talon-agent 5.29.0 → 5.30.0

package/src/frontend/native/bridge/routes/pre-auth.ts

@@ -1,3 +1,4 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
 import type { RouteHost } from "./host.js";
 import type { BridgeRoutes } from "./table.js";
 import { BRIDGE_PROTOCOL_VERSION } from "../../protocol.js";
@@ -6,7 +7,12 @@ export function preAuthRoutes(
   host: RouteHost,
 ): Pick<
   BridgeRoutes,
-  "GET /health" | "GET /pair" | "GET /node/install" | "GET /node/binary"
+  | "GET /health"
+  | "GET /pair"
+  | "GET /node/install"
+  | "GET /node/binary"
+  | "GET /secret"
+  | "POST /secret"
 > {
   const { json, handlers: h } = host;
   return {
@@ -90,6 +96,37 @@ export function preAuthRoutes(
       });
       res.end(install.script);
     },
+    // Secret drop. GET shows the paste form and leaves the grant live, so
+    // a chat app fetching the link for a preview can't burn it. POST
+    // checks the grant BEFORE reading a byte of body — an anonymous caller
+    // without one gets nothing read and a closed socket — then reads at
+    // most SECRET_BODY_MAX bytes. The value goes to the core service and
+    // nowhere else: not a log line, not an error message.
+    "GET /secret": ({ res, url }) => {
+      const form = h.openSecretDrop(url.searchParams.get("grant") ?? "");
+      if (!form) return sendSecretPage(res, 404, notFoundPage());
+      sendSecretPage(res, 200, form);
+    },
+    "POST /secret": async ({ req, res, url }) => {
+      const token = url.searchParams.get("grant") ?? "";
+      if (!h.isLiveSecretDrop(token)) {
+        res.setHeader("Connection", "close");
+        return sendSecretPage(res, 404, notFoundPage());
+      }
+      let body: string;
+      try {
+        body = await readCappedBody(req, SECRET_BODY_MAX);
+      } catch {
+        res.setHeader("Connection", "close");
+        return sendSecretPage(res, 413, notFoundPage("Too large."));
+      }
+      const result = await h.submitSecretDrop(
+        token,
+        body,
+        req.headers["content-type"],
+      );
+      sendSecretPage(res, result.status, result.html);
+    },
     "GET /node/binary": ({ res, url }) => {
       const token = url.searchParams.get("provision") ?? "";
       const binary = token ? h.openNodeBinary(token) : null;
@@ -98,3 +135,47 @@ export function preAuthRoutes(
     },
   };
 }
+
+/** A form-encoded 64 KB value plus its encoding overhead, and no more. */
+const SECRET_BODY_MAX = 200 * 1024;
+
+/** Read a request body as UTF-8, refusing anything over `max` bytes. */
+async function readCappedBody(
+  req: IncomingMessage,
+  max: number,
+): Promise<string> {
+  const chunks: Buffer[] = [];
+  let total = 0;
+  for await (const chunk of req) {
+    total += (chunk as Buffer).length;
+    if (total > max) throw new Error("too large");
+    chunks.push(chunk as Buffer);
+  }
+  return Buffer.concat(chunks).toString("utf-8");
+}
+
+/**
+ * Secret-drop pages: no caching anywhere, no framing, no referrer, and a
+ * CSP that allows inline style and a same-origin form post — nothing else.
+ */
+function sendSecretPage(
+  res: ServerResponse,
+  status: number,
+  html: string,
+): void {
+  res.writeHead(status, {
+    "Content-Type": "text/html; charset=utf-8",
+    "Cache-Control": "no-store",
+    "Referrer-Policy": "no-referrer",
+    "X-Frame-Options": "DENY",
+    "X-Content-Type-Options": "nosniff",
+    "Content-Security-Policy":
+      "default-src 'none'; style-src 'unsafe-inline'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'",
+  });
+  res.end(html);
+}
+
+function notFoundPage(message?: string): string {
+  const text = message ?? "This link is unknown, expired, or already used.";
+  return `<!doctype html><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>Not available</title><p style="font:15px system-ui,sans-serif;padding:24px">${text} Ask for a fresh one with /secret &lt;name&gt;.</p>\n`;
+}

package/src/frontend/native/bridge/routes/table.ts

@@ -37,6 +37,11 @@ export const BRIDGE_ROUTE_AUTH = {
   "GET /pair": "public",
   "GET /node/install": "public",
   "GET /node/binary": "public",
+  // Secret drop: a browser with no credential pastes one value, once. GET
+  // shows the form without spending the grant (link previews fetch it);
+  // POST spends it, and its body is read only after the grant checks out.
+  "GET /secret": "public",
+  "POST /secret": "public",
 
   // Credential self-service. Any credential may ask who it is, and trade
   // itself (or the shared legacy token) for a fresh per-device credential

package/src/frontend/native/bridge/server.ts

@@ -81,6 +81,25 @@ const SSE_PING_MS = 25_000;
  */
 const SSE_MAX_BACKLOG_BYTES = 16 * 1024 * 1024;
 const MAX_BODY_BYTES = 256 * 1024;
+
+/**
+ * Routes a page served by the bridge itself posts a plain HTML form to
+ * (the secret drop). A browser stamps that POST with the bridge's own
+ * origin, which is no cross-site request — so these, and only these,
+ * accept it without `native.allowedOrigins`. Every other route still
+ * refuses any Origin not configured, same-origin included: a page under
+ * /media is the bridge's origin too.
+ */
+const SAME_ORIGIN_FORM_ROUTES: ReadonlySet<string> = new Set(["POST /secret"]);
+
+/** `host[:port]` of an Origin header, or undefined when it doesn't parse. */
+function originHost(origin: string): string | undefined {
+  try {
+    return new URL(origin).host;
+  } catch {
+    return undefined;
+  }
+}
 const PORT_FALLBACKS = 5;
 
 /**
@@ -90,7 +109,8 @@ const PORT_FALLBACKS = 5;
  * bodies) are unaffected. It does bound request bodies, and every
  * body-reading route sits behind the bearer check (an unauthenticated
  * request is answered 401/429 with `Connection: close` before its body is
- * read), so the budget is sized for the largest authenticated upload
+ * read) — the one pre-auth exception, `POST /secret`, reads a body only
+ * for a live single-use grant and caps it at 200 KB — so the budget is sized for the largest authenticated upload
  * (512 MB) on a slow link, not for an attacker.
  */
 export type BridgeTimeouts = {
@@ -496,7 +516,10 @@ export class BridgeServer {
     // slip the browser is asking for.
     const origin =
       typeof req.headers.origin === "string" ? req.headers.origin : undefined;
-    const refusal = this.originGuard(req);
+    const refusal = this.originGuard(
+      req,
+      SAME_ORIGIN_FORM_ROUTES.has(`${method} ${path}`),
+    );
     if (refusal !== undefined) {
       res.writeHead(403, {
         ...this.corsHeaders(),
@@ -860,10 +883,15 @@ export class BridgeServer {
    *
    * Returns an error string when the request must be refused.
    */
-  private originGuard(req: IncomingMessage): string | undefined {
+  private originGuard(
+    req: IncomingMessage,
+    sameOriginAllowed = false,
+  ): string | undefined {
     const origin = req.headers.origin;
     if (typeof origin === "string" && origin !== "" && origin !== "null") {
-      if (!this.isAllowedOrigin(origin)) {
+      const sameOrigin =
+        sameOriginAllowed && originHost(origin) === req.headers.host;
+      if (!sameOrigin && !this.isAllowedOrigin(origin)) {
         return `Origin ${origin} is not allowed. Add it to native.allowedOrigins to permit browser clients.`;
       }
     }

package/src/frontend/native/commands/definitions.ts

@@ -96,6 +96,12 @@ export const NATIVE_COMMANDS = [
     args: "[status|now|checkpoint <label>|list|show <id>|pin <id>|unpin <id>|restore <id>]",
     admin: true,
   },
+  {
+    name: "secret",
+    description: "Store a password via a one-time link, not the chat",
+    args: "<name> [what it's for]",
+    admin: true,
+  },
 ] as const satisfies readonly ClientCommand[];
 
 export type NativeCommandName = (typeof NATIVE_COMMANDS)[number]["name"];

package/src/frontend/native/commands/index.ts

@@ -18,6 +18,7 @@ import type { NativeRuntime } from "../runtime.js";
 import { emitNotice, emitUser } from "../turn/emit.js";
 import { adminCommands } from "./admin.js";
 import { backupCommand } from "./backup.js";
+import { secretCommandReply } from "../../../core/secrets/index.js";
 import { findNativeCommand, type NativeCommandName } from "./definitions.js";
 import { infoCommands } from "./info.js";
 import { sessionCommands } from "./session.js";
@@ -30,6 +31,17 @@ const HANDLERS: Record<NativeCommandName, NativeCommandHandler> = {
   ...sessionCommands,
   ...adminCommands,
   backup: backupCommand,
+  // Native chats are one operator's own surface: never a group.
+  secret: async (ctx) =>
+    ctx.reply(
+      secretCommandReply({
+        arg: ctx.arg,
+        chatKey: ctx.entry.id,
+        frontend: "native",
+        isOperator: ctx.operator,
+        isGroup: false,
+      }),
+    ),
 };
 
 export type ParsedNativeCommand = { name: NativeCommandName; arg: string };

package/src/frontend/native/surface/handlers.ts

@@ -4,6 +4,11 @@
  * anything with logic of its own lives in the module named for it.
  */
 
+import {
+  isLiveSecretDrop,
+  openSecretDropForm,
+  submitSecretDrop,
+} from "../../../core/secrets/index.js";
 import { files } from "../../../util/paths.js";
 import { setChatPulse } from "../../../storage/chat-settings.js";
 import { getPooledBackend } from "../../../core/engine/backend-controller/index.js";
@@ -219,5 +224,9 @@ export function buildBridgeHandlers(
     openCompanionPair: (token, format) => mesh.openCompanionPair(token, format),
     openNodeInstall: (token, os, arch) => mesh.openNodeInstall(token, os, arch),
     openNodeBinary: (token) => mesh.openNodeBinary(token),
+    openSecretDrop: (token) => openSecretDropForm(token),
+    isLiveSecretDrop: (token) => isLiveSecretDrop(token),
+    submitSecretDrop: (token, body, contentType) =>
+      submitSecretDrop(token, body, contentType),
   };
 }

package/src/frontend/telegram/commands/definitions.ts

@@ -52,6 +52,10 @@ export const TELEGRAM_COMMANDS: ReadonlyArray<{
     command: "backup",
     description: "Snapshots and checkpoints; /backup restore <id> (admin)",
   },
+  {
+    command: "secret",
+    description: "Store a password via a one-time link, not the chat (admin)",
+  },
   { command: "plugins", description: "List loaded plugins" },
   { command: "help", description: "All commands and features" },
 ];

package/src/frontend/telegram/commands/index.ts

@@ -8,6 +8,7 @@
  *   - `memory`      — /memory (read-only view of the typed memory store)
  *   - `session`     — /reset /status
  *   - `settings`    — /model /effort /pulse /settings
+ *   - `secret`      — /secret (single-use paste link for a password)
  *   - `admin`       — /admin /metrics /doctor /dream /restart /update
  *                     + the unknown-command suggester
  *
@@ -27,6 +28,7 @@ import { registerAdminCommands } from "./admin.js";
 import { registerWhatsAppPairingCommand } from "./whatsapp-pairing.js";
 import { registerAuthCommand } from "./auth.js";
 import { registerBackupCommand } from "./backup.js";
+import { registerSecretCommand } from "./secret.js";
 
 export { telegramCommandMenu } from "./definitions.js";
 export { setAdminUserId } from "./state.js";
@@ -45,6 +47,7 @@ export function registerCommands(
   registerWhatsAppPairingCommand(bot);
   registerAuthCommand(bot);
   registerBackupCommand(bot);
+  registerSecretCommand(bot);
   // admin LAST: it owns the unknown-command catch-all, which must only
   // be reached after every real command has had its chance to match.
   // Registering anything after it makes that command look unknown

package/src/frontend/telegram/commands/secret.ts

@@ -0,0 +1,24 @@
+/**
+ * /secret <name> [purpose] — a single-use link to paste a password into,
+ * so it never has to be typed into this chat. The rules and the reply
+ * text live in core/secrets; this only adapts Telegram's context.
+ */
+
+import type { Bot } from "grammy";
+import { secretCommandReply } from "../../../core/secrets/index.js";
+import { isAuthorizedAdmin } from "./state.js";
+
+export function registerSecretCommand(bot: Bot): void {
+  bot.command("secret", async (ctx) => {
+    const text = secretCommandReply({
+      arg: typeof ctx.match === "string" ? ctx.match : "",
+      chatKey: String(ctx.chat.id),
+      frontend: "telegram",
+      isOperator: isAuthorizedAdmin(ctx),
+      isGroup: ctx.chat.type !== "private",
+    });
+    // No preview: a preview fetch is harmless (GET doesn't spend the
+    // grant) but there is no reason to hand Telegram the URL early.
+    await ctx.reply(text, { link_preview_options: { is_disabled: true } });
+  });
+}

package/src/frontend/whatsapp/commands.ts

@@ -1,6 +1,6 @@
 /**
  * Slash commands on WhatsApp — `/model`, `/effort`, `/settings`,
- * `/reset`, `/status`, `/help`.
+ * `/reset`, `/status`, `/secret`, `/help`.
  *
  * WhatsApp has no inline buttons, so everything Telegram does with a
  * picker is done here with typed arguments: `/model` prints a numbered
@@ -26,6 +26,8 @@ import {
   settingsCommandReply,
   statusCommandReply,
 } from "../presentation/text-commands.js";
+import { isOperatorPrivateChat } from "../../core/mcp-hub/guest-scope.js";
+import { secretCommandReply } from "../../core/secrets/index.js";
 import { sendText } from "./actions/send.js";
 import { identityAllowed, type Identity } from "./connection/identity.js";
 import type { WhatsAppChatInfo } from "./registry.js";
@@ -37,6 +39,7 @@ const COMMAND_NAMES = [
   "settings",
   "reset",
   "status",
+  "secret",
   "help",
 ] as const;
 
@@ -96,6 +99,7 @@ const HELP_TEXT = [
   "/settings — this chat's model, backend, effort and pulse",
   "/status — session info, context usage and stats",
   "/reset — start a fresh session (chat log kept)",
+  "/secret <name> — a one-time link to store a password, so it never goes in a chat (operator, DM)",
   "/help — this message",
 ].join("\n");
 
@@ -143,6 +147,17 @@ export async function executeWhatsAppCommand(
       return statusCommandReply(chatId, deps);
     case "reset":
       return runResetCommand(chatId, inbound.senderName, deps);
+    case "secret":
+      return secretCommandReply({
+        arg: cmd.arg,
+        chatKey: chatId,
+        frontend: "whatsapp",
+        // The operator's own DM (guest scope's operator chats), never a
+        // group and never another allowlisted contact.
+        isOperator:
+          !inbound.isGroup && isOperatorPrivateChat("whatsapp", chatId),
+        isGroup: inbound.isGroup,
+      });
     case "help":
       return HELP_TEXT;
   }

package/src/util/log.ts

@@ -72,6 +72,7 @@ export type LogComponent =
   | "memory"
   | "stickers"
   | "backup"
+  | "secrets"
   | "router"
   | "backend-controller"
   | "fetch";

package/src/util/paths.ts

@@ -88,6 +88,12 @@ export const dirs = {
   skills: resolve(TALON_ROOT, "workspace", "skills"),
   /** Key material (bridge TLS identity, release keys): ~/.talon/keys/ */
   keys: resolve(TALON_ROOT, "keys"),
+  /**
+   * Operator secrets, one file per value (mode 600): ~/.talon/secrets/.
+   * Written by the secret drop (`/secret <name>`, `request_secret`) so a
+   * password never has to travel through a chat message.
+   */
+  secrets: resolve(TALON_ROOT, "secrets"),
   /**
    * The talon:// namespace on disk: ~/.talon/ns/. Holds one symlink per
    * file-backed mount (home → workspace/, skills/, …); while the daemon