switchroom 0.16.23 → 0.16.24

package/telegram-plugin/inline-keyboard-callbacks.ts

@@ -200,7 +200,10 @@ export interface FinalizeCallbackContext {
   answerCallbackQuery: (
     opts?: { text?: string; show_alert?: boolean },
   ) => Promise<unknown>
-  editMessageText: (text: string, opts?: Record<string, unknown>) => Promise<unknown>
+  editMessageText: (
+    text: string | { markdown: string },
+    opts?: Record<string, unknown>,
+  ) => Promise<unknown>
 }
 
 export interface FinalizeCallbackOptions {
@@ -225,11 +228,12 @@ export interface FinalizeCallbackOptions {
    */
   newText: string
   /**
-   * Parse mode for `newText`. Match the original message's parse mode —
-   * mixing modes mid-edit silently breaks formatting. Optional; omitted
-   * means plain text.
+   * When true, `newText` is edited as a LITERAL plain string (no markdown
+   * parsing) — match the original message's send shape. Default (false) →
+   * the rich-markdown path, so `newText` is rendered as GFM markdown
+   * (#2669, successor to the old `parseMode` option).
    */
-  parseMode?: 'HTML' | 'Markdown' | 'MarkdownV2'
+  literalText?: boolean
   /**
    * Side effect invoked AFTER `editMessageText` resolves. Use for
    * synthesizing the `<channel source="...">` inbound that wakes the
@@ -274,14 +278,16 @@ export async function finalizeCallback(
   })
   // Invariant 2 — strip keyboard + append status line, atomic edit.
   try {
-    await ctx.editMessageText(opts.newText, {
-      reply_markup: { inline_keyboard: [] },
-      ...(opts.parseMode ? { parse_mode: opts.parseMode } : {}),
-      // Default link_preview_options off — most finalized cards don't
-      // benefit from preview cards, and a stale preview survives the
-      // edit otherwise.
-      link_preview_options: { is_disabled: true },
-    })
+    await ctx.editMessageText(
+      opts.literalText ? opts.newText : { markdown: opts.newText },
+      {
+        reply_markup: { inline_keyboard: [] },
+        // Default link_preview_options off — most finalized cards don't
+        // benefit from preview cards, and a stale preview survives the
+        // edit otherwise.
+        link_preview_options: { is_disabled: true },
+      },
+    )
   } catch (err) {
     // MESSAGE_NOT_MODIFIED (text didn't change) and MESSAGE_TO_EDIT_NOT_FOUND
     // (operator already deleted the card) are both benign. Other failures

package/telegram-plugin/issues-card.ts

@@ -17,7 +17,7 @@
  */
 
 import { readFileSync, writeFileSync } from "node:fs";
-import { escapeHtml } from "./card-format.js";
+import { escapeMarkdown } from "./card-format.js";
 import type { IssueEvent, IssueSeverity } from "../src/issues/index.js";
 
 export interface BotApiForIssuesCard {
@@ -92,7 +92,7 @@ export function renderIssuesCard(opts: RenderIssuesCardOpts): string | null {
   const maxSeverity = sorted[0].severity;
   const headerEmoji = SEVERITY_EMOJI[maxSeverity];
   const count = sorted.length;
-  const header = `${headerEmoji} <b>${escapeHtml(opts.agentName)}</b> · ${count} ${count === 1 ? "issue" : "issues"}`;
+  const header = `${headerEmoji} **${escapeMarkdown(opts.agentName)}** · ${count} ${count === 1 ? "issue" : "issues"}`;
 
   const maxRows = opts.maxRows ?? DEFAULT_MAX_ROWS;
   const visible = sorted.slice(0, maxRows);
@@ -101,22 +101,22 @@ export function renderIssuesCard(opts: RenderIssuesCardOpts): string | null {
   const now = opts.now ?? Date.now();
   const rows = visible.map((e) => {
     const emoji = SEVERITY_EMOJI[e.severity];
-    const occ = e.occurrences > 1 ? ` <i>(×${e.occurrences})</i>` : "";
+    const occ = e.occurrences > 1 ? ` _(×${e.occurrences})_` : "";
     const ago = relTime(now - e.last_seen);
-    const head = `${emoji} <code>${escapeHtml(e.fingerprint)}</code>  ${escapeHtml(e.summary)}${occ} — <i>${ago}</i>`;
+    const head = `${emoji} \`${e.fingerprint}\`  ${escapeMarkdown(e.summary)}${occ} — _${ago}_`;
     // Render the `detail` line below the summary when present and short
     // enough to be a remediation hint (not a multi-line stderr tail).
     // Convention from the cron prompt template: agents put "Fix: <cmd>"
     // or "→ <cmd>" in detail. Long stderr details are omitted from the
     // card to keep the layout tight; users can run /issues to see them.
     const remediation = formatRemediation(e.detail);
-    return remediation == null ? head : `${head}\n  → <i>${escapeHtml(remediation)}</i>`;
+    return remediation == null ? head : `${head}\n  → _${escapeMarkdown(remediation)}_`;
   });
 
   const lines = [header, "", ...rows];
   if (overflow > 0) {
     lines.push("");
-    lines.push(`<i>+${overflow} more not shown — run <code>/issues</code></i>`);
+    lines.push(`_+${overflow} more not shown — run \`/issues\`_`);
   }
   return lines.join("\n");
 }
@@ -326,7 +326,6 @@ export function createIssuesCardHandle(
       if (body === lastBody && messageId != null) return;
 
       const sendOpts: Record<string, unknown> = {
-        parse_mode: "HTML",
         disable_web_page_preview: true,
         // Status card, not the user's answer — silence the open ping.
         // (editMessageText ignores disable_notification, so the shared

package/telegram-plugin/model-unavailable.ts

@@ -366,10 +366,10 @@ export function formatModelUnavailableCard(
   opts: FormatCardOptions = {},
 ): string {
   const now = opts.now ?? new Date()
-  const slotPart = opts.slot ? ` (slot <b>${escHtml(opts.slot)}</b>)` : ''
+  const slotPart = opts.slot ? ` (slot **${escHtml(opts.slot)}**)` : ''
   const reason = formatReason(detection, now)
   const lines = [
-    `⚠️ <b>Model unavailable</b> on agent <b>${escHtml(agent)}</b>${slotPart}`,
+    `⚠️ **Model unavailable** on agent **${escHtml(agent)}**${slotPart}`,
     `Reason: ${reason}`,
     '',
   ]
@@ -378,7 +378,7 @@ export function formatModelUnavailableCard(
     // swap; a follow-up announcement (causal-shape) will land within
     // ~1s. Mention it explicitly so the user knows not to react.
     lines.push(
-      '<i>Auto-failover in progress — see the announcement below.</i>',
+      '_Auto-failover in progress — see the announcement below._',
     )
   } else {
     // Default — kinds where auto-fallback can't help (network)
@@ -386,10 +386,10 @@ export function formatModelUnavailableCard(
     // a verb (post-RFC-H); `/auth use <label>` is the canonical
     // fleet-wide swap.
     lines.push(
-      '<b>What to try</b>',
-      '• <code>/auth use &lt;label&gt;</code> — switch the fleet to a healthy account',
-      '• <code>/auth add</code> — attach another subscription',
-      '• <code>/usage</code> — show quota breakdown',
+      '**What to try**',
+      '• \`/auth use <label>\` — switch the fleet to a healthy account',
+      '• \`/auth add\` — attach another subscription',
+      '• \`/usage\` — show quota breakdown',
     )
   }
   return lines.join('\n')
@@ -471,9 +471,5 @@ export function resolveModelUnavailableFromOperatorEvent(
 // ─── HTML escape (mirrors operator-events.ts) ────────────────────────────────
 
 function escHtml(text: string): string {
-  return text
-    .replace(/&/g, '&amp;')
-    .replace(/</g, '&lt;')
-    .replace(/>/g, '&gt;')
-    .replace(/"/g, '&quot;')
+  return text.replace(/([\\`*_~=\[\]|])/g, '\\$1')
 }

package/telegram-plugin/operator-events-history.ts

@@ -78,7 +78,7 @@ export function formatLastEventLine(
   }
 
   const kindIcon = EVENT_KIND_ICON[ev.kind] ?? '⚪'
-  return `  <i>last: ${kindIcon} ${ev.kind} (${age})</i>`
+  return `  _last: ${kindIcon} ${ev.kind} (${age})_`
 }
 
 const EVENT_KIND_ICON: Record<string, string> = {

package/telegram-plugin/operator-events.ts

@@ -217,9 +217,9 @@ export function renderOperatorEvent(ev: OperatorEvent): RenderResult {
     case 'credentials-expired':
       return {
         text: [
-          `🔑 <b>Claude login expired</b> for <b>${agent}</b>.`,
-          detail ? `<i>${detail}</i>` : '',
-          `Tap <b>Reauth now</b> to refresh credentials.`,
+          `🔑 **Claude login expired** for **${agent}**.`,
+          detail ? `_${detail}_` : '',
+          `Tap **Reauth now** to refresh credentials.`,
         ]
           .filter(Boolean)
           .join('\n'),
@@ -236,9 +236,9 @@ export function renderOperatorEvent(ev: OperatorEvent): RenderResult {
     case 'credentials-invalid':
       return {
         text: [
-          `🔑 <b>Invalid Claude credentials</b> for <b>${agent}</b>.`,
-          detail ? `<i>${detail}</i>` : '',
-          `Run <code>/auth reauth ${agent}</code> or tap below.`,
+          `🔑 **Invalid Claude credentials** for **${agent}**.`,
+          detail ? `_${detail}_` : '',
+          `Run \`/auth reauth ${agent}\` or tap below.`,
         ]
           .filter(Boolean)
           .join('\n'),
@@ -255,9 +255,9 @@ export function renderOperatorEvent(ev: OperatorEvent): RenderResult {
     case 'credit-exhausted':
       return {
         text: [
-          `💳 <b>Credit balance too low</b> for <b>${agent}</b>.`,
-          detail ? `<i>${detail}</i>` : '',
-          `Use <code>/auth use &lt;label&gt;</code> to switch account slot or <code>/auth add</code> to add one.`,
+          `💳 **Credit balance too low** for **${agent}**.`,
+          detail ? `_${detail}_` : '',
+          `Use \`/auth use <label>\` to switch account slot or \`/auth add\` to add one.`,
         ]
           .filter(Boolean)
           .join('\n'),
@@ -274,9 +274,9 @@ export function renderOperatorEvent(ev: OperatorEvent): RenderResult {
       // are the historical source; this is now the single owner.
       return {
         text: [
-          `⚠️ <b>Quota exhausted</b> for <b>${agent}</b>.`,
-          detail ? `<i>${detail}</i>` : '',
-          `All account slots are at the usage limit. Switchroom will auto-fallback when another slot is available. Use <code>/auth use &lt;label&gt;</code> to switch manually.`,
+          `⚠️ **Quota exhausted** for **${agent}**.`,
+          detail ? `_${detail}_` : '',
+          `All account slots are at the usage limit. Switchroom will auto-fallback when another slot is available. Use \`/auth use <label>\` to switch manually.`,
         ]
           .filter(Boolean)
           .join('\n'),
@@ -290,8 +290,8 @@ export function renderOperatorEvent(ev: OperatorEvent): RenderResult {
     case 'rate-limited':
       return {
         text: [
-          `🚦 <b>Rate limited</b> for <b>${agent}</b>.`,
-          detail ? `<i>${detail}</i>` : '',
+          `🚦 **Rate limited** for **${agent}**.`,
+          detail ? `_${detail}_` : '',
           `Claude is temporarily rate-limiting requests. Will retry automatically.`,
         ]
           .filter(Boolean)
@@ -306,8 +306,8 @@ export function renderOperatorEvent(ev: OperatorEvent): RenderResult {
     case 'agent-crashed':
       return {
         text: [
-          `💥 <b>Agent crashed</b>: <b>${agent}</b>.`,
-          detail ? `<i>${detail}</i>` : '',
+          `💥 **Agent crashed**: **${agent}**.`,
+          detail ? `_${detail}_` : '',
         ]
           .filter(Boolean)
           .join('\n'),
@@ -324,8 +324,8 @@ export function renderOperatorEvent(ev: OperatorEvent): RenderResult {
     case 'agent-restarted-unexpectedly':
       return {
         text: [
-          `🔄 <b>Agent restarted unexpectedly</b>: <b>${agent}</b>.`,
-          detail ? `<i>${detail}</i>` : '',
+          `🔄 **Agent restarted unexpectedly**: **${agent}**.`,
+          detail ? `_${detail}_` : '',
           `This may indicate a crash-loop. Check logs if it happens again.`,
         ]
           .filter(Boolean)
@@ -343,8 +343,8 @@ export function renderOperatorEvent(ev: OperatorEvent): RenderResult {
     case 'unknown-4xx':
       return {
         text: [
-          `⚠️ <b>API error (4xx)</b> for <b>${agent}</b>.`,
-          detail ? `<code>${detail}</code>` : '',
+          `⚠️ **API error (4xx)** for **${agent}**.`,
+          detail ? `\`${detail}\`` : '',
         ]
           .filter(Boolean)
           .join('\n'),
@@ -361,8 +361,8 @@ export function renderOperatorEvent(ev: OperatorEvent): RenderResult {
     case 'unknown-5xx':
       return {
         text: [
-          `🔥 <b>Server error (5xx)</b> for <b>${agent}</b>.`,
-          detail ? `<code>${detail}</code>` : '',
+          `🔥 **Server error (5xx)** for **${agent}**.`,
+          detail ? `\`${detail}\`` : '',
           `Anthropic may be experiencing issues. Will retry automatically.`,
         ]
           .filter(Boolean)
@@ -411,12 +411,8 @@ export function resetAllCooldowns(): void {
   cooldownMap.clear()
 }
 
-// ─── HTML escape ─────────────────────────────────────────────────────────────
+// ─── Markdown escape (#2669) ──────────────────────────────────────────────────
 
 function escHtml(text: string): string {
-  return text
-    .replace(/&/g, '&amp;')
-    .replace(/</g, '&lt;')
-    .replace(/>/g, '&gt;')
-    .replace(/"/g, '&quot;')
+  return text.replace(/([\\`*_~=\[\]|])/g, '\\$1')
 }

package/telegram-plugin/package.json

@@ -32,7 +32,7 @@
     "@secretlint/secretlint-rule-preset-recommend": "^12.2.0",
     "@secretlint/types": "^12.2.0",
     "@xterm/headless": "^6.0.0",
-    "grammy": "^1.21.0",
+    "grammy": "^1.44",
     "posthog-node": "^5.29.2"
   },
   "engines": {

package/telegram-plugin/pending-work-progress.ts

@@ -49,14 +49,13 @@
  * interval is short (5s) but edits are spaced at EDIT_INTERVAL_MS so
  * the Telegram bot.api editMessageText rate stays well under limits.
  *
- * Edits preserve the anchor's original `parse_mode` (issue #1698). The
- * anchor was sent through the reply tool, which defaults to HTML; an
- * earlier version of this module dropped parse_mode on edit, which made
- * the next "still working (Nm)" tick re-render `<b>` / `<code>` tags as
- * literal text. The suffix itself is plain text (no `<`/`>`/`&`) so it
- * is safe under any parse_mode. On subsequent edits the prior suffix is
- * stripped before re-appending so the message never accumulates duplicate
- * suffixes.
+ * Edits preserve the anchor's original send shape — rich-markdown vs the
+ * literal `format:'text'` path (#2669, successor to the #1698 parse-mode
+ * contract). The anchor was sent through the reply tool, which defaults to
+ * the rich-markdown path; the edit re-sends via the SAME path so the
+ * anchor body keeps rendering the way it first did. On subsequent edits
+ * the prior suffix is stripped before re-appending so the message never
+ * accumulates duplicate suffixes.
  *
  * Kill switch: `SWITCHROOM_DISABLE_PENDING_PROGRESS=1` disables the
  * whole subsystem. The conversational-pacing prompt is unaffected.
@@ -65,32 +64,36 @@
 export const EDIT_INTERVAL_MS = 60_000
 export const POLL_INTERVAL_MS = 5_000
 export const MAX_LIFETIME_MS = 30 * 60_000
-/** Telegram message length limit is 4096; budget headroom for the
+/** Rich-message wire cap is 32768 (#2669); budget headroom for the
  *  suffix and any escape expansion. If the anchor text plus suffix
  *  would exceed this, we skip the edit (the user still sees the
  *  original) rather than truncate the model's authored prose. */
-export const TELEGRAM_MSG_CAP = 4000
+export const TELEGRAM_MSG_CAP = 32768
 
 /**
  * Regex matching the suffix we append. Used to strip a prior suffix
  * before appending the next one. The (\d+) covers "1m" / "12m" / etc.
  * The reachability clause is optional so anchors carrying a pre-v0.14.30
- * suffix (no clause) are still stripped during a rolling upgrade.
- * Kept anchored to end-of-string so it only matches OUR suffix, not
- * something the model happened to write.
+ * suffix (no clause) are still stripped during a rolling upgrade. Both the
+ * legacy em-dash prefix (`— still working`) and the rich-markdown italic
+ * form (`_still working … _`, #2669) are matched so a rolling upgrade
+ * strips either. Kept anchored to end-of-string so it only matches OUR
+ * suffix, not something the model happened to write.
  */
 const SUFFIX_RE =
-  /\n\n— still working \(\d+m\)( · message me anytime, I'll keep you posted)?$/
+  /\n\n(?:— |_)still working \(\d+m\)( · message me anytime, I'll keep you posted)?_?$/
 
 export interface PendingProgressEditCtx {
   chatId: string
   threadId: number | null
   messageId: number
   newText: string
-  /** Telegram parse_mode the original anchor was sent with (#1698).
-   *  The edit must use the same mode or pre-rendered HTML / MarkdownV2
-   *  tags in `anchorOriginalText` re-render as literal text. */
-  parseMode: 'HTML' | 'MarkdownV2' | undefined
+  /** True when the original anchor was a literal `format:'text'` send
+   *  (plain `sendMessage`, no rich-message wrapper). The edit must match:
+   *  a rich anchor re-edits via `editMessageText({ markdown })`, a literal
+   *  anchor re-edits as a plain string (#2669 single-rich-path migration of
+   *  the #1698 parse-mode-preservation contract). */
+  literalText: boolean
 }
 
 /**
@@ -145,11 +148,11 @@ interface State {
   /** The captured anchor text — what the model wrote, *minus* any
    *  prior pending-progress suffix. Used as the base for every edit. */
   anchorOriginalText: string
-  /** parse_mode the anchor was originally sent with. Edits must
-   *  reuse this or the rendered HTML / MarkdownV2 tags in
-   *  anchorOriginalText render as literal text on the next tick
-   *  (issue #1698). */
-  anchorParseMode: 'HTML' | 'MarkdownV2' | undefined
+  /** True when the anchor was a literal `format:'text'` send. Edits must
+   *  match the original send shape (rich vs literal) or the suffix re-edit
+   *  changes how the anchor body renders (the #2669 single-rich-path
+   *  successor to the #1698 parse-mode-preservation contract). */
+  anchorLiteralText: boolean
   /** Wall-clock ms when the cross-turn ambient state was *activated*
    *  (at turn_end with pending+anchor). null before activation. */
   activatedAt: number | null
@@ -178,7 +181,7 @@ function ensure(key: string): State {
       pending: false,
       anchorMessageId: null,
       anchorOriginalText: '',
-      anchorParseMode: undefined,
+      anchorLiteralText: false,
       activatedAt: null,
       lastEditAt: null,
     }
@@ -216,7 +219,7 @@ export function startTurn(key: string): void {
   s.pending = false
   s.anchorMessageId = null
   s.anchorOriginalText = ''
-  s.anchorParseMode = undefined
+  s.anchorLiteralText = false
 }
 
 /**
@@ -241,21 +244,18 @@ export function noteOutbound(
   opts: {
     messageId: number
     text: string
-    /** parse_mode the anchor was sent with. Captured so the
-     *  cross-turn edit tick can reuse it (#1698). Undefined or
-     *  omitted means the original send had no parse_mode (plain
-     *  text). Production callers MUST pass this — every reply path
-     *  knows its own parse_mode. Defaulted to undefined only so test
-     *  fixtures don't have to thread it through where they're
-     *  asserting other behaviour. */
-    parseMode?: 'HTML' | 'MarkdownV2' | undefined
+    /** True when the anchor was a literal `format:'text'` send. Captured
+     *  so the cross-turn edit tick re-edits with the same shape (#2669
+     *  single-rich-path successor to the #1698 parse-mode contract).
+     *  Omitted ⇒ false (the rich-markdown default). */
+    literalText?: boolean
   },
 ): void {
   if (!enabled()) return
   const s = ensure(key)
   s.anchorMessageId = opts.messageId
   s.anchorOriginalText = opts.text.replace(SUFFIX_RE, '')
-  s.anchorParseMode = opts.parseMode
+  s.anchorLiteralText = opts.literalText ?? false
 }
 
 /**
@@ -399,7 +399,7 @@ function tick(now: number): void {
     // user-visible counter reads honestly (we only edit at intervals
     // ≥ EDIT_INTERVAL_MS = 60s).
     const minutes = Math.max(1, Math.round(elapsed / 60_000))
-    const suffix = `\n\n— still working (${minutes}m) · message me anytime, I'll keep you posted`
+    const suffix = `\n\n_still working (${minutes}m) · message me anytime, I'll keep you posted_`
     const newText = s.anchorOriginalText + suffix
 
     if (newText.length > TELEGRAM_MSG_CAP) {
@@ -417,7 +417,7 @@ function tick(now: number): void {
       threadId,
       messageId: s.anchorMessageId,
       newText,
-      parseMode: s.anchorParseMode,
+      literalText: s.anchorLiteralText,
     }
     // Fire-and-forget so a slow edit doesn't block the tick loop.
     // Errors are logged but never bubble (a 429 / "message not modified"

package/telegram-plugin/permission-title.ts

@@ -18,6 +18,7 @@
  */
 
 import { basename } from "node:path";
+import { escapeMarkdown } from "./card-format.js";
 import { prettyMcpServer, type ScopeOption } from "./permission-rule.js";
 import { redact } from "./secret-detect/redact.js";
 
@@ -96,10 +97,10 @@ const HOSTD_AGENT_TARGET_VERBS = new Set([
 /**
  * Build the multi-line card body for an approval prompt.
  *
- *   🔐 <b>Gymbro</b> wants to edit: supplement-log.md
- *   why: <i>logging today's lifts</i>
+ *   🔐 **Gymbro** wants to edit: supplement-log.md
+ *   why: _logging today's lifts_
  *
- * Output is HTML-escaped for `parse_mode: 'HTML'`. The agent name is
+ * Output is GFM markdown for the rich-message path (#2669). The agent name is
  * capitalized for the sentence; dropped (with "wants to") when null —
  * the bridge client can be anonymous during early-boot edge cases.
  *
@@ -127,10 +128,10 @@ export function formatPermissionCardBody(opts: {
 
   if (opts.agentName && opts.agentName.length > 0) {
     lines.push(
-      `🔐 <b>${escapeTgHtml(capFirst(opts.agentName))}</b> wants to ${escapeTgHtml(action)}`,
+      `🔐 **${escapeTgHtml(capFirst(opts.agentName))}** wants to ${escapeActionMarkdown(action)}`,
     );
   } else {
-    lines.push(`🔐 ${escapeTgHtml(capFirst(action))}`);
+    lines.push(`🔐 ${escapeActionMarkdown(capFirst(action))}`);
   }
 
   // why: the caller-supplied rationale (`reason`/`why` arg), never the
@@ -143,8 +144,8 @@ export function formatPermissionCardBody(opts: {
       : rawWhy;
   lines.push(
     truncatedWhy.length > 0
-      ? `why: <i>${escapeTgHtml(truncatedWhy)}</i>`
-      : `why: <i>not provided</i>`,
+      ? `why: _${escapeTgHtml(truncatedWhy)}_`
+      : `why: _not provided_`,
   );
 
   // Third line (REST-wrapper MCP writes only): a redaction-safe summary of
@@ -152,7 +153,7 @@ export function formatPermissionCardBody(opts: {
   // endpoint — e.g. "↳ to: lisa@…, subject: Priority access…".
   const argSummary = mcpArgSummary(opts.toolName, opts.inputPreview);
   if (argSummary) {
-    lines.push(`↳ <i>${escapeTgHtml(argSummary)}</i>`);
+    lines.push(`↳ _${escapeTgHtml(argSummary)}_`);
   }
 
   return lines.join("\n");
@@ -424,10 +425,10 @@ export function describeGrant(
  * the operator scrolls past — so this is the legible signal that the tap
  * landed and names the work being (re)started.
  *
- * Mirrors `formatPermissionCardBody`'s style ("🔐 <b>Gymbro</b> wants to
- * edit: log.md" → "▶️ <b>Gymbro</b> — got it, continuing: edit: log.md").
+ * Mirrors `formatPermissionCardBody`'s style ("🔐 **Gymbro** wants to
+ * edit: log.md" → "▶️ **Gymbro** — got it, continuing: edit: log.md").
  * `action` is a phrase from {@link naturalAction} (already operator-facing,
- * no tool ids). Output is HTML-escaped for `parse_mode: 'HTML'`.
+ * no tool ids). Output is GFM markdown for the rich-message path (#2669).
  *
  * `timeoutMinutes` marks the TTL auto-deny variant (no operator tapped —
  * the request aged out) so the wording reflects "no answer" rather than a
@@ -441,25 +442,25 @@ export function formatPermissionResumeMessage(opts: {
 }): string {
   const who =
     opts.agentName && opts.agentName.length > 0
-      ? `<b>${escapeTgHtml(capFirst(opts.agentName))}</b>`
-      : `<b>Agent</b>`;
+      ? `**${escapeTgHtml(capFirst(opts.agentName))}**`
+      : `**Agent**`;
   const act = (opts.action ?? "").trim();
   const hasAction = act.length > 0;
 
   if (opts.behavior === "allow") {
     return hasAction
-      ? `▶️ ${who} — got it, continuing: <i>${escapeTgHtml(act)}</i>`
+      ? `▶️ ${who} — got it, continuing: _${escapeActionMarkdown(act)}_`
       : `▶️ ${who} — got it, back to work.`;
   }
 
   // deny
   if (opts.timeoutMinutes != null) {
     return hasAction
-      ? `🚫 ${who} — no answer in ${opts.timeoutMinutes}m, continuing without it (<i>${escapeTgHtml(act)}</i>).`
+      ? `🚫 ${who} — no answer in ${opts.timeoutMinutes}m, continuing without it (_${escapeActionMarkdown(act)}_).`
       : `🚫 ${who} — no answer in ${opts.timeoutMinutes}m, continuing without it.`;
   }
   return hasAction
-    ? `🚫 ${who} — noted, I won't ${escapeTgHtml(lowerFirst(act))}. Continuing without it.`
+    ? `🚫 ${who} — noted, I won't ${escapeActionMarkdown(lowerFirst(act))}. Continuing without it.`
     : `🚫 ${who} — noted, continuing without it.`;
 }
 
@@ -520,12 +521,27 @@ function capFirst(text: string): string {
   return text.length > 0 ? text.charAt(0).toUpperCase() + text.slice(1) : text;
 }
 
-/** Minimal HTML escape for Telegram `parse_mode=HTML`. */
+/** Markdown escape for the rich-message path (#2669). */
 function escapeTgHtml(text: string): string {
+  return escapeMarkdown(text);
+}
+
+/**
+ * Escape a phrase that may itself contain DELIBERATE `` `code spans` ``
+ * (e.g. the hostd fleet-verb phrases name the target agent in a code span:
+ * "restart agent `carrie` in the fleet"). The structural backticks must NOT
+ * be escaped — that would render literal `` \`carrie\` `` to the operator
+ * (#2669 regression). Everything OUTSIDE a backtick span is still escaped so
+ * a hostile Bash command / filename can't inject emphasis. Content INSIDE a
+ * span is left verbatim — code spans render literally, so there is no
+ * injection risk there.
+ */
+function escapeActionMarkdown(text: string): string {
+  // Split on balanced single-backtick spans, keeping the delimiters.
   return text
-    .replace(/&/g, "&amp;")
-    .replace(/</g, "&lt;")
-    .replace(/>/g, "&gt;");
+    .split(/(`[^`]*`)/g)
+    .map((seg) => (seg.startsWith("`") && seg.endsWith("`") && seg.length >= 2 ? seg : escapeMarkdown(seg)))
+    .join("");
 }
 
 function parseInput(raw: string | undefined): Record<string, unknown> | null {

package/telegram-plugin/pty-partial-handler.ts

@@ -48,13 +48,6 @@ export interface PtyHandlerState {
   pendingPtyPartial: { text: string } | null
   /** Active streams, keyed by `chat_id:thread_id`. */
   activeDraftStreams: Map<string, DraftStreamHandle>
-  /**
-   * Parallel to activeDraftStreams: parseMode baked into each controller.
-   * Lets `handleStreamReply` detect and rotate streams whose parseMode no
-   * longer matches the caller's resolved format (bug 1). Optional for
-   * backwards compatibility.
-   */
-  activeDraftParseModes?: Map<string, 'HTML' | 'MarkdownV2' | undefined>
   /**
    * Chats whose PTY preview is claimed by an in-flight reply handler.
    * Partials for these chats are dropped to avoid duplicates.
@@ -67,8 +60,6 @@ export interface PtyHandlerState {
 export interface PtyHandlerDeps {
   bot: { api: StreamBotApi }
   retry?: RetryPolicy
-  /** Markdown → HTML renderer applied to the text before stream.update. */
-  renderText: (text: string) => string
   /** Optional structured event hook, called once per invocation. */
   logEvent?: (ev: {
     kind: 'pty_partial_received'
@@ -154,7 +145,10 @@ export function handlePtyPartialPure(
       bot: deps.bot,
       chatId,
       threadId,
-      parseMode: 'HTML',
+      // PTY-tail previews are raw terminal/TUI output, not authored
+      // markdown — send them literally so control glyphs and box-drawing
+      // characters aren't misinterpreted as markdown syntax (#2669).
+      literalText: true,
       disableLinkPreview: true,
       throttleMs: 600,
       retry: deps.retry,
@@ -177,11 +171,9 @@ export function handlePtyPartialPure(
         : {}),
     })
     state.activeDraftStreams.set(sKey, stream)
-    state.activeDraftParseModes?.set(sKey, 'HTML')
   }
 
-  const rendered = deps.renderText(text)
-  void stream.update(rendered).catch(() => { /* swallow — logged elsewhere */ })
+  void stream.update(text).catch(() => { /* swallow — logged elsewhere */ })
 
   return created ? 'update-new' : 'update-existing'
 }