talon-agent 5.26.1 → 5.26.3

package/README.md

@@ -468,6 +468,7 @@ talon kill      Abort a killable task by id
 talon events    Tail the event bus (-f follows, --history [N] reads the journal)
 talon plugin    Manage plugins (install / enable / disable / remove)
 talon skill     Manage skills (install / enable / disable / remove)
+talon history   Chat history kept by Talon (show / hidden / purge — docs/chat-history.md)
 talon config    View or edit configuration
 talon logs      Tail structured log file
 talon doctor    Validate environment and dependencies

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "talon-agent",
-  "version": "5.26.1",
+  "version": "5.26.3",
   "description": "Multi-frontend AI agent with full tool access, streaming, cron jobs, and plugin system",
   "author": "The Falconry",
   "license": "Apache-2.0",

package/src/app.ts

@@ -167,8 +167,49 @@ const restoreReport = await withConfigGuard(() =>
   bootPhase("staged restore", applyStagedRestore),
 );
 
+/**
+ * The first boot of a new version (a Docker/TrueNAS image pull, an npm or
+ * binary upgrade — anything but `/update`, which checkpoints itself) takes
+ * a pinned `pre-upgrade <old>→<new>` checkpoint HERE: after a staged
+ * restore, before bootstrap opens the stores and the backend reconcile or
+ * any migration runs against them. A failed checkpoint alerts the admin
+ * and still boots, but with the destructive boot steps skipped.
+ *
+ * Never throws.
+ */
+async function checkpointIfUpgraded(): Promise<{ safe: boolean }> {
+  try {
+    const { checkpointOnVersionChange } =
+      await import("./core/backup/index.js");
+    const { loadConfig } = await import("./core/config/index.js");
+    const { resolveBackupSettings } = await import("./core/backup/plan.js");
+    const { talonVersion } = await import("./util/version.js");
+    const result = await checkpointOnVersionChange({
+      settings: resolveBackupSettings(loadConfig().backup),
+      version: talonVersion(),
+    });
+    return { safe: result.status !== "failed" };
+  } catch (err) {
+    if (err instanceof ConfigFileError) throw err;
+    logError("backup", "Pre-upgrade version check failed", err);
+    const { raiseAlert } = await import("./core/frontend-runtime/alerts.js");
+    raiseAlert(
+      "backup.upgrade-checkpoint",
+      `The boot-time version check / pre-upgrade checkpoint crashed: ${String(err)}. Booted without it; boot-time cleanup skipped.`,
+      { severity: "critical" },
+    );
+    return { safe: false };
+  }
+}
+
+const upgrade = await withConfigGuard(() =>
+  bootPhase("upgrade checkpoint", checkpointIfUpgraded),
+);
+
 const { config } = await withConfigGuard(() =>
-  bootPhase("bootstrap", () => bootstrap()),
+  bootPhase("bootstrap", () =>
+    bootstrap({ skipDestructiveSteps: !upgrade.safe }),
+  ),
 );
 
 // Record this process as the daemon. The gateway port is appended once

package/src/bootstrap.ts

@@ -15,7 +15,7 @@ import { loadSessions, resetSession } from "./storage/sessions.js";
 import { loadChatSettings } from "./storage/chat-settings.js";
 import { loadCronJobs } from "./storage/cron.js";
 import { loadTriggers } from "./storage/triggers.js";
-import { clearHistory, loadHistory } from "./storage/history.js";
+import { loadHistory } from "./storage/history.js";
 import { loadMediaIndex } from "./storage/media-index.js";
 import { cleanupOldLogs } from "./storage/daily-log.js";
 import {
@@ -90,6 +90,12 @@ function resolveFrontendByNumericId(
 export type BootstrapOptions = {
   /** Override frontend names for plugin loading (e.g. ["terminal"]). */
   frontendNames?: string[];
+  /**
+   * Skip the boot steps that delete data (expired daily logs and memory
+   * notes, expired media). Set when the pre-upgrade checkpoint failed:
+   * with no snapshot to fall back on, this boot deletes nothing.
+   */
+  skipDestructiveSteps?: boolean;
 };
 
 export type BootstrapResult = {
@@ -165,9 +171,16 @@ export async function bootstrap(
     loadCronJobs();
     loadTriggers();
     loadHistory();
-    loadMediaIndex();
+    loadMediaIndex({ purgeExpired: !options.skipDestructiveSteps });
   });
-  cleanupOldLogs();
+  if (options.skipDestructiveSteps) {
+    logWarn(
+      "bot",
+      "Skipping boot-time cleanup (old daily logs, expired media): no pre-upgrade checkpoint to fall back on",
+    );
+  } else {
+    cleanupOldLogs();
+  }
 
   return { config };
 }
@@ -195,89 +208,191 @@ type ChatBindingDeps = {
   getBackendIdForChat: (chatId: string) => string;
   getBackendForChat: (chatId: string) => Backend;
   isModelValidForBackend: (backend: Backend, model: string) => Promise<boolean>;
+  /**
+   * Tell the operator what the reconcile changed — once per boot, one
+   * message for every chat. Defaults to an operator alert.
+   */
+  notify?: (text: string) => void;
 };
 
 const CHAT_BINDING_CONCURRENCY = 8;
 const REBIND_RETRY_DELAY_MS = 1_500;
+const ONE_MILLION_SUFFIX = /\s*\[1m\]$/i;
 
 /**
  * Re-establish every chat's stored backend/model override against the
  * backends this boot actually has. Chats are independent, so they are
  * reconciled `CHAT_BINDING_CONCURRENCY` at a time; a shared backend that
  * two chats need at once is initialised exactly once by the pool.
+ *
+ * Never deletes chat history. A stale override is corrected (remapped to
+ * the closest valid id, or cleared so the backend default serves) and the
+ * operator is told once, naming every chat that changed. Only a chat whose
+ * backend is gone gets a fresh backend session — its old session id is
+ * archived by `resetSession`, and its history rows stay.
  */
 export async function reconcileChatBindings(
   config: TalonConfig,
   deps: ChatBindingDeps,
 ): Promise<void> {
   const { getAllChatSettings } = await import("./storage/chat-settings.js");
+  const changes: string[] = [];
   await mapConcurrent(
     Object.entries(getAllChatSettings()),
     CHAT_BINDING_CONCURRENCY,
-    ([cid, settings]) => reconcileChatBinding(cid, settings, config, deps),
+    async ([cid, settings]) => {
+      const change = await reconcileChatBinding(cid, settings, config, deps);
+      if (change) changes.push(`• ${cid}: ${change}`);
+    },
+  );
+  if (changes.length === 0) return;
+  const text =
+    `Boot reconcile adjusted ${changes.length} chat(s) whose pinned backend/model ` +
+    `is no longer available (chat history kept):\n${changes.sort().join("\n")}`;
+  logWarn("bot", text);
+  (deps.notify ?? defaultReconcileNotify)(text);
+}
+
+function defaultReconcileNotify(text: string): void {
+  void import("./core/frontend-runtime/alerts.js").then(({ raiseAlert }) =>
+    raiseAlert("chat-bindings.reconciled", text, { severity: "warn" }),
   );
 }
 
+/**
+ * The closest valid id for a model the catalog no longer lists, or null.
+ * Today: `<id>[1m]` → `<id>` (SDK catalogs stopped enumerating the 1M
+ * context variants), so a chat keeps its model family instead of being
+ * dropped to the backend default.
+ */
+async function remapModelAlias(
+  backend: Backend,
+  model: string,
+  deps: ChatBindingDeps,
+): Promise<string | null> {
+  if (!ONE_MILLION_SUFFIX.test(model)) return null;
+  const stem = model.replace(ONE_MILLION_SUFFIX, "").trim();
+  if (!stem) return null;
+  return (await deps.isModelValidForBackend(backend, stem)) ? stem : null;
+}
+
+/**
+ * Reconcile one chat. Returns a short description of what changed, or
+ * null when nothing did.
+ */
 async function reconcileChatBinding(
   cid: string,
   settings: { backend?: string; model?: string },
   config: TalonConfig,
   deps: ChatBindingDeps,
-): Promise<void> {
-  const { getAllChatSettings, setChatBackend, setChatModel } =
-    await import("./storage/chat-settings.js");
-  let resetVolatileState = false;
+): Promise<string | null> {
+  const changes: string[] = [];
   if (settings.backend) {
-    if (!deps.isBackendAvailable(settings.backend, config)) {
-      log(
-        "bot",
-        `Per-chat backend ${settings.backend} for ${cid} is no longer available — resetting chat to default backend`,
-      );
-      await deps.releaseChat(cid);
-      setChatBackend(cid, undefined);
-      setChatModel(cid, undefined);
-      resetVolatileState = true;
-    } else {
-      let result = await deps.rebindChat(cid, settings.backend, config);
-      if (!result.ok) {
-        await new Promise((r) => setTimeout(r, REBIND_RETRY_DELAY_MS));
-        result = await deps.rebindChat(cid, settings.backend, config);
-      }
-      if (!result.ok) {
-        log(
-          "bot",
-          `Per-chat backend rebind failed for ${cid} → ${settings.backend}: ${result.error} — keeping the setting; will serve on the default backend until re-selected`,
-        );
-      }
-    }
+    const change = await reconcileChatBackend(
+      cid,
+      settings.backend,
+      config,
+      deps,
+    );
+    if (change) changes.push(change);
   }
   const bindingMatchesSetting =
     !settings.backend || deps.getBackendIdForChat(cid) === settings.backend;
-  const currentModel = getAllChatSettings()[cid]?.model;
-  if (currentModel && bindingMatchesSetting) {
-    const be = deps.getBackendForChat(cid);
-    try {
-      const valid = await deps.isModelValidForBackend(be, currentModel);
-      if (!valid) {
-        log(
-          "bot",
-          `Per-chat model ${currentModel} for ${cid} is not valid for its backend — resetting model to default`,
-        );
-        setChatModel(cid, undefined);
-        resetVolatileState = true;
-      }
-    } catch (err) {
-      log(
+  if (bindingMatchesSetting) {
+    const change = await reconcileChatModel(cid, deps);
+    if (change) changes.push(change);
+  }
+  return changes.length > 0 ? changes.join("; ") : null;
+}
+
+async function reconcileChatBackend(
+  cid: string,
+  backendId: string,
+  config: TalonConfig,
+  deps: ChatBindingDeps,
+): Promise<string | null> {
+  const { setChatBackend, clearLegacyChatModel } =
+    await import("./storage/chat-settings.js");
+  if (!deps.isBackendAvailable(backendId, config)) {
+    logWarn(
+      "bot",
+      `Per-chat backend ${backendId} for ${cid} is no longer available — serving the chat on the default backend (history kept)`,
+    );
+    await deps.releaseChat(cid);
+    setChatBackend(cid, undefined);
+    // The per-backend model picks stay: they are keyed by backend, so the
+    // default backend's pick (if any) still applies and the vanished
+    // backend's comes back with it. Only the unkeyed legacy slot goes.
+    clearLegacyChatModel(cid);
+    // The stored session belongs to the vanished backend and cannot resume
+    // on another one. resetSession archives its id; history is untouched.
+    resetSession(cid, "backend-unavailable");
+    return `backend ${backendId} unavailable → default backend`;
+  }
+  let result = await deps.rebindChat(cid, backendId, config);
+  if (!result.ok) {
+    await new Promise((r) => setTimeout(r, REBIND_RETRY_DELAY_MS));
+    result = await deps.rebindChat(cid, backendId, config);
+  }
+  if (!result.ok) {
+    log(
+      "bot",
+      `Per-chat backend rebind failed for ${cid} → ${backendId}: ${result.error} — keeping the setting; will serve on the default backend until re-selected`,
+    );
+  }
+  return null;
+}
+
+/**
+ * Check the chat's pinned model against the backend that serves it.
+ * The unkeyed legacy slot is remapped or cleared when stale; a per-backend
+ * pick is only ever remapped (the send-time resolver already falls back
+ * past a stale one, and a catalog that failed to load must not erase it).
+ * The backend session is kept either way: a resume under a different
+ * model is fine, and the conversation is the point.
+ */
+async function reconcileChatModel(
+  cid: string,
+  deps: ChatBindingDeps,
+): Promise<string | null> {
+  const {
+    getAllChatSettings,
+    getChatModelForBackend,
+    setChatModelForBackend,
+    clearLegacyChatModel,
+  } = await import("./storage/chat-settings.js");
+  const backendId = deps.getBackendIdForChat(cid);
+  const legacy = getAllChatSettings()[cid]?.model;
+  const model = legacy ?? getChatModelForBackend(cid, backendId);
+  if (!model) return null;
+  const be = deps.getBackendForChat(cid);
+  try {
+    if (await deps.isModelValidForBackend(be, model)) return null;
+    const remapped = await remapModelAlias(be, model, deps);
+    if (remapped) {
+      setChatModelForBackend(cid, backendId, remapped);
+      if (legacy) clearLegacyChatModel(cid);
+      logWarn(
         "bot",
-        `Per-chat model validation failed for ${cid} (${currentModel}): ${
-          err instanceof Error ? err.message : String(err)
-        } — keeping stored model`,
+        `Per-chat model ${model} for ${cid} is not in the ${backendId} catalog — remapped to ${remapped} (history and session kept)`,
       );
+      return `model ${model} → ${remapped}`;
     }
-  }
-  if (resetVolatileState) {
-    resetSession(cid);
-    clearHistory(cid);
+    if (!legacy) return null;
+    clearLegacyChatModel(cid);
+    logWarn(
+      "bot",
+      `Per-chat model ${model} for ${cid} is not valid for its backend — falling back to the backend default (history and session kept)`,
+    );
+    return `model ${model} unavailable → backend default`;
+  } catch (err) {
+    log(
+      "bot",
+      `Per-chat model validation failed for ${cid} (${model}): ${
+        err instanceof Error ? err.message : String(err)
+      } — keeping stored model`,
+    );
+    return null;
   }
 }
 
@@ -370,11 +485,10 @@ export async function initBackendAndDispatcher(
   );
 
   // Re-acquire any persisted per-chat backend/model overrides so chats
-  // resume exactly where they were before restart. If a backend has
-  // since been disabled/removed, or the stored model is no longer valid
-  // for the backend that would serve it, clear the override and reset
-  // volatile chat state so the next user message starts a fresh default
-  // session instead of crashing on an orphaned model id.
+  // resume exactly where they were before restart. A backend that has
+  // since gone, or a stored model its backend no longer lists, is
+  // corrected (remapped or cleared to the default) — never by deleting
+  // the chat's history. See reconcileChatBindings.
   await bootPhase("chat bindings", () =>
     reconcileChatBindings(config, {
       isBackendAvailable,

package/src/cli/commands/backup.ts

@@ -271,7 +271,10 @@ async function backupStatus(): Promise<void> {
     renderResult(result);
     return;
   }
-  const status = await collectBackupStatus({ withTargets: false });
+  const status = await collectBackupStatus({
+    withTargets: false,
+    settings: resolveBackupSettings(loadConfig().backup),
+  });
   console.log(
     `\n${formatBackupStatus(status)
       .split("\n")

package/src/cli/commands/history.ts

@@ -0,0 +1,152 @@
+/**
+ * `talon history` — the operator's view of chat history the daemon keeps.
+ *
+ * Talon never deletes chat history on its own: /reset is a soft reset
+ * (a context marker), backend switches leave history alone, and deleting a
+ * chat in the app only hides it. `purge` is the one way to delete rows for
+ * real — host access only (it is not reachable from any chat), and it asks
+ * for the chat id to be typed back before touching anything.
+ */
+
+import { createInterface } from "node:readline/promises";
+import pc from "picocolors";
+import {
+  getChatHistoryState,
+  getHistoryStats,
+  listHiddenChats,
+  purgeChatHistory,
+} from "../../storage/history.js";
+import { clearTurnMeta } from "../../storage/turn-meta.js";
+
+const USAGE = [
+  `  Usage: ${pc.cyan("talon history <command>")}`,
+  "",
+  "  Commands:",
+  `    ${pc.cyan("show <chatId>")}           Row count, date range, reset/hidden state`,
+  `    ${pc.cyan("hidden")}                  Chats deleted in a client (rows kept)`,
+  `    ${pc.cyan("purge <chatId> [--yes]")}  PERMANENTLY delete a chat's history`,
+  "",
+  "  Resets, backend switches and chat deletion never delete history;",
+  `  ${pc.cyan("purge")} is the only command that does. Take a checkpoint first:`,
+  `  ${pc.cyan('talon backup now --checkpoint "before purge"')}`,
+  "",
+].join("\n");
+
+/** Reads one line from stdin; injectable so tests can answer the prompt. */
+export type HistoryCliIo = {
+  ask: (question: string) => Promise<string>;
+  print: (line: string) => void;
+};
+
+const defaultIo: HistoryCliIo = {
+  ask: async (question) => {
+    const rl = createInterface({
+      input: process.stdin,
+      output: process.stdout,
+    });
+    try {
+      return await rl.question(question);
+    } finally {
+      rl.close();
+    }
+  },
+  print: (line) => console.log(line),
+};
+
+function date(ms: number | undefined): string {
+  return ms ? new Date(ms).toISOString() : "—";
+}
+
+function cmdShow(chatId: string, io: HistoryCliIo): void {
+  const stats = getHistoryStats(chatId);
+  const state = getChatHistoryState(chatId);
+  io.print(`  ${pc.bold(chatId)}`);
+  io.print(
+    `    ${stats.totalMessages} message(s), ${stats.uniqueUsers} sender(s), ` +
+      `${date(stats.oldestTimestamp || undefined)} → ${date(stats.newestTimestamp || undefined)}`,
+  );
+  if (state?.clearedAt !== undefined) {
+    io.print(`    context reset at ${date(state.clearedAt)} (rows kept)`);
+  }
+  if (state?.hiddenAt !== undefined) {
+    io.print(`    deleted in a client at ${date(state.hiddenAt)} (rows kept)`);
+  }
+  io.print("");
+}
+
+function cmdHidden(io: HistoryCliIo): void {
+  const chats = listHiddenChats();
+  if (chats.length === 0) {
+    io.print(`  ${pc.dim("No hidden chats.")}\n`);
+    return;
+  }
+  for (const chat of chats) {
+    io.print(
+      `  ${pc.bold(chat.chatId)}  ${chat.total} message(s)  ${pc.dim(`hidden ${date(chat.hiddenAt)}`)}`,
+    );
+  }
+  io.print("");
+}
+
+/**
+ * Delete a chat's history for good. Without `--yes` the operator must type
+ * the chat id back; anything else aborts. Returns rows deleted (0 when
+ * aborted or empty).
+ */
+async function cmdPurge(
+  chatId: string,
+  yes: boolean,
+  io: HistoryCliIo,
+): Promise<number> {
+  const { totalMessages } = getHistoryStats(chatId);
+  if (totalMessages === 0 && getChatHistoryState(chatId) === undefined) {
+    io.print(`  ${pc.dim(`No history stored for ${chatId}.`)}\n`);
+    return 0;
+  }
+  if (!yes) {
+    io.print(
+      `\n  This PERMANENTLY deletes ${pc.bold(String(totalMessages))} message(s) of chat ${pc.bold(chatId)}.\n` +
+        `  It cannot be undone except from a backup. Take a checkpoint first:\n` +
+        `    ${pc.cyan('talon backup now --checkpoint "before purge"')}\n`,
+    );
+    const answer = (await io.ask(`  Type the chat id to confirm: `)).trim();
+    if (answer !== chatId) {
+      io.print(`  ${pc.yellow("●")} Aborted — nothing deleted.\n`);
+      return 0;
+    }
+  }
+  const deleted = purgeChatHistory(chatId);
+  clearTurnMeta(chatId);
+  io.print(`  ${pc.green("●")} Purged ${deleted} message(s) from ${chatId}.\n`);
+  return deleted;
+}
+
+/** Route a `talon history <command>` invocation. */
+export async function runHistoryCommand(
+  args: readonly string[],
+  io: HistoryCliIo = defaultIo,
+): Promise<void> {
+  const positional = args.filter((a) => !a.startsWith("--"));
+  const yes = args.includes("--yes");
+  const chatId = positional[1];
+  try {
+    switch (positional[0]) {
+      case "show":
+        if (!chatId) io.print(`  ${pc.red("✖")} show needs a chat id\n`);
+        else cmdShow(chatId, io);
+        break;
+      case "hidden":
+        cmdHidden(io);
+        break;
+      case "purge":
+        if (!chatId) io.print(`  ${pc.red("✖")} purge needs a chat id\n`);
+        else await cmdPurge(chatId, yes, io);
+        break;
+      default:
+        io.print(USAGE);
+    }
+  } catch (err) {
+    io.print(`  ${pc.red("✖")} ${err instanceof Error ? err.message : err}`);
+    process.exitCode = 1;
+  }
+}

package/src/cli/index.ts

@@ -37,6 +37,7 @@ import { showEvents } from "./events.js";
 import { runPluginCommand } from "./plugin.js";
 import { runSkillCommand } from "./skill.js";
 import { runMemoryCommand } from "./memory.js";
+import { runHistoryCommand } from "./commands/history.js";
 import { mainMenu } from "./menu.js";
 import { runBackupCommand } from "./commands/backup.js";
 import { runMeshCommand } from "./commands/mesh.js";
@@ -62,6 +63,7 @@ const CLI_COMMANDS = [
   "plugin",
   "skill",
   "memory",
+  "history",
   "backup",
   "mesh",
 ];
@@ -109,6 +111,9 @@ function printHelp(): void {
   console.log(
     `    ${pc.cyan("memory")}     Read/edit the memory store (list/search/import/render)`,
   );
+  console.log(
+    `    ${pc.cyan("history")}    Chat history kept by Talon (show/hidden/purge)`,
+  );
   console.log(
     `    ${pc.cyan("backup")}     Snapshots and checkpoints (now/list/show/pin/restore)`,
   );
@@ -180,6 +185,7 @@ const COMMANDS: Record<string, CommandHandler> = {
   plugin: (args) => runPluginCommand(args),
   skill: (args) => runSkillCommand(args),
   memory: (args) => runMemoryCommand(args),
+  history: (args) => runHistoryCommand(args),
   "--version": () => console.log(pkg.version),
   "-v": () => console.log(pkg.version),
   "--help": () => printHelp(),