talon-agent 5.18.1 → 5.19.0

package/LICENSE

@@ -1,21 +1,202 @@
-MIT License
-
-Copyright (c) 2026 The Falconry
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/LICENSE-MIT

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 The Falconry
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/NOTICE

@@ -0,0 +1,16 @@
+Talon
+Copyright 2026 The Falconry
+
+This product is licensed under the Apache License, Version 2.0 (see LICENSE).
+
+Prior licensing
+---------------
+Every release up to and including v5.18.1 was published under the MIT
+License, preserved verbatim in LICENSE-MIT. That grant is irrevocable: anyone
+who received those versions keeps their MIT rights to them, and the
+contributions made under it remain available on those terms.
+
+The relicensing relies on the MIT License's own permission to sublicense, so
+the earlier contributions are redistributed here under Apache-2.0 with the
+original MIT notice retained. Contributions made from this release onward are
+licensed under Apache-2.0 per section 5 of that licence.

package/README.md

@@ -9,7 +9,7 @@
 [![TypeScript](https://img.shields.io/badge/TypeScript-7.0-3178C6?logo=typescript&logoColor=white)](https://www.typescriptlang.org/)
 [![Frontends](https://img.shields.io/badge/frontends-Telegram_%7C_WhatsApp_%7C_Discord_%7C_Teams_%7C_Terminal_%7C_App-25D366)](#frontends)
 [![Backends](https://img.shields.io/badge/backends-Claude_%7C_Kilo_%7C_OpenCode_%7C_Codex_%7C_Antigravity_%7C_OpenAI_Agents-D97706)](#backends)
-[![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
+[![License: Apache 2.0](https://img.shields.io/badge/license-Apache%202.0-blue.svg)](LICENSE)
 [![CI](https://github.com/thefalconry/talon/actions/workflows/ci.yml/badge.svg)](https://github.com/thefalconry/talon/actions/workflows/ci.yml)
 
 Multi-platform agentic AI harness. Runs on **Telegram**, **WhatsApp**, **Discord**, **Microsoft Teams**, the **Terminal**, and a **cross-platform Desktop/Mobile companion app** (Flutter), with a pluggable backend (**Claude Agent SDK**, **Kilo**, **OpenCode**, **Codex**, **Antigravity**, or **OpenAI Agents**) and full tool access through MCP.
@@ -203,7 +203,7 @@ The WhatsApp frontend drives a real WhatsApp account over Baileys multi-device
     // The bot account's own number, E.164 digits, no "+". Omit for QR pairing.
     "pairingNumber": "353871234567",
     // Who may DM it — bare numbers or full JIDs. Empty disables DMs.
-    "allowedJids": ["353834733284"],
+    "allowedJids": ["447700900102"],
     // Which groups it serves: "listed" | "with-allowed-user" | "all"
     "groupPolicy": "with-allowed-user",
     // In groups: reply only when mentioned/quoted, or to everything
@@ -487,6 +487,7 @@ Config file: `~/.talon/config.json`
 | `heartbeatIntervalMinutes` | `60`         | Heartbeat interval                                                                                                      |
 | `heartbeatModel`           | ---          | Model for the heartbeat agent (falls back to `model`)                                                                   |
 | `heartbeatEffort`          | ---          | Reasoning effort for the heartbeat agent: `off`, `minimal`, `low`, `medium`, `high`, `xhigh`, `max`. Unset = the model's own default |
+| `alerts`                   | on           | Operator alerts to the admin chat — full disk, crash, error spike, dead frontend — once per fault per cooldown, plus a recovery notice: `{ "enabled": true, "cooldownMinutes": 30 }`. Active alerts also show in `talon status` |
 | `router`                   | ---          | Plan-aware routing for background work: `{ "enabled": true, "ceilingPercent": 85 }`. Unpinned sub-agents, cron `query` jobs and heartbeats run on whichever backend has the most plan headroom, skipping any whose tightest window is at or above the ceiling. `enabled: false` restores inherit-the-caller's-backend ([Backends](docs/backends.md)) |
 | `backendBudgets`           | ---          | Soft token budgets for backends with no usage API, e.g. `{ "openai-agents": { "tokensPer5h": 2000000, "tokensPerDay": 8000000 } }`. Talon's own rolling ledger is measured against these so such a backend still has a headroom signal — and it is what opts an idle backend into routing. `agy` reports its real quota windows (via `agy -p /usage`); a budget there is only a fallback for when that read fails |
 | `dreamModel`               | ---          | Model for dream / memory consolidation (falls back to `model`)                                                          |
@@ -610,4 +611,8 @@ smoke-tests the CLI and the MCP supervisor from it.
 
 ## License
 
-MIT
+Apache License 2.0 — see [LICENSE](LICENSE).
+
+Releases up to and including v5.18.1 were published under the MIT License,
+kept at [LICENSE-MIT](LICENSE-MIT). That grant is irrevocable for those
+versions and still covers the contributions made under it — see [NOTICE](NOTICE).

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "talon-agent",
-  "version": "5.18.1",
+  "version": "5.19.0",
   "description": "Multi-frontend AI agent with full tool access, streaming, cron jobs, and plugin system",
   "author": "The Falconry",
-  "license": "MIT",
+  "license": "Apache-2.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/thefalconry/talon.git"
@@ -52,6 +52,8 @@
     "src/login.ts",
     "prompts/",
     "README.md",
+    "NOTICE",
+    "LICENSE-MIT",
     "tsconfig.json"
   ],
   "scripts": {

package/prompts/system/agent-brief.md

@@ -19,14 +19,31 @@ a useful result; silence is not.
 
 ## Talking to your parent
 
-- `check_inbox()` drains any instructions your parent has sent you. Check it
-  at natural milestones — after a phase of work, before a long operation, and
-  before you report. Messages are not delivered to you any other way.
+- `check_inbox()` drains anything sent to you — instructions from your parent
+  and notes from peers. Each message names its sender. Check it at natural
+  milestones: after a phase of work, before a long operation, and before you
+  report. Messages are not delivered to you any other way.
 - `message_parent(text)` sends an interim note (a finding worth acting on now,
   a question, a heads-up that this will take a while). Use it sparingly: each
   one wakes your parent. It does **not** end your run and does **not** count
   as your result.
 
+## Talking to your peers
+
+Your parent may have spawned others alongside you. `list_peers()` shows them —
+id, label, and what each was asked to do — and `message_peer(agent_id, text)`
+sends one of them a note directly, without going through your parent.
+
+Use it when something you found changes _their_ work and waiting would waste
+it: a fact you both need, a dead end worth not repeating, a correction to
+something you told them earlier. Don't narrate your progress at them — a peer
+pays for every message with context it could have spent on its own job.
+
+You can only address peers, and they see your note at their next
+`check_inbox`, so it is not an interrupt. Your report still goes to your
+parent: peer messages are for coordination, never a substitute for
+`report_result`.
+
 ## Delegating further
 
 {% if canSpawn %}You may spawn your own sub-agents with `spawn_agent` (current depth {{depth}}, cap {{maxDepth}}) when the work genuinely splits into independent pieces. You are then responsible for them: `wait_for_agent`, `send_to_agent`, `kill_agent`, and folding their reports into yours.{% else %}You are at the maximum sub-agent depth ({{maxDepth}}) — `spawn_agent` will be refused. Do this work yourself.{% endif %}

package/src/app.ts

@@ -42,6 +42,12 @@ import {
   handleUncaughtException,
   handleUnhandledRejection,
 } from "./core/daemon/crash.js";
+import { writeCrashMarker } from "./core/daemon/crash-marker.js";
+import {
+  announceLastCrash,
+  startHealthAlerts,
+  stopHealthAlerts,
+} from "./core/daemon/health-alerts.js";
 import { log, logError, logWarn } from "./util/log.js";
 import { bootPhase, bootReport } from "./core/daemon/boot-timer.js";
 import {
@@ -352,6 +358,7 @@ async function gracefulShutdown(signal: string): Promise<void> {
   await shutdownStep("sub-agents", shutdownAgents);
   await shutdownStep("watchdog", stopWatchdog);
   await shutdownStep("resource sampler", stopResourceSampler);
+  await shutdownStep("health alerts", stopHealthAlerts);
   await shutdownStep("upload cleanup", stopUploadCleanup);
   await shutdownStep("mcp hub", async () => {
     const { shutdownHub } = await import("./core/mcp-hub/index.js");
@@ -452,6 +459,11 @@ async function main(): Promise<void> {
       await import("./core/frontend-runtime/admin-notify.js");
     await notifyAdmin(restoreReport);
   }
+  // Same reasoning for a crash: the process that died couldn't say so,
+  // so the marker it left is announced now. The probes start here too —
+  // an alert raised before a frontend can carry it is wasted.
+  announceLastCrash();
+  startHealthAlerts();
 
   const bootMs = Math.round(process.uptime() * 1000);
   recordBootMetrics(bootMs);
@@ -465,6 +477,7 @@ async function main(): Promise<void> {
 
 main().catch((err) => {
   crashCleanup(crashHooks);
+  crashStep("crash marker", () => writeCrashMarker("startup", err));
   crashStep("startup report", () =>
     logError("bot", "Fatal startup error", err),
   );

package/src/backend/claude-sdk/handler.ts

@@ -83,10 +83,10 @@ import {
 // The SDK's PostToolBatch hook is the canonical loop-terminator — it returns
 // `{ continue: false }` after `end_turn`/`send`, and the SDK is supposed to
 // emit a `result` SDKMessage and close the async iterator immediately after.
-// In practice (observed 2026-05-19 14:52Z, chat 352042062, contextTokens=251464,
-// numApiCalls=50) the SDK can emit `result` and then ghost — the for-await loop
-// stays parked forever, holding the dispatcher context and the typing-indicator
-// pulse for hours until someone manually `/restart`s.
+// In practice (observed 2026-05-19 on a ~250k-token, 50-API-call turn) the
+// SDK can emit `result` and then ghost — the for-await loop stays parked
+// forever, holding the dispatcher context and the typing-indicator pulse for
+// hours until someone manually `/restart`s.
 //
 // Workaround: arm a short timer the moment `result` is processed. If the
 // iterator hasn't closed by the grace deadline, abort the controller and

package/src/backend/claude-sdk/mcp-ready.ts

@@ -35,9 +35,11 @@ export async function waitForMcpServersReady(
   while (Date.now() < deadline) {
     let statuses;
     try {
-      statuses = await qi.mcpServerStatus();
+      // Bound the call itself: a CLI that never answers the control
+      // request would otherwise park here past the deadline.
+      statuses = await beforeDeadline(qi.mcpServerStatus(), deadline);
     } catch {
-      return; // status query unsupported/failed — don't block the turn
+      return; // status query unsupported/failed/timed out — don't block the turn
     }
     // Best-effort: a backend (or stub) may report status in an unexpected
     // shape (undefined / non-array). Treat anything non-iterable as
@@ -52,3 +54,15 @@ export async function waitForMcpServersReady(
     await new Promise((resolve) => setTimeout(resolve, pollMs));
   }
 }
+
+/** `promise`, or a rejection once `deadline` (epoch ms) passes first. */
+function beforeDeadline<T>(promise: Promise<T>, deadline: number): Promise<T> {
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  const expired = new Promise<never>((_, reject) => {
+    timer = setTimeout(
+      () => reject(new Error("mcpServerStatus timed out")),
+      Math.max(0, deadline - Date.now()),
+    );
+  });
+  return Promise.race([promise, expired]).finally(() => clearTimeout(timer));
+}

package/src/backend/claude-sdk/stream.ts

@@ -2,8 +2,8 @@
  * Typed stream processing helpers for SDK messages.
  *
  * Each function operates on a properly narrowed SDK message type —
- * no Record<string, unknown> casts. The StreamState accumulator
- * replaces the scattered local variables from the original handler.
+ * no Record<string, unknown> casts. StreamState is the turn's single
+ * accumulator.
  */
 
 import type {

package/src/backend/codex/auth.ts

@@ -302,7 +302,7 @@ export function isChatGptModelMismatchError(message: string): boolean {
 
 /**
  * Detect the *silent* OAuth-incompat exit shape — the one that hit
- * Pandario on 2026-05-20 at 23:13Z.
+ * a group chat on 2026-05-20 at 23:13Z.
  *
  * On a free ChatGPT-OAuth credential the Codex CLI silently rejects
  * most model strings (only `gpt-5.5` is verified working). Crucially,

package/src/backend/codex/handler/message.ts

@@ -205,17 +205,6 @@ async function maybeFallbackForChatGptMismatch(
   return await handleMessage({ ...params, model: fallbackModel }, true);
 }
 
-// ── Model resolution ────────────────────────────────────────────────────────
-
-/**
- * Codex accepts arbitrary model strings; we pass through whatever the
- * caller resolved (chat-settings → config) and fall back to the auth-aware
- * default: `gpt-5-codex` when an API key is present, `gpt-5.5` when only
- * ChatGPT OAuth is configured (because `gpt-5-codex` is rejected with a
- * 400 on ChatGPT-mode accounts). A model known to be OAuth-incompat on a
- * ChatGPT-OAuth account is swapped pre-emptively rather than letting the
- * first turn fail.
- */
 /**
  * The turn's user prompt: the shared framing every backend emits, plus
  * whatever this turn's memory retrieval produced. `formatUserPrompt` is
@@ -233,6 +222,17 @@ function buildTurnPrompt(params: QueryParams): string {
   });
 }
 
+// ── Model resolution ────────────────────────────────────────────────────────
+
+/**
+ * Codex accepts arbitrary model strings; we pass through whatever the
+ * caller resolved (chat-settings → config) and fall back to the auth-aware
+ * default: `gpt-5-codex` when an API key is present, `gpt-5.5` when only
+ * ChatGPT OAuth is configured (because `gpt-5-codex` is rejected with a
+ * 400 on ChatGPT-mode accounts). A model known to be OAuth-incompat on a
+ * ChatGPT-OAuth account is swapped pre-emptively rather than letting the
+ * first turn fail.
+ */
 function resolveCodexModel(chatId: string, requested: string | undefined) {
   const authInfo = getCodexAuthInfo();
   const authAwareDefault =

package/src/backend/codex/init.ts

@@ -85,15 +85,10 @@ export function initCodexAgent(
   // credential fingerprint has changed since last load). The store is
   // a no-op for non-OAuth credentials but the loader is cheap, so we
   // call it for all modes uniformly.
-  // Fire-and-forget: the loader keeps its async signature (historical;
-  // kv reads are sync now) but `initCodexAgent` is sync and changing it
-  // to async would ripple through every caller in bootstrap.ts.
-  // The store is best-effort anyway — if a turn races with the
-  // first load, `isKnownOAuthIncompat` defaults to false and the
-  // turn proceeds without the runtime-learned filter (the curated
-  // list still applies). Errors are already swallowed inside
-  // `loadOAuthIncompatStore`, so the .catch() here is purely
-  // defensive against a synchronous throw in the function body.
+  // Fire-and-forget: `initCodexAgent` is sync. The store is best-effort —
+  // a turn that races the first load runs without the runtime-learned
+  // filter (the curated list still applies). The loader swallows its own
+  // errors; the .catch() only guards a throw in its body.
   loadOAuthIncompatStore(computeAuthFingerprint(authInfo)).catch(() => {
     /* logged inside loadOAuthIncompatStore */
   });

package/src/backend/codex/mcp-config.ts

@@ -12,8 +12,7 @@
  * hub (`core/mcp-hub`) — Codex connects with `mcp_servers.<name>.url`
  * (the same transport `codex mcp add --url` configures). The hub hosts
  * Talon's tools in-process and shares plugin/brave children across
- * chats, so Codex no longer spawns a subprocess pair per server per
- * turn:
+ * chats, so Codex spawns no MCP subprocesses of its own:
  *
  *   {
  *     mcp_servers: {

package/src/backend/codex/oauth-incompat.ts

@@ -75,6 +75,7 @@
  *     stay synchronous (they only touch the in-memory set).
  */
 
+import { scryptSync } from "node:crypto";
 import { logDebug } from "../../util/log.js";
 import { files } from "../../util/paths.js";
 import { kvGet, kvSet } from "../../storage/kv.js";
@@ -118,7 +119,7 @@ let memoryStore: InMemoryStore | null = null;
  *
  * Fingerprint shape:
  *   - `mode:source` for ChatGPT OAuth (no token to hash)
- *   - `mode:source:<first 16 chars of key>` for api-key billing
+ *   - `mode:source:<scrypt(key), 16 hex>` for api-key billing
  *   - `mode:source` for missing/empty
  *
  * Constant-folded by `mode === "none"` — no learning happens without
@@ -127,9 +128,12 @@ let memoryStore: InMemoryStore | null = null;
 export function computeAuthFingerprint(info: CodexAuthInfo): string {
   const base = `${info.mode}:${info.source}`;
   if (info.mode === "api-key" && info.apiKey) {
-    // First 16 chars is enough to distinguish keys for fingerprint
-    // purposes without storing the full secret on disk.
-    return `${base}:${info.apiKey.slice(0, 16)}`;
+    // A digest, never key material: the fingerprint is persisted in kv
+    // and appears in debug logs.
+    // scrypt, not a bare hash: the input is a credential. Computed once
+    // per codex init.
+    const digest = scryptSync(info.apiKey, "talon.codex.fingerprint", 8);
+    return `${base}:${digest.toString("hex")}`;
   }
   return base;
 }

package/src/backend/codex/one-shot.ts

@@ -40,7 +40,7 @@ import { toCodexReasoningEffort } from "./effort.js";
  * `config.heartbeatModel ?? config.model`. If that's an OAuth-incompat
  * id (curated `apiKeyOnly: true` or runtime-learned) AND the active
  * Codex credential is ChatGPT OAuth, swap to `gpt-5.5` to avoid the
- * silent exit-1 failure mode that hit Pandario on 2026-05-20 23:13Z.
+ * silent exit-1 failure mode that hit a group chat on 2026-05-20 23:13Z.
  *
  * Returns the resolved model id, whether a swap occurred, and an
  * optional reason string for the run log.