talon-agent 5.14.0 → 5.18.2

package/src/backend/openai-agents/mcp-pool.ts

@@ -25,6 +25,7 @@
 
 import { connectMcpServers, MCPServerStreamableHttp } from "@openai/agents";
 import type { MCPServer } from "@openai/agents";
+import { gatewayAuthHeaders } from "../../core/engine/gateway-auth.js";
 import {
   talonHubUrl,
   pluginHubUrl,
@@ -185,6 +186,7 @@ async function buildBundle(args: BundleInputs): Promise<OpenAIAgentsMcpBundle> {
         name: `${frontend}-tools`,
         url: talonHubUrl(bridgeUrl, frontend, chatId),
         cacheToolsList: true,
+        requestInit: { headers: gatewayAuthHeaders() },
       }),
     );
   }
@@ -197,6 +199,7 @@ async function buildBundle(args: BundleInputs): Promise<OpenAIAgentsMcpBundle> {
         name: "brave-search",
         url: pluginHubUrl(bridgeUrl, "brave-search", chatId),
         cacheToolsList: true,
+        requestInit: { headers: gatewayAuthHeaders() },
       }),
     );
   }
@@ -208,6 +211,7 @@ async function buildBundle(args: BundleInputs): Promise<OpenAIAgentsMcpBundle> {
         name,
         url: pluginHubUrl(bridgeUrl, name, chatId),
         cacheToolsList: true,
+        requestInit: { headers: gatewayAuthHeaders() },
       }),
     );
   }

package/src/backend/remote-server/factory.ts

@@ -68,6 +68,9 @@ export function createRemoteBackendFactory(
   return {
     id,
     label,
+    // The server's built-in shell/file tools can't be withheld per turn,
+    // so guest-scoped turns (non-operator senders) are refused.
+    guestToolScope: "refused",
     // The SDK ships as an npm dep but only talks to a server it spawns from
     // the CLI of the same name (`cross-spawn` → PATH lookup). A present
     // package with an absent binary fails at the first turn with a bare

package/src/backend/remote-server/mcp.ts

@@ -42,6 +42,7 @@ import {
   describeHubChildExit,
 } from "../../core/mcp-hub/index.js";
 import type { RemoteAgentClient } from "./client.js";
+import { gatewayAuthHeaders } from "../../core/engine/gateway-auth.js";
 import type { RemoteServerState } from "./state.js";
 import { errMsg } from "./state.js";
 import type { TalonConfig } from "../../core/config/index.js";
@@ -222,6 +223,7 @@ export async function ensureChatMcpServer<TClient extends RemoteAgentClient>(
       name: serverName,
       config: {
         type: "remote",
+        headers: gatewayAuthHeaders(),
         // Talon's MCP hub serves the chat's tool set in-process over
         // streamable HTTP — no subprocess on the agent-server side, and
         // the (frontend, chatId) binding travels in the URL instead of
@@ -305,6 +307,7 @@ export async function ensurePluginMcpServers<TClient extends RemoteAgentClient>(
           name: serverName,
           config: {
             type: "remote",
+            headers: gatewayAuthHeaders(),
             // Hub-managed child, shared across sessions and idle-reaped —
             // the agent server holds an HTTP connection, not a subprocess.
             url: pluginHubUrl(bridgeUrl, name, chatId),

package/src/backend/runtime/prompt/prompt-format.ts

@@ -10,7 +10,7 @@
  * doesn't" drift that motivated the shared-framework refactor.
  *
  * Examples:
- *   group:  "[2026-05-15 11:01:23] [Dylan (@dylanneve1)] [msg_id:2485]: actual text"
+ *   group:  "[2026-05-15 11:01:23] [Ada (@ada)] [msg_id:2485]: actual text"
  *   DM:     "[2026-05-15 11:01:23] [msg_id:2485] actual text"
  *   DM (no msg_id): "[2026-05-15 11:01:23] actual text"
  */
@@ -23,10 +23,10 @@ import { formatFullDatetime } from "../../../util/time.js";
 export type PromptFormatInputs = {
   /** Raw user text — passed through verbatim. */
   text: string;
-  /** Display name of the sender (e.g. "Dylan"). */
+  /** Display name of the sender (e.g. "Ada"). */
   senderName: string;
   /**
-   * Platform handle of the sender WITHOUT the leading `@` (e.g. `dylanneve1`).
+   * Platform handle of the sender WITHOUT the leading `@` (e.g. `ada`).
    * Rendered next to the display name in group chats so the model can address
    * or mention someone correctly — display names are not addressable, handles
    * are. Absent for users who have no handle set.

package/src/bootstrap.ts

@@ -139,6 +139,10 @@ export async function bootstrap(
   // trimming + brave key come from config; endpoints mount on the
   // gateway HTTP server).
   const { initHub } = await import("./core/mcp-hub/index.js");
+  const { setNativeToolsEnabled } =
+    await import("./core/engine/gateway-actions/native/index.js");
+  // The native shell/fs actions only answer when the tool set is on.
+  setNativeToolsEnabled(config.nativeTools);
   initHub({
     disabledTools: config.disabledTools,
     disabledToolTags: config.disabledToolTags,
@@ -146,6 +150,10 @@ export async function bootstrap(
     nativeTools: config.nativeTools,
     guestDmScope: config.guestDmScope,
     adminUserId: config.adminUserId,
+    operatorIds: [
+      ...(config.operatorIds ?? []),
+      ...(config.discord?.adminUserIds ?? []).map((id) => `discord:${id}`),
+    ],
   });
 
   initWorkspace(config.workspace);

package/src/cli/commands/backup.ts

@@ -22,7 +22,12 @@
 
 import pc from "picocolors";
 import { createInterface } from "node:readline/promises";
-import { getFrontends, loadConfig } from "../../core/config/index.js";
+import { join } from "node:path";
+import {
+  getFrontends,
+  loadBackupConfig,
+  loadConfig,
+} from "../../core/config/index.js";
 import { findRunningInstance } from "../../core/daemon/discovery.js";
 import {
   collectBackupStatus,
@@ -40,7 +45,9 @@ import {
 } from "../../core/backup/index.js";
 import { resolveBackupSettings } from "../../core/backup/plan.js";
 import { buildSnapshot } from "../../core/backup/snapshot.js";
-import { pruneLocal } from "../../core/backup/store.js";
+import { pruneLocal, reconcileIndex } from "../../core/backup/store.js";
+import { generatePassphraseFile } from "../../core/backup/passphrase.js";
+import { dirs } from "../../util/paths.js";
 import { fetchGateway } from "../daemon-api.js";
 
 const USAGE = `
@@ -50,10 +57,13 @@ const USAGE = `
     ${pc.cyan("list")} [--remote <targetId>]           list snapshots
     ${pc.cyan("show")} <id>                            everything about one snapshot
     ${pc.cyan("pin")} <id>  |  ${pc.cyan("unpin")} <id>          keep past retention, or release
-    ${pc.cyan("restore")} <id> [--from <target>] [--yes]  restore (daemon must be stopped)
+    ${pc.cyan("restore")} <id> [--from <target>] [--yes] [--allow-unauthenticated]
+                                       restore (daemon must be stopped)
+          [--clone]                            …onto a new machine: relocate sessions + plugin paths
     ${pc.cyan("prune")}                                apply the local retention policy
     ${pc.cyan("targets")}                              remote targets and their readiness
     ${pc.cyan("status")}                               schedule, sizes, targets
+    ${pc.cyan("keygen")} [path]                        new passphrase file (mode 600)
 `;
 
 type Flags = { values: string[]; flags: Map<string, string | true> };
@@ -169,6 +179,9 @@ async function backupNow(flags: Flags): Promise<void> {
 
 async function backupList(flags: Flags): Promise<void> {
   const target = flags.flags.get("remote");
+  // The manifests on disk are authoritative: a fresh host with a copied-in
+  // backups/ directory has an empty index until something reconciles it.
+  await reconcileIndex();
   const snapshots = await listSnapshots();
   const filtered =
     typeof target === "string"
@@ -312,10 +325,23 @@ async function backupRestore(id: string, flags: Flags): Promise<void> {
       return;
     }
   }
-  const settings = resolveBackupSettings(loadConfig().backup);
+  // Only the backup block: on a fresh host the real config is inside the
+  // snapshot, and a full load would reject the placeholder one.
+  const settings = resolveBackupSettings(loadBackupConfig());
   const target =
     typeof from === "string" ? await resolveTarget(from) : undefined;
-  const report = await restoreSnapshot({ id, settings, target });
+  if (typeof from === "string" && !target) {
+    process.exitCode = 1;
+    return;
+  }
+  const clone = flags.flags.get("clone") === true;
+  const report = await restoreSnapshot({
+    id,
+    settings,
+    target,
+    allowUnauthenticated: flags.flags.get("allow-unauthenticated") === true,
+    clone,
+  });
   const written = Object.entries(report.written)
     .map(([root, count]) => `${root} (${count})`)
     .join(", ");
@@ -330,6 +356,12 @@ async function backupRestore(id: string, flags: Flags): Promise<void> {
   console.log(
     `  Database: ${report.databaseReplaced ? "replaced" : "left in place"}\n`,
   );
+  if (clone) {
+    console.log(
+      `  Clone: config.json paths ${report.configRewritten ? "rewritten for this machine" : "unchanged"}.\n` +
+        `  Reinstall fetched plugins from ${pc.cyan("~/.talon/plugins-manifest.json")} (docs/backups.md).\n`,
+    );
+  }
 }
 
 /**
@@ -354,6 +386,27 @@ async function resolveTarget(id: string): Promise<BackupTarget | undefined> {
   return target;
 }
 
+/** Write a fresh passphrase file. Prints where, never what. */
+async function backupKeygen(path: string | undefined): Promise<void> {
+  try {
+    const dest = await generatePassphraseFile(
+      path ?? join(dirs.root, "backup.key"),
+    );
+    console.log(
+      `  ${pc.green("●")} Wrote a new backup passphrase to ${pc.bold(dest)} (mode 600).\n` +
+        `    Enable it in config.json:\n` +
+        `      "backup": { "encryption": { "passphraseFile": "${dest}" } }\n` +
+        `    Keep a copy OFF this machine — encrypted snapshots cannot be\n` +
+        `    restored without it.\n`,
+    );
+  } catch (err) {
+    console.log(
+      `  ${pc.red("●")} ${err instanceof Error ? err.message : String(err)}\n`,
+    );
+    process.exitCode = 1;
+  }
+}
+
 // ── Entry ───────────────────────────────────────────────────────────────────
 
 export async function runBackupCommand(argv: readonly string[]): Promise<void> {
@@ -386,6 +439,9 @@ export async function runBackupCommand(argv: readonly string[]): Promise<void> {
     case "targets":
       await backupTargets();
       return;
+    case "keygen":
+      await backupKeygen(id);
+      return;
     case "status":
     case undefined:
       await backupStatus();

package/src/cli/commands/mesh.ts

@@ -0,0 +1,133 @@
+/**
+ * `talon mesh` — per-device credentials from the outside.
+ *
+ *   talon mesh [list]                    every credential + devices still on
+ *                                        the shared token
+ *   talon mesh revoke <device|credId>    revoke now; live sessions drop
+ *   talon mesh rotate <device>           the device swaps credentials on its
+ *                                        next heartbeat (old one: 7-day grace)
+ *   talon mesh scopes <device> <list>    e.g. device,client,operator
+ *
+ * Everything goes through the running daemon's loopback gateway
+ * (core/engine/gateway-routes.ts → core/mesh/credentials/admin.ts): the
+ * daemon owns the store and the live sessions a revocation must drop, so
+ * editing the file behind its back could never take effect in time.
+ */
+
+import pc from "picocolors";
+import { fetchGateway, requireGatewayPort } from "../daemon-api.js";
+import type { DeviceCredential } from "../../core/mesh/credentials/index.js";
+
+const USAGE = `
+  ${pc.bold("talon mesh")} — per-device mesh credentials
+
+    ${pc.cyan("list")}                              credentials, scopes, last use (default)
+    ${pc.cyan("revoke")} <device|credential-id>     revoke now; drops its live sessions
+    ${pc.cyan("rotate")} <device>                   re-issue on the device's next heartbeat
+    ${pc.cyan("scopes")} <device> <scope,scope>     set scopes: device, client, operator
+`;
+
+type Overview = {
+  ok: boolean;
+  error?: string;
+  credentials?: DeviceCredential[];
+  legacyDevices?: { deviceId: string; lastSeen: number }[];
+  legacySharedToken?: boolean;
+};
+
+type AdminReply = { ok: boolean; text?: string; error?: string };
+
+function ago(ts: number | undefined, now: number): string {
+  if (ts === undefined) return "never";
+  const s = Math.max(0, Math.round((now - ts) / 1000));
+  if (s < 90) return `${s}s ago`;
+  if (s < 5400) return `${Math.round(s / 60)}m ago`;
+  if (s < 172_800) return `${Math.round(s / 3600)}h ago`;
+  return `${Math.round(s / 86_400)}d ago`;
+}
+
+function stateOf(c: DeviceCredential, now: number): string {
+  if (c.revokedAt !== undefined) return pc.dim(`revoked (${c.revokeReason})`);
+  if (c.expiresAt !== undefined && now >= c.expiresAt) return pc.dim("expired");
+  if (c.supersededBy) return pc.yellow(`superseded by ${c.supersededBy}`);
+  if (c.rotateRequestedAt !== undefined) return pc.yellow("rotation pending");
+  if (c.deviceId === null) return pc.yellow("unbound (awaiting first use)");
+  return pc.green("active");
+}
+
+function renderOverview(o: Overview): void {
+  const now = Date.now();
+  const creds = o.credentials ?? [];
+  console.log(`\n  ${pc.bold("Mesh credentials")}\n`);
+  if (creds.length === 0) console.log(`  ${pc.dim("(none issued yet)")}`);
+  for (const c of creds) {
+    console.log(
+      `  ${pc.cyan(c.id)}  ${c.deviceId ?? pc.dim("—")}  [${c.scopes.join(", ")}]  ${stateOf(c, now)}`,
+    );
+    console.log(
+      pc.dim(
+        `      via ${c.origin}, issued ${ago(c.createdAt, now)}, last used ${ago(c.lastUsedAt, now)}`,
+      ),
+    );
+  }
+  const legacy = o.legacyDevices ?? [];
+  if (legacy.length > 0) {
+    console.log(`\n  ${pc.yellow("Still on the shared native.token:")}`);
+    for (const d of legacy) {
+      console.log(`  ${d.deviceId}  ${pc.dim(`seen ${ago(d.lastSeen, now)}`)}`);
+    }
+  }
+  console.log(
+    `\n  Legacy shared token from remote clients: ${
+      o.legacySharedToken ? pc.yellow("accepted") : pc.green("refused")
+    }\n`,
+  );
+}
+
+async function adminOp(
+  port: number,
+  body: Record<string, unknown>,
+): Promise<void> {
+  const reply = (await fetchGateway(port, "/mesh/credentials", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body),
+  })) as AdminReply;
+  if (reply.ok) {
+    console.log(`\n  ${pc.green("✔")} ${reply.text}\n`);
+  } else {
+    console.error(`\n  ${pc.red("✖")} ${reply.error}\n`);
+    process.exitCode = 1;
+  }
+}
+
+export async function runMeshCommand(args: string[]): Promise<void> {
+  const [sub = "list", target, scopes] = args;
+  if (sub === "help" || sub === "--help" || sub === "-h") {
+    console.log(USAGE);
+    return;
+  }
+  const known = ["list", "revoke", "rotate", "scopes"];
+  if (!known.includes(sub)) {
+    console.error(`  Unknown mesh command: ${sub}\n${USAGE}`);
+    process.exitCode = 1;
+    return;
+  }
+  if (sub !== "list" && !target) {
+    console.error(
+      `  ${pc.red("✖")} talon mesh ${sub} needs a device.\n${USAGE}`,
+    );
+    process.exitCode = 1;
+    return;
+  }
+  const port = await requireGatewayPort();
+  if (port === null) {
+    process.exitCode = 1;
+    return;
+  }
+  if (sub === "list") {
+    renderOverview((await fetchGateway(port, "/mesh/credentials")) as Overview);
+    return;
+  }
+  await adminOp(port, { op: sub, device: target, scopes });
+}

package/src/cli/config.ts

@@ -46,6 +46,8 @@ export type Config = {
   pulse: boolean;
   pulseIntervalMs: number;
   adminUserId?: number;
+  /** Telegram DM allowlist; defaults to `[adminUserId]` when set up. */
+  allowedUsers?: number[];
   apiId?: number;
   apiHash?: string;
   maxMessageLength: number;
@@ -222,7 +224,7 @@ export function isConfigured(config: Config): boolean {
     ? config.frontend
     : [config.frontend];
   return fes.every((fe) => {
-    if (fe === "telegram") return !!config.botToken;
+    if (fe === "telegram") return !!config.botToken && !!config.adminUserId;
     if (fe === "teams") return !!config.teamsWebhookUrl;
     if (fe === "discord") return !!config.discord?.botToken;
     // WhatsApp's credentials live in ~/.talon/whatsapp-auth/, not the

package/src/cli/daemon-api.ts

@@ -6,19 +6,41 @@
 
 import pc from "picocolors";
 import { findRunningInstance } from "../core/daemon/discovery.js";
+import {
+  gatewayAuthHeaders,
+  gatewayTokenPath,
+  readGatewayToken,
+} from "../core/engine/gateway-auth.js";
 
 const REQUEST_TIMEOUT_MS = 3_000;
 
+/**
+ * Call a gateway endpoint as the operator: every request carries the gateway
+ * token (read from ~/.talon/keys/gateway-token), and a POST always declares a
+ * JSON body — the gateway refuses anything else.
+ */
 export async function fetchGateway(
   port: number,
   path: string,
   init?: RequestInit,
   timeoutMs: number = REQUEST_TIMEOUT_MS,
 ): Promise<unknown> {
+  const isPost = init?.method === "POST";
   const response = await fetch(`http://127.0.0.1:${port}${path}`, {
     ...init,
+    ...(isPost && init?.body === undefined ? { body: "{}" } : {}),
+    headers: {
+      ...(isPost ? { "Content-Type": "application/json" } : {}),
+      ...(init?.headers as Record<string, string> | undefined),
+      ...gatewayAuthHeaders(readGatewayToken()),
+    },
     signal: AbortSignal.timeout(timeoutMs),
   });
+  if (response.status === 401) {
+    throw new Error(
+      `gateway refused the request (401) — is ${gatewayTokenPath()} readable by this user?`,
+    );
+  }
   if (!response.ok) throw new Error(`gateway answered ${response.status}`);
   return response.json();
 }

package/src/cli/index.ts

@@ -39,6 +39,7 @@ import { runSkillCommand } from "./skill.js";
 import { runMemoryCommand } from "./memory.js";
 import { mainMenu } from "./menu.js";
 import { runBackupCommand } from "./commands/backup.js";
+import { runMeshCommand } from "./commands/mesh.js";
 
 export * from "./context.js";
 export * from "./config.js";
@@ -62,6 +63,7 @@ const CLI_COMMANDS = [
   "skill",
   "memory",
   "backup",
+  "mesh",
 ];
 
 /** `talon events [-f] [--history [N]]` → the tail options. */
@@ -110,6 +112,9 @@ function printHelp(): void {
   console.log(
     `    ${pc.cyan("backup")}     Snapshots and checkpoints (now/list/show/pin/restore)`,
   );
+  console.log(
+    `    ${pc.cyan("mesh")}       Device credentials (list/revoke/rotate/scopes)`,
+  );
   console.log(`    ${pc.cyan("config")}     View/edit configuration`);
   console.log(`    ${pc.cyan("logs")}       Tail log file`);
   console.log(`    ${pc.cyan("doctor")}     Validate environment`);
@@ -173,6 +178,7 @@ const COMMANDS: Record<string, CommandHandler> = {
   kill: (args) => killTask(args[0]),
   events: (args) => showEvents(eventsOptions(args)),
   backup: (args) => runBackupCommand(args),
+  mesh: (args) => runMeshCommand(args),
   plugin: (args) => runPluginCommand(args),
   skill: (args) => runSkillCommand(args),
   memory: (args) => runMemoryCommand(args),

package/src/cli/install-sources.ts

@@ -10,13 +10,15 @@
  *   4. anything else                         → { kind: "other" } — the caller
  *      decides (plugins treat it as an npm spec, skills reject it)
  *
- * Cloning always uses `--depth=1` (installs never need history) and spawns
+ * Cloning always uses `--depth=1` (installs never need history), ends the
+ * options with `--` so a URL can never be read as a git flag, and reports
+ * the commit it got so the install can be pinned/audited later. It spawns
  * `git`/`npm` via cross-spawn, which resolves the `.cmd`/`.exe` shims on
  * Windows — never assume a POSIX shell here.
  */
 
 import crossSpawn from "cross-spawn";
-import { existsSync, mkdtempSync, rmSync } from "node:fs";
+import { existsSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 
@@ -91,16 +93,49 @@ export function runTool(
 }
 
 export type CloneOutcome =
-  { ok: true; dir: string; cleanup: () => void } | { ok: false; error: string };
+  | { ok: true; dir: string; commit?: string; cleanup: () => void }
+  | { ok: false; error: string };
+
+/** The checked-out commit of a clone, when git can tell us. */
+function headCommit(dir: string): string | undefined {
+  const result = crossSpawn.sync("git", ["-C", dir, "rev-parse", "HEAD"], {
+    stdio: ["ignore", "pipe", "ignore"],
+  });
+  const sha = result.status === 0 ? result.stdout?.toString().trim() : "";
+  return sha && /^[0-9a-f]{40,64}$/.test(sha) ? sha : undefined;
+}
 
 /** Shallow-clone into a fresh temp directory. Caller must run `cleanup`. */
 export function cloneShallow(url: string): CloneOutcome {
+  // `--` below already stops option parsing; refusing a leading dash too
+  // means a hostile "URL" never even reaches git.
+  if (url.startsWith("-")) {
+    return { ok: false, error: `Refusing a git URL that starts with "-"` };
+  }
   const dir = mkdtempSync(join(tmpdir(), "talon-install-"));
   const cleanup = () => rmSync(dir, { recursive: true, force: true });
-  const outcome = runTool("git", ["clone", "--depth=1", url, dir]);
+  const outcome = runTool("git", ["clone", "--depth=1", "--", url, dir]);
   if (!outcome.ok) {
     cleanup();
     return { ok: false, error: `Clone failed: ${outcome.error}` };
   }
-  return { ok: true, dir, cleanup };
+  return { ok: true, dir, commit: headCommit(dir), cleanup };
+}
+
+/** The file a git-installed plugin keeps its provenance in. */
+const INSTALL_RECORD = ".talon-install.json";
+
+/** Write where an install came from and exactly which commit it is. */
+export function writeInstallRecord(
+  dir: string,
+  record: { source: string; subpath?: string; commit?: string },
+): void {
+  writeFileSync(
+    join(dir, INSTALL_RECORD),
+    JSON.stringify(
+      { ...record, installedAt: new Date().toISOString() },
+      null,
+      2,
+    ) + "\n",
+  );
 }

package/src/cli/plugin.ts

@@ -25,6 +25,7 @@ import { fetchGateway } from "./daemon-api.js";
 import { loadConfig, saveConfig, type Config } from "./config.js";
 import {
   cloneShallow,
+  writeInstallRecord,
   resolveSource,
   runTool,
   type ResolvedSource,
@@ -258,7 +259,16 @@ function installFromGit(
     }
     // An install is a snapshot, not a checkout — updates go through
     // `install --force`, so the clone's history has no business here.
+    // What it WAS a snapshot of is kept, so the exact commit is auditable.
     rmSync(join(stage, ".git"), { recursive: true, force: true });
+    writeInstallRecord(stage, {
+      source: source.url,
+      ...(source.subpath ? { subpath: source.subpath } : {}),
+      ...(clone.commit ? { commit: clone.commit } : {}),
+    });
+    if (clone.commit) {
+      console.log(`  ${pc.dim(`Commit ${clone.commit}`)}`);
+    }
 
     if (existsSync(join(stage, "package.json"))) {
       console.log(`  ${pc.dim("Installing dependencies…")}`);

package/src/cli/setup.ts

@@ -94,6 +94,20 @@ type TelegramAnswers = Pick<
   "botToken" | "adminId" | "apiId" | "apiHash"
 >;
 
+/**
+ * The Telegram admin id is required: it is the bot's owner (admin commands)
+ * and the default DM allowlist. The daemon refuses to start without it.
+ */
+export function validateTelegramAdminId(
+  value: string | undefined,
+): string | undefined {
+  const v = value?.trim() ?? "";
+  if (!v) return "Required — the bot answers only its admin (and allowedUsers)";
+  if (!/^\d+$/.test(v) || Number(v) <= 0 || !Number.isSafeInteger(Number(v)))
+    return "Must be your numeric Telegram user ID";
+  return undefined;
+}
+
 async function askTelegram(config: Config): Promise<TelegramAnswers> {
   const botToken = await askOrExit(
     p.text({
@@ -110,8 +124,9 @@ async function askTelegram(config: Config): Promise<TelegramAnswers> {
   const adminId = await askOrExit(
     p.text({
       message: "Your Telegram user ID",
-      placeholder: "optional — message @userinfobot to find yours",
+      placeholder: "message @userinfobot to find yours",
       initialValue: config.adminUserId ? String(config.adminUserId) : "",
+      validate: validateTelegramAdminId,
     }),
   );
 
@@ -619,6 +634,34 @@ export type SetupAnswers = {
   whatsapp?: Config["whatsapp"];
 };
 
+/**
+ * Admin + DM allowlist for the saved config. With Telegram on, the admin id
+ * is the one just entered, and an empty allowlist defaults to that admin —
+ * a fresh bot answers its owner and no one else. With Telegram off, both are
+ * left as they were (other surfaces read `adminUserId` too).
+ */
+function telegramAccess(
+  existing: Config,
+  answers: SetupAnswers,
+  telegramOn: boolean,
+): Pick<Config, "adminUserId" | "allowedUsers"> {
+  const adminUserId = answers.adminId
+    ? parseInt(answers.adminId, 10) || undefined
+    : undefined;
+  if (!telegramOn || adminUserId === undefined) {
+    return {
+      adminUserId: adminUserId ?? existing.adminUserId,
+      allowedUsers: existing.allowedUsers,
+    };
+  }
+  return {
+    adminUserId,
+    allowedUsers: existing.allowedUsers?.length
+      ? existing.allowedUsers
+      : [adminUserId],
+  };
+}
+
 /**
  * Fold the wizard's answers onto the existing config.
  *
@@ -674,9 +717,7 @@ export function buildSetupConfig(
     concurrency: existing.concurrency,
     pulse: answers.pulse,
     pulseIntervalMs: existing.pulseIntervalMs,
-    adminUserId: answers.adminId
-      ? parseInt(answers.adminId, 10) || undefined
-      : undefined,
+    ...telegramAccess(existing, answers, on("telegram")),
     apiId: answers.apiId,
     apiHash: answers.apiHash,
     maxMessageLength: existing.maxMessageLength,

package/src/cli/skill.ts

@@ -171,6 +171,9 @@ async function cmdInstall(args: string[]): Promise<void> {
         return;
       }
       installed = installAll(dirs, force);
+      if (clone.commit) {
+        console.log(`  ${pc.dim(`From ${resolved.url} @ ${clone.commit}`)}`);
+      }
     } finally {
       clone.cleanup();
     }