talon-agent 5.20.1 → 5.22.0

package/src/core/mesh/transfers/transfers.ts

@@ -12,15 +12,21 @@
  *     daemon → device (command): upload_file { token, path }
  *     device → daemon (HTTP):    POST /devices/file?transfer=token  (raw body)
  *     bridge route:              acceptUpload(token, stream) → tmp+rename
- *     device → daemon (command result): ok + bytes — the command round trip
- *     doubles as the completion signal.
+ *     device → daemon (command result): ok + bytes + sha256 — the command
+ *     round trip doubles as the completion signal, and the daemon checks the
+ *     device's digest against the one it computed while receiving.
  *
  *   push (daemon → device):
  *     daemon: token = createPush(deviceId, sourcePath)
- *     daemon → device (command): download_file { token, path }
+ *     daemon → device (command): download_file { token, path, sha256 }
  *     device → daemon (HTTP):    GET /devices/file?transfer=token
  *     bridge route:              openDownload(token) → stream the source
- *     device writes to its path, answers the command with ok + bytes.
+ *     device hashes while writing its temp file, refuses to rename it into
+ *     place on a digest mismatch, and answers with ok + bytes + sha256.
+ *
+ * The digests are additive: a device build that predates them ignores the
+ * push param and omits the pull result key, and the daemon then skips the
+ * check.
  *
  * Tokens are single-use, bound to one device + one path, and expire unused.
  * The registry never trusts the HTTP caller with a path — the token IS the
@@ -30,7 +36,7 @@
  * itself must name the device the token was minted for (see take()).
  */
 
-import { randomBytes } from "node:crypto";
+import { createHash, randomBytes } from "node:crypto";
 import { createWriteStream } from "node:fs";
 import { mkdir, rename, rm, stat } from "node:fs/promises";
 import { dirname } from "node:path";
@@ -40,6 +46,10 @@ import type { Readable } from "node:stream";
 /** Unused tokens die after this long (transfer not started). */
 const TOKEN_TTL_MS = 10 * 60 * 1000;
 
+/** What a finished pull delivered: its size and the SHA-256 (hex) of the
+ *  bytes as they arrived, hashed in stream. */
+export type PullReceipt = { bytes: number; sha256: string };
+
 type Transfer = {
   token: string;
   direction: "pull" | "push";
@@ -49,10 +59,10 @@ type Transfer = {
   createdAt: number;
   /** Set once the HTTP leg has started (single-use latch). */
   consumed: boolean;
-  /** pull only — resolved by acceptUpload with the byte count. */
+  /** pull only — resolved by acceptUpload with what arrived. */
   uploadDone?: {
-    promise: Promise<number>;
-    resolve: (bytes: number) => void;
+    promise: Promise<PullReceipt>;
+    resolve: (receipt: PullReceipt) => void;
     reject: (err: Error) => void;
   };
   /** pull only — tears down the upload once its HTTP leg is streaming. */
@@ -63,16 +73,17 @@ export class TransferStore {
   private readonly transfers = new Map<string, Transfer>();
 
   /** Arrange a device→daemon transfer. Returns the token to send to the
-   *  device and a promise that resolves (bytes) when the upload lands. */
+   *  device and a promise that resolves (bytes + digest) when the upload
+   *  lands. */
   createPull(
     deviceId: string,
     destPath: string,
-  ): { token: string; done: Promise<number> } {
+  ): { token: string; done: Promise<PullReceipt> } {
     this.sweep();
     const token = randomBytes(24).toString("base64url");
-    let resolve!: (bytes: number) => void;
+    let resolve!: (receipt: PullReceipt) => void;
     let reject!: (err: Error) => void;
-    const promise = new Promise<number>((res, rej) => {
+    const promise = new Promise<PullReceipt>((res, rej) => {
       resolve = res;
       reject = rej;
     });
@@ -125,7 +136,8 @@ export class TransferStore {
   /**
    * Bridge route: a device is streaming a pull's file body up. Writes to a
    * temp file and renames into place, so a dropped connection can't leave a
-   * half-written destination. Resolves the pull's `done` promise.
+   * half-written destination. Resolves the pull's `done` promise with the
+   * SHA-256 of the bytes, hashed as they stream through (no second read).
    *
    * `fromDeviceId` is the device the HTTP caller says it is (see take()).
    */
@@ -143,14 +155,18 @@ export class TransferStore {
     try {
       await mkdir(dirname(t.localPath), { recursive: true });
       let bytes = 0;
-      body.on("data", (d: Buffer) => (bytes += d.length));
+      const hash = createHash("sha256");
+      body.on("data", (d: Buffer) => {
+        bytes += d.length;
+        hash.update(d);
+      });
       await pipeline(body, createWriteStream(tmp, { mode: 0o600 }), {
         signal: abort.signal,
       });
       abort.signal.throwIfAborted();
       await rename(tmp, t.localPath);
       this.transfers.delete(token);
-      t.uploadDone?.resolve(bytes);
+      t.uploadDone?.resolve({ bytes, sha256: hash.digest("hex") });
       return { ok: true, bytes };
     } catch (err) {
       await rm(tmp, { force: true }).catch(() => {});

package/src/core/tools/ops/mesh.ts

@@ -181,6 +181,12 @@ export const meshTools: ToolDefinition[] = [
         .describe(
           "Where to stage the APK on the device (default /sdcard/Download/talon-companion-update.apk).",
         ),
+      allow_downgrade: z
+        .boolean()
+        .optional()
+        .describe(
+          "Install even when the APK has a lower versionCode (pm install -d), for a deliberate rollback.",
+        ),
     },
     execute: (params, bridge) => bridge("update_device", params),
     tag: "mesh",
@@ -203,6 +209,12 @@ export const meshTools: ToolDefinition[] = [
         .describe(
           "Where to stage the binary on the node (default /tmp/talon-node.update; the node re-stages next to its own executable before the atomic swap).",
         ),
+      allow_downgrade: z
+        .boolean()
+        .optional()
+        .describe(
+          "Install even when the binary is an older version, or the exact build already running. The node refuses both without it.",
+        ),
     },
     execute: (params, bridge) => bridge("update_node", params),
     tag: "mesh",
@@ -223,12 +235,20 @@ export const meshTools: ToolDefinition[] = [
   {
     name: "make_node_install_link",
     description:
-      "Mint a single-use install link served by this daemon's bridge and return the one command that attaches a fresh Linux/macOS/Windows host to the mesh as a headless talon-node. Running it on the host downloads the installer script and binary from the bridge (sha256-verified), installs talon-node, pre-pins the bridge TLS certificate, embeds the bearer token, and registers a boot service — no toolchain, package manager, or manual config on the host. The link expires in 30 minutes and each leg serves exactly once; the host only needs to reach the bridge URL. Requires the native bridge running on a non-loopback bind with a token.",
+      "Mint a single-use install link served by this daemon's bridge and return the one command that attaches a fresh Linux/macOS/Windows host to the mesh as a headless talon-node. Running it on the host downloads the installer script and binary from the bridge (sha256-verified), installs talon-node, pre-pins the bridge TLS certificate, embeds the bearer token, and registers a boot service — no toolchain, package manager, or manual config on the host. Omit os and arch when you don't know the host: you get a POSIX and a PowerShell command, and whichever runs reports its own platform so the bridge picks the right binary. The link expires in 30 minutes and each leg serves exactly once; the host only needs to reach the bridge URL. Requires the native bridge running on a non-loopback bind with a token.",
     schema: {
-      os: z.string().describe("Host OS: linux, macos/darwin, or windows."),
+      os: z
+        .string()
+        .optional()
+        .describe(
+          "Host OS: linux, macos/darwin, or windows. Omit (with arch) to auto-detect on the host.",
+        ),
       arch: z
         .string()
-        .describe("Host arch: amd64/x86_64, arm64/aarch64, or arm."),
+        .optional()
+        .describe(
+          "Host arch: amd64/x86_64, arm64/aarch64, or arm. Omit (with os) to auto-detect on the host.",
+        ),
       name: z
         .string()
         .optional()
@@ -239,7 +259,7 @@ export const meshTools: ToolDefinition[] = [
         .string()
         .optional()
         .describe(
-          "Bridge base URL as reachable FROM the new host (e.g. https://100.64.0.7:19880). Default: derived from the bridge bind (wildcard binds use this host's first external IPv4).",
+          "Bridge base URL as reachable FROM the new host (e.g. https://100.64.0.7:19880). Default: native.publicUrl when set, else derived from the bridge bind (wildcard binds use this host's first external IPv4).",
         ),
     },
     execute: (params, bridge) => bridge("make_node_install_link", params),

package/src/core/weaver/weaver.ts

@@ -99,7 +99,10 @@ export class Weaver {
     const lifecycle = { started: false, killed: false, enqueuedAt: Date.now() };
     // The turn id is minted at enqueue so a queued turn's wait is already
     // attributable; the log scope goes live when the turn starts running.
-    const scope = createTurnScope(params.chatId);
+    const scope = createTurnScope(params.chatId, {
+      sender: params.senderKeys?.[0] ?? (params.senderName || undefined),
+      source: params.source,
+    });
     const trace = createTurnTrace(scope.turnId, params, thread.inFlightCount);
     // Registered before enqueueing so a turn waiting in its chat's FIFO is
     // visible as `queued` in the task table, not invisible until it runs.

package/src/frontend/native/bridge/credentials/upgrade.ts

@@ -6,8 +6,9 @@
  *   shared token → a per-device credential bound to the device id in the
  *     body (the migration path off `native.token`). Scopes are what the
  *     client asks for, capped by policy: a node gets `device`; a companion
- *     at most `native.companionScopes` (default device + client). Operator
- *     is never granted in-band unless the operator put it in that list.
+ *     at most `native.companionScopes` (default: all three, as the shared
+ *     token it is trading carried). A companion that asks for `client`
+ *     also gets `operator` whenever that list allows it.
  *
  *   per-device credential → a replacement with the same device and scopes
  *     (rotation, when the operator asked for it or the client wants one).
@@ -48,7 +49,19 @@ function grantFor(
   const ceiling: readonly BridgeScope[] =
     client === "node" ? ["device"] : credentials.policy.companionScopes;
   if (asked.length === 0) return [...ceiling];
-  return asked.filter((s) => ceiling.includes(s));
+  const granted = asked.filter((s) => ceiling.includes(s));
+  // Shipped companions ask for device + client: the list predates operator
+  // being part of the default. The companion is the full UI (settings,
+  // extensions), so it gets operator whenever the policy allows it.
+  if (
+    client !== "node" &&
+    granted.includes("client") &&
+    ceiling.includes("operator") &&
+    !granted.includes("operator")
+  ) {
+    granted.push("operator");
+  }
+  return granted;
 }
 
 export async function upgradeCredential(

package/src/frontend/native/bridge/routes/host.ts

@@ -149,8 +149,18 @@ export type BridgeServerHandlers = {
     token: string,
     format: "html" | "json",
   ): { contentType: string; body: string } | null;
-  /** Resolve a node-provisioning token to its installer script, or null. */
-  openNodeInstall(token: string): { script: string; filename: string } | null;
+  /**
+   * Resolve a node-provisioning token to its installer script, or null. An
+   * auto link passes the os/arch its host reported.
+   */
+  openNodeInstall(
+    token: string,
+    os?: string | null,
+    arch?: string | null,
+  ):
+    | { script: string; filename: string }
+    | null
+    | Promise<{ script: string; filename: string } | null>;
   /** Resolve a node-provisioning token to the binary to stream, or null. */
   openNodeBinary(token: string): { path: string; size: number } | null;
 };

package/src/frontend/native/bridge/routes/pre-auth.ts

@@ -73,9 +73,15 @@ export function preAuthRoutes(
     // the single-use grant token (minted by make_node_install_link,
     // expiring, one serve per leg) is the entire authorization, the same
     // trust model as streamed-transfer tokens.
-    "GET /node/install": ({ res, url }) => {
+    "GET /node/install": async ({ res, url }) => {
       const token = url.searchParams.get("provision") ?? "";
-      const install = token ? h.openNodeInstall(token) : null;
+      const install = token
+        ? await h.openNodeInstall(
+            token,
+            url.searchParams.get("os"),
+            url.searchParams.get("arch"),
+          )
+        : null;
       if (!install) return host.unknownProvision(res);
       res.writeHead(200, {
         "Content-Type": "text/plain; charset=utf-8",

package/src/frontend/native/bridge/server.ts

@@ -31,6 +31,7 @@ import {
 } from "../../../core/frontend-runtime/alerts.js";
 import { errorText } from "../../health/outage.js";
 import {
+  certificateSpkiPin,
   formatFingerprint,
   isLoopbackHost,
   type BridgeTlsIdentity,
@@ -196,6 +197,13 @@ export class BridgeServer {
     return this.tlsIdentity?.fingerprint ?? null;
   }
 
+  /** The served key's SPKI pin (base64 SHA-256), or null over HTTP. */
+  getSpkiPin(): string | null {
+    return this.tlsIdentity
+      ? certificateSpkiPin(this.tlsIdentity.certPem)
+      : null;
+  }
+
   /**
    * Push an event to every connected SSE client that may see it. Chat
    * traffic is for `client`-scoped sessions only; a device-only credential

package/src/frontend/native/bridge/tls.ts

@@ -228,6 +228,21 @@ export function certificateFingerprint(certPem: string): string {
     .digest("hex");
 }
 
+/**
+ * The certificate's public-key pin: base64 SHA-256 of its DER
+ * SubjectPublicKeyInfo — the value curl's `--pinnedpubkey sha256//…` checks.
+ */
+export function certificateSpkiPin(certPem: string): string {
+  return createHash("sha256")
+    .update(
+      new X509Certificate(certPem).publicKey.export({
+        type: "spki",
+        format: "der",
+      }),
+    )
+    .digest("base64");
+}
+
 /** AA:BB:… presentation of a fingerprint, for logs and pairing screens. */
 export function formatFingerprint(fingerprint: string): string {
   return (fingerprint.match(/.{2}/g) ?? []).join(":").toUpperCase();

package/src/frontend/native/index.ts

@@ -33,6 +33,7 @@ import { createNativeRuntime, type NativeRuntime } from "./runtime.js";
 import { BridgeServer, type BridgeCredentials } from "./bridge/server.js";
 import {
   DEFAULT_COMPANION_SCOPES,
+  FORMER_COMPANION_SCOPES,
   type MeshScope,
 } from "../../core/mesh/credentials/index.js";
 import { isLoopbackHost, loadOrCreateBridgeTlsIdentity } from "./bridge/tls.js";
@@ -106,6 +107,28 @@ function bridgeCredentials(
   };
 }
 
+/**
+ * Companions paired while the default was device + client get the current
+ * default too — unless the operator set `native.companionScopes` (their
+ * choice then stands) or set that device's scopes by hand.
+ */
+async function adoptCompanionDefault(
+  config: TalonConfig,
+  mesh: NativeRuntime["mesh"],
+): Promise<void> {
+  if (config.native?.companionScopes || !mesh.credentials) return;
+  const moved = await mesh.credentials.adoptDefaultScopes(
+    FORMER_COMPANION_SCOPES,
+    DEFAULT_COMPANION_SCOPES,
+  );
+  if (moved > 0) {
+    log(
+      "native",
+      `Granted the default companion scopes (${DEFAULT_COMPANION_SCOPES.join(", ")}) to ${moved} credential(s) issued under the old device + client default; set native.companionScopes to narrow them.`,
+    );
+  }
+}
+
 /**
  * Plug this bridge in as the mesh's transport: locates and device commands
  * (from ANY frontend's mesh tool calls) leave as SSE events.
@@ -189,6 +212,7 @@ export function createNativeFrontend(
 
     async init() {
       await mesh.load();
+      await adoptCompanionDefault(config, mesh);
       unregisterMeshTransport = registerMeshTransport(runtime, server);
       // Mesh tool actions (list_devices / get_device_location) are shared
       // gateway actions — no native-only cases here.
@@ -226,6 +250,7 @@ export function createNativeFrontend(
         );
       }
       const fingerprint = server.getFingerprint();
+      const spkiPin = server.getSpkiPin();
       // Tell the mesh how this bridge is reachable — everything a generated
       // node installer needs (make_node_install_link fails cleanly without it).
       mesh.setBridgeInfo({
@@ -234,6 +259,7 @@ export function createNativeFrontend(
         port: server.getPort(),
         ...(listen.token ? { token: listen.token } : {}),
         ...(fingerprint ? { fingerprint } : {}),
+        ...(spkiPin ? { spkiPin } : {}),
         ...(config.native?.publicUrl
           ? { publicUrl: config.native.publicUrl }
           : {}),

package/src/frontend/native/surface/handlers.ts

@@ -191,7 +191,7 @@ export function buildBridgeHandlers(
     openFileDownload: (token, fromDeviceId) =>
       mesh.openFileDownload(token, fromDeviceId),
     openCompanionPair: (token, format) => mesh.openCompanionPair(token, format),
-    openNodeInstall: (token) => mesh.openNodeInstall(token),
+    openNodeInstall: (token, os, arch) => mesh.openNodeInstall(token, os, arch),
     openNodeBinary: (token) => mesh.openNodeBinary(token),
   };
 }

package/src/util/logging/turn-scope.ts

@@ -24,9 +24,18 @@
 import { AsyncLocalStorage } from "node:async_hooks";
 import { randomBytes } from "node:crypto";
 
+/** Who a turn acts for — recorded by audits of what the turn did. */
+export type TurnIssuer = {
+  /** The sender's operator key, else display name; absent when unknown. */
+  readonly sender?: string;
+  /** What started the turn: message, cron, trigger, pulse, agent. */
+  readonly source?: string;
+};
+
 export type TurnLogScope = {
   readonly turnId: string;
   readonly chatId: string;
+  readonly issuer: TurnIssuer;
   /** False once the turn has settled — the scope then tags nothing. */
   open: boolean;
 };
@@ -41,8 +50,11 @@ function mintTurnId(): string {
 }
 
 /** A fresh scope for a turn that has been accepted but not yet started. */
-export function createTurnScope(chatId: string): TurnLogScope {
-  return { turnId: mintTurnId(), chatId, open: true };
+export function createTurnScope(
+  chatId: string,
+  issuer: TurnIssuer = {},
+): TurnLogScope {
+  return { turnId: mintTurnId(), chatId, issuer, open: true };
 }
 
 /**
@@ -83,3 +95,12 @@ export function currentTurnId(): string | undefined {
   const scope = storage.getStore();
   return scope?.open ? scope.turnId : undefined;
 }
+
+/** The live turn for the current async chain — who is acting — if any. */
+export function currentTurn():
+  { turnId: string; chatId: string; issuer: TurnIssuer } | undefined {
+  const scope = storage.getStore();
+  return scope?.open
+    ? { turnId: scope.turnId, chatId: scope.chatId, issuer: scope.issuer }
+    : undefined;
+}