alvin-bot 4.4.6 → 4.5.0

package/CHANGELOG.md

@@ -2,6 +2,111 @@
 
 All notable changes to Alvin Bot are documented here.
 
+## [4.5.0] — 2026-04-09
+
+### 🐛 TUI Bug Fixes (critical — the old TUI was effectively unusable)
+
+**Double-character echo fixed** — Every keystroke in `alvin-bot tui` appeared twice (typing `hello` showed as `hheelllloo`). Root cause: `src/tui/index.ts` called `process.stdin.setRawMode(false)` alongside `readline.createInterface({ terminal: true })`. readline with `terminal: true` already controls the tty mode for its own line editor; forcing cooked mode on top of that makes both the terminal AND readline echo every keystroke. Removed the explicit `setRawMode(false)` call and let readline manage the tty state itself.
+
+**Cursor chaos fixed** — The old `redrawHeader()` function wrote `\x1b7` / `\x1b8` (save/restore cursor) escape sequences that raced with readline's internal cursor tracking, producing garbled output mid-stream. The header redraw is now a no-op during active streaming and uses readline's own `cursorTo`/`clearLine` helpers otherwise — cooperating with readline instead of fighting it.
+
+**Prompt state machine consolidated** — `showPrompt()` was called at ~7 different places, each re-rendering the prompt at potentially racy moments. It is now the single source of truth and no-ops during streaming. Every helper (`printUser`, `printAssistantStart`, `printInfo`, `printError`, `printSuccess`, `printTool`) calls `clearCurrentLine()` first, so the input line is always cleanly wiped before output is written above it.
+
+**Terminal resize handling** — Added `process.stdout.on("resize", …)` so the header redraws correctly when the user resizes the window (when safe).
+
+### ✨ New Feature: Parallel Observation + Session Routing
+
+**The big one.** Before 4.5.0, the TUI/Web-UI shared the exact same session as the Telegram bot (both keyed to `config.allowedUsers[0]`). That meant `/new` in the TUI wiped the Telegram history, and the TUI had no visibility into live Telegram activity. This release cleanly separates the two and adds live mirroring in both directions.
+
+#### New in-process broadcast bus — `src/services/broadcast.ts`
+
+A tiny typed `EventEmitter` with four event types:
+- `user_msg` — a user sent a message on a platform (Telegram, WhatsApp, etc.)
+- `response_start` — the bot started generating a response
+- `response_delta` — a streaming text chunk
+- `response_done` — the response is complete
+
+Fire-and-forget, zero backpressure, no history retention. The Telegram handler (`src/handlers/message.ts`) emits these events around its normal processing. The web server subscribes once at module load and fan-outs to every connected WebSocket client as `mirror:*` messages. Platform-agnostic signature so WhatsApp/Signal can plug in later without architectural changes.
+
+#### TUI session isolation
+
+The TUI now owns its own session key, completely separate from the Telegram user's session:
+
+- **Default**: `alvin-bot tui` → fresh ephemeral session `tui:ephemeral:<timestamp>`. Every TUI start is a clean slate.
+- **Persistent**: `alvin-bot tui --resume` → resumes `tui:local`, a long-lived session that survives TUI restarts.
+
+Your Telegram conversation and your TUI conversation no longer overwrite each other's history. `/new` in the TUI only resets the TUI session.
+
+#### `/target tui|telegram` — remote-control the Telegram session from TUI
+
+New TUI command to switch where your typed messages go:
+
+- **`/target tui`** (default) — Your messages go into the TUI's isolated session. Responses are rendered in the TUI only.
+- **`/target telegram`** — Your messages enter the Telegram session (shared memory with whoever messages your bot on Telegram). The bot responds **both** in the TUI (via the open WebSocket) **and** in the actual Telegram chat (via the existing delivery queue). The active target is shown in the header as `→ Telegram` or `TUI session`.
+
+Note: Telegram bot API does not allow bots to forge user messages, so your original prompt stays in the TUI — only the bot's response lands in Telegram. This is the closest possible equivalent to "remote typing into Telegram".
+
+#### `/observe on|off` — mirror Telegram activity into the TUI
+
+When observer mode is on (default), every Telegram user message and streaming bot response is mirrored into the TUI with distinct dim + `📱 Tel` styling. You can watch a live conversation happen from the TUI while running your own independent session in parallel. Toggle off with `/observe off` if the mirror noise gets in the way.
+
+### 🧠 Architecture / Design Note
+
+This feature deliberately does **not** go through the Claude Agent SDK or touch the `pathToClaudeCodeExecutable` flow. The broadcast bus is a pure observation layer in alvin-bot's own process, and session routing is just a different `sessionKey` lookup in the existing `getSession()` map. The bot's 1st-party auth behavior (CLI-backed session routing) is preserved exactly as before.
+
+### 📦 Compatibility
+
+This is a minor release (new feature), not a patch. No breaking changes to existing commands, existing behavior, or existing API endpoints. Old clients that don't send a `target` field continue to work exactly as before (falling back to the primary Telegram user's session).
+
+```bash
+npm update -g alvin-bot
+alvin-bot tui               # fresh TUI session, observer on by default
+alvin-bot tui --resume      # resume persistent tui:local session
+```
+
+Once inside TUI:
+- `/target telegram` — route your messages into the Telegram session (responses land in both TUI and Telegram chat)
+- `/target tui`      — switch back to isolated TUI session (default)
+- `/observe off`     — stop mirroring Telegram activity
+- `/observe on`      — resume mirroring
+
+## [4.4.7] — 2026-04-09
+
+### 🔐 Security / Dependencies
+
+**6 of 9 npm audit vulnerabilities fixed (non-breaking)** — Ran `npm audit fix` to patch the transitive `@xmldom/xmldom` XML injection, `basic-ftp` CRLF command injection, and `brace-expansion` DoS vulnerabilities. Also upgraded the direct dependency `@anthropic-ai/claude-agent-sdk` from `0.2.92` to `0.2.97` (latest, non-breaking patch release with no changes to the `query()` API surface Alvin-Bot uses).
+
+Remaining unaddressed (by design, require breaking upgrades or overrides):
+- `@anthropic-ai/sdk` Memory Tool sandbox escape — **not exploitable** in Alvin-Bot because the `Memory` tool is not listed in `allowedTools` (we only use `Read`, `Write`, `Edit`, `Bash`, `Glob`, `Grep`, `WebSearch`, `WebFetch`, `Task`).
+- `electron` (17 advisories) — waiting for a planned breaking upgrade to `electron@41.x`.
+
+### ✨ Stability Improvements
+
+**Session memory hygiene (`src/services/session.ts`)** — The in-memory `sessions` Map grew unbounded: every user that ever messaged the bot kept a full session object (including conversation history, cost breakdown, abort controller) forever. On a single-user bot like Ali's this is a non-issue; on any multi-user deployment it's a steady leak.
+
+New behavior:
+- **Conservative 7-day TTL**: a session is only eligible for cleanup after 7 full days of complete inactivity. Configurable via `ALVIN_SESSION_TTL_DAYS` env var.
+- **Never touches active sessions**: the cleanup loop explicitly skips any session with `isProcessing === true`.
+- **`lastActivity` touched on every `getSession()` call**: any interaction at all keeps the session alive indefinitely.
+- **Orphaned `abortController` cleanup** before removal (defensive).
+- Runs hourly; logs a message when it actually purges something.
+
+This is memory hygiene only — it cannot reduce Alvin-Bot's capabilities, permissions, or responsiveness. Active users see zero behavioral change.
+
+**MAX_BUDGET_USD tracking (`src/services/session.ts:trackProviderUsage`)** — The `MAX_BUDGET_USD` config was declared but never read anywhere. Now it's tracked as a **soft warning** (never a block):
+- When a session's cumulative cost crosses 80% of the configured budget, a `⚠️  Session budget 80% consumed` message is logged.
+- When it crosses 100%, a `💸 Session budget exceeded … bot continues (no hard limit enforced)` message is logged.
+- **The bot never blocks** — the warnings exist purely as operator signals. `/new` resets the warning flags so subsequent sessions get fresh thresholds.
+- `session.totalCost` is now correctly incremented (previously declared in the interface but never written to).
+
+### 📦 Compatibility
+
+No breaking changes. User-facing behavior is identical — same commands, same permissions, same response patterns. The only visible change is new log messages for cleanup events and budget thresholds.
+
+```bash
+npm update -g alvin-bot
+```
+
 ## [4.4.6] — 2026-04-09
 
 ### 🐛 Bug Fixes

package/dist/handlers/message.js

@@ -12,6 +12,7 @@ import { trackAndAdapt } from "../services/language-detect.js";
 import { shouldCompact, compactSession } from "../services/compaction.js";
 import { emit } from "../services/hooks.js";
 import { trackUsage } from "../services/usage-tracker.js";
+import { emitUserMessage as broadcastUserMessage, emitResponseStart as broadcastResponseStart, emitResponseDelta as broadcastResponseDelta, emitResponseDone as broadcastResponseDone, } from "../services/broadcast.js";
 /** React to a message with an emoji. Silently fails if reactions aren't supported. */
 async function react(ctx, emoji) {
     try {
@@ -85,6 +86,22 @@ export async function handleMessage(ctx) {
         await ctx.api.sendChatAction(ctx.chat.id, "typing");
         session.messageCount++;
         emit("message:received", { userId, text, platform: "telegram" });
+        // v4.5.0: broadcast the user message so TUI/WebUI observers can mirror it.
+        // The broadcast bus is fire-and-forget — never affects the Telegram flow.
+        broadcastUserMessage({
+            platform: "telegram",
+            userId,
+            userName: ctx.from?.first_name || ctx.from?.username,
+            chatId: ctx.chat.id,
+            text,
+            ts: Date.now(),
+        });
+        broadcastResponseStart({
+            platform: "telegram",
+            userId,
+            chatId: ctx.chat.id,
+            ts: Date.now(),
+        });
         // Determine provider type early for compaction check
         const registry = getRegistry();
         const activeProvider = registry.getActive();
@@ -130,11 +147,25 @@ export async function handleMessage(ctx) {
             addToHistory(userId, { role: "user", content: text });
         }
         // Stream response from provider (with fallback)
+        let lastBroadcastLen = 0;
         for await (const chunk of registry.queryWithFallback(queryOpts)) {
             switch (chunk.type) {
                 case "text":
                     finalText = chunk.text || "";
                     await streamer.update(finalText);
+                    // Emit the new delta for observers — accumulated text minus what
+                    // we already broadcast.
+                    if (finalText.length > lastBroadcastLen) {
+                        const delta = finalText.slice(lastBroadcastLen);
+                        broadcastResponseDelta({
+                            platform: "telegram",
+                            userId,
+                            chatId: ctx.chat.id,
+                            delta,
+                            ts: Date.now(),
+                        });
+                        lastBroadcastLen = finalText.length;
+                    }
                     break;
                 case "tool_use":
                     // Could show tool activity indicator
@@ -161,6 +192,15 @@ export async function handleMessage(ctx) {
         }
         await streamer.finalize(finalText);
         emit("message:sent", { userId, text: finalText, platform: "telegram" });
+        // v4.5.0: tell observers the response is complete.
+        broadcastResponseDone({
+            platform: "telegram",
+            userId,
+            chatId: ctx.chat.id,
+            finalText,
+            cost: session.costByProvider[registry.getActiveKey()],
+            ts: Date.now(),
+        });
         // Clear thinking reaction (replace with nothing — message was answered)
         await react(ctx, "👍");
         // Add assistant response to history (for non-SDK providers)

package/dist/index.js

@@ -60,6 +60,7 @@ import { loadPlugins, registerPluginCommands, unloadPlugins } from "./services/p
 import { initMCP, disconnectMCP, hasMCPConfig } from "./services/mcp.js";
 import { startWebServer } from "./web/server.js";
 import { startScheduler, stopScheduler, setNotifyCallback } from "./services/cron.js";
+import { startSessionCleanup, stopSessionCleanup } from "./services/session.js";
 import { processQueue, cleanupQueue, setSenders, enqueue } from "./services/delivery-queue.js";
 import { discoverTools } from "./services/tool-discovery.js";
 import { startHeartbeat } from "./services/heartbeat.js";
@@ -214,6 +215,7 @@ const shutdown = async () => {
     console.log("Graceful shutdown initiated...");
     cancelAllSubAgents();
     stopScheduler();
+    stopSessionCleanup();
     if (queueInterval)
         clearInterval(queueInterval);
     if (queueCleanupInterval)
@@ -348,6 +350,9 @@ setNotifyCallback(async (target, text) => {
     enqueue(target.platform, String(target.chatId), text);
 });
 startScheduler();
+// Session memory hygiene: purge sessions idle > 7 days (configurable via
+// ALVIN_SESSION_TTL_DAYS). Never touches active sessions — see session.ts.
+startSessionCleanup();
 // Wire delivery queue senders
 setSenders({
     telegram: async (chatId, content) => {

package/dist/services/broadcast.js

@@ -0,0 +1,52 @@
+/**
+ * In-process Broadcast Bus — Telegram Activity Mirror (v4.5.0+)
+ *
+ * A tiny typed EventEmitter that lets the Telegram handler announce every
+ * user message, every streaming response delta, and every "response done"
+ * event. The web server subscribes to the same bus and forwards each event
+ * to all connected WebSocket clients as `mirror:*` messages.
+ *
+ * The TUI (and Web UI) can then show the full Telegram conversation in
+ * real time, side-by-side with its own isolated chat session.
+ *
+ * Design constraints:
+ *   - Zero backpressure: events are fire-and-forget, listeners must be fast
+ *   - No memory retention: no history is buffered here, just live pub/sub
+ *   - Platform-agnostic signature so we can later mirror WhatsApp/Signal too
+ *   - Does not touch the Claude Agent SDK or any provider internals — this
+ *     is a pure observation layer
+ */
+import { EventEmitter } from "events";
+class TypedBus extends EventEmitter {
+    emit(event, ...args) {
+        return super.emit(event, ...args);
+    }
+    on(event, listener) {
+        return super.on(event, listener);
+    }
+    off(event, listener) {
+        return super.off(event, listener);
+    }
+}
+/**
+ * Singleton bus. Import and call methods directly — no need for a factory.
+ *
+ * EventEmitter default maxListeners is 10; we bump it because a single
+ * web server connection may subscribe many listeners (one per connected
+ * WS client on a busy day).
+ */
+export const broadcast = new TypedBus();
+broadcast.setMaxListeners(100);
+// ── Convenience Emitters ───────────────────────────────────────────────────
+export function emitUserMessage(payload) {
+    broadcast.emit("user_msg", payload);
+}
+export function emitResponseStart(payload) {
+    broadcast.emit("response_start", payload);
+}
+export function emitResponseDelta(payload) {
+    broadcast.emit("response_delta", payload);
+}
+export function emitResponseDone(payload) {
+    broadcast.emit("response_done", payload);
+}

package/dist/services/session.js

@@ -39,6 +39,11 @@ export function getSession(key) {
         };
         sessions.set(k, session);
     }
+    else {
+        // Touch lastActivity on every access so the cleanup interval
+        // never kills a session that's still being interacted with.
+        session.lastActivity = Date.now();
+    }
     return session;
 }
 export function resetSession(key) {
@@ -53,16 +58,85 @@ export function resetSession(key) {
     session.totalOutputTokens = 0;
     session.history = [];
     session.startedAt = Date.now();
+    // Reset budget warning flags so the user gets fresh warnings in the new session.
+    session._budgetWarned80 = false;
+    session._budgetWarned100 = false;
 }
 /** Track cost, query count, and tokens for a provider. */
 export function trackProviderUsage(key, providerKey, cost, inputTokens, outputTokens) {
     const session = getSession(key);
     session.costByProvider[providerKey] = (session.costByProvider[providerKey] || 0) + cost;
     session.queriesByProvider[providerKey] = (session.queriesByProvider[providerKey] || 0) + 1;
+    session.totalCost += cost;
     if (inputTokens)
         session.totalInputTokens += inputTokens;
     if (outputTokens)
         session.totalOutputTokens += outputTokens;
+    // Soft budget warnings — these NEVER block the bot. They exist purely
+    // as log signals so the operator (Ali) can notice unusually expensive
+    // sessions. Each threshold fires at most once per session (reset on /new).
+    const budget = config.maxBudgetUsd;
+    if (budget > 0) {
+        const pct = (session.totalCost / budget) * 100;
+        if (pct >= 100 && !session._budgetWarned100) {
+            console.warn(`💸 Session budget exceeded: $${session.totalCost.toFixed(4)} / $${budget.toFixed(2)} (${pct.toFixed(0)}%) — bot continues (no hard limit enforced)`);
+            session._budgetWarned100 = true;
+        }
+        else if (pct >= 80 && !session._budgetWarned80) {
+            console.warn(`⚠️  Session budget 80% consumed: $${session.totalCost.toFixed(4)} / $${budget.toFixed(2)}`);
+            session._budgetWarned80 = true;
+        }
+    }
+}
+// ── Session Cleanup ────────────────────────────────────────────────────────
+//
+// Memory hygiene for long-running deployments. The sessions Map would
+// otherwise grow unbounded as new users arrive. The cleanup is deliberately
+// *conservative*:
+//   • Default TTL: 7 days of complete inactivity (not 24h)
+//   • Never touches sessions where isProcessing === true
+//   • Touches lastActivity on every getSession() call, so any interaction
+//     in the last 7 days keeps the session alive indefinitely
+//   • Aborts orphaned abort controllers defensively before removal
+//
+// Override via ALVIN_SESSION_TTL_DAYS env var if you want different behavior.
+const SESSION_TTL_DAYS = Number(process.env.ALVIN_SESSION_TTL_DAYS) || 7;
+const SESSION_INACTIVE_TTL_MS = SESSION_TTL_DAYS * 24 * 60 * 60 * 1000;
+const CLEANUP_INTERVAL_MS = 60 * 60 * 1000; // check hourly
+let cleanupTimer = null;
+/** Start the periodic session cleanup. Safe to call multiple times. */
+export function startSessionCleanup() {
+    if (cleanupTimer)
+        return;
+    cleanupTimer = setInterval(() => {
+        const now = Date.now();
+        let purged = 0;
+        for (const [key, s] of sessions) {
+            // NEVER kill a session that's actively processing a query.
+            if (s.isProcessing)
+                continue;
+            if (now - s.lastActivity > SESSION_INACTIVE_TTL_MS) {
+                if (s.abortController) {
+                    try {
+                        s.abortController.abort();
+                    }
+                    catch { /* ignore */ }
+                }
+                sessions.delete(key);
+                purged++;
+            }
+        }
+        if (purged > 0) {
+            console.log(`🧹 Session cleanup: purged ${purged} inactive session(s) (TTL: ${SESSION_TTL_DAYS} days)`);
+        }
+    }, CLEANUP_INTERVAL_MS);
+}
+/** Stop the cleanup timer (for graceful shutdown). */
+export function stopSessionCleanup() {
+    if (cleanupTimer) {
+        clearInterval(cleanupTimer);
+        cleanupTimer = null;
+    }
 }
 /** Add a message to conversation history (for non-SDK providers). */
 export function addToHistory(key, message) {

package/dist/tui/index.js

@@ -16,7 +16,7 @@
  *
  * Usage: alvin-bot tui [--port 3100] [--host localhost] [--lang en|de]
  */
-import { createInterface } from "readline";
+import { createInterface, cursorTo, clearLine as rlClearLine } from "readline";
 import WebSocket from "ws";
 import http from "http";
 import { initI18n, t } from "../i18n.js";
@@ -57,11 +57,17 @@ let connected = false;
 let currentModel = "loading...";
 let totalCost = 0;
 let isStreaming = false;
+let isMirrorStreaming = false;
 let currentResponse = "";
 let currentToolName = "";
 let toolCount = 0;
 const inputHistory = [];
 let historyIndex = -1;
+let activeTarget = "tui";
+let observerEnabled = true;
+// TUI's own session key — either ephemeral (new every start) or persistent
+// ("tui:local") if --resume is passed. Set once in startTUI().
+let tuiSessionKey = `tui:ephemeral:${Date.now()}`;
 const host = process.argv.includes("--host")
     ? process.argv[process.argv.indexOf("--host") + 1] || "localhost"
     : "localhost";
@@ -76,8 +82,14 @@ const HEADER_LINES = 3;
 function getWidth() {
     return process.stdout.columns || 80;
 }
-function clearLine() {
-    process.stdout.write("\r\x1b[K");
+/**
+ * Clear the current readline input line so we can write content "above" the
+ * prompt cleanly. Uses readline's own cursor API instead of raw escape
+ * sequences — this cooperates with readline's internal cursor tracking.
+ */
+function clearCurrentLine() {
+    cursorTo(process.stdout, 0);
+    rlClearLine(process.stdout, 0);
 }
 function drawHeader() {
     const w = getWidth();
@@ -85,61 +97,78 @@ function drawHeader() {
     const status = connected ? t("tui.connected") : t("tui.disconnected");
     const modelStr = `${C.brightMagenta}${currentModel}${C.reset}`;
     const costStr = totalCost > 0 ? ` ${C.gray}· $${totalCost.toFixed(4)}${C.reset}` : "";
+    const targetStr = ` ${C.gray}│${C.reset} ${C.brightYellow}${activeTarget === "telegram" ? "→ Telegram" : "TUI session"}${C.reset}`;
     const title = `${C.bold}${C.brightCyan}${t("tui.title")}${C.reset}`;
-    const right = `${statusDot} ${status} ${C.gray}│${C.reset} ${modelStr}${costStr}`;
+    const right = `${statusDot} ${status} ${C.gray}│${C.reset} ${modelStr}${costStr}${targetStr}`;
     console.log(`${C.gray}${"─".repeat(w)}${C.reset}`);
     console.log(`  ${title}${"".padEnd(10)}${right}`);
     console.log(`${C.gray}${"─".repeat(w)}${C.reset}`);
 }
+/**
+ * Redraw the header in place. Only safe to call when NOT streaming —
+ * the previous implementation used aggressive cursor save/restore escape
+ * sequences that collided with readline's internal cursor state and
+ * produced garbled output. Now this is a no-op during streaming and
+ * a clean redraw otherwise.
+ */
 function redrawHeader() {
-    // Save cursor, move to top, redraw header, restore cursor
-    process.stdout.write("\x1b7"); // Save cursor position
-    process.stdout.write("\x1b[H"); // Move to top-left (1,1)
-    // Clear the 3 header lines
+    if (isStreaming)
+        return; // Don't touch the cursor mid-stream
+    clearCurrentLine();
+    process.stdout.write("\x1b[s"); // Save cursor
+    process.stdout.write("\x1b[H"); // Move to top-left
     for (let i = 0; i < HEADER_LINES; i++) {
-        process.stdout.write("\x1b[K"); // Clear line
+        cursorTo(process.stdout, 0);
+        rlClearLine(process.stdout, 0);
         if (i < HEADER_LINES - 1)
-            process.stdout.write("\x1b[1B"); // Move down
+            process.stdout.write("\x1b[1B");
     }
-    process.stdout.write("\x1b[H"); // Back to top
+    process.stdout.write("\x1b[H");
     drawHeader();
-    process.stdout.write("\x1b8"); // Restore cursor position
+    process.stdout.write("\x1b[u"); // Restore cursor
+    if (rl && !isStreaming)
+        rl.prompt(true);
 }
 function drawHelp() {
     console.log(`
 ${C.bold}${t("help.title")}${C.reset}
-  ${C.cyan}/model${C.reset}        ${t("help.model")}
-  ${C.cyan}/status${C.reset}       ${t("help.status")}
-  ${C.cyan}/clear${C.reset}        ${t("help.clear")}
-  ${C.cyan}/cron${C.reset}         ${t("help.cron")}
-  ${C.cyan}/doctor${C.reset}       ${t("help.doctor")}
-  ${C.cyan}/backup${C.reset}       ${t("help.backup")}
-  ${C.cyan}/restart${C.reset}      ${t("help.restart")}
-  ${C.cyan}/help${C.reset}         ${t("help.help")}
-  ${C.cyan}/quit${C.reset}         ${t("help.quit")}
+  ${C.cyan}/model${C.reset}              ${t("help.model")}
+  ${C.cyan}/status${C.reset}             ${t("help.status")}
+  ${C.cyan}/clear${C.reset}              ${t("help.clear")}
+  ${C.cyan}/cron${C.reset}               ${t("help.cron")}
+  ${C.cyan}/doctor${C.reset}             ${t("help.doctor")}
+  ${C.cyan}/backup${C.reset}             ${t("help.backup")}
+  ${C.cyan}/restart${C.reset}            ${t("help.restart")}
+  ${C.cyan}/target tui${C.reset}|${C.cyan}telegram${C.reset}  Switch where your messages go
+  ${C.cyan}/observe on${C.reset}|${C.cyan}off${C.reset}       Mirror Telegram activity (default: on)
+  ${C.cyan}/help${C.reset}               ${t("help.help")}
+  ${C.cyan}/quit${C.reset}               ${t("help.quit")}
 
 ${C.dim}${t("help.footer")}${C.reset}
 `);
 }
 function printUser(text) {
+    clearCurrentLine();
     console.log(`\n${C.bold}${C.brightGreen}${t("tui.you")}:${C.reset} ${text}`);
 }
 function printAssistantStart() {
-    process.stdout.write(`\n${C.bold}${C.brightBlue}Alvin Bot:${C.reset} `);
+    clearCurrentLine();
+    const targetTag = activeTarget === "telegram" ? ` ${C.dim}[→ Tel]${C.reset}` : "";
+    process.stdout.write(`\n${C.bold}${C.brightBlue}Alvin Bot${targetTag}:${C.reset} `);
 }
 function printAssistantDelta(text) {
     process.stdout.write(text);
 }
 function printAssistantEnd(cost) {
     const costStr = cost && cost > 0 ? ` ${C.dim}($${cost.toFixed(4)})${C.reset}` : "";
-    console.log(costStr);
+    process.stdout.write(costStr + "\n");
 }
 function printTool(name) {
-    clearLine();
-    process.stdout.write(`\r  ${C.yellow}⚙ ${name}...${C.reset}`);
+    clearCurrentLine();
+    process.stdout.write(`  ${C.yellow}⚙ ${name}...${C.reset}`);
 }
 function printToolDone() {
-    clearLine();
+    clearCurrentLine();
     if (toolCount > 0) {
         const label = toolCount > 1 ? t("tui.toolsUsed") : t("tui.toolUsed");
         console.log(`  ${C.dim}${C.yellow}⚙ ${toolCount} ${label}${C.reset}`);
@@ -147,19 +176,46 @@ function printToolDone() {
     toolCount = 0;
 }
 function printError(msg) {
+    clearCurrentLine();
     console.log(`\n${C.red}✖ ${msg}${C.reset}`);
 }
 function printInfo(msg) {
+    clearCurrentLine();
     console.log(`${C.cyan}ℹ ${msg}${C.reset}`);
 }
 function printSuccess(msg) {
+    clearCurrentLine();
     console.log(`${C.green}✔ ${msg}${C.reset}`);
 }
+/**
+ * Render the mirror of a Telegram event (user message or bot response).
+ * Distinct styling: dim, phone prefix, grayed color.
+ */
+function printMirrorUser(text) {
+    clearCurrentLine();
+    console.log(`\n${C.dim}${C.gray}📱 Tel User: ${text}${C.reset}`);
+}
+function printMirrorAssistantStart() {
+    clearCurrentLine();
+    process.stdout.write(`\n${C.dim}${C.gray}📱 Tel Bot: ${C.reset}`);
+}
+function printMirrorAssistantDelta(text) {
+    // Dim styling while streaming the mirrored response
+    process.stdout.write(`${C.dim}${C.gray}${text}${C.reset}`);
+}
+function printMirrorAssistantEnd() {
+    process.stdout.write("\n");
+}
+/**
+ * The single source of truth for rendering the input prompt. Only ever
+ * called at state-transition points (connect, done, error, command result)
+ * and no-ops during streaming so the prompt never races with delta writes.
+ */
 function showPrompt() {
-    if (!isStreaming) {
-        rl.setPrompt(`${C.brightGreen}❯${C.reset} `);
-        rl.prompt();
-    }
+    if (isStreaming || !rl)
+        return;
+    rl.setPrompt(`${C.brightGreen}❯${C.reset} `);
+    rl.prompt(true);
 }
 // ── WebSocket Connection ────────────────────────────────
 function connectWebSocket() {
@@ -223,7 +279,7 @@ function handleMessage(msg) {
             isStreaming = false;
             currentResponse = "";
             currentToolName = "";
-            redrawHeader(); // Update cost in header
+            redrawHeader(); // Update cost in header (only if not streaming — see redrawHeader)
             showPrompt();
             break;
         case "error":
@@ -235,6 +291,41 @@ function handleMessage(msg) {
             printInfo(t("tui.sessionReset"));
             showPrompt();
             break;
+        // ── v4.5.0: Telegram activity mirror events ────────────────────────
+        // These arrive whenever someone interacts with the bot via Telegram,
+        // regardless of what the TUI is currently doing. We render them
+        // distinctly (dim + 📱 prefix) so they don't confuse themselves with
+        // the user's own session.
+        case "mirror:user_msg":
+            if (!observerEnabled)
+                break;
+            printMirrorUser(msg.text || "");
+            break;
+        case "mirror:response_start":
+            if (!observerEnabled)
+                break;
+            isMirrorStreaming = true;
+            printMirrorAssistantStart();
+            break;
+        case "mirror:response_delta":
+            if (!observerEnabled)
+                break;
+            if (!isMirrorStreaming) {
+                isMirrorStreaming = true;
+                printMirrorAssistantStart();
+            }
+            printMirrorAssistantDelta(msg.delta || "");
+            break;
+        case "mirror:response_done":
+            if (!observerEnabled)
+                break;
+            if (isMirrorStreaming) {
+                printMirrorAssistantEnd();
+                isMirrorStreaming = false;
+            }
+            // Don't call showPrompt here — the user's own prompt state is
+            // independent of mirror activity.
+            break;
     }
 }
 // ── API Calls ───────────────────────────────────────────
@@ -423,6 +514,40 @@ async function handleCommand(cmd) {
                 ws.send(JSON.stringify({ type: "reset" }));
             }
             break;
+        case "target":
+        case "t": {
+            const val = (parts[1] || "").toLowerCase();
+            if (val === "tui") {
+                activeTarget = "tui";
+                printSuccess("Target: TUI (your own isolated session)");
+                redrawHeader();
+            }
+            else if (val === "telegram" || val === "tel") {
+                activeTarget = "telegram";
+                printSuccess("Target: Telegram (your messages now go into the Telegram session — the bot replies in Telegram AND here)");
+                redrawHeader();
+            }
+            else {
+                printInfo(`Current target: ${activeTarget}. Use /target tui or /target telegram.`);
+            }
+            break;
+        }
+        case "observe":
+        case "o": {
+            const val = (parts[1] || "").toLowerCase();
+            if (val === "on" || val === "1" || val === "true") {
+                observerEnabled = true;
+                printSuccess("Observer mode: ON — Telegram activity will be mirrored here (dim)");
+            }
+            else if (val === "off" || val === "0" || val === "false") {
+                observerEnabled = false;
+                printSuccess("Observer mode: OFF — Telegram activity will NOT be shown here");
+            }
+            else {
+                printInfo(`Observer: ${observerEnabled ? "on" : "off"}. Use /observe on or /observe off.`);
+            }
+            break;
+        }
         case "quit":
         case "q":
         case "exit":
@@ -442,7 +567,16 @@ function sendChat(text) {
         return;
     }
     printUser(text);
-    ws.send(JSON.stringify({ type: "chat", text }));
+    // v4.5.0: include target + sessionKey so the web server routes the
+    // message to the right session. For target=tui, sessionKey is the
+    // TUI's own ephemeral (or persistent) key; for target=telegram,
+    // the server resolves it to the primary Telegram user's key.
+    ws.send(JSON.stringify({
+        type: "chat",
+        text,
+        target: activeTarget,
+        sessionKey: activeTarget === "tui" ? tuiSessionKey : undefined,
+    }));
     if (inputHistory[0] !== text) {
         inputHistory.unshift(text);
         if (inputHistory.length > 100)
@@ -464,9 +598,14 @@ async function fetchInitialModel() {
     catch { /* will get it on connect */ }
 }
 export async function startTUI() {
+    // --resume: use persistent TUI session (survives restarts).
+    // Default: ephemeral session, fresh every TUI start.
+    const wantResume = process.argv.includes("--resume");
+    tuiSessionKey = wantResume ? "tui:local" : `tui:ephemeral:${Date.now()}`;
     console.clear();
     drawHeader();
-    console.log(`${C.dim}${t("tui.connecting")} ${baseUrl}...${C.reset}\n`);
+    console.log(`${C.dim}${t("tui.connecting")} ${baseUrl}...${C.reset}`);
+    console.log(`${C.dim}Session: ${wantResume ? "resuming tui:local (persistent)" : "new ephemeral session"}${C.reset}\n`);
     drawHelp();
     rl = createInterface({
         input: process.stdin,
@@ -495,9 +634,18 @@ export async function startTUI() {
         console.log(`\n${C.dim}${t("tui.bye")}${C.reset}\n`);
         process.exit(0);
     });
-    if (process.stdin.isTTY) {
-        process.stdin.setRawMode(false);
-    }
+    // NOTE: Do NOT call process.stdin.setRawMode(false) here. readline with
+    // `terminal: true` already controls the terminal mode, and forcing cooked
+    // mode on top of that causes every keystroke to be echoed TWICE (once by
+    // the terminal, once by readline's line editor) — producing the classic
+    // "hheelllloo" double-echo bug. Let readline manage the tty mode itself.
+    // Handle terminal resize — redraw header to fit the new width.
+    process.stdout.on("resize", () => {
+        if (!isStreaming) {
+            redrawHeader();
+            showPrompt();
+        }
+    });
     await fetchInitialModel();
     connectWebSocket();
 }

package/dist/web/server.js

@@ -28,6 +28,7 @@ import { handleDoctorAPI } from "./doctor-api.js";
 import { handleOpenAICompat } from "./openai-compat.js";
 import { addCanvasClient } from "./canvas.js";
 import { BOT_ROOT, ENV_FILE, PUBLIC_DIR, MEMORY_DIR, MEMORY_FILE, SOUL_FILE, DATA_DIR, MCP_CONFIG, SKILLS_DIR } from "../paths.js";
+import { broadcast } from "../services/broadcast.js";
 const WEB_PORT = parseInt(process.env.WEB_PORT || "3100");
 const WEB_PASSWORD = process.env.WEB_PASSWORD || "";
 /** The actual port the Web UI is running on (may differ from WEB_PORT if busy). */
@@ -1144,6 +1145,57 @@ async function handleAPI(req, res, urlPath, body) {
     res.end(JSON.stringify({ error: "Not found" }));
 }
 // ── WebSocket Chat ──────────────────────────────────────
+// Set of all currently connected chat WebSocket clients (excluding canvas).
+// Populated on connect, cleaned up on close. Used to forward Telegram
+// activity to every observer.
+const chatClients = new Set();
+/**
+ * Wire the broadcast bus once at module load. The bus is singleton, so
+ * subscribing here means every Telegram message fan-outs to every connected
+ * chat client — without any per-connection re-subscription.
+ */
+broadcast.on("user_msg", (payload) => {
+    if (payload.platform !== "telegram")
+        return; // v4.5.0: telegram only for now
+    const json = JSON.stringify({
+        type: "mirror:user_msg",
+        text: payload.text,
+        platform: payload.platform,
+        userName: payload.userName,
+        ts: payload.ts,
+    });
+    for (const client of chatClients) {
+        if (client.readyState === WebSocket.OPEN)
+            client.send(json);
+    }
+});
+broadcast.on("response_start", (payload) => {
+    if (payload.platform !== "telegram")
+        return;
+    const json = JSON.stringify({ type: "mirror:response_start", platform: payload.platform, ts: payload.ts });
+    for (const client of chatClients) {
+        if (client.readyState === WebSocket.OPEN)
+            client.send(json);
+    }
+});
+broadcast.on("response_delta", (payload) => {
+    if (payload.platform !== "telegram")
+        return;
+    const json = JSON.stringify({ type: "mirror:response_delta", delta: payload.delta, platform: payload.platform, ts: payload.ts });
+    for (const client of chatClients) {
+        if (client.readyState === WebSocket.OPEN)
+            client.send(json);
+    }
+});
+broadcast.on("response_done", (payload) => {
+    if (payload.platform !== "telegram")
+        return;
+    const json = JSON.stringify({ type: "mirror:response_done", cost: payload.cost, platform: payload.platform, ts: payload.ts });
+    for (const client of chatClients) {
+        if (client.readyState === WebSocket.OPEN)
+            client.send(json);
+    }
+});
 function handleWebSocket(wss) {
     wss.on("connection", (ws, req) => {
         // Auth check
@@ -1158,12 +1210,33 @@ function handleWebSocket(wss) {
             return;
         }
         console.log("WebUI: client connected");
+        chatClients.add(ws);
         ws.on("message", async (data) => {
             try {
                 const msg = JSON.parse(data.toString());
                 if (msg.type === "chat") {
                     let { text, effort, file } = msg;
-                    const userId = config.allowedUsers[0] || 0;
+                    // v4.5.0: session routing. The client (TUI/WebUI) tells us which
+                    // session it wants its message to go into. Supported targets:
+                    //   - "tui"      → use msg.sessionKey (e.g. "tui:local" or
+                    //                   "tui:ephemeral:…"). Isolated from Telegram.
+                    //   - "telegram" → route into the primary Telegram user's session.
+                    //                   Responses go back to the client AND to the
+                    //                   actual Telegram chat via the broadcast bus.
+                    //   - undefined  → backwards-compatible: default to the primary
+                    //                   allowed user's session (old behavior).
+                    const target = msg.target;
+                    const telegramUserId = config.allowedUsers[0] || 0;
+                    let sessionKey;
+                    if (target === "tui" && typeof msg.sessionKey === "string" && msg.sessionKey.startsWith("tui:")) {
+                        sessionKey = msg.sessionKey;
+                    }
+                    else if (target === "telegram") {
+                        sessionKey = telegramUserId;
+                    }
+                    else {
+                        sessionKey = telegramUserId; // backwards compat
+                    }
                     // Handle file upload — save to temp and reference in prompt
                     if (file?.dataUrl && file?.name) {
                         try {
@@ -1184,16 +1257,17 @@ function handleWebSocket(wss) {
                     const registry = getRegistry();
                     const activeProvider = registry.getActive();
                     const isSDK = activeProvider.config.type === "claude-sdk";
-                    const session = getSession(userId);
+                    const session = getSession(sessionKey);
                     const queryOpts = {
                         prompt: text,
-                        systemPrompt: buildSystemPrompt(isSDK, session.language, "web-dashboard"),
+                        systemPrompt: buildSystemPrompt(isSDK, session.language, target === "telegram" ? "telegram" : "web-dashboard"),
                         workingDir: session.workingDir,
                         effort: effort || session.effort,
                         sessionId: isSDK ? session.sessionId : null,
                         history: !isSDK ? session.history : undefined,
                     };
                     let gotDone = false;
+                    let finalText = ""; // v4.5.0: capture the final response for target=telegram relay
                     try {
                         // Stream response
                         for await (const chunk of registry.queryWithFallback(queryOpts)) {
@@ -1201,6 +1275,8 @@ function handleWebSocket(wss) {
                                 break;
                             switch (chunk.type) {
                                 case "text":
+                                    if (chunk.text)
+                                        finalText = chunk.text;
                                     ws.send(JSON.stringify({ type: "text", text: chunk.text, delta: chunk.delta }));
                                     break;
                                 case "tool_use":
@@ -1208,6 +1284,8 @@ function handleWebSocket(wss) {
                                     break;
                                 case "done":
                                     gotDone = true;
+                                    if (chunk.text)
+                                        finalText = chunk.text;
                                     if (chunk.sessionId)
                                         session.sessionId = chunk.sessionId;
                                     if (chunk.costUsd)
@@ -1235,6 +1313,21 @@ function handleWebSocket(wss) {
                         if (!gotDone && ws.readyState === WebSocket.OPEN) {
                             ws.send(JSON.stringify({ type: "done", cost: 0 }));
                         }
+                        // v4.5.0: if the user typed in the TUI with target=telegram, we
+                        // must also post the bot's final response to the actual Telegram
+                        // chat so the continuity is preserved from the Telegram side.
+                        // (Telegram bots cannot forge user messages, so only the
+                        // response lands in the chat — the user prompt itself stays
+                        // in the TUI.)
+                        if (target === "telegram" && finalText.trim()) {
+                            try {
+                                const dq = await import("../services/delivery-queue.js");
+                                dq.enqueue("telegram", String(telegramUserId), finalText);
+                            }
+                            catch (err) {
+                                console.error("WebUI → Telegram relay failed:", err);
+                            }
+                        }
                     }
                     catch (streamErr) {
                         const errMsg = streamErr instanceof Error ? streamErr.message : String(streamErr);
@@ -1248,8 +1341,17 @@ function handleWebSocket(wss) {
                     }
                 }
                 if (msg.type === "reset") {
-                    const userId = config.allowedUsers[0] || 0;
-                    resetSession(userId);
+                    // v4.5.0: reset the target session, not a hardcoded one.
+                    const target = msg.target;
+                    const telegramUserId = config.allowedUsers[0] || 0;
+                    let resetKey;
+                    if (target === "tui" && typeof msg.sessionKey === "string" && msg.sessionKey.startsWith("tui:")) {
+                        resetKey = msg.sessionKey;
+                    }
+                    else {
+                        resetKey = telegramUserId;
+                    }
+                    resetSession(resetKey);
                     ws.send(JSON.stringify({ type: "reset", ok: true }));
                 }
             }
@@ -1260,6 +1362,7 @@ function handleWebSocket(wss) {
         });
         ws.on("close", () => {
             console.log("WebUI: client disconnected");
+            chatClients.delete(ws);
         });
     });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "alvin-bot",
-  "version": "4.4.6",
+  "version": "4.5.0",
   "description": "Alvin Bot — Your personal AI agent on Telegram, WhatsApp, Discord, Signal, and Web.",
   "type": "module",
   "main": "dist/index.js",
@@ -159,7 +159,7 @@
     "url": "git+https://github.com/alvbln/Alvin-Bot.git"
   },
   "dependencies": {
-    "@anthropic-ai/claude-agent-sdk": "^0.2.92",
+    "@anthropic-ai/claude-agent-sdk": "^0.2.97",
     "@hapi/boom": "^10.0.1",
     "@slack/bolt": "^4.6.0",
     "@types/node": "^22.0.0",