talon-agent 5.14.0 → 5.18.2

package/LICENSE

@@ -1,21 +1,202 @@
-MIT License
-
-Copyright (c) 2026 Dylan Neve
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/LICENSE-MIT

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 The Falconry
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/NOTICE

@@ -0,0 +1,16 @@
+Talon
+Copyright 2026 The Falconry
+
+This product is licensed under the Apache License, Version 2.0 (see LICENSE).
+
+Prior licensing
+---------------
+Every release up to and including v5.18.1 was published under the MIT
+License, preserved verbatim in LICENSE-MIT. That grant is irrevocable: anyone
+who received those versions keeps their MIT rights to them, and the
+contributions made under it remain available on those terms.
+
+The relicensing relies on the MIT License's own permission to sublicense, so
+the earlier contributions are redistributed here under Apache-2.0 with the
+original MIT notice retained. Contributions made from this release onward are
+licensed under Apache-2.0 per section 5 of that licence.

package/README.md

@@ -9,8 +9,8 @@
 [![TypeScript](https://img.shields.io/badge/TypeScript-7.0-3178C6?logo=typescript&logoColor=white)](https://www.typescriptlang.org/)
 [![Frontends](https://img.shields.io/badge/frontends-Telegram_%7C_WhatsApp_%7C_Discord_%7C_Teams_%7C_Terminal_%7C_App-25D366)](#frontends)
 [![Backends](https://img.shields.io/badge/backends-Claude_%7C_Kilo_%7C_OpenCode_%7C_Codex_%7C_Antigravity_%7C_OpenAI_Agents-D97706)](#backends)
-[![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
-[![CI](https://github.com/dylanneve1/talon/actions/workflows/ci.yml/badge.svg)](https://github.com/dylanneve1/talon/actions/workflows/ci.yml)
+[![License: Apache 2.0](https://img.shields.io/badge/license-Apache%202.0-blue.svg)](LICENSE)
+[![CI](https://github.com/thefalconry/talon/actions/workflows/ci.yml/badge.svg)](https://github.com/thefalconry/talon/actions/workflows/ci.yml)
 
 Multi-platform agentic AI harness. Runs on **Telegram**, **WhatsApp**, **Discord**, **Microsoft Teams**, the **Terminal**, and a **cross-platform Desktop/Mobile companion app** (Flutter), with a pluggable backend (**Claude Agent SDK**, **Kilo**, **OpenCode**, **Codex**, **Antigravity**, or **OpenAI Agents**) and full tool access through MCP.
 
@@ -39,7 +39,7 @@ Multi-platform agentic AI harness. Runs on **Telegram**, **WhatsApp**, **Discord
 ## Quick Start
 
 ```bash
-git clone https://github.com/dylanneve1/talon.git && cd talon
+git clone https://github.com/thefalconry/talon.git && cd talon
 npm install
 
 # Interactive setup (select frontend, configure tokens, pick model)
@@ -73,7 +73,7 @@ modules are embedded in the binary.
 
 ```bash
 # Homebrew (macOS / Linux)
-brew install dylanneve1/talon/talon
+brew install thefalconry/talon/talon
 
 # Debian / Ubuntu — download the .deb for your arch from the release, then:
 sudo apt install ./talon_<version>_amd64.deb     # or _arm64.deb
@@ -498,6 +498,9 @@ Config file: `~/.talon/config.json`
 | `disabledTools`            | ---          | Hide individual tools by name (`end_turn` cannot be disabled)                                                           |
 | `adminUserId`              | ---          | Telegram user ID for `/admin` commands                                                                                  |
 | `allowedUsers`             | ---          | Whitelist of Telegram user IDs                                                                                          |
+| `allowedGroups`            | ---          | Telegram group IDs the bot serves. Unset: groups the admin is in are still admitted (legacy, warned at startup)          |
+| `operatorIds`              | ---          | Extra operator identities (`"123"`, `"wa_dm_<number>"`, `"discord:<id>"`, `"teams:<id>"`) — only operators get the full tool set |
+| `guestDmScope`             | on           | Conversation-only tools for non-operator senders. Always applied in groups; `enabled: false` exempts DMs (legacy)       |
 | `apiId` / `apiHash`        | ---          | Telegram API credentials for full message history                                                                       |
 | `whatsapp`                 | ---          | WhatsApp frontend: pairing, allowlists, group policy ([above](#whatsapp))                                               |
 | `discord`                  | ---          | Discord frontend: bot token, application ID, guild / channel allowlists                                                 |
@@ -564,7 +567,7 @@ Commands: `/model`, `/effort`, `/context`, `/status`, `/reset`, `/rename`, `/res
 
 ## Production
 
-**Docker:** the image runs the daemon on Bun (`bun src/index.ts`); `~/.talon` and `~/.claude` are bind-mounted from the host into the container's `HOME=/home/bun`. Prebuilt images are on GHCR (`ghcr.io/dylanneve1/talon:latest`), and a first boot can be configured entirely from `TALON_*` environment variables — see **[docs/docker.md](docs/docker.md)** for the quick install, and **[docs/truenas.md](docs/truenas.md)** for a step-by-step TrueNAS SCALE install.
+**Docker:** the image runs the daemon on Bun (`bun src/index.ts`); `~/.talon` and `~/.claude` are bind-mounted from the host into the container's `HOME=/home/bun`. Prebuilt images are on GHCR (`ghcr.io/thefalconry/talon:latest`), and a first boot can be configured entirely from `TALON_*` environment variables — see **[docs/docker.md](docs/docker.md)** for the quick install, and **[docs/truenas.md](docs/truenas.md)** for a step-by-step TrueNAS SCALE install.
 
 ```bash
 docker compose up -d
@@ -576,7 +579,7 @@ The image is also ready for the **Antigravity (`agy`) backend**: add `-f docker-
 
 **Systemd:** unit file at `packaging/systemd/talon.service` — copy to `/etc/systemd/system/`, set `User=` and `WorkingDirectory=`, then `systemctl enable --now talon`.
 
-**Health endpoint:** `GET http://localhost:19876/health` returns JSON with uptime, memory, queue depth, active sessions, and last activity timestamp.
+**Health endpoint:** `GET http://localhost:19876/health` returns the daemon's identity (`app`, `mode`, `pid`, `port`, `startedAt`, `ok`). With the gateway token (`Authorization: Bearer $(cat ~/.talon/keys/gateway-token)`) it also returns uptime, memory, queue depth, active sessions, and last activity timestamp. Every other gateway route requires that token.
 
 **Logging:** Structured JSON via pino to `~/.talon/talon.log`. Rotated on startup when the file exceeds 10MB.
 
@@ -607,4 +610,8 @@ smoke-tests the CLI and the MCP supervisor from it.
 
 ## License
 
-MIT
+Apache License 2.0 — see [LICENSE](LICENSE).
+
+Releases up to and including v5.18.1 were published under the MIT License,
+kept at [LICENSE-MIT](LICENSE-MIT). That grant is irrevocable for those
+versions and still covers the contributions made under it — see [NOTICE](NOTICE).

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "talon-agent",
-  "version": "5.14.0",
+  "version": "5.18.2",
   "description": "Multi-frontend AI agent with full tool access, streaming, cron jobs, and plugin system",
-  "author": "Dylan Neve",
-  "license": "MIT",
+  "author": "The Falconry",
+  "license": "Apache-2.0",
   "repository": {
     "type": "git",
-    "url": "https://github.com/dylanneve1/talon.git"
+    "url": "https://github.com/thefalconry/talon.git"
   },
   "keywords": [
     "telegram",
@@ -52,6 +52,8 @@
     "src/login.ts",
     "prompts/",
     "README.md",
+    "NOTICE",
+    "LICENSE-MIT",
     "tsconfig.json"
   ],
   "scripts": {

package/prompts/system/heartbeat-agent.md

@@ -40,7 +40,7 @@ is a primary responsibility, not an optional extra. Goal tools
 (`update_goal`, `list_goals`, …) require an explicit `chat_id` parameter
 in heartbeat mode — use the chat id shown next to each goal.
 
-OUTBOUND MESSAGING: You also have access to the frontend tool servers — {{toolList}} — which expose `send`, `react`, and the rest of the messaging surface. Because there is NO ambient chat in heartbeat mode, every outbound tool call MUST include an explicit `chat_id` parameter. The bridge promotes that chat_id to the routing target, so `send(type="text", text="...", chat_id=N)` from `{{exampleFrontend}}-tools` delivers a message to chat N on that frontend. Known chat IDs live in your memory.md (per-frontend — for Telegram, Dylan's DM ID and group IDs are recorded; other frontends list their own). Without `chat_id`, the gateway returns 'No active chat context and no explicit numeric chat_id'. Cross-frontend: every tool server also carries `send_via(frontend=..., target=..., text=...)`, which delivers through ANY enabled frontend — target is the numeric chat id as a string, or for WhatsApp a phone number ("+353871234567") or wa_dm_/wa_group_ id.
+OUTBOUND MESSAGING: You also have access to the frontend tool servers — {{toolList}} — which expose `send`, `react`, and the rest of the messaging surface. Because there is NO ambient chat in heartbeat mode, every outbound tool call MUST include an explicit `chat_id` parameter. The bridge promotes that chat_id to the routing target, so `send(type="text", text="...", chat_id=N)` from `{{exampleFrontend}}-tools` delivers a message to chat N on that frontend. Known chat IDs live in your memory.md (per-frontend — for Telegram, Ada's DM ID and group IDs are recorded; other frontends list their own). Without `chat_id`, the gateway returns 'No active chat context and no explicit numeric chat_id'. Cross-frontend: every tool server also carries `send_via(frontend=..., target=..., text=...)`, which delivers through ANY enabled frontend — target is the numeric chat id as a string, or for WhatsApp a phone number ("+353871234567") or wa_dm_/wa_group_ id.
 
 Reaching out is part of the job, not an exception: when a run turns up
 something a user would genuinely want to know — a goal completed or

package/src/backend/agy/factory.ts

@@ -52,6 +52,9 @@ import {
 const agyFactory: BackendFactory = {
   id: "agy",
   label: "Antigravity",
+  // Its own shell/file tools can't be withheld per turn, so guest-scoped
+  // turns (non-operator senders) are refused rather than run with them.
+  guestToolScope: "refused",
   doctor: (config, isActive) => agyDoctorChecks(config, isActive),
 
   async init(config, ctx) {

package/src/backend/agy/mcp/config.ts

@@ -45,6 +45,7 @@ import {
 } from "../../../core/mcp-hub/index.js";
 import { frontendsForChat } from "../../runtime/frontends.js";
 import { logWarn } from "../../../util/log.js";
+import { gatewayAuthHeaders } from "../../../core/engine/gateway-auth.js";
 import { AGY_MCP_PREFIX } from "../constants.js";
 
 // ── Paths ───────────────────────────────────────────────────────────────────
@@ -77,6 +78,8 @@ function agyMcpSnapshotDir(override?: string): string {
  */
 export interface AgyMcpServer {
   disabled: boolean;
+  /** Gateway bearer token (`agy mcp add --header` writes this shape). */
+  headers: Record<string, string>;
   serverUrl: string;
 }
 
@@ -129,8 +132,13 @@ export function buildAgyMcpServers(args: {
   const { chatId, bridgeUrl, frontends, braveApiKey } = args;
   const scope = args.scope ?? agyScopeSlug(chatId);
   const servers: Record<string, AgyMcpServer> = {};
+  const headers = gatewayAuthHeaders();
   const add = (name: string, url: string) => {
-    servers[agyServerKey(scope, name)] = { disabled: false, serverUrl: url };
+    servers[agyServerKey(scope, name)] = {
+      disabled: false,
+      headers,
+      serverUrl: url,
+    };
   };
 
   for (const frontend of frontendsForChat(chatId, frontends)) {
@@ -198,7 +206,11 @@ function writeConfigAtomic(
   mkdirSync(dirname(path), { recursive: true });
   const tmp = `${path}.talon-${randomBytes(6).toString("hex")}.tmp`;
   try {
-    writeFileSync(tmp, `${JSON.stringify(file, null, 2)}\n`, "utf-8");
+    // Owner-only: Talon's entries carry the gateway token.
+    writeFileSync(tmp, `${JSON.stringify(file, null, 2)}\n`, {
+      encoding: "utf-8",
+      mode: 0o600,
+    });
     renameSync(tmp, path);
   } catch (err) {
     try {

package/src/backend/claude-sdk/factory.ts

@@ -41,6 +41,9 @@ const claudeSdkFactory: BackendFactory = {
   // no migration is needed.
   id: "claude",
   label: "Anthropic",
+  // Guest turns run with no SDK built-ins and only guest-allowed MCP
+  // servers (see options.ts), so the hub's guest scope is the whole surface.
+  guestToolScope: "enforced",
   doctor: (config, isActive) => claudeDoctorChecks(config, isActive),
 
   async init(config, ctx) {

package/src/backend/claude-sdk/options.ts

@@ -32,10 +32,14 @@ import {
 import { toolFingerprint } from "../runtime/cache/cache-telemetry.js";
 import { reportToolFingerprint } from "../runtime/cache/cache-metrics.js";
 import { log, logError } from "../../util/log.js";
+import {
+  GATEWAY_TOKEN_ENV,
+  gatewayToken,
+} from "../../core/engine/gateway-auth.js";
 import { getConfig, getBridgePort } from "./state.js";
 import { ALLOWED_TOOLS_CHAT, EFFORT_MAP } from "./constants.js";
 import {
-  isGuestChat,
+  isGuestTurn,
   isGuestPluginAllowed,
 } from "../../core/mcp-hub/guest-scope.js";
 import { VALID_TOOL_FRONTENDS } from "../../core/mcp-hub/talon-server.js";
@@ -92,6 +96,8 @@ export function getActiveFrontends(): readonly string[] {
 export type HubMcpEntry = {
   type: "http";
   url: string;
+  /** Gateway bearer token — see `hubAuthHeaders`. */
+  headers: Record<string, string>;
   alwaysLoad?: boolean;
   /** Per-server tool-call timeout in ms (overrides MCP_TOOL_TIMEOUT). */
   timeout?: number;
@@ -106,6 +112,18 @@ export type HubMcpEntry = {
  */
 const FRONTEND_TOOL_CALL_TIMEOUT_MS = 3_900_000; // 65 min
 
+/**
+ * Hub auth header for the Claude CLI's MCP config. The SDK hands that config
+ * to the CLI on its command line, which other local accounts can read — so
+ * the header carries a `${TALON_GATEWAY_TOKEN}` reference the CLI expands
+ * from its environment (inherited from the daemon), never the value itself.
+ * `gatewayToken()` runs first so the variable is guaranteed to be exported.
+ */
+function hubAuthHeaders(): Record<string, string> {
+  gatewayToken();
+  return { Authorization: `Bearer \${${GATEWAY_TOKEN_ENV}}` };
+}
+
 /**
  * Build the MCP servers map for a chat query.
  * Includes frontend-specific tool servers and Brave Search, if configured.
@@ -130,6 +148,7 @@ export function buildMcpServers(chatId: string): Record<string, HubMcpEntry> {
     servers[`${frontend}-tools`] = {
       type: "http",
       url: talonHubUrl(bridgeUrl, frontend, chatId),
+      headers: hubAuthHeaders(),
       // Always include the frontend's tools in the turn-1 prompt instead of
       // deferring them behind the SDK's tool search. These are the bot's
       // primary surface — it needs `end_turn`/`send`/`react` on EVERY turn to
@@ -155,6 +174,7 @@ export function buildMcpServers(chatId: string): Record<string, HubMcpEntry> {
     servers["brave-search"] = {
       type: "http",
       url: pluginHubUrl(bridgeUrl, "brave-search", chatId),
+      headers: hubAuthHeaders(),
     };
   }
 
@@ -176,6 +196,7 @@ export function buildPluginMcpServers(
     servers[name] = {
       type: "http",
       url: pluginHubUrl(bridgeUrl, name, chatId),
+      headers: hubAuthHeaders(),
     };
   }
   return servers;
@@ -393,10 +414,10 @@ export function buildSdkOptions(
   const { postToolUseFailureHook, postToolBatchHook } =
     buildTurnTerminatorHooks();
 
-  // Guest DMs (non-operator) get no SDK built-ins at all — Bash/Read/
+  // Guest turns (non-operator sender) get no SDK built-ins at all — Bash/Read/
   // Write/Skill live outside the hub, so the hub's guest scope can't hide
   // them — and only the plugin servers the guest scope allows.
-  const guest = isGuestChat(chatId);
+  const guest = isGuestTurn(chatId);
   const builtinTools = guest
     ? []
     : config.nativeTools

package/src/backend/codex/factory.ts

@@ -42,6 +42,9 @@ import {
 const codexFactory: BackendFactory = {
   id: "codex",
   label: "Codex",
+  // Its own shell/file tools can't be withheld per turn, so guest-scoped
+  // turns (non-operator senders) are refused rather than run with them.
+  guestToolScope: "refused",
   doctor: (config) => codexDoctorChecks(config),
 
   async init(config, ctx) {

package/src/backend/codex/init.ts

@@ -30,6 +30,7 @@ import { getState } from "./state.js";
 import { asCodexConfig, buildCodexMcpServers } from "./mcp-config.js";
 import { detectCodexAuth, type CodexAuthInfo } from "./auth.js";
 import { startDiscovery } from "./discovery.js";
+import { gatewayToken } from "../../core/engine/gateway-auth.js";
 import {
   computeAuthFingerprint,
   loadOAuthIncompatStore,
@@ -199,6 +200,9 @@ export function ensureCodex(chatId: string): Codex {
   const codexPathOverride =
     process.env.TALON_CODEX_BINARY || state.config.codexBinary || undefined;
 
+  // Export TALON_GATEWAY_TOKEN before snapshotting the env: the MCP entries
+  // name it via `bearer_token_env_var`.
+  gatewayToken();
   const codex = new Codex({
     apiKey,
     baseUrl,

package/src/backend/codex/mcp-config.ts

@@ -30,6 +30,7 @@ import {
   hubPluginServerNames,
 } from "../../core/mcp-hub/index.js";
 import type { ToolExclusionConfig } from "../../core/tools/mcp-env.js";
+import { GATEWAY_TOKEN_ENV } from "../../core/engine/gateway-auth.js";
 import { frontendsForChat } from "../runtime/frontends.js";
 
 /**
@@ -69,6 +70,12 @@ export interface CodexMcpServer {
    * Serialised as `default_tools_approval_mode` in the TOML config.
    */
   default_tools_approval_mode?: CodexToolApprovalMode;
+  /**
+   * Env var holding the hub's bearer token. Codex reads the value from its
+   * own environment (inherited from the daemon), so the token never lands
+   * in the `--config` flags on its command line.
+   */
+  bearer_token_env_var: string;
 }
 
 /**
@@ -140,6 +147,7 @@ export function buildCodexMcpServers(args: {
     servers[`${frontend}-tools`] = {
       url: talonHubUrl(bridgeUrl, frontend, chatId),
       default_tools_approval_mode: TALON_MCP_DEFAULT_APPROVAL,
+      bearer_token_env_var: GATEWAY_TOKEN_ENV,
     };
   }
 
@@ -149,6 +157,7 @@ export function buildCodexMcpServers(args: {
     servers["brave-search"] = {
       url: pluginHubUrl(bridgeUrl, "brave-search", chatId),
       default_tools_approval_mode: TALON_MCP_DEFAULT_APPROVAL,
+      bearer_token_env_var: GATEWAY_TOKEN_ENV,
     };
   }
 
@@ -157,6 +166,7 @@ export function buildCodexMcpServers(args: {
     servers[name] = {
       url: pluginHubUrl(bridgeUrl, name, chatId),
       default_tools_approval_mode: TALON_MCP_DEFAULT_APPROVAL,
+      bearer_token_env_var: GATEWAY_TOKEN_ENV,
     };
   }
 

package/src/backend/codex/oauth-incompat.ts

@@ -39,7 +39,7 @@
  * Keyed by auth fingerprint
  * ─────────────────────────
  *
- * If Dylan switches OAuth accounts (e.g. work vs personal) the cache
+ * If Ada switches OAuth accounts (e.g. work vs personal) the cache
  * file at `~/.codex/auth.json` changes, and what we learned about
  * account A doesn't necessarily apply to account B. To stay correct
  * across credential changes we tag the store with a fingerprint of the

package/src/backend/codex/token-usage.ts

@@ -71,7 +71,7 @@ interface CodexTokenTotals {
  *       "rate_limit_reached_type": null
  *     }
  *
- *   Exhausted (the silent-exit case on Dylan's free ChatGPT OAuth):
+ *   Exhausted (the silent-exit case on Ada's free ChatGPT OAuth):
  *     {
  *       "limit_id": "premium",
  *       "primary": null,
@@ -242,7 +242,7 @@ export async function readLastTokenCount(
  * Returns `null` only when the file can't be found or no `token_count`
  * event exists in it. Returns `{ usage: undefined, rateLimits: {...} }`
  * when a usage-exhausted turn writes a `token_count` event with
- * `info: null` but populated rate_limits (the literal shape on Dylan's
+ * `info: null` but populated rate_limits (the literal shape on Ada's
  * exhausted OAuth account, 2026-05-21).
  */
 export async function readLastRolloutSnapshot(

package/src/backend/openai-agents/factory.ts

@@ -40,6 +40,9 @@ import {
 const openAIAgentsFactory: BackendFactory = {
   id: "openai-agents",
   label: "OpenAI Agents",
+  // Its own shell/file tools can't be withheld per turn, so guest-scoped
+  // turns (non-operator senders) are refused rather than run with them.
+  guestToolScope: "refused",
   doctor: (config) => openAIAgentsDoctorChecks(config),
 
   async init(config, ctx) {