so renderers can flag figures as aged. */
   fetchedAt: number;
 }

package/src/core/agents/registry.ts

@@ -141,7 +141,8 @@ export class AgentRegistry {
         ok: false,
         error:
           `Sub-agent concurrency cap reached (${caps.maxConcurrent} live). ` +
-          `Wait for one to finish (wait_for_agent) or kill one (kill_agent).`,
+          `Wait for one to finish (wait_for_agent) or kill one (kill_agent), ` +
+          `or raise agents.maxConcurrent in ~/.talon/config.json.`,
       };
     }
 

package/src/core/background/triggers/caps.ts

@@ -0,0 +1,78 @@
+/**
+ * Per-chat trigger caps — how many watcher scripts one chat may keep active.
+ *
+ * Configured by `config.triggers` (see core/config) and wired in once via
+ * initTriggers. The check is a pure function of the chat's active triggers so
+ * the gateway handler and the tests share one rule.
+ */
+
+import { MAX_ACTIVE_PER_CHAT } from "../../../storage/triggers.js";
+
+export type TriggerCaps = {
+  /** Active triggers per chat — all of them, or only ad-hoc ones when
+   *  `maxPersistentPerChat` is set. */
+  readonly maxActivePerChat: number;
+  /** Optional separate budget for persistent triggers. */
+  readonly maxPersistentPerChat?: number;
+};
+
+export const DEFAULT_TRIGGER_CAPS: TriggerCaps = {
+  maxActivePerChat: MAX_ACTIVE_PER_CHAT,
+};
+
+const capsHolder: { caps: TriggerCaps } = { caps: DEFAULT_TRIGGER_CAPS };
+
+/** Replace the live caps. Missing fields fall back to the defaults. */
+export function setTriggerCaps(caps?: Partial<TriggerCaps>): void {
+  const next: TriggerCaps = {
+    maxActivePerChat:
+      caps?.maxActivePerChat ?? DEFAULT_TRIGGER_CAPS.maxActivePerChat,
+    ...(caps?.maxPersistentPerChat !== undefined
+      ? { maxPersistentPerChat: caps.maxPersistentPerChat }
+      : {}),
+  };
+  capsHolder.caps = next;
+}
+
+export function getTriggerCaps(): TriggerCaps {
+  return capsHolder.caps;
+}
+
+/**
+ * Why a new trigger may not be created, or null when there is room.
+ *
+ * Without `maxPersistentPerChat`, every active trigger shares
+ * `maxActivePerChat` (the historical behaviour). With it, persistent and
+ * ad-hoc triggers draw from separate budgets.
+ */
+export function triggerCapError(
+  active: ReadonlyArray<{ persistent?: boolean }>,
+  persistent: boolean,
+  caps: TriggerCaps = capsHolder.caps,
+): string | null {
+  const configPath = "~/.talon/config.json";
+  if (caps.maxPersistentPerChat === undefined) {
+    if (active.length < caps.maxActivePerChat) return null;
+    return (
+      `Per-chat trigger cap reached (${caps.maxActivePerChat} active). ` +
+      `Cancel one before creating another, or raise ` +
+      `triggers.maxActivePerChat in ${configPath}.`
+    );
+  }
+  if (persistent) {
+    const count = active.filter((t) => t.persistent === true).length;
+    if (count < caps.maxPersistentPerChat) return null;
+    return (
+      `Per-chat persistent trigger cap reached ` +
+      `(${caps.maxPersistentPerChat} persistent active). Cancel one before ` +
+      `creating another, or raise triggers.maxPersistentPerChat in ${configPath}.`
+    );
+  }
+  const count = active.filter((t) => t.persistent !== true).length;
+  if (count < caps.maxActivePerChat) return null;
+  return (
+    `Per-chat ad-hoc trigger cap reached (${caps.maxActivePerChat} ` +
+    `non-persistent active). Cancel one before creating another, or raise ` +
+    `triggers.maxActivePerChat in ${configPath}.`
+  );
+}

package/src/core/background/triggers/index.ts

@@ -5,6 +5,7 @@
  * Split by responsibility:
  *   - `state`   — injected deps + the child/timeout/log/buffer registries,
  *                 the warden set, timing constants, init + getRunningCount
+ *   - `caps`    — per-chat active-trigger caps (config.triggers)
  *   - `command` — interpreter resolution per script language
  *   - `output`  — stdout/stderr capture, payload truncation, wake firing
  *   - `exit`    — timeout/cancel/shutdown, child kill, finalizeExit, failTrigger
@@ -20,6 +21,11 @@ import { handleStdoutLine } from "./output.js";
 import { handleTimeout, finalizeExit } from "./exit.js";
 
 export { initTriggers, getRunningCount } from "./state.js";
+export {
+  getTriggerCaps,
+  triggerCapError,
+  DEFAULT_TRIGGER_CAPS,
+} from "./caps.js";
 export { commandForLanguage } from "./command.js";
 export { spawnTrigger } from "./spawn.js";
 export { cancelTrigger, shutdownTriggers } from "./exit.js";

package/src/core/background/triggers/state.ts

@@ -9,12 +9,15 @@ import type { ChildProcess } from "node:child_process";
 import type { WriteStream } from "node:fs";
 import { execute as dispatcherExecute } from "../../engine/dispatcher.js";
 import { log } from "../../../util/log.js";
+import { getTriggerCaps, setTriggerCaps, type TriggerCaps } from "./caps.js";
 
 // ── Dependencies (injected at startup) ──────────────────────────────────────
 
 export type TriggerDeps = {
   /** Used for terminal "fired"/"errored" wake prompts that go through the model. */
   execute: typeof dispatcherExecute;
+  /** Per-chat caps from `config.triggers`; defaults apply when absent. */
+  caps?: Partial<TriggerCaps>;
 };
 
 /** Reassignable on a holder object so submodules see the injected deps. */
@@ -52,7 +55,15 @@ export const WARDEN_GRACE_SLACK_MS = 2_000;
 export function initTriggers(d: TriggerDeps): void {
   depsHolder.deps = d;
   lifecycle.shuttingDown = false;
-  log("triggers", "Initialized");
+  setTriggerCaps(d.caps);
+  const caps = getTriggerCaps();
+  log(
+    "triggers",
+    `Initialized — maxActivePerChat=${caps.maxActivePerChat}` +
+      (caps.maxPersistentPerChat !== undefined
+        ? ` maxPersistentPerChat=${caps.maxPersistentPerChat}`
+        : ""),
+  );
 }
 
 /** Number of triggers currently running. */

package/src/core/config/index.ts

@@ -511,6 +511,25 @@ const configSchema = z.object({
         .default(15 * 60 * 1000),
     })
     .optional(),
+  /**
+   * Triggers — per-chat caps on active watcher scripts (running or
+   * pending). Checked when `trigger_create` runs; triggers already running
+   * are never killed when a cap is lowered.
+   *
+   *   - `maxActivePerChat` — active triggers per chat (default 5). When
+   *     `maxPersistentPerChat` is unset this counts persistent and ad-hoc
+   *     triggers together, exactly as before.
+   *   - `maxPersistentPerChat` — optional separate budget for persistent
+   *     triggers. When set, persistent triggers count only against it and
+   *     `maxActivePerChat` bounds ad-hoc (non-persistent) triggers only, so
+   *     long-lived watchers can't starve short ad-hoc ones.
+   */
+  triggers: z
+    .object({
+      maxActivePerChat: z.number().int().min(1).max(50).default(5),
+      maxPersistentPerChat: z.number().int().min(1).max(50).optional(),
+    })
+    .optional(),
   /**
    * Backups & checkpoints (docs/backups.md). Talon's only safety net, so
    * it is on by default: every `intervalHours` it writes a snapshot of
@@ -785,15 +804,84 @@ const DEFAULT_CONFIG = {
   pulseIntervalMs: 300000,
 };
 
+/**
+ * A config.json that exists but cannot be used — unreadable, not JSON, or
+ * rejected by the schema. Thrown instead of falling back to defaults: a
+ * daemon that silently boots on defaults (e.g. the telegram frontend) is
+ * far more surprising than one that refuses to start. The file on disk is
+ * never touched. `issues` carries one line per problem for callers that
+ * want to render them individually.
+ */
+export class ConfigFileError extends Error {
+  constructor(
+    message: string,
+    readonly path: string,
+    readonly issues: readonly string[] = [],
+  ) {
+    super(message);
+    this.name = "ConfigFileError";
+  }
+}
+
+/**
+ * Append a line/column hint to a JSON.parse error message. Recent V8
+ * already includes "(line L column C)"; older runtimes only report
+ * "at position N", so derive it from the raw text in that case.
+ */
+function describeJsonError(err: unknown, raw: string): string {
+  const message = err instanceof Error ? err.message : String(err);
+  if (/\(line \d+ column \d+\)/.test(message)) return message;
+  const match = /at position (\d+)/.exec(message);
+  if (!match) return message;
+  const before = raw.slice(0, Number(match[1]));
+  const line = before.split("\n").length;
+  const column = before.length - before.lastIndexOf("\n");
+  return `${message} (line ${line} column ${column})`;
+}
+
+/** Render zod issues as `path: message` lines (`(root)` for top-level). */
+function formatSchemaIssues(error: z.ZodError): string[] {
+  return error.issues.map((issue) => {
+    const path = issue.path.map(String).join(".") || "(root)";
+    return `${path}: ${issue.message}`;
+  });
+}
+
+/**
+ * Read config.json. A missing file is `{}` (first run — defaults apply);
+ * a present file that cannot be read or parsed throws ConfigFileError.
+ */
 function loadConfigFile(): Record<string, unknown> {
+  if (!existsSync(CONFIG_FILE)) return {};
+  let raw: string;
   try {
-    if (existsSync(CONFIG_FILE)) {
-      return JSON.parse(readFileSync(CONFIG_FILE, "utf-8"));
-    }
-  } catch {
-    /* corrupt — will be recreated */
+    raw = readFileSync(CONFIG_FILE, "utf-8");
+  } catch (err) {
+    throw new ConfigFileError(
+      `Cannot read ${CONFIG_FILE}: ${err instanceof Error ? err.message : err}`,
+      CONFIG_FILE,
+    );
+  }
+  let data: unknown;
+  try {
+    data = JSON.parse(raw);
+  } catch (err) {
+    const detail = describeJsonError(err, raw);
+    throw new ConfigFileError(
+      `Invalid JSON in ${CONFIG_FILE}: ${detail}. ` +
+        `The file was left untouched — fix it and start Talon again.`,
+      CONFIG_FILE,
+      [detail],
+    );
+  }
+  if (data === null || typeof data !== "object" || Array.isArray(data)) {
+    throw new ConfigFileError(
+      `Invalid config in ${CONFIG_FILE}: the top level must be a JSON object.`,
+      CONFIG_FILE,
+      ["(root): expected a JSON object"],
+    );
   }
-  return {};
+  return data as Record<string, unknown>;
 }
 
 function normalizeDeprecatedFrontendConfig(
@@ -879,7 +967,18 @@ export function loadConfig(): TalonConfig {
     }
   }
 
-  const parsed = configSchema.parse(fileConfig);
+  const result = configSchema.safeParse(fileConfig);
+  if (!result.success) {
+    const issues = formatSchemaIssues(result.error);
+    throw new ConfigFileError(
+      `Invalid config in ${CONFIG_FILE}:\n` +
+        issues.map((line) => `  - ${line}`).join("\n") +
+        `\nThe file was left untouched — fix it and start Talon again.`,
+      CONFIG_FILE,
+      issues,
+    );
+  }
+  const parsed = result.data;
 
   // The soul kernel is gone (#953). Its config block still parses so an
   // existing config.json keeps loading, but it no longer does anything —

package/src/core/daemon/crash.ts

@@ -80,3 +80,26 @@ export function handleUncaughtException(err: Error, hooks: CrashHooks): void {
   crashStep("crash report", () => logError("bot", "Uncaught exception", err));
   process.exit(1);
 }
+
+/**
+ * `process.on("unhandledRejection")` body. Report — never crash — but keep
+ * the stack: a bare "Unhandled rejection: ENOSPC: no space left on device,
+ * write" says nothing about which code path forgot its `.catch()`. Async fs
+ * errors carry `path`/`syscall` rather than useful frames, so those ride
+ * along in the message too.
+ */
+export function handleUnhandledRejection(reason: unknown): void {
+  crashStep("rejection report", () => {
+    if (!(reason instanceof Error)) {
+      logError("bot", `Unhandled rejection: ${String(reason)}`);
+      return;
+    }
+    const { syscall, path } = reason as NodeJS.ErrnoException;
+    const where = [syscall, path].filter(Boolean).join(" ");
+    logError(
+      "bot",
+      `Unhandled rejection: ${reason.message}${where ? ` (${where})` : ""}`,
+      reason,
+    );
+  });
+}

package/src/core/engine/gateway-actions/triggers.ts

@@ -19,12 +19,12 @@ import {
   validateTimeout,
   writeScriptFile,
   DEFAULT_TIMEOUT_SECONDS,
-  MAX_ACTIVE_PER_CHAT,
   type TriggerLanguage,
 } from "../../../storage/triggers.js";
 import {
   cancelTrigger,
   spawnTrigger,
+  triggerCapError,
 } from "../../background/triggers/index.js";
 import { log } from "../../../util/log.js";
 import { validateJobModelOverride } from "./validation.js";
@@ -61,13 +61,11 @@ export const triggerHandlers: SharedActionHandlers = {
         error: `A trigger named "${name}" already exists in this chat. Cancel it first or pick a different name.`,
       };
     }
-    const active = getActiveTriggersForChat(chatKey);
-    if (active.length >= MAX_ACTIVE_PER_CHAT) {
-      return {
-        ok: false,
-        error: `Per-chat trigger cap reached (${MAX_ACTIVE_PER_CHAT} active). Cancel one before creating another.`,
-      };
-    }
+    const capErr = triggerCapError(
+      getActiveTriggersForChat(chatKey),
+      persistent,
+    );
+    if (capErr) return { ok: false, error: capErr };
 
     // Validate the model up front so a bad id is rejected here instead of
     // silently failing at fire time.

package/src/core/mcp-hub/launcher.ts

@@ -40,7 +40,9 @@
  *   2. `TALON_BRIDGE_URL/health` stops responding for several
  *      consecutive pings — Talon's gateway is gone. Catches the
  *      "kilo serve / opencode serve outlives Talon" case where those
- *      daemons keep our stdin open across Talon restarts.
+ *      daemons keep our stdin open across Talon restarts. A ping that only
+ *      times out (port still bound, gateway busy) is tolerated for minutes,
+ *      not seconds — see BridgeWatchdog.
  */
 
 import crossSpawn from "cross-spawn";
@@ -203,7 +205,75 @@ export function wrapMcpCommand(command: readonly string[]): string[] {
 // within ~1 minute.
 const BRIDGE_PING_INTERVAL_MS = 15_000;
 const BRIDGE_PING_TIMEOUT_MS = 2_000;
-const BRIDGE_FAILURES_BEFORE_EXIT = 4;
+export const BRIDGE_FAILURES_BEFORE_EXIT = 4;
+// A ping that TIMES OUT means the port is still bound — the kernel accepted
+// the connection — but the gateway is too busy to answer within 2s (event
+// loop saturated by a burst of agents, a big synchronous write, …). That is
+// a live Talon, not a dead one, so it gets a much longer budget (~5 min)
+// before the child is evicted. Only a truly wedged daemon reaches it.
+export const BRIDGE_UNRESPONSIVE_BEFORE_EXIT = 20;
+
+/**
+ * Outcome of one bridge health ping:
+ *   - "ok": /health answered 2xx.
+ *   - "unreachable": nothing healthy behind the port (connection refused or
+ *     reset, non-2xx reply) — Talon is gone or restarting.
+ *   - "unresponsive": the request timed out — something holds the port but
+ *     is slow to answer; Talon is alive but busy.
+ */
+export type BridgePingOutcome = "ok" | "unreachable" | "unresponsive";
+
+/** Classify a rejected health fetch. Timeouts/aborts mean "busy", not "gone". */
+export function classifyBridgePingError(
+  err: unknown,
+): Exclude<BridgePingOutcome, "ok"> {
+  const name = (err as { name?: unknown } | null)?.name;
+  return name === "TimeoutError" || name === "AbortError"
+    ? "unresponsive"
+    : "unreachable";
+}
+
+/** Ping `${bridgeUrl}/health` once. Never throws. */
+export async function pingBridge(
+  bridgeUrl: string,
+  timeoutMs: number = BRIDGE_PING_TIMEOUT_MS,
+): Promise<BridgePingOutcome> {
+  try {
+    const resp = await fetch(`${bridgeUrl}/health`, {
+      signal: AbortSignal.timeout(timeoutMs),
+    });
+    // Drain the body so the socket is released promptly.
+    await resp.arrayBuffer().catch(() => undefined);
+    return resp.ok ? "ok" : "unreachable";
+  } catch (err) {
+    return classifyBridgePingError(err);
+  }
+}
+
+/**
+ * Consecutive-failure bookkeeping for the bridge watchdog. `record()`
+ * returns true once the child should be shut down: after
+ * BRIDGE_FAILURES_BEFORE_EXIT failures ending in an "unreachable" ping (the
+ * port is really closed), or after BRIDGE_UNRESPONSIVE_BEFORE_EXIT failures
+ * of any kind (the daemon is wedged, not just busy).
+ */
+export class BridgeWatchdog {
+  consecutiveFailures = 0;
+
+  record(outcome: BridgePingOutcome): boolean {
+    if (outcome === "ok") {
+      this.consecutiveFailures = 0;
+      return false;
+    }
+    this.consecutiveFailures += 1;
+    if (this.consecutiveFailures >= BRIDGE_UNRESPONSIVE_BEFORE_EXIT)
+      return true;
+    return (
+      outcome === "unreachable" &&
+      this.consecutiveFailures >= BRIDGE_FAILURES_BEFORE_EXIT
+    );
+  }
+}
 
 /**
  * Run the supervisor over `argvTail` = [cmd, ...args].
@@ -346,29 +416,19 @@ export function runSupervisor(argvTail: string[]): Promise<never> {
   // (every Talon-spawned MCP server has it; ad-hoc supervisor uses
   // without the env var keep the stdin-EOF-only behavior).
   if (BRIDGE_URL) {
-    let consecutiveFailures = 0;
+    const watchdog = new BridgeWatchdog();
     const tick = async (): Promise<void> => {
       if (terminating) return;
-      try {
-        const resp = await fetch(`${BRIDGE_URL}/health`, {
-          signal: AbortSignal.timeout(BRIDGE_PING_TIMEOUT_MS),
-        });
-        if (resp.ok) {
-          consecutiveFailures = 0;
-          return;
-        }
-        consecutiveFailures += 1;
-      } catch {
-        consecutiveFailures += 1;
-      }
-      if (consecutiveFailures >= BRIDGE_FAILURES_BEFORE_EXIT) {
-        // Talon's gateway is gone. The MCP child has nothing useful to
-        // serve — bridge calls would 404 against a dead port — so shut
-        // down. Kilo/OpenCode notice the stdio close on the next
-        // interaction and drop the registration on their side.
+      const outcome = await pingBridge(BRIDGE_URL);
+      if (terminating) return;
+      if (watchdog.record(outcome)) {
+        // Talon's gateway is gone (or wedged for minutes). The MCP child
+        // has nothing useful to serve — bridge calls would 404 against a
+        // dead port — so shut down. Kilo/OpenCode notice the stdio close
+        // on the next interaction and drop the registration on their side.
         process.stderr.write(
-          `mcp-launcher: bridge ${BRIDGE_URL} unreachable for ${
-            consecutiveFailures * (BRIDGE_PING_INTERVAL_MS / 1000)
+          `mcp-launcher: bridge ${BRIDGE_URL} ${outcome} for ${
+            watchdog.consecutiveFailures * (BRIDGE_PING_INTERVAL_MS / 1000)
           }s; shutting down child\n`,
         );
         terminate(0);

package/src/core/tools/ops/triggers.ts

@@ -57,7 +57,8 @@ shutdown/crash are respawned (not ones that exited on their own), the
 script must be safe to re-run from scratch, and timeout_seconds is ignored
 (persistent triggers run until cancelled or until Talon shuts down).
 
-Per-chat cap of 5 active triggers.`;
+Per-chat cap on active triggers (default 5; config triggers.maxActivePerChat,
+with an optional separate triggers.maxPersistentPerChat budget).`;
 
 export const triggerTools: ToolDefinition[] = [
   {

package/src/frontend/presentation/reports.ts

@@ -462,7 +462,10 @@ export function renderUsageMessage(
     if (entry.plan.resetsAvailable) {
       const n = entry.plan.resetsAvailable;
       const resets = `usage limit reset${n === 1 ? "" : "s"} available`;
-      lines.push(`  • You have ${fmt.bold(String(n))} ${resets}`);
+      const by = entry.plan.resetsExpireLabel
+        ? ` ${fmt.escape(`(use by ${entry.plan.resetsExpireLabel})`)}`
+        : "";
+      lines.push(`  • You have ${fmt.bold(String(n))} ${resets}${by}`);
     }
     for (const w of entry.plan.windows) {
       const reset = w.resetLabel ? ` reset ${w.resetLabel}` : "";

package/src/frontend/presentation/status-context.ts

@@ -404,6 +404,8 @@ export interface PlanDisplay {
   windows: PlanWindowDisplay[];
   /** Set only when the account still has one-shot rate-limit resets left. */
   resetsAvailable: number | undefined;
+  /** Deadline for the soonest-expiring banked reset, when the plan reports one. */
+  resetsExpireLabel?: string;
   /** Set only when the figures have aged, e.g. "12m ago". */
   ageLabel: string | undefined;
 }
@@ -432,6 +434,9 @@ export function buildPlanDisplay(
   return {
     plan: usage.plan,
     resetsAvailable: usage.resetsAvailable,
+    resetsExpireLabel: usage.resetsAvailable
+      ? planResetLabel(usage.resetsExpireAt)
+      : undefined,
     ageLabel:
       age > PLAN_STALE_AFTER_MS
         ? formatRelativeAge(usage.fetchedAt)

package/src/storage/triggers.ts

@@ -38,7 +38,7 @@ import type { Trigger, TriggerLanguage } from "./repositories/triggers-repo.js";
 
 export const DEFAULT_TIMEOUT_SECONDS = 24 * 60 * 60; // 24h
 export const MAX_TIMEOUT_SECONDS = 7 * 24 * 60 * 60; // 7d
-/** Per-chat soft cap on simultaneously active triggers. */
+/** Default per-chat cap on simultaneously active triggers (`config.triggers.maxActivePerChat`). */
 export const MAX_ACTIVE_PER_CHAT = 5;
 /** Truncate fire payloads at this many bytes to keep wake prompts sane. */
 export const FIRE_PAYLOAD_MAX_BYTES = 4_096;