switchroom 0.16.22 → 0.16.24

package/dist/host-control/main.js

@@ -22587,7 +22587,7 @@ import { existsSync as existsSync6, readFileSync as readFileSync4 } from "node:f
 import { dirname as dirname4, join as join2 } from "node:path";
 
 // src/build-info.ts
-var VERSION = "0.16.22";
+var VERSION = "0.16.23";
 
 // src/cli/resolve-version.ts
 function readPackageVersion() {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "switchroom",
-  "version": "0.16.22",
-  "description": "Run Claude Code 24/7 on your Claude Pro/Max subscription over Telegram. Open-source alternative to OpenClaw and NanoClaw — no API keys.",
+  "version": "0.16.24",
+  "description": "Run Claude Code 24/7 on your Claude Pro/Max subscription over Telegram. Open-source alternative to OpenClaw and NanoClaw \u2014 no API keys.",
   "type": "module",
   "bin": {
     "switchroom": "./dist/cli/switchroom.js"
@@ -23,9 +23,9 @@
     "build": "node scripts/build.mjs",
     "build:cli": "node scripts/build.mjs && bun build --compile --target=bun-linux-x64 --minify bin/switchroom.ts --outfile switchroom-linux-amd64",
     "pretest": "npm run build",
-    "test": "vitest run && bun test telegram-plugin/tests/history.test.ts telegram-plugin/tests/cross-turn-card-gate.test.ts telegram-plugin/tests/emission-authority-open-gate.test.ts telegram-plugin/tests/emission-authority-ping-gate.test.ts telegram-plugin/tests/emission-authority-card-drain-gate.test.ts telegram-plugin/tests/per-topic-current-turn.test.ts telegram-plugin/tests/history-reaper.test.ts telegram-plugin/tests/ipc-server-client.test.ts telegram-plugin/tests/ipc-server-race.test.ts telegram-plugin/tests/gateway-bridge.test.ts telegram-plugin/tests/gateway-startup-mutex.test.ts telegram-plugin/tests/gateway-clean-shutdown-marker.test.ts telegram-plugin/tests/boot-card-dedupe.test.ts telegram-plugin/tests/boot-card-reason.test.ts telegram-plugin/tests/progress-update.test.ts telegram-plugin/tests/quota-cache.test.ts telegram-plugin/tests/silent-reply-guard.test.ts telegram-plugin/tests/unhandled-rejection-policy.test.ts telegram-plugin/tests/registry-turns.test.ts telegram-plugin/registry/subagents.test.ts telegram-plugin/registry/subagents-bugs.test.ts telegram-plugin/tests/subagent-watcher-parent-turn-key.test.ts telegram-plugin/tests/turns-writer.test.ts telegram-plugin/tests/resume-inbound-builder.test.ts telegram-plugin/registry/api-registry.test.ts telegram-plugin/registry/turns-schema.test.ts telegram-plugin/tests/idle-footer-wiring.test.ts telegram-plugin/tests/subagent-tracker-hooks.test.ts telegram-plugin/tests/resolve-calling-subagent.test.ts telegram-plugin/tests/gateway-update-placeholder-dispatch.test.ts telegram-plugin/tests/reaction-trigger.test.ts telegram-plugin/tests/reaction-trigger-flow.test.ts telegram-plugin/gateway/webhook-ingest-server.test.ts",
+    "test": "vitest run && bun test telegram-plugin/tests/history.test.ts telegram-plugin/tests/cross-turn-card-gate.test.ts telegram-plugin/tests/emission-authority-open-gate.test.ts telegram-plugin/tests/emission-authority-ping-gate.test.ts telegram-plugin/tests/emission-authority-card-drain-gate.test.ts telegram-plugin/tests/per-topic-current-turn.test.ts telegram-plugin/tests/history-reaper.test.ts telegram-plugin/tests/ipc-server-client.test.ts telegram-plugin/tests/ipc-server-race.test.ts telegram-plugin/tests/gateway-bridge.test.ts telegram-plugin/tests/gateway-startup-mutex.test.ts telegram-plugin/tests/gateway-clean-shutdown-marker.test.ts telegram-plugin/tests/boot-card-dedupe.test.ts telegram-plugin/tests/boot-card-reason.test.ts telegram-plugin/tests/progress-update.test.ts telegram-plugin/tests/quota-cache.test.ts telegram-plugin/tests/silent-reply-guard.test.ts telegram-plugin/tests/unhandled-rejection-policy.test.ts telegram-plugin/tests/registry-turns.test.ts telegram-plugin/registry/subagents.test.ts telegram-plugin/registry/subagents-bugs.test.ts telegram-plugin/tests/subagent-watcher-parent-turn-key.test.ts telegram-plugin/tests/turns-writer.test.ts telegram-plugin/tests/resume-inbound-builder.test.ts telegram-plugin/registry/api-registry.test.ts telegram-plugin/registry/turns-schema.test.ts telegram-plugin/tests/idle-footer-wiring.test.ts telegram-plugin/tests/subagent-tracker-hooks.test.ts telegram-plugin/tests/resolve-calling-subagent.test.ts telegram-plugin/tests/gateway-update-placeholder-dispatch.test.ts telegram-plugin/tests/reaction-trigger.test.ts telegram-plugin/tests/reaction-trigger-flow.test.ts telegram-plugin/gateway/webhook-ingest-server.test.ts telegram-plugin/tests/skill-proposal-card.test.ts",
     "test:vitest": "vitest run",
-    "test:bun": "bun test src/watchdog/state.test.ts src/watchdog/policy.test.ts src/vault/grants.test.ts src/vault/write-grants.test.ts src/vault/broker/server-grants.test.ts src/vault/broker/server-write-grants.test.ts src/vault/broker/server-mint-grant-passphrase-attest.test.ts src/vault/broker/server-passphrase-attest.test.ts src/vault/broker/server-mint-grant-posture-attest.test.ts src/vault/broker/server-admin-only-keys.test.ts src/vault/broker/client-token.test.ts src/vault/broker/server-unlock.test.ts src/vault/broker/auto-unlock.test.ts src/vault/broker/drift-detection.test.ts tests/vault-broker-passphrase.test.ts src/cli/vault-get-broker.test.ts src/vault/resolver-via-broker.test.ts src/vault/broker/scope.test.ts src/vault/broker/server.test.ts src/litellm/provision-apply-e2e.test.ts src/drive/disconnect.test.ts src/drive/grants.test.ts src/drive/oauth.test.ts src/drive/onboarding.test.ts src/drive/reconciler.test.ts src/drive/vault-slots.test.ts src/drive/wrapper.test.ts src/vault/approvals/kernel.test.ts src/vault/approvals/approval-origin.test.ts src/vault/approvals/schema-idempotent.test.ts src/vault/broker/server-approvals.test.ts telegram-plugin/tests/boot-probes.test.ts telegram-plugin/tests/boot-version-string.test.ts telegram-plugin/tests/history.test.ts telegram-plugin/tests/cross-turn-card-gate.test.ts telegram-plugin/tests/emission-authority-open-gate.test.ts telegram-plugin/tests/emission-authority-ping-gate.test.ts telegram-plugin/tests/emission-authority-card-drain-gate.test.ts telegram-plugin/tests/per-topic-current-turn.test.ts telegram-plugin/tests/history-reaper.test.ts telegram-plugin/tests/ipc-server-client.test.ts telegram-plugin/tests/ipc-server-race.test.ts telegram-plugin/tests/gateway-bridge.test.ts telegram-plugin/tests/gateway-startup-mutex.test.ts telegram-plugin/tests/gateway-clean-shutdown-marker.test.ts telegram-plugin/tests/boot-card-dedupe.test.ts telegram-plugin/tests/boot-card-reason.test.ts telegram-plugin/tests/progress-update.test.ts telegram-plugin/tests/quota-cache.test.ts telegram-plugin/tests/silent-reply-guard.test.ts telegram-plugin/tests/unhandled-rejection-policy.test.ts telegram-plugin/tests/registry-turns.test.ts telegram-plugin/registry/subagents.test.ts telegram-plugin/registry/subagents-bugs.test.ts telegram-plugin/tests/subagent-watcher-parent-turn-key.test.ts telegram-plugin/tests/turns-writer.test.ts telegram-plugin/tests/resume-inbound-builder.test.ts telegram-plugin/tests/subagent-tracker-hooks.test.ts telegram-plugin/tests/resolve-calling-subagent.test.ts telegram-plugin/tests/gateway-update-placeholder-dispatch.test.ts telegram-plugin/tests/reaction-trigger.test.ts telegram-plugin/tests/reaction-trigger-flow.test.ts telegram-plugin/tests/subagent-watcher-workflow-visibility.test.ts telegram-plugin/uat/load-env.test.ts telegram-plugin/uat/feed-matcher.test.ts telegram-plugin/gateway/webhook-ingest-server.test.ts",
+    "test:bun": "bun test src/watchdog/state.test.ts src/watchdog/policy.test.ts src/vault/grants.test.ts src/vault/write-grants.test.ts src/vault/broker/server-grants.test.ts src/vault/broker/server-write-grants.test.ts src/vault/broker/server-mint-grant-passphrase-attest.test.ts src/vault/broker/server-passphrase-attest.test.ts src/vault/broker/server-mint-grant-posture-attest.test.ts src/vault/broker/server-admin-only-keys.test.ts src/vault/broker/client-token.test.ts src/vault/broker/server-unlock.test.ts src/vault/broker/auto-unlock.test.ts src/vault/broker/drift-detection.test.ts tests/vault-broker-passphrase.test.ts src/cli/vault-get-broker.test.ts src/vault/resolver-via-broker.test.ts src/vault/broker/scope.test.ts src/vault/broker/server.test.ts src/litellm/provision-apply-e2e.test.ts src/drive/disconnect.test.ts src/drive/grants.test.ts src/drive/oauth.test.ts src/drive/onboarding.test.ts src/drive/reconciler.test.ts src/drive/vault-slots.test.ts src/drive/wrapper.test.ts src/vault/approvals/kernel.test.ts src/vault/approvals/approval-origin.test.ts src/vault/approvals/schema-idempotent.test.ts src/vault/broker/server-approvals.test.ts telegram-plugin/tests/boot-probes.test.ts telegram-plugin/tests/boot-version-string.test.ts telegram-plugin/tests/history.test.ts telegram-plugin/tests/cross-turn-card-gate.test.ts telegram-plugin/tests/emission-authority-open-gate.test.ts telegram-plugin/tests/emission-authority-ping-gate.test.ts telegram-plugin/tests/emission-authority-card-drain-gate.test.ts telegram-plugin/tests/per-topic-current-turn.test.ts telegram-plugin/tests/history-reaper.test.ts telegram-plugin/tests/ipc-server-client.test.ts telegram-plugin/tests/ipc-server-race.test.ts telegram-plugin/tests/gateway-bridge.test.ts telegram-plugin/tests/gateway-startup-mutex.test.ts telegram-plugin/tests/gateway-clean-shutdown-marker.test.ts telegram-plugin/tests/boot-card-dedupe.test.ts telegram-plugin/tests/boot-card-reason.test.ts telegram-plugin/tests/progress-update.test.ts telegram-plugin/tests/quota-cache.test.ts telegram-plugin/tests/silent-reply-guard.test.ts telegram-plugin/tests/unhandled-rejection-policy.test.ts telegram-plugin/tests/registry-turns.test.ts telegram-plugin/registry/subagents.test.ts telegram-plugin/registry/subagents-bugs.test.ts telegram-plugin/tests/subagent-watcher-parent-turn-key.test.ts telegram-plugin/tests/turns-writer.test.ts telegram-plugin/tests/resume-inbound-builder.test.ts telegram-plugin/tests/subagent-tracker-hooks.test.ts telegram-plugin/tests/resolve-calling-subagent.test.ts telegram-plugin/tests/gateway-update-placeholder-dispatch.test.ts telegram-plugin/tests/reaction-trigger.test.ts telegram-plugin/tests/reaction-trigger-flow.test.ts telegram-plugin/tests/subagent-watcher-workflow-visibility.test.ts telegram-plugin/uat/load-env.test.ts telegram-plugin/uat/feed-matcher.test.ts telegram-plugin/gateway/webhook-ingest-server.test.ts telegram-plugin/tests/skill-proposal-card.test.ts",
     "test:watch": "vitest",
     "lint": "tsc --noEmit && node scripts/check-plugin-references.mjs && bash scripts/check-bot-api-wrapping.sh && node scripts/check-bun-test-imports.mjs && node scripts/check-no-pii-secrets.mjs && node scripts/check-vault-test-hermeticity.mjs && node scripts/check-no-broadcast-delivery.mjs && node scripts/check-stale-tool-descriptions.mjs && node scripts/check-web-subscription-honest.mjs",
     "lint:tsc": "tsc --noEmit",
@@ -47,7 +47,7 @@
     "bcryptjs": "^3.0.3",
     "chalk": "^5.4.0",
     "commander": "^13.1.0",
-    "grammy": "^1.21.0",
+    "grammy": "^1.44",
     "handlebars": "^4.7.8",
     "posthog-node": "^5.29.2",
     "yaml": "^2.7.0",

package/telegram-plugin/answer-stream.ts

@@ -34,7 +34,7 @@ import { isSilentFlushMarker } from './turn-flush-safety.js'
 
 export const MIN_INITIAL_CHARS = 50
 export const DEFAULT_THROTTLE_MS = 1000
-const TELEGRAM_MAX_CHARS = 4096
+const TELEGRAM_MAX_CHARS = 32768
 
 /** Called when a late sendMessage/edit resolves after a new turn has started. */
 export type OnSupersededCallback = (params: {
@@ -55,11 +55,13 @@ export interface AnswerStreamConfig {
   replyToMessageId?: number
 
   // ── Transport callbacks ────────────────────────────────────────────────
+  // Both callbacks ship the RAW assistant transcript markdown — the gateway
+  // wrapper sends it via the rich-message path (`sendRichMessage` /
+  // `editMessageText({ markdown })`, #2669). No render step happens here.
   sendMessage: (
     chatId: string,
     text: string,
     params?: {
-      parse_mode?: 'HTML'
       message_thread_id?: number
       link_preview_options?: { is_disabled: boolean }
       reply_parameters?: { message_id: number }
@@ -86,31 +88,12 @@ export interface AnswerStreamConfig {
     messageId: number,
     text: string,
     params?: {
-      parse_mode?: 'HTML'
       message_thread_id?: number
       link_preview_options?: { is_disabled: boolean }
     },
   ) => Promise<unknown>
   deleteMessage?: (chatId: string, messageId: number) => Promise<unknown>
 
-  /**
-   * Render the raw assistant transcript text into the wire format used for
-   * `parse_mode: 'HTML'` sends/edits. Every OTHER outbound lane in the gateway
-   * (handleStreamReply, the reply handler, the turn-flush backstop, the PTY
-   * partial handler) converts markdown → Telegram HTML via
-   * `sanitizeTelegramHtml(markdownToHtml(...))` before sending. The
-   * answer-stream lane historically shipped the RAW transcript under
-   * `parse_mode: 'HTML'`, so `**bold**` reached the user as literal asterisks
-   * and agent narration read as unformatted text.
-   *
-   * Injected as a dependency (mirroring `renderText` on the PTY partial
-   * handler) rather than hard-importing `format`/`html-sanitize` here, so this
-   * module stays free of a grammy/format dependency and remains fully
-   * testable. When absent, text is sent verbatim — preserving the old
-   * behaviour for callers (and tests) that don't wire it.
-   */
-  renderText?: (text: string) => string
-
   /** Called when a late edit/send resolves but this stream has been superseded. */
   onSuperseded?: OnSupersededCallback
   log?: (msg: string) => void
@@ -197,7 +180,6 @@ export function createAnswerStream(config: AnswerStreamConfig): AnswerStreamHand
     replyToMessageId,
     sendMessage,
     editMessageText,
-    renderText,
     onSuperseded,
     log,
     warn,
@@ -207,13 +189,6 @@ export function createAnswerStream(config: AnswerStreamConfig): AnswerStreamHand
     recordOutbound,
   } = config
 
-  /**
-   * Convert raw transcript text to the wire format before any
-   * `parse_mode: 'HTML'` send/edit. Falls back to the verbatim text when no
-   * renderer is injected (old behaviour / unwired tests).
-   */
-  const render = (text: string): string => (renderText != null ? renderText(text) : text)
-
   const effectiveThrottle = Math.max(250, throttleMs)
 
   // Stream state
@@ -255,19 +230,17 @@ export function createAnswerStream(config: AnswerStreamConfig): AnswerStreamHand
   }
 
   async function sendOrEditViaMessage(trimmed: string, gen: number, prevText: string): Promise<void> {
-    // Convert raw transcript markdown → Telegram HTML before sending under
-    // parse_mode: 'HTML'. Without this, `**bold**` ships as literal asterisks
-    // (the answer-stream-raw-markdown bug). Mirrors every other outbound lane.
-    const rendered = render(trimmed)
+    // Ship the RAW transcript markdown — the gateway wrapper sends it via the
+    // rich-message path (#2669), so `**bold**` renders correctly without any
+    // render step here.
     if (typeof streamMsgId === 'number') {
       // Edit existing message
       const editParams: Parameters<typeof editMessageText>[3] = {
-        parse_mode: 'HTML',
         link_preview_options: { is_disabled: true },
       }
       if (threadId != null) editParams.message_thread_id = threadId
       try {
-        await editMessageText(chatId, streamMsgId, rendered, editParams)
+        await editMessageText(chatId, streamMsgId, trimmed, editParams)
         onMetric?.({ kind: 'answer_lane_update', chatId, messageId: streamMsgId, charCount: trimmed.length, transport: 'edit' })
       } catch (err) {
         const msg = err instanceof Error ? err.message : String(err)
@@ -290,13 +263,12 @@ export function createAnswerStream(config: AnswerStreamConfig): AnswerStreamHand
       // preview opener — silent (no device ping). The turn-end materialize
       // path uses 'materialize' to allow the platform-default ping.
       const sendParams: Parameters<typeof sendMessage>[2] = {
-        parse_mode: 'HTML',
         link_preview_options: { is_disabled: true },
         purpose: 'stream',
       }
       if (threadId != null) sendParams.message_thread_id = threadId
       if (replyToMessageId != null) sendParams.reply_parameters = { message_id: replyToMessageId }
-      const sent = await sendMessage(chatId, rendered, sendParams)
+      const sent = await sendMessage(chatId, trimmed, sendParams)
       const sentId = sent?.message_id
       if (typeof sentId !== 'number' || !Number.isFinite(sentId)) {
         warn?.('answer-stream: sendMessage returned no message_id')
@@ -444,7 +416,6 @@ export function createAnswerStream(config: AnswerStreamConfig): AnswerStreamHand
       // answer surface — beat 5 of the conversational-pacing contract
       // — and MUST ping so the user knows the answer landed.
       const sendParams: Parameters<typeof sendMessage>[2] = {
-        parse_mode: 'HTML',
         link_preview_options: { is_disabled: true },
         purpose: 'materialize',
       }
@@ -454,11 +425,10 @@ export function createAnswerStream(config: AnswerStreamConfig): AnswerStreamHand
       // nested quote that looks wrong.
 
       try {
-        // Render markdown → Telegram HTML for the wire send. The dedup /
-        // silent-marker / history checks above all run on the raw textToSend
-        // (so they match the comparisons the other lanes make on raw text);
-        // only the actual outbound payload is converted.
-        const sent = await sendMessage(chatId, render(textToSend), sendParams)
+        // Ship the raw transcript markdown — the gateway wrapper sends it via
+        // the rich-message path (#2669). The dedup / silent-marker / history
+        // checks above all run on the same raw textToSend.
+        const sent = await sendMessage(chatId, textToSend, sendParams)
         const sentId = sent?.message_id
         if (typeof sentId === 'number' && Number.isFinite(sentId)) {
           streamMsgId = sentId

package/telegram-plugin/auth-snapshot-format.ts

@@ -243,7 +243,7 @@ function displayLabel(label: string, opts: SnapshotRenderOpts): string {
 function groupHeader(health: AccountHealth, count: number): string {
   const emoji = HEALTH_EMOJI[health];
   const title = HEALTH_TITLE[health];
-  return `${emoji} <b>${title}</b> (${count})`;
+  return `${emoji} **${title}** (${count})`;
 }
 
 const HEALTH_EMOJI: Record<AccountHealth, string> = {
@@ -284,10 +284,10 @@ function renderAccountRow(
 
   if (!snap.quota) {
     lines.push(
-      `${marker}<code>${escapeHtml(label)}</code>  <i>quota probe failed</i>`,
+      `${marker}\`${escapeHtml(label)}\`  _quota probe failed_`,
     );
     if (snap.quotaError) {
-      lines.push(`  <i>${escapeHtml(snap.quotaError)}</i>`);
+      lines.push(`  _${escapeHtml(snap.quotaError)}_`);
     }
     return lines;
   }
@@ -297,7 +297,7 @@ function renderAccountRow(
   // it as a data-quality gap, never a confident "0% / 0%".
   if (isProbeThin(q)) {
     lines.push(
-      `${marker}<code>${escapeHtml(label)}</code>  <i>quota unknown (thin probe)</i>`,
+      `${marker}\`${escapeHtml(label)}\`  _quota unknown (thin probe)_`,
     );
     return lines;
   }
@@ -307,7 +307,7 @@ function renderAccountRow(
   const fiveStr = fmtPct(norm.fiveHourUtilizationPct);
   const sevenStr = fmtPct(norm.sevenDayUtilizationPct);
   lines.push(
-    `${marker}<code>${escapeHtml(label)}</code>  ${fiveStr} / ${sevenStr}`,
+    `${marker}\`${escapeHtml(label)}\`  ${fiveStr} / ${sevenStr}`,
   );
 
   const health = classifyHealth(snap, now);
@@ -318,7 +318,7 @@ function renderAccountRow(
     const reset = win === '5h' ? q.fiveHourResetAt : q.sevenDayResetAt;
     const winLabel = win === '5h' ? '5-hour' : '7-day';
     lines.push(
-      `  <i>quota exhausted — back ${formatAbsolute(reset, tz)} (in ${formatRelative(reset, now)}, ${winLabel} cap)</i>`,
+      `  _quota exhausted — back ${formatAbsolute(reset, tz)} (in ${formatRelative(reset, now)}, ${winLabel} cap)_`,
     );
     return lines;
   }
@@ -337,13 +337,13 @@ function renderAccountRow(
   const sevenSeg = q.sevenDayResetAt
     ? `7d resets ${formatAbsolute(q.sevenDayResetAt, tz)} (in ${formatRelative(q.sevenDayResetAt, now)})`
     : '7d resets —';
-  lines.push(`  <i>${fiveFirst ? fiveSeg : sevenSeg}</i>`);
-  lines.push(`  <i>${fiveFirst ? sevenSeg : fiveSeg}</i>`);
+  lines.push(`  _${fiveFirst ? fiveSeg : sevenSeg}_`);
+  lines.push(`  _${fiveFirst ? sevenSeg : fiveSeg}_`);
   // Informational overage annotation: if out_of_credits (no overage headroom),
   // surface it as a sub-line on a healthy/throttling row — NOT a blocked badge.
   if (q.overageDisabledReason != null && OVERAGE_EXHAUSTED_REASONS.has(q.overageDisabledReason)) {
     lines.push(
-      `  <i>overage off (${escapeHtml(q.overageDisabledReason)}) — serving from quota</i>`,
+      `  _overage off (${escapeHtml(q.overageDisabledReason)}) — serving from quota_`,
     );
   }
   return lines;
@@ -380,7 +380,7 @@ export function renderAuthSnapshotFormat2(
 ): string {
   const now = opts.now ?? new Date();
   const lines: string[] = [];
-  lines.push('🔋 <b>Auth — fleet status</b>');
+  lines.push('🔋 **Auth — fleet status**');
 
   // Group by health. Render BLOCKED first (it's the urgent action),
   // then THROTTLING (potential next problem), then HEALTHY (good
@@ -410,16 +410,16 @@ export function renderAuthSnapshotFormat2(
 
   lines.push('');
   lines.push('────────────────────────────');
-  lines.push(`<i>${recommendation(snapshots, now, opts.demo ?? false)}</i>`);
+  lines.push(`_${recommendation(snapshots, now, opts.demo ?? false)}_`);
   // #2495 Change 2 — a failed probe-on-open renders an explicit "cached Nm
   // ago" warning, never a false live stamp. The degraded variant takes
   // precedence over the live stamp.
   if (opts.staleCachedAtMs != null) {
-    lines.push(`<i>⚠ cached ${formatAgeStamp(opts.staleCachedAtMs, now)}</i>`);
+    lines.push(`_⚠ cached ${formatAgeStamp(opts.staleCachedAtMs, now)}_`);
   } else if (opts.liveProbedAtMs != null) {
-    lines.push(`<i>Live · refreshed ${formatAgeStamp(opts.liveProbedAtMs, now)}</i>`);
+    lines.push(`_Live · refreshed ${formatAgeStamp(opts.liveProbedAtMs, now)}_`);
   } else {
-    lines.push('<i>Live</i>');
+    lines.push('_Live_');
   }
   return lines.join('\n');
 }
@@ -615,10 +615,10 @@ export function renderFallbackAnnouncement(input: FallbackAnnouncementInput): st
     // same per-account row + earliest-recovery helpers the /auth table uses so
     // the formatting stays consistent with the rest of the auth surface.
     lines.push(
-      `🔴 <b>All accounts blocked · ${headerLimit} on ${escapeHtml(input.oldLabel)}</b>`,
+      `🔴 **All accounts blocked · ${headerLimit} on ${escapeHtml(input.oldLabel)}**`,
     );
     lines.push('');
-    lines.push(`Triggered by: agent <b>${escapeHtml(input.triggerAgent)}</b>`);
+    lines.push(`Triggered by: agent **${escapeHtml(input.triggerAgent)}**`);
 
     const fleet = input.fleetSnapshots ?? [];
     if (fleet.length > 0) {
@@ -639,7 +639,7 @@ export function renderFallbackAnnouncement(input: FallbackAnnouncementInput): st
       if (earliest) {
         lines.push('');
         lines.push(
-          `Earliest recovery: <code>${escapeHtml(earliest.label)}</code> ` +
+          `Earliest recovery: \`${escapeHtml(earliest.label)}\` ` +
             `${formatAbsolute(earliest.at, tz)} (in ${formatRelative(earliest.at, now)})`,
         );
       }
@@ -655,28 +655,28 @@ export function renderFallbackAnnouncement(input: FallbackAnnouncementInput): st
     }
     lines.push('');
     lines.push(
-      `Run <code>/auth add &lt;label&gt;</code> to attach another subscription, ` +
-        `or <code>/auth refresh</code> to re-probe.`,
+      `Run \`/auth add <label>\` to attach another subscription, ` +
+        `or \`/auth refresh\` to re-probe.`,
     );
     return lines.join('\n');
   }
 
   // Successful swap.
   lines.push(
-    `✓ <b>Switched fleet · ${headerLimit} on ${escapeHtml(input.oldLabel)}</b>`,
+    `✓ **Switched fleet · ${headerLimit} on ${escapeHtml(input.oldLabel)}**`,
   );
   lines.push('');
   lines.push(
-    `<code>${escapeHtml(input.oldLabel)}</code> → <code>${escapeHtml(input.newLabel)}</code>`,
+    `\`${escapeHtml(input.oldLabel)}\` → \`${escapeHtml(input.newLabel)}\``,
   );
-  lines.push(`Triggered by: agent <b>${escapeHtml(input.triggerAgent)}</b>`);
+  lines.push(`Triggered by: agent **${escapeHtml(input.triggerAgent)}**`);
   lines.push('');
 
   if (input.oldQuota) {
     const recovery = recoveryAtFor(input.oldQuota);
     if (recovery) {
       lines.push(
-        `<code>${escapeHtml(input.oldLabel)}</code> recovers ` +
+        `\`${escapeHtml(input.oldLabel)}\` recovers ` +
           `${formatAbsolute(recovery, tz)} (in ${formatRelative(recovery, now)})`,
       );
     }
@@ -688,13 +688,13 @@ export function renderFallbackAnnouncement(input: FallbackAnnouncementInput): st
     const hasHeadroom =
       input.newQuota.fiveHourUtilizationPct < THROTTLING_THRESHOLD_PCT &&
       input.newQuota.sevenDayUtilizationPct < THROTTLING_THRESHOLD_PCT;
-    const headroomStr = hasHeadroom ? '<i>(plenty of headroom)</i>' : '<i>(near limit — watch this)</i>';
+    const headroomStr = hasHeadroom ? '_(plenty of headroom)_' : '_(near limit — watch this)_';
     lines.push(
-      `<code>${escapeHtml(input.newLabel)}</code> now: ${fiveStr} of 5h · ${sevenStr} of 7d ${headroomStr}`,
+      `\`${escapeHtml(input.newLabel)}\` now: ${fiveStr} of 5h · ${sevenStr} of 7d ${headroomStr}`,
     );
   } else {
     lines.push(
-      `<i>(quota probe for new account is pending — will reflect on next /auth)</i>`,
+      `_(quota probe for new account is pending — will reflect on next /auth)_`,
     );
   }
 
@@ -808,10 +808,7 @@ function switchPriority(s: AccountSnapshot, now: Date = new Date()): number {
 // ── shared HTML escape ───────────────────────────────────────────────
 
 function escapeHtml(s: string): string {
-  return s
-    .replace(/&/g, '&amp;')
-    .replace(/</g, '&lt;')
-    .replace(/>/g, '&gt;');
+  return s.replace(/([\\`*_~=\[\]|])/g, '\\$1');
 }
 
 // ── snapshot assembly helper ─────────────────────────────────────────

package/telegram-plugin/auto-fallback-fleet.ts

@@ -54,19 +54,14 @@ import {
  */
 export function renderFallbackFailureNotice(triggerAgent: string, reason: string): string {
   return (
-    `⚠️ <b>Auto-failover could not run</b> (trigger: <b>${escFailureHtml(triggerAgent)}</b>)\n` +
+    `⚠️ **Auto-failover could not run** (trigger: **${escFailureHtml(triggerAgent)}**)\n` +
     `${escFailureHtml(reason)}\n\n` +
-    `<i>Switch manually with <code>/auth use &lt;label&gt;</code>, or <code>/auth</code> for fleet status.</i>`
+    `_Switch manually with \`/auth use <label>\`, or \`/auth\` for fleet status._`
   );
 }
 
 function escFailureHtml(s: string): string {
-  return s
-    .replace(/&/g, '&amp;')
-    .replace(/</g, '&lt;')
-    .replace(/>/g, '&gt;')
-    .replace(/"/g, '&quot;')
-    .replace(/'/g, '&#39;');
+  return s.replace(/([\\`*_~=\[\]|])/g, '\\$1');
 }
 
 /**
@@ -214,7 +209,7 @@ export async function runFleetAutoFallback(
   if (!oldSnap) {
     return {
       kind: 'no-old-active',
-      announcement: '<i>Auto-fallback skipped: no active account in broker state.</i>',
+      announcement: '_Auto-fallback skipped: no active account in broker state._',
     };
   }
 
@@ -232,8 +227,8 @@ export async function runFleetAutoFallback(
       oldLabel: oldSnap.label,
       oldQuota: oldSnap.quota,
       announcement:
-        `<i>Auto-fallback skipped: ${oldSnap.label} probed healthy ` +
-        `(${pctSummary(oldSnap.quota)}). Stale event?</i>`,
+        `_Auto-fallback skipped: ${oldSnap.label} probed healthy ` +
+        `(${pctSummary(oldSnap.quota)}). Stale event?_`,
     };
   }
 

package/telegram-plugin/card-format.ts

@@ -1,9 +1,14 @@
 /**
  * Shared formatters for Telegram status cards.
  *
+ * Since the Bot API 10.1 rich-message migration (#2669) the cards emit raw
+ * GFM markdown (sent via `sendRichMessage` / `editMessageText({ markdown })`),
+ * not HTML. `escapeMarkdown` (re-exported from `format.ts`) is the
+ * dynamic-value escaper cards use where they used to call `escapeHtml`.
+ *
  * Both the main progress card (rendered via `stream-reply-handler.ts`)
- * and the pinned worker card (`subagent-watcher.ts`) emit HTML to
- * Telegram; before issue #94 each had its own private copies with subtly
+ * and the pinned worker card (`subagent-watcher.ts`) emit to Telegram;
+ * before issue #94 each had its own private copies with subtly
  * different conventions:
  *
  *   - `formatDuration(500)` → progress-card returned `500ms`, watcher
@@ -16,14 +21,24 @@
  *     in both modules. Centralising removes one more piece of drift the
  *     reviewer has to verify.
  *
- * Keep this module dependency-free. It's imported by every card-render
- * surface and must not pull in plugin or gateway state.
+ * Keep this module nearly dependency-free. It's imported by every
+ * card-render surface and must not pull in plugin or gateway state. The
+ * single exception is the `escapeMarkdown` re-export from `format.ts`,
+ * which is itself state-free.
+ */
+
+import { escapeMarkdown } from './format.js'
+
+/**
+ * Re-export so card surfaces have one import for the markdown escaper they
+ * use when interpolating dynamic values into a hand-built markdown card.
  */
+export { escapeMarkdown }
 
 /**
  * Render a millisecond duration as `<n>ms` for sub-second values, or
- * `MM:SS` thereafter. Output is always HTML-safe (no `<` / `>` / `&`),
- * so callers can interpolate it into HTML without `escapeHtml`.
+ * `MM:SS` thereafter. Output contains no markdown-special characters, so
+ * callers can interpolate it into a markdown card without escaping.
  *
  *   formatDuration(0)      → "0ms"
  *   formatDuration(500)    → "500ms"
@@ -45,17 +60,6 @@ export function formatDuration(ms: number): string {
   return `${m.toString().padStart(2, '0')}:${r.toString().padStart(2, '0')}`;
 }
 
-/**
- * Escape `&`, `<`, `>` for safe interpolation into Telegram HTML
- * messages. Telegram's HTML parser is strict — an unescaped `<` is
- * read as a tag opener and rejects the message with
- * "can't parse entities" (see #101 for the cascade that crashed the
- * gateway into a restart loop).
- */
-export function escapeHtml(s: string): string {
-  return s.replace(/[&<>]/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;' })[c]!);
-}
-
 /** Truncate to at most `n` characters, replacing the last char with `…`. */
 export function truncate(s: string, n: number): string {
   return s.length > n ? s.slice(0, n - 1) + '…' : s;
@@ -65,13 +69,12 @@ export function truncate(s: string, n: number): string {
  * Strip Markdown markup from a single line, leaving plain prose.
  *
  * Worker narration is authored as Markdown — the model writes `**bold**`,
- * `` `code` ``, `- bullets`, `# headings`. The status cards render Telegram
- * HTML, which does NOT interpret Markdown, so an unstripped `**` shows up as
- * two literal asterisks (the #94-class "half-done" look). Strip the markup
- * here so the card reads as clean prose.
+ * `` `code` ``, `- bullets`, `# headings`. The status cards have a fixed
+ * structure (steps, durations) and interleave narration as plain prose, so
+ * we strip the author's inline markup here so the narration reads as clean
+ * prose and never collides with the card's own markdown structure.
  *
- * Run this BEFORE `truncate` + `escapeHtml`: clean → measure → escape. (The
- * stripper never touches `<`/`>`/`&`, so escaping stays the last step.)
+ * Run this BEFORE `truncate` + `escapeMarkdown`: clean → measure → escape.
  */
 export function stripMarkdown(s: string): string {
   let out = s;
@@ -107,8 +110,8 @@ function isRuleLine(s: string): boolean {
  * Clean a worker's multi-line result/narration into a single plain-text
  * paragraph for a card's finished body. Drops fenced code blocks and
  * horizontal rules, strips per-line Markdown, then space-joins what's left.
- * Output is plain text — the caller still truncates + escapes before
- * interpolating into HTML.
+ * Output is plain text — the caller still truncates + escapes (escapeMarkdown)
+ * before interpolating into the card's markdown body.
  */
 export function cleanWorkerResultParagraph(s: string): string {
   const kept: string[] = [];

package/telegram-plugin/credits-watch.ts

@@ -157,7 +157,7 @@ export function evaluateCreditState(args: {
   if (!currentIsFatal && prevIsFatal) {
     return {
       kind: "notify",
-      message: `✅ <b>${escapeHtml(agentName)}</b>: credits restored — agent should resume normal operation.`,
+      message: `✅ **${escapeHtml(agentName)}**: credits restored — agent should resume normal operation.`,
       newState: { lastNotifiedReason: null, lastNotifiedAt: now },
       transition: "exited",
     };
@@ -193,12 +193,12 @@ export function evaluateCreditState(args: {
 function buildEntryMessage(agentName: string, reason: string): string {
   const desc = humanizeReason(reason);
   return [
-    `⚠️ <b>${escapeHtml(agentName)}</b>: ${desc}`,
+    `⚠️ **${escapeHtml(agentName)}**: ${desc}`,
     ``,
     `Cron tasks and inbound replies will fail until this is resolved. Check`,
-    `your subscription or pre-paid usage at <a href="https://console.anthropic.com">console.anthropic.com</a>.`,
+    `your subscription or pre-paid usage at [console.anthropic.com](https://console.anthropic.com).`,
     ``,
-    `<i>Source: Claude CLI cache (cachedExtraUsageDisabledReason=${escapeHtml(reason)})</i>`,
+    `_Source: Claude CLI cache (cachedExtraUsageDisabledReason=${escapeHtml(reason)})_`,
   ].join("\n");
 }
 
@@ -218,12 +218,7 @@ function humanizeReason(reason: string): string {
 }
 
 function escapeHtml(s: string): string {
-  return s
-    .replace(/&/g, "&amp;")
-    .replace(/</g, "&lt;")
-    .replace(/>/g, "&gt;")
-    .replace(/"/g, "&quot;")
-    .replace(/'/g, "&#39;");
+  return s.replace(/([\\`*_~=\[\]|])/g, "\\$1");
 }
 
 // ─── State persistence ───────────────────────────────────────────────────────