@inetafrica/open-claudia 3.5.75 → 3.5.77

package/core/loopback.js

@@ -109,7 +109,12 @@ const JSON_KINDS = new Set([
   "say", "call-say", "call", "tts", "transcribe",
   "card-send", "card-update", "card-show", "decide-add", "decide-list", "decide-cancel",
   "owner-setup",
+  "view-send", "view-push",
 ]);
+// view-send carries the page and its preview (each at most 2 MB) as base64.
+const VIEW_FILE_MAX = 2 * 1024 * 1024;
+const VIEW_SEND_BODY_MAX = 6 * 1024 * 1024;
+const VIEW_PUSH_DATA_MAX = 16384;
 
 // Who is calling, decided by the bot: the principal of a LIVE run whose
 // OC_RUN_ATTEST matches (see core/speaker-attest), else UNATTRIBUTED. Nothing
@@ -303,17 +308,121 @@ async function handleCardKind(res, kind, payload, { channelId, adapterId, adapte
   return reply(res, 400, { error: `unknown card command ${kind}` });
 }
 
+// HTML views (Kazee Chat only; core/views.js answers their events). Like a
+// card, a view's events wake the conversation that sent it, so only a live,
+// attributed run may send one, into that run's own room and thread.
+function decodeViewFile(file, what, exts) {
+  if (!file || typeof file !== "object") return { error: `missing ${what}` };
+  const fileName = path.basename(String(file.fileName || "")).replace(/[^A-Za-z0-9._-]/g, "_");
+  const ext = path.extname(fileName).toLowerCase();
+  if (!exts.includes(ext)) return { error: `the ${what} must be a ${exts.join(" or ")} file (got ${fileName || "no name"})` };
+  if (typeof file.data !== "string" || !file.data) return { error: `the ${what} is empty` };
+  const buffer = Buffer.from(file.data, "base64");
+  if (!buffer.length) return { error: `the ${what} is empty` };
+  if (buffer.length > VIEW_FILE_MAX) return { error: `the ${what} is over 2 MB` };
+  return { buffer, fileName, ext };
+}
+
+async function handleViewKind(res, kind, payload, { channelId, adapterId, adapter }) {
+  const cards = require("./cards");
+  const caller = callerOf(payload);
+  if (!caller.attributed) {
+    return reply(res, 403, { error: "views can only be used from a live, attributed run" });
+  }
+  const own = (caller.adapterId && registry.findAdapter(caller.adapterId)) || adapter;
+  const room = String(caller.channelId || channelId);
+  const threadId = threadForCaller(caller, room, payload.threadId);
+
+  if (kind === "view-send") {
+    if (own.type !== "kazee" || typeof own.sendCard !== "function" || typeof own.uploadMedia !== "function") {
+      return reply(res, 501, { error: `views are Kazee Chat only (this conversation is on ${own.type || adapterId})` });
+    }
+    const title = String(payload.title || "").trim();
+    if (!title || title.length > 140) return reply(res, 400, { error: "a view needs a --title of at most 140 characters" });
+    const body = payload.body ? String(payload.body).trim() : "";
+    if (body.length > 600) return reply(res, 400, { error: "--body is over 600 characters" });
+    const label = payload.label ? String(payload.label).trim() : "";
+    if (label.length > 40) return reply(res, 400, { error: "--label is over 40 characters" });
+    const wake = payload.wake === undefined || payload.wake === null || payload.wake === "" ? "each" : String(payload.wake);
+    if (!["each", "none"].includes(wake)) return reply(res, 400, { error: "--wake must be each or none" });
+    let handler = null;
+    if (payload.handler) {
+      handler = String(payload.handler);
+      if (!path.isAbsolute(handler)) return reply(res, 400, { error: "the handler path must be absolute (the bot process has its own cwd)" });
+      let st = null;
+      try { st = fs.statSync(handler); } catch (_) {}
+      if (!st || !st.isFile()) return reply(res, 400, { error: `handler not found: ${handler}` });
+    }
+    const page = decodeViewFile(payload.page, "page", [".html", ".htm"]);
+    if (page.error) return reply(res, 400, { error: page.error });
+    const preview = payload.preview ? decodeViewFile(payload.preview, "preview", [".png", ".jpg", ".jpeg"]) : null;
+    if (preview && preview.error) return reply(res, 400, { error: preview.error });
+
+    let block;
+    try {
+      const pageId = await own.uploadMedia(room, { buffer: page.buffer, fileName: page.fileName, contentType: "text/html; charset=utf-8" });
+      block = { type: "view", page: pageId };
+      if (preview) {
+        block.preview = await own.uploadMedia(room, {
+          buffer: preview.buffer, fileName: preview.fileName, contentType: preview.ext === ".png" ? "image/png" : "image/jpeg",
+        });
+      }
+      if (label) block.label = label;
+    } catch (e) {
+      return reply(res, 502, { error: `upload failed: ${e.message}` });
+    }
+    const card = { v: 1, kind: "report", title, ...(body ? { body } : {}), blocks: [block] };
+    let messageId;
+    try {
+      messageId = await own.sendCard(room, card, { threadId });
+    } catch (e) {
+      return reply(res, 400, { error: e.message });
+    }
+    if (!messageId) return reply(res, 502, { error: "Kazee Chat returned no message id for the view" });
+    // wake "none" on the card path: a view takes no card answers; its events
+    // go through core/views.js with the view's own policy.
+    cards.recordSentCard({
+      messageId, title, kind: "report", wake: "none",
+      origin: cardOrigin(caller, payload, own, threadId),
+      view: { handler, wake },
+    });
+    return reply(res, 200, { ok: true, messageId, handler, wake, card });
+  }
+
+  if (kind === "view-push") {
+    const rec = cards.getCard(payload.messageId);
+    if (!rec || !rec.view) return reply(res, 404, { error: "not a view this bot sent (or older than the card ledger)" });
+    const mine = rec.origin && rec.origin.canonicalUserId && rec.origin.canonicalUserId === caller.canonicalUserId;
+    if (!mine && caller.owner !== true) return reply(res, 403, { error: "only the conversation's person or the owner can push to this view" });
+    const target = (rec.origin && registry.findAdapter(rec.origin.adapter)) || own;
+    if (typeof target.pushView !== "function") return reply(res, 501, { error: "views are Kazee Chat only" });
+    const data = payload.data === undefined ? null : payload.data;
+    if (Buffer.byteLength(JSON.stringify(data)) > VIEW_PUSH_DATA_MAX) return reply(res, 400, { error: "the data is over 16 KB as JSON" });
+    try {
+      await target.pushView(String(payload.messageId), data, payload.to ? String(payload.to) : undefined);
+    } catch (e) {
+      return reply(res, 400, { error: e.message });
+    }
+    return reply(res, 200, { ok: true });
+  }
+  return reply(res, 400, { error: `unknown view command ${kind}` });
+}
+
 function readBodyAsString(req, max = 64 * 1024) {
   return new Promise((resolve, reject) => {
-    let buf = "";
+    // Bytes first, text at the end: a big body (view-send) arrives in many
+    // chunks, and a chunk may end inside a multi-byte character.
+    const chunks = [];
+    let size = 0;
     req.on("data", (d) => {
-      buf += d.toString();
-      if (buf.length > max) {
+      chunks.push(d);
+      size += d.length;
+      if (size > max) {
         req.destroy();
         reject(new Error("body too large"));
       }
     });
-    req.on("end", () => resolve(buf));
+    req.on("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
     req.on("error", reject);
   });
 }
@@ -369,7 +478,7 @@ async function handleSend(req, res, url, kind) {
 }
 
 async function handleJson(req, res, url, kind) {
-  const body = await readBodyAsString(req);
+  const body = await readBodyAsString(req, kind === "view-send" ? VIEW_SEND_BODY_MAX : undefined);
   let payload = {};
   if (body.trim()) {
     try { payload = JSON.parse(body); }
@@ -440,6 +549,7 @@ async function handleJson(req, res, url, kind) {
         maxHops: out.maxHops,
         source: out.source,
         target: out.target,
+        newThread: out.newThread === true,
       });
     } catch (e) {
       return reply(res, e.status || 500, { error: e.message });
@@ -453,6 +563,9 @@ async function handleJson(req, res, url, kind) {
     return handleCardKind(res, kind, payload, { channelId, adapterId, adapter });
   }
 
+  if (kind === "view-send" || kind === "view-push") {
+    return handleViewKind(res, kind, payload, { channelId, adapterId, adapter });
+  }
   // `open-claudia owner-setup` (core/owner-setup.js): the one-tap card that
   // lets a personal bot's owner switch it on or renew it. It always goes to
   // HER direct chat, never this room; the bot decides what it says from its

package/core/migration-backup.js

@@ -257,8 +257,12 @@ function acquireLock(root) {
       let stale = false;
       try {
         const stat = assertRegularFile(filePath, "MIGRATION_LOCKED", "migration lock");
-        const pid = Number(fs.readFileSync(filePath, "utf8").trim());
-        if (Number.isSafeInteger(pid) && pid > 0 && Date.now() - stat.mtimeMs > 1000) {
+        const text = fs.readFileSync(filePath, "utf8").trim();
+        const pid = Number(text);
+        // An old empty lock was left by a run that died before writing its pid
+        // (kazee-people, Oct 2026: 817 restarts); nobody can hold it.
+        if (!text && Date.now() - stat.mtimeMs > 1000) stale = true;
+        else if (Number.isSafeInteger(pid) && pid > 0 && Date.now() - stat.mtimeMs > 1000) {
           // We haven't taken the lock yet, so one naming our own pid was left by an
           // earlier run that died holding it. In a container the bot is pid 1 after
           // every restart, so the liveness probe below would find "us" alive forever.

package/core/model-prices.js

@@ -16,6 +16,9 @@ const PRICES = {
   "claude-opus-4-8": [5, 25, 0.5, 6.25, 10],
   "claude-opus-4-7": [5, 25, 0.5, 6.25, 10],
   "claude-opus-4-6": [5, 25, 0.5, 6.25, 10],
+  // Fable 5.2 (9 Nov 2026, pricing page read 11 Nov): without its own row it
+  // fell through to the claude-fable-5 prefix and was billed 10/50, cache 1.
+  "claude-fable-5-2": [8, 40, 0.2, 10, 16],
   "claude-fable-5-1": [10, 50, 0.25, 12.5, 20],
   "claude-fable-5": [10, 50, 1, 12.5, 20],
   "claude-sonnet-5-5": [2, 10, 0.1, 2.5, 4],

package/core/pack-review.js

@@ -682,6 +682,49 @@ function listDeferredDecisions() {
   } catch (_) { return []; }
 }
 
+// In-process FIFO in front of the review model: a busy bot runs reviews one at a
+// time instead of stacking model processes (OC_REVIEW_CONCURRENCY, default 1).
+// Utility calls over their cap are rejected, not queued, so lowering the cap
+// would lose reviews. acquire() hands back a release function, at once when a
+// slot is free and otherwise as a promise; a waiter pushed out by the bound
+// (OC_REVIEW_QUEUE_MAX, default 20, oldest first) gets "dropped", and one still
+// waiting at shutdown gets "closed".
+function reviewSetting(key, fallback) {
+  const value = Number(require("./config").settingValue(key));
+  return Number.isSafeInteger(value) && value > 0 ? value : fallback;
+}
+
+function createReviewGate({ limit, maxWaiting }) {
+  let active = 0;
+  let closed = false;
+  const waiting = [];
+  function grant() {
+    active += 1;
+    let released = false;
+    return () => {
+      if (released) return;
+      released = true;
+      active -= 1;
+      if (waiting.length) waiting.shift()(grant());
+    };
+  }
+  return {
+    acquire() {
+      if (closed) return "closed";
+      if (active < limit) return grant();
+      if (waiting.length >= maxWaiting) {
+        waiting.shift()("dropped");
+        console.warn(`[pack-review] review queue full (${maxWaiting} waiting): dropped the oldest waiting review`);
+      }
+      return new Promise((resolve) => waiting.push(resolve));
+    },
+    close() {
+      closed = true;
+      for (const resolve of waiting.splice(0)) resolve("closed");
+    },
+  };
+}
+
 function createPackReviewer(dependencies = {}) {
   const runUtility = dependencies.spawnUtilityAgent || spawnUtilityAgent;
   const queue = dependencies.mutationQueue || memoryMutationQueue;
@@ -689,6 +732,10 @@ function createPackReviewer(dependencies = {}) {
   const lockRetryDelayMs = dependencies.lockRetryDelayMs ?? LOCK_RETRY_DELAY_MS;
   const adjudicator = dependencies.dedupAdjudicator
     || dedupAdjudicator.createDedupAdjudicator({ spawnUtilityAgent: dependencies.spawnUtilityAgent });
+  const gate = createReviewGate({
+    limit: reviewSetting("OC_REVIEW_CONCURRENCY", 1),
+    maxWaiting: reviewSetting("OC_REVIEW_QUEUE_MAX", 20),
+  });
   const handles = new Map();
   let accepting = true;
 
@@ -712,19 +759,34 @@ function createPackReviewer(dependencies = {}) {
     }
 
     const capturedProvider = provider || null;
-    const versions = snapshotMemoryVersions();
-    // Denies are the OWNER's refusals — mine them only when reviewing an
-    // owner turn, so deny content never surfaces via external speakers' turns.
-    const denies = (!source || source.isOwner) ? collectDeniedApprovals() : { block: "", ids: [] };
-    const prompt = buildReviewPrompt(
-      redactSensitive(String(userText || "")),
-      redactSensitive(String(assistantText || "")),
-      activePacks,
-      denies.block,
-    );
     const work = (async () => {
       let utilityResult = null;
+      let releaseSlot = () => {};
       try {
+        // The review's own timeout starts at the model call, after this wait.
+        let slot = gate.acquire();
+        if (slot instanceof Promise) slot = await slot;
+        if (slot === "dropped") {
+          reviewerMetric({ provider: capturedProvider || "", status: "dropped", code: "REVIEW_QUEUE_FULL" });
+          return { status: "dropped", reason: "review queue full" };
+        }
+        if (slot === "closed") {
+          queue.record({ id: null, label: "review", status: "pending_intent_rejected", provider: capturedProvider, runId: runId || null });
+          return { status: "not_admitted", reason: "review shutdown in progress" };
+        }
+        releaseSlot = slot;
+        // Read memory after the wait: a snapshot from before it would make this
+        // review's rewrites stale whenever the review ahead touched the same pack.
+        const versions = snapshotMemoryVersions();
+        // Denies are the OWNER's refusals — mine them only when reviewing an
+        // owner turn, so deny content never surfaces via external speakers' turns.
+        const denies = (!source || source.isOwner) ? collectDeniedApprovals() : { block: "", ids: [] };
+        const prompt = buildReviewPrompt(
+          redactSensitive(String(userText || "")),
+          redactSensitive(String(assistantText || "")),
+          activePacks,
+          denies.block,
+        );
         utilityResult = await runUtility(prompt, {
           purpose: "review",
           activeProvider: capturedProvider,
@@ -754,6 +816,8 @@ function createPackReviewer(dependencies = {}) {
         try {
           dedup = await adjudicator.adjudicateDecision(decision, { provider: capturedProvider, cwd: process.cwd() });
         } catch (_) {}
+        // Model runs are done; the wait for the write lock does not hold the slot.
+        releaseSlot();
         const finalDecision = dedup ? dedup.decision : decision;
         const enqueueApply = () => queue.enqueue("review", () => applyDecisionBatch({
           decision: finalDecision,
@@ -822,6 +886,8 @@ function createPackReviewer(dependencies = {}) {
           announcementFailed,
           error: { code: error.code || "REVIEW_FAILED", message: redactSensitive(error.message) },
         };
+      } finally {
+        releaseSlot();
       }
     })();
     return track(work, { provider: capturedProvider, channelId: channelId || null, runId: runId || null });
@@ -829,6 +895,7 @@ function createPackReviewer(dependencies = {}) {
 
   function stopAdmission(reason = "shutdown") {
     accepting = false;
+    gate.close();
     queue.record({ id: null, label: "review", status: "review_admission_stopped", reason: String(reason).slice(0, 160) });
   }
 

package/core/providers/claude.js

@@ -6,6 +6,8 @@ const { createJsonlDecoder } = require("./events");
 const { createClaudeParserState, normalizeClaudeEvent } = require("./claude-events");
 const { createClaudeHookTransport } = require("./claude-hook");
 
+// claude-fable-5-2 (9 Nov 2026) answers on Claude Code 2.1.302 when named in
+// full (checked 10 Nov); the short name "fable" only means 5.2 from 2.1.321.
 // New models are gated on the CLI build: claude-fable-5-1 requires Claude Code
 // >= 2.1.251, claude-opus-5-5 requires >= 2.1.280. An older CLI rejects them with
 // an API 400 rather than falling back, so a pod on a stale image will error on
@@ -28,6 +30,7 @@ const { createClaudeHookTransport } = require("./claude-hook");
 const CLAUDE_LOW_TIER_MODEL = "claude-haiku-5-5";
 const CLAUDE_MEDIUM_TIER_MODEL = "claude-sonnet-5-5";
 const CLAUDE_MODELS = Object.freeze([
+  "claude-fable-5-2",
   "claude-fable-5-1",
   "claude-fable-5",
   "claude-opus-5-5",

package/core/recall/index.js

@@ -4,7 +4,7 @@
 // Each engine implements: async run(ctx) -> { packBlock, entityBlock,
 // packMatches, entityMatches }. The active engine is chosen per channel via
 // the `recallEngine` setting (set by the /engine slash command), falling back
-// to the RECALL_ENGINE env var, then to DEFAULT_ENGINE. Unknown names fall
+// to RECALL_ENGINE (process env or the bot's .env), then to DEFAULT_ENGINE. Unknown names fall
 // back to the default so a bad value can never break recall. The discoverer is
 // the default: it's fail-open (falls back to the classic keyword baseline on
 // any error), so it never recalls worse than classic, only better. `ask`
@@ -37,7 +37,8 @@ function listEngines() {
 
 function activeEngineName(settings) {
   const fromSettings = settings && settings.recallEngine;
-  const fromEnv = process.env.RECALL_ENGINE;
+  let fromEnv;
+  try { fromEnv = require("../config").settingValue("RECALL_ENGINE"); } catch (e) { fromEnv = process.env.RECALL_ENGINE; }
   const name = String(fromSettings || fromEnv || DEFAULT_ENGINE).toLowerCase();
   return ENGINES[name] ? name : DEFAULT_ENGINE;
 }

package/core/recall/warm-walker.js

@@ -16,6 +16,9 @@ const MAX_CHARS = Number(process.env.RECALL_WARM_WALKER_MAX_CHARS || 24000);
 const DEFAULT_TIMEOUT_MS = 25000;
 const KILL_GRACE_MS = Number(process.env.RECALL_WARM_WALKER_KILL_GRACE_MS || 250);
 const MAX_BUFFER_BYTES = Number(process.env.RECALL_WARM_WALKER_MAX_BUFFER_BYTES || 1024 * 1024);
+// The child holds about 160 MB doing nothing; stop it this long after the last
+// walk ends (0 = never). The next walk respawns it.
+const IDLE_MS = Number(process.env.RECALL_WARM_WALKER_IDLE_MS || 10 * 60 * 1000);
 
 let child = null;
 let childProviderId = null;
@@ -26,6 +29,8 @@ let charCount = 0;
 let costTotal = 0;
 let childModel = null;
 let stopPromise = null;
+let idleTimer = null;
+let walksInHand = 0;
 
 function isEnabled(provider) {
   if (String(process.env.RECALL_WARM_WALKER || "on").toLowerCase() === "off") return false;
@@ -70,6 +75,22 @@ function stopChild(reason = "warm walker stopped") {
   return stopPromise;
 }
 
+function clearIdleTimer() {
+  if (idleTimer) clearTimeout(idleTimer);
+  idleTimer = null;
+}
+
+function armIdleTimer() {
+  clearIdleTimer();
+  if (!(IDLE_MS > 0) || !child) return;
+  idleTimer = setTimeout(() => {
+    idleTimer = null;
+    if (pending || walksInHand) return;
+    stopChild("warm walker idle").catch(() => {});
+  }, IDLE_MS);
+  idleTimer.unref();
+}
+
 function persistentInvocation(cfg) {
   const provider = cfg.provider;
   if (!isEnabled(provider)) throw new Error(`${provider?.id || "provider"} has no enabled persistent utility stream`);
@@ -165,6 +186,8 @@ function spawnChild(cfg) {
 
 async function doWalk(promptText, opts) {
   if (!isEnabled(opts.provider)) throw new Error(`${opts.provider?.id || "provider"} persistent recall is unavailable`);
+  // An idle stop still closing: its close must not land on this walk.
+  if (stopPromise) await stopPromise;
   if (child && (childProviderId !== opts.provider.id || msgCount >= MAX_MSGS || charCount >= MAX_CHARS)) {
     await stopChild("warm walker recycled");
   }
@@ -193,13 +216,20 @@ async function doWalk(promptText, opts) {
 }
 
 function walkWarm(promptText, opts = {}) {
+  clearIdleTimer();
+  walksInHand += 1;
   const run = () => doWalk(promptText, opts);
   const result = chain.then(run, run);
-  chain = result.then(() => {}, () => {});
+  const walkEnded = () => {
+    walksInHand -= 1;
+    if (!walksInHand) armIdleTimer();
+  };
+  chain = result.then(walkEnded, walkEnded);
   return result;
 }
 
 async function shutdown() {
+  clearIdleTimer();
   await stopChild("warm walker shutdown");
 }
 

package/core/runner.js

@@ -49,6 +49,7 @@ const packReview = require("./pack-review");
 const {
   appendUsageRecord,
   loadUsageHistory,
+  usageAlertsOn,
   usageAlertPolicy,
   evaluateUsageAlert,
 } = require("./usage-log");
@@ -234,7 +235,9 @@ function logTurnUsage(state, usage, costUsd, announce, opts = {}) {
     record.rawCacheReadTokens = raw.cacheRead;
     record.rawContextTokens = raw.context;
   }
-  const previousRecords = loadUsageHistory();
+  // Only an alert reads the history, and parsing the whole file every turn is
+  // not free.
+  const previousRecords = usageAlertsOn(config) ? loadUsageHistory() : [];
   appendUsageRecord(record, { strict: !!opts.strict });
 
   const policy = usageAlertPolicy(config);

package/core/system-prompt.js

@@ -319,6 +319,7 @@ Reply normally in your final answer. To send a file, image, or voice clip back t
 - \`open-claudia send-voice <path>\` — ogg/opus voice note
 - \`open-claudia say "<text>"\` — synthesize the text and send it as a voice note (use this when asked for a voice reply)
 - \`open-claudia card send <spec.json|->\` — (Kazee Chat) a decision, choice (poll), rating, slider, form or report card; answers wake this conversation. Cards are built from pieces: blocks (text, stats, bars, facts, table) and form questions (choice, rating, text, tick, date, slots, rows with a tick/date/option per row, board). When a reply would list items for someone to tick, date, pick, approve or move, or asks one person 2+ questions, send ONE card built from pieces instead of a text list plus a separate question; \`open-claudia card pieces\` lists them, \`card example <name>\` prints a spec, \`card update <id> --close | --note "..."\` changes one you sent.
+- \`open-claudia view send <page.html> --title "<title>" [--handler <file>]\` — (Kazee Chat) an interactive web page, sent as a card with an Open button; it opens in a walled-off panel. The page can load libraries from cdn.jsdelivr.net, unpkg.com, cdnjs.cloudflare.com or esm.sh but cannot fetch data from the internet, so put the data in the page. It talks to you with \`kazee.send(name, data)\` (wakes this conversation, or a --handler script answers fast) and \`kazee.on(fn)\` (gets what you \`view push\`); \`open-claudia view example\` shows a page and a handler.
 - \`open-claudia decide "<question>" --option yes="..." --option no="..." [--pick yes] [--body "why"]\` — (owner, Kazee Chat) queue a decision for the owner as a card: one is out at a time, his answer wakes this conversation. Prefer it to asking a yes/no question in text when work waits on his decision.
 Never print or embed bot tokens in prompts, commands, logs, or messages.
 ${hasVoice || hasEars ? `
@@ -334,7 +335,7 @@ These survive restarts and are the ONLY timers that do: the provider's own sched
 - Wakeups and crons: \`open-claudia schedule-wakeup <30s|5m|2h|1d|ISO> "<prompt>"\` (you wake in this conversation with the prompt), \`open-claudia cron-add "<5-field cron>" "<prompt>"\`, \`cron-list\`, \`cron-remove <id>\`.
 - Watches: \`open-claudia watch-add "<check-cmd>" "<wake-prompt>"\` polls silently and wakes you once the check exits 0 (one-shot; \`--repeat\`, \`--every\`, \`--timeout\` default 2h, an expired watch still fires marked "Watch expired"). For EXTERNAL state only. \`watch-list\` / \`watch-remove <id>\`.
 - Tasks: \`open-claudia task plan|add|list|start|done|remove\` is the persistent per-channel list (the provider's own todo tools are not). Plan work that may outlive this turn and mark each step as you go; \`done\` deletes the entry. Skip it for work that finishes this turn.
-- Relay and hand-off: \`open-claudia send-to --person "<name>" "<msg>"\` (prefix "From <speaker>:" when forwarding, "Open Claudia:" when acting on your own; sparingly, audited). \`open-claudia handoff --thread <id> "<msg>"\` moves work to another Kazee thread (owner only).
+- Relay and hand-off: \`open-claudia send-to --person "<name>" "<msg>"\` (prefix "From <speaker>:" when forwarding, "Open Claudia:" when acting on your own; sparingly, audited). \`open-claudia handoff --thread <id> "<msg>"\` moves work to another Kazee thread (owner only); \`handoff --new "<title>" "<msg>"\` starts a titled thread tagging the asker (never hand off onto a plain main-chat message).
 - Lookups: \`open-claudia recent --person "<name>"\`; \`open-claudia people list|show|note\`; \`open-claudia intros list|approve|reject\` (owner).
 
 ## Context packs (your long-term knowledge)

package/core/thread-handoff.js

@@ -27,6 +27,8 @@ const MAX_HOPS = 3;
 const MAX_MESSAGE_CHARS = 4000;
 const MAX_LABEL_CHARS = 60;
 const MAX_SHOWN_TITLE_CHARS = 80;
+// chat-central thread titles (kazee-chat thread-start): 1-80 characters.
+const MAX_NEW_TITLE_CHARS = 80;
 // Kazee chat and thread ids are 24-hex Mongo ids; anything outside this set
 // could not be one and could bend a conversation key ("#thread:").
 const ID_RE = /^[A-Za-z0-9_-]{1,64}$/;
@@ -73,9 +75,20 @@ function sourceName(source) {
 }
 
 // What everyone in the target thread sees: plain, readable on a phone.
-function visibleText({ source, message }) {
+function visibleText({ source, message, tag = null }) {
   const sep = message.includes("\n") || message.length > 120 ? "\n" : " ";
-  return `↪️ Hand-off from ${sourceName(source)}:${sep}${message}`;
+  const who = tag ? `@[${tag.name}](${tag.id}) ` : "";
+  return `${who}↪️ Hand-off from ${sourceName(source)}:${sep}${message}`;
+}
+
+// The person a new thread is for: the one whose turn asked, tagged so the
+// thread shows in their Threads list (24 Oct 2026: Cynthia's bot handed off
+// onto a plain main-chat message; untitled and untagged, nobody could find it).
+function requesterTag(caller) {
+  const id = caller && caller.userId ? String(caller.userId) : "";
+  if (!/^[a-f0-9]{24}$/i.test(id)) return null;
+  const name = oneLine((caller.name || "you").replace(/[\[\]()]/g, ""), 60) || "you";
+  return { id, name };
 }
 
 function quote(message) {
@@ -135,10 +148,17 @@ async function handOff({ caller, payload = {}, registry }, deps = {}) {
   const sourceThreadId = caller.threadId ? String(caller.threadId) : null;
   if (!sourceChatId) throw new HandoffError(400, "cannot tell which Kazee chat this turn is in");
 
-  const targetThreadId = String(payload.targetThreadId || "").trim();
+  let targetThreadId = String(payload.targetThreadId || "").trim();
   const targetChatId = String(payload.targetChatId || "").trim() || sourceChatId;
-  if (!targetThreadId) throw new HandoffError(400, "missing --thread <threadId> (a hand-off goes to a Kazee thread)");
-  if (!ID_RE.test(targetThreadId)) throw new HandoffError(400, `"${oneLine(targetThreadId, 40)}" is not a Kazee thread id (the thread's root message id)`);
+  const newTitle = payload.newThreadTitle == null ? "" : oneLine(payload.newThreadTitle, 200);
+  if (payload.newThreadTitle != null) {
+    if (targetThreadId) throw new HandoffError(400, "use --thread <threadId> for an existing thread or --new \"<title>\" for a new one, not both");
+    if (!newTitle) throw new HandoffError(400, "a new thread needs a title: --new \"<title>\"");
+    if (newTitle.length > MAX_NEW_TITLE_CHARS) throw new HandoffError(400, `the new thread's title is ${newTitle.length} characters; at most ${MAX_NEW_TITLE_CHARS}`);
+    targetThreadId = "(new)";
+  }
+  if (!targetThreadId) throw new HandoffError(400, "missing --thread <threadId> or --new \"<title>\" (a hand-off goes to a Kazee thread)");
+  if (!newTitle && !ID_RE.test(targetThreadId)) throw new HandoffError(400, `"${oneLine(targetThreadId, 40)}" is not a Kazee thread id (the thread's root message id)`);
   if (!ID_RE.test(targetChatId)) throw new HandoffError(400, `"${oneLine(targetChatId, 40)}" is not a Kazee chat id`);
   if (targetChatId === sourceChatId && targetThreadId === sourceThreadId) {
     throw new HandoffError(400, "that is the thread you are in: a hand-off goes to another thread");
@@ -155,7 +175,18 @@ async function handOff({ caller, payload = {}, registry }, deps = {}) {
     throw new HandoffError(409, `loop guard: ${MAX_HOPS} hand-offs already ran in a row without a person writing, so this one is refused. Report in your reply instead; the person's next message starts a new chain.`);
   }
 
-  const targetThread = await readThread(adapter, targetChatId, targetThreadId);
+  // A new thread: a real titled thread (never a plain main-chat message),
+  // started only once every refusal above has passed.
+  const tag = newTitle ? requesterTag(caller) : null;
+  if (newTitle) {
+    if (typeof adapter.startThread !== "function") throw new HandoffError(501, "this Kazee adapter cannot start threads");
+    try {
+      targetThreadId = await adapter.startThread(targetChatId, newTitle);
+    } catch (e) {
+      throw new HandoffError(502, `Kazee Chat did not start the thread "${newTitle}": ${String((e && e.message) || e).slice(0, 200)}; nothing was posted or woken`);
+    }
+  }
+  const targetThread = newTitle ? { ok: true, title: newTitle } : await readThread(adapter, targetChatId, targetThreadId);
   if (!targetThread.ok) {
     throw new HandoffError(404, `could not open thread ${targetThreadId} in chat ${targetChatId}: ${targetThread.error}`);
   }
@@ -173,7 +204,9 @@ async function handOff({ caller, payload = {}, registry }, deps = {}) {
     key: conversationKeyFor("kazee", targetChatId, targetThreadId),
   };
 
-  const sent = normalizeSendResult(await adapter.send(targetChatId, visibleText({ source, message }), { threadId: targetThreadId }));
+  const sendOpts = { threadId: targetThreadId };
+  if (tag) sendOpts.mentions = [tag.id];
+  const sent = normalizeSendResult(await adapter.send(targetChatId, visibleText({ source, message, tag }), sendOpts));
   if (!sent.ok) {
     throw new HandoffError(502, "Kazee Chat did not take the hand-off message (details in bot.log); nothing was woken");
   }
@@ -230,6 +263,7 @@ async function handOff({ caller, payload = {}, registry }, deps = {}) {
         to: target.key,
         requestedBy,
         messageId: sent.messageId,
+        newThread: Boolean(newTitle),
         at,
       },
     });
@@ -241,15 +275,17 @@ async function handOff({ caller, payload = {}, registry }, deps = {}) {
       by: caller.canonicalUserId || null, from: source.key, to: target.key, hop, jobId: job && job.id, messageId: sent.messageId,
     });
   } catch (_) { /* the audit trail is best-effort */ }
-  return { messageId: sent.messageId, job, hop, maxHops: MAX_HOPS, source, target };
+  return { messageId: sent.messageId, job, hop, maxHops: MAX_HOPS, source, target, newThread: Boolean(newTitle) };
 }
 
 module.exports = {
   MAX_HOPS,
   MAX_MESSAGE_CHARS,
+  MAX_NEW_TITLE_CHARS,
   HandoffError,
   handOff,
   priorHop,
+  requesterTag,
   visibleText,
   wakePrompt,
 };

package/core/tool-guard.js

@@ -1008,14 +1008,18 @@ function browserDriverDenial(command, now = Date.now()) {
 // file, a runner this does not know). Deliberately ahead of the relaxed
 // tooling-mode switch: it protects the machine, it is not a workflow
 // preference. Any error here allows: the net still holds.
-const TEST_RUNNERS = new Set(["jest", "vitest"]);
+// 6 Nov 2026: helpers on the tickets bot ran tsc on three repos at once, about
+// 700 MB each, 2,887 of its 3,072 MiB. tsc has no workers, so it only takes its
+// turn with the test runs and honours the memory floor.
+const TEST_RUNNERS = new Set(["jest", "vitest", "tsc"]);
 const PACKAGE_MANAGERS = new Set(["npm", "yarn", "pnpm", "bun"]);
 const TEST_RUN_CLAIM_MS = 30000;
 const NODE_VALUE_FLAGS = new Set(["-r", "--require", "--import", "--loader", "--experimental-loader", "--env-file", "--conditions", "-C"]);
 const NOT_A_RUN_FLAGS = new Set(["--listTests", "--showConfig", "--version", "-v", "--help", "-h", "--clearCache"]);
+const TSC_NOT_A_RUN_FLAGS = new Set(["--init", "--all"]);
 // A process that IS a test run (not a shell or grep that mentions one).
-const TEST_PROCESS_RE = /(?:^|[\s/])(?:jest|jest-cli|vitest)(?:\.c?m?js)?(?=\s|$)|jest-worker\/|vitest\/dist\/|tinypool\//;
-const TEST_PROCESS_BINS = new Set(["node", "nodejs", "jest", "vitest", "npm", "npx", "yarn", "pnpm", "pnpx", "bun", "bunx"]);
+const TEST_PROCESS_RE = /(?:^|[\s/])(?:jest|jest-cli|vitest|tsc)(?:\.c?m?js)?(?=\s|$)|jest-worker\/|vitest\/dist\/|tinypool\//;
+const TEST_PROCESS_BINS = new Set(["node", "nodejs", "jest", "vitest", "tsc", "npm", "npx", "yarn", "pnpm", "pnpx", "bun", "bunx"]);
 
 function positiveInt(value, fallback) {
   const n = Number(value);
@@ -1110,7 +1114,7 @@ function packageScriptRun(words, at, pkg) {
 // and what a shell runs from a string (bash -c, eval, $(...)).
 function testRunInvocations(command, cwd, depth = 0) {
   const runs = [];
-  if (depth > 4 || !/jest|vitest|test|run|\bt\b|exec|yarn|pnpm/.test(String(command || ""))) return runs;
+  if (depth > 4 || !/jest|vitest|tsc|test|run|\bt\b|exec|yarn|pnpm/.test(String(command || ""))) return runs;
   let dir = path.resolve(String(cwd || process.cwd()));
   const { commands, nested } = shellCommands(command);
   const scripts = [...nested];
@@ -1204,6 +1208,9 @@ function testRunWorkers(run, cpus) {
   if (args.some((a) => NOT_A_RUN_FLAGS.has(a)) || (runner === "vitest" && ["list", "init"].includes(args[0]))) {
     return { notARun: true };
   }
+  if (runner === "tsc") {
+    return args.some((a) => TSC_NOT_A_RUN_FLAGS.has(a)) ? { notARun: true } : { workers: 1, source: "tsc" };
+  }
   if (runner === "jest") {
     if (args.includes("--runInBand") || args.includes("-i") || args.includes("--run-in-band")) return { workers: 1, source: "--runInBand" };
     const value = flagValue(args, ["--maxWorkers", "--max-workers", "-w"]);
@@ -1333,8 +1340,8 @@ function testRunDenial(command, { cwd, session = "", probe = systemProbe, limits
       return {
         reason: "busy",
         message:
-          `⛔ Test-run guard: another test run is already going on this machine (pid ${busy.pid}, running ${busy.etime}${where ? `, in ${where}` : ""}): ${String(busy.command).slice(0, 140)}\n` +
-          `Only one test run at a time, so parallel conversations cannot run the machine out of memory. Wait for it to finish, then run yours. If it is your own leftover run, stop it first.`,
+          `⛔ Test-run guard: another test run or type check is already going on this machine (pid ${busy.pid}, running ${busy.etime}${where ? `, in ${where}` : ""}): ${String(busy.command).slice(0, 140)}\n` +
+          `Only one test run or type check at a time, so parallel conversations cannot run the machine out of memory. Wait for it to finish, then run yours. If it is your own leftover run, stop it first.`,
       };
     }
     const claim = readClaim(limits.claimFile);
@@ -1342,7 +1349,7 @@ function testRunDenial(command, { cwd, session = "", probe = systemProbe, limits
       return {
         reason: "busy",
         message:
-          `⛔ Test-run guard: another conversation started a test run ${Math.round((probe.now() - claim.at) / 1000)} s ago${claim.cwd ? ` in ${home(claim.cwd)}` : ""}. Only one runs at a time; wait for it to finish, then run yours.`,
+          `⛔ Test-run guard: another conversation started a test run or type check ${Math.round((probe.now() - claim.at) / 1000)} s ago${claim.cwd ? ` in ${home(claim.cwd)}` : ""}. Only one runs at a time; wait for it to finish, then run yours.`,
       };
     }
     const free = probe.freePct();
@@ -1350,7 +1357,7 @@ function testRunDenial(command, { cwd, session = "", probe = systemProbe, limits
       return {
         reason: "memory",
         message:
-          `⛔ Test-run guard: free memory is ${free}%, under the ${limits.minFreePct}% a test run needs. Wait a few minutes and try again; do not raise the worker count.` +
+          `⛔ Test-run guard: free memory is ${free}%, under the ${limits.minFreePct}% a test run or type check needs. Wait a few minutes and try again; do not raise the worker count.` +
           (process.platform === "darwin" ? " See what is using memory: open-claudia tool run mac-health memory-guard-status" : ""),
       };
     }