@agentprojectcontext/apx 1.78.0 → 1.80.0

package/src/core/util/thinking.js

@@ -17,6 +17,35 @@
 
 const THINK_RE = /<(?:think|thinking)>([\s\S]*?)<\/(?:think|thinking)>/gi;
 
+// Untagged chain-of-thought.
+//
+// Some models — routed free tiers especially — emit their planning as the
+// answer itself, with no tags at all: "We need to produce a response to user
+// request: ...". That reached a real user's Telegram as a 668-token English
+// wall in place of two sentences of Spanish.
+//
+// Detection is deliberately narrow. It only fires when the text OPENS with
+// first-person-plural planning about producing a response, which is a register
+// no genuine reply uses. Anything looser would eat real answers that happen to
+// begin with "We need to".
+const UNTAGGED_COT_OPENERS = [
+  /^we need to (produce|craft|write|generate|compose) (a |an )?(response|reply|answer|message)/i,
+  /^(the )?user (is )?(asking|says|wants|requests)\b[\s\S]{0,200}?\bwe (should|need to|must)\b/i,
+  /^okay,? (so )?(the )?user\b[\s\S]{0,120}?\bwe (should|need to)\b/i,
+  /^interpretation:\s/i,
+  /^let'?s (think|analyze|break this down)\b/i,
+];
+
+/**
+ * True when `text` reads as raw planning rather than a reply.
+ * Only ever consulted for the ANSWER half, after tagged blocks are removed.
+ */
+export function looksLikeUntaggedReasoning(text) {
+  const t = String(text || "").trimStart();
+  if (t.length < 120) return false; // too short to be a planning dump
+  return UNTAGGED_COT_OPENERS.some((re) => re.test(t));
+}
+
 export function splitThinking(text) {
   if (!text || typeof text !== "string") return { thinking: "", answer: text || "" };
   const blocks = [];
@@ -34,6 +63,28 @@ export function stripThinking(text) {
   return splitThinking(text).answer;
 }
 
+/**
+ * The answer, with untagged planning treated as thinking too.
+ *
+ * `stripThinking` only removes TAGGED blocks. A model that dumps its planning
+ * with no tags slips straight through, which is how a 668-token English
+ * chain-of-thought reached a user's phone instead of two sentences of Spanish.
+ *
+ * When the remaining answer still reads as raw planning, this returns "" — the
+ * caller decides what to do with an empty reply, which is a far better failure
+ * than shipping the model's notes to the user. Never guesses at salvaging a
+ * partial answer out of it.
+ *
+ * @returns {{ answer: string, leaked: boolean, thinking: string }}
+ */
+export function stripReasoning(text) {
+  const { thinking, answer } = splitThinking(text);
+  if (looksLikeUntaggedReasoning(answer)) {
+    return { answer: "", leaked: true, thinking: [thinking, answer].filter(Boolean).join("\n\n") };
+  }
+  return { answer, leaked: false, thinking };
+}
+
 export function formatForChannel(text, channel) {
   const { thinking, answer } = splitThinking(text);
   // Channels where reasoning would be noise to a human operator

package/src/host/daemon/api/commitments.js

@@ -0,0 +1,135 @@
+// Commitments — what you promised, to whom, by when. Backed by
+// core/stores/commitments.js (JSONL event log, sibling of tasks).
+//
+//   GET    /commitments                              cross-project
+//                                                    ?state=open|kept|missed|all
+//                                                    &counterparty=X&overdue=1
+//                                                    &due_before=ISO&due_after=ISO
+//                                                    &sort=due|newest&limit=N&offset=N
+//   GET    /projects/:pid/commitments                same filters, one project
+//   POST   /projects/:pid/commitments                { counterparty, body, due?, … }
+//   GET    /projects/:pid/commitments/:id            (id or prefix)
+//   PATCH  /projects/:pid/commitments/:id            { patch: {...} }
+//   POST   /projects/:pid/commitments/:id/kept       { note? }
+//   POST   /projects/:pid/commitments/:id/missed     { note? }
+//   POST   /projects/:pid/commitments/:id/renegotiate { due, note? }
+//   GET    /projects/:pid/commitments-summary
+import {
+  createCommitment,
+  listCommitments,
+  listCommitmentsAcrossProjects,
+  getCommitment,
+  patchCommitment,
+  keepCommitment,
+  missCommitment,
+  renegotiateCommitment,
+  countCommitments,
+} from "#core/stores/commitments.js";
+import { pageEnvelope } from "./shared.js";
+
+/** Shared filter parsing so the cross-project and per-project views cannot drift. */
+function filtersFrom(query) {
+  const { state, counterparty, due_before, due_after, overdue, updated_since, sort } = query;
+  return {
+    state: state === "all" ? "all" : (state || undefined),
+    counterparty: counterparty || undefined,
+    due_before: due_before || undefined,
+    due_after: due_after || undefined,
+    overdue: overdue === "1" || overdue === "true" || undefined,
+    updated_since: updated_since || undefined,
+    sort: sort === "newest" ? "newest" : "due",
+  };
+}
+
+export function register(api, { project, projects }) {
+  api.get("/commitments", (req, res) => {
+    const entries = [];
+    for (const entry of projects.list()) {
+      const p = projects.get(entry.id);
+      if (!p?.storagePath) continue;
+      entries.push({
+        id: entry.id,
+        name: entry.name || entry.path,
+        path: entry.path,
+        storagePath: p.storagePath,
+      });
+    }
+
+    const { commitments, skipped } = listCommitmentsAcrossProjects(entries, filtersFrom(req.query));
+    const envelope = pageEnvelope(commitments, req.query);
+    if (skipped.length) envelope.meta = { ...(envelope.meta || {}), skipped };
+    res.json(envelope);
+  });
+
+  api.get("/projects/:pid/commitments", (req, res) => {
+    const p = project(req, res);
+    if (!p) return;
+    res.json(pageEnvelope(listCommitments(p.storagePath, filtersFrom(req.query)), req.query));
+  });
+
+  api.post("/projects/:pid/commitments", (req, res) => {
+    const p = project(req, res);
+    if (!p) return;
+    try {
+      res.status(201).json(createCommitment(p.storagePath, req.body || {}));
+    } catch (e) {
+      res.status(400).json({ error: e.message });
+    }
+  });
+
+  api.get("/projects/:pid/commitments/:id", (req, res) => {
+    const p = project(req, res);
+    if (!p) return;
+    const row = getCommitment(p.storagePath, req.params.id);
+    if (!row) return res.status(404).json({ error: "commitment not found" });
+    res.json(row);
+  });
+
+  api.patch("/projects/:pid/commitments/:id", (req, res) => {
+    const p = project(req, res);
+    if (!p) return;
+    const { patch } = req.body || {};
+    if (!patch || typeof patch !== "object") {
+      return res.status(400).json({ error: "patch object required" });
+    }
+    const updated = patchCommitment(p.storagePath, req.params.id, patch);
+    if (!updated) return res.status(404).json({ error: "commitment not found" });
+    res.json(updated);
+  });
+
+  api.post("/projects/:pid/commitments/:id/kept", (req, res) => {
+    const p = project(req, res);
+    if (!p) return;
+    const updated = keepCommitment(p.storagePath, req.params.id, req.body?.note || null);
+    if (!updated) return res.status(404).json({ error: "commitment not found" });
+    res.json(updated);
+  });
+
+  api.post("/projects/:pid/commitments/:id/missed", (req, res) => {
+    const p = project(req, res);
+    if (!p) return;
+    const updated = missCommitment(p.storagePath, req.params.id, req.body?.note || null);
+    if (!updated) return res.status(404).json({ error: "commitment not found" });
+    res.json(updated);
+  });
+
+  api.post("/projects/:pid/commitments/:id/renegotiate", (req, res) => {
+    const p = project(req, res);
+    if (!p) return;
+    const { due, note } = req.body || {};
+    if (!due) return res.status(400).json({ error: "a new due date is required" });
+    try {
+      const updated = renegotiateCommitment(p.storagePath, req.params.id, due, note || null);
+      if (!updated) return res.status(404).json({ error: "commitment not found" });
+      res.json(updated);
+    } catch (e) {
+      res.status(400).json({ error: e.message });
+    }
+  });
+
+  api.get("/projects/:pid/commitments-summary", (req, res) => {
+    const p = project(req, res);
+    if (!p) return;
+    res.json(countCommitments(p.storagePath));
+  });
+}

package/src/host/daemon/api/nudges.js

@@ -0,0 +1,112 @@
+// The interruption budget, as seen from outside.
+//
+//   GET   /nudges                      — the ledger, newest first
+//   GET   /nudges/policy               — the effective policy and where it came from
+//   PUT   /nudges/policy               — the user's overrides (config.nudge)
+//   POST  /nudges/:id/feedback         — { useful, note? }
+//   POST  /nudges/check                — dry-run the gate without sending
+//
+// The ledger is the honest answer to "how often does this thing bother me",
+// which is the question that decides whether someone keeps the bot on.
+import { readConfig, writeConfig } from "#core/config/index.js";
+import {
+  listNudges, nudgeStats, recordFeedback, canNudge,
+  resolveNudgePolicy, DEFAULT_POLICY,
+} from "#core/nudge/index.js";
+import { pageEnvelope } from "./shared.js";
+
+export function register(api) {
+  api.get("/nudges", (req, res) => {
+    try {
+      const rows = listNudges({
+        limit: req.query.limit || 50,
+        kind: req.query.kind || "",
+        project_id: req.query.project_id || "",
+        with_feedback:
+          req.query.with_feedback === "1" ? true
+          : req.query.with_feedback === "0" ? false
+          : null,
+      });
+      const envelope = pageEnvelope(rows, req.query);
+      envelope.meta = { ...(envelope.meta || {}), stats: nudgeStats() };
+      res.json(envelope);
+    } catch (e) {
+      res.status(500).json({ error: e.message });
+    }
+  });
+
+  api.get("/nudges/policy", (_req, res) => {
+    try {
+      const cfg = readConfig();
+      const { source, ...policy } = resolveNudgePolicy(cfg);
+      res.json({
+        policy,
+        // Which layers contributed, so the panel can say "this came from your
+        // profile" instead of showing a number with no provenance.
+        source,
+        defaults: DEFAULT_POLICY,
+        user_overrides: cfg.nudge || {},
+      });
+    } catch (e) {
+      res.status(500).json({ error: e.message });
+    }
+  });
+
+  api.put("/nudges/policy", (req, res) => {
+    const body = req.body || {};
+    try {
+      const cfg = readConfig();
+      const next = { ...(cfg.nudge || {}) };
+      for (const key of Object.keys(DEFAULT_POLICY)) {
+        if (!(key in body)) continue;
+        // null clears the override and hands the key back to the profile.
+        if (body[key] === null) delete next[key];
+        else next[key] = body[key];
+      }
+      cfg.nudge = next;
+      writeConfig(cfg);
+      const { source, ...policy } = resolveNudgePolicy(cfg);
+      res.json({ ok: true, policy, source, user_overrides: next });
+    } catch (e) {
+      res.status(400).json({ error: e.message });
+    }
+  });
+
+  api.post("/nudges/:id/feedback", (req, res) => {
+    const { useful, note } = req.body || {};
+    if (typeof useful !== "boolean") {
+      return res.status(400).json({ error: "useful (boolean) required" });
+    }
+    try {
+      const entry = recordFeedback(req.params.id, useful, note || "");
+      if (!entry) return res.status(404).json({ error: `no nudge: ${req.params.id}` });
+      res.json({ ok: true, entry });
+    } catch (e) {
+      res.status(500).json({ error: e.message });
+    }
+  });
+
+  // Dry run. Lets a caller (or a curious user) ask "would this get through?"
+  // without spending anything — nothing is recorded here.
+  api.post("/nudges/check", (req, res) => {
+    const { kind, project_id, severity, unsolicited } = req.body || {};
+    try {
+      const gate = canNudge(
+        {
+          kind: kind || "unknown",
+          project_id: project_id ?? null,
+          severity: severity || "normal",
+          unsolicited: unsolicited !== false,
+        },
+        readConfig(),
+      );
+      res.json({
+        allowed: gate.allowed,
+        reason: gate.reason,
+        retry_after_ms: gate.retry_after_ms,
+      });
+    } catch (e) {
+      res.status(500).json({ error: e.message });
+    }
+  });
+}

package/src/host/daemon/api/routines.js

@@ -16,6 +16,7 @@ import {
   setEnabled as setRoutineEnabled,
   runRoutineNow,
 } from "#core/routines/index.js";
+import { CHANNELS } from "#core/constants/channels.js";
 
 export function register(api, { projects, registries, plugins, project, config }) {
   api.get("/projects/:pid/routines", (req, res) => {
@@ -38,7 +39,30 @@ export function register(api, { projects, registries, plugins, project, config }
     try {
       // Accepts every field including the pipeline extensions
       // (pre_commands, post_commands, skip_prompt_on).
+      const existed = !!getRoutine(p.storagePath, (req.body || {}).name);
       const r = upsertRoutine(p.storagePath, req.body || {});
+      // Say it happened, where it happened. A routine appearing in a list on a
+      // screen nobody has open is not the same as being told one now exists —
+      // and "what did that just create?" is the question people actually ask
+      // after asking for something to be set up.
+      p.logMessage?.({
+        channel: CHANNELS.ROUTINE,
+        direction: "out",
+        type: "system",
+        actor_id: "apx:routine",
+        author: "apx",
+        body: existed
+          ? `routine ${r.name} updated (${r.kind}, ${r.schedule})`
+          : `routine ${r.name} created (${r.kind}, ${r.schedule})`,
+        meta: {
+          event: existed ? "routine_updated" : "routine_created",
+          routine: r.name,
+          routine_id: r.id,
+          kind: r.kind,
+          schedule: r.schedule,
+          enabled: r.enabled !== false,
+        },
+      });
       res.status(201).json(r);
     } catch (e) {
       res.status(400).json({ error: e.message });

package/src/host/daemon/api/self-memory.js

@@ -0,0 +1,50 @@
+// The super-agent's own notebook — ~/.apx/memory.md.
+//
+//   GET /notebook   → { body, path, size, approx_tokens, entries, consolidated }
+//   PUT /notebook   { body }
+//
+// WHY THIS EXISTS. This file is the one memory that ships in EVERY prompt on
+// every channel, and until now it was the only one with no screen. The Memories
+// tab listed project memory and each agent's memory; the super-agent's own
+// notebook was reachable from the model (read_self_memory / remember) and from
+// the CLI, and nowhere a person could look. So "where is Roby's memory?" had no
+// answer in the product, which is a fair thing to be confused by.
+//
+// It reports its own size because that size is a tax paid on every turn — see
+// core/memory/consolidate.js.
+import { readSelfMemory, SELF_MEMORY_PATH } from "#core/agent/self-memory.js";
+import { notebookSize } from "#core/memory/consolidate.js";
+import fs from "node:fs";
+import path from "node:path";
+
+const MAX_BODY = 256 * 1024; // a notebook past this is a symptom, not a note
+
+export function register(api) {
+  api.get("/notebook", (_req, res) => {
+    try {
+      const body = readSelfMemory();
+      res.json({ body, path: SELF_MEMORY_PATH, ...notebookSize() });
+    } catch (e) {
+      res.status(500).json({ error: e.message });
+    }
+  });
+
+  api.put("/notebook", (req, res) => {
+    const { body } = req.body || {};
+    if (typeof body !== "string") {
+      return res.status(400).json({ error: "body (string) required" });
+    }
+    if (body.length > MAX_BODY) {
+      return res.status(413).json({
+        error: `notebook too large (${body.length} > ${MAX_BODY} bytes) — it ships in every prompt`,
+      });
+    }
+    try {
+      fs.mkdirSync(path.dirname(SELF_MEMORY_PATH), { recursive: true });
+      fs.writeFileSync(SELF_MEMORY_PATH, body);
+      res.json({ ok: true, path: SELF_MEMORY_PATH, ...notebookSize() });
+    } catch (e) {
+      res.status(500).json({ error: e.message });
+    }
+  });
+}

package/src/host/daemon/api/telegram.js

@@ -6,7 +6,11 @@
 //   POST   /telegram/send_photo   { chat_id?, photo, caption?, parse_mode?, channel? }
 //   POST   /telegram/send_voice   { chat_id?, audio, caption?, duration?, channel? }
 //   POST   /telegram/send_audio   { chat_id?, audio, caption?, title?, performer?, channel? }
-//   POST   /telegram/notify       (alias of /telegram/send; daemon-initiated pushes)
+//   POST   /telegram/notify       { chat_id?, text, channel?, kind?, project_id?,
+//                                   severity?, unsolicited? }
+//                                 Daemon-initiated pushes. Goes through the
+//                                 interruption budget (core/nudge) and answers
+//                                 429 with a retry_after_ms when suppressed.
 //
 //   GET    /telegram/channels                         — list configured channels
 //   POST   /telegram/channels    { name, ... }        — create or replace one channel
@@ -39,6 +43,7 @@ import {
 } from "#core/config/index.js";
 
 import { redactChannel, isSecretMarker } from "#core/config/redact.js";
+import { canNudge, recordNudge, nudgeFeedbackKeyboard } from "#core/nudge/index.js";
 
 export function register(api, { telegram }) {
   api.get("/telegram/status", (_req, res) => {
@@ -299,14 +304,47 @@ export function register(api, { telegram }) {
   });
 
   // Alias for proactive daemon-initiated pushes (routines, error handlers, …).
+  //
+  // PUSH PATH 2 OF 4 — this endpoint exists FOR unrequested messages, so the
+  // interruption budget applies by default. A caller delivering something the
+  // user is waiting for says so with `unsolicited: false`, and that choice is
+  // then visible in its own diff rather than hidden in this handler.
   api.post("/telegram/notify", async (req, res) => {
-    const { chat_id, text, channel } = req.body || {};
+    const { chat_id, text, channel, kind, project_id, severity, unsolicited } = req.body || {};
     if (!text) return res.status(400).json({ error: "text required" });
     if (!telegram)
       return res.status(503).json({ error: "telegram plugin not loaded" });
+
+    const gate = canNudge(
+      {
+        kind: kind || "notify",
+        project_id: project_id ?? null,
+        severity: severity || "normal",
+        unsolicited: unsolicited !== false,
+        channel: "telegram",
+      },
+      readConfig(),
+    );
+    if (!gate.allowed) {
+      // 429, not 500: nothing failed. The caller is being asked to wait, and
+      // told for how long, so a routine can decide to try again rather than
+      // treating a working guardrail as an outage.
+      return res.status(429).json({
+        ok: false,
+        suppressed: true,
+        reason: gate.reason,
+        retry_after_ms: gate.retry_after_ms,
+      });
+    }
+
     try {
-      const r = await telegram.send({ chat_id, text, channel });
-      res.status(202).json({ ok: true, message_id: r.message_id, via: "notify" });
+      const r = await telegram.send({
+        chat_id, text, channel,
+        reply_markup: gate.unsolicited ? nudgeFeedbackKeyboard(gate.nudge_id) : undefined,
+        meta: { nudge_id: gate.unsolicited ? gate.nudge_id : undefined, nudge_kind: gate.kind },
+      });
+      recordNudge(gate, { chat_id, preview: text });
+      res.status(202).json({ ok: true, message_id: r.message_id, via: "notify", nudge_id: gate.nudge_id });
     } catch (e) {
       res.status(502).json({ error: e.message });
     }

package/src/host/daemon/api/voice.js

@@ -18,6 +18,7 @@
 //
 // Domain logic (channel context, suggestion parsing, audio decoding) lives in
 // core/. This file is just glue: parse request → call core → format response.
+import { stripReasoning } from "#core/util/thinking.js";
 import fs from "node:fs";
 import path from "node:path";
 import { TTS_TMP_DIR } from "#core/config/paths.js";
@@ -128,7 +129,8 @@ export function register(api, { projects, plugins, registries }) {
             systemSuffix: channelCtx.systemSuffix,
             previousMessages,
           });
-          const raw = (result?.text || "").trim();
+          // Spoken back to the user — never narrate raw planning.
+          const raw = stripReasoning(result?.text || "").answer.trim();
           replyModel = result?.model || null;
           replyUsage = result?.usage || null;
           replyName = result?.name || null;

package/src/host/daemon/api.js

@@ -46,6 +46,7 @@ import { register as registerRoutines } from "./api/routines.js";
 import { register as registerArtifacts } from "./api/artifacts.js";
 import { register as registerArtifactPreview } from "./api/artifact-preview.js";
 import { register as registerTasks } from "./api/tasks.js";
+import { register as registerCommitments } from "./api/commitments.js";
 import { register as registerOrganization } from "./api/organization.js";
 import { register as registerProjectFiles } from "./api/files-project.js";
 import { register as registerConfig } from "./api/config.js";
@@ -64,6 +65,8 @@ import { register as registerAdminConfig } from "./api/admin-config.js";
 import { register as registerIdentity } from "./api/identity.js";
 import { register as registerProfiles } from "./api/profiles.js";
 import { register as registerInbox } from "./api/inbox.js";
+import { register as registerSelfMemory } from "./api/self-memory.js";
+import { register as registerNudges } from "./api/nudges.js";
 import { register as registerWeb, registerWebToken } from "./api/web.js";
 import { register as registerConfirm } from "./api/confirm.js";
 
@@ -143,6 +146,7 @@ export function buildApi({
   registerArtifacts(api, ctx);
   registerArtifactPreview(api, ctx);
   registerTasks(api, ctx);
+  registerCommitments(api, ctx);
   registerOrganization(api, ctx);
   registerProjectFiles(api, ctx);
   registerConfig(api, ctx);
@@ -169,6 +173,8 @@ export function buildApi({
   registerIdentity(api, ctx);
   registerProfiles(api, ctx);
   registerInbox(api, ctx);
+  registerSelfMemory(api, ctx);
+  registerNudges(api, ctx);
   registerWebToken(api, ctx);
 
   // ---- API 404 (MUST be last on the router) ------------------------

package/src/host/daemon/callback-reconciler.js

@@ -15,6 +15,8 @@
 // session close captured remains). The rich A2A relay (Roby re-voicing the
 // result) stays the job of the live in-process path.
 import { listPendingCallbacks, deletePendingCallback, readSessionState } from "#core/stores/runtime-callbacks.js";
+import { readConfig } from "#core/config/index.js";
+import { canNudge, recordNudge } from "#core/nudge/index.js";
 
 const GRACE_MS = 30_000;               // let the live in-process path win a fresh completion
 const STALE_MS = 24 * 60 * 60 * 1000;  // drop IOUs for runs that never finished in a day
@@ -62,11 +64,25 @@ export async function reconcilePendingCallbacks({ plugins, log }) {
       if (Number.isFinite(compAge) && compAge < GRACE_MS) continue;
 
       if (!telegram) continue; // telegram plugin not up this boot — retry next tick
+
+      // PUSH PATH 4 OF 4. Declared SOLICITED, and that is a judgement worth
+      // stating: the user launched this runtime and is waiting for its result.
+      // Arriving late does not make it an interruption, and holding it back
+      // for quiet hours would mean losing an answer they asked for. It still
+      // passes through the gate so the audit is real and so a future policy
+      // can reach it without hunting for a fifth path nobody remembered.
+      const gate = canNudge(
+        { kind: "session_result", severity: "normal", unsolicited: false, channel: "telegram" },
+        readConfig(),
+      );
+      if (!gate.allowed) continue; // never today; retry next tick if it ever is
+
       await telegram.send({
         channel: entry.tg_channel || undefined,
         chat_id: entry.chat_id,
         text: deliverText(entry, state),
       });
+      recordNudge(gate, { chat_id: entry.chat_id });
       deletePendingCallback(entry.session_id);
       log?.(`callback-reconciler: delivered late callback for ${entry.session_id} → chat ${entry.chat_id}`);
     } catch (e) {

package/src/host/daemon/plugins/desktop/index.js

@@ -25,6 +25,7 @@ import {
 import { runSuperAgent, isSuperAgentEnabled } from "#core/agent/super-agent.js";
 import { appendGlobalMessage } from "#core/stores/messages.js";
 import { stripEmotionTags } from "#core/voice/emotions.js";
+import { stripReasoning } from "#core/util/thinking.js";
 import { CHANNELS } from "#core/constants/channels.js";
 import { tryResolveSkillCommand } from "#core/agent/skills/trigger.js";
 
@@ -123,7 +124,12 @@ async function _handleMessage({ ws, text, previousMessages }, { projects, config
     emittedSegments.push(seg);
     // `text` is what the bubble shows (no [tags]); `speak` keeps the inline
     // emotion tags so the renderer's per-segment TTS can use them.
-    _send(ws, { type: "segment", seq: ++segSeq, text: stripEmotionTags(seg), speak: seg });
+    // Desktop is voice-first: an unstripped reasoning dump would be spoken
+    // aloud, at length, in the wrong language. Drop the segment entirely
+    // rather than narrate the model's notes.
+    const spoken = stripReasoning(seg).answer;
+    if (!spoken.trim()) return;
+    _send(ws, { type: "segment", seq: ++segSeq, text: stripEmotionTags(spoken), speak: spoken });
   };
 
   try {

package/src/host/daemon/plugins/telegram/index.js

@@ -311,9 +311,13 @@ export default {
       // that bot; otherwise first available bot-tokened channel. Always logs
       // the outbound on `messages` of the channel's target project so audit
       // trails are complete.
-      async send({ channel: channelName, chat_id, text, author = resolveAgentName(config) }) {
+      // `reply_markup` carries the interruption-budget feedback keyboard on
+      // proactive pushes (core/nudge). It is NOT a gate: the gate belongs at
+      // the call sites that decide to speak unprompted, because this method
+      // also carries traffic the user asked for.
+      async send({ channel: channelName, chat_id, text, reply_markup, author = resolveAgentName(config), meta: extraMeta }) {
         const p = pickPoller(pollers, channelName);
-        const result = await p._send({ chat_id, text });
+        const result = await p._send({ chat_id, text, reply_markup });
         appendGlobalMessage({
           channel: CHANNELS.TELEGRAM,
           direction: "out",
@@ -327,6 +331,7 @@ export default {
             chat_id: chat_id || resolveChatId(p.channel),
             tg_channel: p.channel.name,
             via: channelName ? "explicit" : "auto",
+            ...(extraMeta || {}),
           },
         });
         return result;

package/src/host/daemon/wakeup.js

@@ -2,6 +2,7 @@
 import fetch from "node-fetch";
 import { readIdentity, writeIdentity } from "#core/identity/index.js";
 import { resolveProvider, getAdapter } from "#core/engines/index.js";
+import { canNudge, recordNudge, nudgeFeedbackKeyboard } from "#core/nudge/index.js";
 
 const WAKEUP_COOLDOWN_MS = 30 * 60 * 1000; // 30 min
 
@@ -50,12 +51,12 @@ async function generateMessage(identity, engineConfig) {
   }
 }
 
-async function sendTelegram(token, chatId, text) {
+async function sendTelegram(token, chatId, text, reply_markup) {
   const url = `https://api.telegram.org/bot${token}/sendMessage`;
   const res = await fetch(url, {
     method: "POST",
     headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({ chat_id: chatId, text }),
+    body: JSON.stringify({ chat_id: chatId, text, ...(reply_markup ? { reply_markup } : {}) }),
   });
   const json = await res.json();
   if (!json.ok) throw new Error(json.description || "telegram send failed");
@@ -75,10 +76,23 @@ export async function triggerWakeup(config, log) {
     if (elapsed < WAKEUP_COOLDOWN_MS) return;
   }
 
+  // PUSH PATH 1 OF 4 — nobody asked for this one. "I restarted" is the least
+  // interesting thing APX can say, so it is also the first thing a budget
+  // should be allowed to swallow.
+  const gate = canNudge(
+    { kind: "wakeup", severity: "low", unsolicited: true, channel: "telegram" },
+    config,
+  );
+  if (!gate.allowed) {
+    log?.(`wakeup: suppressed by the interruption budget — ${gate.reason}`);
+    return;
+  }
+
   try {
     const message = await generateMessage(identity, config);
     const text = message || `${identity.agent_name} online. Ready.`;
-    await sendTelegram(tg.bot_token, tg.chat_id, text);
+    await sendTelegram(tg.bot_token, tg.chat_id, text, nudgeFeedbackKeyboard(gate.nudge_id));
+    recordNudge(gate, { chat_id: tg.chat_id, preview: text });
     writeIdentity({ last_wakeup: new Date().toISOString() });
     log?.(`wakeup: sent to Telegram chat ${tg.chat_id}`);
   } catch (e) {