talon-agent 5.5.0 → 5.5.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "talon-agent",
-  "version": "5.5.0",
+  "version": "5.5.1",
   "description": "Multi-frontend AI agent with full tool access, streaming, cron jobs, and plugin system",
   "author": "Dylan Neve",
   "license": "MIT",
@@ -108,7 +108,7 @@
     "@kilocode/sdk": "^7.2.22",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@openai/agents": "^0.18.0",
-    "@openai/codex-sdk": "^0.154.0",
+    "@openai/codex-sdk": "^0.155.0",
     "@opencode-ai/sdk": "^1.17.4",
     "@playwright/mcp": "0.0.56",
     "@types/cross-spawn": "^6.0.6",

package/src/frontend/telegram/handlers/access.ts

@@ -151,6 +151,47 @@ export async function isAccessAllowed(
   return false;
 }
 
+/**
+ * True when the update is a /command or an inline-button press.
+ *
+ * Both are handled by `bot.command` / `bot.callbackQuery` handlers that
+ * run before — and independently of — the message handlers, so the
+ * message-path access check never sees them.
+ */
+export function isCommandOrCallback(ctx: Context): boolean {
+  if (ctx.callbackQuery) return true;
+  const msg = ctx.message ?? ctx.editedMessage;
+  if (!msg) return false;
+  const entities = msg.entities ?? msg.caption_entities ?? [];
+  return entities.some((e) => e.type === "bot_command" && e.offset === 0);
+}
+
+/**
+ * Gate every /command and button press behind the same access check as
+ * ordinary messages (denylist, DM whitelist, group admin membership).
+ *
+ * Without this, a sender outside `allowedUsers` who DMs the bot is refused
+ * for plain text but can still run /model, /settings, /status, /mesh,
+ * /plugins, /memory and press any inline button, because those handlers
+ * are registered with grammy directly and never pass through
+ * `isAccessAllowed`. Must be installed BEFORE registerCommands and
+ * registerCallbacks so it sees the update first.
+ */
+export function registerCommandAccessGate(bot: Bot): void {
+  bot.use(async (ctx, next) => {
+    if (!isCommandOrCallback(ctx)) return next();
+    if (await isAccessAllowed(ctx, bot)) return next();
+    if (ctx.callbackQuery) {
+      try {
+        await ctx.answerCallbackQuery();
+      } catch {
+        /* stale query — ignore */
+      }
+    }
+    // Dropped: not passed to any command or callback handler.
+  });
+}
+
 /**
  * Maximum length of an unauthorized message body to retain in logs.
  * Keeps abusive payloads (large pastes, attachment captions etc.) bounded

package/src/frontend/telegram/handlers/index.ts

@@ -17,6 +17,7 @@ export {
   setAccessControl,
   shouldHandleInGroup,
   extractUnauthorizedPreview,
+  registerCommandAccessGate,
 } from "./access.js";
 export {
   getSenderName,

package/src/frontend/telegram/index.ts

@@ -21,7 +21,10 @@ import {
   setAdminUserId,
   telegramCommandMenu,
 } from "./commands/index.js";
-import { setAccessControl } from "./handlers/index.js";
+import {
+  setAccessControl,
+  registerCommandAccessGate,
+} from "./handlers/index.js";
 import { registerMiddleware } from "./middleware.js";
 import { confirmUpdates } from "./update-offset.js";
 import { registerCallbacks } from "./callbacks/index.js";
@@ -94,6 +97,9 @@ export function createTelegramFrontend(
         adminUserId: config.adminUserId,
       });
 
+      // Gate /commands and button presses behind the DM whitelist and
+      // group check BEFORE any command/callback handler is registered.
+      registerCommandAccessGate(bot);
       registerCommands(bot, config, gateway);
       registerMiddleware(bot, config);
       registerCallbacks(bot, config, gateway);