talon-agent 5.28.0 → 5.30.0

package/src/core/tools/types.ts

@@ -32,7 +32,8 @@ export type ToolTag =
   | "mesh"
   | "moderation"
   | "native"
-  | "backup";
+  | "backup"
+  | "secrets";
 
 /** The bridge caller signature — injected into execute(). */
 export type BridgeFunction = (

package/src/frontend/discord/commands/definitions.ts

@@ -17,6 +17,26 @@ import type { TalonConfig } from "../../../core/config/index.js";
 import { log, logError, logWarn } from "../../../util/log.js";
 import { getRepoRoot } from "../../../core/update/self-update.js";
 
+/** /secret — one-time paste link for a password (admin, DMs). */
+function secretCommand(): unknown {
+  return new SlashCommandBuilder()
+    .setName("secret")
+    .setDescription("Store a password via a one-time link (admin, DMs)")
+    .addStringOption((o) =>
+      o
+        .setName("name")
+        .setDescription("File name under ~/.talon/secrets")
+        .setRequired(true),
+    )
+    .addStringOption((o) =>
+      o
+        .setName("purpose")
+        .setDescription("What it's for (shown on the form)")
+        .setRequired(false),
+    )
+    .toJSON();
+}
+
 /**
  * /backup — its own builder: the definitions list is one long literal and
  * this is the only entry with two options and seven choices.
@@ -167,6 +187,7 @@ function buildCommandDefinitions(devBuild = false): unknown[] {
         ]
       : []),
     backupCommand(),
+    secretCommand(),
     new SlashCommandBuilder()
       .setName("admin")
       .setDescription("Admin operations (admin only)")

package/src/frontend/discord/commands/router.ts

@@ -38,6 +38,7 @@ import {
   handleSettings,
 } from "./settings.js";
 import { handleBackup } from "./backup.js";
+import { handleSecret } from "./secret.js";
 import {
   handleRestart,
   handleMetrics,
@@ -163,6 +164,8 @@ async function routeSlashCommand(
       return handleUpdate(interaction, config);
     case "backup":
       return handleBackup(interaction);
+    case "secret":
+      return handleSecret(interaction, chatId);
     case "admin":
       return handleAdmin(interaction, config, gateway);
     default:

package/src/frontend/discord/commands/secret.ts

@@ -0,0 +1,26 @@
+/**
+ * /secret name:<name> [purpose:<text>] — a single-use link to paste a
+ * password into instead of the channel. Rules and reply live in
+ * core/secrets; the reply is ephemeral either way.
+ */
+
+import type { ChatInputCommandInteraction } from "discord.js";
+import { secretCommandReply } from "../../../core/secrets/index.js";
+import { isAdmin } from "../handlers/index.js";
+import { reply } from "./interaction.js";
+
+export async function handleSecret(
+  i: ChatInputCommandInteraction,
+  chatId: string,
+): Promise<void> {
+  const name = (i.options.getString("name") ?? "").trim();
+  const purpose = (i.options.getString("purpose") ?? "").trim();
+  const text = secretCommandReply({
+    arg: `${name} ${purpose}`,
+    chatKey: chatId,
+    frontend: "discord",
+    isOperator: isAdmin(i.user.id),
+    isGroup: i.inGuild(),
+  });
+  await reply(i, text, true);
+}

package/src/frontend/discord/handlers/messages.ts

@@ -66,15 +66,17 @@ export async function handleMessage(
   if (msg.attachments.size > 0) {
     for (const att of msg.attachments.values()) {
       try {
-        const savedPath = await downloadAttachment(att, config.workspace);
+        const downloadedPath = await downloadAttachment(att, config.workspace);
         const cls = classifyAttachment(att);
-        setMessageFilePath(chatId, numericMessageId, savedPath);
-        addMedia({
+        setMessageFilePath(chatId, numericMessageId, downloadedPath);
+        // addMedia may dedupe onto an existing identical file and delete
+        // the fresh download — prompt with the path it resolves to.
+        const savedPath = await addMedia({
           chatId,
           msgId: numericMessageId,
           senderName: sender,
           type: cls.type,
-          filePath: savedPath,
+          filePath: downloadedPath,
           caption: cleanedContent || undefined,
           timestamp: Date.now(),
         });

package/src/frontend/native/bridge/routes/host.ts

@@ -178,6 +178,16 @@ export type BridgeServerHandlers = {
     | Promise<{ script: string; filename: string } | null>;
   /** Resolve a node-provisioning token to the binary to stream, or null. */
   openNodeBinary(token: string): { path: string; size: number } | null;
+  /** The secret-drop form for a live grant (not spent), or null. */
+  openSecretDrop(token: string): string | null;
+  /** Whether a secret-drop grant is live (checked before reading a body). */
+  isLiveSecretDrop(token: string): boolean;
+  /** Spend a secret-drop grant and store the value; the page to show. */
+  submitSecretDrop(
+    token: string,
+    body: string,
+    contentType: string | undefined,
+  ): Promise<{ status: number; html: string }>;
 };
 
 /**

package/src/frontend/native/bridge/routes/pre-auth.ts

@@ -1,3 +1,4 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
 import type { RouteHost } from "./host.js";
 import type { BridgeRoutes } from "./table.js";
 import { BRIDGE_PROTOCOL_VERSION } from "../../protocol.js";
@@ -6,7 +7,12 @@ export function preAuthRoutes(
   host: RouteHost,
 ): Pick<
   BridgeRoutes,
-  "GET /health" | "GET /pair" | "GET /node/install" | "GET /node/binary"
+  | "GET /health"
+  | "GET /pair"
+  | "GET /node/install"
+  | "GET /node/binary"
+  | "GET /secret"
+  | "POST /secret"
 > {
   const { json, handlers: h } = host;
   return {
@@ -90,6 +96,37 @@ export function preAuthRoutes(
       });
       res.end(install.script);
     },
+    // Secret drop. GET shows the paste form and leaves the grant live, so
+    // a chat app fetching the link for a preview can't burn it. POST
+    // checks the grant BEFORE reading a byte of body — an anonymous caller
+    // without one gets nothing read and a closed socket — then reads at
+    // most SECRET_BODY_MAX bytes. The value goes to the core service and
+    // nowhere else: not a log line, not an error message.
+    "GET /secret": ({ res, url }) => {
+      const form = h.openSecretDrop(url.searchParams.get("grant") ?? "");
+      if (!form) return sendSecretPage(res, 404, notFoundPage());
+      sendSecretPage(res, 200, form);
+    },
+    "POST /secret": async ({ req, res, url }) => {
+      const token = url.searchParams.get("grant") ?? "";
+      if (!h.isLiveSecretDrop(token)) {
+        res.setHeader("Connection", "close");
+        return sendSecretPage(res, 404, notFoundPage());
+      }
+      let body: string;
+      try {
+        body = await readCappedBody(req, SECRET_BODY_MAX);
+      } catch {
+        res.setHeader("Connection", "close");
+        return sendSecretPage(res, 413, notFoundPage("Too large."));
+      }
+      const result = await h.submitSecretDrop(
+        token,
+        body,
+        req.headers["content-type"],
+      );
+      sendSecretPage(res, result.status, result.html);
+    },
     "GET /node/binary": ({ res, url }) => {
       const token = url.searchParams.get("provision") ?? "";
       const binary = token ? h.openNodeBinary(token) : null;
@@ -98,3 +135,47 @@ export function preAuthRoutes(
     },
   };
 }
+
+/** A form-encoded 64 KB value plus its encoding overhead, and no more. */
+const SECRET_BODY_MAX = 200 * 1024;
+
+/** Read a request body as UTF-8, refusing anything over `max` bytes. */
+async function readCappedBody(
+  req: IncomingMessage,
+  max: number,
+): Promise<string> {
+  const chunks: Buffer[] = [];
+  let total = 0;
+  for await (const chunk of req) {
+    total += (chunk as Buffer).length;
+    if (total > max) throw new Error("too large");
+    chunks.push(chunk as Buffer);
+  }
+  return Buffer.concat(chunks).toString("utf-8");
+}
+
+/**
+ * Secret-drop pages: no caching anywhere, no framing, no referrer, and a
+ * CSP that allows inline style and a same-origin form post — nothing else.
+ */
+function sendSecretPage(
+  res: ServerResponse,
+  status: number,
+  html: string,
+): void {
+  res.writeHead(status, {
+    "Content-Type": "text/html; charset=utf-8",
+    "Cache-Control": "no-store",
+    "Referrer-Policy": "no-referrer",
+    "X-Frame-Options": "DENY",
+    "X-Content-Type-Options": "nosniff",
+    "Content-Security-Policy":
+      "default-src 'none'; style-src 'unsafe-inline'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'",
+  });
+  res.end(html);
+}
+
+function notFoundPage(message?: string): string {
+  const text = message ?? "This link is unknown, expired, or already used.";
+  return `<!doctype html><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>Not available</title><p style="font:15px system-ui,sans-serif;padding:24px">${text} Ask for a fresh one with /secret &lt;name&gt;.</p>\n`;
+}

package/src/frontend/native/bridge/routes/table.ts

@@ -37,6 +37,11 @@ export const BRIDGE_ROUTE_AUTH = {
   "GET /pair": "public",
   "GET /node/install": "public",
   "GET /node/binary": "public",
+  // Secret drop: a browser with no credential pastes one value, once. GET
+  // shows the form without spending the grant (link previews fetch it);
+  // POST spends it, and its body is read only after the grant checks out.
+  "GET /secret": "public",
+  "POST /secret": "public",
 
   // Credential self-service. Any credential may ask who it is, and trade
   // itself (or the shared legacy token) for a fresh per-device credential

package/src/frontend/native/bridge/server.ts

@@ -81,6 +81,25 @@ const SSE_PING_MS = 25_000;
  */
 const SSE_MAX_BACKLOG_BYTES = 16 * 1024 * 1024;
 const MAX_BODY_BYTES = 256 * 1024;
+
+/**
+ * Routes a page served by the bridge itself posts a plain HTML form to
+ * (the secret drop). A browser stamps that POST with the bridge's own
+ * origin, which is no cross-site request — so these, and only these,
+ * accept it without `native.allowedOrigins`. Every other route still
+ * refuses any Origin not configured, same-origin included: a page under
+ * /media is the bridge's origin too.
+ */
+const SAME_ORIGIN_FORM_ROUTES: ReadonlySet<string> = new Set(["POST /secret"]);
+
+/** `host[:port]` of an Origin header, or undefined when it doesn't parse. */
+function originHost(origin: string): string | undefined {
+  try {
+    return new URL(origin).host;
+  } catch {
+    return undefined;
+  }
+}
 const PORT_FALLBACKS = 5;
 
 /**
@@ -90,7 +109,8 @@ const PORT_FALLBACKS = 5;
  * bodies) are unaffected. It does bound request bodies, and every
  * body-reading route sits behind the bearer check (an unauthenticated
  * request is answered 401/429 with `Connection: close` before its body is
- * read), so the budget is sized for the largest authenticated upload
+ * read) — the one pre-auth exception, `POST /secret`, reads a body only
+ * for a live single-use grant and caps it at 200 KB — so the budget is sized for the largest authenticated upload
  * (512 MB) on a slow link, not for an attacker.
  */
 export type BridgeTimeouts = {
@@ -496,7 +516,10 @@ export class BridgeServer {
     // slip the browser is asking for.
     const origin =
       typeof req.headers.origin === "string" ? req.headers.origin : undefined;
-    const refusal = this.originGuard(req);
+    const refusal = this.originGuard(
+      req,
+      SAME_ORIGIN_FORM_ROUTES.has(`${method} ${path}`),
+    );
     if (refusal !== undefined) {
       res.writeHead(403, {
         ...this.corsHeaders(),
@@ -860,10 +883,15 @@ export class BridgeServer {
    *
    * Returns an error string when the request must be refused.
    */
-  private originGuard(req: IncomingMessage): string | undefined {
+  private originGuard(
+    req: IncomingMessage,
+    sameOriginAllowed = false,
+  ): string | undefined {
     const origin = req.headers.origin;
     if (typeof origin === "string" && origin !== "" && origin !== "null") {
-      if (!this.isAllowedOrigin(origin)) {
+      const sameOrigin =
+        sameOriginAllowed && originHost(origin) === req.headers.host;
+      if (!sameOrigin && !this.isAllowedOrigin(origin)) {
         return `Origin ${origin} is not allowed. Add it to native.allowedOrigins to permit browser clients.`;
       }
     }

package/src/frontend/native/commands/definitions.ts

@@ -96,6 +96,12 @@ export const NATIVE_COMMANDS = [
     args: "[status|now|checkpoint <label>|list|show <id>|pin <id>|unpin <id>|restore <id>]",
     admin: true,
   },
+  {
+    name: "secret",
+    description: "Store a password via a one-time link, not the chat",
+    args: "<name> [what it's for]",
+    admin: true,
+  },
 ] as const satisfies readonly ClientCommand[];
 
 export type NativeCommandName = (typeof NATIVE_COMMANDS)[number]["name"];

package/src/frontend/native/commands/index.ts

@@ -18,6 +18,7 @@ import type { NativeRuntime } from "../runtime.js";
 import { emitNotice, emitUser } from "../turn/emit.js";
 import { adminCommands } from "./admin.js";
 import { backupCommand } from "./backup.js";
+import { secretCommandReply } from "../../../core/secrets/index.js";
 import { findNativeCommand, type NativeCommandName } from "./definitions.js";
 import { infoCommands } from "./info.js";
 import { sessionCommands } from "./session.js";
@@ -30,6 +31,17 @@ const HANDLERS: Record<NativeCommandName, NativeCommandHandler> = {
   ...sessionCommands,
   ...adminCommands,
   backup: backupCommand,
+  // Native chats are one operator's own surface: never a group.
+  secret: async (ctx) =>
+    ctx.reply(
+      secretCommandReply({
+        arg: ctx.arg,
+        chatKey: ctx.entry.id,
+        frontend: "native",
+        isOperator: ctx.operator,
+        isGroup: false,
+      }),
+    ),
 };
 
 export type ParsedNativeCommand = { name: NativeCommandName; arg: string };

package/src/frontend/native/surface/handlers.ts

@@ -4,6 +4,11 @@
  * anything with logic of its own lives in the module named for it.
  */
 
+import {
+  isLiveSecretDrop,
+  openSecretDropForm,
+  submitSecretDrop,
+} from "../../../core/secrets/index.js";
 import { files } from "../../../util/paths.js";
 import { setChatPulse } from "../../../storage/chat-settings.js";
 import { getPooledBackend } from "../../../core/engine/backend-controller/index.js";
@@ -219,5 +224,9 @@ export function buildBridgeHandlers(
     openCompanionPair: (token, format) => mesh.openCompanionPair(token, format),
     openNodeInstall: (token, os, arch) => mesh.openNodeInstall(token, os, arch),
     openNodeBinary: (token) => mesh.openNodeBinary(token),
+    openSecretDrop: (token) => openSecretDropForm(token),
+    isLiveSecretDrop: (token) => isLiveSecretDrop(token),
+    submitSecretDrop: (token, body, contentType) =>
+      submitSecretDrop(token, body, contentType),
   };
 }

package/src/frontend/telegram/actions/chat-info.ts

@@ -21,6 +21,7 @@ import {
   getPinnedMessages as userbotPinnedMessages,
   getOnlineCount as userbotOnlineCount,
 } from "../userbot.js";
+import { getMediaForMessage } from "../../../storage/media-index.js";
 import { savePackToLibrary } from "../sticker-library.js";
 import { toPositiveId } from "./coerce.js";
 import type { TelegramActionHandlers } from "./types.js";
@@ -308,16 +309,32 @@ export const chatInfoHandlers: TelegramActionHandlers = {
   },
 
   download_media: async (body, chatId) => {
+    const msgId = toPositiveId(body.message_id);
+    if (!msgId) return { ok: false, error: "Required: message_id" };
+    // Media the bot received is already on disk and indexed. Answer from
+    // the index first: the userbot can't see messages in the bot's own
+    // DMs (message ids there are per-account), so asking it for an
+    // inbound photo by id reports "not found".
+    const indexed = getMediaForMessage(String(chatId), msgId);
+    if (indexed && existsSync(indexed.filePath)) {
+      return {
+        ok: true,
+        text: `Saved at: ${indexed.filePath} (${indexed.type}). Use the Read tool on this path to view the content.`,
+        file_path: indexed.filePath,
+      };
+    }
     if (isUserClientReady()) {
       const { downloadMessageMedia } = await import("../userbot.js");
       return {
         ok: true,
-        text: await downloadMessageMedia({
-          chatId,
-          messageId: Number(body.message_id),
-        }),
+        text: await downloadMessageMedia({ chatId, messageId: msgId }),
       };
     }
-    return { ok: false, error: "User client not connected." };
+    return {
+      ok: false,
+      error: indexed
+        ? `Media for message ${msgId} is no longer on disk and the user client is not connected to re-download it.`
+        : "User client not connected.",
+    };
   },
 };

package/src/frontend/telegram/commands/definitions.ts

@@ -52,6 +52,10 @@ export const TELEGRAM_COMMANDS: ReadonlyArray<{
     command: "backup",
     description: "Snapshots and checkpoints; /backup restore <id> (admin)",
   },
+  {
+    command: "secret",
+    description: "Store a password via a one-time link, not the chat (admin)",
+  },
   { command: "plugins", description: "List loaded plugins" },
   { command: "help", description: "All commands and features" },
 ];

package/src/frontend/telegram/commands/index.ts

@@ -8,6 +8,7 @@
  *   - `memory`      — /memory (read-only view of the typed memory store)
  *   - `session`     — /reset /status
  *   - `settings`    — /model /effort /pulse /settings
+ *   - `secret`      — /secret (single-use paste link for a password)
  *   - `admin`       — /admin /metrics /doctor /dream /restart /update
  *                     + the unknown-command suggester
  *
@@ -27,6 +28,7 @@ import { registerAdminCommands } from "./admin.js";
 import { registerWhatsAppPairingCommand } from "./whatsapp-pairing.js";
 import { registerAuthCommand } from "./auth.js";
 import { registerBackupCommand } from "./backup.js";
+import { registerSecretCommand } from "./secret.js";
 
 export { telegramCommandMenu } from "./definitions.js";
 export { setAdminUserId } from "./state.js";
@@ -45,6 +47,7 @@ export function registerCommands(
   registerWhatsAppPairingCommand(bot);
   registerAuthCommand(bot);
   registerBackupCommand(bot);
+  registerSecretCommand(bot);
   // admin LAST: it owns the unknown-command catch-all, which must only
   // be reached after every real command has had its chance to match.
   // Registering anything after it makes that command look unknown

package/src/frontend/telegram/commands/secret.ts

@@ -0,0 +1,24 @@
+/**
+ * /secret <name> [purpose] — a single-use link to paste a password into,
+ * so it never has to be typed into this chat. The rules and the reply
+ * text live in core/secrets; this only adapts Telegram's context.
+ */
+
+import type { Bot } from "grammy";
+import { secretCommandReply } from "../../../core/secrets/index.js";
+import { isAuthorizedAdmin } from "./state.js";
+
+export function registerSecretCommand(bot: Bot): void {
+  bot.command("secret", async (ctx) => {
+    const text = secretCommandReply({
+      arg: typeof ctx.match === "string" ? ctx.match : "",
+      chatKey: String(ctx.chat.id),
+      frontend: "telegram",
+      isOperator: isAuthorizedAdmin(ctx),
+      isGroup: ctx.chat.type !== "private",
+    });
+    // No preview: a preview fetch is harmless (GET doesn't spend the
+    // grant) but there is no reason to hand Telegram the URL early.
+    await ctx.reply(text, { link_preview_options: { is_disabled: true } });
+  });
+}

package/src/frontend/telegram/handlers/messages.ts

@@ -72,16 +72,18 @@ async function handleMediaMessage(
       return;
     }
 
-    const savedPath = await downloadTelegramFile(
+    const downloadedPath = await downloadTelegramFile(
       bot,
       config,
       media.fileId,
       media.fileName,
     );
 
-    // Store file path in history + media index
-    setMessageFilePath(chatId, ctx.message.message_id, savedPath);
-    addMedia({
+    // Store file path in history + media index. addMedia may dedupe the
+    // download onto an identical file already on disk (and delete the
+    // fresh one), so the prompt must use the path it resolves to.
+    setMessageFilePath(chatId, ctx.message.message_id, downloadedPath);
+    const savedPath = await addMedia({
       chatId,
       msgId: ctx.message.message_id,
       senderName: sender,
@@ -93,7 +95,7 @@ async function handleMediaMessage(
         | "animation"
         | "audio"
         | "sticker",
-      filePath: savedPath,
+      filePath: downloadedPath,
       caption: media.caption,
       timestamp: Date.now(),
     });

package/src/frontend/whatsapp/commands.ts

@@ -1,6 +1,6 @@
 /**
  * Slash commands on WhatsApp — `/model`, `/effort`, `/settings`,
- * `/reset`, `/status`, `/help`.
+ * `/reset`, `/status`, `/secret`, `/help`.
  *
  * WhatsApp has no inline buttons, so everything Telegram does with a
  * picker is done here with typed arguments: `/model` prints a numbered
@@ -26,6 +26,8 @@ import {
   settingsCommandReply,
   statusCommandReply,
 } from "../presentation/text-commands.js";
+import { isOperatorPrivateChat } from "../../core/mcp-hub/guest-scope.js";
+import { secretCommandReply } from "../../core/secrets/index.js";
 import { sendText } from "./actions/send.js";
 import { identityAllowed, type Identity } from "./connection/identity.js";
 import type { WhatsAppChatInfo } from "./registry.js";
@@ -37,6 +39,7 @@ const COMMAND_NAMES = [
   "settings",
   "reset",
   "status",
+  "secret",
   "help",
 ] as const;
 
@@ -96,6 +99,7 @@ const HELP_TEXT = [
   "/settings — this chat's model, backend, effort and pulse",
   "/status — session info, context usage and stats",
   "/reset — start a fresh session (chat log kept)",
+  "/secret <name> — a one-time link to store a password, so it never goes in a chat (operator, DM)",
   "/help — this message",
 ].join("\n");
 
@@ -143,6 +147,17 @@ export async function executeWhatsAppCommand(
       return statusCommandReply(chatId, deps);
     case "reset":
       return runResetCommand(chatId, inbound.senderName, deps);
+    case "secret":
+      return secretCommandReply({
+        arg: cmd.arg,
+        chatKey: chatId,
+        frontend: "whatsapp",
+        // The operator's own DM (guest scope's operator chats), never a
+        // group and never another allowlisted contact.
+        isOperator:
+          !inbound.isGroup && isOperatorPrivateChat("whatsapp", chatId),
+        isGroup: inbound.isGroup,
+      });
     case "help":
       return HELP_TEXT;
   }

package/src/frontend/whatsapp/messages/media-store.ts

@@ -96,7 +96,9 @@ export async function saveInboundMedia(
     writeFileSync(filePath, buffer);
 
     const caption = content?.caption ?? undefined;
-    addMedia({
+    // addMedia may dedupe onto an existing identical file and delete
+    // this download — report the path it resolves to.
+    const savedPath = await addMedia({
       chatId,
       msgId,
       senderName,
@@ -105,7 +107,7 @@ export async function saveInboundMedia(
       timestamp: Date.now(),
       ...(caption ? { caption } : {}),
     });
-    return { filePath, type, ...(caption ? { caption } : {}) };
+    return { filePath: savedPath, type, ...(caption ? { caption } : {}) };
   } catch (err) {
     logWarn(
       "whatsapp",