talon-agent 5.14.0 → 5.18.2

package/src/core/engine/gateway-actions/{fetch-url.ts → fetch-url/index.ts}

@@ -9,7 +9,7 @@ import { resolve } from "node:path";
 import {
   readBodyLimited,
   ResponseTooLargeError,
-} from "../../../util/http-body.js";
+} from "../../../../util/http-body.js";
 import {
   advertisedBinaryKind,
   decodeText,
@@ -18,9 +18,11 @@ import {
   isHtmlContent,
   isTextContent,
   matchesBinaryKind,
-} from "../../tools/content/web-content.js";
-import { dirs } from "../../../util/paths.js";
-import type { SharedActionHandlers } from "./types.js";
+} from "../../../tools/content/web-content.js";
+import { dirs } from "../../../../util/paths.js";
+import { getPoolConfig } from "../../backend-controller/index.js";
+import type { SharedActionHandlers } from "../types.js";
+import { BlockedUrlError, guardedFetch } from "./guard.js";
 
 const MAX_RESPONSE_MB = 50;
 const MAX_RESPONSE_BYTES = MAX_RESPONSE_MB * 1024 * 1024;
@@ -32,24 +34,60 @@ function capText(text: string): string {
   return `${text.slice(0, MAX_TEXT_CHARS)}\n\n[Content truncated at ${MAX_TEXT_CHARS} characters]`;
 }
 
+/** Reject anything that isn't a well-formed http(s) URL. */
+function urlError(url: string): string | undefined {
+  if (!url) return "Missing URL";
+  try {
+    const parsed = new URL(url);
+    if (!["http:", "https:"].includes(parsed.protocol)) {
+      return "URL must use http or https protocol";
+    }
+  } catch {
+    return "Invalid URL";
+  }
+  return undefined;
+}
+
+/** Turn a text-ish body into the tool's text result. */
+function textResult(
+  mimeType: string,
+  buffer: Buffer,
+  ct: string,
+): { ok: true; text: string } {
+  const trimmed = decodeText(buffer, ct).trim();
+  if (!trimmed) return { ok: true, text: "(Page has no readable content)" };
+
+  // extractText is a DOM extractor — running it on JSON/XML/JavaScript/
+  // plain text strips small payloads like {"status":"ok"} to nothing,
+  // so only HTML (declared or sniffed) goes through it.
+  if (!isHtmlContent(mimeType, trimmed)) {
+    return { ok: true, text: capText(trimmed) };
+  }
+  const text = extractText(trimmed, Number.POSITIVE_INFINITY);
+  if (text.length < 20)
+    return { ok: true, text: "(Page has no readable content)" };
+  return { ok: true, text: capText(text) };
+}
+
 export const fetchUrlHandlers: SharedActionHandlers = {
   fetch_url: async (body) => {
     const url = String(body.url ?? "");
-    if (!url) return { ok: false, error: "Missing URL" };
+    const invalid = urlError(url);
+    if (invalid) return { ok: false, error: invalid };
     try {
-      const parsed = new URL(url);
-      if (!["http:", "https:"].includes(parsed.protocol)) {
-        return { ok: false, error: "URL must use http or https protocol" };
-      }
-    } catch {
-      return { ok: false, error: "Invalid URL" };
-    }
-    try {
-      const resp = await fetch(url, {
-        signal: AbortSignal.timeout(15_000),
-        headers: { "User-Agent": "Talon/1.0" },
-        redirect: "follow",
-      });
+      // Every hop is checked against private/loopback/link-local ranges
+      // (see guard.ts) unless the operator opted out for local use.
+      const resp = await guardedFetch(
+        url,
+        {
+          signal: AbortSignal.timeout(15_000),
+          headers: { "User-Agent": "Talon/1.0" },
+        },
+        {
+          allowPrivateNetworks:
+            getPoolConfig()?.fetchUrl?.allowPrivateNetworks === true,
+        },
+      );
       if (!resp.ok) return { ok: false, error: `HTTP ${resp.status}` };
       const ct = resp.headers.get("content-type") ?? "";
 
@@ -78,20 +116,7 @@ export const fetchUrlHandlers: SharedActionHandlers = {
       }
 
       if (isTextContent(mimeType, buffer)) {
-        const trimmed = decodeText(buffer, ct).trim();
-        if (!trimmed)
-          return { ok: true, text: "(Page has no readable content)" };
-
-        // extractText is a DOM extractor — running it on JSON/XML/JavaScript/
-        // plain text strips small payloads like {"status":"ok"} to nothing,
-        // so only HTML (declared or sniffed) goes through it.
-        if (!isHtmlContent(mimeType, trimmed)) {
-          return { ok: true, text: capText(trimmed) };
-        }
-        const text = extractText(trimmed, Number.POSITIVE_INFINITY);
-        if (text.length < 20)
-          return { ok: true, text: "(Page has no readable content)" };
-        return { ok: true, text: capText(text) };
+        return textResult(mimeType, buffer, ct);
       }
 
       if (buffer.length === 0)
@@ -125,6 +150,9 @@ export const fetchUrlHandlers: SharedActionHandlers = {
         text: `Downloaded ${typeLabel} (${(buffer.length / 1024).toFixed(0)}KB) to: ${filePath}\nRead it with the Read tool or send it with send(type="file", file_path="${filePath}").`,
       };
     } catch (err) {
+      if (err instanceof BlockedUrlError) {
+        return { ok: false, error: err.message };
+      }
       return {
         ok: false,
         error: `Fetch failed: ${err instanceof Error ? err.message : err}`,

package/src/core/engine/gateway-actions/index.ts

@@ -28,7 +28,7 @@ import type { ActionResult } from "../../types.js";
 import type { Backend } from "../../agent-runtime/capabilities.js";
 import type { SharedActionHandlers } from "./types.js";
 import { historyHandlers } from "./history.js";
-import { fetchUrlHandlers } from "./fetch-url.js";
+import { fetchUrlHandlers } from "./fetch-url/index.js";
 import { cronHandlers } from "./cron.js";
 import { triggerHandlers } from "./triggers.js";
 import { agentContextActions, agentHandlers } from "./agents/index.js";
@@ -47,7 +47,7 @@ import {
   whatsappAccountHandlers,
   whatsappAccountChatFreeActions,
 } from "./whatsapp-account.js";
-import { nativeHandlers } from "./native/index.js";
+import { nativeActionRefusal, nativeHandlers } from "./native/index.js";
 import { backupChatFreeActions, backupHandlers } from "./backup/index.js";
 
 // Null-prototype so a request `action` of "toString" / "constructor" / etc.
@@ -98,6 +98,8 @@ export async function handleSharedAction(
   const action = body.action as string;
   const handler = handlers[action];
   if (!handler) return null; // not a shared action — delegate to frontend
+  const refusal = nativeActionRefusal(action);
+  if (refusal) return refusal;
   return handler(body, chatId, backend, chatKey);
 }
 

package/src/core/engine/gateway-actions/native/index.ts

@@ -36,6 +36,7 @@ import { readHandlers } from "./read.js";
 import { writeHandlers } from "./write.js";
 import { searchHandlers } from "./search.js";
 import type { SharedActionHandlers } from "../types.js";
+import type { ActionResult } from "../../../types.js";
 
 export const nativeHandlers: SharedActionHandlers = {
   ...teleportHandlers,
@@ -44,3 +45,26 @@ export const nativeHandlers: SharedActionHandlers = {
   ...writeHandlers,
   ...searchHandlers,
 };
+
+/**
+ * Whether the native tool actions may run at all. Off unless
+ * `config.nativeTools` turns them on (bootstrap calls the setter): with the
+ * option off the tools are never offered to the model, so a request for
+ * one can only come from outside the daemon's own tool surface.
+ */
+let nativeToolsEnabled = false;
+
+export function setNativeToolsEnabled(enabled: boolean): void {
+  nativeToolsEnabled = enabled;
+}
+
+/** The refusal for a native action while native tools are off, else null. */
+export function nativeActionRefusal(action: string): ActionResult | null {
+  if (nativeToolsEnabled || !Object.hasOwn(nativeHandlers, action)) {
+    return null;
+  }
+  return {
+    ok: false,
+    error: `${action} is unavailable: native tools are disabled (set "nativeTools": true in config.json to enable them).`,
+  };
+}

package/src/core/engine/gateway-actions/whatsapp-account.ts

@@ -5,7 +5,7 @@
  * A chat-free shared action, for the same reason `send_via` is one: the
  * account surface belongs to the WhatsApp *connection*, not to any
  * conversation, and the session driving it usually lives somewhere else
- * (Dylan's Telegram DM, or a heartbeat run with no ambient chat at
+ * (Ada's Telegram DM, or a heartbeat run with no ambient chat at
  * all). Routing it through the normal chat_id path would demand a
  * WhatsApp chat that need not exist.
  *

package/src/core/engine/gateway-auth.ts

@@ -0,0 +1,164 @@
+/**
+ * Gateway auth — the credential and request guard in front of the local
+ * action gateway (and the MCP hub mounted on it).
+ *
+ * The gateway binds 127.0.0.1, but loopback is not a trust boundary on its
+ * own: other accounts on the same host can connect to it, and a browser can
+ * be steered at it (cross-site requests, DNS rebinding). So every request
+ * passes three checks before routing:
+ *
+ *   - Host must name loopback on the gateway's own port. A rebinding
+ *     hostname resolves to 127.0.0.1 but still carries its own Host.
+ *   - No `Origin` header. Talon's clients (Node/Bun fetch, the Claude/Codex
+ *     CLIs, MCP SDK clients) never send one; browsers always do on the
+ *     requests that matter, and scripts cannot suppress it.
+ *   - POSTs must declare `Content-Type: application/json`, which a plain
+ *     HTML form cannot produce without a CORS preflight.
+ *
+ * and every route except `/health` requires the gateway token as
+ * `Authorization: Bearer <token>`, compared in constant time.
+ *
+ * The token is minted once (32 random bytes) into ~/.talon/keys/gateway-token
+ * with owner-only permissions and stays stable across restarts, so agent
+ * servers and CLIs configured by a previous boot keep working. The daemon
+ * also exports it as TALON_GATEWAY_TOKEN, so every process it spawns (MCP
+ * children, the Claude/Codex CLIs, plugins) inherits it without the value
+ * ever appearing on a command line. Delete the file and restart to rotate.
+ */
+
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import type { IncomingMessage } from "node:http";
+import { dirname, resolve } from "node:path";
+import { dirs } from "../../util/paths.js";
+
+/** Env var carrying the token to child processes (plugins, agent CLIs). */
+export const GATEWAY_TOKEN_ENV = "TALON_GATEWAY_TOKEN";
+
+const TOKEN_FILE = "gateway-token";
+/** 32 random bytes → 43 base64url chars. */
+const TOKEN_BYTES = 32;
+
+let cachedToken: string | null = null;
+
+/** Path of the persisted token file. */
+export function gatewayTokenPath(dir: string = dirs.keys): string {
+  return resolve(dir, TOKEN_FILE);
+}
+
+function readTokenFile(path: string): string | undefined {
+  try {
+    const value = readFileSync(path, "utf-8").trim();
+    return value || undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+function mintTokenFile(path: string): string {
+  const token = randomBytes(TOKEN_BYTES).toString("base64url");
+  mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+  writeFileSync(path, `${token}\n`, { mode: 0o600 });
+  chmodSync(path, 0o600); // `mode` above is ignored when the file exists
+  return token;
+}
+
+/**
+ * The gateway token, for the process that SERVES the gateway (and for
+ * in-process callers). Resolution: an inherited TALON_GATEWAY_TOKEN, then
+ * the key file, else a freshly minted key file. The result is exported to
+ * `process.env` so children spawned afterwards inherit it.
+ */
+export function gatewayToken(): string {
+  if (!cachedToken) {
+    const inherited = process.env[GATEWAY_TOKEN_ENV]?.trim();
+    const path = inherited ? "" : gatewayTokenPath();
+    cachedToken = inherited || readTokenFile(path) || mintTokenFile(path);
+  }
+  // Re-asserted on every call: children spawned from here on must see the
+  // token even if something cleared the variable in between.
+  process.env[GATEWAY_TOKEN_ENV] = cachedToken;
+  return cachedToken;
+}
+
+/**
+ * The gateway token for a CLIENT of a running daemon (CLI commands): the
+ * inherited env var or the key file, never minting one. Undefined when the
+ * daemon has not provisioned a token yet.
+ */
+export function readGatewayToken(): string | undefined {
+  return (
+    process.env[GATEWAY_TOKEN_ENV]?.trim() || readTokenFile(gatewayTokenPath())
+  );
+}
+
+/** Header map authenticating a request to the gateway. */
+export function gatewayAuthHeaders(
+  token: string | undefined = gatewayToken(),
+): Record<string, string> {
+  return token ? { Authorization: `Bearer ${token}` } : {};
+}
+
+/** Test seam: forget the cached token so the next call re-resolves it. */
+export function resetGatewayTokenCache(): void {
+  cachedToken = null;
+}
+
+// ── Request guard ───────────────────────────────────────────────────────────
+
+/** A refused request: HTTP status plus a short, non-sensitive reason. */
+export type GatewayRefusal = { status: number; error: string };
+
+const LOOPBACK_HOSTS = ["127.0.0.1", "localhost", "[::1]"];
+
+function digest(value: string): Buffer {
+  return createHash("sha256").update(value).digest();
+}
+
+/** Constant-time check of the request's bearer token against `expected`. */
+export function hasValidGatewayToken(
+  req: IncomingMessage,
+  expected: string,
+): boolean {
+  const header = req.headers.authorization;
+  if (typeof header !== "string") return false;
+  const match = /^Bearer\s+(\S+)\s*$/i.exec(header);
+  if (!match) return false;
+  // Hash both sides so the comparison is length-independent.
+  return timingSafeEqual(digest(match[1]!), digest(expected));
+}
+
+function isLoopbackHost(host: string | undefined, port: number): boolean {
+  if (typeof host !== "string") return false;
+  const normalized = host.trim().toLowerCase();
+  return LOOPBACK_HOSTS.some((name) => normalized === `${name}:${port}`);
+}
+
+function isJsonContentType(value: string | undefined): boolean {
+  if (typeof value !== "string") return false;
+  const mediaType = value.split(";")[0]!.trim().toLowerCase();
+  return mediaType === "application/json";
+}
+
+/**
+ * Transport-level checks every request must pass, `/health` included:
+ * loopback Host on the bound port, no browser Origin, JSON POST bodies.
+ */
+export function checkGatewayTransport(
+  req: IncomingMessage,
+  port: number,
+): GatewayRefusal | null {
+  if (req.headers.origin !== undefined) {
+    return { status: 403, error: "Browser requests are not accepted" };
+  }
+  if (!isLoopbackHost(req.headers.host, port)) {
+    return { status: 403, error: "Host not allowed" };
+  }
+  if (
+    req.method === "POST" &&
+    !isJsonContentType(req.headers["content-type"])
+  ) {
+    return { status: 415, error: "Content-Type must be application/json" };
+  }
+  return null;
+}

package/src/core/engine/gateway-routes.ts

@@ -1,19 +1,35 @@
 /**
  * The action gateway's HTTP routes — declared once, in order, rather than
- * implied by where an `if` sits in `Gateway.start`. Every route shares the
- * 127.0.0.1 trust boundary; the table is the list a reviewer reads.
+ * implied by where an `if` sits in `Gateway.start`. Every request first
+ * passes the transport guard (loopback Host, no browser Origin, JSON POST
+ * bodies) and every route except `/health` requires the gateway token —
+ * see gateway-auth.ts. The table is the list a reviewer reads.
  */
 import type { IncomingMessage, Server, ServerResponse } from "node:http";
 import { bus } from "../bus/index.js";
 import { taskTable } from "../tasks/index.js";
 import { agentRegistry } from "../agents/index.js";
 import { handleHubRequest, HUB_PATH_PREFIX } from "../mcp-hub/index.js";
+import { getMeshService } from "../mesh/index.js";
+import {
+  credentialAdmin,
+  credentialOverview,
+  type CredentialAdminContext,
+} from "../mesh/credentials/index.js";
 import { log, logError } from "../../util/log.js";
+import { checkGatewayTransport, hasValidGatewayToken } from "./gateway-auth.js";
 
 /** What the routes need from the Gateway that owns them. */
 export type GatewayRouteHost = {
-  /** The /health body — identity fields plus live counters. */
-  healthSnapshot: () => Record<string, unknown>;
+  /** The port the gateway is bound to — the only Host port it answers on. */
+  port: () => number;
+  /** The token every non-public route requires. */
+  token: () => string;
+  /**
+   * The /health body. `full` (an authenticated caller) adds the live
+   * counters; without it only the identity fields discovery matches on.
+   */
+  healthSnapshot: (full: boolean) => Record<string, unknown>;
   /** Schedule a graceful stop; false when this process cannot be stopped this way. */
   requestShutdown: () => boolean;
   /** Hot-reload plugins from config; resolves to the loaded plugin names. */
@@ -29,6 +45,8 @@ type RouteContext = {
   res: ServerResponse;
   url: URL;
   host: GatewayRouteHost;
+  /** True when the request carried a valid gateway token. */
+  authenticated: boolean;
 };
 
 type GatewayRoute = {
@@ -36,6 +54,8 @@ type GatewayRoute = {
   path: string;
   /** `prefix` matches `path` as a leading segment; default is an exact match. */
   match?: "prefix";
+  /** Served without the gateway token (still behind the transport guard). */
+  public?: boolean;
   handle: (ctx: RouteContext) => void | Promise<void>;
 };
 
@@ -55,9 +75,14 @@ async function readJsonBody(req: IncomingMessage): Promise<unknown> {
 
 const ROUTES: readonly GatewayRoute[] = [
   {
+    // Unauthenticated so discovery, container healthchecks and the MCP
+    // launcher's watchdog can probe it — which is why an anonymous caller
+    // only gets the identity fields, never the live counters.
     method: "GET",
     path: "/health",
-    handle: ({ res, host }) => sendJson(res, 200, host.healthSnapshot()),
+    public: true,
+    handle: ({ res, host, authenticated }) =>
+      sendJson(res, 200, host.healthSnapshot(authenticated)),
   },
   {
     // Graceful stop for `talon stop`/`talon restart`. Respond before
@@ -145,6 +170,40 @@ const ROUTES: readonly GatewayRoute[] = [
       }
     },
   },
+  {
+    // Per-device mesh credentials — the transport for `talon mesh`.
+    method: "GET",
+    path: "/mesh/credentials",
+    handle: async ({ req, res }) => {
+      const ctx = await meshCredentialContext(req, res);
+      if (ctx) sendJson(res, 200, await credentialOverview(ctx));
+    },
+  },
+  {
+    // `talon mesh revoke|rotate|scopes <device>`. Revocation drops the
+    // device's live bridge sessions before this answers.
+    method: "POST",
+    path: "/mesh/credentials",
+    handle: async ({ req, res }) => {
+      const ctx = await meshCredentialContext(req, res);
+      if (!ctx) return;
+      // A JSON content type forces a CORS preflight this gateway never
+      // grants, so a web page cannot drive credential changes via the
+      // user's browser (a text/plain "simple" POST would skip it).
+      if (!(req.headers["content-type"] ?? "").includes("application/json")) {
+        sendJson(res, 415, { ok: false, error: "Expected application/json" });
+        return;
+      }
+      let body: Record<string, unknown>;
+      try {
+        body = (await readJsonBody(req)) as Record<string, unknown>;
+      } catch {
+        sendJson(res, 400, { ok: false, error: "Invalid JSON" });
+        return;
+      }
+      sendJson(res, 200, await credentialAdmin(ctx, body));
+    },
+  },
   {
     // MCP hub — daemon-hosted MCP-over-HTTP endpoints for every backend
     // (see core/mcp-hub).
@@ -170,6 +229,31 @@ const ROUTES: readonly GatewayRoute[] = [
   },
 ];
 
+/**
+ * The mesh's credential admin context, or null after answering why not.
+ * Browser-originated requests are refused outright: only local processes
+ * (the CLI) manage credentials.
+ */
+async function meshCredentialContext(
+  req: IncomingMessage,
+  res: ServerResponse,
+): Promise<CredentialAdminContext | null> {
+  if (req.headers.origin) {
+    sendJson(res, 403, { ok: false, error: "Browser requests are refused" });
+    return null;
+  }
+  const mesh = getMeshService();
+  await mesh.load();
+  const ctx = mesh.credentialAdminContext();
+  if (!ctx) {
+    sendJson(res, 501, {
+      ok: false,
+      error: "This daemon has no per-device credential store",
+    });
+  }
+  return ctx;
+}
+
 function matches(route: GatewayRoute, req: IncomingMessage): boolean {
   if (route.method !== "ANY" && req.method !== route.method) return false;
   const url = req.url ?? "";
@@ -184,7 +268,17 @@ export async function dispatchGatewayRoute(
   res: ServerResponse,
   host: GatewayRouteHost,
 ): Promise<void> {
+  const refusal = checkGatewayTransport(req, host.port());
+  if (refusal) {
+    sendJson(res, refusal.status, { ok: false, error: refusal.error });
+    return;
+  }
+  const authenticated = hasValidGatewayToken(req, host.token());
   const route = ROUTES.find((candidate) => matches(candidate, req));
+  if (!authenticated && !route?.public) {
+    sendJson(res, 401, { ok: false, error: "Unauthorized" });
+    return;
+  }
   if (!route) {
     res.writeHead(404);
     res.end("Not found");
@@ -196,6 +290,7 @@ export async function dispatchGatewayRoute(
       res,
       url: new URL(req.url ?? "/", "http://gateway"),
       host,
+      authenticated,
     });
   } catch (err) {
     if (res.headersSent) return;

package/src/core/engine/gateway.ts

@@ -30,6 +30,7 @@ import {
   listenWithRetry,
   type GatewayRouteHost,
 } from "./gateway-routes.js";
+import { gatewayToken } from "./gateway-auth.js";
 import { handlePluginAction } from "../plugin/index.js";
 import type { FrontendActionHandler } from "../types.js";
 import type { Backend } from "../agent-runtime/capabilities.js";
@@ -422,8 +423,11 @@ export class Gateway {
 
   /** The actual bind. Always called through `start()`'s single-flight guard. */
   private async bind(port: number): Promise<number> {
+    const token = gatewayToken();
     const host: GatewayRouteHost = {
-      healthSnapshot: () => this.healthSnapshot(),
+      port: () => this.port,
+      token: () => token,
+      healthSnapshot: (full) => this.healthSnapshot(full),
       requestShutdown: () => {
         const handler = this.shutdownHandler;
         if (!handler) return false;
@@ -458,17 +462,21 @@ export class Gateway {
   /**
    * The /health body. Identity fields first — daemon discovery matches on
    * them to tell a Talon daemon from chat sessions and unrelated localhost
-   * services — then live counters.
+   * services — then, for an authenticated caller only, live counters.
    */
-  private healthSnapshot(): Record<string, unknown> {
+  private healthSnapshot(full: boolean): Record<string, unknown> {
     const w = getHealthStatus();
-    return {
+    const identity = {
       app: "talon",
       mode: this.mode,
       pid: process.pid,
       port: this.port,
       startedAt: this.startedAt,
       ok: w.healthy,
+    };
+    if (!full) return identity;
+    return {
+      ...identity,
       uptime: Math.round(process.uptime()),
       memory: Math.round(process.memoryUsage().heapUsed / 1024 / 1024),
       bridge: {