appback-remoteagent 0.22.2 → 0.23.0

package/README.md

@@ -29,6 +29,8 @@ RemoteAgent is currently organized around six core capabilities.
 | Telegram attachments | Telegram can send images, text, Markdown, PDF, Word documents, spreadsheet files, archives, and audio/voice inputs into the runtime | Supported |
 | Telegram Mini App UI | A richer Telegram-native UI can sit on top of the same runtime and session model | Planned next |
 
+Consecutive Telegram text updates received within the message batch window are treated as one user input. When their combined text exceeds 3,900 characters, RemoteAgent stores the complete UTF-8 text under `DATA_DIR/uploads/telegram`, indexes it as an artifact, and sends the provider one instruction containing the file path. This prevents Telegram-split long inputs from starting separate provider executions. Provider responses continue to use Telegram-safe message chunking.
+
 ## Product direction
 
 RemoteAgent is a self-hosted personal runtime, not a hosted SaaS.
@@ -327,6 +329,13 @@ remoteagent-start
 
 The command validates the BotFather token and shows a one-time Telegram `/start` link. Open that link from the account that will own the installation; RemoteAgent detects the sender's numeric user ID and stores it as the owner automatically. The token is entered through a hidden prompt, and the owner ID does not need to be looked up or typed manually.
 
+Remove a configured bot by username or numeric Bot ID, then restart the runtime:
+
+```bash
+remoteagent bot remove @example_bot
+sudo systemctl restart remoteagent
+```
+
 To move installation-wide `/secret` values to another PC, export and import a password-encrypted bundle:
 
 ```bash

package/dist/bot.js

@@ -102,6 +102,7 @@ const RECOGNIZED_COMMANDS = new Set([
 ]);
 const TELEGRAM_STALE_UPDATE_GRACE_SECONDS = 10;
 const TELEGRAM_PROCESS_STARTED_AT_SECONDS = Math.floor(Date.now() / 1000);
+const TELEGRAM_LONG_TEXT_FILE_THRESHOLD = 3900;
 const workLoopTails = new Map();
 const workLoopGenerations = new Map();
 const queuedWorkLoops = new Map();
@@ -233,10 +234,26 @@ export function createBot(token, bridge, botManagement, botInfo) {
         claude: config.claudeInstallCommand,
     }, config.claudeLoginStartCommand, config.claudeLoginFinishCommand);
     const messageBatcher = new TelegramMessageBatcher(config.telegramMessageBatchMs, async (target, botId, chatId, text) => {
+        let request = text;
+        if (text.length > TELEGRAM_LONG_TEXT_FILE_THRESHOLD) {
+            const saved = await saveLongTelegramText(botId, chatId, text);
+            const mapping = await bridge.status(botId, chatId).catch(() => undefined);
+            await memoryService.recordArtifact({
+                session: mapping?.session,
+                botId,
+                chatId,
+                kind: "text",
+                filePath: saved.path,
+                fileName: saved.fileName,
+                mimeType: "text/plain",
+            });
+            request = formatLongTelegramTextPrompt(saved.path, text.length);
+            await bridge.logSystem(botId, chatId, `Telegram long text saved as UTF-8 attachment (${text.length} chars): ${saved.path}`);
+        }
         await bridge.logSystem(botId, chatId, `Telegram text dispatch (${text.length} chars).`);
         await runWithPendingAnimation(target.botToken, target.telegramChatId, async (helpers) => {
             return {
-                chunks: await routeTelegramWorkLoop(bridge, botId, chatId, text, "Telegram text request", botManagement, helpers, autoContinue, memoryService),
+                chunks: await routeTelegramWorkLoop(bridge, botId, chatId, request, "Telegram text request", botManagement, helpers, autoContinue, memoryService),
             };
         });
     });
@@ -2980,6 +2997,23 @@ function safePathSegment(value) {
     const safe = value.replace(/[^a-zA-Z0-9._-]+/g, "_").replace(/^_+|_+$/g, "");
     return safe || "file";
 }
+async function saveLongTelegramText(botId, chatId, text) {
+    const directory = path.join(config.dataDir, "uploads", "telegram", safePathSegment(botId), safePathSegment(chatId));
+    await fs.mkdir(directory, { recursive: true });
+    const fileName = `${Date.now()}-telegram-long-message-${randomUUID()}.txt`;
+    const outputPath = path.join(directory, fileName);
+    await fs.writeFile(outputPath, text, { encoding: "utf8", mode: 0o600 });
+    return { path: outputPath, fileName };
+}
+function formatLongTelegramTextPrompt(filePath, characterCount) {
+    return [
+        "The user sent a long Telegram text that RemoteAgent stored as a UTF-8 text file.",
+        `File: ${filePath}`,
+        `Character count: ${characterCount}`,
+        "Read the entire file directly and treat its complete contents as the user's active instruction.",
+        "Do not process only a preview and do not ask the user to resend the split messages.",
+    ].join("\n");
+}
 async function normalizeTelegramDelivery(chunks) {
     const documents = new Map();
     const normalizedChunks = await Promise.all(chunks.map(async (chunk) => {

package/dist/cli.js

@@ -3,7 +3,7 @@ import { randomBytes } from "node:crypto";
 import os from "node:os";
 import path from "node:path";
 import process from "node:process";
-import { fetchTelegramBotIdentity, registerTelegramBot, readConfiguredOwnerId, waitForTelegramOwner, } from "./services/cli-config-service.js";
+import { fetchTelegramBotIdentity, registerTelegramBot, removeTelegramBot, readConfiguredOwnerId, waitForTelegramOwner, } from "./services/cli-config-service.js";
 import { exportSecrets, importSecrets } from "./services/secret-transfer-service.js";
 async function main() {
     const args = process.argv.slice(2);
@@ -21,6 +21,10 @@ async function main() {
         await addBot(dataDir, args.slice(2));
         return;
     }
+    if (group === "bot" && action === "remove") {
+        await removeBot(dataDir, args.slice(2));
+        return;
+    }
     if (group === "secret" && action === "export") {
         await exportSecretCommand(dataDir, args.slice(2));
         return;
@@ -76,6 +80,25 @@ async function addBot(dataDir, args) {
         "  # systemd runtime: sudo systemctl restart remoteagent",
     ].join("\n"));
 }
+async function removeBot(dataDir, args) {
+    if (args.some((arg) => arg.startsWith("--"))) {
+        throw new Error(`Unknown bot remove option: ${args.find((arg) => arg.startsWith("--"))}`);
+    }
+    const selector = args.shift();
+    if (!selector || args.length > 0) {
+        throw new Error("Usage: remoteagent bot remove <username|id>");
+    }
+    const result = await removeTelegramBot({ dataDir, selector });
+    const label = result.username ? `@${result.username}` : `bot ${result.id}`;
+    console.log([
+        `Removed ${label} (${result.id}).`,
+        `Configured bots: ${result.botCount}`,
+        `Configuration: ${result.envPath}`,
+        "Start or restart RemoteAgent to apply it:",
+        "  remoteagent-start",
+        "  # systemd runtime: sudo systemctl restart remoteagent",
+    ].join("\n"));
+}
 async function exportSecretCommand(dataDir, args) {
     const passphraseFile = takeOption(args, "--passphrase-file");
     if (args.some((arg) => arg.startsWith("--"))) {
@@ -197,6 +220,7 @@ Usage:
   remoteagent                         Start the foreground runtime
   remoteagent bot add [token] [--owner <telegram-user-id>]
   remoteagent bot add --token-file <file> --owner <telegram-user-id>
+  remoteagent bot remove <username|id>
   remoteagent secret export [file] [--passphrase-file <file>]
   remoteagent secret import <file> [--replace] [--passphrase-file <file>]
 

package/dist/config.js

@@ -33,14 +33,13 @@ function readTelegramBotTokens() {
     return [readRequired("TELEGRAM_BOT_TOKEN")];
 }
 function readTelegramBotUsernames() {
-    const raw = process.env.TELEGRAM_BOT_USERNAMES?.trim();
-    if (!raw) {
+    const raw = process.env.TELEGRAM_BOT_USERNAMES;
+    if (raw === undefined || raw === "") {
         return [];
     }
     return raw
-        .split(/[\r\n,]+/)
-        .map((value) => value.trim())
-        .filter(Boolean);
+        .split(",")
+        .map((value) => value.trim());
 }
 function readOptional(name) {
     const value = process.env[name]?.trim();

package/dist/services/bot-management-service.js

@@ -437,7 +437,9 @@ export class BotManagementService {
             : singleTokenLine
                 ? [singleTokenLine.slice("TELEGRAM_BOT_TOKEN=".length).trim()].filter(Boolean)
                 : [];
-        const configuredUsernames = usernameLine ? this.parseCsv(usernameLine.slice("TELEGRAM_BOT_USERNAMES=".length)) : [];
+        const configuredUsernames = usernameLine
+            ? usernameLine.slice("TELEGRAM_BOT_USERNAMES=".length).split(",").map((value) => value.trim())
+            : [];
         const usernames = await this.normalizeUsernamesFromTelegram(tokens, configuredUsernames);
         return {
             lines,

package/dist/services/cli-config-service.js

@@ -18,7 +18,7 @@ export async function registerTelegramBot(options) {
     });
     const values = parseEnv(original);
     const configuredTokens = parseCsv(values.get("TELEGRAM_BOT_TOKENS") || values.get("TELEGRAM_BOT_TOKEN") || "");
-    const configuredUsernames = parseCsv(values.get("TELEGRAM_BOT_USERNAMES") || "");
+    const configuredUsernames = parseCsvSlots(values.get("TELEGRAM_BOT_USERNAMES") || "");
     const validIndexes = configuredTokens
         .map((configuredToken, index) => isBotToken(configuredToken) ? index : -1)
         .filter((index) => index >= 0);
@@ -54,6 +54,51 @@ export async function registerTelegramBot(options) {
         botCount: tokens.length,
     };
 }
+export async function removeTelegramBot(options) {
+    const selector = options.selector.trim().replace(/^@/, "").toLowerCase();
+    if (!selector) {
+        throw new Error("Usage: remoteagent bot remove <username|id>");
+    }
+    const envPath = path.join(options.dataDir, ".env");
+    const original = await fs.readFile(envPath, "utf8").catch((error) => {
+        if (error.code === "ENOENT") {
+            throw new Error(`RemoteAgent configuration was not found: ${envPath}`);
+        }
+        throw error;
+    });
+    const values = parseEnv(original);
+    const configuredTokens = parseCsv(values.get("TELEGRAM_BOT_TOKENS") || values.get("TELEGRAM_BOT_TOKEN") || "");
+    const configuredUsernames = parseCsvSlots(values.get("TELEGRAM_BOT_USERNAMES") || "");
+    const validIndexes = configuredTokens
+        .map((token, index) => isBotToken(token) ? index : -1)
+        .filter((index) => index >= 0);
+    const tokens = validIndexes.map((index) => configuredTokens[index]);
+    const usernames = validIndexes.map((index) => configuredUsernames[index] || "");
+    const targetIndex = tokens.findIndex((token, index) => token.slice(0, token.indexOf(":")) === selector
+        || usernames[index]?.toLowerCase() === selector);
+    if (targetIndex < 0) {
+        throw new Error(`Telegram bot was not found: ${options.selector.trim()}`);
+    }
+    if (tokens.length <= 1) {
+        throw new Error("Cannot remove the last configured bot.");
+    }
+    const removedToken = tokens[targetIndex];
+    const removedUsername = usernames[targetIndex] || undefined;
+    const remainingTokens = tokens.filter((_, index) => index !== targetIndex);
+    const remainingUsernames = usernames.filter((_, index) => index !== targetIndex);
+    const next = upsertEnv(original, {
+        TELEGRAM_BOT_TOKEN: remainingTokens[0],
+        TELEGRAM_BOT_TOKENS: remainingTokens.join(","),
+        TELEGRAM_BOT_USERNAMES: remainingUsernames.join(","),
+    });
+    await atomicWrite(envPath, next, 0o600);
+    return {
+        id: Number(removedToken.slice(0, removedToken.indexOf(":"))),
+        username: removedUsername,
+        envPath,
+        botCount: remainingTokens.length,
+    };
+}
 export async function readConfiguredOwnerId(dataDir) {
     const envPath = path.join(dataDir, ".env");
     const text = await fs.readFile(envPath, "utf8").catch((error) => {
@@ -200,6 +245,9 @@ function parseCsv(value) {
         .map((item) => item.trim())
         .filter(Boolean);
 }
+function parseCsvSlots(value) {
+    return value.split(",").map((item) => item.trim());
+}
 function parseEnv(text) {
     const result = new Map();
     for (const line of text.split(/\r?\n/)) {

package/docs/CLI_BOOTSTRAP_AND_SECRET_MIGRATION.md

@@ -22,6 +22,22 @@ chmod 600 /secure/path/telegram-token
 remoteagent bot add --token-file /secure/path/telegram-token --owner 123456789
 ```
 
+Remove a configured bot by username or numeric Bot ID, then restart the runtime:
+
+```bash
+remoteagent bot remove @example_bot
+sudo systemctl restart remoteagent
+```
+
+```bash
+remoteagent bot remove 123456789
+sudo systemctl restart remoteagent
+```
+
+The command updates `TELEGRAM_BOT_TOKEN`, `TELEGRAM_BOT_TOKENS`, and
+`TELEGRAM_BOT_USERNAMES` together. It does not print bot tokens and refuses to
+remove the final configured bot.
+
 After adding or updating a bot, apply the configuration with the runtime command appropriate to the installation:
 
 ```bash

package/docs/DATABASE_DR_READONLY_STANDBY.md

@@ -0,0 +1,411 @@
+# Database Backup and Read-Only Standby Plan
+
+Last verified: 2026-08-27 (Asia/Seoul)
+
+## Goal
+
+- `.110` and `.111` remain the only writable database servers.
+- `.40` keeps off-host backups and read-only PostgreSQL standby instances.
+- During a primary outage, applications may read from `.40`, but writes fail closed.
+- `.40` is never promoted. After the primary returns, replication resumes in the
+  original direction, so reverse synchronization is not required.
+
+This is a read-only disaster-recovery design. It is not automatic multi-primary
+HA.
+
+## Verified Primary Layout
+
+| Primary | Database | Container | PostgreSQL | Backup stanza |
+|---|---|---|---|---|
+| `192.168.33.110` | Damoa | `damoa-db` | 15.19 | `damoa` |
+| `192.168.33.111` | Hub | `hub-db` | 15.19 | `hub111` |
+| `192.168.33.111` | Title Clash | `tc-db` | 15.19 | `tc111` |
+| `192.168.33.111` | Predict Clash | `pc-db` | 15.19 | `pc111` |
+| `192.168.33.111` | Claw Clash | `cc-db` | 15.19 | `cc111` |
+
+All five primaries were verified with:
+
+```text
+wal_level=replica
+max_wal_senders=10
+max_replication_slots=10
+hot_standby=on
+archive_mode=on
+archive_command=pgbackrest ... archive-push
+```
+
+## Current Backup Path
+
+All stanzas use pgBackRest over SFTP and write to:
+
+```text
+appback@192.168.33.40:/home/appback/backup/pgbackrest/repo
+```
+
+Schedules:
+
+| Primary | Full | Differential | Continuous WAL |
+|---|---|---|---|
+| `.110` Damoa | Sunday 18:00 UTC | Mon-Sat 18:00 UTC | yes |
+| `.111` four DBs | Sunday 17:00 UTC | Mon-Sat 17:00 UTC | yes |
+
+On 2026-08-27, all five stanzas had a successful 2026-08-23 full backup,
+successful differential backups through 2026-08-26, and WAL files arriving on
+2026-08-27. The repository contained only these active stanzas:
+
+```text
+damoa
+hub111
+tc111
+pc111
+cc111
+```
+
+Old `.110` stanzas named `hub`, `tc`, `pc`, and `cc` were removed after the
+services moved to `.111`.
+
+## Server `.40` DR Conversion: 2026-08-27
+
+The development workload previously sharing `.40` was moved before adding
+standby databases. This keeps backup and recovery capacity isolated from test
+builds and duplicate agent runtimes.
+
+### Workloads moved to `.50`
+
+- Damoa test deployment:
+  `/home/appback/deploy/damoa-test` on `.40` to
+  `/opt/appback/dev/damoa-test` on `.50`
+- Damoa test ingress:
+  `dev.appback.app` is terminated by cloudflared on `.30` and now forwards to
+  `http://192.168.33.50:3213`
+- Ten duplicate `appback-ai-agent` PM2 processes remain active on `.50`; their
+  `.40` copies were stopped
+
+The `.50` firewall permits the Damoa test port only from `.30`. The public
+endpoint and the internal `.30 -> .50` endpoint both returned HTTP 200 after
+cutover.
+
+### Cutover verification
+
+The final source snapshot is retained at:
+
+```text
+/home/appback/backup/migrations/damoa-test-cutover-20260827T075116Z
+```
+
+The copied snapshot is retained on `.50` at:
+
+```text
+/opt/appback/backups/migrations/damoa-test-cutover-20260827T075116Z
+```
+
+The source and destination SHA-256 values matched for the database dump,
+object-store archive, and source environment snapshot. After restore, all 83
+public PostgreSQL table row counts produced an identical aggregate hash. All
+non-MinIO-internal user objects also produced an identical file hash list.
+
+The Damoa test edge uses Docker DNS re-resolution for both `damoa-api` and
+`tc-minio`. Nginx configuration validation, API readiness, edge health, and the
+public `dev.appback.app` response were verified after the final restore.
+`route_snapshot_unavailable` refresh warnings appeared in both the old `.40`
+API logs and the `.50` API logs, so they were not introduced by the migration.
+
+### `.40` retained rollback state
+
+The old Damoa test containers, volumes, deployment directory, and immutable
+images remain on `.40`, but every `damoa-test-*` container is stopped. They are
+rollback material and must not be started while `dev.appback.app` points to
+`.50`.
+
+Before stopping the duplicate PM2 agents, `.40` retained its previous PM2 dump
+and crontab under:
+
+```text
+/home/appback/backup/dr-conversion-20260827T075410Z
+```
+
+The `.40` PM2 reboot entry was removed and its daemon was stopped. Backup
+retention cron jobs and the RemoteAgent service remain active. No deployment
+directory, Docker volume, image, external-disk data, pgBackRest data, or
+RemoteAgent workspace was deleted during this conversion.
+
+Rollback order:
+
+1. Stop the Damoa test stack on `.50`.
+2. Restore the saved `.40` crontab only if the duplicate PM2 agents must also
+   return.
+3. Start the `.40` Damoa test stack and verify its internal readiness.
+4. Change the `.30` cloudflared route back to `192.168.33.40:3213`, validate the
+   configuration, restart cloudflared, and verify the public endpoint.
+
+Do not run `.40` and `.50` as simultaneous writable copies of the Damoa test
+database or object store.
+
+## Accumulation Audit: 2026-08-27
+
+The repository did not contain unknown or orphan pgBackRest stanzas. The active
+repository directories were limited to `damoa`, `hub111`, `tc111`, `pc111`, and
+`cc111`. The non-database backup sets were also small:
+
+```text
+appback-minio current + history: about 1.4 GB
+damoa-media current + history: about 3.9 GB
+```
+
+The following unresolved accumulation risks were found.
+
+### Damoa WAL growth
+
+The `damoa` archive occupied about 187 GB and was growing by approximately
+37-60 GB per day. PostgreSQL reported about 909 GB of WAL generated since the
+statistics reset on 2026-08-24. This was real WAL, not duplicate archive files.
+
+The write workload repeatedly updates or replaces large portions of several
+catalog tables. PostgreSQL was also configured with `max_wal_size=1GB`,
+`checkpoint_timeout=5min`, `wal_compression=off`, and had 1,746 requested
+checkpoints during the sampled period. Full-page images therefore account for
+a significant part of the WAL volume.
+
+The `.110` data directory also retained about 32.6 GB in `pg_wal` because
+`wal_keep_size=32GB`, even though no replication slot or live standby existed.
+
+### Stale bind-mounted pgBackRest configuration
+
+The host path `/opt/appback/pgbackrest/config/pgbackrest.conf` had already been
+replaced with the Damoa-only retention policy, but `damoa-db` still had the old
+unlinked inode bind-mounted. The running container therefore continued to use:
+
+```text
+repo1-retention-full=4
+repo1-retention-diff=14
+archive-async=y
+```
+
+instead of the host file's intended `full=1`, `diff=6`, explicit archive
+retention, and Damoa-only stanza. Replacing a bind-mounted file atomically does
+not update the inode already mounted into a running container. The database
+container must be recreated or the mounted inode must otherwise be updated and
+verified before relying on the new policy.
+
+At the observed WAL rate, the `.40` internal disk's approximately 119 GB free
+space may be exhausted before the next weekly full backup. A successful new
+full backup will not expire the old chain while the running container still
+uses retention count 4.
+
+### Backups without bounded retention
+
+- `.40` `appback-minio/history` had seven daily change sets but no explicit
+  age/count cleanup in the backup script or user cron.
+- `.111` retained about 18 GB of Damoa pre-migration dumps even though Damoa now
+  runs on `.110`.
+- `.111` retained about 3.6 GB of deployment rollback dumps and about 995 MB of
+  legacy Title Clash originals without a general retention job.
+- `.40` retained about 3.2 GB under `usb-enclosure-safety-copy`. Keep it until
+  the old 4 TB MinIO disk is mounted read-only and verified, then reassess it.
+- `.40` RemoteAgent workspaces consumed about 21 GB. The two large workspaces
+  were still referenced by sessions, so they were not orphans and must not be
+  removed automatically.
+
+### Required correction order
+
+1. Make the running `damoa-db` consume the current pgBackRest configuration and
+   verify the effective settings from inside the container.
+2. Run and verify a new Damoa full backup, then confirm expiration reclaimed the
+   previous backup chain and its WAL.
+3. Add disk thresholds and projected-days-to-full monitoring for the `.40`
+   repository.
+4. Reduce Damoa WAL at the source by reviewing the catalog synchronization
+   write pattern and PostgreSQL checkpoint/WAL settings.
+5. Reduce `wal_keep_size` while no streaming standby exists; select a new value
+   as part of standby deployment rather than retaining an unused 32 GB.
+6. Add explicit retention to MinIO history and deployment rollback dumps.
+7. Remove `.111` Damoa migration dumps only after the `.110` restore path is
+   independently verified.
+
+## Corrections Applied: 2026-08-27
+
+The accumulation incident was corrected in the following order.
+
+1. Recreated only `damoa-db` so its bind-mounted pgBackRest configuration uses
+   the current host file. The effective container configuration is now strict
+   SFTP host-key verification with SHA-256, `full=1`, `diff=6`, `archive=1`,
+   and synchronous archive submission.
+2. Added all verified `.40` SSH host keys to the pinned `known_hosts` file and
+   proved a strict pgBackRest repository connection before running a backup.
+3. Created and verified full backup `20260827-043735F`. Expiration removed the
+   superseded Damoa backup chain and its WAL. The `.40` pgBackRest repository
+   fell from about 229 GB to 18 GB, and root filesystem use fell from 74% to
+   26%.
+4. Applied these reloadable Damoa PostgreSQL settings:
+
+   ```text
+   wal_keep_size=1GB
+   wal_compression=pglz
+   max_wal_size=8GB
+   checkpoint_timeout=15min
+   ```
+
+   A PostgreSQL checkpoint then reduced `.110` `pg_wal` from about 32.6 GB to
+   about 2 GB. No WAL file was deleted manually. The `.110` root filesystem is
+   now 13% used.
+5. Repaired the isolated Damoa restore verifier and completed an actual
+   restore, WAL replay, read-only query, and shutdown test for the new full
+   backup. The verified database system ID was `7666642961956692002`.
+6. Removed 18 GB of obsolete pre-migration Damoa dumps from `.111` after the
+   restore test passed. Also removed about 1.5 GB of deployment rollback
+   entries older than 35 days. The `.111` root filesystem fell from 64% to 57%
+   used.
+7. Installed bounded 35-day cleanup jobs for `.111` deployment rollback
+   entries and `.40` Damoa media and Appback MinIO history. The shared cleanup
+   command is dry-run by default, only considers immediate children of an
+   explicitly supplied root, and requires `--apply` before deletion.
+
+Continuous Damoa WAL archiving was observed advancing after the backup and
+expiration. The active pgBackRest stanza set remains exactly `damoa`, `hub111`,
+`tc111`, `pc111`, and `cc111`.
+
+The database tuning mitigates storage growth but does not remove its source.
+Damoa catalog synchronization still performs unusually high update/replace
+volume across campaign route, media, coordinate, and source tables. That
+application write amplification requires a separate code and query review.
+
+The following data was intentionally retained:
+
+- `.111` legacy Title Clash originals, about 995 MB, until ownership and
+  duplication are independently verified.
+- `.40` `usb-enclosure-safety-copy`, about 3.2 GB, until the preserved 4 TB
+  MinIO disk is mounted read-only and compared.
+- `.40` RemoteAgent workspaces referenced by active session state. They are not
+  orphan workspaces and must not be deleted by a backup cleanup job.
+
+## Important Limitation
+
+The pgBackRest repository is recovery material, not a queryable standby. A
+PostgreSQL process cannot serve reads directly from the repository. Read-only
+outage service requires five restored PostgreSQL instances on `.40` that keep
+replaying WAL.
+
+## Target Layout on `.40`
+
+Use one PostgreSQL 15 standby per source database. Assign separate ports and
+data directories. Keep the application-facing endpoints separate:
+
+```text
+write endpoint -> primary only (.110 or .111)
+read endpoint  -> primary normally, .40 standby during an outage
+```
+
+Standby requirements:
+
+- `hot_standby=on`
+- recovery remains active
+- no promotion trigger and no automatic failover manager
+- application credentials on `.40` receive read-only privileges
+- network rules allow application reads but block unintended administrative
+  writes
+- monitoring checks replay delay, receive/replay LSN, last replay time, disk
+  space, and restore errors
+
+Recommended replication method:
+
+1. Bootstrap each standby from its pgBackRest backup.
+2. Use asynchronous physical streaming replication from the primary.
+3. Keep pgBackRest WAL restore configured as a gap-recovery fallback.
+4. If streaming is interrupted, continue replaying archived WAL when available.
+
+## Dual-Bay Allocation
+
+The dual-bay enclosure currently attached to `.40` contains:
+
+| Device | Size | Label | Current state |
+|---|---:|---|---|
+| Toshiba | 4 TB | `MINIO4T` | unmounted, preserves the previous MinIO data |
+| WDC | 2 TB | `STORAGE2T` | unmounted |
+
+Recommended allocation after data validation:
+
+- 2 TB: PostgreSQL standby data directories for all five databases.
+- 4 TB: pgBackRest repository and MinIO read-only replica data.
+
+The five PostgreSQL datasets currently total well below 200 GB, so the 2 TB
+disk has ample capacity. The two disks share one USB bridge and power source;
+they are not independent backup copies. The writable primaries on `.110` and
+`.111` remain the independent source copies.
+
+Do not reformat or repurpose the 4 TB disk until its old MinIO data has been
+mounted read-only, inventoried, and compared with the active `.110` MinIO.
+
+## Implementation Order
+
+1. Mount the 4 TB disk read-only on `.40` and verify the preserved MinIO data.
+2. Mount and endurance-test the 2 TB disk, then create standby data paths.
+3. Move the pgBackRest repository to the 4 TB disk with a verified maintenance
+   window, preserving the existing repository path with a bind mount.
+4. Bootstrap one low-risk standby first, recommended `pc111`.
+5. Verify read-only SQL, WAL replay, reconnect, restart, and primary recovery.
+6. Repeat for `tc111`, `hub111`, `cc111`, then `damoa`.
+7. Add separate read endpoints and prove that writes to `.40` fail.
+8. Test a primary outage without promoting `.40`, then restore the primary and
+   verify replication resumes.
+9. Add monitoring and a periodic restore/read test. A backup is not considered
+   verified solely because archive files exist.
+
+## Service Continuity Boundary
+
+A read-only database does not keep an application available if the application
+server itself is down. In particular, a complete `.110` outage also removes the
+Damoa API unless a read-only application instance exists on another host. The
+same rule applies to services hosted on `.111`.
+
+MinIO follows the same policy independently:
+
+- writes go only to `.110`
+- `.110` replicates one way to an independent `.40` MinIO
+- `.40` uses read-only application credentials
+- `.40` is not written to during a `.110` outage
+
+## Container DNS Continuity
+
+Recreating MinIO may assign it a different Docker network address. A healthy
+MinIO container and a healthy edge container do not prove that the edge is
+using the current address: an Nginx worker can retain the address resolved when
+it started and continue returning 502 for uncached objects.
+
+The `.110` edge configuration therefore uses Docker DNS `127.0.0.11` with
+bounded re-resolution for both application upstreams:
+
+```nginx
+resolver 127.0.0.11 valid=10s ipv6=off;
+
+upstream damoa_api_upstream {
+    zone damoa_api_upstream 64k;
+    server damoa-api:3100 resolve;
+}
+
+upstream damoa_media_upstream {
+    zone damoa_media_upstream 64k;
+    server appback-minio:9000 resolve;
+}
+```
+
+`/home/appback/deploy/damoa/media-edge.conf` is mounted read-only at
+`/etc/nginx/conf.d/default.conf`. After recreating either MinIO or the Damoa
+API, validation must request at least one known uncached media object through
+the edge and confirm a 200 response. Container health checks alone are not an
+acceptable continuity test.
+
+## Validation Evidence Required
+
+For every standby:
+
+```text
+pg_is_in_recovery() = true
+transaction_read_only = on for application access
+receive/replay LSN is advancing
+replay delay is within the accepted limit
+write test fails
+read query succeeds
+restart preserves recovery mode
+primary outage read test succeeds
+primary recovery resumes replication without reverse sync
+```

package/docs/OPERATIONS.md

@@ -66,7 +66,7 @@ Current policy:
 
 ## Runtime model
 
-Server 30 runs RemoteAgent as a `systemd` service.
+Servers 30 and 40 run RemoteAgent as a `systemd` service.
 
 - unit: `remoteagent.service`
 - working directory: the installed `appback-remoteagent` package root
@@ -76,6 +76,12 @@ Server 30 runs RemoteAgent as a `systemd` service.
 The service environment is loaded from:
 
 - `/home/au2223/.remoteagent/.env`
+- `/home/appback/.remoteagent/.env` on server 40
+
+Server 40 uses the global npm package under Node.js `v22.23.2`. Its unit has
+`Restart=always`, so a transient disk or process failure is recovered without
+waiting for a manual Telegram health check. Deployment restarts this unit with
+the `SUDO_APPBACK_33_40` RemoteAgent secret and never prints the secret value.
 
 ## Single-instance rule
 

package/docs/RELEASING.md

@@ -114,8 +114,10 @@ npm run release:deploy -- 0.15.5 all
 The deploy script performs:
 
 - npm registry version check for `appback-remoteagent@<version>`
+- bounded retry when a target server's npm registry edge has not received the new version yet
+- fail-fast validation for a broken or non-directory `~/.npm` cache path before remote installation
 - server 30 npm install, install hook, systemd restart, version/log verification
-- server 40 npm install, install hook, user-process restart, version/log verification
+- server 40 npm install, install hook, systemd restart using `SUDO_APPBACK_33_40`, version/log verification
 - server 26 npm install, install hook, user-process restart, version/log verification
 
 ## 6. Verify
@@ -153,7 +155,10 @@ Server 40:
 ssh appback@192.168.33.40 'bash -lc '"'"'
 export PATH="$HOME/.local/bin:$HOME/.nvm/versions/node/v22.23.2/bin:$PATH"
 npm list -g appback-remoteagent --depth=0
-pgrep -af "appback-remoteagent/dist/index.js"
+systemctl is-enabled remoteagent
+systemctl is-active remoteagent
+systemctl show remoteagent -p MainPID -p NRestarts
+systemctl status remoteagent --no-pager -n 20
 tail -80 ~/.remoteagent/logs/agent.log
 '"'"''
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "appback-remoteagent",
-  "version": "0.22.2",
+  "version": "0.23.0",
   "description": "Personal installable session server for continuing local AI work across PC and Telegram",
   "license": "MIT",
   "type": "module",

package/scripts/cleanup-aged-backup-entries.sh

@@ -0,0 +1,80 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+usage() {
+  cat <<'EOF'
+Usage:
+  cleanup-aged-backup-entries.sh --root <absolute-directory> --days <count> [--apply]
+
+Without --apply, matching entries are printed but not removed. Only immediate
+children of --root are considered.
+EOF
+}
+
+root=""
+days=""
+apply=false
+
+while (($# > 0)); do
+  case "$1" in
+    --root)
+      [[ $# -ge 2 ]] || { usage >&2; exit 2; }
+      root="$2"
+      shift 2
+      ;;
+    --days)
+      [[ $# -ge 2 ]] || { usage >&2; exit 2; }
+      days="$2"
+      shift 2
+      ;;
+    --apply)
+      apply=true
+      shift
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      usage >&2
+      exit 2
+      ;;
+  esac
+done
+
+[[ "$root" == /* && "$root" != "/" ]] || {
+  printf 'cleanup_refused reason=invalid_root root=%q\n' "$root" >&2
+  exit 2
+}
+[[ "$days" =~ ^[1-9][0-9]*$ ]] || {
+  printf 'cleanup_refused reason=invalid_days days=%q\n' "$days" >&2
+  exit 2
+}
+[[ -d "$root" && ! -L "$root" ]] || {
+  printf 'cleanup_refused reason=root_not_directory root=%q\n' "$root" >&2
+  exit 2
+}
+
+root="$(realpath -e -- "$root")"
+removed=0
+matched=0
+
+while IFS= read -r -d '' candidate; do
+  candidate="$(realpath -m -- "$candidate")"
+  [[ "$(dirname -- "$candidate")" == "$root" && "$candidate" != "$root" ]] || {
+    printf 'cleanup_refused reason=candidate_outside_root candidate=%q\n' "$candidate" >&2
+    exit 1
+  }
+
+  matched=$((matched + 1))
+  if [[ "$apply" == true ]]; then
+    rm -rf --one-file-system -- "$candidate"
+    removed=$((removed + 1))
+    printf 'cleanup_removed path=%q\n' "$candidate"
+  else
+    printf 'cleanup_candidate path=%q\n' "$candidate"
+  fi
+done < <(find "$root" -mindepth 1 -maxdepth 1 -mtime "+$days" -print0)
+
+printf 'cleanup_complete root=%q days=%s apply=%s matched=%s removed=%s\n' \
+  "$root" "$days" "$apply" "$matched" "$removed"

package/scripts/release-deploy.sh

@@ -39,6 +39,14 @@ deploy_30() {
   ssh au2223@192.168.33.30 "VERSION=$VERSION bash -s" <<'REMOTE'
 set -euo pipefail
 export PATH="/home/au2223/.local/bin:/home/au2223/.nvm/versions/node/v22.22.0/bin:$PATH"
+if [[ -L "$HOME/.npm" && ! -e "$HOME/.npm" ]]; then
+  echo "Broken npm cache symlink: $HOME/.npm -> $(readlink "$HOME/.npm")" >&2
+  exit 1
+fi
+if [[ -e "$HOME/.npm" && ! -d "$HOME/.npm" ]]; then
+  echo "npm cache path is not a directory: $HOME/.npm" >&2
+  exit 1
+fi
 node - <<'NODE'
 const fs = require("fs");
 const path = "/home/au2223/.remoteagent/bot-polling-state.json";
@@ -52,7 +60,17 @@ if (running.length > 0) {
   process.exit(2);
 }
 NODE
-npm install -g "appback-remoteagent@$VERSION"
+for ATTEMPT in {1..12}; do
+  if npm install -g "appback-remoteagent@$VERSION"; then
+    break
+  fi
+  if [[ "$ATTEMPT" -eq 12 ]]; then
+    echo "Remote npm install failed after $ATTEMPT attempts." >&2
+    exit 1
+  fi
+  echo "Remote npm registry has not propagated yet; retrying in 5s ($ATTEMPT/12)."
+  sleep 5
+done
 remoteagent-install
 sudo -n systemctl restart remoteagent
 sleep 5
@@ -66,6 +84,14 @@ deploy_26() {
   ssh ospadmin@192.168.33.26 "VERSION=$VERSION bash -s" <<'REMOTE'
 set -euo pipefail
 export PATH="$HOME/.local/bin:$PATH"
+if [[ -L "$HOME/.npm" && ! -e "$HOME/.npm" ]]; then
+  echo "Broken npm cache symlink: $HOME/.npm -> $(readlink "$HOME/.npm")" >&2
+  exit 1
+fi
+if [[ -e "$HOME/.npm" && ! -d "$HOME/.npm" ]]; then
+  echo "npm cache path is not a directory: $HOME/.npm" >&2
+  exit 1
+fi
 node - <<'NODE'
 const fs = require("fs");
 const path = `${process.env.HOME}/.remoteagent/bot-polling-state.json`;
@@ -81,7 +107,17 @@ if (fs.existsSync(path)) {
   }
 }
 NODE
-npm install -g "appback-remoteagent@$VERSION"
+for ATTEMPT in {1..12}; do
+  if npm install -g "appback-remoteagent@$VERSION"; then
+    break
+  fi
+  if [[ "$ATTEMPT" -eq 12 ]]; then
+    echo "Remote npm install failed after $ATTEMPT attempts." >&2
+    exit 1
+  fi
+  echo "Remote npm registry has not propagated yet; retrying in 5s ($ATTEMPT/12)."
+  sleep 5
+done
 remoteagent-install
 ~/.remoteagent/stop-remoteagent.sh || true
 sleep 2
@@ -97,6 +133,14 @@ deploy_40() {
   ssh appback@192.168.33.40 "VERSION=$VERSION bash -s" <<'REMOTE'
 set -euo pipefail
 export PATH="$HOME/.local/bin:$HOME/.nvm/versions/node/v22.23.2/bin:$PATH"
+if [[ -L "$HOME/.npm" && ! -e "$HOME/.npm" ]]; then
+  echo "Broken npm cache symlink: $HOME/.npm -> $(readlink "$HOME/.npm")" >&2
+  exit 1
+fi
+if [[ -e "$HOME/.npm" && ! -d "$HOME/.npm" ]]; then
+  echo "npm cache path is not a directory: $HOME/.npm" >&2
+  exit 1
+fi
 node - <<'NODE'
 const fs = require("fs");
 const path = `${process.env.HOME}/.remoteagent/bot-polling-state.json`;
@@ -112,15 +156,39 @@ if (fs.existsSync(path)) {
   }
 }
 NODE
-npm install -g "appback-remoteagent@$VERSION"
+for ATTEMPT in {1..12}; do
+  if npm install -g "appback-remoteagent@$VERSION"; then
+    break
+  fi
+  if [[ "$ATTEMPT" -eq 12 ]]; then
+    echo "Remote npm install failed after $ATTEMPT attempts." >&2
+    exit 1
+  fi
+  echo "Remote npm registry has not propagated yet; retrying in 5s ($ATTEMPT/12)."
+  sleep 5
+done
 remoteagent-install
-~/.remoteagent/stop-remoteagent.sh || true
-sleep 2
-~/.remoteagent/start-remoteagent.sh
-sleep 5
+if systemctl cat remoteagent >/dev/null 2>&1; then
+  HELPER="$HOME/.nvm/versions/node/v22.23.2/lib/node_modules/appback-remoteagent/dist/secret-helper.js"
+  SUDO_PASSWORD="$(node "$HELPER" get SUDO_APPBACK_33_40)"
+  printf '%s\n' "$SUDO_PASSWORD" | sudo -S -p '' systemctl restart remoteagent
+  unset SUDO_PASSWORD
+  sleep 7
+  systemctl is-active remoteagent
+else
+  ~/.remoteagent/stop-remoteagent.sh || true
+  sleep 2
+  ~/.remoteagent/start-remoteagent.sh
+  sleep 5
+fi
 npm list -g appback-remoteagent --depth=0
 pgrep -af 'appback-remoteagent/dist/index.js'
-tail -80 ~/.remoteagent/logs/agent.log
+if systemctl cat remoteagent >/dev/null 2>&1; then
+  systemctl status remoteagent --no-pager -n 20
+  tail -80 ~/.remoteagent/logs/agent.log
+else
+  tail -80 ~/.remoteagent/logs/agent.log
+fi
 REMOTE
 }
 

package/scripts/selftest-cli.mjs

@@ -7,6 +7,7 @@ import path from "node:path";
 import {
   fetchTelegramBotIdentity,
   registerTelegramBot,
+  removeTelegramBot,
   waitForTelegramOwner,
 } from "../dist/services/cli-config-service.js";
 import { buildProviderEnv, buildRuntimePath } from "../dist/adapters/runtime-env.js";
@@ -14,6 +15,7 @@ import { exportSecrets, importSecrets } from "../dist/services/secret-transfer-s
 
 const root = await fs.mkdtemp(path.join(os.tmpdir(), "remoteagent-cli-selftest-"));
 const sourceDataDir = path.join(root, "source");
+const sparseUsernameDataDir = path.join(root, "sparse-usernames");
 const targetDataDir = path.join(root, "target");
 const bundlePath = path.join(root, "transfer.ra-secrets");
 const selectedBundlePath = path.join(root, "selected-transfer.ra-secrets");
@@ -112,6 +114,55 @@ fi
   assert.doesNotMatch(envText, /your-telegram-bot-token/);
   assert.match(envText, /TELEGRAM_BOT_USERNAMES=first_remoteagent_bot,second_remoteagent_bot/);
 
+  const removedByUsername = await removeTelegramBot({
+    dataDir: sourceDataDir,
+    selector: "@second_remoteagent_bot",
+  });
+  assert.equal(removedByUsername.id, 100002);
+  assert.equal(removedByUsername.username, "second_remoteagent_bot");
+  assert.equal(removedByUsername.botCount, 1);
+  const envAfterUsernameRemoval = await fs.readFile(path.join(sourceDataDir, ".env"), "utf8");
+  assert.match(envAfterUsernameRemoval, /TELEGRAM_BOT_TOKEN=100001:abcdefghijklmnopqrstuvwxyz_123456/);
+  assert.match(envAfterUsernameRemoval, /TELEGRAM_BOT_TOKENS=100001:abcdefghijklmnopqrstuvwxyz_123456/);
+  assert.match(envAfterUsernameRemoval, /TELEGRAM_BOT_USERNAMES=first_remoteagent_bot/);
+  assert.doesNotMatch(envAfterUsernameRemoval, /second_remoteagent_bot/);
+
+  await assert.rejects(
+    removeTelegramBot({ dataDir: sourceDataDir, selector: "100001" }),
+    /Cannot remove the last configured bot/,
+  );
+  await assert.rejects(
+    removeTelegramBot({ dataDir: sourceDataDir, selector: "missing_bot" }),
+    /Telegram bot was not found/,
+  );
+
+  await registerTelegramBot({
+    dataDir: sourceDataDir,
+    token: "100002:abcdefghijklmnopqrstuvwxyz_654321",
+    ownerId: "8202993989",
+    identity: { id: 100002, username: "second_remoteagent_bot" },
+  });
+  const removedById = await removeTelegramBot({ dataDir: sourceDataDir, selector: "100001" });
+  assert.equal(removedById.username, "first_remoteagent_bot");
+  assert.equal(removedById.botCount, 1);
+
+  await fs.mkdir(sparseUsernameDataDir, { recursive: true });
+  await fs.writeFile(path.join(sparseUsernameDataDir, ".env"), [
+    "TELEGRAM_BOT_TOKEN=100001:abcdefghijklmnopqrstuvwxyz_123456",
+    "TELEGRAM_BOT_TOKENS=100001:abcdefghijklmnopqrstuvwxyz_123456,100002:abcdefghijklmnopqrstuvwxyz_654321",
+    "TELEGRAM_BOT_USERNAMES=,second_remoteagent_bot",
+    "TELEGRAM_OWNER_ID=8202993989",
+    "",
+  ].join("\n"), { mode: 0o600 });
+  const removedSparseUsername = await removeTelegramBot({
+    dataDir: sparseUsernameDataDir,
+    selector: "second_remoteagent_bot",
+  });
+  assert.equal(removedSparseUsername.id, 100002);
+  const sparseEnv = await fs.readFile(path.join(sparseUsernameDataDir, ".env"), "utf8");
+  assert.match(sparseEnv, /TELEGRAM_BOT_TOKENS=100001:abcdefghijklmnopqrstuvwxyz_123456/);
+  assert.doesNotMatch(sparseEnv, /100002:abcdefghijklmnopqrstuvwxyz_654321/);
+
   const sourceSecrets = {
     API_TOKEN: {
       key: "API_TOKEN",

package/scripts/selftest-telegram-update.mjs

@@ -556,6 +556,50 @@ await click(macroButton.callback_data);
 await send("/batch send");
 await waitForTelegramCall((call) => call.text.includes("mock provider completed"));
 
+const longTextProviderCallsBefore = providerCalls.length;
+const longPartOne = `LONG_PART_ONE:${"a".repeat(2200)}`;
+const longPartTwo = `LONG_PART_TWO:${"b".repeat(2200)}`;
+providerMode = "success";
+await send("/batch start");
+await send(longPartOne);
+await send(longPartTwo);
+await send("/batch send");
+await waitForTelegramCall((call) => call.text.includes("mock provider completed"));
+
+const longTextProviderCalls = providerCalls.slice(longTextProviderCallsBefore);
+if (longTextProviderCalls.length !== 1) {
+  throw new Error(`Split long Telegram input should make one provider call, got ${longTextProviderCalls.length}`);
+}
+const longTextProviderMessage = longTextProviderCalls[0]?.message ?? "";
+if (!longTextProviderMessage.includes("stored as a UTF-8 text file")) {
+  throw new Error(`Long Telegram input was not replaced with a file prompt: ${longTextProviderMessage}`);
+}
+if (longTextProviderMessage.includes(longPartOne) || longTextProviderMessage.includes(longPartTwo)) {
+  throw new Error("Long Telegram input was copied into the provider prompt instead of being file-backed");
+}
+const longTextFile = longTextProviderMessage.match(/^File: (.+\.txt)$/m)?.[1];
+if (!longTextFile) {
+  throw new Error(`Long Telegram input prompt did not include an absolute text file path: ${longTextProviderMessage}`);
+}
+const expectedLongTextDirectory = path.join(
+  dataDir,
+  "uploads",
+  "telegram",
+  "remoteagent_test_bot",
+  "111222333",
+);
+if (path.dirname(longTextFile) !== expectedLongTextDirectory) {
+  throw new Error(`Long Telegram input was stored outside the managed upload directory: ${longTextFile}`);
+}
+const storedLongText = await fs.readFile(longTextFile, "utf8");
+if (storedLongText !== `${longPartOne}\n${longPartTwo}`) {
+  throw new Error("Stored Telegram text did not preserve all batched message parts in order");
+}
+const longTextMode = (await fs.stat(longTextFile)).mode & 0o777;
+if (longTextMode !== 0o600) {
+  throw new Error(`Stored Telegram text permissions should be 0600, got ${longTextMode.toString(8)}`);
+}
+
 await fs.appendFile(path.join(dataDir, ".env"), [
   "TELEGRAM_BOT_TOKENS=000000:test-token",
   "TELEGRAM_BOT_USERNAMES=remoteagent_test_bot",
@@ -797,6 +841,7 @@ console.log(JSON.stringify({
   queueRemoveLatest: secondQueueId,
   timeoutFinalMessage: true,
   usageLimitFallback: true,
+  longTelegramTextStoredAsFile: true,
   telegramSendMessages: evidenceCalls.filter((call) => call.method === "sendMessage").length,
 }, null, 2));