talon-agent 5.26.0 → 5.26.2

package/src/core/models/active-model.ts

@@ -36,19 +36,20 @@
  *   1. `modelByBackend[B]` — per-chat-per-backend pick, if it still
  *      validates against B's catalog. Cross-backend orphans surface
  *      as `kind: "missing"` and fall through.
- *   2. `backend.models?.getDefaultModelId()` — backend's canonical default.
+ *   2. `config.backendDefaults[B]` — operator-configured per-backend
+ *      default in `talon.json`.
+ *   3. `config.model` — only when B is the global chat-role backend
+ *      (`config.backend === B`).
+ *      Operator picks (2/3) must validate against B's catalog when B
+ *      has a canonical default to fall back to; an unknown pin falls
+ *      through to step 4 (what the boot-time model audit warns about).
+ *   4. `backend.models?.getDefaultModelId()` — backend's canonical default.
  *      Codex picks auth-aware (`gpt-5-codex` on API key, `gpt-5.5`
  *      on ChatGPT OAuth). Claude SDK returns the `"default"` alias.
  *      Stock OpenAI Agents returns a constant.
  *      Catalog-driven backends without a canonical (Kilo, OpenCode,
  *      OpenAI Agents on OpenRouter / custom OpenAI-compatible) do
- *      NOT implement this — they fall through to step 3.
- *   3. `config.backendDefaults[B]` — operator-configured per-backend
- *      default in `talon.json`. Escape hatch for "no canonical"
- *      backends.
- *   4. `config.model` — only when B is the global chat-role backend
- *      (`config.backend === B`). Back-compat for installs that
- *      predate `backendDefaults`.
+ *      NOT implement this.
  *   5. `null` → UI renders "No model selected", send guard refuses
  *      with a "use /model to pick one" reply.
  *
@@ -56,6 +57,10 @@
  * is called. Only `kind: "exact"` with `selectable: true` honours the
  * stored override. Anything else falls through to step 2.
  *
+ * Operator config ranks above the canonical so a pinned `config.model`
+ * is actually honoured (it used to lose to Claude's `"default"`, so a
+ * claude install pinned to any model silently ran the default).
+ *
  * Backends with no `resolveModel` (rare — defensive fallback only)
  * have their stored override returned verbatim — no way to validate.
  */
@@ -157,8 +162,8 @@ async function runChain(
     }
   }
 
-  // ── Step 2-5: backend canonical → config.backendDefaults →
-  //              config.model (chat-role only) → null
+  // ── Steps 2-5: backendDefaults → config.model (chat-role only) →
+  //              backend canonical → null
   return stepsTwoThroughFive(backend, backendId, config, null);
 }
 
@@ -196,57 +201,61 @@ async function stepsTwoThroughFive(
   config: TalonConfig,
   fallbackSourceOverride: "override-invalid-fallback" | null,
 ): Promise<{ model: string | null; source: ActiveModelSource }> {
-  // Step 2: backend.models.getDefaultModelId()
-  if (backend?.models) {
-    const canonical = await safeBackendDefault(backend);
-    if (canonical) {
-      return {
-        model: canonical,
-        source: fallbackSourceOverride ?? "backend-canonical",
-      };
+  const withSource = (model: string, source: ActiveModelSource) => ({
+    model,
+    source: fallbackSourceOverride ?? source,
+  });
+
+  const operatorPick = pickOperatorDefault(backendId, config);
+  const canonical = backend?.models ? await safeBackendDefault(backend) : null;
+
+  // Operator config (steps 2/3) beats the backend canonical (step 4): a
+  // pinned `config.model` is an explicit choice, and letting the canonical
+  // win meant a claude install pinned to e.g. "opus[1m]" silently ran
+  // "default" on every turn. The pin must still validate — a withdrawn id
+  // falls back to the canonical, exactly what the boot-time model audit
+  // warns about. Without a canonical to fall back to, the pin is returned
+  // unvalidated (catalog-driven backends with no default, unchanged).
+  if (operatorPick) {
+    if (!canonical) return withSource(operatorPick.model, operatorPick.source);
+    if (await validateModelOnBackend(backend, operatorPick.model)) {
+      return withSource(operatorPick.model, operatorPick.source);
     }
   }
 
-  // Step 3: config.backendDefaults[backendId]
+  // Step 4: backend.models.getDefaultModelId()
+  if (canonical) return withSource(canonical, "backend-canonical");
+
+  // Step 5: null. Callers must render "No model selected" / refuse send.
+  return { model: null, source: "none" };
+}
+
+/**
+ * The operator-configured default for a backend, if any:
+ *   - `config.backendDefaults[B]`;
+ *   - else `config.model` — only when B is the global chat-role backend
+ *     (`config.backend === B`), or when no backend id is known at all
+ *     (pre-bootstrap callers passing null).
+ */
+function pickOperatorDefault(
+  backendId: string | null,
+  config: TalonConfig,
+): { model: string; source: ActiveModelSource } | null {
   if (backendId && config.backendDefaults) {
     const operatorDefault = config.backendDefaults[backendId];
     if (operatorDefault && operatorDefault.length > 0) {
-      return {
-        model: operatorDefault,
-        source: fallbackSourceOverride ?? "config-backend-defaults",
-      };
+      return { model: operatorDefault, source: "config-backend-defaults" };
     }
   }
-
-  // Step 4: legacy config.model — only for the global chat-role backend
+  const modelAppliesHere = !backendId || backendId === config.backend;
   if (
-    backendId &&
-    backendId === config.backend &&
+    modelAppliesHere &&
     typeof config.model === "string" &&
     config.model.length > 0
   ) {
-    return {
-      model: config.model,
-      source: fallbackSourceOverride ?? "config-legacy-global",
-    };
+    return { model: config.model, source: "config-legacy-global" };
   }
-
-  // Step 4b: even without a backendId, honour config.model if no
-  // backend is bound at all (callers passing null for both — rare,
-  // typically pre-bootstrap code paths).
-  if (
-    !backendId &&
-    typeof config.model === "string" &&
-    config.model.length > 0
-  ) {
-    return {
-      model: config.model,
-      source: fallbackSourceOverride ?? "config-legacy-global",
-    };
-  }
-
-  // Step 5: null. Callers must render "No model selected" / refuse send.
-  return { model: null, source: "none" };
+  return null;
 }
 
 async function validateModelOnBackend(

package/src/core/plugin/loader.ts

@@ -98,6 +98,15 @@ function registerPluginInstance(
   return loaded;
 }
 
+/**
+ * Run a plugin's init, waiting at most `timeoutMs` for it before boot moves
+ * on. The deadline bounds how long boot waits, not the init itself: a
+ * plugin stays registered either way (its tools are served from
+ * `mcpServer` whether or not init finished), so an init that outlives the
+ * deadline keeps running and, when it does finish, clears the alert the
+ * timeout raised — a slow handshake on a busy boot is a delay, not a
+ * failure that lingers until the next restart.
+ */
 export async function initPluginWithTimeout(
   plugin: TalonPlugin,
   config: Record<string, unknown>,
@@ -108,28 +117,54 @@ export async function initPluginWithTimeout(
   if (!plugin.init) return;
 
   let timer: ReturnType<typeof setTimeout> | undefined;
-
   const alertKey = `plugin.${plugin.name}`;
+  const startedAt = Date.now();
+  // Started (and timed) only here, when this plugin's own init begins.
+  const init = Promise.resolve().then(() => plugin.init!(config));
+  const TIMED_OUT = Symbol("timed out");
+
   try {
-    await Promise.race([
-      Promise.resolve(plugin.init(config)),
-      new Promise<never>((_, reject) => {
-        timer = setTimeout(() => {
-          reject(
-            new Error(`${timeoutLabel} timed out after ${timeoutMs / 1000}s`),
-          );
-        }, timeoutMs);
+    const outcome = await Promise.race([
+      init,
+      new Promise<typeof TIMED_OUT>((settle) => {
+        timer = setTimeout(() => settle(TIMED_OUT), timeoutMs);
         timer.unref?.();
       }),
     ]);
-    resolveAlert(alertKey, `Plugin "${plugin.name}" initialised normally.`);
+    if (outcome !== TIMED_OUT) {
+      resolveAlert(alertKey, `Plugin "${plugin.name}" initialised normally.`);
+      return;
+    }
+    const message = `${timeoutLabel} timed out after ${timeoutMs / 1000}s`;
+    logError("plugin", `${errorPrefix}: ${message}; still waiting for it`);
+    raiseAlert(
+      alertKey,
+      `Plugin "${plugin.name}" failed to initialise: ${message}. Its tools stay registered; this clears itself if init finishes late.`,
+    );
+    void init.then(
+      () => {
+        // Reloaded or unloaded meanwhile: this instance's verdict is moot.
+        if (registry.getByName(plugin.name)?.plugin !== plugin) return;
+        const took = Math.round((Date.now() - startedAt) / 1000);
+        log("plugin", `${plugin.name} init finished late (${took}s)`);
+        resolveAlert(
+          alertKey,
+          `Plugin "${plugin.name}" finished initialising late (${took}s).`,
+        );
+      },
+      (err: unknown) =>
+        logError(
+          "plugin",
+          `${errorPrefix} (after timing out): ${err instanceof Error ? err.message : err}`,
+        ),
+    );
   } catch (err) {
     logError(
       "plugin",
       `${errorPrefix}: ${err instanceof Error ? err.message : err}`,
     );
-    // Init runs once per boot or reload: a plugin that failed it stays
-    // half-loaded until someone fixes it, so this needs no threshold.
+    // An init that threw won't retry on its own: it needs a reload or
+    // restart, so this needs no threshold.
     raiseAlert(
       alertKey,
       `Plugin "${plugin.name}" failed to initialise: ${faultText(err)}. Its tools may not work until the next reload or restart.`,

package/src/core/update/self-update.ts

@@ -27,10 +27,19 @@
  * can never leave the deployment un-updatable, which is what the old
  * `pull --ff-only` did (it aborts on any dirty/diverged tree). `.gitignore`
  * is respected (no `-x`), so node_modules, secrets and local config survive.
+ *
+ * Before anything in the checkout moves, a pinned pre-update checkpoint is
+ * taken. If it fails, the update is refused. An update with no way back is
+ * when data goes missing, so the operator must say `force` to go on
+ * without one. Opting out in config (`backup.checkpointBeforeUpdate:
+ * false`) is the only way to skip it without being asked.
  */
 
 import { execFile } from "node:child_process";
-import { checkpointBeforeUpdate } from "../backup/index.js";
+import {
+  checkpointBeforeUpdate,
+  type UpdateCheckpoint,
+} from "../backup/index.js";
 import { existsSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -60,6 +69,13 @@ export interface UpdateOptions {
   entry?: { cmd: string; args: readonly string[] };
   /** Injectable command runner (tests). */
   runner?: CommandRunner;
+  /**
+   * Go on even when the pre-update checkpoint fails (`/update force`).
+   * The result still says the checkpoint failed.
+   */
+  force?: boolean;
+  /** Injectable pre-update checkpoint (tests). */
+  checkpoint?: (from: string, to: string) => Promise<UpdateCheckpoint>;
 }
 
 /** One executed step in an update run. */
@@ -82,6 +98,13 @@ export interface UpdateResult {
   changed: boolean;
   /** Human-readable failure reason when `ok` is false. */
   error?: string;
+  /** The pre-update checkpoint, when the update got far enough to take one. */
+  checkpoint?: UpdateCheckpoint;
+  /**
+   * True when the update was refused because the checkpoint failed. Nothing
+   * in the checkout was touched; `force` would have gone on.
+   */
+  checkpointRefused?: boolean;
 }
 
 export type CommandRunner = (
@@ -171,12 +194,7 @@ export async function runSelfUpdate(
   const branch = opts.branch?.trim() || "main";
   const run = opts.runner ?? defaultRunner;
 
-  const record = async (
-    label: string,
-    cmd: string,
-    args: readonly string[],
-    timeoutMs: number,
-  ): Promise<UpdateStep> => {
+  const record: Recorder = async (label, cmd, args, timeoutMs) => {
     const { ok, output } = await run(cmd, args, repoRoot, timeoutMs);
     const step: UpdateStep = { label, ok, output };
     steps.push(step);
@@ -210,22 +228,58 @@ export async function runSelfUpdate(
   );
   if (!fetch.ok) return fail(`git fetch failed: ${fetch.output}`, before);
 
+  // Where the update is going, read before the tree moves: the checkpoint
+  // is labelled with it, and "already up to date" needs no checkpoint.
+  const targetRef = `${remote}/${branch}`;
+  const target = await record(
+    `rev-parse ${targetRef}`,
+    "git",
+    ["rev-parse", targetRef],
+    GIT_TIMEOUT_MS,
+  );
+  if (!target.ok) {
+    return fail(`Failed to read ${targetRef}: ${target.output}`, before);
+  }
+  const upcoming = shortSha(target.output);
+
+  // The safety net goes up before anything is destroyed: the reset and
+  // clean below discard local state, and the new code may migrate data.
+  let checkpoint: UpdateCheckpoint | undefined;
+  if (upcoming !== before) {
+    checkpoint = await (opts.checkpoint ?? checkpointBeforeUpdate)(
+      before,
+      upcoming,
+    );
+    steps.push({
+      label: "pre-update checkpoint",
+      ok: checkpoint.status !== "failed",
+      output: describeCheckpoint(checkpoint),
+    });
+    if (checkpoint.status === "failed" && !opts.force) {
+      return {
+        ...fail(refusal(checkpoint.error), before),
+        checkpoint,
+        checkpointRefused: true,
+      };
+    }
+  }
+
   // Force the checkout to exactly match the freshly-fetched remote
   // branch, discarding ANY local edits or diverged commits. The old
   // `pull --ff-only` aborted here whenever the tree was dirty, leaving the
   // deployment stuck; a bot host is meant to mirror the remote, so resetting
   // to it is both correct and reliable.
   const reset = await record(
-    `reset --hard ${remote}/${branch}`,
+    `reset --hard ${targetRef}`,
     "git",
-    ["reset", "--hard", `${remote}/${branch}`],
+    ["reset", "--hard", targetRef],
     GIT_TIMEOUT_MS,
   );
   if (!reset.ok) {
-    return fail(
-      `git reset --hard ${remote}/${branch} failed: ${reset.output}`,
-      before,
-    );
+    return {
+      ...fail(`git reset --hard ${targetRef} failed: ${reset.output}`, before),
+      checkpoint,
+    };
   }
 
   // Drop untracked files too so the tree is pristine and a future update
@@ -246,28 +300,62 @@ export async function runSelfUpdate(
   // Nothing moved — skip the expensive install/setup and tell the
   // caller no restart is needed.
   if (!changed) {
-    return { ok: true, repoRoot, steps, before, after, changed: false };
+    return {
+      ok: true,
+      repoRoot,
+      steps,
+      before,
+      after,
+      changed: false,
+      checkpoint,
+    };
   }
 
-  await checkpointBeforeUpdate(before, after);
+  const error = await installAndVerify(record, opts, before, after);
+  return {
+    ok: !error,
+    repoRoot,
+    steps,
+    before,
+    after,
+    changed: true,
+    checkpoint,
+    ...(error ? { error } : {}),
+  };
+}
+
+type Recorder = (
+  label: string,
+  cmd: string,
+  args: readonly string[],
+  timeoutMs: number,
+) => Promise<UpdateStep>;
 
+function refusal(error: string): string {
+  return (
+    `the pre-update checkpoint failed (${error}). ` +
+    `Nothing was changed. Fix the backup problem, or run the update ` +
+    `with "force" to go on without a checkpoint.`
+  );
+}
+
+/**
+ * Reinstall, run setup, and prove the new tree imports. Returns the
+ * failure reason, or null when the tree is ready to restart into.
+ */
+async function installAndVerify(
+  record: Recorder,
+  opts: UpdateOptions,
+  before: string,
+  after: string,
+): Promise<string | null> {
   const install = await record(
     "npm install",
     "npm",
     ["install"],
     INSTALL_TIMEOUT_MS,
   );
-  if (!install.ok) {
-    return {
-      ok: false,
-      repoRoot,
-      steps,
-      before,
-      after,
-      changed,
-      error: `npm install failed: ${install.output}`,
-    };
-  }
+  if (!install.ok) return `npm install failed: ${install.output}`;
 
   for (const cmd of opts.setup ?? []) {
     const trimmed = cmd.trim();
@@ -279,15 +367,7 @@ export async function runSelfUpdate(
       SETUP_TIMEOUT_MS,
     );
     if (!setup.ok) {
-      return {
-        ok: false,
-        repoRoot,
-        steps,
-        before,
-        after,
-        changed,
-        error: `setup command failed (${trimmed}): ${setup.output}`,
-      };
+      return `setup command failed (${trimmed}): ${setup.output}`;
     }
   }
 
@@ -299,18 +379,35 @@ export async function runSelfUpdate(
     VERIFY_TIMEOUT_MS,
   );
   if (!verify.ok || !verify.output.includes(BOOT_SMOKE_OK)) {
-    return {
-      ok: false,
-      repoRoot,
-      steps,
-      before,
-      after,
-      changed,
-      error:
-        `the updated tree does not import — not restarting into it. ` +
-        `Still running ${before}; the checkout is at ${after}.`,
-    };
+    return (
+      `the updated tree does not import — not restarting into it. ` +
+      `Still running ${before}; the checkout is at ${after}.`
+    );
+  }
+  return null;
+}
+
+/** One line for the step log and the chat reply. */
+export function describeCheckpoint(checkpoint: UpdateCheckpoint): string {
+  switch (checkpoint.status) {
+    case "taken":
+      return `checkpoint ${checkpoint.id} taken`;
+    case "disabled":
+      return "no checkpoint (backup.checkpointBeforeUpdate is off)";
+    case "failed":
+      return `checkpoint failed: ${checkpoint.error}`;
   }
+}
 
-  return { ok: true, repoRoot, steps, before, after, changed: true };
+/**
+ * Whether the arguments to `/update` ask to go on without a checkpoint.
+ * `force` and `--force` both work, so the chat command and a CLI habit
+ * read the same.
+ */
+export function wantsForce(args: string | undefined | null): boolean {
+  return (args ?? "")
+    .trim()
+    .toLowerCase()
+    .split(/\s+/)
+    .some((token) => token === "force" || token === "--force");
 }

package/src/frontend/discord/commands/admin.ts

@@ -32,6 +32,7 @@ import {
 import {
   getRepoRoot,
   runSelfUpdate,
+  describeCheckpoint,
 } from "../../../core/update/self-update.js";
 import { reply } from "./interaction.js";
 
@@ -153,7 +154,8 @@ export async function handleDream(
 }
 
 /**
- * /update — pull, reinstall, run setup, restart. Only reachable on developer
+ * /update [force] — pull, reinstall, run setup, restart. Refused when the
+ * pre-update checkpoint fails unless `force` is set. Only reachable on developer
  * builds running from a git checkout; the command is not registered at all
  * otherwise (see buildCommandDefinitions).
  */
@@ -172,8 +174,13 @@ export async function handleUpdate(
   }
   const remote = config.update?.remote ?? "origin";
   const branch = config.update?.branch ?? "main";
+  const force = i.options.getBoolean("force") ?? false;
   await i.deferReply({ flags: MessageFlags.Ephemeral });
-  await i.editReply(`⏳ Updating from \`${remote}/${branch}\`…`);
+  await i.editReply(
+    `⏳ Updating from \`${remote}/${branch}\`` +
+      (force ? " (forced: a failed checkpoint will not stop it)" : "") +
+      "…",
+  );
   const edit = (text: string) => i.editReply(safeSlice(text, DISCORD_MAX_TEXT));
 
   // Fire-and-forget so the gateway keeps processing other interactions.
@@ -182,12 +189,24 @@ export async function handleUpdate(
     branch,
     setup: config.update?.setup,
     repoRoot,
+    force,
   })
     .then(async (res) => {
+      if (res.checkpointRefused) {
+        await edit(
+          `🛑 Update refused: ${res.error ?? "the pre-update checkpoint failed"}\n\n` +
+            "Run `/update force:true` to update without a checkpoint.",
+        );
+        return;
+      }
+      const note = res.checkpoint
+        ? `\n${describeCheckpoint(res.checkpoint)}`
+        : "";
       if (!res.ok) {
         const tail = res.steps[res.steps.length - 1]?.output ?? "";
         await edit(
           `⚠️ Update failed: ${res.error ?? "unknown error"}` +
+            note +
             (tail
               ? `\n\`\`\`\n${escapeForCodeBlock(tail.slice(-1200))}\n\`\`\``
               : ""),
@@ -201,7 +220,7 @@ export async function handleUpdate(
         return;
       }
       await edit(
-        `✅ Updated \`${res.before ?? "?"}\` → \`${res.after ?? "?"}\`. ♻️ Restarting…`,
+        `✅ Updated \`${res.before ?? "?"}\` → \`${res.after ?? "?"}\`.${note}\n♻️ Restarting…`,
       );
       // The successor documents any provisioning changes (plugin runtime
       // upgrades, migrations) back to this channel once it's up.

package/src/frontend/discord/commands/definitions.ts

@@ -156,6 +156,13 @@ function buildCommandDefinitions(devBuild = false): unknown[] {
           new SlashCommandBuilder()
             .setName("update")
             .setDescription("Pull latest, reinstall, restart (admin)")
+            .addBooleanOption((o) =>
+              o
+                .setName("force")
+                .setDescription(
+                  "Update even if the pre-update checkpoint fails",
+                ),
+            )
             .toJSON(),
         ]
       : []),