switchroom 0.14.46 → 0.14.47

package/dist/cli/switchroom.js

@@ -49462,8 +49462,8 @@ var {
 } = import__.default;
 
 // src/build-info.ts
-var VERSION = "0.14.46";
-var COMMIT_SHA = "df3deacf";
+var VERSION = "0.14.47";
+var COMMIT_SHA = "fbd2e491";
 
 // src/cli/agent.ts
 init_source();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switchroom",
-  "version": "0.14.46",
+  "version": "0.14.47",
   "description": "Run Claude Code 24/7 on your Claude Pro/Max subscription over Telegram. Open-source alternative to OpenClaw and NanoClaw — no API keys.",
   "type": "module",
   "bin": {

package/telegram-plugin/dist/gateway/gateway.js

@@ -51137,8 +51137,14 @@ function prettyMcpServer(server) {
 }
 
 // permission-title.ts
+init_redact();
 var COMMAND_TITLE_MAX = 48;
 var DESCRIPTION_LINE_MAX = 240;
+var HTTP_VERBS = new Set(["get", "post", "put", "patch", "delete", "head"]);
+var RESOURCE_KEYS = ["path", "endpoint", "url", "resource", "route"];
+var ARG_SUMMARY_MAX_KEYS = 4;
+var ARG_VALUE_MAX = 40;
+var ARG_SUMMARY_LINE_MAX = 180;
 var MCP_TOOL_DESCRIPTIONS = {
   "mcp__agent-config__config_get": "Read its own merged config",
   "mcp__agent-config__cron_list": "List its own scheduled tasks",
@@ -51179,6 +51185,10 @@ function formatPermissionCardBody(opts) {
   const rawWhy = (opts.description ?? "").replace(/\s+/g, " ").trim();
   const truncatedWhy = rawWhy.length > DESCRIPTION_LINE_MAX ? rawWhy.slice(0, DESCRIPTION_LINE_MAX - 1) + "\u2026" : rawWhy;
   lines.push(truncatedWhy.length > 0 ? `why: <i>${escapeTgHtml(truncatedWhy)}</i>` : `why: <i>not provided</i>`);
+  const argSummary = mcpArgSummary(opts.toolName, opts.inputPreview);
+  if (argSummary) {
+    lines.push(`\u21b3 <i>${escapeTgHtml(argSummary)}</i>`);
+  }
   return lines.join(`
 `);
 }
@@ -51243,10 +51253,63 @@ function naturalMcpAction(toolName, input) {
   }
   if (parts.length >= 3) {
     const verb = parts.slice(2).join("__").replace(/_/g, " ");
+    if (!INTERNAL_MCP_SERVERS.has(server)) {
+      const resourcePhrase = restResourcePhrase(server, verb, input);
+      if (resourcePhrase)
+        return resourcePhrase;
+    }
     return INTERNAL_MCP_SERVERS.has(server) ? verb : `${verb} (${prettyMcpServer(server)})`;
   }
   return `use ${toolName}`;
 }
+function restResourcePhrase(server, verb, input) {
+  if (!input)
+    return null;
+  let path = null;
+  for (const key of RESOURCE_KEYS) {
+    path = readString(input, key);
+    if (path)
+      break;
+  }
+  if (!path)
+    return null;
+  const v = HTTP_VERBS.has(verb.toLowerCase()) ? verb.toUpperCase() : verb;
+  const shownPath = truncate6(redact(path), COMMAND_TITLE_MAX);
+  return `${v} ${shownPath} (${prettyMcpServer(server)})`;
+}
+function mcpArgSummary(toolName, inputPreview) {
+  if (!toolName.startsWith("mcp__"))
+    return null;
+  const server = toolName.split("__")[1] ?? "";
+  if (INTERNAL_MCP_SERVERS.has(server))
+    return null;
+  const input = parseInput(inputPreview);
+  if (!input)
+    return null;
+  const payload = input.body ?? input.query;
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
+    return null;
+  }
+  const parts = [];
+  for (const [key, value] of Object.entries(payload)) {
+    if (parts.length >= ARG_SUMMARY_MAX_KEYS) {
+      parts.push("\u2026");
+      break;
+    }
+    if (value == null)
+      continue;
+    if (typeof value === "object") {
+      parts.push(key);
+      continue;
+    }
+    const shown = truncate6(redact(String(value)), ARG_VALUE_MAX);
+    parts.push(`${key}: ${shown}`);
+  }
+  if (parts.length === 0)
+    return null;
+  const joined = parts.join(", ");
+  return joined.length > ARG_SUMMARY_LINE_MAX ? joined.slice(0, ARG_SUMMARY_LINE_MAX - 1) + "\u2026" : joined;
+}
 function describeGrant(toolName, inputPreview, option) {
   const rule = option.rule;
   if (rule.endsWith("__*") && rule.startsWith("mcp__")) {
@@ -52034,10 +52097,10 @@ function sweepStaleTurnActiveMarker(stateDir, opts) {
 }
 
 // ../src/build-info.ts
-var VERSION = "0.14.46";
-var COMMIT_SHA = "df3deacf";
-var COMMIT_DATE = "2026-06-03T05:00:14Z";
-var LATEST_PR = 2116;
+var VERSION = "0.14.47";
+var COMMIT_SHA = "fbd2e491";
+var COMMIT_DATE = "2026-06-03T07:22:07Z";
+var LATEST_PR = 2119;
 var COMMITS_AHEAD_OF_TAG = 0;
 
 // gateway/boot-version.ts
@@ -53520,6 +53583,22 @@ function resumeReactionAfterVerdict() {
     return;
   activeStatusReactions.get(statusKey(turn.sessionChatId, turn.sessionThreadId))?.setThinking();
 }
+function resolvePermissionCardTargets() {
+  const turn = currentTurn;
+  if (turn != null) {
+    return [{ chatId: turn.sessionChatId, threadId: turn.sessionThreadId }];
+  }
+  const sg = resolveAgentSupergroupChatId();
+  const topic = resolveAgentOutboundTopic({
+    kind: "permission",
+    turnInitiated: false,
+    originThreadId: undefined
+  });
+  return loadAccess().allowFrom.map((chatId) => ({
+    chatId,
+    threadId: topicForRecipient({ recipientChatId: chatId, resolvedTopic: topic, supergroupChatId: sg })
+  }));
+}
 function postPermissionResumeMessage(opts) {
   if (process.env.SWITCHROOM_RESUME_MSG === "0")
     return;
@@ -53529,19 +53608,7 @@ function postPermissionResumeMessage(opts) {
     action: opts.action,
     timeoutMinutes: opts.timeoutMinutes
   });
-  const turn = currentTurn;
-  const targets = turn != null ? [{ chatId: turn.sessionChatId, threadId: turn.sessionThreadId }] : (() => {
-    const sg = resolveAgentSupergroupChatId();
-    const topic = resolveAgentOutboundTopic({
-      kind: "permission",
-      turnInitiated: false,
-      originThreadId: undefined
-    });
-    return loadAccess().allowFrom.map((chatId) => ({
-      chatId,
-      threadId: topicForRecipient({ recipientChatId: chatId, resolvedTopic: topic, supergroupChatId: sg })
-    }));
-  })();
+  const targets = resolvePermissionCardTargets();
   for (const { chatId, threadId } of targets) {
     swallowingApiCall(() => bot.api.sendMessage(chatId, text, {
       parse_mode: "HTML",
@@ -54646,7 +54713,6 @@ var ipcServer = createIpcServer({
   onPermissionRequest(_client, msg) {
     const { requestId, toolName, description, inputPreview } = msg;
     pendingPermissions.set(requestId, { tool_name: toolName, description, input_preview: inputPreview, startedAt: Date.now() });
-    const access = loadAccess();
     const text = formatPermissionCardBody({
       toolName,
       inputPreview,
@@ -54656,20 +54722,14 @@ var ipcServer = createIpcServer({
     const showAlways = resolveScopedAllowChoices(toolName, inputPreview) != null;
     const keyboard = buildPermissionActionRow(requestId, showAlways);
     const activeTurn = currentTurn;
-    const permTopic = resolveAgentOutboundTopic({
-      kind: "permission",
-      turnInitiated: activeTurn != null,
-      originThreadId: activeTurn?.sessionThreadId
-    });
-    const permSupergroup = resolveAgentSupergroupChatId();
-    for (const chat_id of access.allowFrom) {
-      const permThread = topicForRecipient({ recipientChatId: chat_id, resolvedTopic: permTopic, supergroupChatId: permSupergroup });
-      bot.api.sendMessage(chat_id, text, {
+    const targets = resolvePermissionCardTargets();
+    for (const { chatId, threadId } of targets) {
+      retryWithThreadFallback(robustApiCall, (tid) => bot.api.sendMessage(chatId, text, {
         parse_mode: "HTML",
         reply_markup: keyboard,
-        ...permThread != null ? { message_thread_id: permThread } : {}
-      }).catch((e) => {
-        process.stderr.write(`telegram gateway: permission_request send to ${chat_id} failed: ${e}
+        ...tid != null ? { message_thread_id: tid } : {}
+      }), { threadId, chat_id: chatId, verb: "permission_request" }).catch((e) => {
+        process.stderr.write(`telegram gateway: permission_request send to ${chatId} failed: ${e}
 `);
       });
     }

package/telegram-plugin/gateway/gateway.ts

@@ -2240,6 +2240,47 @@ function resumeReactionAfterVerdict(): void {
     ?.setThinking()
 }
 
+/**
+ * The recipient set for a permission card (the initial Approve/Deny card
+ * AND the post-verdict resume message — they MUST route identically, so
+ * both go through this one helper).
+ *
+ * Turn-initiated (the normal case — a permission gate fires mid-tool-use
+ * with an active turn): send to the ORIGINATING chat+thread. For a
+ * supergroup-owned agent working in a forum topic that is the supergroup +
+ * the topic, so the card lands IN the topic the operator asked from (e.g.
+ * marko's "CRM (Brevo)" topic) — not the operator's DM. For a DM agent the
+ * originating chat IS the operator's DM (thread-less), unchanged.
+ *
+ * No active turn (cron / background / a swept turn at TTL): fall back to the
+ * configured operator DMs (`allowFrom`), thread-stripped via
+ * `topicForRecipient` so a DM never gets a `message_thread_id` (the 400
+ * "message thread not found" → auto-deny wedge, #2096).
+ *
+ * Before this helper the INITIAL card emitter iterated `allowFrom`
+ * unconditionally, so a supergroup card could only ever reach operator DMs —
+ * the topic chat id is never in `allowFrom`. The resume message already
+ * routed correctly; the card now matches it (marko, 2026-06-03).
+ */
+function resolvePermissionCardTargets(): Array<{ chatId: string; threadId: number | undefined }> {
+  const turn = currentTurn
+  if (turn != null) {
+    return [{ chatId: turn.sessionChatId, threadId: turn.sessionThreadId }]
+  }
+  const sg = resolveAgentSupergroupChatId()
+  const topic = resolveAgentOutboundTopic({
+    kind: 'permission',
+    turnInitiated: false,
+    originThreadId: undefined,
+  })
+  // allowFrom is normally operator DMs — attach the topic only to a
+  // recipient that owns it (the supergroup), never a DM (marko wedge).
+  return loadAccess().allowFrom.map(chatId => ({
+    chatId,
+    threadId: topicForRecipient({ recipientChatId: chatId, resolvedTopic: topic, supergroupChatId: sg }),
+  }))
+}
+
 /**
  * Post the agent-voiced "got your verdict — continuing" message the
  * instant the operator answers a permission card. Travels right beside
@@ -2269,24 +2310,7 @@ function postPermissionResumeMessage(opts: {
     action: opts.action,
     timeoutMinutes: opts.timeoutMinutes,
   })
-  const turn = currentTurn
-  const targets: Array<{ chatId: string; threadId: number | undefined }> =
-    turn != null
-      ? [{ chatId: turn.sessionChatId, threadId: turn.sessionThreadId }]
-      : (() => {
-          const sg = resolveAgentSupergroupChatId()
-          const topic = resolveAgentOutboundTopic({
-            kind: 'permission',
-            turnInitiated: false,
-            originThreadId: undefined,
-          })
-          // allowFrom is normally operator DMs — attach the topic only to a
-          // recipient that owns it (the supergroup), never a DM (marko wedge).
-          return loadAccess().allowFrom.map(chatId => ({
-            chatId,
-            threadId: topicForRecipient({ recipientChatId: chatId, resolvedTopic: topic, supergroupChatId: sg }),
-          }))
-        })()
+  const targets = resolvePermissionCardTargets()
   for (const { chatId, threadId } of targets) {
     // allow-raw-bot-api: wrapped in swallowingApiCall (retry policy); thread-aware send
     void swallowingApiCall(
@@ -4665,7 +4689,6 @@ const ipcServer: IpcServer = createIpcServer({
   onPermissionRequest(_client: IpcClient, msg: PermissionRequestForward) {
     const { requestId, toolName, description, inputPreview } = msg
     pendingPermissions.set(requestId, { tool_name: toolName, description, input_preview: inputPreview, startedAt: Date.now() })
-    const access = loadAccess()
     // Natural-language card body — a plain sentence ("Gymbro wants to
     // edit: supplement-log.md" + a why-line), never a raw tool id.
     // The operator sees what is being requested and why at a glance.
@@ -4685,42 +4708,34 @@ const ipcServer: IpcServer = createIpcServer({
     // two-button row only.
     const showAlways = resolveScopedAllowChoices(toolName, inputPreview) != null
     const keyboard = buildPermissionActionRow(requestId, showAlways)
-    // PR4b emitter sweep — supergroup-mode permission card routing.
-    // Per CPO #3 the design is "turn-initiated requests follow the
-    // conversation topic; background requests go to admin alias."
-    // Permission requests come from the bridge mid-tool-use, so they
-    // are always turn-initiated in practice — the currently active
-    // turn's sessionThreadId is the originating topic. Fall back to
-    // admin alias when no active turn (cron / background path).
-    // Fleet-shared / DM agents see `undefined` → no
-    // `message_thread_id` is added → behavior unchanged.
-    // currentTurn is the singleton "claude is currently on this turn"
-    // pointer — per Framing 1 / PR3b scope-discovery, claude
-    // serializes so there's exactly one (or zero) active turn at any
-    // moment. When set, the permission request is in-flight for that
-    // turn and follows the originating topic.
+    // Route the card to the SAME place the post-verdict resume message
+    // lands (resolvePermissionCardTargets): the ORIGINATING chat+topic when
+    // there's an active turn — so a supergroup agent's card appears IN the
+    // topic the operator asked from (marko's "CRM (Brevo)"), not the
+    // operator DM — else the configured operator DMs, thread-stripped. The
+    // old code iterated `allowFrom` unconditionally, so a supergroup card
+    // could only ever reach operator DMs (the topic chat id is never in
+    // `allowFrom`) (marko, 2026-06-03).
     const activeTurn = currentTurn
-    const permTopic = resolveAgentOutboundTopic({
-      kind: 'permission',
-      turnInitiated: activeTurn != null,
-      originThreadId: activeTurn?.sessionThreadId,
-    })
-    const permSupergroup = resolveAgentSupergroupChatId()
-    for (const chat_id of access.allowFrom) {
-      // parse_mode=HTML pairs with formatPermissionCardBody (#1790)
-      // so the <b>/<i> tags render as formatting.
-      // The resolved topic is valid only in the agent's supergroup — attach
-      // it ONLY when this recipient IS that supergroup. allowFrom DMs get the
-      // card thread-less; attaching a topic to a DM yields 400 "message thread
-      // not found" → card never arrives → auto-deny → wedge (marko 2026-06-02).
-      const permThread = topicForRecipient({ recipientChatId: chat_id, resolvedTopic: permTopic, supergroupChatId: permSupergroup })
-      // allow-raw-bot-api: permission-request keyboard fan-out; topic-aware opts
-      void bot.api.sendMessage(chat_id, text, {
-        parse_mode: 'HTML',
-        reply_markup: keyboard,
-        ...(permThread != null ? { message_thread_id: permThread } : {}),
-      }).catch(e => {
-        process.stderr.write(`telegram gateway: permission_request send to ${chat_id} failed: ${e}\n`)
+    const targets = resolvePermissionCardTargets()
+    for (const { chatId, threadId } of targets) {
+      // parse_mode=HTML pairs with formatPermissionCardBody (#1790) so the
+      // <b>/<i> tags render. retryWithThreadFallback: if the topic was
+      // deleted/recreated (stale thread id → 400 "message thread not
+      // found"), re-send thread-less into the main chat so the card still
+      // ARRIVES rather than vanishing → 10-min TTL auto-deny → wedge.
+      // allow-raw-bot-api: wrapped in retryWithThreadFallback (retry policy); topic-aware send
+      void retryWithThreadFallback<{ message_id: number }>(
+        robustApiCall,
+        (tid) =>
+          bot.api.sendMessage(chatId, text, {
+            parse_mode: 'HTML',
+            reply_markup: keyboard,
+            ...(tid != null ? { message_thread_id: tid } : {}),
+          }),
+        { threadId, chat_id: chatId, verb: 'permission_request' },
+      ).catch(e => {
+        process.stderr.write(`telegram gateway: permission_request send to ${chatId} failed: ${e}\n`)
       })
     }
     // Park the turn's status reaction on 🙏 (awaiting your tap) and

package/telegram-plugin/permission-title.ts

@@ -19,10 +19,21 @@
 
 import { basename } from "node:path";
 import { prettyMcpServer, type ScopeOption } from "./permission-rule.js";
+import { redact } from "./secret-detect/redact.js";
 
 const COMMAND_TITLE_MAX = 48;
 const DESCRIPTION_LINE_MAX = 240;
 
+/** HTTP methods the generic REST-wrapper MCP tools (brevo/meta/postiz/… via
+ *  rest-server.mjs) expose as verbs — uppercased on the card so the operator
+ *  reads "POST /smtp/email" as an API write, not "post". */
+const HTTP_VERBS = new Set(["get", "post", "put", "patch", "delete", "head"]);
+/** Keys that, on a REST-style MCP input, name the resource/endpoint. */
+const RESOURCE_KEYS = ["path", "endpoint", "url", "resource", "route"];
+const ARG_SUMMARY_MAX_KEYS = 4; // how many payload keys to surface on the card
+const ARG_VALUE_MAX = 40; // per-value truncation in the arg-summary line
+const ARG_SUMMARY_LINE_MAX = 180; // total cap for the arg-summary line
+
 /**
  * Human verb-phrases for switchroom-managed MCP tools. The raw
  * `mcp__<server>__<tool>` name is operator-hostile. Phrases are written
@@ -104,6 +115,14 @@ export function formatPermissionCardBody(opts: {
       : `why: <i>not provided</i>`,
   );
 
+  // Third line (REST-wrapper MCP writes only): a redaction-safe summary of
+  // the payload so the operator can see WHAT is being sent, not just the
+  // endpoint — e.g. "↳ to: lisa@…, subject: Priority access…".
+  const argSummary = mcpArgSummary(opts.toolName, opts.inputPreview);
+  if (argSummary) {
+    lines.push(`↳ <i>${escapeTgHtml(argSummary)}</i>`);
+  }
+
   return lines.join("\n");
 }
 
@@ -171,7 +190,6 @@ function naturalMcpAction(
   toolName: string,
   input: Record<string, unknown> | null,
 ): string {
-  void input;
   const parts = toolName.split("__");
   const server = parts.length >= 2 ? parts[1]! : "";
   const curated = MCP_TOOL_DESCRIPTIONS[toolName];
@@ -183,6 +201,15 @@ function naturalMcpAction(
   }
   if (parts.length >= 3) {
     const verb = parts.slice(2).join("__").replace(/_/g, " ");
+    // External REST-wrapper tools (brevo/meta/postiz/…) take a `path`. Name
+    // the endpoint so "post (Brevo)" becomes "POST /smtp/email (Brevo)" —
+    // the operator can see WHICH resource is being written, not just that
+    // *something* is. Internal servers + tools without a resource key keep
+    // the plain verb phrasing.
+    if (!INTERNAL_MCP_SERVERS.has(server)) {
+      const resourcePhrase = restResourcePhrase(server, verb, input);
+      if (resourcePhrase) return resourcePhrase;
+    }
     return INTERNAL_MCP_SERVERS.has(server)
       ? verb
       : `${verb} (${prettyMcpServer(server)})`;
@@ -190,6 +217,78 @@ function naturalMcpAction(
   return `use ${toolName}`;
 }
 
+/**
+ * For a REST-wrapper MCP call ({ path, body?, query? }), build the action
+ * phrase "<VERB> <path> (<Server>)" — e.g. "POST /smtp/email (Brevo)". The
+ * path is redaction-passed + length-capped before display. Returns null
+ * when the input carries no recognizable resource key (caller falls back to
+ * the plain verb phrasing).
+ */
+function restResourcePhrase(
+  server: string,
+  verb: string,
+  input: Record<string, unknown> | null,
+): string | null {
+  if (!input) return null;
+  let path: string | null = null;
+  for (const key of RESOURCE_KEYS) {
+    path = readString(input, key);
+    if (path) break;
+  }
+  if (!path) return null;
+  const v = HTTP_VERBS.has(verb.toLowerCase()) ? verb.toUpperCase() : verb;
+  const shownPath = truncate(redact(path), COMMAND_TITLE_MAX);
+  return `${v} ${shownPath} (${prettyMcpServer(server)})`;
+}
+
+/**
+ * A compact, redaction-safe one-line summary of a REST-wrapper MCP call's
+ * payload ({ body } for writes, { query } for reads) — the third card line.
+ * Shows up to {@link ARG_SUMMARY_MAX_KEYS} payload keys with short, masked
+ * scalar values ("to: lisa@…, subject: Priority access…"); nested
+ * objects/arrays surface as the bare key name (no value dump — avoids
+ * leaking PII/secrets and oversized blobs). Every value passes through
+ * `redact()` so an API key in the payload is masked, never surfaced.
+ * Returns null when there's nothing meaningful to show.
+ */
+function mcpArgSummary(
+  toolName: string,
+  inputPreview: string | undefined,
+): string | null {
+  if (!toolName.startsWith("mcp__")) return null;
+  // Internal servers (agent-config / hostd / hindsight / telegram) use flat
+  // input schemas, not the REST `body`/`query` convention — and we don't
+  // endpoint-enrich their title line either, so keep the summary line off
+  // them too (redact() still runs, so this is intent-match, not a leak fix).
+  const server = toolName.split("__")[1] ?? "";
+  if (INTERNAL_MCP_SERVERS.has(server)) return null;
+  const input = parseInput(inputPreview);
+  if (!input) return null;
+  const payload = input.body ?? input.query;
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
+    return null;
+  }
+  const parts: string[] = [];
+  for (const [key, value] of Object.entries(payload as Record<string, unknown>)) {
+    if (parts.length >= ARG_SUMMARY_MAX_KEYS) {
+      parts.push("…");
+      break;
+    }
+    if (value == null) continue;
+    if (typeof value === "object") {
+      parts.push(key); // nested object/array → key name only, never dumped
+      continue;
+    }
+    const shown = truncate(redact(String(value)), ARG_VALUE_MAX);
+    parts.push(`${key}: ${shown}`);
+  }
+  if (parts.length === 0) return null;
+  const joined = parts.join(", ");
+  return joined.length > ARG_SUMMARY_LINE_MAX
+    ? joined.slice(0, ARG_SUMMARY_LINE_MAX - 1) + "…"
+    : joined;
+}
+
 /**
  * Confirmation phrase describing a grant that just landed, derived from
  * the *scope option the operator chose* — so an always-allow's breadth

package/telegram-plugin/tests/permission-card-routing.test.ts

@@ -0,0 +1,77 @@
+/**
+ * Structural pin for permission-card topic routing.
+ *
+ * The bug (marko, 2026-06-03): the INITIAL Approve/Deny card emitter
+ * (`onPermissionRequest`) iterated `access.allowFrom` unconditionally as its
+ * recipient set. For a supergroup-owned agent, `allowFrom` holds only the
+ * operator DM user-ids — the supergroup chat id is never in it — so a
+ * permission card raised from a forum topic could ONLY ever land in the
+ * operator's DM, never in the topic the operator asked from. The
+ * post-verdict resume message already routed correctly (to the turn's
+ * originating chat+thread); the card did not.
+ *
+ * The fix routes BOTH the card and the resume through one shared helper,
+ * `resolvePermissionCardTargets()`, so they can't drift: turn-initiated →
+ * the originating chat+topic; no active turn → operator DMs, thread-stripped
+ * via topicForRecipient (the DM-thread 400 / auto-deny guard, #2096).
+ *
+ * gateway.ts is not unit-importable (top-level side effects), so this is a
+ * source-text pin in the same style as permission-verdict-resume-guard.ts.
+ * The routing *logic* (topicForRecipient / resolveAgentOutboundTopic) is
+ * unit-tested in src/telegram/topic-router.test.ts; the end-to-end
+ * "card lands in the topic" is covered by the supergroup UAT. This guards
+ * the wiring: that the card uses the shared helper and never reverts to the
+ * raw allowFrom fan-out.
+ */
+
+import { describe, it, expect } from 'vitest'
+import { readFileSync } from 'node:fs'
+import { fileURLToPath } from 'node:url'
+import { dirname, resolve } from 'node:path'
+
+const __dirname = dirname(fileURLToPath(import.meta.url))
+const GATEWAY_SRC = readFileSync(
+  resolve(__dirname, '..', 'gateway', 'gateway.ts'),
+  'utf8',
+)
+
+/** Slice the body of the `onPermissionRequest` IPC handler — from its header
+ *  to the next handler method (`onHeartbeat`). */
+function onPermissionRequestBody(): string {
+  const start = GATEWAY_SRC.indexOf('onPermissionRequest(')
+  expect(start).toBeGreaterThan(-1)
+  const rest = GATEWAY_SRC.slice(start)
+  const end = rest.indexOf('onHeartbeat(')
+  expect(end).toBeGreaterThan(-1)
+  return rest.slice(0, end)
+}
+
+describe('permission card routing', () => {
+  it('the shared target helper exists', () => {
+    expect(
+      /function\s+resolvePermissionCardTargets\s*\(/.test(GATEWAY_SRC),
+    ).toBe(true)
+  })
+
+  it('the initial card emitter routes via resolvePermissionCardTargets()', () => {
+    expect(onPermissionRequestBody()).toContain('resolvePermissionCardTargets()')
+  })
+
+  it('the initial card emitter no longer iterates access.allowFrom directly (the bug shape)', () => {
+    // The raw fan-out loop is what sent supergroup cards to operator DMs.
+    expect(onPermissionRequestBody()).not.toMatch(
+      /for\s*\(\s*const\s+chat_id\s+of\s+access\.allowFrom\s*\)/,
+    )
+  })
+
+  it('the card send is wrapped in retryWithThreadFallback (stale-topic → thread-less, not a silent drop)', () => {
+    expect(onPermissionRequestBody()).toContain('retryWithThreadFallback')
+  })
+
+  it('the resume message uses the SAME helper, so card + resume cannot drift', () => {
+    const start = GATEWAY_SRC.indexOf('function postPermissionResumeMessage(')
+    expect(start).toBeGreaterThan(-1)
+    const body = GATEWAY_SRC.slice(start, start + 1400)
+    expect(body).toContain('resolvePermissionCardTargets()')
+  })
+})

package/telegram-plugin/tests/permission-title.test.ts

@@ -87,6 +87,35 @@ describe('naturalAction — MCP tools', () => {
       'list files (Google Workspace)',
     )
   })
+
+  // Clarity fix: REST-wrapper MCP tools (brevo/meta/postiz via rest-server.mjs)
+  // take a `path` — surface it so "post (Brevo)" becomes "POST /smtp/email
+  // (Brevo)" and the operator can see WHICH endpoint is being written.
+  test('REST-wrapper write names the endpoint with an uppercased HTTP verb', () => {
+    expect(
+      naturalAction('mcp__brevo__post', JSON.stringify({ path: '/smtp/email', body: { to: 'x' } })),
+    ).toBe('POST /smtp/email (Brevo)')
+    expect(
+      naturalAction('mcp__brevo__put', JSON.stringify({ path: '/contacts/123', body: {} })),
+    ).toBe('PUT /contacts/123 (Brevo)')
+  })
+
+  test('REST-wrapper read surfaces the path too', () => {
+    expect(
+      naturalAction('mcp__brevo__get', JSON.stringify({ path: '/contacts', query: { limit: 10 } })),
+    ).toBe('GET /contacts (Brevo)')
+  })
+
+  test('falls back to the plain verb phrase when there is no resource key', () => {
+    // No path → today's behavior, unchanged (defensive for unknown shapes).
+    expect(naturalAction('mcp__brevo__post', undefined)).toBe('post (Brevo)')
+    expect(naturalAction('mcp__brevo__post', JSON.stringify({ foo: 1 }))).toBe('post (Brevo)')
+  })
+
+  test('internal REST-ish tool is NOT endpoint-enriched (stays a bare verb)', () => {
+    // hostd is internal → no "(Server)" tag, no path enrichment.
+    expect(naturalAction('mcp__hostd__do_thing', JSON.stringify({ path: '/x' }))).toBe('do thing')
+  })
 })
 
 describe('formatPermissionCardBody', () => {
@@ -156,6 +185,56 @@ describe('formatPermissionCardBody', () => {
     })
     expect(body).toContain('why: <i>first second paragraph</i>')
   })
+
+  // Clarity fix: the card gains a third "↳" line summarizing the REST
+  // payload so the operator can see WHAT is being written, not just the
+  // endpoint. Values are redaction-passed + truncated; nested objects show
+  // as a bare key name.
+  test('REST write card: endpoint in the title + a payload summary line', () => {
+    const body = formatPermissionCardBody({
+      toolName: 'mcp__brevo__post',
+      inputPreview: JSON.stringify({
+        path: '/smtp/email',
+        body: { subject: 'Priority access', templateId: 12, to: [{ email: 'lisa@example.com' }] },
+      }),
+      description: 'HIGH RISK: write to the brevo API (POST).',
+      agentName: 'marko',
+    })
+    const lines = body.split('\n')
+    expect(lines[0]).toBe('🔐 <b>Marko</b> wants to POST /smtp/email (Brevo)')
+    expect(lines[1]).toBe('why: <i>HIGH RISK: write to the brevo API (POST).</i>')
+    // Third line: scalar keys show value; the nested `to` array shows key-only.
+    expect(lines[2]).toContain('↳')
+    expect(lines[2]).toContain('subject: Priority access')
+    expect(lines[2]).toContain('templateId: 12')
+    expect(lines[2]).toContain('to') // key-only, not the email object dumped
+    expect(lines[2]).not.toContain('lisa@example.com')
+  })
+
+  test('no payload → no third line (DM / non-REST cards unchanged)', () => {
+    const body = formatPermissionCardBody({
+      toolName: 'Edit',
+      inputPreview: JSON.stringify({ file_path: '/a/b.md' }),
+      description: 'edit it',
+      agentName: 'clerk',
+    })
+    expect(body.split('\n')).toHaveLength(2)
+    expect(body).not.toContain('↳')
+  })
+
+  test('redaction is load-bearing: a token in the payload is masked, never shown', () => {
+    // Build the fake token at runtime so the source file never holds a
+    // contiguous token literal (repo push-protection rule).
+    const fakeToken = 'sk-ant-' + 'api03-' + 'A'.repeat(48)
+    const body = formatPermissionCardBody({
+      toolName: 'mcp__brevo__post',
+      inputPreview: JSON.stringify({ path: '/contacts', body: { apiKey: fakeToken, name: 'Lisa' } }),
+      description: 'create a contact',
+      agentName: 'marko',
+    })
+    expect(body).not.toContain(fakeToken)
+    expect(body).toContain('name: Lisa') // benign value still surfaces
+  })
 })
 
 describe('describeGrant — phrased from the chosen scope', () => {