switchroom 0.16.24 → 0.16.28

package/telegram-plugin/gateway/gateway.ts

@@ -72,6 +72,11 @@ import {
   timeoutDenyMessage,
   duplicateDenyMessage,
   isRecentTimeoutDuplicate,
+  PERMISSION_TTL_MS,
+  ttlForTool,
+  buildTimedOutCardEdits,
+  STALE_TAP_NOTICE,
+  type PermissionCardRef,
 } from './permission-timeout.js'
 import { pickRecoveredPermissionOrigin } from './permission-card-origin.js'
 import { isTelegramReplyTool, isTelegramSurfaceTool } from '../tool-names.js'
@@ -89,6 +94,7 @@ import {
   createSwallowingRetryApiCall,
   retryWithThreadFallback,
   isHtmlParseRejectError,
+  isMessageTooLongError,
 } from '../retry-api-call.js'
 import { installTgPostLogger, withTgPostTags } from '../shared/bot-runtime.js'
 import { buildAttachmentPath, assertInsideInbox } from '../attachment-path.js'
@@ -189,7 +195,7 @@ const REPLY_TO_TEXT_MAX = 200
 const SILENT_END_FALLBACK_TEXT =
   '⚠️ The agent finished working but didn’t send a reply — your last ' +
   'message may not have been answered. Please try asking again.'
-import { splitMarkdownChunks, repairEscapedWhitespace, escapeMarkdown, RICH_MESSAGE_MAX_CHARS } from '../format.js'
+import { splitMarkdownChunks, hardSliceToCap, repairEscapedWhitespace, normalizeParagraphBreaks, escapeMarkdown, RICH_MESSAGE_MAX_CHARS } from '../format.js'
 import { richMessage } from '../rich-send.js'
 import { scrubVoice } from '../text-voice-scrub.js'
 import {
@@ -779,6 +785,26 @@ const AGENT_ADMIN = process.env.SWITCHROOM_AGENT_ADMIN === 'true'
 const bot = new Bot(TOKEN)
 installTgPostLogger(bot)
 
+// ─── getUpdates heartbeat ─────────────────────────────────────────────────
+// Tracks the last time getUpdates completed (success OR error). Used by
+// the poll health check as a secondary stall signal: if getMe succeeds but
+// getUpdates hasn't responded in a while, the grammy runner loop is frozen
+// without the network being down (2026-06-30: clerk/klanker deaf for 2h
+// after a single timeout — getMe stayed green so the getMe-only check
+// never fired). Initialized to now so the first health-check interval
+// doesn't false-positive before the runner makes its first poll.
+let lastGetUpdatesHeartbeatMs = Date.now()
+bot.api.config.use(async (prev, method, payload, signal) => {
+  try {
+    const result = await prev(method, payload, signal)
+    if (method === 'getUpdates') lastGetUpdatesHeartbeatMs = Date.now()
+    return result
+  } catch (err) {
+    if (method === 'getUpdates') lastGetUpdatesHeartbeatMs = Date.now()
+    throw err
+  }
+})
+
 const GRAMMY_VERSION: string = (() => {
   try {
     const raw = readFileSync(new URL('../../node_modules/grammy/package.json', import.meta.url), 'utf8')
@@ -4312,8 +4338,10 @@ const STATUS_QUERY_RE = /^\s*status\??\s*$/i
 
 // ─── Permission handling ──────────────────────────────────────────────────
 const PERMISSION_REPLY_RE = /^\s*(y|yes|n|no)\s+([a-km-z]{5})\s*$/i
-const pendingPermissions = new Map<string, { tool_name: string; description: string; input_preview: string; startedAt: number }>()
-const PERMISSION_TTL_MS = 10 * 60_000
+const pendingPermissions = new Map<string, { tool_name: string; description: string; input_preview: string; startedAt: number; card_text: string; cards: { chatId: string; messageId: number }[] }>()
+// PERMISSION_TTL_MS / ttlForTool / the timed-out card builder now live in
+// ./permission-timeout.ts (pure + unit-testable). hostd gated verbs get a
+// 30-min window; everything else keeps the 10-min default.
 // No-repeat-on-timeout (marko Rentals-budget loop, 2026-06-17). When a card
 // auto-denies on TTL, the model is told it was a TIMEOUT (not a denial) so it
 // doesn't retry; if it retries the identical (tool, input) anyway while the
@@ -4944,7 +4972,10 @@ const pendingStateReaper = setInterval(() => {
     if (now - v.startedAt > VAULT_INPUT_TTL_MS) pendingVaultOps.delete(k)
   }
   for (const [k, v] of pendingPermissions) {
-    if (now - v.startedAt > PERMISSION_TTL_MS) {
+    // hostd gated fleet-mutation verbs get a longer (30-min) human-scale
+    // decision window than the 10-min default (Bug 2 fix #2).
+    const ttl = ttlForTool(v.tool_name)
+    if (now - v.startedAt > ttl) {
       // Don't just drop it: the claude turn is suspended INSIDE the MCP
       // permission call waiting for a verdict. A silent delete left it
       // wedged forever when the operator never tapped — permanent
@@ -4956,13 +4987,20 @@ const pendingStateReaper = setInterval(() => {
       // Carry a TIMEOUT reason to the model (claude renders it as "…the user
       // said: …") so it can tell a timeout from a real denial and not retry
       // the identical call — the duplicate-card loop this series closes.
-      const timeoutMinutes = Math.round(PERMISSION_TTL_MS / 60000)
+      const timeoutMinutes = Math.round(ttl / 60000)
       dispatchPermissionVerdict({
         type: 'permission',
         requestId: k,
         behavior: 'deny',
         message: timeoutDenyMessage(timeoutMinutes),
       })
+      // Strip the card's inline keyboard + mark it timed out (Bug 2 fix #1).
+      // Before this, the reaper deleted the pending entry but left a LIVE
+      // Approve button — a late operator tap then dispatched a verdict for an
+      // already-resolved/dead request_id, which Claude Code ignores, so the
+      // operator "approved" but work never continued. Stripping the keyboard
+      // makes the timeout legible and removes the stale tappable button.
+      void stripTimedOutPermissionCards(v.card_text, v.cards)
       // The auto-deny un-parks the suspended turn — flip 🙏 → working so
       // it doesn't sit on the awaiting glyph (or stall) after the timeout.
       resumeReactionAfterVerdict()
@@ -6565,6 +6603,32 @@ function buildPermissionActionRow(
   return kb
 }
 
+/**
+ * Strip the inline keyboard from one or more timed-out permission cards and
+ * append a "timed out — re-request to act" line (Bug 2 fix #1). Called from
+ * the pendingStateReaper, which has no grammy `ctx`, so it edits via the
+ * bot.api directly — routed through `swallowingApiCall` so a deleted card
+ * (operator removed the message) is swallowed rather than crashing the sweep.
+ *
+ * A single `editMessageText` re-renders the original card body plus a
+ * timed-out footer; omitting `reply_markup` drops the keyboard atomically
+ * with the text edit (same approach the normal tap finalizer uses, which
+ * strips the keyboard alongside its status-line edit). Best-effort: a failed
+ * edit never blocks the auto-deny that already fired.
+ */
+async function stripTimedOutPermissionCards(
+  cardText: string,
+  cards: PermissionCardRef[],
+): Promise<void> {
+  for (const edit of buildTimedOutCardEdits(cardText, cards)) {
+    await swallowingApiCall(
+      // allow-raw-bot-api: routed through swallowingApiCall (retry policy); message-id-targeted edit (no thread to lose). Passing {} as opts (no reply_markup) strips the stale Allow/Deny keyboard atomically with the text edit.
+      () => bot.api.editMessageText(edit.chatId, edit.messageId, richMessage(edit.text), {}),
+      { chat_id: edit.chatId, verb: 'permission_timeout.strip' },
+    )
+  }
+}
+
 function dispatchPermissionVerdict(ev: PermissionEvent): void {
   const selfAgent = process.env.SWITCHROOM_AGENT_NAME ?? ''
   const delivered = ipcServer.sendToAgent(selfAgent, ev)
@@ -6996,7 +7060,6 @@ const ipcServer: IpcServer = createIpcServer({
         return
       }
     }
-    pendingPermissions.set(requestId, { tool_name: toolName, description, input_preview: inputPreview, startedAt: Date.now() })
     // Natural-language card body — a plain sentence ("Gymbro wants to
     // edit: supplement-log.md" + a why-line), never a raw tool id.
     // The operator sees what is being requested and why at a glance.
@@ -7008,6 +7071,10 @@ const ipcServer: IpcServer = createIpcServer({
       description,
       agentName: _client.agentName,
     })
+    // `card_text` is retained so the TTL reaper can re-edit the SAME body
+    // with a "timed out" footer while stripping the keyboard atomically
+    // (Bug 2 fix #1) — the reaper has no grammy ctx to read the live text.
+    pendingPermissions.set(requestId, { tool_name: toolName, description, input_preview: inputPreview, startedAt: Date.now(), card_text: text, cards: [] })
     // Compact action row: ❌ Deny · ✅ Allow · 🔁 Always… — the scope of an
     // "always" grant stays hidden until the operator taps "🔁 Always…",
     // which swaps the row for a scope choice (this file / any file ⚠️). The
@@ -7042,7 +7109,17 @@ const ipcServer: IpcServer = createIpcServer({
             ...(tid != null ? { message_thread_id: tid } : {}),
           }),
         { threadId, chat_id: chatId, verb: 'permission_request' },
-      ).catch(e => {
+      ).then(sent => {
+        // Record the live card's (chat, message) so the TTL reaper can strip
+        // its inline keyboard on auto-deny — a stale Approve button left
+        // tappable dispatches a verdict for a dead request_id (Bug 2). The
+        // entry may already be gone (operator tapped before this resolved);
+        // guard the lookup.
+        const pend = pendingPermissions.get(requestId)
+        if (pend && sent && typeof sent.message_id === 'number') {
+          pend.cards.push({ chatId, messageId: sent.message_id })
+        }
+      }).catch(e => {
         process.stderr.write(`telegram gateway: permission_request send to ${chatId} failed: ${e}\n`)
       })
     }
@@ -8087,7 +8164,10 @@ async function executeReply(args: Record<string, unknown>): Promise<{ content: A
   })()
   const rawText = args.text as string | undefined
   if (rawText == null || rawText === '') throw new Error('reply: text is required and cannot be empty')
-  let text = repairEscapedWhitespace(rawText)
+  // Repair LLM JSON-escape bungles, then promote lone prose paragraph breaks
+  // into GFM hard breaks so the rich path doesn't collapse them (lists/tables/
+  // code are left untouched — see normalizeParagraphBreaks).
+  let text = normalizeParagraphBreaks(repairEscapedWhitespace(rawText))
   // Outbound secret scrub (#2044): mask any secret the agent echoed BEFORE
   // the stderr preview below, the dedup key, the send, and the history
   // record. Mutates `text` so every downstream consumer sees the masked
@@ -8744,6 +8824,41 @@ async function executeReply(args: Record<string, unknown>): Promise<{ content: A
         return lockedBot.api.sendRichMessage(chat_id, richMessage(chunks[i]), richOpts as never)
       }
 
+      // Length-error recovery: a single pre-computed chunk can still exceed the
+      // wire cap when splitMarkdownChunks hit an indivisible region and emitted
+      // it whole (a giant fenced block, a no-boundary blob). Telegram answers
+      // with RICH_MESSAGE_TEXT_TOO_LONG / MESSAGE_TOO_LONG. Re-split this chunk
+      // at a harder boundary and send each piece, rather than misclassifying it
+      // as a parse-reject (which would resend the same oversized payload as
+      // plain text) or surfacing the raw 400.
+      const sendChunkResplit = async (opts: Record<string, unknown>): Promise<void> => {
+        // Re-split at the same cap; for a truly indivisible block this still
+        // yields one oversized piece, but a hard character-cut on the rendered
+        // markdown at least keeps each delivered piece under the wire cap.
+        const subPieces = splitMarkdownChunks(chunks[i], RICH_MESSAGE_MAX_CHARS)
+        const pieces =
+          subPieces.length > 1
+            ? subPieces
+            : hardSliceToCap(chunks[i], RICH_MESSAGE_MAX_CHARS)
+        for (let p = 0; p < pieces.length; p++) {
+          let sent: { message_id: number }
+          if (literalText) {
+            // allow-raw-bot-api: length-error re-split last resort (literal text); wrapping would re-enter the chunk-loop's own classification on an already-classified length failure.
+            sent = await lockedBot.api.sendMessage(chat_id, pieces[p], opts as never)
+          } else {
+            const ro = { ...opts }
+            delete (ro as { link_preview_options?: unknown }).link_preview_options
+            // allow-raw-bot-api: length-error re-split last resort (rich); wrapping would re-enter the chunk-loop's own classification on an already-classified length failure.
+            sent = await lockedBot.api.sendRichMessage(chat_id, richMessage(pieces[p]), ro as never)
+          }
+          sentIds.push(sent.message_id)
+          logOutbound('reply', chat_id, sent.message_id, pieces[p].length, `chunk=${i + 1}/${chunks.length} resplit=${p + 1}/${pieces.length}`)
+        }
+        process.stderr.write(
+          `telegram gateway: rich body too long — re-split chunk ${i + 1}/${chunks.length} into ${pieces.length} piece(s)\n`,
+        )
+      }
+
       try {
         const sent = await robustApiCall(() => sendChunk(sendOpts), { threadId, chat_id })
         sentIds.push(sent.message_id)
@@ -8757,10 +8872,14 @@ async function executeReply(args: Record<string, unknown>): Promise<{ content: A
             const sent = await sendChunk(retryOpts)
             sentIds.push(sent.message_id)
           } catch (retryErr) {
-            // Thread dropped, but the markdown is also unparseable — go plain.
-            if (isHtmlParseRejectError(retryErr)) await sendChunkPlainText(retryOpts)
+            // Thread dropped, AND another failure: length → re-split,
+            // parse-reject → plain text, else propagate.
+            if (isMessageTooLongError(retryErr)) await sendChunkResplit(retryOpts)
+            else if (isHtmlParseRejectError(retryErr)) await sendChunkPlainText(retryOpts)
             else throw retryErr
           }
+        } else if (isMessageTooLongError(err)) {
+          await sendChunkResplit(sendOpts)
         } else if (isHtmlParseRejectError(err)) {
           await sendChunkPlainText(sendOpts)
         } else {
@@ -9259,6 +9378,7 @@ async function executeStreamReply(args: Record<string, unknown>): Promise<unknow
       bot: lockedBot as unknown as { api: import('../stream-controller.js').StreamBotApi },
       retry: robustApiCall,
       repairEscapedWhitespace,
+      normalizeParagraphBreaks,
       assertAllowedChat,
       resolveThreadId,
       disableLinkPreview: access.disableLinkPreview !== false,
@@ -10508,7 +10628,11 @@ async function executeEditMessage(args: Record<string, unknown>): Promise<unknow
   // Single rich-markdown path (#2669): `format:'text'` edits as a literal
   // plain string; everything else edits via the rich-markdown path.
   const editLiteralText = editFormat === 'text'
+  // Match the reply path: repair JSON-escape bungles, then promote lone prose
+  // paragraph breaks for the rich path. A literal-text edit (`format:'text'`)
+  // skips paragraph normalization — it must edit byte-for-byte as given.
   let editRawText = repairEscapedWhitespace(args.text as string)
+  if (!editLiteralText) editRawText = normalizeParagraphBreaks(editRawText)
   // Outbound secret scrub (#2044): an edit must not re-introduce a raw
   // secret into a live bubble or the history row. Mask before scrub/send.
   editRawText = redactOutboundText(editRawText, 'edit_message')
@@ -14687,7 +14811,10 @@ function switchroomExecCombined(args: string[], timeoutMs = 15000): string {
   })
 }
 
-function formatSwitchroomOutput(output: string, maxLen = 4000): string {
+// Default truncation budget for CLI output bound for Telegram. The rich-message
+// wire cap is RICH_MESSAGE_MAX_CHARS (32768) post-#2669, not the legacy 4096
+// plain-text limit. Mirrors shared/bot-runtime.ts formatSwitchroomOutput.
+function formatSwitchroomOutput(output: string, maxLen = RICH_MESSAGE_MAX_CHARS): string {
   const trimmed = output.trim()
   if (trimmed.length <= maxLen) return trimmed
   return trimmed.slice(0, maxLen - 20) + '\n... (truncated)'
@@ -21812,6 +21939,20 @@ bot.on('callback_query:data', async ctx => {
   // scopes (resolveTimeBox → null) and the disabled tier (ttl<=0) stay truly
   // once. The verdict is still dispatched WITHOUT a `rule` (below), so the
   // bridge never caches it untimed — the window lives only in scopedGrants.
+  // Stale-id tap (#2469 follow-up): the pendingStateReaper auto-DENIES a
+  // permission whose TTL expired and DELETES its pending entry — but a late
+  // operator tap on the (now keyboard-stripped, but possibly still-cached)
+  // card would otherwise dispatch a verdict for an already-resolved/dead
+  // request_id, which Claude Code silently ignores. Net: operator THINKS
+  // they approved, but the work was auto-denied and never continues. Be
+  // honest: tell the operator the request already resolved and do NOT
+  // dispatch a verdict for the dead id (no buffering, no resume message).
+  // LIVE ids fall through to the normal dispatch path below, preserving the
+  // dispatchPermissionVerdict buffering/offline-redelivery contract.
+  if (!pendingPermissions.has(request_id)) {
+    await ctx.answerCallbackQuery({ text: STALE_TAP_NOTICE }).catch(() => {})
+    return
+  }
   // Operator tapped a verdict ⇒ they are present; reset no-repeat suppression
   // so a later identical ask is shown fresh rather than silently short-circuited.
   clearPermissionTimeoutSuppression('operator answered a permission card')
@@ -23198,7 +23339,23 @@ const POLL_HEALTH_THRESHOLD = Number(
 let pollHealthCheck: PollHealthCheckHandle | null = null
 if (POLL_HEALTH_INTERVAL_MS > 0) {
   pollHealthCheck = createPollHealthCheck({
-    ping: () => bot.api.getMe(),
+    ping: async () => {
+      await bot.api.getMe()
+      // Secondary: if getMe passes but getUpdates hasn't responded in
+      // `threshold × interval` ms, the grammy runner loop is frozen without
+      // the network being down. Throw so the failure counter increments and
+      // stall recovery fires after `failureThreshold` consecutive misses.
+      // (2026-06-30 incident: one getUpdates TimeoutError → runner silently
+      // froze; getMe stayed green; fleet deaf for 2 h until manual restart.)
+      const staleMs = Date.now() - lastGetUpdatesHeartbeatMs
+      const staleThresholdMs = POLL_HEALTH_INTERVAL_MS * POLL_HEALTH_THRESHOLD
+      if (staleMs > staleThresholdMs) {
+        throw new Error(
+          `getUpdates heartbeat stale: last seen ${Math.round(staleMs / 1000)}s ago ` +
+          `(threshold ${Math.round(staleThresholdMs / 1000)}s) — runner loop frozen`,
+        )
+      }
+    },
     onStall: async () => {
       // Exit non-zero → _switchroom_supervise restarts the gateway sidecar
       // with a fresh runner. Never awaits runnerHandle.stop() (it hangs on a

package/telegram-plugin/gateway/ipc-server.ts

@@ -20,6 +20,7 @@ import type {
   ToolCallMessage,
   ToolCallResult,
 } from "./ipc-protocol.js";
+import { RICH_MESSAGE_MAX_CHARS } from "../format.js";
 
 export interface IpcServerOptions {
   socketPath: string;
@@ -230,9 +231,11 @@ export function validateClientMessage(msg: unknown): msg is ClientToGateway {
     case "pty_partial":
       // Extracted reply text from PTY-tail. May be empty (the extractor
       // returns empty strings for "no text yet" snapshots — gateway
-      // handler dedups on lastPtyPreviewByChat). Capped at 8192 to
-      // give some headroom over Telegram's 4096-char wire limit while
-      // still bounding buffer growth from a runaway extractor.
+      // handler dedups on lastPtyPreviewByChat). Capped at 8192 — this is a
+      // preview-buffer bound on the PTY tail, not the outbound wire cap (which
+      // is now RICH_MESSAGE_MAX_CHARS / 32768 on the rich path post-#2669) —
+      // sized to bound buffer growth from a runaway extractor while still
+      // carrying a useful preview.
       return typeof m.text === "string"
         && (m.text as string).length <= 8192;
     case "update_placeholder":
@@ -270,10 +273,12 @@ export function validateClientMessage(msg: unknown): msg is ClientToGateway {
       if (typeof m.agentName !== "string"
         || !AGENT_NAME_RE.test(m.agentName as string)) return false;
       if (typeof m.chatId !== "string" || (m.chatId as string).length === 0) return false;
-      // text non-empty and bounded — Telegram caps a message at 4096 chars;
-      // reject over-long here (defense in depth against a malformed payload).
+      // text non-empty and bounded — the send_outbound handler posts via
+      // sendRichMessage (rich path), whose wire cap is RICH_MESSAGE_MAX_CHARS
+      // (32768) post-#2669, not the legacy 4096 plain-text limit. Reject
+      // over-long here (defense in depth against a malformed payload).
       if (typeof m.text !== "string" || (m.text as string).length === 0
-        || (m.text as string).length > 4096) return false;
+        || (m.text as string).length > RICH_MESSAGE_MAX_CHARS) return false;
       if (m.threadId !== undefined
         && (typeof m.threadId !== "number" || !Number.isInteger(m.threadId as number))) return false;
       if (m.parseMode !== undefined && m.parseMode !== "html" && m.parseMode !== "text") return false;

package/telegram-plugin/gateway/permission-timeout.ts

@@ -68,3 +68,79 @@ export function isRecentTimeoutDuplicate(
   const at = timeouts.get(sig)
   return at != null && now - at <= windowMs
 }
+
+// ─── Bug 2 — per-tool TTL + timed-out card hygiene + stale-tap honesty ──────
+
+/** Default operator approval-card lifetime. */
+export const PERMISSION_TTL_MS = 10 * 60_000
+
+/**
+ * hostd gated fleet-mutation verbs (rollout / update_apply / agent_* /
+ * config_propose_edit) surface an OPERATOR approval card and demand a
+ * human-scale decision window — 10 min is too tight when the operator is
+ * mid-task. The `mcp__hostd__*` family gets 30 min; everything else keeps
+ * the 10-min default.
+ */
+export const HOSTD_PERMISSION_TTL_MS = 30 * 60_000
+
+/** Per-tool approval-card TTL. */
+export function ttlForTool(toolName: string | undefined): number {
+  return toolName && toolName.startsWith('mcp__hostd__')
+    ? HOSTD_PERMISSION_TTL_MS
+    : PERMISSION_TTL_MS
+}
+
+/** Suffix appended to a card body when its approval window times out. */
+export const TIMED_OUT_FOOTER = '\n\n⏱ Timed out — re-request to act'
+
+export interface PermissionCardRef {
+  chatId: string
+  messageId: number
+}
+
+export interface TimedOutCardEdit {
+  chatId: string
+  messageId: number
+  /** New body text (original card body + the timed-out footer). */
+  text: string
+  /**
+   * Always true: the edit MUST drop the inline keyboard (omit reply_markup)
+   * so the stale Allow/Deny buttons are no longer tappable — the core of
+   * Bug 2 fix #1. A stale tappable Approve dispatches a verdict for an
+   * already-resolved request_id, which Claude Code ignores → "operator
+   * approved but work never continued".
+   */
+  stripKeyboard: true
+}
+
+/**
+ * Build the (pure) list of card edits the reaper applies on TTL auto-deny:
+ * re-render each recorded card's original body with the timed-out footer and
+ * mark it for keyboard-strip. One entry per card (a permission may have been
+ * broadcast to several operator surfaces).
+ */
+export function buildTimedOutCardEdits(
+  cardText: string,
+  cards: readonly PermissionCardRef[],
+): TimedOutCardEdit[] {
+  return cards.map(({ chatId, messageId }) => ({
+    chatId,
+    messageId,
+    text: `${cardText}${TIMED_OUT_FOOTER}`,
+    stripKeyboard: true,
+  }))
+}
+
+/**
+ * A tap on a permission card is STALE when no pending entry exists for its
+ * request_id — the reaper already auto-denied + deleted it on TTL. A stale
+ * tap must NOT dispatch a verdict (the dead id is ignored by Claude Code);
+ * the operator instead gets an honest "already resolved" notice.
+ */
+export function isStaleTap(hasPending: boolean): boolean {
+  return !hasPending
+}
+
+/** Operator-facing notice shown when a stale (timed-out) card is tapped. */
+export const STALE_TAP_NOTICE =
+  'This request already resolved (timed out) — ask again to act.'

package/telegram-plugin/permission-title.ts

@@ -63,6 +63,9 @@ const MCP_TOOL_DESCRIPTIONS: Record<string, string> = {
   "mcp__hostd__agent_exec": "Run a read-only inspection inside another agent",
   "mcp__hostd__update_check": "Check what a fleet-wide update would do",
   "mcp__hostd__update_apply": "Apply a fleet-wide update (pull + recreate)",
+  "mcp__hostd__rollout": "Roll the fleet to a pinned version",
+  "mcp__hostd__config_propose_edit": "Propose an edit to switchroom.yaml",
+  "mcp__hostd__get_status": "Read the last fleet-update status",
   // hindsight — memory
   "mcp__hindsight__recall": "Recall relevant memories",
   "mcp__hindsight__retain": "Retain a memory",

package/telegram-plugin/retry-api-call.ts

@@ -266,6 +266,10 @@ export async function retryWithThreadFallback<T>(
  */
 export function isHtmlParseRejectError(err: unknown): boolean {
   if (!(err instanceof GrammyError) || err.error_code !== 400) return false
+  // A too-long rejection is a LENGTH error (see isMessageTooLongError) — never
+  // route it through the plain-text parse-reject fallback, which would resend
+  // the same oversized body and fail again. The caller re-splits instead.
+  if (isMessageTooLongError(err)) return false
   const d = (err.description || '').toLowerCase()
   return (
     d.includes("can't parse entities") ||
@@ -282,3 +286,26 @@ export function isHtmlParseRejectError(err: unknown): boolean {
     d.includes('expected end tag')
   )
 }
+
+/**
+ * True when Telegram rejected the message because the BODY WAS TOO LONG (over
+ * the rich-message wire cap), not because the markdown failed to parse.
+ *
+ * The rich path surfaces this as `RICH_MESSAGE_TEXT_TOO_LONG` (empirically the
+ * description for 32769+ chars); the legacy plain-text path used
+ * `MESSAGE_TOO_LONG` / "message is too long". A caller that hits this should
+ * re-split the body (`splitMarkdownChunks` at a smaller cap) and resend, NOT
+ * treat it as a parse-reject (which resends the same oversized payload as
+ * plain text). Mirrors rich-send.ts `isLengthError`.
+ */
+export function isMessageTooLongError(err: unknown): boolean {
+  if (!(err instanceof GrammyError) || err.error_code !== 400) return false
+  const d = (err.description || '').toLowerCase()
+  return (
+    d.includes('rich_message_text_too_long') ||
+    d.includes('message_too_long') ||
+    d.includes('text_too_long') ||
+    d.includes('message is too long') ||
+    d.includes('text is too long')
+  )
+}

package/telegram-plugin/rich-send.ts

@@ -39,6 +39,11 @@ export function richMessage(markdown: string): InputRichMessageMarkdown {
  */
 export function isParseEntitiesError(err: unknown): boolean {
   if (!(err instanceof GrammyError) || err.error_code !== 400) return false
+  // A too-long rejection is a LENGTH error, not a parse error — never let the
+  // length case fall through here (it would be "recovered" by resending the
+  // same oversized body as plain text, which fails again). Classify it
+  // separately via isLengthError so the caller re-splits instead.
+  if (isLengthError(err)) return false
   const d = (err.description || '').toLowerCase()
   return (
     d.includes("can't parse entities") ||
@@ -55,3 +60,27 @@ export function isParseEntitiesError(err: unknown): boolean {
     d.includes('expected end tag')
   )
 }
+
+/**
+ * True when Telegram rejected the message because the BODY WAS TOO LONG (over
+ * the rich-message wire cap), as opposed to a markdown-parse failure.
+ *
+ * The rich path surfaces this distinctly: `RICH_MESSAGE_TEXT_TOO_LONG`
+ * (empirically the description for a body of 32769+ chars). The legacy
+ * plain-text path used `MESSAGE_TOO_LONG` / "message is too long" — both are
+ * matched here so a caller that hits either re-splits the body
+ * (`splitMarkdownChunks`) and resends, instead of misclassifying it as a parse
+ * error (and resending the same oversized payload as plain text) or surfacing
+ * the raw 400.
+ */
+export function isLengthError(err: unknown): boolean {
+  if (!(err instanceof GrammyError) || err.error_code !== 400) return false
+  const d = (err.description || '').toLowerCase()
+  return (
+    d.includes('rich_message_text_too_long') ||
+    d.includes('message_too_long') ||
+    d.includes('text_too_long') ||
+    d.includes('message is too long') ||
+    d.includes('text is too long')
+  )
+}

package/telegram-plugin/shared/bot-runtime.ts

@@ -29,6 +29,7 @@ import { createHash } from 'crypto'
 import { AsyncLocalStorage } from 'async_hooks'
 import { clearStaleTelegramPollingState } from '../startup-reset.js'
 import { createRetryApiCall } from '../retry-api-call.js'
+import { RICH_MESSAGE_MAX_CHARS } from '../format.js'
 
 // ─── tg-post tag plumbing ─────────────────────────────────────────────────
 
@@ -179,7 +180,11 @@ export function stripAnsi(text: string): string {
   return text.replace(/\x1b\[[0-9;]*[a-zA-Z]/g, '')
 }
 
-export function formatSwitchroomOutput(output: string, maxLen = 4000): string {
+// Default truncation budget for CLI output bound for Telegram. Post-#2669 the
+// rich-message wire cap is RICH_MESSAGE_MAX_CHARS (32768), not the legacy 4096
+// plain-text limit; the preBlock fence framing (~8 chars) easily fits the
+// remaining headroom.
+export function formatSwitchroomOutput(output: string, maxLen = RICH_MESSAGE_MAX_CHARS): string {
   const trimmed = output.trim()
   if (trimmed.length <= maxLen) return trimmed
   return trimmed.slice(0, maxLen - 20) + '\n... (truncated)'

package/telegram-plugin/silent-reply-anchor.ts

@@ -38,8 +38,15 @@
  * the safety net off; reverts to per-reply fresh send.
  */
 
-/** Telegram caption / text limit. The accumulator stays under this. */
-export const TELEGRAM_MSG_CAP = 4000
+import { RICH_MESSAGE_MAX_CHARS } from './format.js'
+
+/**
+ * Telegram rich-message text limit. The accumulator stays under this before
+ * it rolls to a fresh anchor. Post-#2669 every reply renders as GFM markdown
+ * via `sendRichMessage`, so the cap is `RICH_MESSAGE_MAX_CHARS` (32768), not
+ * the legacy 4096 plain-text limit.
+ */
+export const TELEGRAM_MSG_CAP = RICH_MESSAGE_MAX_CHARS
 
 export interface SilentReplyAnchorDecisionInput {
   /** True when the model passed `disable_notification: true` for

package/telegram-plugin/status-no-truncate.ts

@@ -8,6 +8,10 @@
  * holds the tuning constants that primitive (and its internal helpers)
  * read, so a forked renderer never re-derives them.
  *
+ * Wire cap: since the Bot API 10.1 rich-message migration (#2669) every card
+ * renders as GFM markdown via `sendRichMessage`, whose limit is
+ * `RICH_MESSAGE_MAX_CHARS` (32768), not the legacy 4096 plain-text cap.
+ *
  * The former `SWITCHROOM_STATUS_NO_TRUNCATE` feature flag was retired:
  * rolling-window-with-char-budget is now the only behaviour. The per-line
  * cap (`STATUS_LINE_MAX`) and rolling window (`STATUS_ROLLING_LINES`) apply
@@ -15,6 +19,8 @@
  * (`STATUS_CARD_CHAR_BUDGET`) is the wire-limit backstop.
  */
 
+import { RICH_MESSAGE_MAX_CHARS } from './format.js'
+
 /**
  * Number of trailing narrative/step lines shown in the rolling window.
  * The feed is a fixed-height rolling window: oldest drops off as new arrive.
@@ -30,15 +36,15 @@ export const STATUS_ROLLING_LINES = 5
 export const STATUS_LINE_MAX = 200
 
 /**
- * The safe char budget for a rendered Telegram status card. Telegram's hard
- * cap is 4096; we use 4000 to leave 96 chars of headroom for HTML framing,
- * emoji, and escape expansion — matching the convention in
- * pending-work-progress.ts (TELEGRAM_MSG_CAP = 4000).
+ * The safe char budget for a rendered Telegram status card. The rich-message
+ * wire cap is `RICH_MESSAGE_MAX_CHARS` (32768) post-#2669 — the legacy 4096
+ * plain-text cap no longer applies on the rich path. We use the constant
+ * directly as the backstop.
  *
  * With STATUS_ROLLING_LINES=5 lines each ≤ STATUS_LINE_MAX this backstop
  * effectively never fires in practice, but is kept as a wire-limit safety net.
  */
-export const STATUS_CARD_CHAR_BUDGET = 4000
+export const STATUS_CARD_CHAR_BUDGET = RICH_MESSAGE_MAX_CHARS
 
 /** Indent marker for a nested (foreground sub-agent) step line. */
 export const NESTED_PREFIX = '   ↳ '

package/telegram-plugin/stream-reply-handler.ts

@@ -152,6 +152,12 @@ export interface StreamReplyDeps {
   retry?: RetryPolicy
   /** Whitespace repair applied to the raw caller text. */
   repairEscapedWhitespace: (text: string) => string
+  /**
+   * Promote lone prose paragraph breaks into GFM hard breaks so the rich
+   * path doesn't collapse them. Optional for backward compat; when omitted,
+   * the raw (repaired) text is sent unchanged.
+   */
+  normalizeParagraphBreaks?: (text: string) => string
   /** Validates the chat id against the access list. Throws on deny. */
   assertAllowedChat: (chatId: string) => void
   /** Resolves the effective thread id (explicit, last-inbound, or undefined). */
@@ -302,7 +308,9 @@ export async function handleStreamReply(
   deps: StreamReplyDeps,
 ): Promise<StreamReplyResult> {
   const chat_id = args.chat_id
-  const rawText = deps.repairEscapedWhitespace(args.text)
+  const rawText = deps.normalizeParagraphBreaks
+    ? deps.normalizeParagraphBreaks(deps.repairEscapedWhitespace(args.text))
+    : deps.repairEscapedWhitespace(args.text)
   const done = Boolean(args.done)
   const format = args.format ?? deps.defaultFormat
   if (done) {