switchroom 0.14.46 → 0.14.48

package/dist/cli/switchroom.js

@@ -49462,8 +49462,8 @@ var {
 } = import__.default;
 
 // src/build-info.ts
-var VERSION = "0.14.46";
-var COMMIT_SHA = "df3deacf";
+var VERSION = "0.14.48";
+var COMMIT_SHA = "a6517652";
 
 // src/cli/agent.ts
 init_source();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switchroom",
-  "version": "0.14.46",
+  "version": "0.14.48",
   "description": "Run Claude Code 24/7 on your Claude Pro/Max subscription over Telegram. Open-source alternative to OpenClaw and NanoClaw — no API keys.",
   "type": "module",
   "bin": {

package/telegram-plugin/dist/gateway/gateway.js

@@ -46927,7 +46927,7 @@ function escapeHtml7(s) {
 
 // gateway/pending-inbound-buffer.ts
 var DEFAULT_PENDING_INBOUND_CAP = 32;
-function redeliverBufferedInbound(buffer, agent, send, spool) {
+function redeliverBufferedInbound(buffer, agent, send, spool, onDelivered) {
   const pending = buffer.drain(agent);
   let redelivered = 0;
   let rebuffered = 0;
@@ -46942,6 +46942,7 @@ function redeliverBufferedInbound(buffer, agent, send, spool) {
       for (const o of originals)
         spool?.ack(o);
       redelivered += originals.length;
+      onDelivered?.(merged, originals);
     } else {
       for (const o of originals)
         buffer.push(agent, o);
@@ -47004,14 +47005,14 @@ function mergeRun(run2) {
     merged.attachment = mediaEntry.attachment;
   return merged;
 }
-function idleDrainTick(buffer, agent, isBridgeAlive, send, spool) {
+function idleDrainTick(buffer, agent, isBridgeAlive, send, spool, onDelivered) {
   if (!agent)
     return null;
   if (buffer.depth(agent) === 0)
     return null;
   if (!isBridgeAlive())
     return null;
-  return redeliverBufferedInbound(buffer, agent, send, spool);
+  return redeliverBufferedInbound(buffer, agent, send, spool, onDelivered);
 }
 function createPendingInboundBuffer(opts = {}) {
   const cap = opts.capPerAgent ?? DEFAULT_PENDING_INBOUND_CAP;
@@ -47618,7 +47619,7 @@ function formatEventDetail(event) {
 }
 
 // gateway/pending-inbound-buffer.ts
-function redeliverBufferedInbound2(buffer, agent, send, spool) {
+function redeliverBufferedInbound2(buffer, agent, send, spool, onDelivered) {
   const pending = buffer.drain(agent);
   let redelivered = 0;
   let rebuffered = 0;
@@ -47633,6 +47634,7 @@ function redeliverBufferedInbound2(buffer, agent, send, spool) {
       for (const o of originals)
         spool?.ack(o);
       redelivered += originals.length;
+      onDelivered?.(merged, originals);
     } else {
       for (const o of originals)
         buffer.push(agent, o);
@@ -47725,7 +47727,7 @@ function dispatchOne(effect, ctx) {
         }
         return ctx.ipcServer.sendToAgent(ctx.selfAgent, msg);
       };
-      const result = redeliverBufferedInbound2(ctx.pendingInboundBuffer, ctx.selfAgent, send, ctx.inboundSpool ?? undefined);
+      const result = redeliverBufferedInbound2(ctx.pendingInboundBuffer, ctx.selfAgent, send, ctx.inboundSpool ?? undefined, ctx.onUserInboundDelivered ? (merged) => ctx.onUserInboundDelivered(merged) : undefined);
       if (result.drained > 0) {
         log(`telegram gateway: dispatch drainBuffer agent=${ctx.selfAgent} ` + `drained=${result.drained} redelivered=${result.redelivered} ` + `rebuffered=${result.rebuffered}
 `);
@@ -51137,8 +51139,14 @@ function prettyMcpServer(server) {
 }
 
 // permission-title.ts
+init_redact();
 var COMMAND_TITLE_MAX = 48;
 var DESCRIPTION_LINE_MAX = 240;
+var HTTP_VERBS = new Set(["get", "post", "put", "patch", "delete", "head"]);
+var RESOURCE_KEYS = ["path", "endpoint", "url", "resource", "route"];
+var ARG_SUMMARY_MAX_KEYS = 4;
+var ARG_VALUE_MAX = 40;
+var ARG_SUMMARY_LINE_MAX = 180;
 var MCP_TOOL_DESCRIPTIONS = {
   "mcp__agent-config__config_get": "Read its own merged config",
   "mcp__agent-config__cron_list": "List its own scheduled tasks",
@@ -51179,6 +51187,10 @@ function formatPermissionCardBody(opts) {
   const rawWhy = (opts.description ?? "").replace(/\s+/g, " ").trim();
   const truncatedWhy = rawWhy.length > DESCRIPTION_LINE_MAX ? rawWhy.slice(0, DESCRIPTION_LINE_MAX - 1) + "\u2026" : rawWhy;
   lines.push(truncatedWhy.length > 0 ? `why: <i>${escapeTgHtml(truncatedWhy)}</i>` : `why: <i>not provided</i>`);
+  const argSummary = mcpArgSummary(opts.toolName, opts.inputPreview);
+  if (argSummary) {
+    lines.push(`\u21b3 <i>${escapeTgHtml(argSummary)}</i>`);
+  }
   return lines.join(`
 `);
 }
@@ -51243,10 +51255,63 @@ function naturalMcpAction(toolName, input) {
   }
   if (parts.length >= 3) {
     const verb = parts.slice(2).join("__").replace(/_/g, " ");
+    if (!INTERNAL_MCP_SERVERS.has(server)) {
+      const resourcePhrase = restResourcePhrase(server, verb, input);
+      if (resourcePhrase)
+        return resourcePhrase;
+    }
     return INTERNAL_MCP_SERVERS.has(server) ? verb : `${verb} (${prettyMcpServer(server)})`;
   }
   return `use ${toolName}`;
 }
+function restResourcePhrase(server, verb, input) {
+  if (!input)
+    return null;
+  let path = null;
+  for (const key of RESOURCE_KEYS) {
+    path = readString(input, key);
+    if (path)
+      break;
+  }
+  if (!path)
+    return null;
+  const v = HTTP_VERBS.has(verb.toLowerCase()) ? verb.toUpperCase() : verb;
+  const shownPath = truncate6(redact(path), COMMAND_TITLE_MAX);
+  return `${v} ${shownPath} (${prettyMcpServer(server)})`;
+}
+function mcpArgSummary(toolName, inputPreview) {
+  if (!toolName.startsWith("mcp__"))
+    return null;
+  const server = toolName.split("__")[1] ?? "";
+  if (INTERNAL_MCP_SERVERS.has(server))
+    return null;
+  const input = parseInput(inputPreview);
+  if (!input)
+    return null;
+  const payload = input.body ?? input.query;
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
+    return null;
+  }
+  const parts = [];
+  for (const [key, value] of Object.entries(payload)) {
+    if (parts.length >= ARG_SUMMARY_MAX_KEYS) {
+      parts.push("\u2026");
+      break;
+    }
+    if (value == null)
+      continue;
+    if (typeof value === "object") {
+      parts.push(key);
+      continue;
+    }
+    const shown = truncate6(redact(String(value)), ARG_VALUE_MAX);
+    parts.push(`${key}: ${shown}`);
+  }
+  if (parts.length === 0)
+    return null;
+  const joined = parts.join(", ");
+  return joined.length > ARG_SUMMARY_LINE_MAX ? joined.slice(0, ARG_SUMMARY_LINE_MAX - 1) + "\u2026" : joined;
+}
 function describeGrant(toolName, inputPreview, option) {
   const rule = option.rule;
   if (rule.endsWith("__*") && rule.startsWith("mcp__")) {
@@ -52034,10 +52099,10 @@ function sweepStaleTurnActiveMarker(stateDir, opts) {
 }
 
 // ../src/build-info.ts
-var VERSION = "0.14.46";
-var COMMIT_SHA = "df3deacf";
-var COMMIT_DATE = "2026-06-03T05:00:14Z";
-var LATEST_PR = 2116;
+var VERSION = "0.14.48";
+var COMMIT_SHA = "a6517652";
+var COMMIT_DATE = "2026-06-03T07:57:29Z";
+var LATEST_PR = 2120;
 var COMMITS_AHEAD_OF_TAG = 0;
 
 // gateway/boot-version.ts
@@ -52602,14 +52667,20 @@ function buildResumeWatchdogReportInbound(ctx) {
     meta
   };
 }
-function selectResumeBuilder(endedVia) {
+function selectResumeBuilder(endedVia, opts) {
+  let kind;
   if (endedVia === "timeout")
+    kind = "report";
+  else if (endedVia === "restart" || endedVia === "sigterm" || endedVia === "unknown")
+    kind = "resume";
+  else if (endedVia == null)
+    kind = "resume";
+  else
+    kind = null;
+  if (kind === "resume" && opts?.ageMs != null && opts?.maxAgeMs != null && opts.ageMs > opts.maxAgeMs) {
     return "report";
-  if (endedVia === "restart" || endedVia === "sigterm" || endedVia === "unknown")
-    return "resume";
-  if (endedVia == null)
-    return "resume";
-  return null;
+  }
+  return kind;
 }
 
 // registry/subagents-schema.ts
@@ -53060,7 +53131,14 @@ try {
   const pending2 = findLatestTurnIfInterrupted(turnsDb);
   const selfAgent = process.env.SWITCHROOM_AGENT_NAME ?? "";
   if (pending2 != null && selfAgent) {
-    const kind = selectResumeBuilder(pending2.ended_via);
+    const RESUME_MAX_AGE_MS = (() => {
+      const v = Number(process.env.SWITCHROOM_RESUME_MAX_AGE_MS);
+      return Number.isFinite(v) && v > 0 ? v : 10800000;
+    })();
+    const kind = selectResumeBuilder(pending2.ended_via, {
+      ageMs: Math.max(0, Date.now() - pending2.started_at),
+      maxAgeMs: RESUME_MAX_AGE_MS
+    });
     if (kind === "resume") {
       bootResumeInbound = { agent: selfAgent, msg: buildResumeInterruptedInbound({ turn: pending2 }) };
     } else if (kind === "report") {
@@ -53327,7 +53405,7 @@ function purgeReactionTracking(key, endingTurn) {
         if (d)
           markClaudeBusyForInbound(m);
         return d;
-      }, inboundSpool);
+      }, inboundSpool, trackRedeliveredInbound);
       if (fr.redelivered > 0) {
         process.stderr.write(`telegram gateway: turn-complete flushed ${fr.redelivered}/${fr.drained} held inbound for ${selfAgentForFlush}${fr.rebuffered > 0 ? ` (${fr.rebuffered} re-buffered)` : ""}
 `);
@@ -53357,7 +53435,7 @@ function releaseTurnBufferGate(key) {
         if (d)
           markClaudeBusyForInbound(m);
         return d;
-      }, inboundSpool);
+      }, inboundSpool, trackRedeliveredInbound);
       if (fr.redelivered > 0) {
         process.stderr.write(`telegram gateway: reply-released-gate flushed ${fr.redelivered}/${fr.drained} held inbound for ${selfAgentForFlush}${fr.rebuffered > 0 ? ` (${fr.rebuffered} re-buffered)` : ""}
 `);
@@ -53520,6 +53598,22 @@ function resumeReactionAfterVerdict() {
     return;
   activeStatusReactions.get(statusKey(turn.sessionChatId, turn.sessionThreadId))?.setThinking();
 }
+function resolvePermissionCardTargets() {
+  const turn = currentTurn;
+  if (turn != null) {
+    return [{ chatId: turn.sessionChatId, threadId: turn.sessionThreadId }];
+  }
+  const sg = resolveAgentSupergroupChatId();
+  const topic = resolveAgentOutboundTopic({
+    kind: "permission",
+    turnInitiated: false,
+    originThreadId: undefined
+  });
+  return loadAccess().allowFrom.map((chatId) => ({
+    chatId,
+    threadId: topicForRecipient({ recipientChatId: chatId, resolvedTopic: topic, supergroupChatId: sg })
+  }));
+}
 function postPermissionResumeMessage(opts) {
   if (process.env.SWITCHROOM_RESUME_MSG === "0")
     return;
@@ -53529,19 +53623,7 @@ function postPermissionResumeMessage(opts) {
     action: opts.action,
     timeoutMinutes: opts.timeoutMinutes
   });
-  const turn = currentTurn;
-  const targets = turn != null ? [{ chatId: turn.sessionChatId, threadId: turn.sessionThreadId }] : (() => {
-    const sg = resolveAgentSupergroupChatId();
-    const topic = resolveAgentOutboundTopic({
-      kind: "permission",
-      turnInitiated: false,
-      originThreadId: undefined
-    });
-    return loadAccess().allowFrom.map((chatId) => ({
-      chatId,
-      threadId: topicForRecipient({ recipientChatId: chatId, resolvedTopic: topic, supergroupChatId: sg })
-    }));
-  })();
+  const targets = resolvePermissionCardTargets();
   for (const { chatId, threadId } of targets) {
     swallowingApiCall(() => bot.api.sendMessage(chatId, text, {
       parse_mode: "HTML",
@@ -54339,7 +54421,7 @@ startTimer({
       if (d)
         markClaudeBusyForInbound(m);
       return d;
-    }, inboundSpool);
+    }, inboundSpool, trackRedeliveredInbound);
     process.stderr.write(`telegram gateway: silence-poke framework-fallback ended wedged turn chat=${fbChatId} thread=${ctx.threadId ?? "-"} silence_ms=${ctx.silenceMs} currentTurn_nulled=${turnMatchesFallback} drained_buffered=${fbRedeliver.redelivered}/${fbRedeliver.drained}${fbRedeliver.rebuffered > 0 ? ` rebuffered=${fbRedeliver.rebuffered}` : ""}${fbExtraPurge.purged.length > 0 ? ` extra_keys_purged=${fbExtraPurge.purged.length}` : ""}
 `);
   }
@@ -54349,6 +54431,20 @@ var _deliveryMachineTick = setInterval(() => {
   shadowEmit({ kind: "tick", now: Date.now() });
 }, DELIVERY_MACHINE_TICK_MS);
 _deliveryMachineTick.unref?.();
+function trackRedeliveredInbound(merged) {
+  if (!DELIVERY_CONFIRM_ENABLED)
+    return;
+  if (!shouldTrackDelivery({
+    isSteering: false,
+    isInterrupt: false,
+    hasSource: merged.meta?.source != null,
+    effectiveText: merged.text
+  })) {
+    return;
+  }
+  const key = chatKey2(merged.chatId, merged.threadId != null ? Number(merged.threadId) : null);
+  trackDelivery(deliveryQueue, key, merged, Date.now(), merged.messageId != null ? String(merged.messageId) : null);
+}
 async function redeliverStrandedInbound(p) {
   const selfAgent = process.env.SWITCHROOM_AGENT_NAME ?? "";
   process.stderr.write(`telegram gateway: inbound strand (no enqueue ack) key=${p.key} \u2014 re-clearing composer + re-delivering
@@ -54455,7 +54551,8 @@ var ipcServer = createIpcServer({
           pendingInboundBuffer,
           inboundSpool: inboundSpool ?? null,
           pendingPermissionBuffer,
-          client: client3
+          client: client3,
+          onUserInboundDelivered: trackRedeliveredInbound
         });
       } else {
         const pending2 = pendingInboundBuffer.drain(client3.agentName);
@@ -54463,6 +54560,7 @@ var ipcServer = createIpcServer({
           try {
             client3.send(msg);
             inboundSpool?.ack(msg);
+            trackRedeliveredInbound(msg);
           } catch (err) {
             process.stderr.write(`telegram gateway: pending-inbound drain failed agent=${client3.agentName} source=${msg.meta?.source ?? "-"}: ${err.message}
 `);
@@ -54646,7 +54744,6 @@ var ipcServer = createIpcServer({
   onPermissionRequest(_client, msg) {
     const { requestId, toolName, description, inputPreview } = msg;
     pendingPermissions.set(requestId, { tool_name: toolName, description, input_preview: inputPreview, startedAt: Date.now() });
-    const access = loadAccess();
     const text = formatPermissionCardBody({
       toolName,
       inputPreview,
@@ -54656,20 +54753,14 @@ var ipcServer = createIpcServer({
     const showAlways = resolveScopedAllowChoices(toolName, inputPreview) != null;
     const keyboard = buildPermissionActionRow(requestId, showAlways);
     const activeTurn = currentTurn;
-    const permTopic = resolveAgentOutboundTopic({
-      kind: "permission",
-      turnInitiated: activeTurn != null,
-      originThreadId: activeTurn?.sessionThreadId
-    });
-    const permSupergroup = resolveAgentSupergroupChatId();
-    for (const chat_id of access.allowFrom) {
-      const permThread = topicForRecipient({ recipientChatId: chat_id, resolvedTopic: permTopic, supergroupChatId: permSupergroup });
-      bot.api.sendMessage(chat_id, text, {
+    const targets = resolvePermissionCardTargets();
+    for (const { chatId, threadId } of targets) {
+      retryWithThreadFallback(robustApiCall, (tid) => bot.api.sendMessage(chatId, text, {
         parse_mode: "HTML",
         reply_markup: keyboard,
-        ...permThread != null ? { message_thread_id: permThread } : {}
-      }).catch((e) => {
-        process.stderr.write(`telegram gateway: permission_request send to ${chat_id} failed: ${e}
+        ...tid != null ? { message_thread_id: tid } : {}
+      }), { threadId, chat_id: chatId, verb: "permission_request" }).catch((e) => {
+        process.stderr.write(`telegram gateway: permission_request send to ${chatId} failed: ${e}
 `);
       });
     }
@@ -55025,7 +55116,7 @@ if (!STATIC) {
       if (d)
         markClaudeBusyForInbound(m);
       return d;
-    }, inboundSpool);
+    }, inboundSpool, trackRedeliveredInbound);
     if (r != null && r.redelivered > 0) {
       process.stderr.write(`telegram gateway: idle-drain flushed ${r.redelivered}/${r.drained} buffered inbound for ${selfAgent}${r.rebuffered > 0 ? ` (${r.rebuffered} re-buffered)` : ""}
 `);

package/telegram-plugin/gateway/gateway.ts

@@ -1064,7 +1064,19 @@ try {
   const pending = findLatestTurnIfInterrupted(turnsDb)
   const selfAgent = process.env.SWITCHROOM_AGENT_NAME ?? ''
   if (pending != null && selfAgent) {
-    const kind = selectResumeBuilder(pending.ended_via)
+    // 3h staleness failsafe (operator spec, 2026-06-03): never AUTO-resume
+    // interrupted work older than RESUME_MAX_AGE_MS — selectResumeBuilder
+    // downgrades a stale 'resume' to the passive 'report' so the user is told
+    // ("I was working on X ~Nh ago") but nothing replays unprompted. Env
+    // override SWITCHROOM_RESUME_MAX_AGE_MS (ms); set very high to disable.
+    const RESUME_MAX_AGE_MS = (() => {
+      const v = Number(process.env.SWITCHROOM_RESUME_MAX_AGE_MS)
+      return Number.isFinite(v) && v > 0 ? v : 10_800_000 // 3h
+    })()
+    const kind = selectResumeBuilder(pending.ended_via, {
+      ageMs: Math.max(0, Date.now() - pending.started_at),
+      maxAgeMs: RESUME_MAX_AGE_MS,
+    })
     if (kind === 'resume') {
       bootResumeInbound = { agent: selfAgent, msg: buildResumeInterruptedInbound({ turn: pending }) }
     } else if (kind === 'report') {
@@ -1801,6 +1813,7 @@ function purgeReactionTracking(key: string, endingTurn?: CurrentTurn): void {
           return d
         },
         inboundSpool,
+        trackRedeliveredInbound,
       )
       if (fr.redelivered > 0) {
         process.stderr.write(
@@ -1896,6 +1909,7 @@ function releaseTurnBufferGate(key: string): void {
           return d
         },
         inboundSpool,
+        trackRedeliveredInbound,
       )
       if (fr.redelivered > 0) {
         process.stderr.write(
@@ -2240,6 +2254,47 @@ function resumeReactionAfterVerdict(): void {
     ?.setThinking()
 }
 
+/**
+ * The recipient set for a permission card (the initial Approve/Deny card
+ * AND the post-verdict resume message — they MUST route identically, so
+ * both go through this one helper).
+ *
+ * Turn-initiated (the normal case — a permission gate fires mid-tool-use
+ * with an active turn): send to the ORIGINATING chat+thread. For a
+ * supergroup-owned agent working in a forum topic that is the supergroup +
+ * the topic, so the card lands IN the topic the operator asked from (e.g.
+ * marko's "CRM (Brevo)" topic) — not the operator's DM. For a DM agent the
+ * originating chat IS the operator's DM (thread-less), unchanged.
+ *
+ * No active turn (cron / background / a swept turn at TTL): fall back to the
+ * configured operator DMs (`allowFrom`), thread-stripped via
+ * `topicForRecipient` so a DM never gets a `message_thread_id` (the 400
+ * "message thread not found" → auto-deny wedge, #2096).
+ *
+ * Before this helper the INITIAL card emitter iterated `allowFrom`
+ * unconditionally, so a supergroup card could only ever reach operator DMs —
+ * the topic chat id is never in `allowFrom`. The resume message already
+ * routed correctly; the card now matches it (marko, 2026-06-03).
+ */
+function resolvePermissionCardTargets(): Array<{ chatId: string; threadId: number | undefined }> {
+  const turn = currentTurn
+  if (turn != null) {
+    return [{ chatId: turn.sessionChatId, threadId: turn.sessionThreadId }]
+  }
+  const sg = resolveAgentSupergroupChatId()
+  const topic = resolveAgentOutboundTopic({
+    kind: 'permission',
+    turnInitiated: false,
+    originThreadId: undefined,
+  })
+  // allowFrom is normally operator DMs — attach the topic only to a
+  // recipient that owns it (the supergroup), never a DM (marko wedge).
+  return loadAccess().allowFrom.map(chatId => ({
+    chatId,
+    threadId: topicForRecipient({ recipientChatId: chatId, resolvedTopic: topic, supergroupChatId: sg }),
+  }))
+}
+
 /**
  * Post the agent-voiced "got your verdict — continuing" message the
  * instant the operator answers a permission card. Travels right beside
@@ -2269,24 +2324,7 @@ function postPermissionResumeMessage(opts: {
     action: opts.action,
     timeoutMinutes: opts.timeoutMinutes,
   })
-  const turn = currentTurn
-  const targets: Array<{ chatId: string; threadId: number | undefined }> =
-    turn != null
-      ? [{ chatId: turn.sessionChatId, threadId: turn.sessionThreadId }]
-      : (() => {
-          const sg = resolveAgentSupergroupChatId()
-          const topic = resolveAgentOutboundTopic({
-            kind: 'permission',
-            turnInitiated: false,
-            originThreadId: undefined,
-          })
-          // allowFrom is normally operator DMs — attach the topic only to a
-          // recipient that owns it (the supergroup), never a DM (marko wedge).
-          return loadAccess().allowFrom.map(chatId => ({
-            chatId,
-            threadId: topicForRecipient({ recipientChatId: chatId, resolvedTopic: topic, supergroupChatId: sg }),
-          }))
-        })()
+  const targets = resolvePermissionCardTargets()
   for (const { chatId, threadId } of targets) {
     // allow-raw-bot-api: wrapped in swallowingApiCall (retry policy); thread-aware send
     void swallowingApiCall(
@@ -4110,6 +4148,7 @@ silencePoke.startTimer({
         return d
       },
       inboundSpool,
+      trackRedeliveredInbound,
     )
     process.stderr.write(
       `telegram gateway: silence-poke framework-fallback ended wedged turn ` +
@@ -4139,6 +4178,45 @@ const _deliveryMachineTick = setInterval(() => {
 }, DELIVERY_MACHINE_TICK_MS)
 _deliveryMachineTick.unref?.()
 
+// Enrol a buffer-redelivered inbound in the deliver-until-acked queue so the
+// existing sweep re-delivers it until claude's `enqueue` ack lands. Wired into
+// EVERY redelivery path (bridgeUp drain, silence-poke fallback, flap/reply-gate
+// flushes) — `send` returning true only means the bytes reached the bridge, NOT
+// that claude consumed them. Right after a restart (esp. a slow MCP boot) the
+// inject can hit a not-ready session and be silently dropped, and nothing
+// retried it: the clerk 2026-06-03 lost-message incident. Mirrors the
+// live-delivery tracking at the handleInbound site (chatKey + messageId), so
+// DMs and supergroup forum topics are handled identically. Only real user
+// inbounds are tracked — shouldTrackDelivery excludes steer/interrupt/
+// synthetic-source/empty, which never produce an `enqueue` and would otherwise
+// re-deliver forever.
+function trackRedeliveredInbound(merged: InboundMessage): void {
+  if (!DELIVERY_CONFIRM_ENABLED) return
+  if (
+    !shouldTrackDelivery({
+      isSteering: false,
+      isInterrupt: false,
+      // Synthetic inbounds (cron / vault / handback / resume) carry a source
+      // and are NOT tracked here — they enqueue under their own semantics, and
+      // (for the resume synthetics) tracking them safely first needs the
+      // resume builder to emit meta.message_id so the deliver-until-acked ack
+      // matches its enqueue. Tracked separately as a follow-up (see PR notes).
+      hasSource: merged.meta?.source != null,
+      effectiveText: merged.text,
+    })
+  ) {
+    return
+  }
+  const key = chatKey(merged.chatId, merged.threadId != null ? Number(merged.threadId) : null)
+  trackDelivery(
+    deliveryQueue,
+    key,
+    merged,
+    Date.now(),
+    merged.messageId != null ? String(merged.messageId) : null,
+  )
+}
+
 // Re-deliver stranded inbounds until claude acks (the marko drop-wedge).
 // Every few seconds, re-send any inbound that was handed to claude but never
 // acked by an `enqueue` — it stranded unsubmitted in the composer. Re-clear
@@ -4376,6 +4454,11 @@ const ipcServer: IpcServer = createIpcServer({
           inboundSpool: inboundSpool ?? null,
           pendingPermissionBuffer,
           client,
+          // Enrol each drained user inbound in the deliver-until-acked queue
+          // so the 5s sweep re-delivers until claude's `enqueue` ack lands —
+          // a socket-write into a still-booting session is NOT consumption
+          // (clerk lost-message incident, 2026-06-03).
+          onUserInboundDelivered: trackRedeliveredInbound,
         })
       } else {
         // Kill-switch fallback: imperative drain (parity with pre-cutover
@@ -4386,6 +4469,10 @@ const ipcServer: IpcServer = createIpcServer({
           try {
             client.send(msg)
             inboundSpool?.ack(msg)
+            // Same enrol as the cutover drain path: a socket-write success is
+            // not proof claude consumed it — enrol so the sweep re-delivers
+            // until `enqueue` (clerk lost-message incident, 2026-06-03).
+            trackRedeliveredInbound(msg)
           } catch (err) {
             process.stderr.write(
               `telegram gateway: pending-inbound drain failed agent=${client.agentName} ` +
@@ -4665,7 +4752,6 @@ const ipcServer: IpcServer = createIpcServer({
   onPermissionRequest(_client: IpcClient, msg: PermissionRequestForward) {
     const { requestId, toolName, description, inputPreview } = msg
     pendingPermissions.set(requestId, { tool_name: toolName, description, input_preview: inputPreview, startedAt: Date.now() })
-    const access = loadAccess()
     // Natural-language card body — a plain sentence ("Gymbro wants to
     // edit: supplement-log.md" + a why-line), never a raw tool id.
     // The operator sees what is being requested and why at a glance.
@@ -4685,42 +4771,34 @@ const ipcServer: IpcServer = createIpcServer({
     // two-button row only.
     const showAlways = resolveScopedAllowChoices(toolName, inputPreview) != null
     const keyboard = buildPermissionActionRow(requestId, showAlways)
-    // PR4b emitter sweep — supergroup-mode permission card routing.
-    // Per CPO #3 the design is "turn-initiated requests follow the
-    // conversation topic; background requests go to admin alias."
-    // Permission requests come from the bridge mid-tool-use, so they
-    // are always turn-initiated in practice — the currently active
-    // turn's sessionThreadId is the originating topic. Fall back to
-    // admin alias when no active turn (cron / background path).
-    // Fleet-shared / DM agents see `undefined` → no
-    // `message_thread_id` is added → behavior unchanged.
-    // currentTurn is the singleton "claude is currently on this turn"
-    // pointer — per Framing 1 / PR3b scope-discovery, claude
-    // serializes so there's exactly one (or zero) active turn at any
-    // moment. When set, the permission request is in-flight for that
-    // turn and follows the originating topic.
+    // Route the card to the SAME place the post-verdict resume message
+    // lands (resolvePermissionCardTargets): the ORIGINATING chat+topic when
+    // there's an active turn — so a supergroup agent's card appears IN the
+    // topic the operator asked from (marko's "CRM (Brevo)"), not the
+    // operator DM — else the configured operator DMs, thread-stripped. The
+    // old code iterated `allowFrom` unconditionally, so a supergroup card
+    // could only ever reach operator DMs (the topic chat id is never in
+    // `allowFrom`) (marko, 2026-06-03).
     const activeTurn = currentTurn
-    const permTopic = resolveAgentOutboundTopic({
-      kind: 'permission',
-      turnInitiated: activeTurn != null,
-      originThreadId: activeTurn?.sessionThreadId,
-    })
-    const permSupergroup = resolveAgentSupergroupChatId()
-    for (const chat_id of access.allowFrom) {
-      // parse_mode=HTML pairs with formatPermissionCardBody (#1790)
-      // so the <b>/<i> tags render as formatting.
-      // The resolved topic is valid only in the agent's supergroup — attach
-      // it ONLY when this recipient IS that supergroup. allowFrom DMs get the
-      // card thread-less; attaching a topic to a DM yields 400 "message thread
-      // not found" → card never arrives → auto-deny → wedge (marko 2026-06-02).
-      const permThread = topicForRecipient({ recipientChatId: chat_id, resolvedTopic: permTopic, supergroupChatId: permSupergroup })
-      // allow-raw-bot-api: permission-request keyboard fan-out; topic-aware opts
-      void bot.api.sendMessage(chat_id, text, {
-        parse_mode: 'HTML',
-        reply_markup: keyboard,
-        ...(permThread != null ? { message_thread_id: permThread } : {}),
-      }).catch(e => {
-        process.stderr.write(`telegram gateway: permission_request send to ${chat_id} failed: ${e}\n`)
+    const targets = resolvePermissionCardTargets()
+    for (const { chatId, threadId } of targets) {
+      // parse_mode=HTML pairs with formatPermissionCardBody (#1790) so the
+      // <b>/<i> tags render. retryWithThreadFallback: if the topic was
+      // deleted/recreated (stale thread id → 400 "message thread not
+      // found"), re-send thread-less into the main chat so the card still
+      // ARRIVES rather than vanishing → 10-min TTL auto-deny → wedge.
+      // allow-raw-bot-api: wrapped in retryWithThreadFallback (retry policy); topic-aware send
+      void retryWithThreadFallback<{ message_id: number }>(
+        robustApiCall,
+        (tid) =>
+          bot.api.sendMessage(chatId, text, {
+            parse_mode: 'HTML',
+            reply_markup: keyboard,
+            ...(tid != null ? { message_thread_id: tid } : {}),
+          }),
+        { threadId, chat_id: chatId, verb: 'permission_request' },
+      ).catch(e => {
+        process.stderr.write(`telegram gateway: permission_request send to ${chatId} failed: ${e}\n`)
       })
     }
     // Park the turn's status reaction on 🙏 (awaiting your tap) and
@@ -5303,6 +5381,7 @@ if (!STATIC) {
         return d
       },
       inboundSpool,
+      trackRedeliveredInbound,
     )
     if (r != null && r.redelivered > 0) {
       process.stderr.write(

package/telegram-plugin/gateway/inbound-delivery-machine-dispatch.ts

@@ -45,6 +45,15 @@ export interface DispatchCtx {
   readonly client?: IpcClient
   /** Optional log sink — default stderr. Test hook. */
   readonly log?: (line: string) => void
+  /**
+   * Optional: enrol a drained+redelivered inbound in the deliver-until-acked
+   * queue. The bridgeUp drain's socket-write "success" is NOT proof claude
+   * consumed the message — right after a restart (esp. with a slow MCP boot)
+   * the inject can hit a not-ready session and be dropped. Wiring this makes
+   * the existing 5s sweep re-deliver until claude's `enqueue` ack lands.
+   * (clerk lost-message incident, 2026-06-03.)
+   */
+  readonly onUserInboundDelivered?: (merged: InboundMessage) => void
 }
 
 const enabled = process.env.SWITCHROOM_DELIVERY_MACHINE_CUTOVER !== '0'
@@ -103,6 +112,9 @@ function dispatchOne(effect: Effect, ctx: DispatchCtx): void {
         ctx.selfAgent,
         send,
         ctx.inboundSpool ?? undefined,
+        ctx.onUserInboundDelivered
+          ? (merged) => ctx.onUserInboundDelivered!(merged)
+          : undefined,
       )
       if (result.drained > 0) {
         log(

package/telegram-plugin/gateway/pending-inbound-buffer.ts

@@ -87,6 +87,14 @@ export function redeliverBufferedInbound(
   agent: string,
   send: (msg: InboundMessage) => boolean,
   spool?: InboundSpool,
+  // Called once per merged group on CONFIRMED delivery (after spool.ack).
+  // The caller uses it to enrol the redelivered inbound in the
+  // deliver-until-acked queue (`trackDelivery`) so it is re-sent until
+  // claude's `enqueue` ack lands — closing the restart boot-race where a
+  // socket-write "succeeds" into a not-ready session and the message is
+  // silently dropped (clerk 2026-06-03). `send` returning true only means
+  // the bytes reached the bridge, NOT that claude consumed them.
+  onDelivered?: (merged: InboundMessage, originals: InboundMessage[]) => void,
 ): { drained: number; redelivered: number; rebuffered: number } {
   const pending = buffer.drain(agent)
   let redelivered = 0
@@ -110,6 +118,10 @@ export function redeliverBufferedInbound(
       // originals are, so we ack by original identity.
       for (const o of originals) spool?.ack(o)
       redelivered += originals.length
+      // Enrol in the deliver-until-acked queue (caller's hook). A bare
+      // socket-write success is NOT proof claude consumed it; the queue's
+      // sweep re-delivers until the `enqueue` ack lands.
+      onDelivered?.(merged, originals)
     } else {
       // Re-buffer the originals (not the merged synthetic) so the spool
       // identity is preserved and the next drain re-merges them losslessly.
@@ -258,11 +270,15 @@ export function idleDrainTick(
   isBridgeAlive: () => boolean,
   send: (msg: InboundMessage) => boolean,
   spool?: InboundSpool,
+  // Forwarded to redeliverBufferedInbound so the post-flap-settle drain also
+  // enrols redelivered inbounds in the deliver-until-acked queue (parity with
+  // the bridgeUp drain — clerk lost-message incident, 2026-06-03).
+  onDelivered?: (merged: InboundMessage, originals: InboundMessage[]) => void,
 ): { drained: number; redelivered: number; rebuffered: number } | null {
   if (!agent) return null
   if (buffer.depth(agent) === 0) return null
   if (!isBridgeAlive()) return null
-  return redeliverBufferedInbound(buffer, agent, send, spool)
+  return redeliverBufferedInbound(buffer, agent, send, spool, onDelivered)
 }
 
 export function createPendingInboundBuffer(

package/telegram-plugin/gateway/resume-inbound-builder.ts

@@ -172,9 +172,25 @@ export function buildResumeWatchdogReportInbound(
  */
 export function selectResumeBuilder(
   endedVia: TurnEndedVia | null,
+  // 3h staleness failsafe (operator spec, 2026-06-03): when the interrupted
+  // turn is older than `maxAgeMs`, an AUTO-resume is downgraded to the passive
+  // `report` — silently re-injecting hours-old work could act on long-stale
+  // context (a tax figure, a "send it" the user has moved on from). Pass both
+  // to enable; omit (default) keeps the legacy blanket-resume behaviour.
+  opts?: { ageMs?: number; maxAgeMs?: number },
 ): 'resume' | 'report' | null {
-  if (endedVia === 'timeout') return 'report'
-  if (endedVia === 'restart' || endedVia === 'sigterm' || endedVia === 'unknown') return 'resume'
-  if (endedVia == null) return 'resume' // still-open at boot = killed mid-flight
-  return null
+  let kind: 'resume' | 'report' | null
+  if (endedVia === 'timeout') kind = 'report'
+  else if (endedVia === 'restart' || endedVia === 'sigterm' || endedVia === 'unknown') kind = 'resume'
+  else if (endedVia == null) kind = 'resume' // still-open at boot = killed mid-flight
+  else kind = null
+  if (
+    kind === 'resume' &&
+    opts?.ageMs != null &&
+    opts?.maxAgeMs != null &&
+    opts.ageMs > opts.maxAgeMs
+  ) {
+    return 'report' // too old to safely auto-resume — passive notice only
+  }
+  return kind
 }

package/telegram-plugin/permission-title.ts

@@ -19,10 +19,21 @@
 
 import { basename } from "node:path";
 import { prettyMcpServer, type ScopeOption } from "./permission-rule.js";
+import { redact } from "./secret-detect/redact.js";
 
 const COMMAND_TITLE_MAX = 48;
 const DESCRIPTION_LINE_MAX = 240;
 
+/** HTTP methods the generic REST-wrapper MCP tools (brevo/meta/postiz/… via
+ *  rest-server.mjs) expose as verbs — uppercased on the card so the operator
+ *  reads "POST /smtp/email" as an API write, not "post". */
+const HTTP_VERBS = new Set(["get", "post", "put", "patch", "delete", "head"]);
+/** Keys that, on a REST-style MCP input, name the resource/endpoint. */
+const RESOURCE_KEYS = ["path", "endpoint", "url", "resource", "route"];
+const ARG_SUMMARY_MAX_KEYS = 4; // how many payload keys to surface on the card
+const ARG_VALUE_MAX = 40; // per-value truncation in the arg-summary line
+const ARG_SUMMARY_LINE_MAX = 180; // total cap for the arg-summary line
+
 /**
  * Human verb-phrases for switchroom-managed MCP tools. The raw
  * `mcp__<server>__<tool>` name is operator-hostile. Phrases are written
@@ -104,6 +115,14 @@ export function formatPermissionCardBody(opts: {
       : `why: <i>not provided</i>`,
   );
 
+  // Third line (REST-wrapper MCP writes only): a redaction-safe summary of
+  // the payload so the operator can see WHAT is being sent, not just the
+  // endpoint — e.g. "↳ to: lisa@…, subject: Priority access…".
+  const argSummary = mcpArgSummary(opts.toolName, opts.inputPreview);
+  if (argSummary) {
+    lines.push(`↳ <i>${escapeTgHtml(argSummary)}</i>`);
+  }
+
   return lines.join("\n");
 }
 
@@ -171,7 +190,6 @@ function naturalMcpAction(
   toolName: string,
   input: Record<string, unknown> | null,
 ): string {
-  void input;
   const parts = toolName.split("__");
   const server = parts.length >= 2 ? parts[1]! : "";
   const curated = MCP_TOOL_DESCRIPTIONS[toolName];
@@ -183,6 +201,15 @@ function naturalMcpAction(
   }
   if (parts.length >= 3) {
     const verb = parts.slice(2).join("__").replace(/_/g, " ");
+    // External REST-wrapper tools (brevo/meta/postiz/…) take a `path`. Name
+    // the endpoint so "post (Brevo)" becomes "POST /smtp/email (Brevo)" —
+    // the operator can see WHICH resource is being written, not just that
+    // *something* is. Internal servers + tools without a resource key keep
+    // the plain verb phrasing.
+    if (!INTERNAL_MCP_SERVERS.has(server)) {
+      const resourcePhrase = restResourcePhrase(server, verb, input);
+      if (resourcePhrase) return resourcePhrase;
+    }
     return INTERNAL_MCP_SERVERS.has(server)
       ? verb
       : `${verb} (${prettyMcpServer(server)})`;
@@ -190,6 +217,78 @@ function naturalMcpAction(
   return `use ${toolName}`;
 }
 
+/**
+ * For a REST-wrapper MCP call ({ path, body?, query? }), build the action
+ * phrase "<VERB> <path> (<Server>)" — e.g. "POST /smtp/email (Brevo)". The
+ * path is redaction-passed + length-capped before display. Returns null
+ * when the input carries no recognizable resource key (caller falls back to
+ * the plain verb phrasing).
+ */
+function restResourcePhrase(
+  server: string,
+  verb: string,
+  input: Record<string, unknown> | null,
+): string | null {
+  if (!input) return null;
+  let path: string | null = null;
+  for (const key of RESOURCE_KEYS) {
+    path = readString(input, key);
+    if (path) break;
+  }
+  if (!path) return null;
+  const v = HTTP_VERBS.has(verb.toLowerCase()) ? verb.toUpperCase() : verb;
+  const shownPath = truncate(redact(path), COMMAND_TITLE_MAX);
+  return `${v} ${shownPath} (${prettyMcpServer(server)})`;
+}
+
+/**
+ * A compact, redaction-safe one-line summary of a REST-wrapper MCP call's
+ * payload ({ body } for writes, { query } for reads) — the third card line.
+ * Shows up to {@link ARG_SUMMARY_MAX_KEYS} payload keys with short, masked
+ * scalar values ("to: lisa@…, subject: Priority access…"); nested
+ * objects/arrays surface as the bare key name (no value dump — avoids
+ * leaking PII/secrets and oversized blobs). Every value passes through
+ * `redact()` so an API key in the payload is masked, never surfaced.
+ * Returns null when there's nothing meaningful to show.
+ */
+function mcpArgSummary(
+  toolName: string,
+  inputPreview: string | undefined,
+): string | null {
+  if (!toolName.startsWith("mcp__")) return null;
+  // Internal servers (agent-config / hostd / hindsight / telegram) use flat
+  // input schemas, not the REST `body`/`query` convention — and we don't
+  // endpoint-enrich their title line either, so keep the summary line off
+  // them too (redact() still runs, so this is intent-match, not a leak fix).
+  const server = toolName.split("__")[1] ?? "";
+  if (INTERNAL_MCP_SERVERS.has(server)) return null;
+  const input = parseInput(inputPreview);
+  if (!input) return null;
+  const payload = input.body ?? input.query;
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
+    return null;
+  }
+  const parts: string[] = [];
+  for (const [key, value] of Object.entries(payload as Record<string, unknown>)) {
+    if (parts.length >= ARG_SUMMARY_MAX_KEYS) {
+      parts.push("…");
+      break;
+    }
+    if (value == null) continue;
+    if (typeof value === "object") {
+      parts.push(key); // nested object/array → key name only, never dumped
+      continue;
+    }
+    const shown = truncate(redact(String(value)), ARG_VALUE_MAX);
+    parts.push(`${key}: ${shown}`);
+  }
+  if (parts.length === 0) return null;
+  const joined = parts.join(", ");
+  return joined.length > ARG_SUMMARY_LINE_MAX
+    ? joined.slice(0, ARG_SUMMARY_LINE_MAX - 1) + "…"
+    : joined;
+}
+
 /**
  * Confirmation phrase describing a grant that just landed, derived from
  * the *scope option the operator chose* — so an always-allow's breadth

package/telegram-plugin/tests/pending-inbound-buffer.test.ts

@@ -220,6 +220,33 @@ describe('redeliverBufferedInbound — wedge-clear self-heal (fleet-update incid
     expect(calls).toBe(0)
   })
 
+  // onDelivered: the deliver-until-acked enrol hook (clerk lost-message
+  // incident 2026-06-03). A socket-write "success" is not proof claude
+  // consumed it; the caller uses onDelivered to enrol the redelivered inbound
+  // in the deliver-until-acked queue so the sweep re-delivers until `enqueue`.
+  it('calls onDelivered for each CONFIRMED-delivered group (per merged identity)', () => {
+    const buf = createPendingInboundBuffer({ log: () => {} })
+    buf.push('klanker', inbound('user', 1))
+    buf.push('klanker', inbound('cron', 2)) // source-tagged → its own group
+    const delivered: number[] = []
+    const r = redeliverBufferedInbound(buf, 'klanker', () => true, undefined, (merged) => {
+      delivered.push(merged.messageId as number)
+    })
+    expect(r.redelivered).toBe(2)
+    expect(delivered).toEqual([1, 2]) // fired once per group, carrying the merged identity
+  })
+
+  it('does NOT call onDelivered for a group that failed to send (re-buffered, not enrolled)', () => {
+    const buf = createPendingInboundBuffer({ log: () => {} })
+    buf.push('klanker', inbound('user', 1))
+    const delivered: number[] = []
+    const r = redeliverBufferedInbound(buf, 'klanker', () => false, undefined, (m) =>
+      delivered.push(m.messageId as number),
+    )
+    expect(r.rebuffered).toBe(1)
+    expect(delivered).toEqual([]) // never enrolled — buffer/spool still own it
+  })
+
   it('only touches the named agent', () => {
     const buf = createPendingInboundBuffer({ log: () => {} })
     buf.push('klanker', inbound('user', 1))

package/telegram-plugin/tests/permission-card-routing.test.ts

@@ -0,0 +1,77 @@
+/**
+ * Structural pin for permission-card topic routing.
+ *
+ * The bug (marko, 2026-06-03): the INITIAL Approve/Deny card emitter
+ * (`onPermissionRequest`) iterated `access.allowFrom` unconditionally as its
+ * recipient set. For a supergroup-owned agent, `allowFrom` holds only the
+ * operator DM user-ids — the supergroup chat id is never in it — so a
+ * permission card raised from a forum topic could ONLY ever land in the
+ * operator's DM, never in the topic the operator asked from. The
+ * post-verdict resume message already routed correctly (to the turn's
+ * originating chat+thread); the card did not.
+ *
+ * The fix routes BOTH the card and the resume through one shared helper,
+ * `resolvePermissionCardTargets()`, so they can't drift: turn-initiated →
+ * the originating chat+topic; no active turn → operator DMs, thread-stripped
+ * via topicForRecipient (the DM-thread 400 / auto-deny guard, #2096).
+ *
+ * gateway.ts is not unit-importable (top-level side effects), so this is a
+ * source-text pin in the same style as permission-verdict-resume-guard.ts.
+ * The routing *logic* (topicForRecipient / resolveAgentOutboundTopic) is
+ * unit-tested in src/telegram/topic-router.test.ts; the end-to-end
+ * "card lands in the topic" is covered by the supergroup UAT. This guards
+ * the wiring: that the card uses the shared helper and never reverts to the
+ * raw allowFrom fan-out.
+ */
+
+import { describe, it, expect } from 'vitest'
+import { readFileSync } from 'node:fs'
+import { fileURLToPath } from 'node:url'
+import { dirname, resolve } from 'node:path'
+
+const __dirname = dirname(fileURLToPath(import.meta.url))
+const GATEWAY_SRC = readFileSync(
+  resolve(__dirname, '..', 'gateway', 'gateway.ts'),
+  'utf8',
+)
+
+/** Slice the body of the `onPermissionRequest` IPC handler — from its header
+ *  to the next handler method (`onHeartbeat`). */
+function onPermissionRequestBody(): string {
+  const start = GATEWAY_SRC.indexOf('onPermissionRequest(')
+  expect(start).toBeGreaterThan(-1)
+  const rest = GATEWAY_SRC.slice(start)
+  const end = rest.indexOf('onHeartbeat(')
+  expect(end).toBeGreaterThan(-1)
+  return rest.slice(0, end)
+}
+
+describe('permission card routing', () => {
+  it('the shared target helper exists', () => {
+    expect(
+      /function\s+resolvePermissionCardTargets\s*\(/.test(GATEWAY_SRC),
+    ).toBe(true)
+  })
+
+  it('the initial card emitter routes via resolvePermissionCardTargets()', () => {
+    expect(onPermissionRequestBody()).toContain('resolvePermissionCardTargets()')
+  })
+
+  it('the initial card emitter no longer iterates access.allowFrom directly (the bug shape)', () => {
+    // The raw fan-out loop is what sent supergroup cards to operator DMs.
+    expect(onPermissionRequestBody()).not.toMatch(
+      /for\s*\(\s*const\s+chat_id\s+of\s+access\.allowFrom\s*\)/,
+    )
+  })
+
+  it('the card send is wrapped in retryWithThreadFallback (stale-topic → thread-less, not a silent drop)', () => {
+    expect(onPermissionRequestBody()).toContain('retryWithThreadFallback')
+  })
+
+  it('the resume message uses the SAME helper, so card + resume cannot drift', () => {
+    const start = GATEWAY_SRC.indexOf('function postPermissionResumeMessage(')
+    expect(start).toBeGreaterThan(-1)
+    const body = GATEWAY_SRC.slice(start, start + 1400)
+    expect(body).toContain('resolvePermissionCardTargets()')
+  })
+})

package/telegram-plugin/tests/permission-title.test.ts

@@ -87,6 +87,35 @@ describe('naturalAction — MCP tools', () => {
       'list files (Google Workspace)',
     )
   })
+
+  // Clarity fix: REST-wrapper MCP tools (brevo/meta/postiz via rest-server.mjs)
+  // take a `path` — surface it so "post (Brevo)" becomes "POST /smtp/email
+  // (Brevo)" and the operator can see WHICH endpoint is being written.
+  test('REST-wrapper write names the endpoint with an uppercased HTTP verb', () => {
+    expect(
+      naturalAction('mcp__brevo__post', JSON.stringify({ path: '/smtp/email', body: { to: 'x' } })),
+    ).toBe('POST /smtp/email (Brevo)')
+    expect(
+      naturalAction('mcp__brevo__put', JSON.stringify({ path: '/contacts/123', body: {} })),
+    ).toBe('PUT /contacts/123 (Brevo)')
+  })
+
+  test('REST-wrapper read surfaces the path too', () => {
+    expect(
+      naturalAction('mcp__brevo__get', JSON.stringify({ path: '/contacts', query: { limit: 10 } })),
+    ).toBe('GET /contacts (Brevo)')
+  })
+
+  test('falls back to the plain verb phrase when there is no resource key', () => {
+    // No path → today's behavior, unchanged (defensive for unknown shapes).
+    expect(naturalAction('mcp__brevo__post', undefined)).toBe('post (Brevo)')
+    expect(naturalAction('mcp__brevo__post', JSON.stringify({ foo: 1 }))).toBe('post (Brevo)')
+  })
+
+  test('internal REST-ish tool is NOT endpoint-enriched (stays a bare verb)', () => {
+    // hostd is internal → no "(Server)" tag, no path enrichment.
+    expect(naturalAction('mcp__hostd__do_thing', JSON.stringify({ path: '/x' }))).toBe('do thing')
+  })
 })
 
 describe('formatPermissionCardBody', () => {
@@ -156,6 +185,56 @@ describe('formatPermissionCardBody', () => {
     })
     expect(body).toContain('why: <i>first second paragraph</i>')
   })
+
+  // Clarity fix: the card gains a third "↳" line summarizing the REST
+  // payload so the operator can see WHAT is being written, not just the
+  // endpoint. Values are redaction-passed + truncated; nested objects show
+  // as a bare key name.
+  test('REST write card: endpoint in the title + a payload summary line', () => {
+    const body = formatPermissionCardBody({
+      toolName: 'mcp__brevo__post',
+      inputPreview: JSON.stringify({
+        path: '/smtp/email',
+        body: { subject: 'Priority access', templateId: 12, to: [{ email: 'lisa@example.com' }] },
+      }),
+      description: 'HIGH RISK: write to the brevo API (POST).',
+      agentName: 'marko',
+    })
+    const lines = body.split('\n')
+    expect(lines[0]).toBe('🔐 <b>Marko</b> wants to POST /smtp/email (Brevo)')
+    expect(lines[1]).toBe('why: <i>HIGH RISK: write to the brevo API (POST).</i>')
+    // Third line: scalar keys show value; the nested `to` array shows key-only.
+    expect(lines[2]).toContain('↳')
+    expect(lines[2]).toContain('subject: Priority access')
+    expect(lines[2]).toContain('templateId: 12')
+    expect(lines[2]).toContain('to') // key-only, not the email object dumped
+    expect(lines[2]).not.toContain('lisa@example.com')
+  })
+
+  test('no payload → no third line (DM / non-REST cards unchanged)', () => {
+    const body = formatPermissionCardBody({
+      toolName: 'Edit',
+      inputPreview: JSON.stringify({ file_path: '/a/b.md' }),
+      description: 'edit it',
+      agentName: 'clerk',
+    })
+    expect(body.split('\n')).toHaveLength(2)
+    expect(body).not.toContain('↳')
+  })
+
+  test('redaction is load-bearing: a token in the payload is masked, never shown', () => {
+    // Build the fake token at runtime so the source file never holds a
+    // contiguous token literal (repo push-protection rule).
+    const fakeToken = 'sk-ant-' + 'api03-' + 'A'.repeat(48)
+    const body = formatPermissionCardBody({
+      toolName: 'mcp__brevo__post',
+      inputPreview: JSON.stringify({ path: '/contacts', body: { apiKey: fakeToken, name: 'Lisa' } }),
+      description: 'create a contact',
+      agentName: 'marko',
+    })
+    expect(body).not.toContain(fakeToken)
+    expect(body).toContain('name: Lisa') // benign value still surfaces
+  })
 })
 
 describe('describeGrant — phrased from the chosen scope', () => {

package/telegram-plugin/tests/resume-inbound-builder.test.ts

@@ -179,4 +179,23 @@ describe('selectResumeBuilder', () => {
       expect(selectResumeBuilder(endedVia)).toBe(expected)
     })
   }
+
+  // 3h staleness failsafe (operator spec, 2026-06-03).
+  const MAX = 10_800_000 // 3h
+  it('downgrades a fresh resume to report when older than maxAgeMs (no auto-resume of stale work)', () => {
+    expect(selectResumeBuilder('restart', { ageMs: MAX + 1, maxAgeMs: MAX })).toBe('report')
+    expect(selectResumeBuilder(null, { ageMs: MAX + 60_000, maxAgeMs: MAX })).toBe('report')
+  })
+  it('keeps resume when within maxAgeMs', () => {
+    expect(selectResumeBuilder('restart', { ageMs: MAX - 1, maxAgeMs: MAX })).toBe('resume')
+    expect(selectResumeBuilder('sigterm', { ageMs: 1000, maxAgeMs: MAX })).toBe('resume')
+  })
+  it('age cap never UPGRADES — report/null stay as-is regardless of age', () => {
+    expect(selectResumeBuilder('timeout', { ageMs: MAX + 1, maxAgeMs: MAX })).toBe('report')
+    expect(selectResumeBuilder('stop', { ageMs: MAX + 1, maxAgeMs: MAX })).toBe(null)
+  })
+  it('legacy behaviour preserved when age/maxAge omitted (blanket resume)', () => {
+    expect(selectResumeBuilder('restart')).toBe('resume')
+    expect(selectResumeBuilder('restart', { ageMs: MAX + 1 })).toBe('resume') // needs BOTH to cap
+  })
 })