talon-agent 5.9.0 → 5.11.0

package/README.md

@@ -488,7 +488,7 @@ Config file: `~/.talon/config.json`
 | `heartbeatModel`           | ---          | Model for the heartbeat agent (falls back to `model`)                                                                   |
 | `heartbeatEffort`          | ---          | Reasoning effort for the heartbeat agent: `off`, `minimal`, `low`, `medium`, `high`, `xhigh`, `max`. Unset = the model's own default |
 | `router`                   | ---          | Plan-aware routing for background work: `{ "enabled": true, "ceilingPercent": 85 }`. Unpinned sub-agents, cron `query` jobs and heartbeats run on whichever backend has the most plan headroom, skipping any whose tightest window is at or above the ceiling. `enabled: false` restores inherit-the-caller's-backend ([Backends](docs/backends.md)) |
-| `backendBudgets`           | ---          | Soft token budgets for backends with no usage API, e.g. `{ "agy": { "tokensPer5h": 2000000, "tokensPerDay": 8000000 } }`. Talon's own rolling ledger is measured against these so such a backend still has a headroom signal — and it is what opts an idle backend into routing |
+| `backendBudgets`           | ---          | Soft token budgets for backends with no usage API, e.g. `{ "openai-agents": { "tokensPer5h": 2000000, "tokensPerDay": 8000000 } }`. Talon's own rolling ledger is measured against these so such a backend still has a headroom signal — and it is what opts an idle backend into routing. `agy` reports its real quota windows (via `agy -p /usage`); a budget there is only a fallback for when that read fails |
 | `dreamModel`               | ---          | Model for dream / memory consolidation (falls back to `model`)                                                          |
 | `dreamEffort`              | ---          | Reasoning effort for the dream agent — same levels as `heartbeatEffort`                                                 |
 | `braveApiKey`              | ---          | Brave Search API key                                                                                                    |
@@ -508,6 +508,33 @@ Config file: `~/.talon/config.json`
 | `memory`                   | ---          | Long-term memory backend selection: `mempalace` or `mem0` (see above)                                                   |
 | `mempalace`                | ---          | Legacy MemPalace plugin config (prefer `memory`)                                                                        |
 | `playwright`               | ---          | Playwright plugin config (see above)                                                                                    |
+| `triggers`                 | ---          | Per-chat trigger caps, e.g. `{ "maxActivePerChat": 5, "maxPersistentPerChat": 3 }` ([Scaling limits](#scaling-limits)) |
+| `agents`                   | ---          | Sub-agent caps: `{ "maxConcurrent": 6, "maxDepth": 2, "defaultTimeoutMs": 900000 }` ([docs/agents.md](docs/agents.md)) |
+
+### Scaling limits
+
+Two caps bound how much background work Talon keeps alive. Both keep their
+historical defaults and are raised in `~/.talon/config.json`; the error a
+capped tool returns names the key to raise.
+
+| Key                             | Default | Bounds | What it caps                                                 |
+| ------------------------------- | ------- | ------ | ------------------------------------------------------------ |
+| `triggers.maxActivePerChat`     | `5`     | 1–50   | Active (running or pending) triggers per chat                |
+| `triggers.maxPersistentPerChat` | unset   | 1–50   | Optional separate budget for persistent triggers (see below) |
+| `agents.maxConcurrent`          | `6`     | 1–64   | Live sub-agents daemon-wide, children included               |
+
+With `maxPersistentPerChat` unset, persistent and ad-hoc triggers share
+`maxActivePerChat`, exactly as before. Set it and the two draw from separate
+budgets: persistent triggers count only against `maxPersistentPerChat`, and
+`maxActivePerChat` then bounds ad-hoc (non-persistent) triggers only — so a
+chat running long-lived watchers still has room for a short CI wait. Caps are
+checked at `trigger_create`; lowering one never kills a trigger already
+running, and persistent triggers resumed after a restart are not re-checked.
+
+```json
+"triggers": { "maxActivePerChat": 5, "maxPersistentPerChat": 6 },
+"agents": { "maxConcurrent": 12 }
+```
 
 ### Background reasoning effort
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "talon-agent",
-  "version": "5.9.0",
+  "version": "5.11.0",
   "description": "Multi-frontend AI agent with full tool access, streaming, cron jobs, and plugin system",
   "author": "Dylan Neve",
   "license": "MIT",

package/src/app.ts

@@ -6,7 +6,7 @@
  * are loaded dynamically — only the selected platform's dependencies are required.
  */
 
-import { getFrontends } from "./core/config/index.js";
+import { ConfigFileError, getFrontends } from "./core/config/index.js";
 import { startUploadCleanup, stopUploadCleanup } from "./core/vfs/workspace.js";
 import { flushDatabase } from "./storage/db.js";
 import { getActiveCount, stopAllTurns } from "./core/engine/dispatcher.js";
@@ -40,6 +40,7 @@ import {
   crashCleanup,
   crashStep,
   handleUncaughtException,
+  handleUnhandledRejection,
 } from "./core/daemon/crash.js";
 import { log, logError, logWarn } from "./util/log.js";
 import { bootPhase, bootReport } from "./core/daemon/boot-timer.js";
@@ -119,9 +120,31 @@ async function applyStagedRestore(): Promise<string | null> {
   );
 }
 
-const restoreReport = await bootPhase("staged restore", applyStagedRestore);
+/**
+ * A present-but-invalid config.json is fatal at startup: print the file
+ * path and every problem, then exit non-zero. Booting on defaults instead
+ * would put the daemon in a surprising state (wrong frontend, no plugins).
+ */
+async function withConfigGuard<T>(fn: () => Promise<T>): Promise<T> {
+  try {
+    return await fn();
+  } catch (err) {
+    if (err instanceof ConfigFileError) {
+      logError("config", err.message);
+      console.error(`talon: ${err.message}`);
+      process.exit(1);
+    }
+    throw err;
+  }
+}
+
+const restoreReport = await withConfigGuard(() =>
+  bootPhase("staged restore", applyStagedRestore),
+);
 
-const { config } = await bootPhase("bootstrap", () => bootstrap());
+const { config } = await withConfigGuard(() =>
+  bootPhase("bootstrap", () => bootstrap()),
+);
 
 // Record this process as the daemon. The gateway port is appended once
 // the gateway binds (it may fall back from the default on EADDRINUSE).
@@ -361,12 +384,7 @@ process.on("uncaughtException", (err) =>
   handleUncaughtException(err, crashHooks),
 );
 
-process.on("unhandledRejection", (reason) => {
-  logWarn(
-    "bot",
-    `Unhandled rejection: ${reason instanceof Error ? reason.message : reason}`,
-  );
-});
+process.on("unhandledRejection", handleUnhandledRejection);
 
 // ── Start ────────────────────────────────────────────────────────────────────
 

package/src/backend/agy/factory.ts

@@ -35,6 +35,7 @@ import { evictOrphanSubprocesses } from "./process/orphans.js";
 import { getState, resetState } from "./state.js";
 import { resetChat, warmSession, refreshTools } from "./sessions.js";
 import { killAllChildren } from "./process/child.js";
+import { getAgyPlanUsage, resetAgyPlanUsage } from "./plan-usage.js";
 import { unregisterAllMcp } from "./mcp/register.js";
 import {
   resolveModel,
@@ -92,11 +93,11 @@ const agyFactory: BackendFactory = {
     // cache-write counter in its usage payload, hence `cacheMetrics: "read"`.
     const usage: UsageTelemetry = {
       getSessionSnapshot: async (chatId) => getState().lastUsage.get(chatId),
-      // No plan-usage endpoint exists: the CLI exposes `/usage` only as
-      // an interactive slash command that prints a human report, and
-      // there is no account API to read windows from. Reporting
-      // undefined lets /status fall through to another backend's plan.
-      getPlanUsage: async () => undefined,
+      // Quota windows come from `agy -p /usage --output-format text`
+      // (see plan-usage.ts): at most one spawn per cache window, and
+      // undefined on any failure so headroom falls back to the local
+      // `backendBudgets` ledger.
+      getPlanUsage: () => getAgyPlanUsage(),
     };
 
     const control: SystemControl = {
@@ -127,6 +128,7 @@ const agyFactory: BackendFactory = {
         killAllChildren("shutdown");
         unregisterAllMcp();
         resetModelCache();
+        resetAgyPlanUsage();
         resetState();
         log("bot", "Antigravity backend cleaned up");
       },

package/src/backend/agy/plan-usage.ts

@@ -0,0 +1,240 @@
+/**
+ * Antigravity subscription quota windows for `/usage`, `/status` and the
+ * plan-aware router.
+ *
+ * `agy` has no account API, but its `/usage` slash command also runs
+ * headlessly: `agy -p /usage --output-format text` prints one
+ * tab-separated line per quota window and exits without a model call:
+ *
+ *   Gemini Models  Weekly Limit Remaining     60%   2026-09-26T17:40:26Z
+ *   Gemini Models  Five Hour Limit Remaining  100%  2026-09-23T21:23:05Z
+ *
+ * Columns are the model group, the window, the percent REMAINING, and the
+ * next reset (ISO-8601 UTC). Talon speaks percent used, so the figure is
+ * flipped on the way in.
+ *
+ * A read is a subprocess spawn (~a second of Go start-up plus an account
+ * round-trip), so it is cached for a minute, concurrent callers share one
+ * spawn, and a failed read backs off before trying again. Everything
+ * degrades to the last good value or `undefined` — never a throw, so
+ * `/status` and the router fall through to the local-budget ledger.
+ */
+
+import { spawn } from "node:child_process";
+import { logWarn } from "../../util/log.js";
+import type {
+  PlanUsage,
+  PlanWindow,
+} from "../../core/agent-runtime/capabilities.js";
+import { AGY_KILL_GRACE_MS } from "./constants.js";
+import { agyBinary } from "./state.js";
+
+/** argv for the headless quota report. */
+const AGY_USAGE_ARGS: readonly string[] = [
+  "-p",
+  "/usage",
+  "--output-format",
+  "text",
+];
+const RUN_TIMEOUT_MS = 20_000;
+const CACHE_TTL_MS = 60_000;
+/** After a failed read, how long to wait before spawning `agy` again. */
+const FAILURE_BACKOFF_MS = 15_000;
+/** The report is a handful of lines; anything past this is not it. */
+const MAX_OUTPUT_BYTES = 64 * 1024;
+
+// ── Parsing ─────────────────────────────────────────────────────────────────
+
+const HOUR_WORDS: Record<string, number> = {
+  one: 1,
+  two: 2,
+  three: 3,
+  four: 4,
+  five: 5,
+  six: 6,
+  eight: 8,
+  twelve: 12,
+};
+
+/**
+ * Short duration label for a window name, in the claude/codex vocabulary
+ * (`5h`, `7d`). Unknown window kinds return undefined and are skipped
+ * rather than rendered under a guessed name.
+ */
+function windowLabel(name: string): string | undefined {
+  const lower = name.toLowerCase();
+  if (/\bweekly\b/.test(lower)) return "7d";
+  if (/\bdaily\b/.test(lower)) return "1d";
+  const hours = /\b(\d+|[a-z]+)[\s-]+hours?\b/.exec(lower);
+  if (hours) {
+    const raw = hours[1] as string;
+    const n = /^\d+$/.test(raw) ? Number(raw) : HOUR_WORDS[raw];
+    if (n && n > 0) return n % 24 === 0 ? `${n / 24}d` : `${n}h`;
+  }
+  return undefined;
+}
+
+/** `Gemini Models` → `Gemini`, `Claude and GPT models` → `Claude/GPT`. */
+function groupLabel(name: string): string {
+  const short = name
+    .replace(/\s+models?$/i, "")
+    .replace(/\s+and\s+/gi, "/")
+    .trim();
+  return short.length > 0 ? short : name.trim();
+}
+
+/** Percent remaining (`60%`, `60`, `12.5 %`) → percent used, 0-100. */
+function usedPercent(raw: string): number | undefined {
+  const match = /^(\d+(?:\.\d+)?)\s*%?$/.exec(raw.trim());
+  if (!match) return undefined;
+  const remaining = Number(match[1]);
+  if (!Number.isFinite(remaining)) return undefined;
+  return Math.max(0, Math.min(100, Math.round(100 - remaining)));
+}
+
+// oxlint-disable-next-line no-control-regex -- stripping terminal escapes
+const ANSI = /\u001b\[[0-9;]*[A-Za-z]/g;
+
+function columns(line: string): string[] {
+  const clean = line.replace(ANSI, "").trim();
+  // Tabs are the real separator; runs of 2+ spaces cover a report that
+  // was padded into aligned columns instead.
+  const parts = clean.includes("\t")
+    ? clean.split(/\t+/)
+    : clean.split(/ {2,}/);
+  return parts.map((p) => p.trim()).filter((p) => p.length > 0);
+}
+
+function parseLine(line: string): PlanWindow | undefined {
+  const [group, window, percent, reset] = columns(line);
+  if (!group || !window || !percent) return undefined;
+  const duration = windowLabel(window);
+  const used = usedPercent(percent);
+  if (!duration || used === undefined) return undefined;
+  return {
+    label: `${groupLabel(group)} · ${duration}`,
+    percent: used,
+    ...(reset && Number.isFinite(Date.parse(reset)) ? { resetsAt: reset } : {}),
+  };
+}
+
+/**
+ * Parse `agy /usage` text output. Malformed or unknown lines are skipped;
+ * `undefined` when no line yields a window.
+ */
+export function parseAgyUsage(stdout: string): PlanUsage | undefined {
+  const windows: PlanWindow[] = [];
+  for (const line of stdout.split(/\r?\n/)) {
+    const window = parseLine(line);
+    if (window) windows.push(window);
+  }
+  if (windows.length === 0) return undefined;
+  return { windows, fetchedAt: Date.now() };
+}
+
+// ── Running ─────────────────────────────────────────────────────────────────
+
+/**
+ * Spawn `agy -p /usage` once and parse what it prints. Non-zero exit,
+ * spawn error, timeout or unparseable output all resolve `undefined`.
+ */
+export function runAgyUsage(
+  binary: string = agyBinary(),
+  timeoutMs: number = RUN_TIMEOUT_MS,
+): Promise<PlanUsage | undefined> {
+  return new Promise((resolve) => {
+    let settled = false;
+    let stdout = "";
+    let stderr = "";
+    const finish = (value: PlanUsage | undefined, why?: string) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      if (why) logWarn("agent", `agy usage: ${why}`);
+      resolve(value);
+    };
+
+    let proc: ReturnType<typeof spawn>;
+    try {
+      proc = spawn(binary, [...AGY_USAGE_ARGS], {
+        env: process.env,
+        stdio: ["ignore", "pipe", "pipe"],
+        windowsHide: true,
+      });
+    } catch (err) {
+      resolve(undefined);
+      logWarn(
+        "agent",
+        `agy usage: ${err instanceof Error ? err.message : String(err)}`,
+      );
+      return;
+    }
+
+    const timer = setTimeout(() => {
+      finish(undefined, `timed out after ${timeoutMs}ms`);
+      proc.kill("SIGTERM");
+      setTimeout(() => {
+        if (proc.exitCode === null && proc.signalCode === null) {
+          proc.kill("SIGKILL");
+        }
+      }, AGY_KILL_GRACE_MS).unref?.();
+    }, timeoutMs);
+
+    proc.stdout?.setEncoding("utf-8");
+    proc.stdout?.on("data", (chunk: string) => {
+      if (stdout.length < MAX_OUTPUT_BYTES) stdout += chunk;
+    });
+    proc.stderr?.setEncoding("utf-8");
+    proc.stderr?.on("data", (chunk: string) => {
+      stderr = (stderr + chunk).slice(-500);
+    });
+    proc.on("error", (err) => finish(undefined, err.message));
+    proc.on("close", (code) => {
+      if (code !== 0) {
+        const tail = stderr.trim().split("\n").pop() ?? "";
+        finish(undefined, `exited ${code}${tail ? `: ${tail}` : ""}`);
+        return;
+      }
+      const usage = parseAgyUsage(stdout);
+      finish(usage, usage ? undefined : "no quota windows in output");
+    });
+  });
+}
+
+// ── Cache ───────────────────────────────────────────────────────────────────
+
+let cache: { value: PlanUsage; fetchedAt: number } | undefined;
+let lastFailureAt: number | undefined;
+let inFlight: Promise<PlanUsage | undefined> | undefined;
+
+/**
+ * Plan windows, cached for a minute with concurrent callers sharing one
+ * spawn. A failed refresh serves the last good value (its `fetchedAt`
+ * lets renderers age it) and is not retried for {@link FAILURE_BACKOFF_MS},
+ * so a busy router cannot turn a broken `agy` into a spawn storm.
+ */
+export async function getAgyPlanUsage(): Promise<PlanUsage | undefined> {
+  const now = Date.now();
+  if (cache && now - cache.fetchedAt < CACHE_TTL_MS) return cache.value;
+  if (lastFailureAt !== undefined && now - lastFailureAt < FAILURE_BACKOFF_MS)
+    return cache?.value;
+
+  inFlight ??= runAgyUsage().finally(() => {
+    inFlight = undefined;
+  });
+  const loaded = await inFlight;
+  if (loaded) {
+    cache = { value: loaded, fetchedAt: loaded.fetchedAt };
+    lastFailureAt = undefined;
+  } else {
+    lastFailureAt = Date.now();
+  }
+  return loaded ?? cache?.value;
+}
+
+/** Drop the cached reading — backend cleanup and test isolation. */
+export function resetAgyPlanUsage(): void {
+  cache = undefined;
+  lastFailureAt = undefined;
+  inFlight = undefined;
+}

package/src/backend/claude-sdk/plan-usage.ts

@@ -21,7 +21,14 @@ import type {
   PlanWindow,
 } from "../../core/agent-runtime/capabilities.js";
 
-const USAGE_ENDPOINT = "https://api.anthropic.com/api/oauth/usage";
+// `cedar_ember=1` asks the endpoint to include banked limit resets (the
+// claude.ai "Reset for free" grants); `skip_spend=1` drops the spend block we
+// don't render. Resets are only reported to the CLI surface — any other
+// user agent gets `ineligible_reason: "surface"` — so the request identifies
+// as the CLI, which is what the Agent SDK runs anyway.
+const USAGE_ENDPOINT =
+  "https://api.anthropic.com/api/oauth/usage?cedar_ember=1&skip_spend=1";
+const CLI_USER_AGENT = "claude-cli/2.1.280 (external, cli)";
 const REQUEST_TIMEOUT_MS = 5_000;
 const CACHE_TTL_MS = 60_000;
 
@@ -77,6 +84,48 @@ function windowLabel(limit: RawLimit): string | undefined {
   return undefined;
 }
 
+interface RawResetGrant {
+  resets_left?: number;
+  ends_at?: string | null;
+  paused?: boolean;
+}
+
+/**
+ * Banked limit resets still usable: unpaused grants whose window hasn't
+ * closed. Returns the count and the soonest deadline among grants that still
+ * hold a reset, or undefined when there's nothing to offer.
+ */
+export function parseBankedResets(
+  body: unknown,
+  now = Date.now(),
+): { count: number; expiresAt?: string } | undefined {
+  const program = (body as { cedar_ember?: unknown } | null)?.cedar_ember as
+    { eligible?: boolean; grants?: unknown } | null | undefined;
+  if (!program || program.eligible === false || !Array.isArray(program.grants))
+    return undefined;
+
+  let count = 0;
+  let expiresAt: string | undefined;
+  for (const grant of program.grants as RawResetGrant[]) {
+    const left = grant.resets_left;
+    if (typeof left !== "number" || !Number.isFinite(left) || left <= 0)
+      continue;
+    if (grant.paused === true) continue;
+    const ends =
+      typeof grant.ends_at === "string" ? Date.parse(grant.ends_at) : NaN;
+    if (Number.isFinite(ends) && ends <= now) continue;
+    count += Math.floor(left);
+    if (
+      typeof grant.ends_at === "string" &&
+      Number.isFinite(ends) &&
+      (!expiresAt || ends < Date.parse(expiresAt))
+    )
+      expiresAt = grant.ends_at;
+  }
+  if (count <= 0) return undefined;
+  return { count, ...(expiresAt ? { expiresAt } : {}) };
+}
+
 export function parsePlanUsage(
   body: unknown,
   subscriptionType?: string,
@@ -103,9 +152,16 @@ export function parsePlanUsage(
   }
 
   if (windows.length === 0) return undefined;
+  const banked = parseBankedResets(body);
   return {
     ...(subscriptionType ? { plan: subscriptionType } : {}),
     windows,
+    ...(banked
+      ? {
+          resetsAvailable: banked.count,
+          ...(banked.expiresAt ? { resetsExpireAt: banked.expiresAt } : {}),
+        }
+      : {}),
     fetchedAt: Date.now(),
   };
 }
@@ -119,6 +175,7 @@ async function load(): Promise<PlanUsage | undefined> {
       headers: {
         Authorization: `Bearer ${creds.accessToken}`,
         "anthropic-beta": "oauth-2025-04-20",
+        "User-Agent": CLI_USER_AGENT,
       },
       signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
     });

package/src/bootstrap.ts

@@ -607,7 +607,10 @@ function initRecurringAgents(
  * same delivery shape, so they are wired together.
  */
 function initWakeSubsystems(config: TalonConfig): void {
-  initTriggers({ execute: dispatcherExecute });
+  initTriggers({
+    execute: dispatcherExecute,
+    ...(config.triggers ? { caps: config.triggers } : {}),
+  });
   initAgents({
     execute: dispatcherExecute,
     ...(config.agents ? { caps: config.agents } : {}),

package/src/core/agent-runtime/capabilities.ts

@@ -261,6 +261,8 @@ export interface PlanUsage {
   windows: PlanWindow[];
   /** How many one-shot rate-limit resets are still banked, when the plan has them. */
   resetsAvailable?: number;
+  /** ISO time the soonest-expiring banked reset must be used by, when the plan says. */
+  resetsExpireAt?: string;
   /** Epoch ms of the read, so renderers can flag figures as aged. */
   fetchedAt: number;
 }

package/src/core/agents/registry.ts

@@ -141,7 +141,8 @@ export class AgentRegistry {
         ok: false,
         error:
           `Sub-agent concurrency cap reached (${caps.maxConcurrent} live). ` +
-          `Wait for one to finish (wait_for_agent) or kill one (kill_agent).`,
+          `Wait for one to finish (wait_for_agent) or kill one (kill_agent), ` +
+          `or raise agents.maxConcurrent in ~/.talon/config.json.`,
       };
     }
 

package/src/core/background/triggers/caps.ts

@@ -0,0 +1,78 @@
+/**
+ * Per-chat trigger caps — how many watcher scripts one chat may keep active.
+ *
+ * Configured by `config.triggers` (see core/config) and wired in once via
+ * initTriggers. The check is a pure function of the chat's active triggers so
+ * the gateway handler and the tests share one rule.
+ */
+
+import { MAX_ACTIVE_PER_CHAT } from "../../../storage/triggers.js";
+
+export type TriggerCaps = {
+  /** Active triggers per chat — all of them, or only ad-hoc ones when
+   *  `maxPersistentPerChat` is set. */
+  readonly maxActivePerChat: number;
+  /** Optional separate budget for persistent triggers. */
+  readonly maxPersistentPerChat?: number;
+};
+
+export const DEFAULT_TRIGGER_CAPS: TriggerCaps = {
+  maxActivePerChat: MAX_ACTIVE_PER_CHAT,
+};
+
+const capsHolder: { caps: TriggerCaps } = { caps: DEFAULT_TRIGGER_CAPS };
+
+/** Replace the live caps. Missing fields fall back to the defaults. */
+export function setTriggerCaps(caps?: Partial<TriggerCaps>): void {
+  const next: TriggerCaps = {
+    maxActivePerChat:
+      caps?.maxActivePerChat ?? DEFAULT_TRIGGER_CAPS.maxActivePerChat,
+    ...(caps?.maxPersistentPerChat !== undefined
+      ? { maxPersistentPerChat: caps.maxPersistentPerChat }
+      : {}),
+  };
+  capsHolder.caps = next;
+}
+
+export function getTriggerCaps(): TriggerCaps {
+  return capsHolder.caps;
+}
+
+/**
+ * Why a new trigger may not be created, or null when there is room.
+ *
+ * Without `maxPersistentPerChat`, every active trigger shares
+ * `maxActivePerChat` (the historical behaviour). With it, persistent and
+ * ad-hoc triggers draw from separate budgets.
+ */
+export function triggerCapError(
+  active: ReadonlyArray<{ persistent?: boolean }>,
+  persistent: boolean,
+  caps: TriggerCaps = capsHolder.caps,
+): string | null {
+  const configPath = "~/.talon/config.json";
+  if (caps.maxPersistentPerChat === undefined) {
+    if (active.length < caps.maxActivePerChat) return null;
+    return (
+      `Per-chat trigger cap reached (${caps.maxActivePerChat} active). ` +
+      `Cancel one before creating another, or raise ` +
+      `triggers.maxActivePerChat in ${configPath}.`
+    );
+  }
+  if (persistent) {
+    const count = active.filter((t) => t.persistent === true).length;
+    if (count < caps.maxPersistentPerChat) return null;
+    return (
+      `Per-chat persistent trigger cap reached ` +
+      `(${caps.maxPersistentPerChat} persistent active). Cancel one before ` +
+      `creating another, or raise triggers.maxPersistentPerChat in ${configPath}.`
+    );
+  }
+  const count = active.filter((t) => t.persistent !== true).length;
+  if (count < caps.maxActivePerChat) return null;
+  return (
+    `Per-chat ad-hoc trigger cap reached (${caps.maxActivePerChat} ` +
+    `non-persistent active). Cancel one before creating another, or raise ` +
+    `triggers.maxActivePerChat in ${configPath}.`
+  );
+}

package/src/core/background/triggers/index.ts

@@ -5,6 +5,7 @@
  * Split by responsibility:
  *   - `state`   — injected deps + the child/timeout/log/buffer registries,
  *                 the warden set, timing constants, init + getRunningCount
+ *   - `caps`    — per-chat active-trigger caps (config.triggers)
  *   - `command` — interpreter resolution per script language
  *   - `output`  — stdout/stderr capture, payload truncation, wake firing
  *   - `exit`    — timeout/cancel/shutdown, child kill, finalizeExit, failTrigger
@@ -20,6 +21,11 @@ import { handleStdoutLine } from "./output.js";
 import { handleTimeout, finalizeExit } from "./exit.js";
 
 export { initTriggers, getRunningCount } from "./state.js";
+export {
+  getTriggerCaps,
+  triggerCapError,
+  DEFAULT_TRIGGER_CAPS,
+} from "./caps.js";
 export { commandForLanguage } from "./command.js";
 export { spawnTrigger } from "./spawn.js";
 export { cancelTrigger, shutdownTriggers } from "./exit.js";

package/src/core/background/triggers/state.ts

@@ -9,12 +9,15 @@ import type { ChildProcess } from "node:child_process";
 import type { WriteStream } from "node:fs";
 import { execute as dispatcherExecute } from "../../engine/dispatcher.js";
 import { log } from "../../../util/log.js";
+import { getTriggerCaps, setTriggerCaps, type TriggerCaps } from "./caps.js";
 
 // ── Dependencies (injected at startup) ──────────────────────────────────────
 
 export type TriggerDeps = {
   /** Used for terminal "fired"/"errored" wake prompts that go through the model. */
   execute: typeof dispatcherExecute;
+  /** Per-chat caps from `config.triggers`; defaults apply when absent. */
+  caps?: Partial<TriggerCaps>;
 };
 
 /** Reassignable on a holder object so submodules see the injected deps. */
@@ -52,7 +55,15 @@ export const WARDEN_GRACE_SLACK_MS = 2_000;
 export function initTriggers(d: TriggerDeps): void {
   depsHolder.deps = d;
   lifecycle.shuttingDown = false;
-  log("triggers", "Initialized");
+  setTriggerCaps(d.caps);
+  const caps = getTriggerCaps();
+  log(
+    "triggers",
+    `Initialized — maxActivePerChat=${caps.maxActivePerChat}` +
+      (caps.maxPersistentPerChat !== undefined
+        ? ` maxPersistentPerChat=${caps.maxPersistentPerChat}`
+        : ""),
+  );
 }
 
 /** Number of triggers currently running. */

package/src/core/config/index.ts

@@ -464,15 +464,18 @@ const configSchema = z.object({
     })
     .optional(),
   /**
-   * Soft token budgets for backends with no account usage API (agy,
-   * openai-agents). Talon keeps a local rolling ledger of every turn and
+   * Soft token budgets for backends with no account usage API
+   * (openai-agents). Talon keeps a local rolling ledger of every turn and
    * one-shot it runs on a backend and derives headroom from it, so a
    * provider that cannot report a plan still has a load-balancing signal.
-   * Keyed by backend id; a backend with no entry contributes no signal
-   * (headroom 1, ranked below any backend with real telemetry on a tie).
+   * A backend's own plan windows always win; for agy (which reads its
+   * quota from `agy -p /usage`) a budget is only the fallback for when
+   * that read fails. Keyed by backend id; a backend with no entry
+   * contributes no signal (headroom 1, ranked below any backend with real
+   * telemetry on a tie).
    *
    * Example:
-   *   "backendBudgets": { "agy": { "tokensPer5h": 2000000, "tokensPerDay": 8000000 } }
+   *   "backendBudgets": { "openai-agents": { "tokensPer5h": 2000000, "tokensPerDay": 8000000 } }
    */
   backendBudgets: z
     .record(
@@ -508,6 +511,25 @@ const configSchema = z.object({
         .default(15 * 60 * 1000),
     })
     .optional(),
+  /**
+   * Triggers — per-chat caps on active watcher scripts (running or
+   * pending). Checked when `trigger_create` runs; triggers already running
+   * are never killed when a cap is lowered.
+   *
+   *   - `maxActivePerChat` — active triggers per chat (default 5). When
+   *     `maxPersistentPerChat` is unset this counts persistent and ad-hoc
+   *     triggers together, exactly as before.
+   *   - `maxPersistentPerChat` — optional separate budget for persistent
+   *     triggers. When set, persistent triggers count only against it and
+   *     `maxActivePerChat` bounds ad-hoc (non-persistent) triggers only, so
+   *     long-lived watchers can't starve short ad-hoc ones.
+   */
+  triggers: z
+    .object({
+      maxActivePerChat: z.number().int().min(1).max(50).default(5),
+      maxPersistentPerChat: z.number().int().min(1).max(50).optional(),
+    })
+    .optional(),
   /**
    * Backups & checkpoints (docs/backups.md). Talon's only safety net, so
    * it is on by default: every `intervalHours` it writes a snapshot of
@@ -782,15 +804,84 @@ const DEFAULT_CONFIG = {
   pulseIntervalMs: 300000,
 };
 
+/**
+ * A config.json that exists but cannot be used — unreadable, not JSON, or
+ * rejected by the schema. Thrown instead of falling back to defaults: a
+ * daemon that silently boots on defaults (e.g. the telegram frontend) is
+ * far more surprising than one that refuses to start. The file on disk is
+ * never touched. `issues` carries one line per problem for callers that
+ * want to render them individually.
+ */
+export class ConfigFileError extends Error {
+  constructor(
+    message: string,
+    readonly path: string,
+    readonly issues: readonly string[] = [],
+  ) {
+    super(message);
+    this.name = "ConfigFileError";
+  }
+}
+
+/**
+ * Append a line/column hint to a JSON.parse error message. Recent V8
+ * already includes "(line L column C)"; older runtimes only report
+ * "at position N", so derive it from the raw text in that case.
+ */
+function describeJsonError(err: unknown, raw: string): string {
+  const message = err instanceof Error ? err.message : String(err);
+  if (/\(line \d+ column \d+\)/.test(message)) return message;
+  const match = /at position (\d+)/.exec(message);
+  if (!match) return message;
+  const before = raw.slice(0, Number(match[1]));
+  const line = before.split("\n").length;
+  const column = before.length - before.lastIndexOf("\n");
+  return `${message} (line ${line} column ${column})`;
+}
+
+/** Render zod issues as `path: message` lines (`(root)` for top-level). */
+function formatSchemaIssues(error: z.ZodError): string[] {
+  return error.issues.map((issue) => {
+    const path = issue.path.map(String).join(".") || "(root)";
+    return `${path}: ${issue.message}`;
+  });
+}
+
+/**
+ * Read config.json. A missing file is `{}` (first run — defaults apply);
+ * a present file that cannot be read or parsed throws ConfigFileError.
+ */
 function loadConfigFile(): Record<string, unknown> {
+  if (!existsSync(CONFIG_FILE)) return {};
+  let raw: string;
   try {
-    if (existsSync(CONFIG_FILE)) {
-      return JSON.parse(readFileSync(CONFIG_FILE, "utf-8"));
-    }
-  } catch {
-    /* corrupt — will be recreated */
+    raw = readFileSync(CONFIG_FILE, "utf-8");
+  } catch (err) {
+    throw new ConfigFileError(
+      `Cannot read ${CONFIG_FILE}: ${err instanceof Error ? err.message : err}`,
+      CONFIG_FILE,
+    );
+  }
+  let data: unknown;
+  try {
+    data = JSON.parse(raw);
+  } catch (err) {
+    const detail = describeJsonError(err, raw);
+    throw new ConfigFileError(
+      `Invalid JSON in ${CONFIG_FILE}: ${detail}. ` +
+        `The file was left untouched — fix it and start Talon again.`,
+      CONFIG_FILE,
+      [detail],
+    );
+  }
+  if (data === null || typeof data !== "object" || Array.isArray(data)) {
+    throw new ConfigFileError(
+      `Invalid config in ${CONFIG_FILE}: the top level must be a JSON object.`,
+      CONFIG_FILE,
+      ["(root): expected a JSON object"],
+    );
   }
-  return {};
+  return data as Record<string, unknown>;
 }
 
 function normalizeDeprecatedFrontendConfig(
@@ -876,7 +967,18 @@ export function loadConfig(): TalonConfig {
     }
   }
 
-  const parsed = configSchema.parse(fileConfig);
+  const result = configSchema.safeParse(fileConfig);
+  if (!result.success) {
+    const issues = formatSchemaIssues(result.error);
+    throw new ConfigFileError(
+      `Invalid config in ${CONFIG_FILE}:\n` +
+        issues.map((line) => `  - ${line}`).join("\n") +
+        `\nThe file was left untouched — fix it and start Talon again.`,
+      CONFIG_FILE,
+      issues,
+    );
+  }
+  const parsed = result.data;
 
   // The soul kernel is gone (#953). Its config block still parses so an
   // existing config.json keeps loading, but it no longer does anything —

package/src/core/daemon/crash.ts

@@ -80,3 +80,26 @@ export function handleUncaughtException(err: Error, hooks: CrashHooks): void {
   crashStep("crash report", () => logError("bot", "Uncaught exception", err));
   process.exit(1);
 }
+
+/**
+ * `process.on("unhandledRejection")` body. Report — never crash — but keep
+ * the stack: a bare "Unhandled rejection: ENOSPC: no space left on device,
+ * write" says nothing about which code path forgot its `.catch()`. Async fs
+ * errors carry `path`/`syscall` rather than useful frames, so those ride
+ * along in the message too.
+ */
+export function handleUnhandledRejection(reason: unknown): void {
+  crashStep("rejection report", () => {
+    if (!(reason instanceof Error)) {
+      logError("bot", `Unhandled rejection: ${String(reason)}`);
+      return;
+    }
+    const { syscall, path } = reason as NodeJS.ErrnoException;
+    const where = [syscall, path].filter(Boolean).join(" ");
+    logError(
+      "bot",
+      `Unhandled rejection: ${reason.message}${where ? ` (${where})` : ""}`,
+      reason,
+    );
+  });
+}

package/src/core/engine/backend-router/ledger.ts

@@ -2,10 +2,10 @@
  * Local rolling token ledger — the headroom signal for backends with no
  * account usage API.
  *
- * Claude and Codex report subscription windows; `agy` has no account
- * endpoint and `openai-agents` has no plan at all. Without a second signal
- * the router would treat those as infinitely fresh and pile every background
- * run onto them. So Talon counts what it spends itself: every chat turn,
+ * Claude, Codex and `agy` report subscription windows; `openai-agents` has
+ * no plan at all, and `agy`'s read (a CLI spawn) can fail. Without a second
+ * signal the router would treat those as infinitely fresh and pile every
+ * background run onto them. So Talon counts what it spends itself: every chat turn,
  * one-shot and sub-agent folds its token total into a per-backend ledger,
  * and `headroom.ts` reads that against the operator's soft budget
  * (`config.backendBudgets`).

package/src/core/engine/gateway-actions/triggers.ts

@@ -19,12 +19,12 @@ import {
   validateTimeout,
   writeScriptFile,
   DEFAULT_TIMEOUT_SECONDS,
-  MAX_ACTIVE_PER_CHAT,
   type TriggerLanguage,
 } from "../../../storage/triggers.js";
 import {
   cancelTrigger,
   spawnTrigger,
+  triggerCapError,
 } from "../../background/triggers/index.js";
 import { log } from "../../../util/log.js";
 import { validateJobModelOverride } from "./validation.js";
@@ -61,13 +61,11 @@ export const triggerHandlers: SharedActionHandlers = {
         error: `A trigger named "${name}" already exists in this chat. Cancel it first or pick a different name.`,
       };
     }
-    const active = getActiveTriggersForChat(chatKey);
-    if (active.length >= MAX_ACTIVE_PER_CHAT) {
-      return {
-        ok: false,
-        error: `Per-chat trigger cap reached (${MAX_ACTIVE_PER_CHAT} active). Cancel one before creating another.`,
-      };
-    }
+    const capErr = triggerCapError(
+      getActiveTriggersForChat(chatKey),
+      persistent,
+    );
+    if (capErr) return { ok: false, error: capErr };
 
     // Validate the model up front so a bad id is rejected here instead of
     // silently failing at fire time.

package/src/core/mcp-hub/launcher.ts

@@ -40,7 +40,9 @@
  *   2. `TALON_BRIDGE_URL/health` stops responding for several
  *      consecutive pings — Talon's gateway is gone. Catches the
  *      "kilo serve / opencode serve outlives Talon" case where those
- *      daemons keep our stdin open across Talon restarts.
+ *      daemons keep our stdin open across Talon restarts. A ping that only
+ *      times out (port still bound, gateway busy) is tolerated for minutes,
+ *      not seconds — see BridgeWatchdog.
  */
 
 import crossSpawn from "cross-spawn";
@@ -203,7 +205,75 @@ export function wrapMcpCommand(command: readonly string[]): string[] {
 // within ~1 minute.
 const BRIDGE_PING_INTERVAL_MS = 15_000;
 const BRIDGE_PING_TIMEOUT_MS = 2_000;
-const BRIDGE_FAILURES_BEFORE_EXIT = 4;
+export const BRIDGE_FAILURES_BEFORE_EXIT = 4;
+// A ping that TIMES OUT means the port is still bound — the kernel accepted
+// the connection — but the gateway is too busy to answer within 2s (event
+// loop saturated by a burst of agents, a big synchronous write, …). That is
+// a live Talon, not a dead one, so it gets a much longer budget (~5 min)
+// before the child is evicted. Only a truly wedged daemon reaches it.
+export const BRIDGE_UNRESPONSIVE_BEFORE_EXIT = 20;
+
+/**
+ * Outcome of one bridge health ping:
+ *   - "ok": /health answered 2xx.
+ *   - "unreachable": nothing healthy behind the port (connection refused or
+ *     reset, non-2xx reply) — Talon is gone or restarting.
+ *   - "unresponsive": the request timed out — something holds the port but
+ *     is slow to answer; Talon is alive but busy.
+ */
+export type BridgePingOutcome = "ok" | "unreachable" | "unresponsive";
+
+/** Classify a rejected health fetch. Timeouts/aborts mean "busy", not "gone". */
+export function classifyBridgePingError(
+  err: unknown,
+): Exclude<BridgePingOutcome, "ok"> {
+  const name = (err as { name?: unknown } | null)?.name;
+  return name === "TimeoutError" || name === "AbortError"
+    ? "unresponsive"
+    : "unreachable";
+}
+
+/** Ping `${bridgeUrl}/health` once. Never throws. */
+export async function pingBridge(
+  bridgeUrl: string,
+  timeoutMs: number = BRIDGE_PING_TIMEOUT_MS,
+): Promise<BridgePingOutcome> {
+  try {
+    const resp = await fetch(`${bridgeUrl}/health`, {
+      signal: AbortSignal.timeout(timeoutMs),
+    });
+    // Drain the body so the socket is released promptly.
+    await resp.arrayBuffer().catch(() => undefined);
+    return resp.ok ? "ok" : "unreachable";
+  } catch (err) {
+    return classifyBridgePingError(err);
+  }
+}
+
+/**
+ * Consecutive-failure bookkeeping for the bridge watchdog. `record()`
+ * returns true once the child should be shut down: after
+ * BRIDGE_FAILURES_BEFORE_EXIT failures ending in an "unreachable" ping (the
+ * port is really closed), or after BRIDGE_UNRESPONSIVE_BEFORE_EXIT failures
+ * of any kind (the daemon is wedged, not just busy).
+ */
+export class BridgeWatchdog {
+  consecutiveFailures = 0;
+
+  record(outcome: BridgePingOutcome): boolean {
+    if (outcome === "ok") {
+      this.consecutiveFailures = 0;
+      return false;
+    }
+    this.consecutiveFailures += 1;
+    if (this.consecutiveFailures >= BRIDGE_UNRESPONSIVE_BEFORE_EXIT)
+      return true;
+    return (
+      outcome === "unreachable" &&
+      this.consecutiveFailures >= BRIDGE_FAILURES_BEFORE_EXIT
+    );
+  }
+}
 
 /**
  * Run the supervisor over `argvTail` = [cmd, ...args].
@@ -346,29 +416,19 @@ export function runSupervisor(argvTail: string[]): Promise<never> {
   // (every Talon-spawned MCP server has it; ad-hoc supervisor uses
   // without the env var keep the stdin-EOF-only behavior).
   if (BRIDGE_URL) {
-    let consecutiveFailures = 0;
+    const watchdog = new BridgeWatchdog();
     const tick = async (): Promise<void> => {
       if (terminating) return;
-      try {
-        const resp = await fetch(`${BRIDGE_URL}/health`, {
-          signal: AbortSignal.timeout(BRIDGE_PING_TIMEOUT_MS),
-        });
-        if (resp.ok) {
-          consecutiveFailures = 0;
-          return;
-        }
-        consecutiveFailures += 1;
-      } catch {
-        consecutiveFailures += 1;
-      }
-      if (consecutiveFailures >= BRIDGE_FAILURES_BEFORE_EXIT) {
-        // Talon's gateway is gone. The MCP child has nothing useful to
-        // serve — bridge calls would 404 against a dead port — so shut
-        // down. Kilo/OpenCode notice the stdio close on the next
-        // interaction and drop the registration on their side.
+      const outcome = await pingBridge(BRIDGE_URL);
+      if (terminating) return;
+      if (watchdog.record(outcome)) {
+        // Talon's gateway is gone (or wedged for minutes). The MCP child
+        // has nothing useful to serve — bridge calls would 404 against a
+        // dead port — so shut down. Kilo/OpenCode notice the stdio close
+        // on the next interaction and drop the registration on their side.
         process.stderr.write(
-          `mcp-launcher: bridge ${BRIDGE_URL} unreachable for ${
-            consecutiveFailures * (BRIDGE_PING_INTERVAL_MS / 1000)
+          `mcp-launcher: bridge ${BRIDGE_URL} ${outcome} for ${
+            watchdog.consecutiveFailures * (BRIDGE_PING_INTERVAL_MS / 1000)
           }s; shutting down child\n`,
         );
         terminate(0);

package/src/core/tools/ops/triggers.ts

@@ -57,7 +57,8 @@ shutdown/crash are respawned (not ones that exited on their own), the
 script must be safe to re-run from scratch, and timeout_seconds is ignored
 (persistent triggers run until cancelled or until Talon shuts down).
 
-Per-chat cap of 5 active triggers.`;
+Per-chat cap on active triggers (default 5; config triggers.maxActivePerChat,
+with an optional separate triggers.maxPersistentPerChat budget).`;
 
 export const triggerTools: ToolDefinition[] = [
   {

package/src/frontend/presentation/reports.ts

@@ -462,7 +462,10 @@ export function renderUsageMessage(
     if (entry.plan.resetsAvailable) {
       const n = entry.plan.resetsAvailable;
       const resets = `usage limit reset${n === 1 ? "" : "s"} available`;
-      lines.push(`  • You have ${fmt.bold(String(n))} ${resets}`);
+      const by = entry.plan.resetsExpireLabel
+        ? ` ${fmt.escape(`(use by ${entry.plan.resetsExpireLabel})`)}`
+        : "";
+      lines.push(`  • You have ${fmt.bold(String(n))} ${resets}${by}`);
     }
     for (const w of entry.plan.windows) {
       const reset = w.resetLabel ? ` reset ${w.resetLabel}` : "";

package/src/frontend/presentation/status-context.ts

@@ -404,6 +404,8 @@ export interface PlanDisplay {
   windows: PlanWindowDisplay[];
   /** Set only when the account still has one-shot rate-limit resets left. */
   resetsAvailable: number | undefined;
+  /** Deadline for the soonest-expiring banked reset, when the plan reports one. */
+  resetsExpireLabel?: string;
   /** Set only when the figures have aged, e.g. "12m ago". */
   ageLabel: string | undefined;
 }
@@ -432,6 +434,9 @@ export function buildPlanDisplay(
   return {
     plan: usage.plan,
     resetsAvailable: usage.resetsAvailable,
+    resetsExpireLabel: usage.resetsAvailable
+      ? planResetLabel(usage.resetsExpireAt)
+      : undefined,
     ageLabel:
       age > PLAN_STALE_AFTER_MS
         ? formatRelativeAge(usage.fetchedAt)

package/src/storage/triggers.ts

@@ -38,7 +38,7 @@ import type { Trigger, TriggerLanguage } from "./repositories/triggers-repo.js";
 
 export const DEFAULT_TIMEOUT_SECONDS = 24 * 60 * 60; // 24h
 export const MAX_TIMEOUT_SECONDS = 7 * 24 * 60 * 60; // 7d
-/** Per-chat soft cap on simultaneously active triggers. */
+/** Default per-chat cap on simultaneously active triggers (`config.triggers.maxActivePerChat`). */
 export const MAX_ACTIVE_PER_CHAT = 5;
 /** Truncate fire payloads at this many bytes to keep wake prompts sane. */
 export const FIRE_PAYLOAD_MAX_BYTES = 4_096;