talon-agent 5.26.1 → 5.26.2

package/src/frontend/discord/commands/admin.ts

@@ -32,6 +32,7 @@ import {
 import {
   getRepoRoot,
   runSelfUpdate,
+  describeCheckpoint,
 } from "../../../core/update/self-update.js";
 import { reply } from "./interaction.js";
 
@@ -153,7 +154,8 @@ export async function handleDream(
 }
 
 /**
- * /update — pull, reinstall, run setup, restart. Only reachable on developer
+ * /update [force] — pull, reinstall, run setup, restart. Refused when the
+ * pre-update checkpoint fails unless `force` is set. Only reachable on developer
  * builds running from a git checkout; the command is not registered at all
  * otherwise (see buildCommandDefinitions).
  */
@@ -172,8 +174,13 @@ export async function handleUpdate(
   }
   const remote = config.update?.remote ?? "origin";
   const branch = config.update?.branch ?? "main";
+  const force = i.options.getBoolean("force") ?? false;
   await i.deferReply({ flags: MessageFlags.Ephemeral });
-  await i.editReply(`⏳ Updating from \`${remote}/${branch}\`…`);
+  await i.editReply(
+    `⏳ Updating from \`${remote}/${branch}\`` +
+      (force ? " (forced: a failed checkpoint will not stop it)" : "") +
+      "…",
+  );
   const edit = (text: string) => i.editReply(safeSlice(text, DISCORD_MAX_TEXT));
 
   // Fire-and-forget so the gateway keeps processing other interactions.
@@ -182,12 +189,24 @@ export async function handleUpdate(
     branch,
     setup: config.update?.setup,
     repoRoot,
+    force,
   })
     .then(async (res) => {
+      if (res.checkpointRefused) {
+        await edit(
+          `🛑 Update refused: ${res.error ?? "the pre-update checkpoint failed"}\n\n` +
+            "Run `/update force:true` to update without a checkpoint.",
+        );
+        return;
+      }
+      const note = res.checkpoint
+        ? `\n${describeCheckpoint(res.checkpoint)}`
+        : "";
       if (!res.ok) {
         const tail = res.steps[res.steps.length - 1]?.output ?? "";
         await edit(
           `⚠️ Update failed: ${res.error ?? "unknown error"}` +
+            note +
             (tail
               ? `\n\`\`\`\n${escapeForCodeBlock(tail.slice(-1200))}\n\`\`\``
               : ""),
@@ -201,7 +220,7 @@ export async function handleUpdate(
         return;
       }
       await edit(
-        `✅ Updated \`${res.before ?? "?"}\` → \`${res.after ?? "?"}\`. ♻️ Restarting…`,
+        `✅ Updated \`${res.before ?? "?"}\` → \`${res.after ?? "?"}\`.${note}\n♻️ Restarting…`,
       );
       // The successor documents any provisioning changes (plugin runtime
       // upgrades, migrations) back to this channel once it's up.

package/src/frontend/discord/commands/definitions.ts

@@ -156,6 +156,13 @@ function buildCommandDefinitions(devBuild = false): unknown[] {
           new SlashCommandBuilder()
             .setName("update")
             .setDescription("Pull latest, reinstall, restart (admin)")
+            .addBooleanOption((o) =>
+              o
+                .setName("force")
+                .setDescription(
+                  "Update even if the pre-update checkpoint fails",
+                ),
+            )
             .toJSON(),
         ]
       : []),

package/src/frontend/telegram/commands/admin.ts

@@ -11,8 +11,10 @@ import type { TalonConfig } from "../../../core/config/index.js";
 import { respawnSelf } from "../../../core/daemon/respawn.js";
 import { isStaleCommand } from "../polling/stale-command.js";
 import {
+  describeCheckpoint,
   getRepoRoot,
   runSelfUpdate,
+  wantsForce,
 } from "../../../core/update/self-update.js";
 import { forceDream } from "../../../core/background/dream/index.js";
 import { escapeHtml } from "../formatting.js";
@@ -169,7 +171,8 @@ function registerRestartCommand(bot: Bot): void {
   });
 }
 
-// /update — pull latest, reinstall, run setup, restart. Only wired
+// /update [force] — pull latest, reinstall, run setup, restart. Refused
+// when the pre-update checkpoint fails unless "force" is given. Only wired
 // up for developer builds running from a git checkout; packaged
 // binaries have no source tree (getRepoRoot() === null) so the
 // command stays absent entirely.
@@ -187,8 +190,11 @@ function registerUpdateCommand(
     if (isStaleCommand(ctx.message?.date, "/update")) return;
     const remote = config.update?.remote ?? "origin";
     const branch = config.update?.branch ?? "main";
+    const force = wantsForce(typeof ctx.match === "string" ? ctx.match : "");
     const sent = await ctx.reply(
-      `⏳ Updating from <code>${escapeHtml(remote)}/${escapeHtml(branch)}</code>…`,
+      `⏳ Updating from <code>${escapeHtml(remote)}/${escapeHtml(branch)}</code>` +
+        (force ? " (forced: a failed checkpoint will not stop it)" : "") +
+        "…",
       { parse_mode: "HTML" },
     );
     const edit = (text: string) =>
@@ -204,12 +210,24 @@ function registerUpdateCommand(
       branch,
       setup: config.update?.setup,
       repoRoot: updateRepoRoot,
+      force,
     })
       .then(async (res) => {
+        if (res.checkpointRefused) {
+          await edit(
+            `🛑 Update refused: ${escapeHtml(res.error ?? "the pre-update checkpoint failed")}\n\n` +
+              `Send <code>/update force</code> to update without a checkpoint.`,
+          );
+          return;
+        }
+        const note = res.checkpoint
+          ? `\n${escapeHtml(describeCheckpoint(res.checkpoint))}`
+          : "";
         if (!res.ok) {
           const tail = res.steps[res.steps.length - 1]?.output ?? "";
           await edit(
             `⚠️ Update failed: ${escapeHtml(res.error ?? "unknown error")}` +
+              note +
               (tail ? `\n\n<pre>${escapeHtml(tail.slice(-1500))}</pre>` : ""),
           );
           return;
@@ -221,7 +239,7 @@ function registerUpdateCommand(
           return;
         }
         await edit(
-          `✅ Updated <code>${escapeHtml(res.before ?? "?")}</code> → <code>${escapeHtml(res.after ?? "?")}</code>. ♻️ Restarting…`,
+          `✅ Updated <code>${escapeHtml(res.before ?? "?")}</code> → <code>${escapeHtml(res.after ?? "?")}</code>.${note}\n♻️ Restarting…`,
         );
         // The successor documents any provisioning changes (plugin
         // runtime upgrades, migrations) back to this chat once it's up.

package/src/storage/backup/index.ts

@@ -22,7 +22,7 @@ import * as repo from "./repo.js";
  * handle stays inside storage/ (`db-handle-stays-in-storage`), and a
  * snapshot of the database is a storage concern with a storage API.
  */
-export { snapshotDatabase, snapshotSqliteFile } from "../db.js";
+export { databasePath, snapshotDatabase, snapshotSqliteFile } from "../db.js";
 
 export type { BackupRecord, BackupRemoteRecord } from "./repo.js";
 import type { BackupRecord, BackupRemoteRecord } from "./repo.js";

package/src/storage/chat-settings.ts

@@ -313,6 +313,19 @@ export function clearAllChatModels(chatId: string): void {
   persist(chatId);
 }
 
+/**
+ * Drop only the legacy single-slot `model` field, keeping every
+ * per-backend pick. The boot reconcile uses it: a stale legacy value must
+ * go, but the picks the chat made on other backends are still good.
+ */
+export function clearLegacyChatModel(chatId: string): void {
+  const entry = cache.get(chatId);
+  if (!entry || entry.model === undefined) return;
+  delete entry.model;
+  cleanupEmpty(chatId);
+  persist(chatId);
+}
+
 /**
  * @deprecated Prefer `setChatModelForBackend(chatId, backendId, model)`
  * which is explicit about which backend's slot is being mutated.

package/src/storage/db.ts

@@ -145,6 +145,11 @@ function defaultPath(): string {
   return process.env.TALON_DB_PATH || files.database;
 }
 
+/** Where the process-wide database lives (or will, once opened). */
+export function databasePath(): string {
+  return defaultPath();
+}
+
 /**
  * Open (or return) the process-wide database. The first call wins the
  * path; tests pass an explicit tmp path and call closeDatabase() in

package/src/storage/media-index.ts

@@ -48,15 +48,16 @@ function isMediaEntry(value: unknown): value is MediaEntry {
 
 /**
  * Run the one-time import of the legacy JSON store, then sweep
- * expired entries. Idempotent; called once at boot.
+ * expired entries (unless `purgeExpired: false` — a boot with no safety
+ * checkpoint deletes nothing). Idempotent; called once at boot.
  */
-export function loadMediaIndex(): void {
+export function loadMediaIndex(options: { purgeExpired?: boolean } = {}): void {
   try {
     importLegacyMediaIndex();
   } catch (err) {
     logError("media", "Media index load failed", err);
   }
-  purgeExpired();
+  if (options.purgeExpired !== false) purgeExpired();
 }
 
 /** Legacy shape: bare MediaEntry[]. */

package/src/storage/sessions.ts

@@ -23,6 +23,7 @@ import { recordError } from "../util/watchdog.js";
 import { files } from "../util/paths.js";
 import { importLegacyJson } from "./legacy-import.js";
 import { dbErrorFields } from "./db.js";
+import { kvGet, kvSet } from "./kv.js";
 import * as repo from "./repositories/sessions-repo.js";
 
 export type {
@@ -534,18 +535,76 @@ function removeSessionRow(chatId: string): void {
   }
 }
 
+// ── Replaced-session archive ───────────────────────────────────────────────
+
+/** A backend session id a reset replaced — kept so it can be re-linked. */
+export type ArchivedSession = {
+  chatId: string;
+  sessionId: string;
+  /** Why the session was replaced ("reset", "backend-unavailable", …). */
+  reason: string;
+  /** When it was replaced (ms epoch). */
+  at: number;
+  turns: number;
+  lastModel?: string;
+  sessionName?: string;
+};
+
+const SESSION_ARCHIVE_KEY = "sessions.archive";
+/** Newest entries kept; the transcripts themselves stay on disk regardless. */
+const SESSION_ARCHIVE_MAX = 500;
+
+/**
+ * Remember a session id that is about to be dropped. A reset used to
+ * forget it outright, leaving the backend transcript on disk with nothing
+ * pointing at it; with the id kept, a chat reset by mistake (or by a boot
+ * reconcile) can be re-linked to its old conversation. Never throws.
+ */
+function archiveSessionId(entry: ArchivedSession): void {
+  try {
+    const prior = kvGet<ArchivedSession[]>(SESSION_ARCHIVE_KEY);
+    const list = Array.isArray(prior) ? prior : [];
+    list.push(entry);
+    kvSet(SESSION_ARCHIVE_KEY, list.slice(-SESSION_ARCHIVE_MAX));
+  } catch (err) {
+    logError("sessions", `Failed to archive session chat=${entry.chatId}`, err);
+  }
+}
+
+/** Archived (replaced) session ids, oldest first; one chat's when given. */
+export function getArchivedSessions(chatId?: string): ArchivedSession[] {
+  const list = kvGet<ArchivedSession[]>(SESSION_ARCHIVE_KEY);
+  if (!Array.isArray(list)) return [];
+  return chatId ? list.filter((e) => e.chatId === chatId) : list;
+}
+
 /**
  * Reset the chat's conversation state (backend session id, turns, usage)
  * while carrying its metrics forward. Resets fire on /new, model switches
  * and error recovery — none of which should erase the chat's accounting
  * history (that's what makes per-session metrics survive anything short
  * of deleting the chat). Use deleteSession() to drop the chat entirely.
+ *
+ * The replaced backend session id is archived (see getArchivedSessions),
+ * never just discarded. Talon's own chat history is untouched: clearing
+ * it is a separate, explicit call.
  */
-export function resetSession(chatId: string): void {
+export function resetSession(chatId: string, reason = "reset"): void {
   const session = cache.get(chatId);
   const turns = session?.turns ?? 0;
   const name = session?.sessionName;
   const metrics = session?.metrics;
+  if (session?.sessionId) {
+    archiveSessionId({
+      chatId,
+      sessionId: session.sessionId,
+      reason,
+      at: Date.now(),
+      turns,
+      ...(session.lastModel ? { lastModel: session.lastModel } : {}),
+      ...(name ? { sessionName: name } : {}),
+    });
+  }
   removeSessionRow(chatId);
   const hasHistory =
     metrics &&