talon-agent 5.10.0 → 5.12.0

package/src/cli/config.ts

@@ -87,18 +87,124 @@ export const DEFAULTS: Config = {
   maxMessageLength: 4000,
 };
 
+/**
+ * A config.json that exists but can't be used — unreadable, not valid
+ * JSON, or not a JSON object. Thrown instead of silently falling back to
+ * defaults: `loadConfig` backs both read-only commands (`status`,
+ * `config`, `doctor`, the main menu's "is this configured?" check) and
+ * load → edit → save commands (`setup`, `plugin`), so treating a broken
+ * file as `{}` used to let the latter write those empty defaults straight
+ * back over — destroying — the user's real config. Mirrors
+ * core/config/index.ts's `ConfigFileError` in shape and wording (#1031)
+ * without importing across the CLI/daemon boundary; unlike that one, the
+ * CLI's `Config` type has no runtime schema, so there's no per-key
+ * validation to report here, only "can this be read as a JSON object".
+ */
+export class ConfigFileError extends Error {
+  constructor(
+    message: string,
+    readonly path: string,
+  ) {
+    super(message);
+    this.name = "ConfigFileError";
+  }
+}
+
+/**
+ * Append a line/column hint to a JSON.parse error message. Recent V8
+ * already includes "(line L column C)"; older runtimes only report
+ * "at position N", so derive it from the raw text in that case.
+ */
+function describeJsonError(err: unknown, raw: string): string {
+  const message = err instanceof Error ? err.message : String(err);
+  if (/\(line \d+ column \d+\)/.test(message)) return message;
+  const match = /at position (\d+)/.exec(message);
+  if (!match) return message;
+  const before = raw.slice(0, Number(match[1]));
+  const line = before.split("\n").length;
+  const column = before.length - before.lastIndexOf("\n");
+  return `${message} (line ${line} column ${column})`;
+}
+
+/** Parse `raw` as a config object, or describe in one phrase why it isn't one. */
+function parseConfigJson(
+  raw: string,
+):
+  { ok: true; data: Record<string, unknown> } | { ok: false; problem: string } {
+  let data: unknown;
+  try {
+    data = JSON.parse(raw);
+  } catch (err) {
+    return {
+      ok: false,
+      problem: `invalid JSON — ${describeJsonError(err, raw)}`,
+    };
+  }
+  if (data === null || typeof data !== "object" || Array.isArray(data)) {
+    return { ok: false, problem: "the top level must be a JSON object" };
+  }
+  return { ok: true, data: data as Record<string, unknown> };
+}
+
+/**
+ * Load ~/.talon/config.json. A missing file is first run: defaults apply.
+ * A present file that can't be read or isn't a valid JSON object throws
+ * `ConfigFileError` — see the class comment for why this must not fall
+ * back to defaults instead.
+ */
 export function loadConfig(): Config {
+  if (!existsSync(CONFIG_FILE)) return { ...DEFAULTS };
+  let raw: string;
   try {
-    if (existsSync(CONFIG_FILE)) {
-      return { ...DEFAULTS, ...JSON.parse(readFileSync(CONFIG_FILE, "utf-8")) };
-    }
-  } catch {
-    /* corrupt */
+    raw = readFileSync(CONFIG_FILE, "utf-8");
+  } catch (err) {
+    throw new ConfigFileError(
+      `Cannot read ${CONFIG_FILE}: ${err instanceof Error ? err.message : err}`,
+      CONFIG_FILE,
+    );
+  }
+  const result = parseConfigJson(raw);
+  if (!result.ok) {
+    throw new ConfigFileError(
+      `Invalid config in ${CONFIG_FILE}: ${result.problem}. ` +
+        `The file was left untouched — fix it and try again.`,
+      CONFIG_FILE,
+    );
   }
-  return { ...DEFAULTS };
+  return { ...DEFAULTS, ...result.data };
 }
 
+/**
+ * Save ~/.talon/config.json. Refuses to overwrite an existing file that
+ * isn't valid JSON. The normal caller shape is load → edit → save, and
+ * `loadConfig` above already throws before such a caller ever reaches
+ * this point — this check is the backstop for any caller that saves
+ * without a fresh load, or for the file changing under us between the
+ * two calls: writing `config` in either case would silently replace
+ * whatever is actually on disk with the caller's best guess.
+ */
 export function saveConfig(config: Config): void {
+  if (existsSync(CONFIG_FILE)) {
+    let raw: string;
+    try {
+      raw = readFileSync(CONFIG_FILE, "utf-8");
+    } catch (err) {
+      throw new ConfigFileError(
+        `Refusing to write ${CONFIG_FILE}: cannot read the existing file ` +
+          `(${err instanceof Error ? err.message : err}). It was left untouched.`,
+        CONFIG_FILE,
+      );
+    }
+    const result = parseConfigJson(raw);
+    if (!result.ok) {
+      throw new ConfigFileError(
+        `Refusing to write ${CONFIG_FILE}: the existing file is invalid ` +
+          `(${result.problem}). It was left untouched — fix it manually, ` +
+          `or delete it to start over.`,
+        CONFIG_FILE,
+      );
+    }
+  }
   if (!existsSync(dirs.root)) mkdirSync(dirs.root, { recursive: true });
   const clean = Object.fromEntries(
     Object.entries(config).filter(([, v]) => v !== undefined),

package/src/cli/index.ts

@@ -24,7 +24,7 @@ import pc from "picocolors";
 // inlines the JSON at compile time; tsx/node resolve it from the package.
 import pkg from "../../package.json" with { type: "json" };
 import { PKG_ROOT } from "./context.js";
-import { printBanner } from "./config.js";
+import { printBanner, ConfigFileError } from "./config.js";
 import { runSetup } from "./setup.js";
 import { showStatus } from "./status.js";
 import { viewConfig } from "./config-view.js";
@@ -121,84 +121,86 @@ function printHelp(): void {
 /** Route a `talon <command>` invocation. Called by the entry point. */
 export async function runCli(): Promise<void> {
   const command = process.argv[2];
-  switch (command) {
-    case "setup":
-      runSetup();
-      break;
-    case "status":
-      showStatus();
-      break;
-    case "config":
-      viewConfig();
-      break;
-    case "logs":
-      tailLogs();
-      break;
-    case "start":
-      printBanner();
-      await daemonStart();
-      break;
-    case "stop":
-      printBanner();
-      await daemonStop();
-      break;
-    case "restart":
-      printBanner();
-      await daemonRestart();
-      break;
-    case "run":
-      process.chdir(PKG_ROOT);
-      import("../index.js");
-      break;
-    case "chat":
-      process.chdir(PKG_ROOT);
-      startChat();
-      break;
-    case "doctor":
-      runDoctor();
-      break;
-    case "ps":
-      await showTasks(process.argv[3] === "--all" || process.argv[3] === "-a");
-      break;
-    case "kill":
-      await killTask(process.argv[3]);
-      break;
-    case "events":
-      await showEvents(eventsOptions(process.argv.slice(3)));
-      break;
-    case "backup":
-      await runBackupCommand(process.argv.slice(3));
-      break;
-    case "plugin":
-      await runPluginCommand(process.argv.slice(3));
-      break;
-    case "skill":
-      await runSkillCommand(process.argv.slice(3));
-      break;
-    case "memory":
-      runMemoryCommand(process.argv.slice(3));
-      break;
-    case "--version":
-    case "-v": {
-      console.log(pkg.version);
-      break;
-    }
-    case "--help":
-    case "-h":
-      printHelp();
-      break;
-    case undefined:
-      mainMenu();
-      break;
-    default: {
-      // "did you mean ...?" via the native similarity core (native/strsim-wasm).
-      const { closestMatch } = await import("../native/strsim.js");
-      const suggestion = closestMatch(command, CLI_COMMANDS);
-      const hint = suggestion
-        ? `Did you mean ${pc.cyan(`talon ${suggestion.value}`)}?`
-        : `Run ${pc.cyan("talon --help")} for usage.`;
-      console.error(`  Unknown command: ${command}\n  ${hint}\n`);
-      process.exit(1);
+  try {
+    await dispatch(command);
+  } catch (err) {
+    // A present-but-invalid config.json: every command below that reads
+    // config (directly, or via `mainMenu`'s "is this configured?" check)
+    // is async but was previously invoked without `await`, so this throw
+    // would otherwise surface as a bare unhandled-rejection stack trace —
+    // or, worse for the main menu, never happen at all, because the old
+    // loader swallowed the error and returned defaults, sending a broken
+    // install into the first-run wizard, which then saves over the file.
+    if (err instanceof ConfigFileError) {
+      console.error(`\n  ${pc.red("✖")} ${err.message}\n`);
+      process.exitCode = 1;
+      return;
     }
+    throw err;
+  }
+}
+
+type CommandHandler = (args: string[]) => void | Promise<void>;
+
+/** Every `talon <command>`, keyed by name. Handlers get the argv after the command. */
+const COMMANDS: Record<string, CommandHandler> = {
+  setup: () => runSetup(),
+  status: () => showStatus(),
+  config: () => viewConfig(),
+  logs: () => tailLogs(),
+  start: async () => {
+    printBanner();
+    await daemonStart();
+  },
+  stop: async () => {
+    printBanner();
+    await daemonStop();
+  },
+  restart: async () => {
+    printBanner();
+    await daemonRestart();
+  },
+  run: () => {
+    process.chdir(PKG_ROOT);
+    void import("../index.js");
+  },
+  chat: () => {
+    process.chdir(PKG_ROOT);
+    startChat();
+  },
+  doctor: () => runDoctor(),
+  ps: (args) => showTasks(args[0] === "--all" || args[0] === "-a"),
+  kill: (args) => killTask(args[0]),
+  events: (args) => showEvents(eventsOptions(args)),
+  backup: (args) => runBackupCommand(args),
+  plugin: (args) => runPluginCommand(args),
+  skill: (args) => runSkillCommand(args),
+  memory: (args) => runMemoryCommand(args),
+  "--version": () => console.log(pkg.version),
+  "-v": () => console.log(pkg.version),
+  "--help": () => printHelp(),
+  "-h": () => printHelp(),
+};
+
+async function unknownCommand(command: string): Promise<never> {
+  // "did you mean ...?" via the native similarity core (native/strsim-wasm).
+  const { closestMatch } = await import("../native/strsim.js");
+  const suggestion = closestMatch(command, CLI_COMMANDS);
+  const hint = suggestion
+    ? `Did you mean ${pc.cyan(`talon ${suggestion.value}`)}?`
+    : `Run ${pc.cyan("talon --help")} for usage.`;
+  console.error(`  Unknown command: ${command}\n  ${hint}\n`);
+  process.exit(1);
+}
+
+async function dispatch(command: string | undefined): Promise<void> {
+  if (command === undefined) {
+    await mainMenu();
+    return;
   }
+  const handler = Object.hasOwn(COMMANDS, command)
+    ? COMMANDS[command]
+    : undefined;
+  if (!handler) return unknownCommand(command);
+  await handler(process.argv.slice(3));
 }

package/src/core/agent-runtime/capabilities.ts

@@ -243,6 +243,67 @@ export interface UsageTelemetry {
    * plan concept; resolves `undefined` when the data can't be read.
    */
   getPlanUsage?(): Promise<PlanUsage | undefined>;
+  /**
+   * Banked one-shot limit resets, where the plan has them. Spending one is
+   * irreversible, so this is reachable only from a human-pressed confirm
+   * button — never exposed as an agent tool.
+   */
+  bankedResets?: BankedResetControl;
+}
+
+/** One banked reset grant, as the plan reports it. */
+export interface BankedResetGrant {
+  id: string;
+  label: string;
+  resetsLeft: number;
+  /** ISO deadline, when the grant has one. */
+  endsAt?: string;
+  /** Plan windows the reset clears (`five_hour`, `seven_day`, …). */
+  clears: string[];
+  /** Current utilisation per cleared window, 0-100. */
+  percentUsed: Record<string, number>;
+  /** The reset can only be spent while the account is at a limit. */
+  useRequiresLimit: boolean;
+}
+
+/** The grant a claim would spend, plus the account state around it. */
+export interface BankedResetOffer {
+  grant: BankedResetGrant;
+  atLimit: boolean;
+  /** ISO end of a post-claim cooldown, while one is running. */
+  cooldownUntil?: string;
+  /** Resets left across every usable grant. */
+  totalResetsLeft: number;
+}
+
+export type BankedResetResult =
+  | "reset"
+  | "already_used"
+  | "not_limited"
+  | "cooldown"
+  | "ineligible"
+  | "unavailable"
+  | "rate_limited"
+  | "auth_error"
+  | "error";
+
+export interface BankedResetClaim {
+  result: BankedResetResult;
+  /** Server-side reason code, when it gave one. */
+  reason?: string;
+  resetsLeft?: number;
+  cleared: string[];
+  weeklyResetsAt?: string;
+  cooldownUntil?: string;
+}
+
+export interface BankedResetControl {
+  getOffer(): Promise<BankedResetOffer | undefined>;
+  /**
+   * Spend one reset from `grantId`. `requestId` is the idempotency key:
+   * reuse it when retrying the same user action so a retry can't spend twice.
+   */
+  claim(grantId: string, requestId: string): Promise<BankedResetClaim>;
 }
 
 /** One subscription rate-limit window, as `/status` renders it. */
@@ -261,6 +322,8 @@ export interface PlanUsage {
   windows: PlanWindow[];
   /** How many one-shot rate-limit resets are still banked, when the plan has them. */
   resetsAvailable?: number;
+  /** ISO time the soonest-expiring banked reset must be used by, when the plan says. */
+  resetsExpireAt?: string;
   /** Epoch ms of the read, so renderers can flag figures as aged. */
   fetchedAt: number;
 }

package/src/core/agents/registry.ts

@@ -141,7 +141,8 @@ export class AgentRegistry {
         ok: false,
         error:
           `Sub-agent concurrency cap reached (${caps.maxConcurrent} live). ` +
-          `Wait for one to finish (wait_for_agent) or kill one (kill_agent).`,
+          `Wait for one to finish (wait_for_agent) or kill one (kill_agent), ` +
+          `or raise agents.maxConcurrent in ~/.talon/config.json.`,
       };
     }
 

package/src/core/background/triggers/caps.ts

@@ -0,0 +1,78 @@
+/**
+ * Per-chat trigger caps — how many watcher scripts one chat may keep active.
+ *
+ * Configured by `config.triggers` (see core/config) and wired in once via
+ * initTriggers. The check is a pure function of the chat's active triggers so
+ * the gateway handler and the tests share one rule.
+ */
+
+import { MAX_ACTIVE_PER_CHAT } from "../../../storage/triggers.js";
+
+export type TriggerCaps = {
+  /** Active triggers per chat — all of them, or only ad-hoc ones when
+   *  `maxPersistentPerChat` is set. */
+  readonly maxActivePerChat: number;
+  /** Optional separate budget for persistent triggers. */
+  readonly maxPersistentPerChat?: number;
+};
+
+export const DEFAULT_TRIGGER_CAPS: TriggerCaps = {
+  maxActivePerChat: MAX_ACTIVE_PER_CHAT,
+};
+
+const capsHolder: { caps: TriggerCaps } = { caps: DEFAULT_TRIGGER_CAPS };
+
+/** Replace the live caps. Missing fields fall back to the defaults. */
+export function setTriggerCaps(caps?: Partial<TriggerCaps>): void {
+  const next: TriggerCaps = {
+    maxActivePerChat:
+      caps?.maxActivePerChat ?? DEFAULT_TRIGGER_CAPS.maxActivePerChat,
+    ...(caps?.maxPersistentPerChat !== undefined
+      ? { maxPersistentPerChat: caps.maxPersistentPerChat }
+      : {}),
+  };
+  capsHolder.caps = next;
+}
+
+export function getTriggerCaps(): TriggerCaps {
+  return capsHolder.caps;
+}
+
+/**
+ * Why a new trigger may not be created, or null when there is room.
+ *
+ * Without `maxPersistentPerChat`, every active trigger shares
+ * `maxActivePerChat` (the historical behaviour). With it, persistent and
+ * ad-hoc triggers draw from separate budgets.
+ */
+export function triggerCapError(
+  active: ReadonlyArray<{ persistent?: boolean }>,
+  persistent: boolean,
+  caps: TriggerCaps = capsHolder.caps,
+): string | null {
+  const configPath = "~/.talon/config.json";
+  if (caps.maxPersistentPerChat === undefined) {
+    if (active.length < caps.maxActivePerChat) return null;
+    return (
+      `Per-chat trigger cap reached (${caps.maxActivePerChat} active). ` +
+      `Cancel one before creating another, or raise ` +
+      `triggers.maxActivePerChat in ${configPath}.`
+    );
+  }
+  if (persistent) {
+    const count = active.filter((t) => t.persistent === true).length;
+    if (count < caps.maxPersistentPerChat) return null;
+    return (
+      `Per-chat persistent trigger cap reached ` +
+      `(${caps.maxPersistentPerChat} persistent active). Cancel one before ` +
+      `creating another, or raise triggers.maxPersistentPerChat in ${configPath}.`
+    );
+  }
+  const count = active.filter((t) => t.persistent !== true).length;
+  if (count < caps.maxActivePerChat) return null;
+  return (
+    `Per-chat ad-hoc trigger cap reached (${caps.maxActivePerChat} ` +
+    `non-persistent active). Cancel one before creating another, or raise ` +
+    `triggers.maxActivePerChat in ${configPath}.`
+  );
+}

package/src/core/background/triggers/index.ts

@@ -5,6 +5,7 @@
  * Split by responsibility:
  *   - `state`   — injected deps + the child/timeout/log/buffer registries,
  *                 the warden set, timing constants, init + getRunningCount
+ *   - `caps`    — per-chat active-trigger caps (config.triggers)
  *   - `command` — interpreter resolution per script language
  *   - `output`  — stdout/stderr capture, payload truncation, wake firing
  *   - `exit`    — timeout/cancel/shutdown, child kill, finalizeExit, failTrigger
@@ -20,6 +21,11 @@ import { handleStdoutLine } from "./output.js";
 import { handleTimeout, finalizeExit } from "./exit.js";
 
 export { initTriggers, getRunningCount } from "./state.js";
+export {
+  getTriggerCaps,
+  triggerCapError,
+  DEFAULT_TRIGGER_CAPS,
+} from "./caps.js";
 export { commandForLanguage } from "./command.js";
 export { spawnTrigger } from "./spawn.js";
 export { cancelTrigger, shutdownTriggers } from "./exit.js";

package/src/core/background/triggers/state.ts

@@ -9,12 +9,15 @@ import type { ChildProcess } from "node:child_process";
 import type { WriteStream } from "node:fs";
 import { execute as dispatcherExecute } from "../../engine/dispatcher.js";
 import { log } from "../../../util/log.js";
+import { getTriggerCaps, setTriggerCaps, type TriggerCaps } from "./caps.js";
 
 // ── Dependencies (injected at startup) ──────────────────────────────────────
 
 export type TriggerDeps = {
   /** Used for terminal "fired"/"errored" wake prompts that go through the model. */
   execute: typeof dispatcherExecute;
+  /** Per-chat caps from `config.triggers`; defaults apply when absent. */
+  caps?: Partial<TriggerCaps>;
 };
 
 /** Reassignable on a holder object so submodules see the injected deps. */
@@ -52,7 +55,15 @@ export const WARDEN_GRACE_SLACK_MS = 2_000;
 export function initTriggers(d: TriggerDeps): void {
   depsHolder.deps = d;
   lifecycle.shuttingDown = false;
-  log("triggers", "Initialized");
+  setTriggerCaps(d.caps);
+  const caps = getTriggerCaps();
+  log(
+    "triggers",
+    `Initialized — maxActivePerChat=${caps.maxActivePerChat}` +
+      (caps.maxPersistentPerChat !== undefined
+        ? ` maxPersistentPerChat=${caps.maxPersistentPerChat}`
+        : ""),
+  );
 }
 
 /** Number of triggers currently running. */

package/src/core/config/index.ts

@@ -511,6 +511,25 @@ const configSchema = z.object({
         .default(15 * 60 * 1000),
     })
     .optional(),
+  /**
+   * Triggers — per-chat caps on active watcher scripts (running or
+   * pending). Checked when `trigger_create` runs; triggers already running
+   * are never killed when a cap is lowered.
+   *
+   *   - `maxActivePerChat` — active triggers per chat (default 5). When
+   *     `maxPersistentPerChat` is unset this counts persistent and ad-hoc
+   *     triggers together, exactly as before.
+   *   - `maxPersistentPerChat` — optional separate budget for persistent
+   *     triggers. When set, persistent triggers count only against it and
+   *     `maxActivePerChat` bounds ad-hoc (non-persistent) triggers only, so
+   *     long-lived watchers can't starve short ad-hoc ones.
+   */
+  triggers: z
+    .object({
+      maxActivePerChat: z.number().int().min(1).max(50).default(5),
+      maxPersistentPerChat: z.number().int().min(1).max(50).optional(),
+    })
+    .optional(),
   /**
    * Backups & checkpoints (docs/backups.md). Talon's only safety net, so
    * it is on by default: every `intervalHours` it writes a snapshot of
@@ -785,15 +804,84 @@ const DEFAULT_CONFIG = {
   pulseIntervalMs: 300000,
 };
 
+/**
+ * A config.json that exists but cannot be used — unreadable, not JSON, or
+ * rejected by the schema. Thrown instead of falling back to defaults: a
+ * daemon that silently boots on defaults (e.g. the telegram frontend) is
+ * far more surprising than one that refuses to start. The file on disk is
+ * never touched. `issues` carries one line per problem for callers that
+ * want to render them individually.
+ */
+export class ConfigFileError extends Error {
+  constructor(
+    message: string,
+    readonly path: string,
+    readonly issues: readonly string[] = [],
+  ) {
+    super(message);
+    this.name = "ConfigFileError";
+  }
+}
+
+/**
+ * Append a line/column hint to a JSON.parse error message. Recent V8
+ * already includes "(line L column C)"; older runtimes only report
+ * "at position N", so derive it from the raw text in that case.
+ */
+function describeJsonError(err: unknown, raw: string): string {
+  const message = err instanceof Error ? err.message : String(err);
+  if (/\(line \d+ column \d+\)/.test(message)) return message;
+  const match = /at position (\d+)/.exec(message);
+  if (!match) return message;
+  const before = raw.slice(0, Number(match[1]));
+  const line = before.split("\n").length;
+  const column = before.length - before.lastIndexOf("\n");
+  return `${message} (line ${line} column ${column})`;
+}
+
+/** Render zod issues as `path: message` lines (`(root)` for top-level). */
+function formatSchemaIssues(error: z.ZodError): string[] {
+  return error.issues.map((issue) => {
+    const path = issue.path.map(String).join(".") || "(root)";
+    return `${path}: ${issue.message}`;
+  });
+}
+
+/**
+ * Read config.json. A missing file is `{}` (first run — defaults apply);
+ * a present file that cannot be read or parsed throws ConfigFileError.
+ */
 function loadConfigFile(): Record<string, unknown> {
+  if (!existsSync(CONFIG_FILE)) return {};
+  let raw: string;
   try {
-    if (existsSync(CONFIG_FILE)) {
-      return JSON.parse(readFileSync(CONFIG_FILE, "utf-8"));
-    }
-  } catch {
-    /* corrupt — will be recreated */
+    raw = readFileSync(CONFIG_FILE, "utf-8");
+  } catch (err) {
+    throw new ConfigFileError(
+      `Cannot read ${CONFIG_FILE}: ${err instanceof Error ? err.message : err}`,
+      CONFIG_FILE,
+    );
+  }
+  let data: unknown;
+  try {
+    data = JSON.parse(raw);
+  } catch (err) {
+    const detail = describeJsonError(err, raw);
+    throw new ConfigFileError(
+      `Invalid JSON in ${CONFIG_FILE}: ${detail}. ` +
+        `The file was left untouched — fix it and start Talon again.`,
+      CONFIG_FILE,
+      [detail],
+    );
+  }
+  if (data === null || typeof data !== "object" || Array.isArray(data)) {
+    throw new ConfigFileError(
+      `Invalid config in ${CONFIG_FILE}: the top level must be a JSON object.`,
+      CONFIG_FILE,
+      ["(root): expected a JSON object"],
+    );
   }
-  return {};
+  return data as Record<string, unknown>;
 }
 
 function normalizeDeprecatedFrontendConfig(
@@ -879,7 +967,18 @@ export function loadConfig(): TalonConfig {
     }
   }
 
-  const parsed = configSchema.parse(fileConfig);
+  const result = configSchema.safeParse(fileConfig);
+  if (!result.success) {
+    const issues = formatSchemaIssues(result.error);
+    throw new ConfigFileError(
+      `Invalid config in ${CONFIG_FILE}:\n` +
+        issues.map((line) => `  - ${line}`).join("\n") +
+        `\nThe file was left untouched — fix it and start Talon again.`,
+      CONFIG_FILE,
+      issues,
+    );
+  }
+  const parsed = result.data;
 
   // The soul kernel is gone (#953). Its config block still parses so an
   // existing config.json keeps loading, but it no longer does anything —

package/src/core/daemon/crash.ts

@@ -80,3 +80,26 @@ export function handleUncaughtException(err: Error, hooks: CrashHooks): void {
   crashStep("crash report", () => logError("bot", "Uncaught exception", err));
   process.exit(1);
 }
+
+/**
+ * `process.on("unhandledRejection")` body. Report — never crash — but keep
+ * the stack: a bare "Unhandled rejection: ENOSPC: no space left on device,
+ * write" says nothing about which code path forgot its `.catch()`. Async fs
+ * errors carry `path`/`syscall` rather than useful frames, so those ride
+ * along in the message too.
+ */
+export function handleUnhandledRejection(reason: unknown): void {
+  crashStep("rejection report", () => {
+    if (!(reason instanceof Error)) {
+      logError("bot", `Unhandled rejection: ${String(reason)}`);
+      return;
+    }
+    const { syscall, path } = reason as NodeJS.ErrnoException;
+    const where = [syscall, path].filter(Boolean).join(" ");
+    logError(
+      "bot",
+      `Unhandled rejection: ${reason.message}${where ? ` (${where})` : ""}`,
+      reason,
+    );
+  });
+}