talon-agent 5.26.1 → 5.26.3

package/src/core/update/self-update.ts

@@ -27,10 +27,19 @@
  * can never leave the deployment un-updatable, which is what the old
  * `pull --ff-only` did (it aborts on any dirty/diverged tree). `.gitignore`
  * is respected (no `-x`), so node_modules, secrets and local config survive.
+ *
+ * Before anything in the checkout moves, a pinned pre-update checkpoint is
+ * taken. If it fails, the update is refused. An update with no way back is
+ * when data goes missing, so the operator must say `force` to go on
+ * without one. Opting out in config (`backup.checkpointBeforeUpdate:
+ * false`) is the only way to skip it without being asked.
  */
 
 import { execFile } from "node:child_process";
-import { checkpointBeforeUpdate } from "../backup/index.js";
+import {
+  checkpointBeforeUpdate,
+  type UpdateCheckpoint,
+} from "../backup/index.js";
 import { existsSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -60,6 +69,13 @@ export interface UpdateOptions {
   entry?: { cmd: string; args: readonly string[] };
   /** Injectable command runner (tests). */
   runner?: CommandRunner;
+  /**
+   * Go on even when the pre-update checkpoint fails (`/update force`).
+   * The result still says the checkpoint failed.
+   */
+  force?: boolean;
+  /** Injectable pre-update checkpoint (tests). */
+  checkpoint?: (from: string, to: string) => Promise<UpdateCheckpoint>;
 }
 
 /** One executed step in an update run. */
@@ -82,6 +98,13 @@ export interface UpdateResult {
   changed: boolean;
   /** Human-readable failure reason when `ok` is false. */
   error?: string;
+  /** The pre-update checkpoint, when the update got far enough to take one. */
+  checkpoint?: UpdateCheckpoint;
+  /**
+   * True when the update was refused because the checkpoint failed. Nothing
+   * in the checkout was touched; `force` would have gone on.
+   */
+  checkpointRefused?: boolean;
 }
 
 export type CommandRunner = (
@@ -171,12 +194,7 @@ export async function runSelfUpdate(
   const branch = opts.branch?.trim() || "main";
   const run = opts.runner ?? defaultRunner;
 
-  const record = async (
-    label: string,
-    cmd: string,
-    args: readonly string[],
-    timeoutMs: number,
-  ): Promise<UpdateStep> => {
+  const record: Recorder = async (label, cmd, args, timeoutMs) => {
     const { ok, output } = await run(cmd, args, repoRoot, timeoutMs);
     const step: UpdateStep = { label, ok, output };
     steps.push(step);
@@ -210,22 +228,58 @@ export async function runSelfUpdate(
   );
   if (!fetch.ok) return fail(`git fetch failed: ${fetch.output}`, before);
 
+  // Where the update is going, read before the tree moves: the checkpoint
+  // is labelled with it, and "already up to date" needs no checkpoint.
+  const targetRef = `${remote}/${branch}`;
+  const target = await record(
+    `rev-parse ${targetRef}`,
+    "git",
+    ["rev-parse", targetRef],
+    GIT_TIMEOUT_MS,
+  );
+  if (!target.ok) {
+    return fail(`Failed to read ${targetRef}: ${target.output}`, before);
+  }
+  const upcoming = shortSha(target.output);
+
+  // The safety net goes up before anything is destroyed: the reset and
+  // clean below discard local state, and the new code may migrate data.
+  let checkpoint: UpdateCheckpoint | undefined;
+  if (upcoming !== before) {
+    checkpoint = await (opts.checkpoint ?? checkpointBeforeUpdate)(
+      before,
+      upcoming,
+    );
+    steps.push({
+      label: "pre-update checkpoint",
+      ok: checkpoint.status !== "failed",
+      output: describeCheckpoint(checkpoint),
+    });
+    if (checkpoint.status === "failed" && !opts.force) {
+      return {
+        ...fail(refusal(checkpoint.error), before),
+        checkpoint,
+        checkpointRefused: true,
+      };
+    }
+  }
+
   // Force the checkout to exactly match the freshly-fetched remote
   // branch, discarding ANY local edits or diverged commits. The old
   // `pull --ff-only` aborted here whenever the tree was dirty, leaving the
   // deployment stuck; a bot host is meant to mirror the remote, so resetting
   // to it is both correct and reliable.
   const reset = await record(
-    `reset --hard ${remote}/${branch}`,
+    `reset --hard ${targetRef}`,
     "git",
-    ["reset", "--hard", `${remote}/${branch}`],
+    ["reset", "--hard", targetRef],
     GIT_TIMEOUT_MS,
   );
   if (!reset.ok) {
-    return fail(
-      `git reset --hard ${remote}/${branch} failed: ${reset.output}`,
-      before,
-    );
+    return {
+      ...fail(`git reset --hard ${targetRef} failed: ${reset.output}`, before),
+      checkpoint,
+    };
   }
 
   // Drop untracked files too so the tree is pristine and a future update
@@ -246,28 +300,62 @@ export async function runSelfUpdate(
   // Nothing moved — skip the expensive install/setup and tell the
   // caller no restart is needed.
   if (!changed) {
-    return { ok: true, repoRoot, steps, before, after, changed: false };
+    return {
+      ok: true,
+      repoRoot,
+      steps,
+      before,
+      after,
+      changed: false,
+      checkpoint,
+    };
   }
 
-  await checkpointBeforeUpdate(before, after);
+  const error = await installAndVerify(record, opts, before, after);
+  return {
+    ok: !error,
+    repoRoot,
+    steps,
+    before,
+    after,
+    changed: true,
+    checkpoint,
+    ...(error ? { error } : {}),
+  };
+}
+
+type Recorder = (
+  label: string,
+  cmd: string,
+  args: readonly string[],
+  timeoutMs: number,
+) => Promise<UpdateStep>;
 
+function refusal(error: string): string {
+  return (
+    `the pre-update checkpoint failed (${error}). ` +
+    `Nothing was changed. Fix the backup problem, or run the update ` +
+    `with "force" to go on without a checkpoint.`
+  );
+}
+
+/**
+ * Reinstall, run setup, and prove the new tree imports. Returns the
+ * failure reason, or null when the tree is ready to restart into.
+ */
+async function installAndVerify(
+  record: Recorder,
+  opts: UpdateOptions,
+  before: string,
+  after: string,
+): Promise<string | null> {
   const install = await record(
     "npm install",
     "npm",
     ["install"],
     INSTALL_TIMEOUT_MS,
   );
-  if (!install.ok) {
-    return {
-      ok: false,
-      repoRoot,
-      steps,
-      before,
-      after,
-      changed,
-      error: `npm install failed: ${install.output}`,
-    };
-  }
+  if (!install.ok) return `npm install failed: ${install.output}`;
 
   for (const cmd of opts.setup ?? []) {
     const trimmed = cmd.trim();
@@ -279,15 +367,7 @@ export async function runSelfUpdate(
       SETUP_TIMEOUT_MS,
     );
     if (!setup.ok) {
-      return {
-        ok: false,
-        repoRoot,
-        steps,
-        before,
-        after,
-        changed,
-        error: `setup command failed (${trimmed}): ${setup.output}`,
-      };
+      return `setup command failed (${trimmed}): ${setup.output}`;
     }
   }
 
@@ -299,18 +379,35 @@ export async function runSelfUpdate(
     VERIFY_TIMEOUT_MS,
   );
   if (!verify.ok || !verify.output.includes(BOOT_SMOKE_OK)) {
-    return {
-      ok: false,
-      repoRoot,
-      steps,
-      before,
-      after,
-      changed,
-      error:
-        `the updated tree does not import — not restarting into it. ` +
-        `Still running ${before}; the checkout is at ${after}.`,
-    };
+    return (
+      `the updated tree does not import — not restarting into it. ` +
+      `Still running ${before}; the checkout is at ${after}.`
+    );
+  }
+  return null;
+}
+
+/** One line for the step log and the chat reply. */
+export function describeCheckpoint(checkpoint: UpdateCheckpoint): string {
+  switch (checkpoint.status) {
+    case "taken":
+      return `checkpoint ${checkpoint.id} taken`;
+    case "disabled":
+      return "no checkpoint (backup.checkpointBeforeUpdate is off)";
+    case "failed":
+      return `checkpoint failed: ${checkpoint.error}`;
   }
+}
 
-  return { ok: true, repoRoot, steps, before, after, changed: true };
+/**
+ * Whether the arguments to `/update` ask to go on without a checkpoint.
+ * `force` and `--force` both work, so the chat command and a CLI habit
+ * read the same.
+ */
+export function wantsForce(args: string | undefined | null): boolean {
+  return (args ?? "")
+    .trim()
+    .toLowerCase()
+    .split(/\s+/)
+    .some((token) => token === "force" || token === "--force");
 }

package/src/frontend/discord/admin.ts

@@ -12,7 +12,7 @@ import { tailFile } from "../../util/tail-file.js";
 import type { TalonConfig } from "../../core/config/index.js";
 import type { Gateway } from "../../core/engine/gateway.js";
 import { resetSession, getAllSessions } from "../../storage/sessions.js";
-import { clearHistory } from "../../storage/history.js";
+import { markContextCleared } from "../../storage/history.js";
 import { todayLogDate } from "../../storage/daily-log.js";
 import { getChatSettings } from "../../storage/chat-settings.js";
 import {
@@ -87,7 +87,7 @@ export async function handleAdminSubcommand(
       const target = rest[0];
       if (!target) return send("Usage: /admin kill <chatId>");
       resetSession(target);
-      clearHistory(target);
+      markContextCleared(target); // soft reset: history rows are kept
       gateway?.backend?.sessions?.resetChat?.(target);
       return send(`Session ${target} reset.`);
     }

package/src/frontend/discord/callbacks/components/backend-select.ts

@@ -20,7 +20,6 @@ import {
   rebindChat,
 } from "../../../../core/engine/backend-controller/index.js";
 import { resetSession } from "../../../../storage/sessions.js";
-import { clearHistory } from "../../../../storage/history.js";
 import { resetPulseCheckpoint } from "../../../../core/background/pulse/pulse.js";
 import { resolveActiveModelForChat } from "../../../../core/models/active-model.js";
 import { logError } from "../../../../util/log.js";
@@ -109,12 +108,13 @@ export async function handleBackendSelect(
   }
 
   // Only now is the switch known to hold. Session state doesn't port across
-  // backends, so it goes — but each backend's remembered model pick stays.
+  // backends, so it goes — but each backend's remembered model pick stays,
+  // and chat history is never touched (a switch changes who answers, not
+  // what was said).
   // A re-pick of the backend already in use clears nothing: the retry after
   // a timed-out interaction must not cost the session a second time.
   if (!alreadyThere) {
-    resetSession(chatId);
-    clearHistory(chatId);
+    resetSession(chatId, "backend-switch");
     resetPulseCheckpoint(chatId);
     previous?.sessions?.resetChat?.(chatId);
   }

package/src/frontend/discord/commands/admin.ts

@@ -32,6 +32,7 @@ import {
 import {
   getRepoRoot,
   runSelfUpdate,
+  describeCheckpoint,
 } from "../../../core/update/self-update.js";
 import { reply } from "./interaction.js";
 
@@ -153,7 +154,8 @@ export async function handleDream(
 }
 
 /**
- * /update — pull, reinstall, run setup, restart. Only reachable on developer
+ * /update [force] — pull, reinstall, run setup, restart. Refused when the
+ * pre-update checkpoint fails unless `force` is set. Only reachable on developer
  * builds running from a git checkout; the command is not registered at all
  * otherwise (see buildCommandDefinitions).
  */
@@ -172,8 +174,13 @@ export async function handleUpdate(
   }
   const remote = config.update?.remote ?? "origin";
   const branch = config.update?.branch ?? "main";
+  const force = i.options.getBoolean("force") ?? false;
   await i.deferReply({ flags: MessageFlags.Ephemeral });
-  await i.editReply(`⏳ Updating from \`${remote}/${branch}\`…`);
+  await i.editReply(
+    `⏳ Updating from \`${remote}/${branch}\`` +
+      (force ? " (forced: a failed checkpoint will not stop it)" : "") +
+      "…",
+  );
   const edit = (text: string) => i.editReply(safeSlice(text, DISCORD_MAX_TEXT));
 
   // Fire-and-forget so the gateway keeps processing other interactions.
@@ -182,12 +189,24 @@ export async function handleUpdate(
     branch,
     setup: config.update?.setup,
     repoRoot,
+    force,
   })
     .then(async (res) => {
+      if (res.checkpointRefused) {
+        await edit(
+          `🛑 Update refused: ${res.error ?? "the pre-update checkpoint failed"}\n\n` +
+            "Run `/update force:true` to update without a checkpoint.",
+        );
+        return;
+      }
+      const note = res.checkpoint
+        ? `\n${describeCheckpoint(res.checkpoint)}`
+        : "";
       if (!res.ok) {
         const tail = res.steps[res.steps.length - 1]?.output ?? "";
         await edit(
           `⚠️ Update failed: ${res.error ?? "unknown error"}` +
+            note +
             (tail
               ? `\n\`\`\`\n${escapeForCodeBlock(tail.slice(-1200))}\n\`\`\``
               : ""),
@@ -201,7 +220,7 @@ export async function handleUpdate(
         return;
       }
       await edit(
-        `✅ Updated \`${res.before ?? "?"}\` → \`${res.after ?? "?"}\`. ♻️ Restarting…`,
+        `✅ Updated \`${res.before ?? "?"}\` → \`${res.after ?? "?"}\`.${note}\n♻️ Restarting…`,
       );
       // The successor documents any provisioning changes (plugin runtime
       // upgrades, migrations) back to this channel once it's up.

package/src/frontend/discord/commands/definitions.ts

@@ -156,6 +156,13 @@ function buildCommandDefinitions(devBuild = false): unknown[] {
           new SlashCommandBuilder()
             .setName("update")
             .setDescription("Pull latest, reinstall, restart (admin)")
+            .addBooleanOption((o) =>
+              o
+                .setName("force")
+                .setDescription(
+                  "Update even if the pre-update checkpoint fails",
+                ),
+            )
             .toJSON(),
         ]
       : []),

package/src/frontend/native/chats/chat-lifecycle.ts

@@ -6,7 +6,6 @@
 import { toClientChat } from "./chat-wire.js";
 import type { ClientChat } from "../protocol.js";
 import type { NativeRuntime } from "../runtime.js";
-import { clearTurnMeta } from "../turn/turn-meta.js";
 
 export function createChat(runtime: NativeRuntime, title?: string): ClientChat {
   const entry = runtime.chats.create(title);
@@ -27,10 +26,14 @@ export function renameChat(
   return chat;
 }
 
+/**
+ * Soft delete (see NativeChats.remove): the chat disappears from every
+ * client, but its history rows and their turn meta are kept for the
+ * operator — `talon history purge` is the only hard delete.
+ */
 export function deleteChat(runtime: NativeRuntime, chatId: string): boolean {
   const ok = runtime.chats.remove(chatId);
   if (ok) {
-    clearTurnMeta(chatId);
     runtime.contextByChat.delete(chatId);
     runtime.queuedByChat.delete(chatId);
     runtime.broadcast({ kind: "chat_deleted", chatId });

package/src/frontend/native/chats/chats.ts

@@ -17,7 +17,11 @@ import {
   setSessionName,
   deleteSession,
 } from "../../../storage/sessions.js";
-import { getRecentHistory, clearHistory } from "../../../storage/history.js";
+import {
+  getRecentHistory,
+  hideChatHistory,
+  isChatHistoryHidden,
+} from "../../../storage/history.js";
 import { previewOf } from "../protocol.js";
 
 export type ChatEntry = {
@@ -55,6 +59,8 @@ export class NativeChats {
   restore(): void {
     for (const { chatId, info } of getAllSessions()) {
       if (!isNativeChatId(chatId)) continue;
+      // Deleted by the user: its rows are kept, the chat stays gone.
+      if (isChatHistoryHidden(chatId)) continue;
       const recent = getRecentHistory(chatId, 1);
       const entry: ChatEntry = {
         id: chatId,
@@ -133,13 +139,19 @@ export class NativeChats {
     return entry;
   }
 
+  /**
+   * Delete the chat from the app. A soft delete: the chat leaves every list
+   * and its session goes, but its history rows are only hidden, never
+   * deleted — the operator can still find them, and only an explicit
+   * `talon history purge` removes them for good.
+   */
   remove(id: string): boolean {
     const entry = this.byId.get(id);
     if (!entry) return false;
     this.byId.delete(id);
     this.byNum.delete(entry.numericId);
     deleteSession(id);
-    clearHistory(id);
+    hideChatHistory(id);
     return true;
   }
 

package/src/frontend/native/chats/empty-chat-sweep.ts

@@ -28,7 +28,10 @@ function sweepEmptyChats(runtime: NativeRuntime): void {
   for (const entry of runtime.chats.unused(EMPTY_CHAT_MIN_AGE_MS)) {
     if (isBusy(runtime, entry.id) || runtime.queuedByChat.has(entry.id))
       continue;
-    if (getRecentHistory(entry.id, 1).length > 0) continue;
+    // Any stored row at all — even from before a reset — means the chat
+    // was used; never sweep it.
+    if (getRecentHistory(entry.id, 1, { includeCleared: true }).length > 0)
+      continue;
     if (deleteChat(runtime, entry.id)) {
       log("native", `Swept empty chat ${entry.id}`);
     }

package/src/frontend/native/chats/reset.ts

@@ -1,41 +1,63 @@
 /**
- * Chat reset — drop a chat's conversation (session, history, turn meta,
- * cached readouts, pulse checkpoint) while keeping the chat itself.
+ * Chat reset and backend hand-off — what a native chat forgets when its
+ * conversation restarts. Neither path deletes chat history: a reset is a
+ * soft reset (the context floor moves, the rows stay searchable), and a
+ * backend switch leaves history and the transcript exactly as they were.
  */
 
 import { resetSession } from "../../../storage/sessions.js";
-import { clearHistory } from "../../../storage/history.js";
+import { markContextCleared } from "../../../storage/history.js";
 import { resetPulseCheckpoint } from "../../../core/background/pulse/pulse.js";
 import { getBackendForChat } from "../../../core/engine/backend-controller/index.js";
 import { broadcastChatUpdated } from "./chat-wire.js";
 import { emitSystem } from "../turn/emit.js";
 import type { NativeRuntime } from "../runtime.js";
-import { clearTurnMeta } from "../turn/turn-meta.js";
 
-/**
- * Forget everything the conversation accumulated. Shared by the explicit
- * reset and a backend switch (sessions aren't portable across backends).
- */
-export function wipeChatConversation(
+/** Drop the per-process state tied to the chat's backend session. */
+function dropSessionState(
   runtime: NativeRuntime,
   chatId: string,
+  reason: string,
 ): void {
-  resetSession(chatId);
-  clearHistory(chatId);
-  clearTurnMeta(chatId);
+  resetSession(chatId, reason);
   runtime.contextByChat.delete(chatId);
   runtime.queuedByChat.delete(chatId);
   resetPulseCheckpoint(chatId);
 }
 
+/**
+ * A backend switch: session ids aren't portable across backends, so the
+ * session goes (its id is archived by resetSession). History, turn meta
+ * and the transcript stay — a switch changes who answers, not what was
+ * said.
+ */
+export function handOffChatBackend(
+  runtime: NativeRuntime,
+  chatId: string,
+): void {
+  dropSessionState(runtime, chatId, "backend-switch");
+}
+
+/**
+ * An explicit reset: the session goes and the chat's context starts fresh
+ * (a soft reset — every history row and its turn meta is kept, searchable
+ * and recoverable; the transcript and the bot's history tools start after
+ * the reset point).
+ */
+function resetChatContext(runtime: NativeRuntime, chatId: string): void {
+  dropSessionState(runtime, chatId, "reset");
+  markContextCleared(chatId);
+}
+
 export function resetChat(runtime: NativeRuntime, chatId: string): boolean {
   const entry = runtime.chats.get(chatId);
   if (!entry) return false;
-  // Full reset, matching /reset on the other frontends: session,
-  // history (the app re-fetches its transcript from us), pulse
-  // checkpoint, and any in-process backend memory. Warm the fresh
-  // session in the background — the bridge handler is sync.
-  wipeChatConversation(runtime, chatId);
+  // Full reset, matching /reset on the other frontends: session, the
+  // chat's context (soft — the app re-fetches a transcript that starts
+  // after the reset; nothing is deleted), pulse checkpoint, and any
+  // in-process backend memory. Warm the fresh session in the background —
+  // the bridge handler is sync.
+  resetChatContext(runtime, chatId);
   let backend = null;
   try {
     backend = getBackendForChat(chatId);

package/src/frontend/native/commands/session.ts

@@ -28,7 +28,7 @@ import {
   statusCommandReply,
 } from "../../presentation/text-commands.js";
 import { broadcastChatUpdated } from "../chats/chat-wire.js";
-import { resetChat, wipeChatConversation } from "../chats/reset.js";
+import { resetChat, handOffChatBackend } from "../chats/reset.js";
 import { setBackend } from "../surface/models.js";
 import { broadcastStatus } from "../surface/status.js";
 import { interruptTurn } from "../turn/turn.js";
@@ -48,7 +48,7 @@ async function model(ctx: NativeCommandContext): Promise<void> {
     },
     resetBackend: async () => {
       const outcome = await resetChatBackend(entry.id, deps);
-      wipeChatConversation(runtime, entry.id);
+      handOffChatBackend(runtime, entry.id);
       broadcastStatus(runtime);
       return outcome.text;
     },

package/src/frontend/native/surface/models.ts

@@ -25,7 +25,7 @@ import { getActiveReasoningLevels } from "../../presentation/reasoning-levels.js
 import { broadcastChatUpdated } from "../chats/chat-wire.js";
 import { emitSystem } from "../turn/emit.js";
 import type { BackendOption, ModelOption } from "../protocol.js";
-import { wipeChatConversation } from "../chats/reset.js";
+import { handOffChatBackend } from "../chats/reset.js";
 import type { NativeRuntime } from "../runtime.js";
 import { broadcastStatus } from "./status.js";
 
@@ -182,11 +182,11 @@ export async function setBackend(
   }
 
   setChatBackend(chatId, target);
-  wipeChatConversation(runtime, chatId);
+  handOffChatBackend(runtime, chatId);
   emitSystem(
     runtime,
     entry,
-    `Switched to ${target} — starting a fresh conversation.`,
+    `Switched to ${target} — new session, chat history kept.`,
   );
   broadcastChatUpdated(runtime, entry);
   broadcastStatus(runtime);

package/src/frontend/native/turn/turn-meta.ts

@@ -9,7 +9,6 @@
 import {
   recordTurnMeta as storeRecordTurnMeta,
   getTurnMeta as storeGetTurnMeta,
-  clearTurnMeta as storeClearTurnMeta,
 } from "../../../storage/turn-meta.js";
 import type { ClientToolCall } from "../protocol.js";
 
@@ -33,8 +32,3 @@ export function recordTurnMeta(
 export function getTurnMeta(chatId: string, msgId: string): TurnMeta | null {
   return storeGetTurnMeta<TurnMeta>(chatId, msgId);
 }
-
-/** Forget a chat entirely (chat deleted / history cleared). */
-export function clearTurnMeta(chatId: string): void {
-  storeClearTurnMeta(chatId);
-}