switchroom 0.15.0 → 0.15.2

package/telegram-plugin/dist/gateway/gateway.js

@@ -16160,7 +16160,7 @@ function decodeResponse(line) {
   }
   return ResponseSchema.parse(parsed);
 }
-var MAX_FRAME_BYTES, PROTOCOL_VERSION = 1, ProviderNameSchema, GetCredentialsRequestSchema, ListStateRequestSchema, SetActiveRequestSchema, MarkExhaustedRequestSchema, RefreshAccountRequestSchema, AnthropicCredentialsSchema, GoogleCredentialsSchema, MicrosoftCredentialsSchema, ProviderCredentialsSchema, AddAccountRequestSchema, RmAccountRequestSchema, SetOverrideRequestSchema, ListGoogleAccountsRequestSchema, ListMicrosoftAccountsRequestSchema, ProbeQuotaRequestSchema, RequestSchema, GetCredentialsDataSchema, AccountStateSchema, AgentStateSchema, ConsumerStateSchema, ListStateDataSchema, SetActiveDataSchema, MarkExhaustedDataSchema, RefreshAccountDataSchema, AddAccountDataSchema, RmAccountDataSchema, SetOverrideDataSchema, GoogleAccountStateSchema, ListGoogleAccountsDataSchema, MicrosoftAccountStateSchema, ListMicrosoftAccountsDataSchema, ErrorBodySchema, SuccessResponseSchema, ErrorResponseSchema, ResponseSchema;
+var MAX_FRAME_BYTES, PROTOCOL_VERSION = 1, ProviderNameSchema, GetCredentialsRequestSchema, ListStateRequestSchema, SetActiveRequestSchema, MarkExhaustedRequestSchema, RefreshAccountRequestSchema, AnthropicCredentialsSchema, GoogleCredentialsSchema, MicrosoftCredentialsSchema, ProviderCredentialsSchema, AddAccountRequestSchema, RmAccountRequestSchema, SetOverrideRequestSchema, ListGoogleAccountsRequestSchema, ListMicrosoftAccountsRequestSchema, ProbeQuotaRequestSchema, ClaimNotificationRequestSchema, RequestSchema, GetCredentialsDataSchema, AccountStateSchema, AgentStateSchema, ConsumerStateSchema, ListStateDataSchema, SetActiveDataSchema, MarkExhaustedDataSchema, RefreshAccountDataSchema, AddAccountDataSchema, RmAccountDataSchema, SetOverrideDataSchema, ClaimNotificationDataSchema, GoogleAccountStateSchema, ListGoogleAccountsDataSchema, MicrosoftAccountStateSchema, ListMicrosoftAccountsDataSchema, ErrorBodySchema, SuccessResponseSchema, ErrorResponseSchema, ResponseSchema;
 var init_protocol = __esm(() => {
   init_zod();
   MAX_FRAME_BYTES = 64 * 1024;
@@ -16276,6 +16276,13 @@ var init_protocol = __esm(() => {
     accounts: exports_external.array(exports_external.string().min(1)).min(1).max(32),
     timeoutMs: exports_external.number().int().positive().max(60000).optional()
   });
+  ClaimNotificationRequestSchema = exports_external.object({
+    v: exports_external.literal(PROTOCOL_VERSION),
+    op: exports_external.literal("claim-notification"),
+    id: exports_external.string().min(1),
+    key: exports_external.string().min(1).max(512),
+    windowMs: exports_external.number().int().positive().max(86400000)
+  });
   RequestSchema = exports_external.discriminatedUnion("op", [
     GetCredentialsRequestSchema,
     ListStateRequestSchema,
@@ -16287,7 +16294,8 @@ var init_protocol = __esm(() => {
     SetOverrideRequestSchema,
     ListGoogleAccountsRequestSchema,
     ListMicrosoftAccountsRequestSchema,
-    ProbeQuotaRequestSchema
+    ProbeQuotaRequestSchema,
+    ClaimNotificationRequestSchema
   ]);
   GetCredentialsDataSchema = exports_external.object({
     account: exports_external.string(),
@@ -16343,6 +16351,9 @@ var init_protocol = __esm(() => {
     agent: exports_external.string(),
     account: exports_external.string().nullable()
   });
+  ClaimNotificationDataSchema = exports_external.object({
+    granted: exports_external.boolean()
+  });
   GoogleAccountStateSchema = exports_external.object({
     account: exports_external.string(),
     expiresAt: exports_external.number(),
@@ -16524,6 +16535,16 @@ class AuthBrokerClient {
     const data = await this.send(req);
     return data;
   }
+  async claimNotification(key, windowMs) {
+    const data = await this.send({
+      v: PROTOCOL_VERSION,
+      id: randomUUID3(),
+      op: "claim-notification",
+      key,
+      windowMs
+    });
+    return data;
+  }
   async refreshAccount(account) {
     const data = await this.send({
       v: PROTOCOL_VERSION,
@@ -24173,6 +24194,7 @@ var init_schema = __esm(() => {
     dangerous_mode: exports_external.boolean().optional().describe("If true, include --dangerously-skip-permissions in start.sh"),
     network_isolation: NetworkIsolationSchema,
     admin: exports_external.boolean().optional().describe("If true, the agent's Telegram gateway intercepts admin slash commands " + "(/agents, /logs, /restart, /delete, /update, /auth, /reconcile, etc.) " + "locally before forwarding to Claude. Commands are handled silently \u2014 " + "Claude never sees them. Requires the agent to use the switchroom-telegram " + "plugin. When false or absent, all messages pass through to Claude unchanged."),
+    root: exports_external.boolean().optional().describe("If true, this is a ROOT-tier debugging agent: a root-privileged " + "container (runs as uid 0, mounts /var/run/docker.sock, the whole " + "~/.switchroom tree, and the host root filesystem at /host) so you " + "can DM it to debug the whole fleet \u2014 read any agent's logs, " + "docker exec into peers, edit host files \u2014 instead of SSHing into " + "the host as root. Implies admin: true (all admin slash commands). " + "Standing root power, audited via the agent's own session transcript " + "and shell history; there is no per-action approval tap. Per-agent " + "only (never set at defaults/profile layers). Grant to exactly one " + "trusted operator-private agent \u2014 it ingests other agents' output, " + "which is attacker-influenced text. See docs/root-agent.md."),
     settings_raw: exports_external.record(exports_external.string(), exports_external.unknown()).optional().describe("Escape hatch: raw object deep-merged into the generated " + "settings.json as the final step. Use for Claude Code settings " + "keys switchroom doesn't wrap directly (e.g. effort, apiKeyHelper). " + "Power-user-only \u2014 prefer the typed fields when they exist."),
     claude_md_raw: exports_external.string().optional().describe("Escape hatch: markdown text appended verbatim to CLAUDE.md on " + "initial scaffold. Not re-applied on reconcile (CLAUDE.md is " + "user-protected). Use for one-off persona tuning that isn't " + "worth a template."),
     cli_args: exports_external.array(exports_external.string()).optional().describe("Escape hatch: extra arguments appended to the `exec claude` " + "invocation in start.sh. Use for Claude Code CLI flags switchroom " + "doesn't expose directly (e.g. --effort high, " + "--exclude-dynamic-system-prompt-sections)."),
@@ -30611,7 +30633,8 @@ function buildSnapshotsFromCachedState(state4) {
       isActive: acc.label === state4.active,
       quota: reviveLastQuota(lq),
       quotaError: lq ? undefined : "no cached quota (no probe since broker start)",
-      expiresAtMs: acc.expiresAt
+      expiresAtMs: acc.expiresAt,
+      capturedAtMs: lq?.capturedAt
     };
   });
 }
@@ -40687,17 +40710,31 @@ function renderShowText(state3, now = Date.now(), opts = {}) {
 `);
 }
 function formatAccountsTable(state3, now) {
-  const rows = [["ACCOUNT", "STATUS", "EXPIRES", "QUOTA-RESET"]];
+  const rows = [["ACCOUNT", "STATUS", "EXPIRES", "QUOTA 5h\u00b77d", "QUOTA-RESET"]];
   for (const acc of state3.accounts) {
     const isActive = acc.label === state3.active;
     const marker = isActive ? "\u25cf" : acc.exhausted ? "!" : "\u2713";
     const status = isActive ? "active" : acc.exhausted ? "exhausted" : "available";
     const expires = acc.expiresAt != null ? formatRelativeMs(acc.expiresAt - now) : "\u2014";
     const quotaReset = acc.exhausted && acc.exhausted_until != null && acc.exhausted_until > now ? formatRelativeMs(acc.exhausted_until - now) : "\u2014";
-    rows.push([`${marker} ${escapeHtml3(acc.label)}`, status, expires, quotaReset]);
+    rows.push([
+      `${marker} ${escapeHtml3(acc.label)}`,
+      status,
+      expires,
+      formatQuotaUtilCell(acc, now),
+      quotaReset
+    ]);
   }
   return alignTable(rows);
 }
+function formatQuotaUtilCell(acc, now) {
+  const lq = acc.last_quota;
+  if (!lq)
+    return "no data";
+  const age = now - lq.capturedAt;
+  const ageStr = age > 0 ? formatRelativeMs(age) : "0s";
+  return `${Math.round(lq.fiveHourUtilizationPct)}%\u00b7${Math.round(lq.sevenDayUtilizationPct)}% (${ageStr} ago)`;
+}
 function formatAgentsTable(state3) {
   const rows = [["AGENT", "ACTIVE", "SOURCE"]];
   for (const a of state3.agents) {
@@ -40801,7 +40838,8 @@ function createAuthBrokerClient() {
     rmAccount: (label) => broker.rmAccount(label),
     refreshAccount: (label) => broker.refreshAccount(label),
     setOverride: (agent, account) => broker.setOverride(agent, account),
-    probeQuota: (accounts, timeoutMs) => broker.probeQuota(accounts, timeoutMs)
+    probeQuota: (accounts, timeoutMs) => broker.probeQuota(accounts, timeoutMs),
+    claimNotification: (key, windowMs) => broker.claimNotification(key, windowMs)
   };
   return { client: client3, close: () => broker.close() };
 }
@@ -41215,6 +41253,16 @@ class AuthBrokerClient2 {
     const data = await this.send(req);
     return data;
   }
+  async claimNotification(key, windowMs) {
+    const data = await this.send({
+      v: PROTOCOL_VERSION,
+      id: randomUUID4(),
+      op: "claim-notification",
+      key,
+      windowMs
+    });
+    return data;
+  }
   async refreshAccount(account) {
     const data = await this.send({
       v: PROTOCOL_VERSION,
@@ -42085,6 +42133,22 @@ function escHtml2(text) {
 }
 
 // auto-fallback-fleet.ts
+function renderFallbackFailureNotice(triggerAgent, reason) {
+  return `\u26a0\ufe0f <b>Auto-failover could not run</b> (trigger: <b>${escFailureHtml(triggerAgent)}</b>)
+` + `${escFailureHtml(reason)}
+
+` + `<i>Switch manually with <code>/auth use &lt;label&gt;</code>, or <code>/auth</code> for fleet status.</i>`;
+}
+function escFailureHtml(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+var FALLBACK_FAILURE_NOTICE_COOLDOWN_MS = 30 * 60000;
+function evaluateFallbackFailureNotice(prev, now, cooldownMs = FALLBACK_FAILURE_NOTICE_COOLDOWN_MS) {
+  if (now - prev.lastSentAtMs >= cooldownMs) {
+    return { send: true, next: { lastSentAtMs: now } };
+  }
+  return { send: false, next: prev };
+}
 async function runFleetAutoFallback(deps) {
   const now = deps.now ?? new Date;
   const tz = deps.tz ?? "UTC";
@@ -42979,6 +43043,7 @@ var TELEGRAM_MENU_COMMANDS = [
   { command: "version", description: "Show versions + running agent health" },
   { command: "logs", description: "Show recent agent logs" },
   { command: "inject", description: "Inject a Claude Code slash command (e.g. /cost)" },
+  { command: "model", description: "Show or switch the Claude model" },
   { command: "doctor", description: "Health check (deps, services, MCP)" },
   { command: "usage", description: "Pro/Max plan quota (5h + 7d windows)" },
   { command: "vault", description: "Manage vault secrets + capability grants" },
@@ -43018,6 +43083,8 @@ function switchroomHelpText(agentName3) {
     `<code>/auth list [agent]</code> \u2014 list account slots and health`,
     `<code>/auth use [agent] &lt;slot&gt;</code> \u2014 switch active slot and restart`,
     `<code>/auth rm [agent] &lt;slot&gt; [--force]</code> \u2014 remove a slot`,
+    `<code>/model</code> \u2014 show the configured Claude model`,
+    `<code>/model &lt;name&gt;</code> \u2014 switch the live session's model (opus \u00b7 sonnet \u00b7 haiku or a full id; until restart)`,
     `<code>/topics</code> \u2014 topic-to-agent mappings`,
     `<code>/permissions [agent]</code> \u2014 show agent permissions`,
     `<code>/grant &lt;tool&gt;</code> \u2014 grant a tool permission`,
@@ -44748,6 +44815,106 @@ Allowed: <code>${deps.escapeHtml(allow)}</code>`, { html: true });
   await deps.reply(ctx, finalText, { html: true, accent });
 }
 
+// gateway/model-command.ts
+var MODEL_ALIASES = ["opus", "sonnet", "haiku", "default"];
+var MODEL_ARG_RE = /^[A-Za-z0-9][A-Za-z0-9._\[\]-]{0,99}$/;
+function isValidModelArg(arg) {
+  return MODEL_ARG_RE.test(arg);
+}
+function parseModelCommand(text) {
+  const m = text.match(/^\/model(?:@[A-Za-z0-9_]+)?(?:\s+([\s\S]*))?$/);
+  if (!m)
+    return null;
+  const rest = (m[1] ?? "").trim();
+  if (rest.length === 0)
+    return { kind: "show" };
+  const parts = rest.split(/\s+/);
+  if (parts.length > 1) {
+    return { kind: "help", reason: "model takes a single argument" };
+  }
+  const arg = parts[0];
+  if (arg.toLowerCase() === "help")
+    return { kind: "help" };
+  if (!isValidModelArg(arg)) {
+    return { kind: "help", reason: `not a valid model name: ${arg}` };
+  }
+  return { kind: "set", model: arg };
+}
+var PERSIST_NOTE = "<i>Session-only \u2014 lasts until restart. To persist, set <code>model:</code> in switchroom.yaml and restart.</i>";
+function helpText2(deps, reason) {
+  const lines = [];
+  if (reason)
+    lines.push(`\u26a0\ufe0f ${deps.escapeHtml(reason)}`);
+  lines.push("<b>/model</b> \u2014 show or switch the Claude model", "<code>/model</code> \u2014 show the configured model", `<code>/model &lt;name&gt;</code> \u2014 switch the live session (${MODEL_ALIASES.map((a) => `<code>${a}</code>`).join(" \u00b7 ")} or a full model id)`, PERSIST_NOTE);
+  return { text: lines.join(`
+`), html: true };
+}
+async function handleModelCommand(parsed, deps) {
+  if (parsed.kind === "help")
+    return helpText2(deps, parsed.reason);
+  if (parsed.kind === "show") {
+    const configured = deps.getConfiguredModel();
+    const shown = configured && configured.length > 0 ? configured : "default";
+    return {
+      text: [
+        `<b>Model \u2014 ${deps.escapeHtml(deps.getAgentName())}</b>`,
+        `Configured: <code>${deps.escapeHtml(shown)}</code>`,
+        `Switch the live session: ${MODEL_ALIASES.map((a) => `<code>/model ${a}</code>`).join(" \u00b7 ")}`,
+        "or <code>/model &lt;full-model-id&gt;</code>",
+        PERSIST_NOTE
+      ].join(`
+`),
+      html: true
+    };
+  }
+  if (!isValidModelArg(parsed.model)) {
+    return helpText2(deps, `not a valid model name: ${parsed.model}`);
+  }
+  const verbHtml = `<code>/model ${deps.escapeHtml(parsed.model)}</code>`;
+  let result;
+  try {
+    result = await deps.inject(deps.getAgentName(), `/model ${parsed.model}`);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return {
+      text: `\u274c ${verbHtml} \u2014 inject failed: ${deps.escapeHtml(msg)}`,
+      html: true
+    };
+  }
+  if (result.outcome === "ok") {
+    return {
+      text: [
+        `${verbHtml}`,
+        deps.preBlock(result.output),
+        ...result.truncated ? ["<i>truncated</i>"] : [],
+        PERSIST_NOTE
+      ].join(`
+`),
+      html: true
+    };
+  }
+  if (result.outcome === "ok_no_output") {
+    return {
+      text: [
+        `${verbHtml} \u2014 sent, but no response captured. The agent may be mid-turn; check <code>/inject /status</code> to confirm the active model.`,
+        PERSIST_NOTE
+      ].join(`
+`),
+      html: true
+    };
+  }
+  if (result.errorCode === "session_missing") {
+    return {
+      text: "\u274c tmux session not found \u2014 the agent must be running under the tmux supervisor (the default). Remove <code>experimental.legacy_pty: true</code> if set.",
+      html: true
+    };
+  }
+  return {
+    text: `\u274c ${verbHtml} \u2014 ${deps.escapeHtml(result.errorMessage ?? "inject failed")}`,
+    html: true
+  };
+}
+
 // ../src/config/loader.ts
 init_dist();
 init_zod();
@@ -52727,9 +52894,35 @@ function emptyQuotaWatchState() {
 function emptyAccountState() {
   return { lastNotifiedHealth: null, lastNotifiedAt: 0 };
 }
+var DEFAULT_QUOTA_WATCH_MAX_STALE_MS = 60 * 60000;
+var DEFAULT_QUOTA_WATCH_LATE_RECOVERY_MS = 6 * 60 * 60000;
+var QUOTA_WATCH_CLAIM_WINDOW_MS = 30 * 60000;
+function resolveQuotaWatchTuning(env) {
+  const num = (raw, fallback) => {
+    if (raw === undefined || raw === "")
+      return fallback;
+    const n = Number(raw);
+    return Number.isFinite(n) && n >= 0 ? n : fallback;
+  };
+  return {
+    maxStaleMs: num(env.SWITCHROOM_QUOTA_WATCH_MAX_STALE_MS, DEFAULT_QUOTA_WATCH_MAX_STALE_MS),
+    lateRecoveryMs: num(env.SWITCHROOM_QUOTA_WATCH_LATE_RECOVERY_MS, DEFAULT_QUOTA_WATCH_LATE_RECOVERY_MS),
+    fleetDedup: env.SWITCHROOM_QUOTA_WATCH_FLEET_DEDUP !== "0",
+    sendOnProbeFail: env.SWITCHROOM_QUOTA_WATCH_SEND_ON_PROBE_FAIL === "1"
+  };
+}
+function buildQuotaClaimKey(accountLabel, transition2, chatId) {
+  return `quota-watch:${accountLabel}:${transition2}:${chatId}`;
+}
 function evaluateQuotaWatchAccount(args) {
   const { agentName: agentName3, snap, prev, now } = args;
+  const bootTick = args.bootTick ?? false;
+  const maxStaleMs = args.tuning?.maxStaleMs ?? 0;
+  const lateRecoveryMs = args.tuning?.lateRecoveryMs ?? 0;
   const label = snap.label;
+  if (maxStaleMs > 0 && snap.capturedAtMs !== undefined && now - snap.capturedAtMs > maxStaleMs) {
+    return { kind: "skip", accountLabel: label, reason: "stale-snapshot" };
+  }
   const currentHealth = classifyHealth(snap);
   if (currentHealth === "unknown" || currentHealth === "blocked") {
     return { kind: "skip", accountLabel: label, reason: `${currentHealth}-not-our-domain` };
@@ -52756,6 +52949,24 @@ function evaluateQuotaWatchAccount(args) {
       lastNotifiedHealth: "healthy",
       lastNotifiedAt: now
     };
+    if (bootTick) {
+      return {
+        kind: "reconcile",
+        accountLabel: label,
+        newAccountState: newState,
+        transition: "recovered-to-healthy",
+        reason: "boot-tick-recovery"
+      };
+    }
+    if (lateRecoveryMs > 0 && now - prev.lastNotifiedAt > lateRecoveryMs) {
+      return {
+        kind: "reconcile",
+        accountLabel: label,
+        newAccountState: newState,
+        transition: "recovered-to-healthy",
+        reason: "late-recovery"
+      };
+    }
     return {
       kind: "notify",
       accountLabel: label,
@@ -52971,10 +53182,10 @@ function readTurnActiveMarkerAgeMs(stateDir, now) {
 }
 
 // ../src/build-info.ts
-var VERSION = "0.15.0";
-var COMMIT_SHA = "5841c1d5";
-var COMMIT_DATE = "2026-06-09T23:17:14Z";
-var LATEST_PR = 2253;
+var VERSION = "0.15.2";
+var COMMIT_SHA = "95461524";
+var COMMIT_DATE = "2026-06-10T02:48:01Z";
+var LATEST_PR = 2260;
 var COMMITS_AHEAD_OF_TAG = 0;
 
 // gateway/boot-version.ts
@@ -60618,6 +60829,23 @@ bot.command("inject", async (ctx) => {
     formatOutput: formatSwitchroomOutput
   });
 });
+bot.command("model", async (ctx) => {
+  if (!isAuthorizedSender(ctx))
+    return;
+  const text = ctx.message?.text ?? ctx.channelPost?.text ?? "";
+  const parsed = parseModelCommand(text) ?? { kind: "show" };
+  const reply = await handleModelCommand(parsed, {
+    inject: injectSlashCommand,
+    getAgentName: getMyAgentName,
+    getConfiguredModel: () => {
+      const data = switchroomExecJson(["agent", "list"]);
+      return data?.agents?.find((a) => a.name === getMyAgentName())?.model ?? null;
+    },
+    escapeHtml: escapeHtmlForTg,
+    preBlock
+  });
+  await switchroomReply(ctx, reply.text, { html: reply.html });
+});
 bot.command("agentstart", async (ctx) => {
   if (!isAuthorizedSender(ctx))
     return;
@@ -61156,12 +61384,32 @@ async function fireFleetAutoFallback(triggerAgent, untilMs) {
 `);
   });
 }
+var fallbackFailureNoticeState = { lastSentAtMs: 0 };
+function broadcastFleetFallbackFailure(triggerAgent, reason) {
+  if (process.env.SWITCHROOM_FLEET_FALLBACK_FAILURE_NOTICE === "0")
+    return;
+  const verdict = evaluateFallbackFailureNotice(fallbackFailureNoticeState, Date.now());
+  if (!verdict.send) {
+    process.stderr.write(`telegram gateway: [fleet-fallback] failure notice suppressed (cooldown) agent=${triggerAgent}: ${reason}
+`);
+    return;
+  }
+  fallbackFailureNoticeState = verdict.next;
+  const access = loadAccess();
+  if (access.allowFrom.length === 0)
+    return;
+  const html = renderFallbackFailureNotice(triggerAgent, reason);
+  for (const chat_id of access.allowFrom) {
+    swallowingApiCall(() => bot.api.sendMessage(chat_id, html, { parse_mode: "HTML" }), { chat_id, verb: "fleet-fallback:failure-notify" });
+  }
+}
 async function doFireFleetAutoFallback(triggerAgent, untilMs) {
   try {
     const client3 = await getAuthBrokerClient(triggerAgent);
     if (!client3) {
       process.stderr.write(`telegram gateway: [fleet-fallback] skipped agent=${triggerAgent} reason=no-broker-client
 `);
+      broadcastFleetFallbackFailure(triggerAgent, "auth-broker unreachable (no client).");
       return false;
     }
     const state4 = await client3.listState();
@@ -61194,6 +61442,7 @@ async function doFireFleetAutoFallback(triggerAgent, untilMs) {
   } catch (err) {
     process.stderr.write(`telegram gateway: [fleet-fallback] error agent=${triggerAgent}: ${err?.message ?? err}
 `);
+    broadcastFleetFallbackFailure(triggerAgent, err?.message ?? String(err));
     return false;
   }
 }
@@ -61230,9 +61479,21 @@ async function runCreditWatch() {
 `);
   }
 }
-async function runQuotaWatch() {
+async function claimQuotaNotification(brokerClient, key) {
+  try {
+    const res = await brokerClient.claimNotification(key, QUOTA_WATCH_CLAIM_WINDOW_MS);
+    return res.granted;
+  } catch (err) {
+    process.stderr.write(`telegram gateway: quota-watch: claim failed (fail-open): ${err}
+`);
+    return true;
+  }
+}
+async function runQuotaWatch(opts = {}) {
   const agentName3 = getMyAgentName();
   const stateDir = STATE_DIR;
+  const bootTick = opts.bootTick ?? false;
+  const tuning = resolveQuotaWatchTuning(process.env);
   const brokerClient = await getAuthBrokerClient(agentName3);
   if (!brokerClient) {
     process.stderr.write(`telegram gateway: quota-watch: broker client unavailable \u2014 skipping
@@ -61263,6 +61524,14 @@ async function runQuotaWatch() {
     });
     if (fleetDecision.kind === "notify") {
       for (const chat_id of access.allowFrom) {
+        if (tuning.fleetDedup) {
+          const granted = await claimQuotaNotification(brokerClient, buildQuotaClaimKey(FLEET_ALL_EXHAUSTED_KEY, fleetDecision.transition, chat_id));
+          if (!granted) {
+            process.stderr.write(`telegram gateway: quota-watch: fleet-all-exhausted claim denied chat=${chat_id} \u2014 another agent notified
+`);
+            continue;
+          }
+        }
         await swallowingApiCall(() => bot.api.sendMessage(chat_id, fleetDecision.message, {
           parse_mode: "HTML",
           link_preview_options: { is_disabled: true }
@@ -61281,10 +61550,17 @@ async function runQuotaWatch() {
   }
   const pendingTransitions = [];
   const labelToSnapIndex = new Map(snapshots.map((s, i) => [s.label, i]));
+  let reconciledCount = 0;
+  let mutatedState = watchState;
   for (const snap of snapshots) {
     const prev = watchState[snap.label] ?? emptyAccountState();
-    const decision = evaluateQuotaWatchAccount({ agentName: agentName3, snap, prev, now });
-    if (decision.kind !== "skip") {
+    const decision = evaluateQuotaWatchAccount({ agentName: agentName3, snap, prev, now, bootTick, tuning });
+    if (decision.kind === "reconcile") {
+      mutatedState = patchQuotaWatchState(mutatedState, decision.accountLabel, decision.newAccountState);
+      reconciledCount++;
+      process.stderr.write(`telegram gateway: quota-watch: reconciled ${decision.transition} for account=${decision.accountLabel} (${decision.reason}) \u2014 no notification
+`);
+    } else if (decision.kind !== "skip") {
       pendingTransitions.push({
         accountLabel: snap.label,
         snapIndex: labelToSnapIndex.get(snap.label) ?? -1,
@@ -61293,6 +61569,14 @@ async function runQuotaWatch() {
     }
   }
   if (pendingTransitions.length === 0) {
+    if (reconciledCount > 0) {
+      try {
+        saveQuotaWatchState(stateDir, mutatedState);
+      } catch (err) {
+        process.stderr.write(`telegram gateway: quota-watch state persist failed: ${err}
+`);
+      }
+    }
     return;
   }
   const crossingLabels = pendingTransitions.map((t) => t.accountLabel);
@@ -61305,8 +61589,20 @@ async function runQuotaWatch() {
   } catch (err) {
     process.stderr.write(`telegram gateway: quota-watch: probe for crossing accounts failed: ${err}
 `);
+    if (!tuning.sendOnProbeFail) {
+      if (reconciledCount > 0) {
+        try {
+          saveQuotaWatchState(stateDir, mutatedState);
+        } catch (saveErr) {
+          process.stderr.write(`telegram gateway: quota-watch state persist failed: ${saveErr}
+`);
+        }
+      }
+      process.stderr.write(`telegram gateway: quota-watch: deferring ${pendingTransitions.length} notification(s) until probe succeeds
+`);
+      return;
+    }
   }
-  let mutatedState = watchState;
   const notifications = [];
   for (const { accountLabel, snapIndex, decision } of pendingTransitions) {
     const freshResult = freshProbeMap.get(accountLabel);
@@ -61314,25 +61610,55 @@ async function runQuotaWatch() {
     if (decision.kind !== "notify")
       continue;
     if (freshResult && freshResult.ok && snapIndex >= 0) {
-      const enrichedSnap = { ...snapshots[snapIndex], quota: freshResult.data };
+      const enrichedSnap = { ...snapshots[snapIndex], quota: freshResult.data, capturedAtMs: undefined };
       const prev = watchState[accountLabel] ?? emptyAccountState();
-      const re = evaluateQuotaWatchAccount({ agentName: agentName3, snap: enrichedSnap, prev, now });
+      const re = evaluateQuotaWatchAccount({ agentName: agentName3, snap: enrichedSnap, prev, now, bootTick, tuning });
       if (re.kind === "notify" && re.transition === decision.transition) {
         enrichedDecision = re;
+      } else if (re.kind === "reconcile") {
+        mutatedState = patchQuotaWatchState(mutatedState, accountLabel, re.newAccountState);
+        reconciledCount++;
+        process.stderr.write(`telegram gateway: quota-watch: reconciled ${re.transition} for account=${accountLabel} (${re.reason}) \u2014 no notification
+`);
+        continue;
       } else if (re.kind === "skip") {
         continue;
       }
+    } else if (!tuning.sendOnProbeFail) {
+      process.stderr.write(`telegram gateway: quota-watch: probe unavailable for account=${accountLabel} \u2014 deferring notification
+`);
+      continue;
     }
     if (enrichedDecision.kind !== "notify")
       continue;
-    notifications.push({ message: enrichedDecision.message, accountLabel });
+    notifications.push({
+      message: enrichedDecision.message,
+      accountLabel,
+      transition: enrichedDecision.transition
+    });
     mutatedState = patchQuotaWatchState(mutatedState, accountLabel, enrichedDecision.newAccountState);
   }
   if (notifications.length === 0) {
+    if (reconciledCount > 0) {
+      try {
+        saveQuotaWatchState(stateDir, mutatedState);
+      } catch (err) {
+        process.stderr.write(`telegram gateway: quota-watch state persist failed: ${err}
+`);
+      }
+    }
     return;
   }
-  for (const { message, accountLabel } of notifications) {
+  for (const { message, accountLabel, transition: transition2 } of notifications) {
     for (const chat_id of access.allowFrom) {
+      if (tuning.fleetDedup) {
+        const granted = await claimQuotaNotification(brokerClient, buildQuotaClaimKey(accountLabel, transition2, chat_id));
+        if (!granted) {
+          process.stderr.write(`telegram gateway: quota-watch: claim denied account=${accountLabel} chat=${chat_id} \u2014 another agent notified
+`);
+          continue;
+        }
+      }
       await swallowingApiCall(() => bot.api.sendMessage(chat_id, message, {
         parse_mode: "HTML",
         link_preview_options: { is_disabled: true }
@@ -61399,7 +61725,7 @@ bot.command("connect", async (ctx) => {
   try {
     const cfg = loadConfig2();
     const me = cfg?.agents?.[getMyAgentName()];
-    isAdmin2 = me?.admin === true;
+    isAdmin2 = me?.admin === true || me?.root === true;
   } catch {}
   if (!isAuthAdmin({ isAdmin: isAdmin2 })) {
     await switchroomReply(ctx, `<b>Not authorized.</b> <code>/connect</code> requires this agent to have <code>admin: true</code> in switchroom.yaml.`, { html: true });
@@ -61488,7 +61814,7 @@ bot.command("auth", async (ctx) => {
   try {
     const cfg = loadConfig2();
     const me = cfg?.agents?.[currentAgent];
-    isAdmin2 = me?.admin === true;
+    isAdmin2 = me?.admin === true || me?.root === true;
   } catch {}
   const chatId = String(ctx.chat?.id ?? "");
   if (parsed.kind === "add" || parsed.kind === "cancel") {
@@ -64661,7 +64987,7 @@ var didOneTimeSetup = false;
         const QUOTA_WATCH_POLL_MS = Number(process.env.SWITCHROOM_QUOTA_WATCH_POLL_MS ?? 900000);
         if (QUOTA_WATCH_POLL_MS > 0) {
           setTimeout(() => {
-            runQuotaWatch().catch((err) => {
+            runQuotaWatch({ bootTick: true }).catch((err) => {
               process.stderr.write(`telegram gateway: quota-watch initial run failed: ${err}
 `);
             });

package/telegram-plugin/gateway/auth-broker-client.ts

@@ -34,6 +34,8 @@ export function createAuthBrokerClient(): {
       broker.setOverride(agent, account),
     probeQuota: (accounts: readonly string[], timeoutMs?: number) =>
       broker.probeQuota(accounts, timeoutMs),
+    claimNotification: (key: string, windowMs: number) =>
+      broker.claimNotification(key, windowMs),
   }
   return { client, close: () => broker.close() }
 }

package/telegram-plugin/gateway/auth-command.ts

@@ -238,6 +238,13 @@ export interface AuthBrokerClient {
     accounts: readonly string[],
     timeoutMs?: number,
   ): Promise<{ results: Array<{ label: string; result: import('../quota-check.js').QuotaResult }> }>
+  /**
+   * Fleet notification-dedup claim (quota-watch). First caller of `key`
+   * inside `windowMs` gets `granted: true` and sends; everyone else
+   * stays silent. Callers fail OPEN on error (skewed-rollout brokers
+   * reject the op at the protocol layer).
+   */
+  claimNotification(key: string, windowMs: number): Promise<{ granted: boolean }>
 }
 
 export interface AuthCommandContext {
@@ -778,7 +785,7 @@ export function renderShowText(
 }
 
 function formatAccountsTable(state: ListStateData, now: number): string {
-  const rows: string[][] = [['ACCOUNT', 'STATUS', 'EXPIRES', 'QUOTA-RESET']]
+  const rows: string[][] = [['ACCOUNT', 'STATUS', 'EXPIRES', 'QUOTA 5h·7d', 'QUOTA-RESET']]
   for (const acc of state.accounts) {
     const isActive = acc.label === state.active
     const marker = isActive
@@ -792,11 +799,37 @@ function formatAccountsTable(state: ListStateData, now: number): string {
       acc.exhausted && acc.exhausted_until != null && acc.exhausted_until > now
         ? formatRelativeMs(acc.exhausted_until - now)
         : '—'
-    rows.push([`${marker} ${escapeHtml(acc.label)}`, status, expires, quotaReset])
+    rows.push([
+      `${marker} ${escapeHtml(acc.label)}`,
+      status,
+      expires,
+      formatQuotaUtilCell(acc, now),
+      quotaReset,
+    ])
   }
   return alignTable(rows)
 }
 
+/**
+ * Cached-utilization cell for the legacy accounts table. Honesty fix
+ * (2026-06-09 incident follow-up): the table previously rendered ONLY
+ * the broker exhausted flag, so a 99%-utilized account read
+ * "available —" — and an agent parroting the table under-reported. Now
+ * shows the broker's cached 5h·7d utilization with its age, and
+ * distinguishes "no data" (never probed) from "not exhausted".
+ * Cached, not live: the (age) suffix is the staleness disclosure.
+ */
+export function formatQuotaUtilCell(
+  acc: { last_quota?: { fiveHourUtilizationPct: number; sevenDayUtilizationPct: number; capturedAt: number } | null },
+  now: number,
+): string {
+  const lq = acc.last_quota
+  if (!lq) return 'no data'
+  const age = now - lq.capturedAt
+  const ageStr = age > 0 ? formatRelativeMs(age) : '0s'
+  return `${Math.round(lq.fiveHourUtilizationPct)}%·${Math.round(lq.sevenDayUtilizationPct)}% (${ageStr} ago)`
+}
+
 function formatAgentsTable(state: ListStateData): string {
   const rows: string[][] = [['AGENT', 'ACTIVE', 'SOURCE']]
   for (const a of state.agents) {