talon-agent 5.25.1 → 5.26.0

package/src/frontend/discord/commands/backup.ts

@@ -1,8 +1,9 @@
 /**
  * /backup — snapshots and checkpoints (admin only), the Discord half.
  *
- * Same surface as Telegram's /backup: status, now, checkpoint, list,
- * pin/unpin, restore. Restore is behind a button (`backup:restore:<id>`)
+ * Same surface as Telegram's /backup: the panel (bare `/backup` — status
+ * with Back up now / Snapshots / How restore works / Refresh buttons, see
+ * backup-panel.ts), now, checkpoint, list, pin/unpin, restore. Restore is behind a button (`backup:restore:<id>`)
  * because it replaces the database, memory and identity of a running
  * agent — and even then it does not restore in place: the request is
  * staged to ~/.talon/restore-pending.json and applied by the next boot,
@@ -21,16 +22,23 @@ import {
   type ChatInputCommandInteraction,
 } from "discord.js";
 import {
-  collectBackupStatus,
-  formatBackupStatus,
   formatSnapshotList,
   isSnapshotId,
   listSnapshots,
   readManifest,
-  runBackup,
   setSnapshotPinned,
   writeRestorePending,
 } from "../../../core/backup/index.js";
+import {
+  parseBackupAction,
+  renderRestoreConfirm,
+} from "../../presentation/backup-panel.js";
+import { DISCORD_REPORTS } from "../render.js";
+import {
+  handleBackupPanelAction,
+  replyWithPanel,
+  runSnapshotLine,
+} from "./backup-panel.js";
 import { respawnSelf } from "../../../core/daemon/respawn.js";
 import { logError } from "../../../util/log.js";
 import { escapeForCodeBlock } from "../formatting.js";
@@ -60,24 +68,7 @@ async function takeSnapshot(
   label?: string,
 ): Promise<void> {
   await i.deferReply({ flags: MessageFlags.Ephemeral });
-  try {
-    const manifest = await runBackup({
-      kind: label ? "checkpoint" : "backup",
-      label,
-      pinned: Boolean(label),
-      trigger: "command",
-    });
-    await i.editReply(
-      `✅ \`${manifest.id}\` — ${manifest.parts.length} part(s), ` +
-        `${(manifest.sizeBytes / 1024 / 1024).toFixed(1)} MB` +
-        (label ? " (pinned)" : ""),
-    );
-  } catch (err) {
-    logError("backup", "/backup now failed", err);
-    await i.editReply(
-      `⚠️ Backup failed: ${err instanceof Error ? err.message : String(err)}`,
-    );
-  }
+  await i.editReply(await runSnapshotLine(label));
 }
 
 async function askToRestore(
@@ -94,12 +85,7 @@ async function askToRestore(
     return;
   }
   await i.reply({
-    content:
-      `♻️ **Restore \`${id}\`?**\n` +
-      (manifest.label ? `“${manifest.label}”\n` : "") +
-      `Taken ${new Date(manifest.createdAt).toISOString()}\n\n` +
-      "This replaces config, prompts, keys, sessions, the database and memory, " +
-      "then restarts. A pinned checkpoint of the current state is taken first.",
+    content: renderRestoreConfirm(DISCORD_REPORTS, manifest),
     components: [confirmRow(id).toJSON()],
     flags: MessageFlags.Ephemeral,
   });
@@ -149,11 +135,7 @@ export async function handleBackup(
       await askToRestore(i, argument);
       return;
     default:
-      await reply(
-        i,
-        block(formatBackupStatus(await collectBackupStatus())),
-        true,
-      );
+      await replyWithPanel(i);
   }
 }
 
@@ -174,6 +156,15 @@ export async function handleBackupComponent(
     await interaction.update({ content: "Restore cancelled.", components: [] });
     return true;
   }
+  const panelAction = parseBackupAction(interaction.customId);
+  if (
+    panelAction &&
+    panelAction.kind !== "restore" &&
+    panelAction.kind !== "cancel"
+  ) {
+    await handleBackupPanelAction(interaction, panelAction);
+    return true;
+  }
   if (action !== "restore" || !id || !isSnapshotId(id)) return false;
   await interaction.update({
     content:

package/src/frontend/discord/commands/info.ts

@@ -6,6 +6,7 @@ import {
   type ChatInputCommandInteraction,
   type Client,
   MessageFlags,
+  Status,
 } from "discord.js";
 import {
   formatDuration,
@@ -111,12 +112,23 @@ export async function handlePing(
   const start = Date.now();
   await i.deferReply({ flags: MessageFlags.Ephemeral });
   const apiLatency = Date.now() - start;
-  // client.ws.ping is the WebSocket heartbeat RTT (the real gateway latency).
-  const wsPing = i.client.ws.ping;
+  await i.editReply(renderPingReply(i.client.ws, apiLatency));
+}
+
+/**
+ * The /ping body. `ws.ping` is the gateway heartbeat RTT (-1 until the
+ * first heartbeat is acknowledged); `ws.status` is the live connection
+ * state, reported by name when it isn't Ready.
+ */
+export function renderPingReply(
+  ws: { ping: number; status: Status },
+  restLatencyMs: number,
+): string {
+  const wsPing = ws.ping >= 0 ? `${Math.round(ws.ping)}ms` : "n/a";
+  const gateway =
+    ws.status === Status.Ready ? "✓" : `✗ (${Status[ws.status] ?? ws.status})`;
   const uptime = formatDuration(process.uptime() * 1000);
-  await i.editReply(
-    `Pong! WS: ${wsPing}ms · REST: ${apiLatency}ms\nGateway: ✓ | Uptime: ${uptime}`,
-  );
+  return `Pong! WS: ${wsPing} · REST: ${restLatencyMs}ms\nGateway: ${gateway} | Uptime: ${uptime}`;
 }
 
 export async function handlePlugins(

package/src/frontend/discord/commands/settings.ts

@@ -169,6 +169,18 @@ export async function handleEffort(
     config,
   });
 
+  // Reset first: adaptive needs no model levels, so it must stay
+  // reachable on a model that registers none.
+  if (level === "adaptive" || level === "reset" || level === "default") {
+    setChatEffort(chatId, undefined);
+    await reply(
+      i,
+      "Effort reset to **adaptive** (model decides when to think)",
+      true,
+    );
+    return;
+  }
+
   if (reasoning.levels.length === 0) {
     await reply(
       i,
@@ -202,15 +214,6 @@ export async function handleEffort(
     return;
   }
 
-  if (level === "adaptive") {
-    setChatEffort(chatId, undefined);
-    await reply(
-      i,
-      "Effort reset to **adaptive** (model decides when to think)",
-      true,
-    );
-    return;
-  }
   if (supportsReasoningLevel(level, reasoning.levels)) {
     setChatEffort(chatId, level as EffortLevel);
     await reply(i, `Effort set to **${level}**`, true);

package/src/frontend/discord/render.ts

@@ -46,7 +46,7 @@ export {
 const DEFAULT_METRICS_MESSAGE_MAX = DISCORD_MAX_TEXT - DISCORD_SAFE_RESERVE;
 
 /** Discord markdown: bold/italic/code markers, no escaping, 2000-char messages. */
-const DISCORD_REPORTS: ReportFormatter = {
+export const DISCORD_REPORTS: ReportFormatter = {
   bold: (s) => `**${s}**`,
   italic: (s) => `_${s}_`,
   emphasis: (s) => `*${s}*`,

package/src/frontend/native/bridge/credentials/claims.ts

@@ -5,7 +5,8 @@
  * `id` on /devices/register, `deviceId` on /location and
  * /devices/command-result. A per-device credential may only ever name its
  * own device; an unbound pairing/installer credential is bound by the first
- * id it names (and refused one another credential already holds). The
+ * id it names — re-pairing (revoking) a device that already holds one when
+ * the store allows it, see DeviceCredentialStore.bind. The
  * shared token and an open bridge name whatever they like — that is the
  * legacy trust model — but a remote shared-token claim is recorded so the
  * operator can see which devices still need upgrading.
@@ -44,10 +45,9 @@ export function claimDevice(
   const bind = credentials?.authority.bind(principal.credentialId, claimed);
   if (!bind || !bind.ok) {
     const error = bind?.error ?? "Credential cannot be bound";
-    // The companion only sees a 403; without this line a pairing that
-    // authenticated fine but could not bind (typically: the device kept its
-    // id through a reinstall/wipe and its old credential is still live)
-    // leaves no trace on the daemon side.
+    // Callers answer 403 with this error (never 401: the token itself is
+    // fine). Without this line a pairing that authenticated but could not
+    // bind leaves no trace on the daemon side.
     logWarn(
       "native",
       `bridge.auth event=bind_refused credential=${principal.credentialId} device=${claimed}: ${error}`,

package/src/frontend/native/bridge/routes/chats.ts

@@ -1,5 +1,6 @@
 import type { RouteHost } from "./host.js";
 import { claimDevice } from "../credentials/claims.js";
+import { hasScope } from "../credentials/principal.js";
 import type { BridgeRoutes, RouteContext } from "./table.js";
 import {
   asAttachmentRefs,
@@ -26,6 +27,41 @@ function openEvents(host: RouteHost, ctx: RouteContext): void {
   host.openStream(res, claim.deviceId, principal);
 }
 
+/**
+ * POST /send. Text naming one of the daemon's slash commands is answered
+ * by the daemon; the operator-only ones need the same scope as
+ * POST /control, so the caller's scope rides along.
+ */
+async function postSend(host: RouteHost, ctx: RouteContext): Promise<void> {
+  const { req, res, principal } = ctx;
+  const body = await host.readJson(req);
+  const id = asString(body.chatId) ?? "";
+  const text = asString(body.text) ?? "";
+  // Multi-file clients send `attachments`; the single-image shape older
+  // clients send is folded into the same list by the handler.
+  const attachments = asAttachmentRefs(body.attachments);
+  const imagePath = asString(body.imagePath);
+  const attachmentPath = asString(body.attachmentPath);
+  const hasAttachment =
+    attachments.length > 0 || Boolean(attachmentPath || imagePath);
+  // Text may be empty when a file is attached; require one or the other.
+  if (!id || (!text.trim() && !hasAttachment)) {
+    host.json(res, 400, {
+      ok: false,
+      error: "chatId and text (or an attachment) required",
+    });
+    return;
+  }
+  const operator = principal !== null && hasScope(principal, "operator");
+  host.handlers.send(
+    id,
+    text,
+    { attachments, imagePath, attachmentPath },
+    { operator },
+  );
+  host.json(res, 202, { ok: true });
+}
+
 export function chatRoutes(
   host: RouteHost,
 ): Pick<
@@ -42,6 +78,7 @@ export function chatRoutes(
   | "GET /history"
   | "GET /search"
   | "POST /send"
+  | "GET /commands"
   | "POST /upload"
   | "GET /media"
 > {
@@ -105,26 +142,9 @@ export function chatRoutes(
       const chatId = url.searchParams.get("chatId") ?? undefined;
       json(res, 200, { results: h.search(q, chatId) });
     },
-    "POST /send": async ({ req, res }) => {
-      const body = await readJson(req);
-      const id = asString(body.chatId) ?? "";
-      const text = asString(body.text) ?? "";
-      // Multi-file clients send `attachments`; the single-image shape older
-      // clients send is folded into the same list by the handler.
-      const attachments = asAttachmentRefs(body.attachments);
-      const imagePath = asString(body.imagePath);
-      const attachmentPath = asString(body.attachmentPath);
-      const hasAttachment =
-        attachments.length > 0 || Boolean(attachmentPath || imagePath);
-      // Text may be empty when a file is attached; require one or the other.
-      if (!id || (!text.trim() && !hasAttachment))
-        return json(res, 400, {
-          ok: false,
-          error: "chatId and text (or an attachment) required",
-        });
-      h.send(id, text, { attachments, imagePath, attachmentPath });
-      json(res, 202, { ok: true });
-    },
+    "POST /send": (ctx) => postSend(host, ctx),
+    "GET /commands": ({ res }) =>
+      json(res, 200, { commands: h.listCommands() }),
     "POST /upload": async ({ req, res, url }) => {
       const filename = url.searchParams.get("filename") ?? "upload";
       const contentType =

package/src/frontend/native/bridge/routes/host.ts

@@ -11,6 +11,7 @@ import type {
   BridgeEvent,
   BridgeStatus,
   ClientChat,
+  ClientCommand,
   ClientMessage,
   DeviceInfo,
   DeviceLocation,
@@ -64,8 +65,18 @@ export type BridgeServerHandlers = {
   listMemory(query: MemoryListQuery): MemoryListResult;
   /** One memory row plus its audit trail, or null when no such id. */
   memoryWhy(id: number): MemoryWhyWire | null;
-  /** Fire-and-forget: streams its results back through `broadcast`. */
-  send(id: string, text: string, opts?: SendOptions): void;
+  /**
+   * Fire-and-forget: streams its results back through `broadcast`. Text
+   * naming one of the daemon's slash commands is answered by the daemon
+   * instead of the model; `caller` says whether the credential may run
+   * the operator-only ones (absent = it may not).
+   */
+  send(
+    id: string,
+    text: string,
+    opts?: SendOptions,
+    caller?: { operator: boolean },
+  ): void;
   /**
    * Stream an uploaded file to disk and return its wire description. The body
    * is consumed as it arrives (never buffered whole), so the size ceiling is
@@ -112,6 +123,8 @@ export type BridgeServerHandlers = {
   setSkillEnabled(name: string, enabled: boolean): ToggleResult;
   /** Fire a daemon-level control action (e.g. "restart", "dream"). */
   control(action: string): Promise<{ ok: boolean; message: string }>;
+  /** The slash commands `/send` answers itself, for client autocomplete. */
+  listCommands(): ClientCommand[];
   /** Newest daemon log entries (for the client's log viewer). */
   logs(opts: {
     lines: number;

package/src/frontend/native/bridge/routes/table.ts

@@ -67,6 +67,10 @@ export const BRIDGE_ROUTE_AUTH = {
   "GET /memory/why": "client",
 
   "POST /send": "client",
+  // The slash commands /send answers itself — names and one-liners for
+  // autocomplete. Operator-only ones are listed (flagged `admin`) and
+  // refused at /send time for a credential without the scope.
+  "GET /commands": "client",
   "POST /upload": "client",
   "GET /media": "client",
   "GET /models": "client",

package/src/frontend/native/commands/admin.ts

@@ -0,0 +1,64 @@
+/**
+ * Operator commands — `/metrics`, `/doctor`, `/dream`, `/restart`.
+ *
+ * Gated on the `operator` scope by the dispatcher (see definitions.ts).
+ * `/restart` and `/dream` are the same actions the app's Settings screen
+ * fires through `POST /control`, so a typed command and a tap take the
+ * one code path.
+ */
+
+import { collectDoctorReport } from "../../../core/doctor/index.js";
+import { getMetrics, getTodayMetrics } from "../../../storage/metrics.js";
+import {
+  renderDoctorReport,
+  renderMetricsMessages,
+} from "../../presentation/reports.js";
+import { control } from "../surface/control.js";
+import { NATIVE_REPORTS } from "./format.js";
+import type { NativeCommandContext, NativeCommandHandler } from "./types.js";
+
+async function metrics(ctx: NativeCommandContext): Promise<void> {
+  const all = ctx.arg.toLowerCase() === "all";
+  const parts = renderMetricsMessages(
+    all ? getMetrics() : getTodayMetrics(),
+    NATIVE_REPORTS,
+    undefined,
+    all ? "📊 Metrics — all time" : "📊 Metrics — today (UTC)",
+  );
+  ctx.reply(
+    parts.join("\n\n") +
+      (all ? "" : "\n\n`/metrics all` for the all-time view."),
+  );
+}
+
+async function doctor(ctx: NativeCommandContext): Promise<void> {
+  try {
+    const report = await collectDoctorReport({
+      config: ctx.runtime.config,
+      hasConfigFile: true,
+    });
+    ctx.reply(renderDoctorReport(report, NATIVE_REPORTS));
+  } catch (err) {
+    ctx.reply(
+      `🩺 Doctor failed: ${err instanceof Error ? err.message : String(err)}`,
+    );
+  }
+}
+
+async function dream(ctx: NativeCommandContext): Promise<void> {
+  const result = await control("dream");
+  ctx.reply(result.ok ? `🌙 ${result.message}` : `⚠️ ${result.message}`);
+}
+
+async function restart(ctx: NativeCommandContext): Promise<void> {
+  // Reply first: the restart takes this process down with it.
+  ctx.reply("♻️ Restarting Talon — back online in a few seconds.");
+  await control("restart");
+}
+
+export const adminCommands = {
+  metrics,
+  doctor,
+  dream,
+  restart,
+} satisfies Record<string, NativeCommandHandler>;

package/src/frontend/native/commands/backup.ts

@@ -0,0 +1,191 @@
+/**
+ * /backup — snapshots and checkpoints (operator only), the native half.
+ *
+ *   /backup                      status: schedule, sizes, targets
+ *   /backup now                  take a snapshot now
+ *   /backup checkpoint <label>   labelled, pinned snapshot
+ *   /backup list                 recent snapshots
+ *   /backup show <id>            one snapshot's manifest summary
+ *   /backup pin|unpin <id>       keep past retention, or release
+ *   /backup restore <id>         describe it and ask to confirm
+ *   /backup restore <id> confirm staged restore + restart
+ *
+ * Same surface as Telegram's and Discord's /backup, with the confirmation
+ * button replaced by a typed `confirm` — the bridge has no callback route
+ * for button data. Restore does not happen in place either: the request
+ * is staged to ~/.talon/restore-pending.json and applied by the next boot
+ * before anything opens the database (core/backup/restore.ts, and
+ * `applyStagedRestore` in app.ts), exactly as the other frontends do it.
+ */
+
+import {
+  collectBackupStatus,
+  formatBackupStatus,
+  formatBytes,
+  formatSnapshotList,
+  isSnapshotId,
+  listSnapshots,
+  readManifest,
+  runBackup,
+  setSnapshotPinned,
+  writeRestorePending,
+} from "../../../core/backup/index.js";
+import { respawnSelf } from "../../../core/daemon/respawn.js";
+import { logError } from "../../../util/log.js";
+import { fence } from "./format.js";
+import type { NativeCommandContext } from "./types.js";
+
+const USAGE = [
+  "**/backup** — snapshots and checkpoints",
+  "",
+  "`/backup` — status",
+  "`/backup now` — take a snapshot",
+  "`/backup checkpoint <label>` — labelled, pinned checkpoint",
+  "`/backup list` — recent snapshots",
+  "`/backup show <id>` — one snapshot",
+  "`/backup pin <id>` · `/backup unpin <id>`",
+  "`/backup restore <id>` — restore (asks to confirm, then restarts)",
+].join("\n");
+
+const NOT_AN_ID = "That is not a snapshot id — `/backup list` shows them.";
+
+function errorText(err: unknown): string {
+  return err instanceof Error ? err.message : String(err);
+}
+
+async function takeSnapshot(
+  ctx: NativeCommandContext,
+  label?: string,
+): Promise<void> {
+  ctx.reply(
+    label ? `📸 Taking checkpoint “${label}”…` : "📸 Taking a snapshot…",
+  );
+  try {
+    const manifest = await runBackup({
+      kind: label ? "checkpoint" : "backup",
+      label,
+      pinned: Boolean(label),
+      trigger: "command",
+    });
+    ctx.reply(
+      `✅ \`${manifest.id}\` — ${manifest.parts.length} part(s), ` +
+        `${(manifest.sizeBytes / 1024 / 1024).toFixed(1)} MB` +
+        (label ? " (pinned)" : ""),
+    );
+  } catch (err) {
+    logError("backup", "/backup now failed", err);
+    ctx.reply(`⚠️ Backup failed: ${errorText(err)}`);
+  }
+}
+
+async function show(ctx: NativeCommandContext, id: string): Promise<void> {
+  if (!isSnapshotId(id)) return ctx.reply(NOT_AN_ID);
+  const manifest = await readManifest(id);
+  if (!manifest) return ctx.reply(`No snapshot \`${id}\` on this machine.`);
+  const remotes = Object.entries(manifest.remote ?? {});
+  ctx.reply(
+    [
+      `**Snapshot \`${manifest.id}\`**${manifest.pinned ? " 📌" : ""}`,
+      ...(manifest.label ? [`“${manifest.label}”`] : []),
+      `Kind: ${manifest.kind} · taken ${new Date(manifest.createdAt).toISOString()}`,
+      `Host: ${manifest.host} · Talon ${manifest.talonVersion}`,
+      `Size: ${formatBytes(manifest.sizeBytes)} in ${manifest.parts.length} part(s)`,
+      `Covers: ${manifest.includes.join(", ") || "—"}`,
+      ...(remotes.length
+        ? [
+            `Remotes: ${remotes.map(([name, r]) => `${name} (${r.status})`).join(", ")}`,
+          ]
+        : []),
+      "",
+      `\`/backup restore ${manifest.id}\` restores it.`,
+    ].join("\n"),
+  );
+}
+
+async function setPinned(
+  ctx: NativeCommandContext,
+  id: string,
+  pinned: boolean,
+): Promise<void> {
+  if (!isSnapshotId(id)) return ctx.reply(NOT_AN_ID);
+  const ok = await setSnapshotPinned(id, pinned);
+  ctx.reply(
+    ok
+      ? `${pinned ? "📌 Pinned" : "Unpinned"} \`${id}\``
+      : `No snapshot \`${id}\``,
+  );
+}
+
+/**
+ * `/backup restore <id>` describes the snapshot and asks for the typed
+ * confirmation; `/backup restore <id> confirm` stages it and hands off to
+ * the successor, which applies it during boot.
+ */
+async function restore(
+  ctx: NativeCommandContext,
+  id: string,
+  confirmed: boolean,
+): Promise<void> {
+  if (!isSnapshotId(id)) return ctx.reply(NOT_AN_ID);
+  const manifest = await readManifest(id);
+  if (!manifest) return ctx.reply(`No snapshot \`${id}\` on this machine.`);
+  if (!confirmed) {
+    ctx.reply(
+      `♻️ **Restore \`${id}\`?**\n` +
+        (manifest.label ? `“${manifest.label}”\n` : "") +
+        `Taken ${new Date(manifest.createdAt).toISOString()}\n\n` +
+        "This replaces config, prompts, keys, sessions, the database and memory, " +
+        "then restarts. A pinned checkpoint of the current state is taken first.\n\n" +
+        `Send \`/backup restore ${id} confirm\` to go ahead.`,
+    );
+    return;
+  }
+  try {
+    await writeRestorePending({
+      id,
+      requestedAt: Date.now(),
+      requestedBy: ctx.entry.id,
+    });
+  } catch (err) {
+    logError("backup", "Staging the restore failed", err);
+    ctx.reply(`⚠️ Could not stage the restore: ${errorText(err)}`);
+    return;
+  }
+  ctx.reply(
+    `♻️ Restoring \`${id}\` — restarting now. The restore is applied during ` +
+      "boot; the result is reported once Talon is back up.",
+  );
+  respawnSelf(`native /backup restore ${id}`);
+}
+
+/** `/backup <subcommand> [arg]`. */
+export async function backupCommand(ctx: NativeCommandContext): Promise<void> {
+  const [subcommand, ...rest] = ctx.arg.split(/\s+/).filter(Boolean);
+  const target = rest[0] ?? "";
+  switch (subcommand?.toLowerCase()) {
+    case undefined:
+    case "status":
+      return ctx.reply(fence(formatBackupStatus(await collectBackupStatus())));
+    case "now":
+      return takeSnapshot(ctx);
+    case "checkpoint": {
+      const label = rest.join(" ").trim();
+      if (!label)
+        return ctx.reply(
+          "Give the checkpoint a label: `/backup checkpoint before the rewrite`",
+        );
+      return takeSnapshot(ctx, label);
+    }
+    case "list":
+      return ctx.reply(fence(formatSnapshotList(await listSnapshots())));
+    case "show":
+      return show(ctx, target);
+    case "pin":
+    case "unpin":
+      return setPinned(ctx, target, subcommand.toLowerCase() === "pin");
+    case "restore":
+      return restore(ctx, target, rest[1]?.toLowerCase() === "confirm");
+    default:
+      return ctx.reply(USAGE);
+  }
+}