talon-agent 5.32.1 → 5.33.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "talon-agent",
-  "version": "5.32.1",
+  "version": "5.33.1",
   "description": "Multi-frontend AI agent with full tool access, streaming, cron jobs, and plugin system",
   "author": "The Falconry",
   "license": "Apache-2.0",
@@ -112,7 +112,7 @@
     "@kilocode/sdk": "^7.2.22",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@openai/agents": "^0.18.0",
-    "@openai/codex-sdk": "^0.156.1",
+    "@openai/codex-sdk": "^0.157.1",
     "@opencode-ai/sdk": "^1.17.4",
     "@playwright/mcp": "0.0.56",
     "@types/cross-spawn": "^6.0.6",

package/src/core/config/index.ts

@@ -802,6 +802,21 @@ const configSchema = z.object({
     .object({ allowPrivateNetworks: z.boolean().default(true) })
     .strict()
     .optional(),
+  /**
+   * Inbound credential redaction (docs/secret-drop.md). Before a user's
+   * message is saved or shown to the model, passwords, API keys, tokens and
+   * any value already in ~/.talon/secrets become `[REDACTED:<kind>]`, and
+   * the chat is told once to use /secret. `deleteOriginal` also deletes the
+   * platform message where the bot can: in DMs (default), everywhere, or
+   * never.
+   */
+  redaction: z
+    .object({
+      enabled: z.boolean().default(true),
+      deleteOriginal: z.enum(["dm", "always", "never"]).default("dm"),
+    })
+    .strict()
+    .optional(),
   /**
    * The fetch ladder behind `fetch_url` (docs/fetch-ladder.md): when a page
    * answers with a bot wall it retries through browser-TLS impersonation,

package/src/core/secrets/redact.ts

@@ -0,0 +1,276 @@
+/**
+ * Inbound credential redaction — runs on a user's message before it is
+ * persisted (history DB, interaction logs, traces) or shown to the model.
+ *
+ * Three matchers, applied in order:
+ *  1. any value already stored in ~/.talon/secrets (exact substring);
+ *  2. well-known key/token shapes (sk-…, ghp_…, AKIA…, a PEM private key…);
+ *  3. a value next to a password word (`password: hunter2`, `pin 4821`).
+ *
+ * Each hit becomes `[REDACTED:<kind>]`. Conservative on purpose: prose that
+ * merely mentions a password ("I forgot my password", "pin the message")
+ * is left alone. A value after a bare "is" or space must look like a
+ * credential (a digit or symbol, at least six characters; a PIN is four to
+ * eight digits); after `:` or `=` any non-trivial token counts.
+ *
+ * Nothing here logs, and nothing returned carries a matched value.
+ */
+
+import { readdirSync, readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { dirs } from "../../util/paths.js";
+
+type RedactionKind =
+  "stored" | "private-key" | "api-key" | "token" | "password" | "pin";
+
+export interface RedactionResult {
+  text: string;
+  /** Kinds redacted, in first-seen order; empty when nothing matched. */
+  kinds: RedactionKind[];
+}
+
+const marker = (kind: RedactionKind): string => `[REDACTED:${kind}]`;
+
+// ── Known token shapes ──────────────────────────────────────────────────
+
+const TOKEN_PATTERNS: ReadonlyArray<{ kind: RedactionKind; re: RegExp }> = [
+  {
+    kind: "private-key",
+    re: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
+  },
+  // OpenAI / Anthropic / OpenRouter style: sk-…, sk-ant-…, sk-proj-…
+  { kind: "api-key", re: /\bsk-[A-Za-z0-9_-]{20,}/g },
+  // GitHub tokens
+  {
+    kind: "token",
+    re: /\b(?:gh[pousr]_[A-Za-z0-9]{30,}|github_pat_[A-Za-z0-9_]{30,})/g,
+  },
+  // AWS access key id
+  { kind: "api-key", re: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g },
+  // Google API key
+  { kind: "api-key", re: /\bAIza[0-9A-Za-z_-]{35}\b/g },
+  // Stripe
+  { kind: "api-key", re: /\b[rs]k_(?:live|test)_[0-9A-Za-z]{16,}/g },
+  // Slack
+  { kind: "token", re: /\bxox[abprs]-[A-Za-z0-9-]{10,}/g },
+  // Telegram bot token
+  { kind: "token", re: /\b\d{8,10}:AA[A-Za-z0-9_-]{33}\b/g },
+  // JWT
+  { kind: "token", re: /\beyJ[\w-]{10,}\.eyJ[\w-]{10,}\.[\w-]{10,}/g },
+  // `api_key=…`, `token: …`, `Bearer …` — a labelled long opaque value
+  {
+    kind: "token",
+    re: /\b((?:api[_-]?key|access[_-]?token|auth[_-]?token|secret[_-]?key|client[_-]?secret|token|bearer)\s*(?:[:=]\s*|\s+))([A-Za-z0-9._~+/=-]{16,})/gi,
+  },
+];
+
+// ── Password-word values ────────────────────────────────────────────────
+
+// Not bare "pass": "I'll pass on 2pm-ish" is prose.
+const PASSWORD_WORDS = "password|passwd|passphrase|passcode|pwd|pw";
+const PIN_WORDS = "pin code|pincode|pin";
+const SEPARATOR = String.raw`(?:\s+(?:is|was)\s+|\s*[:=]\s*|\s+-\s+|\s+)`;
+
+/** `<word> [is|:|=|-] <value>` — the separator is captured to judge the value. */
+const PASSWORD_RE = new RegExp(
+  String.raw`\b((?:${PASSWORD_WORDS})\b${SEPARATOR})(\S+)`,
+  "gi",
+);
+const PIN_RE = new RegExp(
+  String.raw`\b((?:${PIN_WORDS})\b${SEPARATOR})(\S+)`,
+  "gi",
+);
+
+/** Trailing sentence punctuation isn't part of the value. */
+function splitTrailing(token: string): [string, string] {
+  const m = /^(.*?)([.,;!?)"']*)$/.exec(token);
+  return m ? [m[1] ?? "", m[2] ?? ""] : [token, ""];
+}
+
+function looksLikePassword(value: string, explicit: boolean): boolean {
+  if (value.startsWith("[REDACTED:")) return false;
+  if (explicit) return value.length >= 3;
+  if (value.length < 6) return false;
+  // A bare word after "is"/space is prose ("my password is wrong").
+  return /[0-9]/.test(value) || /[^A-Za-z0-9]/.test(value);
+}
+
+function replaceWordValues(
+  text: string,
+  re: RegExp,
+  kind: RedactionKind,
+  accept: (value: string, explicit: boolean) => boolean,
+  hit: (k: RedactionKind) => void,
+): string {
+  return text.replace(re, (whole, lead: string, token: string) => {
+    const [value, trailing] = splitTrailing(token);
+    const explicit = /[:=]\s*$/.test(lead);
+    if (!value || !accept(value, explicit)) return whole;
+    hit(kind);
+    return `${lead}${marker(kind)}${trailing}`;
+  });
+}
+
+// ── Stored secrets (cached on the folder's mtime) ───────────────────────
+
+/** Shorter stored values would redact ordinary words and numbers. */
+const MIN_STORED_LENGTH = 6;
+
+let storedCache: { dir: string; stamp: number; values: string[] } | undefined;
+
+function storedValues(dir: string): string[] {
+  let stamp: number;
+  try {
+    stamp = statSync(dir).mtimeMs;
+  } catch {
+    return [];
+  }
+  if (storedCache && storedCache.dir === dir && storedCache.stamp === stamp) {
+    return storedCache.values;
+  }
+  const values: string[] = [];
+  try {
+    for (const name of readdirSync(dir)) {
+      if (name.startsWith(".")) continue;
+      try {
+        const v = readFileSync(join(dir, name), "utf8").trim();
+        if (v.length >= MIN_STORED_LENGTH && v.length <= 4096) values.push(v);
+      } catch {
+        /* unreadable entry — skip */
+      }
+    }
+  } catch {
+    return [];
+  }
+  // Longest first, so a value containing another is replaced whole.
+  values.sort((a, b) => b.length - a.length);
+  storedCache = { dir, stamp, values };
+  return values;
+}
+
+/** Drop the stored-value cache (tests; a write changes the mtime anyway). */
+export function resetRedactionCache(): void {
+  storedCache = undefined;
+}
+
+// ── Entry point ─────────────────────────────────────────────────────────
+
+/** Redact credentials from one inbound message's text. */
+export function redactInbound(
+  text: string,
+  opts: { secretsDir?: string } = {},
+): RedactionResult {
+  if (!text) return { text, kinds: [] };
+  const kinds: RedactionKind[] = [];
+  const hit = (k: RedactionKind): void => {
+    if (!kinds.includes(k)) kinds.push(k);
+  };
+  let out = text;
+
+  for (const value of storedValues(opts.secretsDir ?? dirs.secrets)) {
+    if (out.includes(value)) {
+      out = out.split(value).join(marker("stored"));
+      hit("stored");
+    }
+  }
+
+  for (const { kind, re } of TOKEN_PATTERNS) {
+    out = out.replace(re, (whole: string, lead?: string, value?: string) => {
+      // Labelled pattern: keep the label, redact only the value.
+      if (typeof lead === "string" && typeof value === "string") {
+        if (value.startsWith("[REDACTED:") || !/[0-9]/.test(value))
+          return whole;
+        hit(kind);
+        return `${lead}${marker(kind)}`;
+      }
+      hit(kind);
+      return marker(kind);
+    });
+  }
+
+  out = replaceWordValues(out, PASSWORD_RE, "password", looksLikePassword, hit);
+  out = replaceWordValues(
+    out,
+    PIN_RE,
+    "pin",
+    (v, explicit) => /^\d{4,8}$/.test(v) || (explicit && /^\d{3,12}$/.test(v)),
+    hit,
+  );
+
+  return { text: out, kinds };
+}
+
+/** The one-time nudge shown when something was redacted. */
+function redactionNotice(
+  kinds: readonly RedactionKind[],
+  deleted: boolean,
+): string {
+  const what = kinds.join(", ");
+  return (
+    `🔒 That message looked like it contained a credential (${what}). ` +
+    `I redacted it before saving or reading it` +
+    (deleted ? " and deleted the original message" : "") +
+    `. Next time, use /secret <name> to store it via a one-time private link.`
+  );
+}
+
+const noticed = new Set<string>();
+
+/** True the first time per chat (per daemon run) — the nudge is said once. */
+function shouldNotifyRedaction(chatKey: string): boolean {
+  if (noticed.has(chatKey)) return false;
+  noticed.add(chatKey);
+  return true;
+}
+
+/** Whether to delete the original platform message for this chat. */
+export function shouldDeleteRedacted(
+  mode: "dm" | "always" | "never" | undefined,
+  isDm: boolean,
+): boolean {
+  const m = mode ?? "dm";
+  return m === "always" || (m === "dm" && isDm);
+}
+
+export interface InboundRedaction {
+  text: string;
+  redacted: boolean;
+  /** Delete the platform's copy of the message (config + DM-ness). */
+  deleteOriginal: boolean;
+  /** The once-per-chat nudge to send, if any. */
+  notice?: string;
+}
+
+/**
+ * The one call a frontend makes per inbound message: redact `text` per the
+ * `redaction` config and decide on deletion and the nudge.
+ */
+export function applyInboundRedaction(
+  text: string,
+  ctx: {
+    chatKey: string;
+    isDm: boolean;
+    config?: { enabled?: boolean; deleteOriginal?: "dm" | "always" | "never" };
+    secretsDir?: string;
+  },
+): InboundRedaction {
+  if (ctx.config?.enabled === false || !text) {
+    return { text, redacted: false, deleteOriginal: false };
+  }
+  const result = redactInbound(text, { secretsDir: ctx.secretsDir });
+  if (!result.kinds.length) {
+    return { text, redacted: false, deleteOriginal: false };
+  }
+  const deleteOriginal = shouldDeleteRedacted(
+    ctx.config?.deleteOriginal,
+    ctx.isDm,
+  );
+  return {
+    text: result.text,
+    redacted: true,
+    deleteOriginal,
+    ...(shouldNotifyRedaction(ctx.chatKey)
+      ? { notice: redactionNotice(result.kinds, deleteOriginal) }
+      : {}),
+  };
+}

package/src/frontend/discord/middleware.ts

@@ -15,6 +15,8 @@ import { pushMessage } from "../../storage/history.js";
 import { registerChat } from "../../core/background/pulse/pulse.js";
 import { deriveNumericChatId } from "../../core/frontend-runtime/chat-id.js";
 import { handleMessage, getSenderName } from "./handlers/index.js";
+import { applyInboundRedaction } from "../../core/secrets/redact.js";
+import { log } from "../../util/log.js";
 
 export function registerMiddleware(client: Client, config: TalonConfig): void {
   client.on("messageCreate", (msg: Message) => {
@@ -30,6 +32,8 @@ export function registerMiddleware(client: Client, config: TalonConfig): void {
 
     if (isGroup) registerChat(chatId);
 
+    redactCredentials(msg, chatId, !isGroup, config);
+
     // Push to history buffer — text or attachment placeholder
     const numericMessageId = deriveNumericChatId(msg.id);
     const senderId = deriveNumericChatId(msg.author.id);
@@ -80,3 +84,29 @@ export function registerMiddleware(client: Client, config: TalonConfig): void {
     });
   });
 }
+
+/**
+ * Rewrite a credential out of `msg.content` before history, the handler or
+ * the model sees it (core/secrets/redact.ts), then delete the original and
+ * nudge toward /secret as configured. Delete/notice are best-effort.
+ */
+function redactCredentials(
+  msg: Message,
+  chatId: string,
+  isDm: boolean,
+  config: TalonConfig,
+): void {
+  if (!msg.content) return;
+  const r = applyInboundRedaction(msg.content, {
+    chatKey: chatId,
+    isDm,
+    config: config.redaction,
+  });
+  if (!r.redacted) return;
+  msg.content = r.text;
+  log("discord", `[${chatId}] Redacted a credential from an inbound message`);
+  if (r.deleteOriginal && msg.deletable) msg.delete().catch(() => {});
+  if (r.notice && "send" in msg.channel) {
+    msg.channel.send(r.notice).catch(() => {});
+  }
+}

package/src/frontend/native/surface/handlers.ts

@@ -47,6 +47,8 @@ import type { ClientAttachment } from "../protocol.js";
 import { configSnapshot, applyConfigUpdate } from "./settings.js";
 import { bridgeStatus, broadcastStatus } from "./status.js";
 import { logWarn } from "../../../util/log.js";
+import { applyInboundRedaction } from "../../../core/secrets/redact.js";
+import { emitAssistant } from "../turn/emit.js";
 import {
   interruptTurn,
   isBusy,
@@ -98,6 +100,31 @@ function resolveAttachments(
   return resolved;
 }
 
+/**
+ * Credentials out of a native message before it's emitted, persisted or
+ * sent to the model (core/secrets/redact.ts). The once-per-chat nudge is
+ * emitted after the caller has emitted the user's own message.
+ */
+function redactNativeText(
+  runtime: NativeRuntime,
+  chatId: string,
+  text: string,
+): string {
+  const r = applyInboundRedaction(text, {
+    chatKey: chatId,
+    isDm: true,
+    config: { ...runtime.config.redaction, deleteOriginal: "never" },
+  });
+  const notice = r.notice;
+  if (notice) {
+    queueMicrotask(() => {
+      const entry = runtime.chats.get(chatId);
+      if (entry) emitAssistant(runtime, entry, notice);
+    });
+  }
+  return r.text;
+}
+
 export function buildBridgeHandlers(
   runtime: NativeRuntime,
 ): BridgeServerHandlers {
@@ -114,7 +141,8 @@ export function buildBridgeHandlers(
     // straight delegations to the read-only half of the store.
     listMemory,
     memoryWhy,
-    send: (id, text, opts, caller) => {
+    send: (id, rawText, opts, caller) => {
+      const text = redactNativeText(runtime, id, rawText);
       const entry = chats.get(id) ?? chats.ensure(id);
       // Resolve the client's references into the records this daemon minted
       // at upload time — dropping anything it can't account for.
@@ -153,7 +181,8 @@ export function buildBridgeHandlers(
       }
       startTurn(runtime, entry, text, { attachments });
     },
-    queueMessage: (id, text) => {
+    queueMessage: (id, rawText) => {
+      const text = redactNativeText(runtime, id, rawText);
       // Edit/replace the queued follow-up's text, keeping whatever files were
       // queued with it. Empty text cancels the whole follow-up, attachments
       // included — the client's queue editor offers no other way to drop it.

package/src/frontend/teams/poll.ts

@@ -11,6 +11,8 @@ import { handleSlashCommand } from "./commands.js";
 import type { ChatMessage } from "./graph.js";
 import type { TeamsRuntime } from "./runtime.js";
 import { runTurn } from "./turn.js";
+import { postToTeams } from "./actions.js";
+import { applyInboundRedaction } from "../../core/secrets/redact.js";
 
 /**
  * Messages arrive newest first; everything before `lastSeenId` is new. IDs
@@ -44,6 +46,18 @@ async function handleMessage(
 ): Promise<void> {
   const talonChatId = `teams_chat_${msg.chatId}`;
   if (await handleSlashCommand(runtime, msg, talonChatId)) return;
+  // Credentials out before logging, history and the model (core/secrets).
+  const redaction = applyInboundRedaction(msg.text, {
+    chatKey: talonChatId,
+    isDm: false,
+    config: { ...runtime.config.redaction, deleteOriginal: "never" },
+  });
+  if (redaction.redacted) {
+    msg = { ...msg, text: redaction.text };
+    if (redaction.notice) {
+      postToTeams(runtime.webhookUrl, redaction.notice).catch(() => {});
+    }
+  }
 
   log(
     "teams",

package/src/frontend/telegram/middleware.ts

@@ -13,11 +13,12 @@ import { pushMessage } from "../../storage/history.js";
 import type { HistoryMessage } from "../../storage/repositories/history-repo.js";
 import { allowChat, revokeChat } from "./userbot.js";
 import { registerChat } from "../../core/background/pulse/pulse.js";
-import { log } from "../../util/log.js";
+import { log, logWarn } from "../../util/log.js";
 import { getSenderName } from "./handlers/index.js";
 import { noteUpdateId } from "./polling/update-offset.js";
 import { noteInboundThread } from "./topics.js";
 import { recordJoinRequest } from "./join-requests.js";
+import { applyInboundRedaction } from "../../core/secrets/redact.js";
 import {
   handleTextMessage,
   handlePhotoMessage,
@@ -104,6 +105,45 @@ function historyEntryFor(message: Message): HistoryEntry | undefined {
   return undefined;
 }
 
+// ── Credential redaction (before history, handlers and the model) ───────
+// Rewrites the message's text/caption in place, so every later reader —
+// history, interaction logs, traces, the prompt — sees only the
+// `[REDACTED:<kind>]` form. See core/secrets/redact.ts.
+export function makeRedactCredentials(config: TalonConfig) {
+  return async (
+    ctx: Filter<Context, "message">,
+    next: NextFunction,
+  ): Promise<void> => {
+    const message = ctx.message as { text?: string; caption?: string };
+    const field = message.text !== undefined ? "text" : "caption";
+    const original = message[field];
+    if (original) {
+      const r = applyInboundRedaction(original, {
+        chatKey: String(ctx.chat.id),
+        isDm: ctx.chat.type === "private",
+        config: config.redaction,
+      });
+      if (r.redacted) {
+        message[field] = r.text;
+        log(
+          "bot",
+          `[${ctx.chat.id}] Redacted a credential from an inbound message`,
+        );
+        if (r.deleteOriginal) {
+          await ctx.deleteMessage().catch((err: unknown) => {
+            logWarn(
+              "bot",
+              `Could not delete a redacted message: ${err instanceof Error ? err.message : String(err)}`,
+            );
+          });
+        }
+        if (r.notice) await ctx.reply(r.notice).catch(() => {});
+      }
+    }
+    return next();
+  };
+}
+
 // ── History capture (runs for ALL messages, before handlers) ─────────────
 function captureHistory(
   ctx: Filter<Context, "message">,
@@ -194,6 +234,7 @@ function registerMessageHandlers(bot: Bot, config: TalonConfig): void {
 
 export function registerMiddleware(bot: Bot, config: TalonConfig): void {
   bot.use(trackUpdateOffset);
+  bot.on("message", makeRedactCredentials(config));
   bot.on("message", captureHistory);
   bot.on("chat_join_request", cacheJoinRequest);
   bot.on("my_chat_member", revokeOnRemoval);

package/src/frontend/whatsapp/messages/inbound.ts

@@ -20,6 +20,7 @@ import {
 import { isAddressedToSelf, isGroupAllowed } from "../access.js";
 import { handleWhatsAppCommand, parseWhatsAppCommand } from "../commands.js";
 import { sendText } from "../actions/send.js";
+import { applyInboundRedaction } from "../../../core/secrets/redact.js";
 import {
   bareId,
   canonicalId,
@@ -67,6 +68,65 @@ function extractText(msg: WAMessage): string {
   );
 }
 
+/** The text-bearing fields of an inbound message, as [holder, key] pairs. */
+function textFields(msg: WAMessage): Array<[Record<string, unknown>, string]> {
+  const m = msg.message as Record<string, unknown> | null | undefined;
+  if (!m) return [];
+  const fields: Array<[Record<string, unknown>, string]> = [];
+  const add = (holder: unknown, key: string): void => {
+    if (
+      holder &&
+      typeof (holder as Record<string, unknown>)[key] === "string"
+    ) {
+      fields.push([holder as Record<string, unknown>, key]);
+    }
+  };
+  add(m, "conversation");
+  add(m.extendedTextMessage, "text");
+  add(m.imageMessage, "caption");
+  add(m.videoMessage, "caption");
+  add(m.documentMessage, "caption");
+  const wrapped = (
+    m.documentWithCaptionMessage as
+      { message?: Record<string, unknown> } | undefined
+  )?.message;
+  add(wrapped?.documentMessage, "caption");
+  return fields;
+}
+
+/**
+ * Rewrite credentials out of the raw message in place (core/secrets/redact.ts),
+ * so the message store, history and the prompt only ever hold the redacted
+ * form; nudge toward /secret once. WhatsApp offers a bot no way to delete a
+ * user's message for both sides, so `deleteOriginal` doesn't apply here.
+ */
+function redactCredentials(
+  runtime: WhatsAppRuntime,
+  msg: WAMessage,
+  chat: WhatsAppChatInfo,
+  isGroup: boolean,
+): void {
+  let notice: string | undefined;
+  for (const [holder, key] of textFields(msg)) {
+    const r = applyInboundRedaction(holder[key] as string, {
+      chatKey: chat.chatId,
+      isDm: !isGroup,
+      config: { ...runtime.config.redaction, deleteOriginal: "never" },
+    });
+    if (!r.redacted) continue;
+    holder[key] = r.text;
+    notice ??= r.notice;
+    log(
+      "whatsapp",
+      `[${chat.chatId}] Redacted a credential from an inbound message`,
+    );
+  }
+  const sock = runtime.sock;
+  if (notice && sock) {
+    sendText({ sock, gateway: runtime.gateway }, chat, notice).catch(() => {});
+  }
+}
+
 async function admitInbound(
   runtime: WhatsAppRuntime,
   msg: WAMessage,
@@ -131,7 +191,6 @@ async function recordInbound(
   admitted: AdmittedMessage,
 ): Promise<RecordedMessage | null> {
   const { jid, isGroup, identity } = admitted;
-  const text = extractText(msg).trim();
   // Group chats key on the group JID; DMs key on the person, so the
   // thread survives WhatsApp switching addressing form.
   const chat = registerWhatsAppChat(
@@ -139,6 +198,9 @@ async function recordInbound(
     undefined,
     isGroup ? undefined : canonicalId(identity),
   );
+  // Before the raw message is stored or its text read anywhere else.
+  redactCredentials(runtime, msg, chat, isGroup);
+  const text = extractText(msg).trim();
   const senderName = msg.pushName || canonicalId(identity) || "user";
   const msgId = rememberMessage({
     key: msg.key,