talon-agent 5.26.0 → 5.26.2

package/src/frontend/telegram/actions/media.ts

@@ -54,8 +54,8 @@ export function resolveMediaInput(
 
 /** Telegram's hard limit on media captions, counted after entity parsing. */
 export const TELEGRAM_MAX_CAPTION = 1024;
-/** Visible length a truncated caption is cut to, leaving room for the "…". */
-const TRUNCATED_CAPTION_LEN = 1000;
+/** Below this head budget the splitter is fighting pathological markup; give up. */
+const MIN_CAPTION_HEAD = 64;
 
 /**
  * Drop every `<...>` tag in one linear pass. Only used to *measure* the
@@ -104,35 +104,76 @@ export function visibleCaptionText(html: string): string {
 export type FittedCaption = {
   caption?: string;
   parse_mode?: "HTML";
-  /** Full caption text to deliver as a follow-up message when it was cut. */
+  /** Caption text that did not fit, to deliver as follow-up message(s). */
   overflow?: string;
 };
 
+/** Visible (Telegram-counted) length of a markdown caption once rendered. */
+export function captionUnits(markdown: string): number {
+  // Telegram counts UTF-16 code units, which is what .length measures.
+  return visibleCaptionText(markdownToTelegramHtml(markdown)).length;
+}
+
+/**
+ * Split a markdown caption into the leading part that fits `max` visible
+ * units and the remainder. Splits the *markdown source* with the shared
+ * message splitter (paragraph → newline → space boundaries, surrogate-safe,
+ * ``` fences closed/reopened), so the head is rendered to HTML on its own
+ * and can never strand a tag or entity. Returns null if no clean head fits.
+ */
+export function splitCaption(
+  text: string,
+  max: number = TELEGRAM_MAX_CAPTION,
+): { head: string; rest: string } | null {
+  // Rendering usually shrinks markdown (markers and link URLs vanish), so
+  // the first try nearly always fits; shrink the budget if it does not.
+  for (let budget = max; budget >= MIN_CAPTION_HEAD;) {
+    const chunks = splitMessage(text, budget);
+    const head = chunks[0] ?? "";
+    if (head.trim() && captionUnits(head) <= max) {
+      const at = text.indexOf(head);
+      // The splitter only trims at boundaries, so the head is normally a
+      // verbatim prefix; when it closed a ``` fence it is not, and the
+      // splitter's own reopened chunks carry the remainder instead.
+      const rest =
+        at >= 0
+          ? text.slice(at + head.length).replace(/^\s+/, "")
+          : chunks.slice(1).join("\n\n");
+      return { head, rest };
+    }
+    budget = Math.floor(budget * 0.8);
+  }
+  return null;
+}
+
 /**
  * Convert a markdown caption to what Telegram accepts. Captions over 1024
  * visible characters are rejected outright ("message caption is too long"),
- * losing the media along with them — so an oversized caption is cut to a
- * plain-text preview (no parse_mode: a cut through HTML could strand a tag
- * or entity) and the full text is returned as `overflow` for the caller to
- * send as a normal, chunked text message.
+ * losing the media along with them — so an oversized caption is split: the
+ * leading part that fits rides on the media (still formatted), and the rest
+ * is returned as `overflow` for the caller to send as follow-up text.
  */
 export function fitCaption(raw: unknown): FittedCaption {
   if (!raw) return {};
   const text = String(raw);
   const html = markdownToTelegramHtml(text);
-  const visible = visibleCaptionText(html);
-  // Telegram counts UTF-16 code units, which is what .length measures.
-  if (visible.length <= TELEGRAM_MAX_CAPTION)
+  if (visibleCaptionText(html).length <= TELEGRAM_MAX_CAPTION)
     return { caption: html, parse_mode: "HTML" };
-  let cut = visible.slice(0, TRUNCATED_CAPTION_LEN);
-  // Don't strand half a surrogate pair at the cut.
-  const last = cut.charCodeAt(cut.length - 1);
-  if (last >= 0xd800 && last <= 0xdbff) cut = cut.slice(0, -1);
-  return { caption: `${cut.trimEnd()}…`, overflow: text };
+  const split = splitCaption(text);
+  if (split) {
+    return {
+      caption: markdownToTelegramHtml(split.head),
+      parse_mode: "HTML",
+      ...(split.rest ? { overflow: split.rest } : {}),
+    };
+  }
+  // No clean boundary fits (pathological markup): send the media bare and
+  // deliver the whole caption as text rather than cut through it.
+  return { overflow: text };
 }
 
 /**
- * Deliver the full text of a caption that did not fit, threaded as a reply
+ * Deliver the part of a caption that did not fit, threaded as a reply
  * to the media it belongs to. Best-effort: the media already landed, so a
  * failure here is reported as a warning rather than failing the send.
  */
@@ -167,7 +208,7 @@ async function sendCaptionOverflow(
       `Caption overflow follow-up failed (chat=${chatId}): ${msg}`,
     );
     return {
-      warning: `Media sent with a truncated caption, but sending the full caption text failed: ${msg}`,
+      warning: `Media sent, but the rest of its caption (past Telegram's ${TELEGRAM_MAX_CAPTION}-char limit) failed to send: ${msg}`,
     };
   }
 }
@@ -176,8 +217,8 @@ function overflowResult(
   r: { message_ids: number[] } | { warning: string },
 ): Record<string, unknown> {
   return "warning" in r
-    ? { caption_truncated: true, warning: r.warning }
-    : { caption_truncated: true, caption_message_ids: r.message_ids };
+    ? { caption_split: true, warning: r.warning }
+    : { caption_split: true, caption_message_ids: r.message_ids };
 }
 
 const sendMediaFile: TelegramActionHandlers[string] = async (

package/src/frontend/telegram/actions/messaging.ts

@@ -21,6 +21,7 @@ import {
   richMessagesAvailable,
 } from "./rich-messages.js";
 import { toPositiveId } from "./coerce.js";
+import { captionUnits, TELEGRAM_MAX_CAPTION } from "./media.js";
 import { resolveThreadId } from "../topics.js";
 import { TELEGRAM_MAX_TEXT, type TelegramActionHandlers } from "./types.js";
 
@@ -260,6 +261,14 @@ export const messagingHandlers: TelegramActionHandlers = {
     // Media messages have captions, not text — editMessageText on them fails
     // with "there is no text in the message to edit".
     if (body.is_caption === true) {
+      // An edit cannot spill into a follow-up message the way a send does,
+      // so refuse up front with guidance rather than a raw Bot API 400.
+      const units = captionUnits(text);
+      if (units > TELEGRAM_MAX_CAPTION)
+        return {
+          ok: false,
+          error: `Caption too long (${units} chars, max ${TELEGRAM_MAX_CAPTION}) — shorten it, or send the rest as a separate message`,
+        };
       await withRetry(async () => {
         try {
           await bot.api.editMessageCaption(chatId, Number(body.message_id), {

package/src/frontend/telegram/commands/admin.ts

@@ -11,8 +11,10 @@ import type { TalonConfig } from "../../../core/config/index.js";
 import { respawnSelf } from "../../../core/daemon/respawn.js";
 import { isStaleCommand } from "../polling/stale-command.js";
 import {
+  describeCheckpoint,
   getRepoRoot,
   runSelfUpdate,
+  wantsForce,
 } from "../../../core/update/self-update.js";
 import { forceDream } from "../../../core/background/dream/index.js";
 import { escapeHtml } from "../formatting.js";
@@ -169,7 +171,8 @@ function registerRestartCommand(bot: Bot): void {
   });
 }
 
-// /update — pull latest, reinstall, run setup, restart. Only wired
+// /update [force] — pull latest, reinstall, run setup, restart. Refused
+// when the pre-update checkpoint fails unless "force" is given. Only wired
 // up for developer builds running from a git checkout; packaged
 // binaries have no source tree (getRepoRoot() === null) so the
 // command stays absent entirely.
@@ -187,8 +190,11 @@ function registerUpdateCommand(
     if (isStaleCommand(ctx.message?.date, "/update")) return;
     const remote = config.update?.remote ?? "origin";
     const branch = config.update?.branch ?? "main";
+    const force = wantsForce(typeof ctx.match === "string" ? ctx.match : "");
     const sent = await ctx.reply(
-      `⏳ Updating from <code>${escapeHtml(remote)}/${escapeHtml(branch)}</code>…`,
+      `⏳ Updating from <code>${escapeHtml(remote)}/${escapeHtml(branch)}</code>` +
+        (force ? " (forced: a failed checkpoint will not stop it)" : "") +
+        "…",
       { parse_mode: "HTML" },
     );
     const edit = (text: string) =>
@@ -204,12 +210,24 @@ function registerUpdateCommand(
       branch,
       setup: config.update?.setup,
       repoRoot: updateRepoRoot,
+      force,
     })
       .then(async (res) => {
+        if (res.checkpointRefused) {
+          await edit(
+            `🛑 Update refused: ${escapeHtml(res.error ?? "the pre-update checkpoint failed")}\n\n` +
+              `Send <code>/update force</code> to update without a checkpoint.`,
+          );
+          return;
+        }
+        const note = res.checkpoint
+          ? `\n${escapeHtml(describeCheckpoint(res.checkpoint))}`
+          : "";
         if (!res.ok) {
           const tail = res.steps[res.steps.length - 1]?.output ?? "";
           await edit(
             `⚠️ Update failed: ${escapeHtml(res.error ?? "unknown error")}` +
+              note +
               (tail ? `\n\n<pre>${escapeHtml(tail.slice(-1500))}</pre>` : ""),
           );
           return;
@@ -221,7 +239,7 @@ function registerUpdateCommand(
           return;
         }
         await edit(
-          `✅ Updated <code>${escapeHtml(res.before ?? "?")}</code> → <code>${escapeHtml(res.after ?? "?")}</code>. ♻️ Restarting…`,
+          `✅ Updated <code>${escapeHtml(res.before ?? "?")}</code> → <code>${escapeHtml(res.after ?? "?")}</code>.${note}\n♻️ Restarting…`,
         );
         // The successor documents any provisioning changes (plugin
         // runtime upgrades, migrations) back to this chat once it's up.

package/src/storage/backup/index.ts

@@ -22,7 +22,7 @@ import * as repo from "./repo.js";
  * handle stays inside storage/ (`db-handle-stays-in-storage`), and a
  * snapshot of the database is a storage concern with a storage API.
  */
-export { snapshotDatabase, snapshotSqliteFile } from "../db.js";
+export { databasePath, snapshotDatabase, snapshotSqliteFile } from "../db.js";
 
 export type { BackupRecord, BackupRemoteRecord } from "./repo.js";
 import type { BackupRecord, BackupRemoteRecord } from "./repo.js";

package/src/storage/chat-settings.ts

@@ -313,6 +313,19 @@ export function clearAllChatModels(chatId: string): void {
   persist(chatId);
 }
 
+/**
+ * Drop only the legacy single-slot `model` field, keeping every
+ * per-backend pick. The boot reconcile uses it: a stale legacy value must
+ * go, but the picks the chat made on other backends are still good.
+ */
+export function clearLegacyChatModel(chatId: string): void {
+  const entry = cache.get(chatId);
+  if (!entry || entry.model === undefined) return;
+  delete entry.model;
+  cleanupEmpty(chatId);
+  persist(chatId);
+}
+
 /**
  * @deprecated Prefer `setChatModelForBackend(chatId, backendId, model)`
  * which is explicit about which backend's slot is being mutated.

package/src/storage/db.ts

@@ -145,6 +145,11 @@ function defaultPath(): string {
   return process.env.TALON_DB_PATH || files.database;
 }
 
+/** Where the process-wide database lives (or will, once opened). */
+export function databasePath(): string {
+  return defaultPath();
+}
+
 /**
  * Open (or return) the process-wide database. The first call wins the
  * path; tests pass an explicit tmp path and call closeDatabase() in

package/src/storage/media-index.ts

@@ -48,15 +48,16 @@ function isMediaEntry(value: unknown): value is MediaEntry {
 
 /**
  * Run the one-time import of the legacy JSON store, then sweep
- * expired entries. Idempotent; called once at boot.
+ * expired entries (unless `purgeExpired: false` — a boot with no safety
+ * checkpoint deletes nothing). Idempotent; called once at boot.
  */
-export function loadMediaIndex(): void {
+export function loadMediaIndex(options: { purgeExpired?: boolean } = {}): void {
   try {
     importLegacyMediaIndex();
   } catch (err) {
     logError("media", "Media index load failed", err);
   }
-  purgeExpired();
+  if (options.purgeExpired !== false) purgeExpired();
 }
 
 /** Legacy shape: bare MediaEntry[]. */

package/src/storage/sessions.ts

@@ -23,6 +23,7 @@ import { recordError } from "../util/watchdog.js";
 import { files } from "../util/paths.js";
 import { importLegacyJson } from "./legacy-import.js";
 import { dbErrorFields } from "./db.js";
+import { kvGet, kvSet } from "./kv.js";
 import * as repo from "./repositories/sessions-repo.js";
 
 export type {
@@ -534,18 +535,76 @@ function removeSessionRow(chatId: string): void {
   }
 }
 
+// ── Replaced-session archive ───────────────────────────────────────────────
+
+/** A backend session id a reset replaced — kept so it can be re-linked. */
+export type ArchivedSession = {
+  chatId: string;
+  sessionId: string;
+  /** Why the session was replaced ("reset", "backend-unavailable", …). */
+  reason: string;
+  /** When it was replaced (ms epoch). */
+  at: number;
+  turns: number;
+  lastModel?: string;
+  sessionName?: string;
+};
+
+const SESSION_ARCHIVE_KEY = "sessions.archive";
+/** Newest entries kept; the transcripts themselves stay on disk regardless. */
+const SESSION_ARCHIVE_MAX = 500;
+
+/**
+ * Remember a session id that is about to be dropped. A reset used to
+ * forget it outright, leaving the backend transcript on disk with nothing
+ * pointing at it; with the id kept, a chat reset by mistake (or by a boot
+ * reconcile) can be re-linked to its old conversation. Never throws.
+ */
+function archiveSessionId(entry: ArchivedSession): void {
+  try {
+    const prior = kvGet<ArchivedSession[]>(SESSION_ARCHIVE_KEY);
+    const list = Array.isArray(prior) ? prior : [];
+    list.push(entry);
+    kvSet(SESSION_ARCHIVE_KEY, list.slice(-SESSION_ARCHIVE_MAX));
+  } catch (err) {
+    logError("sessions", `Failed to archive session chat=${entry.chatId}`, err);
+  }
+}
+
+/** Archived (replaced) session ids, oldest first; one chat's when given. */
+export function getArchivedSessions(chatId?: string): ArchivedSession[] {
+  const list = kvGet<ArchivedSession[]>(SESSION_ARCHIVE_KEY);
+  if (!Array.isArray(list)) return [];
+  return chatId ? list.filter((e) => e.chatId === chatId) : list;
+}
+
 /**
  * Reset the chat's conversation state (backend session id, turns, usage)
  * while carrying its metrics forward. Resets fire on /new, model switches
  * and error recovery — none of which should erase the chat's accounting
  * history (that's what makes per-session metrics survive anything short
  * of deleting the chat). Use deleteSession() to drop the chat entirely.
+ *
+ * The replaced backend session id is archived (see getArchivedSessions),
+ * never just discarded. Talon's own chat history is untouched: clearing
+ * it is a separate, explicit call.
  */
-export function resetSession(chatId: string): void {
+export function resetSession(chatId: string, reason = "reset"): void {
   const session = cache.get(chatId);
   const turns = session?.turns ?? 0;
   const name = session?.sessionName;
   const metrics = session?.metrics;
+  if (session?.sessionId) {
+    archiveSessionId({
+      chatId,
+      sessionId: session.sessionId,
+      reason,
+      at: Date.now(),
+      turns,
+      ...(session.lastModel ? { lastModel: session.lastModel } : {}),
+      ...(name ? { sessionName: name } : {}),
+    });
+  }
   removeSessionRow(chatId);
   const hasHistory =
     metrics &&