talon-agent 5.14.0 → 5.18.2

package/src/frontend/telegram/userbot.ts

@@ -10,6 +10,7 @@
 
 import { TelegramClient, Api } from "telegram";
 import { StringSession } from "telegram/sessions/index.js";
+import { outgoingText } from "./actions/outgoing-log.js";
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from "node:fs";
 import { resolve, dirname } from "node:path";
 import writeFileAtomic from "write-file-atomic";
@@ -127,6 +128,29 @@ export async function disconnectUserClient(): Promise<void> {
 // ── Connection monitoring ────────────────────────────────────────────────────
 
 const CHECK_INTERVAL_MS = 5 * 60 * 1000; // 5 minutes
+/**
+ * Upper bound for any single network step in the monitor. GramJS's
+ * `connect()` can hang forever on a half-open socket; without a bound the
+ * `reconnecting` latch never clears and every later tick bails out, leaving
+ * the userbot dead until the daemon restarts.
+ */
+const RECONNECT_STEP_TIMEOUT_MS = 30_000;
+
+/** Reject if `p` doesn't settle within `ms`. Exported for tests. */
+export function withTimeout<T>(
+  p: Promise<T>,
+  ms: number,
+  what: string,
+): Promise<T> {
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  const timeout = new Promise<never>((_, reject) => {
+    timer = setTimeout(
+      () => reject(new Error(`${what} timed out after ${ms}ms`)),
+      ms,
+    );
+  });
+  return Promise.race([p, timeout]).finally(() => clearTimeout(timer));
+}
 
 let reconnecting = false;
 // Bumped by stopConnectionMonitor so a tick whose awaits straddle a shutdown
@@ -150,7 +174,11 @@ function startConnectionMonitor(): void {
     if (client.connected) {
       try {
         // A full API round-trip; throws if the socket is silently dead.
-        await client.getMe();
+        await withTimeout(
+          client.getMe(),
+          RECONNECT_STEP_TIMEOUT_MS,
+          "liveness probe",
+        );
         return; // genuinely alive
       } catch {
         if (gen !== monitorGeneration) return; // monitor stopped mid-probe
@@ -162,8 +190,18 @@ function startConnectionMonitor(): void {
     reconnecting = true;
     logWarn("userbot", "Connection lost, attempting reconnect...");
     try {
-      await client.connect();
-      if (await client.isUserAuthorized()) {
+      await withTimeout(
+        client.connect(),
+        RECONNECT_STEP_TIMEOUT_MS,
+        "reconnect",
+      );
+      if (
+        await withTimeout(
+          client.isUserAuthorized(),
+          RECONNECT_STEP_TIMEOUT_MS,
+          "auth check",
+        )
+      ) {
         log("userbot", "Reconnected successfully.");
       } else {
         logWarn("userbot", "Reconnected but not authorized.");
@@ -174,7 +212,11 @@ function startConnectionMonitor(): void {
       // Try a full re-init on next check
       if (storedApiId && storedApiHash) {
         try {
+          // Drop the wedged client without awaiting it — its socket may be
+          // the thing that's hung.
+          const stale = client;
           client = null;
+          void stale?.disconnect().catch(() => {});
           let sessionString = "";
           if (existsSync(SESSION_FILE)) {
             sessionString = readFileSync(SESSION_FILE, "utf-8").trim();
@@ -183,8 +225,18 @@ function startConnectionMonitor(): void {
           client = new TelegramClient(session, storedApiId, storedApiHash, {
             connectionRetries: 5,
           });
-          await client.connect();
-          if (await client.isUserAuthorized()) {
+          await withTimeout(
+            client.connect(),
+            RECONNECT_STEP_TIMEOUT_MS,
+            "re-init connect",
+          );
+          if (
+            await withTimeout(
+              client.isUserAuthorized(),
+              RECONNECT_STEP_TIMEOUT_MS,
+              "re-init auth check",
+            )
+          ) {
             log("userbot", "Full re-init reconnect succeeded.");
           }
         } catch (retryErr) {
@@ -230,7 +282,7 @@ export async function searchMessages(params: {
           m.sender && "firstName" in m.sender
             ? [m.sender.firstName, m.sender.lastName].filter(Boolean).join(" ")
             : "Unknown";
-        return `[msg:${m.id} ${date}] ${sender}: ${m.text || "(media)"}`;
+        return `[msg:${m.id} ${date}] ${sender}: ${messageBody(m)}`;
       })
       .join("\n");
   } catch (err) {
@@ -238,6 +290,47 @@ export async function searchMessages(params: {
   }
 }
 
+/**
+ * Render one message's body for the history readers.
+ *
+ * Rich Messages (Bot API 10.2) reach this client as `messageMediaUnsupported`
+ * with no text, because gramjs negotiates an older MTProto layer — so every
+ * message the bot itself sent reads back as "(media)" and the agent cannot see
+ * its own half of the conversation. When the text is one of ours, splice it
+ * back in from the outgoing log; when it is not, say what happened rather than
+ * calling it media.
+ */
+export function messageBody(m: {
+  id: number;
+  text?: string;
+  media?: { className: string };
+}): string {
+  if (m.text) return m.text;
+  if (m.media?.className === "MessageMediaUnsupported") {
+    const own = outgoingText(m.id);
+    if (own) return own;
+    return "(rich message — not renderable by this client)";
+  }
+  return "(media)";
+}
+
+/** Media tag for the history line, suppressed for rich messages we resolved. */
+export function mediaTagFor(m: {
+  id: number;
+  text?: string;
+  media?: { className: string };
+}): string {
+  if (!m.media) return "";
+  if (
+    m.media.className === "MessageMediaUnsupported" &&
+    !m.text &&
+    outgoingText(m.id)
+  ) {
+    return "";
+  }
+  return ` [${m.media.className}]`;
+}
+
 /** Get message history from a chat. Supports going back in time via offsetDate or offsetId. */
 export async function getHistory(params: {
   chatId: number | string;
@@ -278,8 +371,8 @@ export async function getHistory(params: {
         const replyTag = m.replyTo?.replyToMsgId
           ? ` (reply to msg:${m.replyTo.replyToMsgId})`
           : "";
-        const mediaTag = m.media ? ` [${m.media.className}]` : "";
-        return `[msg:${m.id} ${date}] ${sender}${replyTag}${mediaTag}: ${m.text || "(media)"}`;
+        const mediaTag = mediaTagFor(m);
+        return `[msg:${m.id} ${date}] ${sender}${replyTag}${mediaTag}: ${messageBody(m)}`;
       })
       .join("\n");
   } catch (err) {
@@ -415,8 +508,8 @@ export async function getMessage(params: {
     const replyTag = m.replyTo?.replyToMsgId
       ? `\nReply to: msg:${m.replyTo.replyToMsgId}`
       : "";
-    const mediaTag = m.media ? `\nMedia: ${m.media.className}` : "";
-    return `[msg:${m.id} ${date}] ${sender}${replyTag}${mediaTag}\n${m.text || "(no text)"}`;
+    const mediaTag = mediaTagFor(m) ? `\nMedia: ${m.media?.className}` : "";
+    return `[msg:${m.id} ${date}] ${sender}${replyTag}${mediaTag}\n${messageBody(m)}`;
   } catch (err) {
     return `Failed: ${err instanceof Error ? err.message : err}`;
   }

package/src/frontend/terminal/index.ts

@@ -33,9 +33,16 @@ import {
   type CommandContext,
 } from "./commands.js";
 import { buildCacheDisplay } from "../presentation/status-context.js";
+import { LOCAL_OPERATOR_SENDER } from "../../core/mcp-hub/guest-scope.js";
 
 // ── State ────────────────────────────────────────────────────────────────────
 
+/** The terminal is driven by the operator at the keyboard. */
+const TERMINAL_SENDER = {
+  senderName: "User",
+  senderKeys: [LOCAL_OPERATOR_SENDER],
+} as const;
+
 let terminalChatId = "";
 let terminalNumericId = 0;
 
@@ -224,7 +231,7 @@ export function createTerminalFrontend(
             chatId: terminalChatId,
             numericChatId: terminalNumericId,
             prompt: text,
-            senderName: "User",
+            ...TERMINAL_SENDER,
             isGroup: false,
             source: "message",
             onEvent: async (event) => {

package/src/frontend/whatsapp/commands.ts

@@ -101,14 +101,14 @@ function isMutating(cmd: WhatsAppCommand): boolean {
  * May this sender change the chat's settings? A DM sender already passed
  * the allowlist. In a group, the same allowlist is the admin rule — the
  * people in `allowedJids` are the operator's, everyone else may read
- * settings but not change them. With no allowlist at all there is no
- * admin to distinguish, the way Telegram opens up with no adminUserId.
+ * settings but not change them. With no allowlist at all nobody in a group
+ * may change them: an empty list never means everyone.
  */
 export function canChangeSettings(
   runtime: WhatsAppRuntime,
   inbound: Pick<CommandInbound, "isGroup" | "identity">,
 ): boolean {
-  if (!inbound.isGroup || runtime.allowedDms.size === 0) return true;
+  if (!inbound.isGroup) return true;
   return identityAllowed(inbound.identity, runtime.allowedDms);
 }
 

package/src/frontend/whatsapp/messages/inbound.ts

@@ -273,6 +273,7 @@ async function runInboundTurn(
       numericChatId: chat.numericChatId,
       prompt,
       senderName,
+      senderKeys: identity.ids.map((id) => `wa_dm_${id}`),
       isGroup,
       source: "message",
       onEvent: (event) => onTurnEvent(runtime, chat, event),

package/src/plugins/playwright/index.ts

@@ -15,7 +15,7 @@
  *   "playwright": {
  *     "enabled": true,
  *     "browser": "firefox",
- *     "endpointFile": "/home/dylan/camoufox-endpoint.txt"
+ *     "endpointFile": "/home/ada/camoufox-endpoint.txt"
  *   }
  *
  * VERSION COUPLING (endpoint mode): the WebSocket handshake requires the

package/src/storage/backup/index.ts

@@ -22,7 +22,7 @@ import * as repo from "./repo.js";
  * handle stays inside storage/ (`db-handle-stays-in-storage`), and a
  * snapshot of the database is a storage concern with a storage API.
  */
-export { snapshotDatabase } from "../db.js";
+export { snapshotDatabase, snapshotSqliteFile } from "../db.js";
 
 export type { BackupRecord, BackupRemoteRecord } from "./repo.js";
 import type { BackupRecord, BackupRemoteRecord } from "./repo.js";

package/src/storage/db.ts

@@ -58,6 +58,11 @@ const sqliteModule = (await import(
   IS_BUN ? "bun:sqlite" : "node:sqlite"
 )) as Record<string, new (path: string) => SqlDatabase>;
 const Database = IS_BUN ? sqliteModule.Database : sqliteModule.DatabaseSync;
+/** The same constructor, with the options bag both runtimes accept. */
+const ReadOnlyDatabase = Database as unknown as new (
+  path: string,
+  options: Record<string, boolean>,
+) => SqlDatabase;
 
 let db: SqlDatabase | null = null;
 
@@ -236,6 +241,24 @@ export function snapshotDatabase(destPath: string): void {
   database.prepare(dbSql.vacuumInto).run(destPath);
 }
 
+/**
+ * Consistent copy of ANOTHER program's SQLite file (a backend's session
+ * store) — the same `VACUUM INTO` as {@link snapshotDatabase}, through a
+ * read-only handle so the owner's database and WAL are never written.
+ */
+export function snapshotSqliteFile(sourcePath: string, destPath: string): void {
+  const foreign = new ReadOnlyDatabase(
+    sourcePath,
+    IS_BUN ? { readonly: true } : { readOnly: true },
+  );
+  try {
+    mkdirSync(dirname(destPath), { recursive: true });
+    foreign.prepare(dbSql.vacuumInto).run(destPath);
+  } finally {
+    foreign.close();
+  }
+}
+
 export function closeDatabase(): void {
   if (!db) return;
   try {