@a1hvdy/cc-openclaw 0.27.4 → 0.27.7

package/dist/src/channels/telegram-mirror/card-renderer.d.ts

@@ -16,6 +16,13 @@
 import type { Turn, ToolCallRecord } from './state-machine.js';
 import type { CardMeta } from './card-state.js';
 export declare function toolDiffBlock(tc: ToolCallRecord): string;
+/**
+ * v0.27.5 — pick a syntax-highlight language for a tool's RESULT block so the
+ * card colors output the way the terminal does. Bash/shell → 'bash'; file tools
+ * → inferred from the `file_path` extension via EXT_LANG. Unknown → undefined
+ * (renders classless, no regression — never guess a language we can't justify).
+ */
+export declare function langForTool(tc: ToolCallRecord): string | undefined;
 /**
  * Format one tool-call line for inclusion in the rendered card body.
  *   "✓ Bash · ls -la"

package/dist/src/channels/telegram-mirror/card-renderer.js

@@ -14,7 +14,7 @@
  * Tests live at tests/channels/telegram-mirror/m2-render-pipeline.test.ts.
  */
 import { renderStatusLine, renderMeters, renderTodos } from './status-line.js';
-import { escapeHtml, code, pre, markdownToHtml } from '../../lib/html-render.js';
+import { escapeHtml, code, pre, markdownToHtml, closeDanglingTags } from '../../lib/html-render.js';
 // v0.27.0 M1 — the card renders as Telegram HTML (parse_mode: 'HTML'), not
 // MarkdownV2. HTML only needs `& < >` escaped (no per-char backslash litter)
 // and supports <pre><code class="language-…"> + <blockquote> for true
@@ -182,6 +182,48 @@ export function toolDiffBlock(tc) {
     }
     return truncateDiff(lines);
 }
+/**
+ * v0.27.5 — extension → Telegram syntax-highlight language. Telegram's only
+ * source of color is `<pre><code class="language-X">`; this maps a file
+ * extension to the `X` it recognizes. Unlisted extensions fall through to
+ * `undefined` (classless block, exactly as today).
+ */
+const EXT_LANG = {
+    ts: 'typescript',
+    tsx: 'typescript',
+    js: 'javascript',
+    jsx: 'javascript',
+    py: 'python',
+    sh: 'bash',
+    json: 'json',
+    md: 'markdown',
+    yml: 'yaml',
+    yaml: 'yaml',
+    sql: 'sql',
+    go: 'go',
+    rs: 'rust',
+    css: 'css',
+    html: 'html',
+    toml: 'toml',
+};
+/**
+ * v0.27.5 — pick a syntax-highlight language for a tool's RESULT block so the
+ * card colors output the way the terminal does. Bash/shell → 'bash'; file tools
+ * → inferred from the `file_path` extension via EXT_LANG. Unknown → undefined
+ * (renders classless, no regression — never guess a language we can't justify).
+ */
+export function langForTool(tc) {
+    const n = tc.name.toLowerCase();
+    if (n === 'bash' || n === 'shell')
+        return 'bash';
+    const input = tc.input;
+    if (input && typeof input === 'object' && typeof input.file_path === 'string') {
+        const m = /\.([a-z0-9]+)$/i.exec(input.file_path);
+        if (m)
+            return EXT_LANG[m[1].toLowerCase()];
+    }
+    return undefined;
+}
 /**
  * Format one tool-call line for inclusion in the rendered card body.
  *   "✓ Bash · ls -la"
@@ -240,11 +282,14 @@ export function renderThinkingBlock(thinkingText) {
     // v0.27.0 M1 — Telegram HTML <blockquote> renders the reasoning as a single
     // indented quote (terminal-style), distinct from the assistant text. Content
     // is HTML-escaped; newlines are preserved inside the blockquote.
+    // v0.27.5 M3 — `expandable` collapses long reasoning to a tap-to-expand quote,
+    // keeping the card compact. stripHtml's `blockquote\b[^>]*>` already tolerates
+    // the attribute, so the plain-text fallback is unaffected.
     const body = trimmed
         .split('\n')
         .map((l) => escapeHtml(l))
         .join('\n');
-    return `💭 Thinking\n<blockquote>${body}</blockquote>`;
+    return `💭 Thinking\n<blockquote expandable>${body}</blockquote>`;
 }
 /**
  * Render the full turn into a Telegram-safe message body. The mirror keeps
@@ -339,9 +384,9 @@ export function renderTurn(turn, meta) {
             const diffText = toolDiffBlock(tc);
             const resultText = toolResultText(tc);
             const block = diffText
-                ? pre(diffText)
+                ? pre(diffText, 'diff') // v0.27.5 M1 — Telegram colors -/+ lines red/green
                 : resultText
-                    ? pre(truncateResult(resultText))
+                    ? pre(truncateResult(resultText), langForTool(tc)) // v0.27.5 M2 — lang-highlight output
                     : '';
             const withBlock = block ? `${line}\n${block}` : line;
             // Prefer line+block; if that bursts the cap, fall back to the line alone
@@ -410,13 +455,21 @@ export function renderTurn(turn, meta) {
     }
     // Guaranteed safety net: even if the budgeted assembly above has a logic gap,
     // a card MUST NOT exceed Telegram's 4096-char hard cap (an over-cap edit is
-    // rejected outright). A blunt slice here can split an HTML tag, but editTg's
-    // hardened plain-text fallback strips tags on rejection, so this degrades
-    // gracefully rather than freezing the card.
+    // rejected outright).
     const body = lines.join('\n');
     if (body.length <= 4096)
         return body;
-    return body.slice(0, 4095) + '…';
+    // v0.27.5 M4 — a blunt slice can split an HTML tag, which makes Telegram reject
+    // the edit and forces editTg's plain-text fallback (the path that surfaces
+    // literal `<pre>`/`**`/`- ` markup — the exact "raw markdown" leak we're
+    // closing). Instead: truncate at the last whole line ≤ 4090, close any tag the
+    // slice left dangling (LIFO), then append the ellipsis. The result is always
+    // well-formed HTML, so editTg never has to fall back. The 3900 budget means
+    // this rarely fires, but it must be safe when it does.
+    const hard = body.slice(0, 4090);
+    const nl = hard.lastIndexOf('\n');
+    const sliced = nl > 0 ? hard.slice(0, nl) : hard;
+    return closeDanglingTags(sliced) + '\n…';
 }
 /**
  * Decide whether the current turn snapshot should be sent (first render)

package/dist/src/channels/telegram-mirror/commands.d.ts

@@ -103,6 +103,19 @@ export declare function handleStatus(ctx: CommandContext): CommandResult;
 export declare function handleCompact(ctx: CommandContext): CommandResult;
 export declare function handleCost(ctx: CommandContext): CommandResult;
 export declare function handleRewind(ctx: CommandContext): CommandResult;
+/**
+ * v0.27.7 — /clear claims the command so it stops leaking to the LLM as plain
+ * text (the bug: before this, /clear wasn't in COMMAND_HANDLERS, so the inbound
+ * router forwarded it verbatim to Claude instead of handling it).
+ *
+ * It does NOT fake an in-place context reset. The running session's lifecycle +
+ * resume linkage live in the command-router (activeSessions, meta.claudeSessionId)
+ * and the engine — not this bookkeeping registry — so a pure mirror handler has
+ * no honest lever to wipe context (the same D-6 constraint behind /compact and
+ * /rewind being CLI-only). So /clear points to the paths that actually work: a
+ * fresh session via /new <slug>, or an in-place wipe via /clear in the CLI.
+ */
+export declare function handleClear(ctx: CommandContext): CommandResult;
 /**
  * Open a compose session for the chat. M7 — drafts append until /send.
  * Returns a force_reply prompt so Telegram nudges the user into reply mode.

package/dist/src/channels/telegram-mirror/commands.js

@@ -231,6 +231,30 @@ export function handleRewind(ctx) {
         ],
     };
 }
+// ── /clear ───────────────────────────────────────────────────────────────
+/**
+ * v0.27.7 — /clear claims the command so it stops leaking to the LLM as plain
+ * text (the bug: before this, /clear wasn't in COMMAND_HANDLERS, so the inbound
+ * router forwarded it verbatim to Claude instead of handling it).
+ *
+ * It does NOT fake an in-place context reset. The running session's lifecycle +
+ * resume linkage live in the command-router (activeSessions, meta.claudeSessionId)
+ * and the engine — not this bookkeeping registry — so a pure mirror handler has
+ * no honest lever to wipe context (the same D-6 constraint behind /compact and
+ * /rewind being CLI-only). So /clear points to the paths that actually work: a
+ * fresh session via /new <slug>, or an in-place wipe via /clear in the CLI.
+ */
+export function handleClear(ctx) {
+    return {
+        actions: [
+            {
+                type: 'sendMessage',
+                chat_id: ctx.chatId,
+                text: "⚠️ /clear can't reset a running session from Telegram (no session-control primitive — same as /compact and /rewind). For a fresh start use <b>/new &lt;slug&gt;</b>; for an in-place context wipe run <b>/clear</b> in the Claude Code CLI.",
+            },
+        ],
+    };
+}
 // ── /compose ─────────────────────────────────────────────────────────────
 /**
  * Open a compose session for the chat. M7 — drafts append until /send.
@@ -372,6 +396,7 @@ export const ALL_COMMANDS = [
     { command: 'cost', description: 'Show Max 20x usage + weekly burn' },
     { command: 'compact', description: 'Compact context (CLI-only — see note)' },
     { command: 'rewind', description: 'Rewind a session (CLI-only — see note)' },
+    { command: 'clear', description: 'Fresh start — /new <slug> (in-place reset is CLI-only)' },
     { command: 'compose', description: 'Start a multi-message draft — finish with /send' },
     { command: 'send', description: 'Send the composed draft to Claude' },
     { command: 'cancel', description: 'Cancel the active compose draft' },
@@ -398,6 +423,7 @@ export const COMMAND_HANDLERS = {
     compact: handleCompact,
     cost: handleCost,
     rewind: handleRewind,
+    clear: handleClear,
     compose: handleCompose,
     send: handleSend,
     cancel: handleCancel,

package/dist/src/channels/telegram-mirror/index.js

@@ -17,8 +17,10 @@
  * Risks monitored: R-7 (parallel maintenance burden — re-evaluate at soak start).
  */
 import { defaultRegisterGuard } from '../../lib/register-guard.js';
-import { initBotTokenFromConfig } from '../../lib/telegram-bot-api.js';
+import { initBotTokenFromConfig, telegramApi } from '../../lib/telegram-bot-api.js';
 import { registerInboundHandler } from './inbound-handler.js';
+import { syncMyCommands } from './sync-commands.js';
+import { TOP_7_COMMANDS } from './commands.js';
 /**
  * Mirror channel register — idempotent via defaultRegisterGuard.
  *
@@ -82,6 +84,47 @@ export function register(api) {
                     ? fullApi.enqueueNextTurnInjection.bind(api)
                     : undefined,
             });
+            // v0.27.7 — wire the command-menu sync. It was DEAD CODE (defined in
+            // sync-commands.ts but never called from boot), so cc-openclaw's native
+            // commands never reached Telegram's command menu — only OpenClaw's
+            // nativeSkills auto-sync did, which is why /stop /new /status were
+            // invisible in the menu. We MERGE (getMyCommands → union) so the sync
+            // AUGMENTS the menu instead of clobbering the skill commands, and DELAY
+            // it so it lands after OpenClaw's own boot sync (tunable via
+            // CC_OPENCLAW_CMD_SYNC_DELAY_MS; default 8s). Gated out of the test
+            // runner — register() fires repeatedly in unit tests and must not make
+            // real Telegram network calls (eager-work-at-register safety, mirrors
+            // OPENCLAW_PLUGIN_TEST_MODE rationale).
+            const isTestRunner = process.env.VITEST !== undefined ||
+                process.env.NODE_ENV === 'test' ||
+                process.env.OPENCLAW_PLUGIN_TEST_MODE === '1';
+            if (!isTestRunner) {
+                const cmdSyncDelayMs = Number(process.env.CC_OPENCLAW_CMD_SYNC_DELAY_MS) || 8000;
+                const timer = setTimeout(() => {
+                    void syncMyCommands({
+                        setMyCommands: (payload) => telegramApi('setMyCommands', { commands: payload.commands }),
+                        getMyCommands: async () => {
+                            const res = await telegramApi('getMyCommands', {});
+                            const result = res.result;
+                            return { commands: result ?? [] };
+                        },
+                        nativeCommands: [
+                            ...TOP_7_COMMANDS,
+                            {
+                                command: 'clear',
+                                description: 'Fresh start — /new <slug> (in-place reset is CLI-only)',
+                            },
+                        ],
+                        logger: {
+                            info: (msg) => process.stderr.write(`${msg}\n`),
+                            warn: (msg) => process.stderr.write(`${msg}\n`),
+                        },
+                    }).catch((err) => process.stderr.write(`[cc-openclaw/telegram-mirror] command-menu sync failed: ${err instanceof Error ? err.message : String(err)}\n`));
+                }, cmdSyncDelayMs);
+                // Don't keep the event loop alive solely for this timer.
+                if (typeof timer.unref === 'function')
+                    timer.unref();
+            }
             process.stderr.write('[cc-openclaw/telegram-mirror] guard body completed (v0.25.2).\n');
         }
         catch (err) {

package/dist/src/channels/telegram-mirror/sync-commands.d.ts

@@ -39,6 +39,32 @@ export interface SyncOptions {
      * Tests pass the G-3 mock; production wires a fetch-based caller.
      */
     setMyCommands: (payload: SetMyCommandsPayload) => Promise<unknown>;
+    /**
+     * v0.27.7 — optional getMyCommands dispatcher. When supplied, the CURRENTLY
+     * registered commands (e.g. OpenClaw's nativeSkills auto-synced /search,
+     * /plan, …) are fetched and MERGED with the native list so the sync augments
+     * the Telegram menu instead of replacing it. setMyCommands is a full-replace
+     * API, so without this merge a native-only sync would wipe the skill
+     * commands (and vice-versa — which is the bug that left native commands
+     * invisible: the dead sync never ran, and OpenClaw's skill-sync owned the
+     * menu alone). Omit it for the legacy native-only replace.
+     */
+    getMyCommands?: () => Promise<{
+        commands?: ReadonlyArray<{
+            command: string;
+            description: string;
+        }>;
+    }>;
+    /**
+     * v0.27.7 — native command set to advertise. Defaults to TOP_7_COMMANDS so
+     * the legacy callers (and the M5 boot-only test) keep the exact top-7 list.
+     * The boot wiring passes top-7 + /clear so the menu reflects the full native
+     * surface.
+     */
+    nativeCommands?: ReadonlyArray<{
+        command: string;
+        description: string;
+    }>;
     logger?: SyncLogger;
 }
 export interface SyncResult {

package/dist/src/channels/telegram-mirror/sync-commands.js

@@ -28,7 +28,24 @@ export async function syncMyCommands(opts) {
         return { alreadySynced: true, commandCount: 0 };
     }
     synced = true;
-    const payload = { commands: TOP_7_COMMANDS.slice() };
+    const native = opts.nativeCommands ?? TOP_7_COMMANDS;
+    let commands = native.map((c) => ({ ...c }));
+    // v0.27.7 — merge in existing (skill) commands so the sync augments rather
+    // than replaces the menu. Native wins on a name collision. If the fetch
+    // fails, fall back to native-only (never wipe the menu on a transient error).
+    if (opts.getMyCommands) {
+        try {
+            const existing = await opts.getMyCommands();
+            const nativeNames = new Set(native.map((c) => c.command));
+            const preserved = (existing?.commands ?? []).filter((c) => !nativeNames.has(c.command));
+            commands = [...commands, ...preserved.map((c) => ({ ...c }))];
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            opts.logger?.warn(`[cc-openclaw/telegram-mirror] getMyCommands failed — syncing native-only: ${msg}`);
+        }
+    }
+    const payload = { commands };
     try {
         await opts.setMyCommands(payload);
         opts.logger?.info(`[cc-openclaw/telegram-mirror] setMyCommands synced — ${payload.commands.length} commands.`);

package/dist/src/channels/telegram-mirror/turn-bridge.d.ts

@@ -90,7 +90,7 @@ export declare function pushThinking(text: string): void;
  * into the card during the turn, then calls this on turn end. Single-tenant:
  * finalizes ALL active cards (one at a time in practice).
  */
-export declare function finalizeActiveCards(): Promise<void>;
+export declare function finalizeActiveCards(deliveredText?: string): Promise<void>;
 /**
  * Map a caught error to a short, user-readable card reason (v0.27.0 M4). Keeps
  * the "❌ <reason>" header concise and classifies the common cc-openclaw-side

package/dist/src/channels/telegram-mirror/turn-bridge.js

@@ -272,7 +272,7 @@ export function pushThinking(text) {
  * into the card during the turn, then calls this on turn end. Single-tenant:
  * finalizes ALL active cards (one at a time in practice).
  */
-export async function finalizeActiveCards() {
+export async function finalizeActiveCards(deliveredText) {
     const chats = activeChatIds();
     if (chats.length === 0)
         return;
@@ -291,7 +291,15 @@ export async function finalizeActiveCards() {
             // The plugin can't suppress the gateway reply (no suppressUserDelivery
             // knob), so the card yields the final text and finalizes to a clean
             // status/tools/✓ Done activity view. renderTurn itself is unchanged.
-            turn.assistantText = '';
+            //
+            // v0.27.6 disconnect exception (Killer #2 report-drop) — when the gateway
+            // socket died mid-turn the gateway delivers NOTHING separately, so the
+            // dedup assumption breaks and wiping the text yields total silence
+            // ("✓ Done" then nothing). The caller passes the accumulated text in that
+            // case (deliveredText); the finalized card then KEEPS the full report as
+            // the sole delivery channel. On the happy path deliveredText is undefined
+            // → '' → behavior unchanged (gateway delivers, no duplicate).
+            turn.assistantText = deliveredText ?? '';
             try {
                 await editTg(chatId, card.messageId, renderTurn(turn, card.meta));
             }

package/dist/src/constants.d.ts

@@ -186,3 +186,20 @@ export declare const CC_AUTO_COMPACT_THRESHOLD = 70;
  *  recreate) instead of compacting. Used when /compact itself would leave
  *  the session too close to the model's window cap to do useful work. */
 export declare const CC_HARD_RESET_THRESHOLD = 90;
+/** Single-flight window for the openai-compat streaming path. When two
+ *  requests with a byte-identical (sessionName + input) signature arrive
+ *  within this window, the second is treated as a duplicate (an OpenClaw
+ *  retry of a stream it perceived as dead) and JOINS the in-flight turn
+ *  instead of spawning a SECOND full model run. The leader's result is
+ *  replayed to the follower; the model executes exactly once.
+ *
+ *  Born from the 2026-05-22 incident: an OOM SIGKILL (exit 137) made
+ *  OpenClaw retry, and session-manager's per-session send-chain SERIALIZES
+ *  (rather than coalesces) the retry — so the turn ran twice and delivered
+ *  two identical Telegram messages. This guards the duplicate at its source.
+ *
+ *  Set CC_OPENCLAW_DEDUP_WINDOW_MS=0 to disable (pure fail-open to the prior
+ *  serialize-and-rerun behavior). Default 45s comfortably exceeds a typical
+ *  OpenClaw read-timeout-then-retry gap without risking a real, distinct
+ *  follow-up message colliding with a just-finished identical one. */
+export declare const DEDUP_WINDOW_MS = 45000;

package/dist/src/constants.js

@@ -195,3 +195,21 @@ export const CC_AUTO_COMPACT_THRESHOLD = 70;
  *  recreate) instead of compacting. Used when /compact itself would leave
  *  the session too close to the model's window cap to do useful work. */
 export const CC_HARD_RESET_THRESHOLD = 90;
+// ─── request coalescing / duplicate-turn defense (v0.27.5) ──────────────────
+/** Single-flight window for the openai-compat streaming path. When two
+ *  requests with a byte-identical (sessionName + input) signature arrive
+ *  within this window, the second is treated as a duplicate (an OpenClaw
+ *  retry of a stream it perceived as dead) and JOINS the in-flight turn
+ *  instead of spawning a SECOND full model run. The leader's result is
+ *  replayed to the follower; the model executes exactly once.
+ *
+ *  Born from the 2026-05-22 incident: an OOM SIGKILL (exit 137) made
+ *  OpenClaw retry, and session-manager's per-session send-chain SERIALIZES
+ *  (rather than coalesces) the retry — so the turn ran twice and delivered
+ *  two identical Telegram messages. This guards the duplicate at its source.
+ *
+ *  Set CC_OPENCLAW_DEDUP_WINDOW_MS=0 to disable (pure fail-open to the prior
+ *  serialize-and-rerun behavior). Default 45s comfortably exceeds a typical
+ *  OpenClaw read-timeout-then-retry gap without risking a real, distinct
+ *  follow-up message colliding with a just-finished identical one. */
+export const DEDUP_WINDOW_MS = 45_000;

package/dist/src/engines/persistent-session.d.ts

@@ -27,6 +27,11 @@ interface InternalStats {
     lastActivity: string | null;
     /** v0.27.x — last PROGRESS event ts (excludes api_retry); watchdog keys off it. */
     lastProgressAt: string | null;
+    /** v0.27.6 — count of tool calls currently in flight (dispatched onToolUse
+     *  without a matching onToolResult yet). The stalled-session watchdog treats
+     *  inFlightTools > 0 as "alive" so a long quiet Bash/build/test step is never
+     *  killed mid-run. Reset to 0 at turn boundaries (start / complete / close). */
+    inFlightTools: number;
     history: Array<{
         time: string;
         type: string;

package/dist/src/engines/persistent-session.js

@@ -59,6 +59,7 @@ export class PersistentClaudeSession extends EventEmitter {
             startTime: null,
             lastActivity: null,
             lastProgressAt: null,
+            inFlightTools: 0,
             history: [],
             retries: 0,
             lastRetryError: undefined,
@@ -291,6 +292,9 @@ export class PersistentClaudeSession extends EventEmitter {
         });
         this.proc.on('close', (code) => {
             this._isReady = false;
+            // v0.27.6 — liveness watchdog (Killer #1): subprocess gone, nothing can be
+            // in flight; clear so a stale count never outlives the process.
+            this.stats.inFlightTools = 0;
             this.emit(SESSION_EVENT.CLOSE, code);
         });
         this.proc.on('error', (err) => {
@@ -385,6 +389,10 @@ export class PersistentClaudeSession extends EventEmitter {
                     const block = inner.content_block;
                     if (block?.type === 'tool_use') {
                         this.stats.toolCalls++;
+                        // v0.27.6 — liveness watchdog (Killer #1): a tool is now in flight.
+                        // Decremented on its tool_result; reset to 0 at turn boundaries so a
+                        // missed result can't pin the count open forever.
+                        this.stats.inFlightTools++;
                         // v0.26.1: carry the tool_use block id so the Telegram mirror can
                         // match the later tool_result event and flip the glyph … → ✓/✗.
                         const toolEvent = { tool: { name: block.name, input: {}, id: block.id } };
@@ -470,6 +478,10 @@ export class PersistentClaudeSession extends EventEmitter {
                             };
                             if (b.is_error)
                                 this.stats.toolErrors++;
+                            // v0.27.6 — liveness watchdog (Killer #1): this tool's result
+                            // arrived, so it's no longer in flight. Clamp at 0 (a duplicate or
+                            // unmatched result must never push the count negative).
+                            this.stats.inFlightTools = Math.max(0, this.stats.inFlightTools - 1);
                             try {
                                 this._streamCallbacks?.onToolResult?.(resultEvent);
                             }
@@ -511,6 +523,8 @@ export class PersistentClaudeSession extends EventEmitter {
                         }
                         else if (block.type === 'tool_use') {
                             this.stats.toolCalls++;
+                            // v0.27.6 — liveness watchdog (Killer #1): tool in flight (see above).
+                            this.stats.inFlightTools++;
                             const toolEvent = {
                                 tool: {
                                     name: block.name,
@@ -559,6 +573,8 @@ export class PersistentClaudeSession extends EventEmitter {
                 break;
             case 'tool_use':
                 this.stats.toolCalls++;
+                // v0.27.6 — liveness watchdog (Killer #1): tool in flight (see above).
+                this.stats.inFlightTools++;
                 try {
                     this._streamCallbacks?.onToolUse?.(event);
                 }
@@ -568,6 +584,8 @@ export class PersistentClaudeSession extends EventEmitter {
                 this.emit(SESSION_EVENT.TOOL_USE, event);
                 break;
             case 'tool_result':
+                // v0.27.6 — liveness watchdog (Killer #1): tool result arrived (see above).
+                this.stats.inFlightTools = Math.max(0, this.stats.inFlightTools - 1);
                 try {
                     this._streamCallbacks?.onToolResult?.(event);
                 }
@@ -601,6 +619,10 @@ export class PersistentClaudeSession extends EventEmitter {
                 }
                 this.emit(SESSION_EVENT.RESULT, event);
                 this.emit(SESSION_EVENT.TURN_COMPLETE, event);
+                // v0.27.6 — liveness watchdog (Killer #1): turn is over; clear any
+                // in-flight tool count so a missed tool_result can't pin the session
+                // "alive" across turns and permanently disable the stalled backstop.
+                this.stats.inFlightTools = 0;
                 this._fireHook('onTurnComplete', {
                     text: event.result,
                     usage,
@@ -668,6 +690,10 @@ export class PersistentClaudeSession extends EventEmitter {
             this._streamCallbacks = options.callbacks;
         if (options.waitForComplete) {
             this._isBusy = true;
+            // v0.27.6 — liveness watchdog (Killer #1): each turn starts with zero
+            // tools in flight; guarantees no count leaks across turns regardless of
+            // how the prior turn ended (result / error / partial).
+            this.stats.inFlightTools = 0;
             try {
                 return await this._waitForTurnComplete(options.timeout || resolveTurnTimeoutMs());
             }
@@ -781,6 +807,7 @@ export class PersistentClaudeSession extends EventEmitter {
             startTime: this.stats.startTime,
             lastActivity: this.stats.lastActivity,
             lastProgressAt: this.stats.lastProgressAt,
+            inFlightTools: this.stats.inFlightTools,
             // v0.6.0: contextPercent now reflects ACTUAL per-turn context occupancy
             // (input + cache-read tokens from the last `result` event), not lifetime
             // cumulative tokens. Pre-fix it saturated at 100% by turn 3 of any

package/dist/src/lib/html-render.d.ts

@@ -26,6 +26,21 @@ export declare function code(s: string): string;
  * stays legible. Not a general sanitizer — scoped to the tags this module emits.
  */
 export declare function stripHtml(input: string | null | undefined): string;
+/**
+ * v0.27.5 M4 — close any unclosed Telegram-HTML tags this module emits, in LIFO
+ * order. A hard truncation of a rendered card (renderTurn's 4096-char backstop)
+ * can slice through an open `<pre>`/`<b>`/… ; left dangling, Telegram rejects the
+ * edit and editTg falls back to plain text — dumping literal `<pre>`/`**`/`- `
+ * markup into the chat. Closing the danglers keeps the truncated HTML well-formed
+ * so the edit is accepted.
+ *
+ * Conservative by design: only the tags this module emits (pre, code, blockquote,
+ * b, i, s, a) are tracked, balanced input passes through byte-identical, and
+ * stray/mismatched closers are tolerated (pop nearest match, never go negative).
+ * Attribute values here never contain a literal `>` (escapeHtml runs on class /
+ * href), so `[^>]*` safely consumes the whole opening tag.
+ */
+export declare function closeDanglingTags(html: string): string;
 /**
  * Fenced code block: `<pre><code class="language-LANG">escaped</code></pre>`.
  * Omits the class when no language is given. Body is HTML-escaped (the only

package/dist/src/lib/html-render.js

@@ -45,6 +45,42 @@ export function stripHtml(input) {
         .replace(/"/g, '"')
         .replace(/&/g, '&');
 }
+/**
+ * v0.27.5 M4 — close any unclosed Telegram-HTML tags this module emits, in LIFO
+ * order. A hard truncation of a rendered card (renderTurn's 4096-char backstop)
+ * can slice through an open `<pre>`/`<b>`/… ; left dangling, Telegram rejects the
+ * edit and editTg falls back to plain text — dumping literal `<pre>`/`**`/`- `
+ * markup into the chat. Closing the danglers keeps the truncated HTML well-formed
+ * so the edit is accepted.
+ *
+ * Conservative by design: only the tags this module emits (pre, code, blockquote,
+ * b, i, s, a) are tracked, balanced input passes through byte-identical, and
+ * stray/mismatched closers are tolerated (pop nearest match, never go negative).
+ * Attribute values here never contain a literal `>` (escapeHtml runs on class /
+ * href), so `[^>]*` safely consumes the whole opening tag.
+ */
+export function closeDanglingTags(html) {
+    const stack = [];
+    const re = /<(\/?)(pre|code|blockquote|b|i|s|a)\b[^>]*>/gi;
+    let m;
+    while ((m = re.exec(html)) !== null) {
+        const tag = m[2].toLowerCase();
+        if (m[1] === '/') {
+            const idx = stack.lastIndexOf(tag);
+            if (idx !== -1)
+                stack.splice(idx, 1);
+        }
+        else {
+            stack.push(tag);
+        }
+    }
+    if (stack.length === 0)
+        return html;
+    let out = html;
+    for (let i = stack.length - 1; i >= 0; i--)
+        out += `</${stack[i]}>`;
+    return out;
+}
 /**
  * Fenced code block: `<pre><code class="language-LANG">escaped</code></pre>`.
  * Omits the class when no language is given. Body is HTML-escaped (the only

package/dist/src/openai-compat/non-streaming-handler.js

@@ -61,6 +61,17 @@ slashCommand) {
     // v0.15.0 Slice 1: hoist userText so the catch-path probe emit can reference
     // it (originally declared inside try at line ~133, post-recovery-pipeline).
     const probeUserText = userMessageToText(userMessage);
+    // v0.27.6 — report-drop fix (Killer #2), mirror of the streaming handler.
+    // The non-streaming path had NO disconnect tracking, so we add it: if the
+    // gateway socket dies mid-turn the buffered JSON reply reaches no one, and
+    // finalize() would otherwise wipe the card → total silence. Track the close,
+    // hoist deliveredText to function scope (same pattern as probeUserText above),
+    // and the finally block keeps the text on the card only when disconnected.
+    let clientDisconnected = false;
+    res.on('close', () => {
+        clientDisconnected = true;
+    });
+    let deliveredText = '';
     try {
         reportStatus('thinking', 'Processing request...');
         // v0.7.1: accumulate thinking-block content when surfaceThinking is on.
@@ -163,6 +174,9 @@ slashCommand) {
         // card. reply_dispatch in inbound-handler will fire shortly after and
         // re-render the card with state='done', picking up this text inline.
         mirrorPushAssistantText(outputText);
+        // v0.27.6 — remember the text the card is showing so the finally block can
+        // re-apply it if the socket died (see clientDisconnected note above).
+        deliveredText = outputText;
         // Parse tool_calls from response text when caller provided tools
         let traceToolCount = 0;
         let traceFinishReason = 'stop';
@@ -256,7 +270,10 @@ slashCommand) {
         // v0.26.1 — finalize the Telegram mirror card at the true end of the model
         // turn (see handleStreaming counterpart). Best-effort.
         try {
-            await mirrorFinalizeActiveCards();
+            // v0.27.6 — report-drop fix (Killer #2): keep the report on the card when
+            // the socket died (mirror of the streaming handler). Happy path passes
+            // undefined → card wiped → gateway delivers (no duplicate).
+            await mirrorFinalizeActiveCards(clientDisconnected ? deliveredText : undefined);
         }
         catch {
             /* finalize is cosmetic; never propagate */