switchroom 0.14.2 → 0.14.4

package/dist/cli/switchroom.js

@@ -30840,8 +30840,11 @@ function defaultStatBroker(p) {
   return { kind: "ok-with-stat", ino: inoStr, size };
 }
 function spawnDockerStat(p) {
+  return spawnDockerStatForContainer("switchroom-vault-broker", p);
+}
+function spawnDockerStatForContainer(containerName2, p) {
   try {
-    const stdout = execFileSync16("docker", ["exec", "switchroom-vault-broker", "stat", "-c", "%i %s", p], { stdio: ["ignore", "pipe", "pipe"], timeout: 3000, encoding: "utf8" });
+    const stdout = execFileSync16("docker", ["exec", containerName2, "stat", "-c", "%i %s", p], { stdio: ["ignore", "pipe", "pipe"], timeout: 3000, encoding: "utf8" });
     return { status: 0, stdout, stderr: "", error: null };
   } catch (err) {
     const e = err;
@@ -30933,9 +30936,80 @@ function runVaultBrokerDurabilityChecks(_config, opts) {
     probeMachineIdMount(),
     formatBindMountResult("vault-broker: vault.enc bind mount", join52(home2, ".switchroom", "vault", "vault.enc"), "/state/vault/vault.enc", probe2(join52(home2, ".switchroom", "vault", "vault.enc"), "/state/vault/vault.enc")),
     formatBindMountResult("vault-broker: vault-grants.db bind mount (#1737)", join52(home2, ".switchroom", "vault-grants.db"), "/root/.switchroom/vault-grants.db", probe2(join52(home2, ".switchroom", "vault-grants.db"), "/root/.switchroom/vault-grants.db")),
-    formatBindMountResult("vault-broker: vault-audit.log bind mount (#1025)", join52(home2, ".switchroom", "vault-audit.log"), "/root/.switchroom/vault-audit.log", probe2(join52(home2, ".switchroom", "vault-audit.log"), "/root/.switchroom/vault-audit.log"))
+    formatBindMountResult("vault-broker: vault-audit.log bind mount (#1025)", join52(home2, ".switchroom", "vault-audit.log"), "/root/.switchroom/vault-audit.log", probe2(join52(home2, ".switchroom", "vault-audit.log"), "/root/.switchroom/vault-audit.log")),
+    probeKernelDbDurability(home2, {
+      statBroker: opts?.kernelStatBroker
+    })
   ];
 }
+function probeKernelDbDurability(home2, opts) {
+  const hostDir = join52(home2, ".switchroom", "approvals");
+  const containerDir = "/state/approvals";
+  const name = "approval-kernel: approvals bind mount (allow_always durability)";
+  const kernelStat = opts?.statBroker ?? defaultKernelStatBroker;
+  const result = probeBindMountInode(hostDir, containerDir, {
+    statBroker: kernelStat,
+    statHost: opts?.statHost
+  });
+  if (result.kind === "ok") {
+    return {
+      name,
+      status: "ok",
+      detail: `${hostDir} == ${containerDir} (same inode) \u2014 allow_always decisions persist across kernel recreate`
+    };
+  }
+  if (result.kind === "host-missing") {
+    return {
+      name,
+      status: "warn",
+      detail: `host directory ${hostDir} missing \u2014 \`switchroom apply\` pre-creates it on greenfield`,
+      fix: "Run `switchroom apply` to pre-create the host approvals directory"
+    };
+  }
+  if (result.kind === "broker-unreachable") {
+    return {
+      name,
+      status: "skip",
+      detail: "approval-kernel container unreachable \u2014 bind mount unverified"
+    };
+  }
+  if (result.kind === "broker-stat-failed") {
+    return {
+      name,
+      status: "warn",
+      detail: `approval-kernel stat failed: ${result.msg}`
+    };
+  }
+  return {
+    name,
+    status: "fail",
+    detail: `inode mismatch \u2014 approval-kernel \`/state/approvals\` is NOT backed by the host bind mount. ` + `host inode=${result.hostInode} size=${result.hostSize}; ` + `kernel inode=${result.brokerInode} size=${result.brokerSize}. ` + `The kernel is writing kernel.db to an ephemeral container-local directory; ` + `all allow_always decisions are lost on every container recreate (e.g. after \`switchroom update\`).`,
+    fix: "Run `switchroom apply` to regenerate compose with the " + "`~/.switchroom/approvals:/state/approvals` bind mount, then " + "`docker compose -p switchroom up -d approval-kernel` to recreate the kernel container."
+  };
+}
+function defaultKernelStatBroker(p) {
+  const r = spawnDockerStatForContainer("switchroom-approval-kernel", p);
+  if (r.error || r.status === null)
+    return { kind: "broker-unreachable" };
+  if (r.status !== 0) {
+    if (r.status >= 125)
+      return { kind: "broker-unreachable" };
+    return {
+      kind: "broker-stat-failed",
+      msg: r.stderr?.trim() || `exit ${r.status}`
+    };
+  }
+  const out = r.stdout.trim();
+  const [inoStr, sizeStr] = out.split(/\s+/);
+  const size = Number(sizeStr);
+  if (!inoStr || !Number.isFinite(size)) {
+    return {
+      kind: "broker-stat-failed",
+      msg: `unparseable stat output: ${out}`
+    };
+  }
+  return { kind: "ok-with-stat", ino: inoStr, size };
+}
 function probeAutoUnlockBlob(home2) {
   const blobPath = join52(home2, ".switchroom", "vault-auto-unlock");
   if (!existsSync52(blobPath)) {
@@ -49278,8 +49352,8 @@ var {
 } = import__.default;
 
 // src/build-info.ts
-var VERSION = "0.14.2";
-var COMMIT_SHA = "3c7d0238";
+var VERSION = "0.14.4";
+var COMMIT_SHA = "a9f2d29a";
 
 // src/cli/agent.ts
 init_source();
@@ -51763,7 +51837,9 @@ function buildSettingsHooksBlock(p) {
 ` + `So:
 ` + "  - Trivial / social message \u2192 reply once, briefly, in your voice. " + `The reply IS the response.
 ` + `  - Question with a short answer \u2192 just reply with the answer.
-` + "  - Complex tool-driven work \u2192 go straight to the tools (the " + "compose-area preview is the ambient liveness signal), then reply " + 'once with the answer or a genuine mid-work pivot ("halfway ' + 'through \u2014 found an unexpected issue, want me to continue?"). Not ' + '"still working".</turn-pacing>';
+` + "  - Complex tool-driven work \u2192 go straight to the tools (the " + "compose-area preview is the ambient liveness signal), then reply " + 'once with the answer or a genuine mid-work pivot ("halfway ' + 'through \u2014 found an unexpected issue, want me to continue?"). Not ' + `"still working".
+
+` + 'Do NOT send a trailing confirmation after your answer \u2014 no "Done.", ' + '"Sent.", "Hope that helps." as a separate message once you have ' + "already replied. Your answer is the last thing the user should " + `see; a follow-up "Done." is dead-air clutter (and the user's ` + "device already pinged on the answer). Stop after the answer.</turn-pacing>";
   const switchroomUserPromptSubmit = [
     ...useHotReloadStable ? [
       {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switchroom",
-  "version": "0.14.2",
+  "version": "0.14.4",
   "description": "Run Claude Code 24/7 on your Claude Pro/Max subscription over Telegram. Open-source alternative to OpenClaw and NanoClaw — no API keys.",
   "type": "module",
   "bin": {

package/telegram-plugin/dist/bridge/bridge.js

@@ -23041,6 +23041,7 @@ import { join as join2 } from "node:path";
 function createToolLabelSidecar(opts) {
   const path = join2(opts.stateDir, `tool-labels-${opts.sessionId}.jsonl`);
   const labels = new Map;
+  const seen = [];
   const subscribers = new Set;
   let offset = 0;
   let stopped = false;
@@ -23063,14 +23064,15 @@ function createToolLabelSidecar(opts) {
       } catch {
         continue;
       }
-      if (!row || typeof row.tool_use_id !== "string" || typeof row.label !== "string")
+      if (!row || typeof row.tool_use_id !== "string" || typeof row.label !== "string" || typeof row.tool_name !== "string")
         continue;
       if (labels.has(row.tool_use_id))
         continue;
       labels.set(row.tool_use_id, row.label);
+      seen.push({ toolUseId: row.tool_use_id, label: row.label, toolName: row.tool_name });
       for (const cb of subscribers) {
         try {
-          cb(row.tool_use_id, row.label);
+          cb(row.tool_use_id, row.label, row.tool_name);
         } catch {}
       }
     }
@@ -23109,6 +23111,11 @@ function createToolLabelSidecar(opts) {
       return labels.get(toolUseId);
     },
     onLabel(cb) {
+      for (const r of seen) {
+        try {
+          cb(r.toolUseId, r.label, r.toolName);
+        } catch {}
+      }
       subscribers.add(cb);
       return () => subscribers.delete(cb);
     },
@@ -23441,6 +23448,9 @@ function startSessionTail(config2) {
     try {
       const s = createToolLabelSidecar({ stateDir: stateDirForSidecar, sessionId });
       sidecars.set(sessionId, s);
+      s.onLabel((toolUseId, label, toolName) => {
+        rawOnEvent({ kind: "tool_label", toolUseId, label, toolName });
+      });
       return s;
     } catch (err) {
       log?.(`session-tail: sidecar create failed: ${err.message}`);
@@ -23554,6 +23564,9 @@ function startSessionTail(config2) {
       }
       log?.(`session-tail: attached to ${file} (cursor=${cursor})`);
     }
+    const attachSid = sessionIdForFile(file);
+    if (attachSid)
+      ensureSidecar(attachSid);
     try {
       watcher = watch(file, () => readNew());
     } catch (err) {

package/telegram-plugin/dist/gateway/gateway.js

@@ -31866,121 +31866,7 @@ function registerAndRender(state, toolName) {
     return null;
   return formatSummary(state);
 }
-function baseName(p) {
-  if (typeof p !== "string" || p.length === 0)
-    return null;
-  const parts = p.split("/").filter(Boolean);
-  return parts.length > 0 ? parts[parts.length - 1] : p;
-}
-function hostName(u) {
-  if (typeof u !== "string" || u.length === 0)
-    return null;
-  try {
-    return new URL(u).hostname.replace(/^www\./, "");
-  } catch {
-    return u.replace(/^https?:\/\//, "").split("/")[0] || null;
-  }
-}
-function clip(s, n) {
-  if (typeof s !== "string")
-    return null;
-  const t = s.trim();
-  if (t.length === 0)
-    return null;
-  return t.length > n ? t.slice(0, n - 1) + "\u2026" : t;
-}
-function describeToolUse(toolName, input) {
-  if (!toolName)
-    return null;
-  const inp = input ?? {};
-  const mcpMatch = /^mcp__(.+?)__(.+)$/.exec(toolName);
-  if (mcpMatch) {
-    const server = mcpMatch[1].toLowerCase();
-    const tool = mcpMatch[2].toLowerCase();
-    if (server === "switchroom-telegram")
-      return null;
-    if (server === "hindsight") {
-      if (tool === "recall" || tool === "reflect")
-        return "Searching memory";
-      if (tool === "retain" || tool === "update_memory" || tool === "sync_retain")
-        return "Saving to memory";
-      return "Working with memory";
-    }
-    if (server === "google-workspace" || server === "claude_ai_google_calendar") {
-      return "Checking your calendar";
-    }
-    if (server === "claude_ai_gmail")
-      return "Checking your email";
-    if (server === "claude_ai_google_drive")
-      return "Looking through your files";
-    if (server === "notion" || server === "claude_ai_notion") {
-      return "Checking your notes";
-    }
-    const desc = clip(inp.description, 60) ?? clip(inp.query, 50) ?? clip(inp.title, 50);
-    if (desc)
-      return desc;
-    return "Using " + tool.replace(/[-_]+/g, " ");
-  }
-  switch (toolName) {
-    case "Bash": {
-      return clip(inp.description, 70) ?? "Running a command";
-    }
-    case "BashOutput":
-    case "KillShell":
-      return "Managing a background command";
-    case "Read": {
-      const f = baseName(inp.file_path);
-      return f ? `Reading ${f}` : "Reading a file";
-    }
-    case "Edit":
-    case "MultiEdit":
-    case "NotebookEdit": {
-      const f = baseName(inp.file_path) ?? baseName(inp.notebook_path);
-      return f ? `Editing ${f}` : "Editing a file";
-    }
-    case "Write": {
-      const f = baseName(inp.file_path);
-      return f ? `Writing ${f}` : "Writing a file";
-    }
-    case "Grep":
-    case "Glob": {
-      const p = clip(inp.pattern, 40);
-      return p ? `Searching for ${p}` : "Searching files";
-    }
-    case "WebFetch": {
-      const h = hostName(inp.url);
-      return h ? `Reading ${h}` : "Reading a web page";
-    }
-    case "WebSearch": {
-      const q = clip(inp.query, 50);
-      return q ? `Searching the web for ${q}` : "Searching the web";
-    }
-    case "Task":
-    case "Agent": {
-      const d = clip(inp.description, 60);
-      return d ? `Delegating: ${d}` : "Delegating to a sub-agent";
-    }
-    case "TodoWrite":
-    case "TaskCreate":
-    case "TaskUpdate":
-    case "TaskList":
-      return "Updating the plan";
-    case "ToolSearch":
-      return "Finding the right tool";
-    default:
-      return "Working\u2026";
-  }
-}
 var MIRROR_MAX_LINES = 6;
-function appendActivityLine(lines, toolName, input) {
-  const line = describeToolUse(toolName, input);
-  if (line == null)
-    return null;
-  if (lines.length === 0 || lines[lines.length - 1] !== line) {
-    lines.push(line);
-  }
-  return renderActivityFeed(lines);
-}
 function renderActivityFeed(lines) {
   if (lines.length === 0)
     return null;
@@ -31991,6 +31877,15 @@ function renderActivityFeed(lines) {
   return hidden > 0 ? `\u00b7 +${hidden} earlier\u2026
 ${body}` : body;
 }
+function appendActivityLabel(lines, label) {
+  const l = (label ?? "").trim();
+  if (l.length === 0)
+    return null;
+  if (lines.length === 0 || lines[lines.length - 1] !== l) {
+    lines.push(l);
+  }
+  return renderActivityFeed(lines);
+}
 
 // tool-labels.ts
 var MAX_LABEL_CHARS = 60;
@@ -46282,6 +46177,13 @@ function transition(state3, event) {
 // gateway/inbound-delivery-machine-shadow.ts
 var state3 = initialState();
 var enabled5 = process.env.SWITCHROOM_DELIVERY_MACHINE_SHADOW !== "0";
+var cutoverEnabled = enabled5 && process.env.SWITCHROOM_DELIVERY_MACHINE_CUTOVER !== "0";
+function isDeliveryCutoverEnabled() {
+  return cutoverEnabled;
+}
+function isMachineInTurn() {
+  return state3.global.kind === "bridge_alive_in_turn";
+}
 function shadowEmit(event) {
   if (!enabled5)
     return [];
@@ -49843,6 +49745,9 @@ function skillBasenameFromPath2(input) {
   const trimmed = path.replace(/\/SKILL\.md$/i, "").replace(/\/$/, "");
   return basename6(trimmed) || null;
 }
+function isRulePersisted(resolvedAllow, ruleRule) {
+  return resolvedAllow.includes(ruleRule);
+}
 
 // credits-watch.ts
 import { readFileSync as readFileSync29, writeFileSync as writeFileSync18, existsSync as existsSync30, mkdirSync as mkdirSync16 } from "fs";
@@ -50163,11 +50068,11 @@ function sweepStaleTurnActiveMarker(stateDir, opts) {
 }
 
 // ../src/build-info.ts
-var VERSION = "0.14.2";
-var COMMIT_SHA = "3c7d0238";
-var COMMIT_DATE = "2026-05-28T07:47:55Z";
-var LATEST_PR = 1958;
-var COMMITS_AHEAD_OF_TAG = 0;
+var VERSION = "0.14.4";
+var COMMIT_SHA = "a9f2d29a";
+var COMMIT_DATE = "2026-05-28T20:55:22+10:00";
+var LATEST_PR = null;
+var COMMITS_AHEAD_OF_TAG = 5;
 
 // gateway/boot-version.ts
 function formatRelativeAgo(iso) {
@@ -51091,6 +50996,9 @@ function markClaudeBusyForInbound(m) {
   }
   claudeBusyKeys.add(chatKey2(m.chatId, tid));
 }
+function turnInFlightForGate() {
+  return isDeliveryCutoverEnabled() ? isMachineInTurn() : claudeBusyKeys.size > 0;
+}
 var pendingRestarts = new Map;
 var lastSessionActiveFile = null;
 var compactState = initialCompactState();
@@ -51156,7 +51064,7 @@ function purgeReactionTracking(key, endingTurn) {
     if (agentDir != null)
       removeActiveReaction(agentDir, msgInfo.chatId, msgInfo.messageId);
   }
-  if (claudeBusyKeys.size === 0) {
+  if (!turnInFlightForGate()) {
     const selfAgentForFlush = process.env.SWITCHROOM_AGENT_NAME ?? "";
     if (pendingInboundBuffer.depth(selfAgentForFlush) > 0) {
       const fr = redeliverBufferedInbound(pendingInboundBuffer, selfAgentForFlush, (m) => {
@@ -51186,7 +51094,7 @@ function releaseTurnBufferGate(key) {
   activeTurnStartedAt.delete(key);
   claudeBusyKeys.delete(key);
   shadowEmit({ kind: "turnEnd", key, at: Date.now(), outboundEmitted: true });
-  if (claudeBusyKeys.size === 0) {
+  if (!turnInFlightForGate()) {
     const selfAgentForFlush = process.env.SWITCHROOM_AGENT_NAME ?? "";
     if (pendingInboundBuffer.depth(selfAgentForFlush) > 0) {
       const fr = redeliverBufferedInbound(pendingInboundBuffer, selfAgentForFlush, (m) => {
@@ -52134,6 +52042,11 @@ startTimer({
 `);
   }
 });
+var DELIVERY_MACHINE_TICK_MS = 30000;
+var _deliveryMachineTick = setInterval(() => {
+  shadowEmit({ kind: "tick", now: Date.now() });
+}, DELIVERY_MACHINE_TICK_MS);
+_deliveryMachineTick.unref?.();
 startTimer2({
   editMessage: async (ctx) => {
     const editOpts = ctx.parseMode != null ? { parse_mode: ctx.parseMode } : undefined;
@@ -52435,7 +52348,7 @@ ${reminder}
   onHeartbeat(_client, _msg) {},
   onScheduleRestart(client3, msg) {
     const { agentName: agentName3 } = msg;
-    const turnInFlight = claudeBusyKeys.size > 0;
+    const turnInFlight = turnInFlightForGate();
     if (!turnInFlight) {
       try {
         client3.send({
@@ -52690,7 +52603,7 @@ if (!STATIC) {
   setInterval(() => {
     const selfAgent = process.env.SWITCHROOM_AGENT_NAME ?? "";
     const r = idleDrainTick(pendingInboundBuffer, selfAgent, () => {
-      if (claudeBusyKeys.size > 0)
+      if (turnInFlightForGate())
         return false;
       const c = ipcServer.getClient(selfAgent);
       return c != null && c.isAlive();
@@ -52971,6 +52884,7 @@ ${url}`;
   });
   noteOutbound(statusKey(chat_id, threadId), Date.now());
   noteOutbound2(statusKey(chat_id, threadId), Date.now());
+  shadowEmit({ kind: "modelOutbound", key: statusKey(chat_id, threadId), at: Date.now() });
   if (isFinalAnswerReply({ text: rawText, disableNotification })) {
     clearSilentEndState(statusKey(chat_id, threadId));
   }
@@ -53298,6 +53212,7 @@ async function executeStreamReply(args) {
       const sKey = statusKey(streamChatId, streamThreadId);
       noteOutbound(sKey, Date.now());
       noteOutbound2(sKey, Date.now());
+      shadowEmit({ kind: "modelOutbound", key: sKey, at: Date.now() });
       if (isFinalAnswerReply({
         text: args.text ?? "",
         disableNotification: args.disable_notification === true,
@@ -54248,6 +54163,11 @@ function handleSessionEvent(ev) {
           isDm: isDmChatId(ev.chatId)
         };
         currentTurn = next;
+        shadowEmit({
+          kind: "turnStart",
+          key: statusKey(ev.chatId, ev.threadId != null ? Number(ev.threadId) : undefined),
+          at: startedAt
+        });
         preambleSuppressor.reset();
         clearSilentEndState(statusKey(ev.chatId, ev.threadId != null ? Number(ev.threadId) : null));
         if (turnsDb != null) {
@@ -54309,12 +54229,12 @@ function handleSessionEvent(ev) {
           clearTimeout(turn.orphanedReplyTimeoutId);
           turn.orphanedReplyTimeoutId = null;
         }
-        if (wasFirstReply) {
+        if (wasFirstReply && !DRAFT_MIRROR_ENABLED) {
           clearActivitySummary(turn);
         }
       }
-      if (!turn.replyCalled && !isTelegramSurfaceTool(name)) {
-        const rendered = DRAFT_MIRROR_ENABLED ? appendActivityLine(turn.mirrorLines, name, ev.input) : registerAndRender(turn.toolActivity, name);
+      if (!DRAFT_MIRROR_ENABLED && !turn.replyCalled && !isTelegramSurfaceTool(name)) {
+        const rendered = registerAndRender(turn.toolActivity, name);
         if (rendered != null) {
           turn.activityPendingRender = rendered;
           if (turn.activityInFlight == null) {
@@ -54332,6 +54252,23 @@ function handleSessionEvent(ev) {
       }
       return;
     }
+    case "tool_label": {
+      if (!DRAFT_MIRROR_ENABLED)
+        return;
+      const turn = currentTurn;
+      if (turn == null)
+        return;
+      if (isTelegramSurfaceTool(ev.toolName))
+        return;
+      const rendered = appendActivityLabel(turn.mirrorLines, ev.label);
+      if (rendered != null) {
+        turn.activityPendingRender = rendered;
+        if (turn.activityInFlight == null) {
+          turn.activityInFlight = drainActivitySummary(turn);
+        }
+      }
+      return;
+    }
     case "text": {
       const turn = currentTurn;
       if (turn != null) {
@@ -54461,6 +54398,9 @@ function handleSessionEvent(ev) {
         clearTimeout(turn.orphanedReplyTimeoutId);
         turn.orphanedReplyTimeoutId = null;
       }
+      if (DRAFT_MIRROR_ENABLED && turn != null) {
+        clearActivitySummary(turn);
+      }
       preambleSuppressor.flushNow();
       let streamFinalizedAsAnswer = false;
       if (turn?.answerStream != null) {
@@ -55001,6 +54941,7 @@ async function handleInbound(ctx, text, downloadImage, attachment) {
   }
   const inboundReceivedAt = Date.now();
   const _shadowKey = statusKey(ctx.chat?.id != null ? String(ctx.chat.id) : "0", ctx.message?.message_thread_id);
+  const machineInTurnAtReceipt = isDeliveryCutoverEnabled() ? isMachineInTurn() : null;
   shadowEmit({
     kind: "inbound",
     key: _shadowKey,
@@ -55011,7 +54952,7 @@ async function handleInbound(ctx, text, downloadImage, attachment) {
     },
     at: Date.now()
   });
-  const turnInFlightAtReceipt = claudeBusyKeys.size > 0;
+  const turnInFlightAtReceipt = machineInTurnAtReceipt ?? claudeBusyKeys.size > 0;
   const access = result.access;
   const from = ctx.from;
   const chat_id = String(ctx.chat.id);
@@ -59096,20 +59037,44 @@ ${prettyInput}`;
       return;
     }
     let grantOk = false;
+    let grantFailReason = "";
     try {
       switchroomExec(["agent", "grant", agentName3, rule.rule, "--no-restart"]);
-      grantOk = true;
-      process.stderr.write(`telegram gateway: always-allow added rule="${rule.rule}" agent=${agentName3} (request_id=${request_id})
+      try {
+        const cfg = loadConfig2();
+        const rawAgent = cfg.agents?.[agentName3];
+        if (rawAgent) {
+          const resolved = resolveAgentConfig2(cfg.defaults, cfg.profiles, rawAgent);
+          const allowList = resolved.tools?.allow ?? [];
+          if (isRulePersisted(allowList, rule.rule)) {
+            grantOk = true;
+            process.stderr.write(`telegram gateway: always-allow added rule="${rule.rule}" agent=${agentName3} (request_id=${request_id})
+`);
+          } else {
+            grantFailReason = `rule "${rule.rule}" not found in resolved tools.allow after write \u2014 config location may have drifted`;
+            process.stderr.write(`telegram gateway: always-allow VERIFY FAILED: ${grantFailReason} (request_id=${request_id})
+`);
+          }
+        } else {
+          grantFailReason = `agent "${agentName3}" not found in config after write`;
+          process.stderr.write(`telegram gateway: always-allow VERIFY FAILED: ${grantFailReason} (request_id=${request_id})
 `);
+        }
+      } catch (verifyErr) {
+        grantFailReason = `config re-read failed: ${verifyErr.message}`;
+        process.stderr.write(`telegram gateway: always-allow VERIFY FAILED: ${grantFailReason} (request_id=${request_id})
+`);
+      }
     } catch (err) {
-      process.stderr.write(`telegram gateway: always-allow grant failed: ${err.message}
+      grantFailReason = err.message;
+      process.stderr.write(`telegram gateway: always-allow grant failed: ${grantFailReason}
 `);
     }
     pendingPermissions.delete(request_id);
-    const ackText = grantOk ? `\uD83D\uDD01 Always allow ${rule.label} for ${agentName3}` : `\u2705 Allowed (always-allow yaml edit failed; check gateway log)`;
+    const ackText = grantOk ? `\uD83D\uDD01 Always allow ${rule.label} for ${agentName3}` : `\u26A0\uFE0F Allowed for now, but "always" did NOT save \u2014 it will ask again after restart. Check gateway log.`;
     const sourceMsg = ctx.callbackQuery?.message;
     const baseText2 = sourceMsg && "text" in sourceMsg && sourceMsg.text ? escapeHtmlForTg(sourceMsg.text) : "";
-    const editLabel = grantOk ? `\uD83D\uDD01 <b>Always allow ${escapeHtmlForTg(rule.label)}</b> for ${escapeHtmlForTg(agentName3)} \u2014 restart agent for full effect` : `\u2705 <b>Allowed</b> (always-allow rule edit failed; see logs)`;
+    const editLabel = grantOk ? `\uD83D\uDD01 <b>Always allow ${escapeHtmlForTg(rule.label)}</b> for ${escapeHtmlForTg(agentName3)} \u2014 restart agent for full effect` : `\u26A0\uFE0F <b>Allowed for now \u2014 "always" did NOT save.</b> It will ask again after restart. Check gateway log.`;
     await finalizeCallback(ctx, {
       ackText: ackText.slice(0, 200),
       newText: baseText2 ? `${baseText2}

package/telegram-plugin/dist/server.js

@@ -17069,6 +17069,7 @@ import { join as join3 } from "node:path";
 function createToolLabelSidecar(opts) {
   const path = join3(opts.stateDir, `tool-labels-${opts.sessionId}.jsonl`);
   const labels = new Map;
+  const seen = [];
   const subscribers = new Set;
   let offset = 0;
   let stopped = false;
@@ -17091,14 +17092,15 @@ function createToolLabelSidecar(opts) {
       } catch {
         continue;
       }
-      if (!row || typeof row.tool_use_id !== "string" || typeof row.label !== "string")
+      if (!row || typeof row.tool_use_id !== "string" || typeof row.label !== "string" || typeof row.tool_name !== "string")
         continue;
       if (labels.has(row.tool_use_id))
         continue;
       labels.set(row.tool_use_id, row.label);
+      seen.push({ toolUseId: row.tool_use_id, label: row.label, toolName: row.tool_name });
       for (const cb of subscribers) {
         try {
-          cb(row.tool_use_id, row.label);
+          cb(row.tool_use_id, row.label, row.tool_name);
         } catch {}
       }
     }
@@ -17137,6 +17139,11 @@ function createToolLabelSidecar(opts) {
       return labels.get(toolUseId);
     },
     onLabel(cb) {
+      for (const r of seen) {
+        try {
+          cb(r.toolUseId, r.label, r.toolName);
+        } catch {}
+      }
       subscribers.add(cb);
       return () => subscribers.delete(cb);
     },
@@ -17479,6 +17486,9 @@ function startSessionTail(config2) {
     try {
       const s = createToolLabelSidecar({ stateDir: stateDirForSidecar, sessionId });
       sidecars.set(sessionId, s);
+      s.onLabel((toolUseId, label, toolName) => {
+        rawOnEvent({ kind: "tool_label", toolUseId, label, toolName });
+      });
       return s;
     } catch (err) {
       log?.(`session-tail: sidecar create failed: ${err.message}`);
@@ -17592,6 +17602,9 @@ function startSessionTail(config2) {
       }
       log?.(`session-tail: attached to ${file} (cursor=${cursor})`);
     }
+    const attachSid = sessionIdForFile(file);
+    if (attachSid)
+      ensureSidecar(attachSid);
     try {
       watcher = watch(file, () => readNew());
     } catch (err) {