switchroom 0.16.47 → 0.17.0

package/telegram-plugin/tests/worker-visibility-prose-silent-harness.test.ts

@@ -0,0 +1,295 @@
+/**
+ * Flagship harness for the prose-silent background-worker visibility fix
+ * (PR 2 of 2). This is the automated proxy for the live-gateway test the
+ * operator demanded: it wires the REAL `startSubagentWatcher` to the REAL
+ * `createWorkerActivityFeed` on ONE shared virtual clock, mirroring the
+ * gateway's `onProgress → workerActivityFeed.update` and
+ * `onFinish → workerActivityFeed.finish` wiring, and drives a sub-agent JSONL
+ * that contains ONLY tool_use events (a long `Bash` run) — NO `sub_agent_text`.
+ *
+ * It asserts the four outcomes the fix must deliver:
+ *   (a) the `🛠 Worker` feed PAINTS a message (gets a messageId) within the
+ *       expected window even though the worker never emitted prose,
+ *   (b) the message keeps UPDATING via the heartbeat while the worker is alive,
+ *   (c) NO false stall is flagged during the Bash window (the worker mid-`Bash`
+ *       is not "stalled" just because its JSONL went quiet), and
+ *   (d) the 300s-style silent-stall TERMINAL synthesis still releases the
+ *       deferred-completion gate at the end (onStallTerminal + onFinish fire,
+ *       and the feed finalizes) — the load-bearing completion path is intact.
+ *
+ * The pre-fix behaviour this locks against: a background worker that dives
+ * straight into a long `Bash` fired one tool tick (before firstPaintMin, so the
+ * paint was held), then no further JSONL lines — and the heartbeat skipped
+ * `messageId == null` handles, so the worker showed NOTHING for its entire run
+ * while ALSO being falsely flagged "stall detected (idle 60s)".
+ *
+ * Uses vitest (no bun:sqlite): no registry DB is wired, so the gate-release
+ * proxy is the `onStallTerminal` + `onFinish` callbacks — the exact signals the
+ * gateway's handback delivery and deferred-completion release consume.
+ */
+
+import { describe, it, expect, vi } from 'vitest'
+import { startSubagentWatcher } from '../subagent-watcher.js'
+import {
+  createWorkerActivityFeed,
+  type WorkerActivityView,
+} from '../worker-activity-feed.js'
+import * as fs from 'fs'
+
+function buildJSONL(...lines: object[]): string {
+  return lines.map((l) => JSON.stringify(l)).join('\n') + '\n'
+}
+function subAgentUserMsg(promptText: string) {
+  return { type: 'user', message: { content: [{ type: 'text', text: promptText }] } }
+}
+function bashToolUse(id: string, command: string) {
+  return { type: 'assistant', message: { content: [{ type: 'tool_use', id, name: 'Bash', input: { command } }] } }
+}
+
+interface FakeBot {
+  sent: Array<{ chatId: string; text: string }>
+  edits: Array<{ messageId: number; text: string }>
+  sendMessage: (chatId: string, text: string) => Promise<{ message_id: number }>
+  editMessageText: (chatId: string, messageId: number, text: string) => Promise<unknown>
+}
+function makeFakeBot(): FakeBot {
+  let nextId = 5000
+  const fb: FakeBot = {
+    sent: [],
+    edits: [],
+    sendMessage: async (chatId, text) => {
+      fb.sent.push({ chatId, text })
+      return { message_id: nextId++ }
+    },
+    editMessageText: async (_chatId, messageId, text) => {
+      fb.edits.push({ messageId, text })
+      return {}
+    },
+  }
+  return fb
+}
+
+/** Flush the feed's async chains (microtasks + the awaited fake bot). */
+const flush = async (): Promise<void> => {
+  for (let i = 0; i < 5; i++) await new Promise((r) => setTimeout(r, 0))
+}
+
+function makeHarness() {
+  const agentId = 'prose-silent-bash-01'
+  const chatId = 'chat-42'
+  let currentTime = 1000
+
+  const stallCalls: Array<{ agentId: string; idleMs: number }> = []
+  const stallTerminalCalls: Array<{ agentId: string }> = []
+  const finishCalls: Array<{ agentId: string; outcome: string }> = []
+
+  const agentDir = '/home/user/.switchroom/agents/myagent'
+  const sessionId = 'mock-session'
+  const projectsRoot = `${agentDir}/.claude/projects`
+  const projectDir = `${projectsRoot}/mock-cwd`
+  const sessionDir = `${projectDir}/${sessionId}`
+  const subagentsDir = `${sessionDir}/subagents`
+  const jsonlPath = `${subagentsDir}/agent-${agentId}.jsonl`
+  const fileContents = new Map<string, Buffer>()
+  // Start with ONLY the dispatch user message — no tool, no prose. The Bash
+  // tool_use is appended post-boot so it fires onProgress on a live (non-
+  // historical) entry, exactly like a worker that starts then dives into Bash.
+  fileContents.set(jsonlPath, Buffer.from(buildJSONL(subAgentUserMsg('run the integration suite')), 'utf-8'))
+
+  let lastOpenedPath: string | null = null
+  const mockFs = {
+    existsSync: ((p: fs.PathLike) => {
+      const ps = String(p)
+      if (ps === projectsRoot || ps === projectDir || ps === sessionDir || ps === subagentsDir) return true
+      return fileContents.has(ps)
+    }) as typeof fs.existsSync,
+    readdirSync: ((p: fs.PathLike) => {
+      const ps = String(p)
+      if (ps === projectsRoot) return ['mock-cwd']
+      if (ps === projectDir) return [sessionId]
+      if (ps === sessionDir) return ['subagents']
+      if (ps === subagentsDir) return [`agent-${agentId}.jsonl`]
+      return []
+    }) as unknown as typeof fs.readdirSync,
+    statSync: ((p: fs.PathLike) => ({ size: fileContents.get(String(p))?.length ?? 0 }) as fs.Stats) as typeof fs.statSync,
+    openSync: ((p: fs.PathLike) => { lastOpenedPath = String(p); return 42 }) as unknown as typeof fs.openSync,
+    closeSync: (() => { lastOpenedPath = null }) as typeof fs.closeSync,
+    readSync: ((
+      _fd: number, buf: NodeJS.ArrayBufferView, offset: number, length: number, position: number | null,
+    ): number => {
+      const content = lastOpenedPath != null ? fileContents.get(lastOpenedPath) : undefined
+      if (!content) return 0
+      const pos = position ?? 0
+      const src = content.slice(pos, pos + length)
+      ;(src as Buffer).copy(buf as Buffer, offset)
+      return src.length
+    }) as unknown as typeof fs.readSync,
+    watch: (() => ({ close: vi.fn() }) as unknown as fs.FSWatcher) as unknown as typeof fs.watch,
+  }
+
+  // One shared interval list drives BOTH the watcher (rescan + checkStalls)
+  // and the feed (heartbeat) off the same virtual clock.
+  const intervals: Array<{ fn: () => void; ms: number; ref: number; fireAt: number }> = []
+  let nextRef = 1
+  const sharedSetInterval = (fn: () => void, ms: number): unknown => {
+    const ref = nextRef++
+    intervals.push({ fn, ms, ref, fireAt: currentTime + ms })
+    return { ref }
+  }
+  const sharedClearInterval = (h: unknown): void => {
+    const { ref } = h as { ref: number }
+    const idx = intervals.findIndex((i) => i.ref === ref)
+    if (idx !== -1) intervals.splice(idx, 1)
+  }
+
+  const bot = makeFakeBot()
+  const feed = createWorkerActivityFeed({
+    bot,
+    now: () => currentTime,
+    firstPaintMinMs: 8000,
+    heartbeatTickMs: 6000,
+    minEditIntervalMs: 2500,
+    setInterval: sharedSetInterval,
+    clearInterval: sharedClearInterval,
+  })
+
+  const watcher = startSubagentWatcher({
+    agentDir,
+    stallThresholdMs: 60_000, // tight active-loop threshold
+    silentSynthesisStallThresholdMs: 300_000, // widened window (also long-runner window)
+    silentStallTerminalMs: 300_000, // post-stall terminal-synthesis window (unchanged)
+    rescanMs: 500,
+    now: () => currentTime,
+    setInterval: sharedSetInterval,
+    clearInterval: sharedClearInterval,
+    fs: mockFs,
+    onStall: (id, idleMs) => stallCalls.push({ agentId: id, idleMs }),
+    onStallTerminal: (id) => stallTerminalCalls.push({ agentId: id }),
+    onFinish: ({ agentId: id, outcome, description, resultText, toolCount, durationMs }) => {
+      finishCalls.push({ agentId: id, outcome })
+      // Mirror the gateway's terminal wiring: force the worker feed's recap.
+      void feed.finish(id, {
+        description,
+        lastTool: null,
+        toolCount,
+        latestSummary: resultText,
+        elapsedMs: durationMs,
+        state: outcome === 'failed' ? 'failed' : 'done',
+      })
+    },
+    // Mirror the gateway's onProgress → workerActivityFeed.update wiring for a
+    // background worker (worker-feed owns the progress beat).
+    onProgress: ({ agentId: id, description, latestSummary, elapsedMs, lastTool, toolCount, progressLine }) => {
+      const view: WorkerActivityView = {
+        description,
+        lastTool,
+        toolCount,
+        // Mirror the gateway's step-line precedence: the friendly tool label
+        // on tool ticks, else the narrative (the unified-cards fix — a
+        // tools-only worker must grow real steps, not freeze on "starting…").
+        latestSummary: progressLine != null && progressLine.length > 0 ? progressLine : latestSummary,
+        elapsedMs,
+        state: 'running',
+      }
+      void feed.update(id, chatId, view)
+    },
+  })
+
+  const advance = (ms: number): void => {
+    currentTime += ms
+    for (;;) {
+      intervals.sort((a, b) => a.fireAt - b.fireAt)
+      const next = intervals[0]
+      if (!next || next.fireAt > currentTime) break
+      next.fireAt += next.ms
+      next.fn()
+    }
+  }
+
+  const appendBash = (): void => {
+    const existing = fileContents.get(jsonlPath) ?? Buffer.from('')
+    const line = JSON.stringify(bashToolUse('tool-bash-1', 'npm run test:integration')) + '\n'
+    fileContents.set(jsonlPath, Buffer.concat([existing, Buffer.from(line, 'utf-8')]))
+  }
+
+  return {
+    agentId, bot, feed, watcher, advance, appendBash, flush,
+    stallCalls, stallTerminalCalls, finishCalls,
+    unmarkHistorical: () => {
+      const e = watcher.getRegistry().get(agentId)
+      if (e) e.historical = false
+    },
+    registry: () => watcher.getRegistry(),
+  }
+}
+
+describe('prose-silent background worker — end-to-end visibility harness (PR 2)', () => {
+  it('paints, keeps updating, does not falsely stall, and still releases the terminal gate', async () => {
+    const h = makeHarness()
+
+    // Boot: register the entry (historical=true at boot). Flip it live to model
+    // an entry discovered post-boot (the only case progress/stall fire).
+    h.advance(500)
+    h.unmarkHistorical()
+
+    // The worker dives into a long Bash. The single tool_use fires onProgress —
+    // BEFORE firstPaintMin — so the feed HOLDS the paint (this is the trap).
+    h.appendBash()
+    h.advance(500) // poll reads the Bash line → onProgress(tool) → feed.update
+    await h.flush()
+    const entry = h.registry().get(h.agentId)
+    expect(entry?.lastTool?.name).toBe('Bash')
+    expect(entry?.toolCount).toBe(1)
+    // Held: elapsed (~1s) < firstPaintMin (8s), no paint yet.
+    expect(h.bot.sent).toHaveLength(0)
+    expect(h.feed.messageIdOf(h.agentId)).toBeNull()
+
+    // (a) PAINT: with NO further JSONL events, the heartbeat performs the first
+    // paint once the held handle is past firstPaintMin. Pre-fix this never
+    // happened (heartbeat skipped messageId==null) → the worker was invisible.
+    h.advance(12_000) // ~12.5s since dispatch — past firstPaintMin, heartbeats fire
+    await h.flush()
+    expect(h.bot.sent).toHaveLength(1)
+    expect(h.feed.messageIdOf(h.agentId)).not.toBeNull()
+    expect(h.bot.sent[0].chatId).toBe('chat-42')
+    expect(h.bot.sent[0].text).toContain('🛠 **Worker**')
+
+    // (b) KEEPS UPDATING: later heartbeats edit the message with a climbing
+    // `· Ns` suffix so the still-alive worker visibly advances.
+    h.advance(30_000)
+    await h.flush()
+    expect(h.bot.edits.length).toBeGreaterThanOrEqual(1)
+    expect(h.bot.edits[h.bot.edits.length - 1].text).toMatch(/· \d+/)
+
+    // (c) NO FALSE STALL during the Bash window: the worker's last tool is a
+    // long-runner, so the tight 60s active-loop threshold does NOT apply. We
+    // are now well past 60s of JSONL silence with zero stall flagged.
+    h.advance(60_000) // total idle ~102s — far past the old 60s misfire point
+    await h.flush()
+    expect(h.stallCalls).toHaveLength(0)
+    // The feed is still live and updating during this window.
+    expect(h.bot.edits.length).toBeGreaterThanOrEqual(2)
+
+    // The stall IS eventually flagged once past the widened silent-synthesis
+    // window (the worker genuinely never wrote another line / turn_end).
+    h.advance(260_000) // total idle > 300s → stall flagged
+    await h.flush()
+    expect(h.stallCalls).toHaveLength(1)
+    expect(h.stallCalls[0].agentId).toBe(h.agentId)
+    expect(h.stallTerminalCalls).toHaveLength(0)
+
+    // (d) TERMINAL GATE RELEASE: 300s past the stall, the silent-stall terminal
+    // synthesis fires — onStallTerminal + onFinish — and the feed finalizes.
+    // This is the untouched, load-bearing completion path.
+    h.advance(310_000)
+    await h.flush()
+    expect(h.stallTerminalCalls).toHaveLength(1)
+    expect(h.finishCalls).toHaveLength(1)
+    expect(h.finishCalls[0].agentId).toBe(h.agentId)
+    // The feed's terminal recap edited the existing worker message to done.
+    const lastEdit = h.bot.edits[h.bot.edits.length - 1]
+    expect(lastEdit.text).toContain('done')
+    // Handle dropped after finish (gateway unpins independently).
+    expect(h.feed.messageIdOf(h.agentId)).toBeNull()
+  })
+})

package/telegram-plugin/tool-activity-summary.ts

@@ -192,6 +192,25 @@ export function formatFeedElapsed(ms: number): string {
   return `${m}m${(s % 60).toString().padStart(2, '0')}s`
 }
 
+/**
+ * Minimum time the CURRENT step must have been running before its own
+ * `· <elapsed>` suffix appears on the `→` line. Under this, no suffix — a
+ * fresh step reads cleaner without a timer, and the header total already
+ * carries the turn/worker elapsed.
+ */
+export const STEP_TIMER_MIN_MS = 10_000
+
+/**
+ * Live-suffix for the in-progress step line: the STEP's OWN elapsed (time
+ * since that step started — NOT the turn/worker total, which lives in the
+ * header). Empty string until the step has run ≥ STEP_TIMER_MIN_MS, so the
+ * suffix never duplicates the header total on a young step.
+ */
+export function formatStepSuffix(stepElapsedMs: number): string {
+  if (stepElapsedMs < STEP_TIMER_MIN_MS) return ''
+  return ` · ${formatFeedElapsed(stepElapsedMs)}`
+}
+
 // ─── Truncation pipeline (the single correctness-critical primitive) ────────
 //
 // Per RAW line, in this EXACT order:

package/telegram-plugin/turn-flush-safety.ts

@@ -190,7 +190,22 @@ export function decideTurnFlush(input: FlushDecisionInput): FlushDecision {
   if (input.replyCalled) return { kind: 'skip', reason: 'reply-called' }
 
   if (input.chatId == null) return { kind: 'skip', reason: 'no-inbound-chat' }
-  const joined = input.capturedText.join('\n').trim()
+  // #2798 — join whole authored assistant text blocks with a PARAGRAPH break,
+  // not a single newline. Each `capturedText` element is one complete
+  // `content[i].text` block (session-tail.ts `projectAssistantTextBlocks`), so
+  // the boundary between two elements is a paragraph boundary. Joining with a
+  // lone `\n` collapses adjacent blocks into one run — on the Bot API 10.1
+  // rich-markdown path (#2669) a single newline is a soft break, so the blocks
+  // render as an undifferentiated wall-of-text. `\n\n` is the GFM paragraph
+  // separator; the gateway send path then wedges visible spacers into those
+  // gaps via addParagraphSpacers (mirroring the reply path, #2692) so the
+  // paragraphs render with real separation.
+  //
+  // The silent-marker guards below are unaffected by this change:
+  // isSilentFlushMarker length-guards the whole joined string; the composite /
+  // trailing-marker guards split on '\n' and filter empty lines, so the extra
+  // blank line an '\n\n' join introduces is discarded before matching.
+  const joined = input.capturedText.join('\n\n').trim()
   if (joined.length === 0) return { kind: 'skip', reason: 'empty-text' }
   if (isSilentFlushMarker(joined)) return { kind: 'skip', reason: 'silent-marker' }
   // Composite silent noise — e.g. "Sent.\nNO_REPLY\nNO_REPLY" accumulated

package/telegram-plugin/uat/scenarios/jtbd-answer-pings.test.ts

@@ -17,15 +17,14 @@
  * Runs under CI `uat-gate`; the full live MTProto run needs the test-harness
  * agent + a vault session, so locally this self-skips green (no driver).
  *
- * Scope caveat: this end-to-end scenario only exercises PR-2's upgrade code
- * path when the harness model delivers its final answer via the `reply` tool.
- * If the model answers via `stream_reply` instead, that path bypasses the
- * over-ping safety net entirely (it never reaches `decideOverPing`), so the
- * upgrade-over-ack logic is never touched. The model's tool choice isn't
- * forceable here, which makes this scenario a WEAKER backstop than the unit
- * matrix — the real proof of the upgrade behaviour lives in the deterministic
- * unit tests in `over-ping-final-answer-decoupling.test.ts`. Treat this as a
- * live smoke-test of the happy path, not the source of truth.
+ * Scope caveat: this end-to-end scenario exercises PR-2's upgrade code path
+ * when the harness model delivers its final answer via the `reply` tool —
+ * which is now the single final-answer tool (the redundant `stream_reply`
+ * tool was retired). The model's exact phrasing isn't forceable here, which
+ * makes this scenario a WEAKER backstop than the unit matrix — the real proof
+ * of the upgrade behaviour lives in the deterministic unit tests in
+ * `over-ping-final-answer-decoupling.test.ts`. Treat this as a live
+ * smoke-test of the happy path, not the source of truth.
  */
 import { describe, it, expect, beforeAll } from "vitest";
 import { spinUp, type Scenario } from "../harness.js";

package/telegram-plugin/uat/scenarios/jtbd-foreground-feed-visibility-dm.test.ts

@@ -8,7 +8,7 @@
  * (`SILENCE_FALLBACK_MS`, default 300 000 ms) even while it is visibly
  * progressing. The silence clock is reset by:
  *
- *   - A fresh `reply` or `stream_reply` first-emit (any real user-visible send).
+ *   - A fresh `reply` first-emit (any real user-visible send).
  *   - `SILENCE_LIVENESS_PRODUCTION` ON (the default): a new tool-activity label
  *     appearing on the feed, or an answer-stream draft update.
  *

package/telegram-plugin/uat/scenarios/jtbd-narration-intent-dm.test.ts

@@ -100,7 +100,7 @@ describe("uat-jtbd: narration intent before a silent tool stretch", () => {
     const toolCount = events.filter((e) => e.kind === "tool_use").length;
     expect(toolCount).toBeGreaterThan(1);
     const replyToolFired = events.some(
-      (e) => e.kind === "tool_use" && /^(reply|stream_reply)$/.test(e.toolName),
+      (e) => e.kind === "tool_use" && /^reply$/.test(e.toolName),
     );
     expect(replyToolFired).toBe(false);
   });

package/telegram-plugin/worker-activity-feed.ts

@@ -38,7 +38,7 @@ import {
   truncate,
 } from './card-format.js'
 import { STATUS_ROLLING_LINES } from './status-no-truncate.js'
-import { renderStatusCard, formatFeedElapsed } from './tool-activity-summary.js'
+import { renderStatusCard, formatStepSuffix } from './tool-activity-summary.js'
 
 /** Worker-activity feed is ON by default; an operator opts out with
  *  SWITCHROOM_WORKER_ACTIVITY_FEED=0. */
@@ -226,6 +226,13 @@ interface WorkerHandle {
    * `· Ns` suffix climbs even when no fresh view arrives.
    */
   dispatchAtMs: number | null
+  /**
+   * Wall-clock ms the CURRENT step started — stamped whenever a NEW narrative
+   * line lands (the `→` line changes). The heartbeat's step suffix shows the
+   * step's OWN elapsed from this anchor (not the worker total, which the
+   * header already carries), and only once past STEP_TIMER_MIN_MS.
+   */
+  stepStartedAtMs: number | null
 }
 
 const COOLDOWN_JITTER_MS = 500
@@ -311,10 +318,19 @@ export function createWorkerActivityFeed(opts: WorkerActivityFeedOpts): WorkerAc
   function accumulateNarrative(h: WorkerHandle, view: WorkerActivityView): void {
     const line = view.latestSummary.trim()
     if (line.length === 0) return
-    // Dedup against the immediately-preceding line — the watcher re-emits the
-    // same narrative across ticks while a tool runs; we only grow on change.
-    if (h.narrative[h.narrative.length - 1] === line) return
+    // Dedup within the whole rolling window, not just the immediately-
+    // preceding line. The watcher re-emits the same narrative across ticks
+    // while a tool runs (adjacent repeats), AND one logical step can surface
+    // twice non-adjacently — e.g. a "Look for X" preamble followed later by
+    // the Task tool whose describeToolUse label is the same "Look for X"
+    // description, interleaved with another step (the A,B,A duplication the
+    // operator observed on live cards). A legitimate later re-visit of the
+    // same step re-appears once the earlier copy scrolls out of the window.
+    if (h.narrative.includes(line)) return
     h.narrative.push(line)
+    // The `→` current-step line just CHANGED — reset the per-step timer so the
+    // heartbeat's `· Ns` suffix measures THIS step, not the whole worker run.
+    h.stepStartedAtMs = nowFn()
     // Rolling window — keep only the last STATUS_ROLLING_LINES in memory. The
     // render shows exactly those lines (clipped per-line by the unified pipeline);
     // fitCardToBudget is the wire-limit backstop.
@@ -405,13 +421,27 @@ export function createWorkerActivityFeed(opts: WorkerActivityFeedOpts): WorkerAc
   }
 
   /**
-   * Heartbeat — option (a), suffix-only, NEVER opens a new message. For each
-   * handle with a posted message, enqueue a re-render through the existing
-   * chain → doUpdate path (never editMessageText directly). Skips:
-   *   - handles with no posted message (messageId == null),
+   * Heartbeat — keeps a running worker's message alive AND performs the
+   * FIRST paint for a prose-silent worker whose only tick arrived before
+   * `firstPaintMin`.
+   *
+   * Why the first-paint branch exists: a background worker that dives
+   * straight into quiet work (e.g. a long `Bash` / `npm test`) emits a
+   * single `sub_agent_tool_use` event when the command is invoked, then no
+   * further JSONL lines for the whole run. That one tick drives `update`
+   * once — but if it lands before `firstPaintMin` the paint is held, and
+   * with no subsequent tick nothing ever re-drives it, so the worker shows
+   * NOTHING for its entire run (the "I can't see the worker" gap). The
+   * heartbeat closes it: once such a handle is past `firstPaintMin`, drive a
+   * paint here through the same chain → doUpdate path. After first paint the
+   * suffix-only maintenance branch keeps it advancing.
+   *
+   * For handles that already have a posted message, this is the original
+   * option-(a), suffix-only re-render (never editMessageText directly). Skips:
    *   - handles inside a 429 cooldown,
-   *   - handles edited within minEditInterval (no stampede),
-   *   - non-running handles (terminal/deleted).
+   *   - handles with no `lastView` (no update ever arrived) or non-running,
+   *   - for the maintenance branch: handles edited within minEditInterval
+   *     (no stampede) or whose current step isn't yet stale.
    * The `· Ns` liveSuffix is applied ONLY when the worker's current step is
    * stale (now - lastEditAt >= heartbeatTickMs) so a normally-ticking worker is
    * untouched and its body stays byte-stable for the dedup.
@@ -419,19 +449,48 @@ export function createWorkerActivityFeed(opts: WorkerActivityFeedOpts): WorkerAc
   function heartbeatTick(): void {
     const now = nowFn()
     for (const h of handles.values()) {
-      if (h.messageId == null) continue
+      // Orphan-paint guard: `finish()` deletes the handle in a `.finally` that
+      // may not have drained if a tick fires in the same synchronous stretch.
+      // Skip any handle no longer in the map so the first-paint branch below
+      // can never send a fresh `running` message on an already-finished worker
+      // (which would orphan a card that never finalizes). Restores the
+      // structural safety the pre-first-paint `messageId == null` skip gave.
+      if (!handles.has(h.agentId)) continue
       if (h.lastView == null) continue
       if (h.lastView.state !== 'running') continue
       if (now < h.cooldownUntil) continue
+
+      const liveElapsed = h.dispatchAtMs != null ? now - h.dispatchAtMs : h.lastView.elapsedMs
+
+      // First-paint path: a prose-silent worker's single early tick was held
+      // (elapsed < firstPaintMin) and no further tick re-drove it. Once it is
+      // past firstPaintMin, drive the paint. doUpdate's send branch re-checks
+      // firstPaintMin against the refreshed elapsed, so this is exact.
+      if (h.messageId == null) {
+        if (liveElapsed < firstPaintMin) continue
+        const view = { ...h.lastView, elapsedMs: Math.max(h.lastView.elapsedMs, liveElapsed) }
+        h.chain = h.chain
+          .then(() => doUpdate(h, view))
+          .catch((err) => {
+            log(`worker-feed: heartbeat first-paint chain error ${h.agentId}: ${(err as Error).message}`)
+          })
+        continue
+      }
+
       if (now - h.lastEditAt < minEditInterval) continue
       const stale = now - h.lastEditAt >= heartbeatTickMs
       if (!stale) continue
-      const liveElapsed = h.dispatchAtMs != null ? now - h.dispatchAtMs : h.lastView.elapsedMs
-      const liveSuffix = ' · ' + formatFeedElapsed(liveElapsed)
+      // Per-step suffix: the CURRENT step's own elapsed (since the `→` line
+      // last changed), never the worker total — the header already shows the
+      // total, and repeating it on the step line was the Ken-observed dupe.
+      // Under STEP_TIMER_MIN_MS formatStepSuffix returns '' (no timer yet);
+      // the header elapsed still climbs via the refreshed view below.
+      const stepElapsed = h.stepStartedAtMs != null ? now - h.stepStartedAtMs : liveElapsed
+      const liveSuffix = formatStepSuffix(stepElapsed)
       // Re-render THROUGH the chain + doUpdate path — never editMessageText directly.
       //
-      // CLOCK-ANCHOR PARITY: refresh the view's elapsedMs to the SAME
-      // `liveElapsed` the step suffix shows. The header renders
+      // CLOCK-ANCHOR PARITY: refresh the view's elapsedMs to the same `now`
+      // anchor the step suffix uses. The header renders
       // `view.elapsedMs`; passing the stale lastView froze the header at the
       // last watcher event while the `· Ns` suffix kept ticking, so the
       // current step's timer could read MORE than the card's master elapsed
@@ -478,6 +537,7 @@ export function createWorkerActivityFeed(opts: WorkerActivityFeedOpts): WorkerAc
           chain: Promise.resolve(),
           lastView: null,
           dispatchAtMs: null,
+          stepStartedAtMs: null,
         }
         handles.set(agentId, h)
       }

package/vendor/hindsight-memory/CHANGELOG.md

@@ -2,6 +2,30 @@
 
 ## [Unreleased]
 
+### Ported from upstream (vectorize-io/hindsight, `hindsight-integrations/claude-code/`)
+
+- `c5a61db2b` — raise `_check_health` default timeout 2s→10s in
+  `scripts/lib/daemon.py` to stop the busy-daemon restart/kill loop
+  (applied clean; codex-integration hunk not applicable).
+- `3d6c2ba8b` — label "Current time" as UTC in the recall context block
+  (`lib/content.py:format_current_time`), so client LLMs in non-UTC
+  timezones don't misread the timestamp as local time.
+- `962140eef` — recall tag filters: `recallTags`, `recallTagsMatch`,
+  `recallTagGroups`, plus per-additional-bank overrides via
+  `recallAdditionalBankFilters`. Hand-ported into the switchroom recall.py
+  rewrite: filters compose with sender-bank routing (per-bank overrides
+  apply to sender banks too) and are part of the recall cache key
+  (`_tag_filter_sig`) so a filter change can't serve stale cached results.
+  Note: because the key now joins an extra part (empty string when filters
+  are unused), every cache key rotates ONCE across this upgrade boundary —
+  the first recall per session after upgrading is a cache miss. Within a
+  version, keys are unchanged as long as filters stay unused.
+- `55ef70679` — optional `requestTimeoutSeconds` /
+  `HINDSIGHT_REQUEST_TIMEOUT_SECONDS` global request-timeout override in
+  `HindsightClient` (adapted to our `_request`). Wired into retain.py only;
+  recall.py deliberately keeps its own 8s hook-budget timeout. Upstream's
+  mcp_server.py hunks skipped (not vendored).
+
 ### Added
 
 - `{user_id}` template variable for `retainTags` and `retainMetadata`, resolved

package/vendor/hindsight-memory/README.md

@@ -186,6 +186,11 @@ Auto-recall runs on every user prompt. It queries Hindsight for relevant memorie
 | `recallContextTurns` | `HINDSIGHT_RECALL_CONTEXT_TURNS` | `1` | How many prior conversation turns to include when composing the recall query. `1` = only the latest user message; higher values give more context but may dilute the query. |
 | `recallMaxQueryChars` | `HINDSIGHT_RECALL_MAX_QUERY_CHARS` | `800` | Maximum character length of the query sent to Hindsight. Longer queries are truncated. |
 | `recallRoles` | — | `["user", "assistant"]` | Which message roles to include when building the recall query from prior turns. |
+| `recallTags` | `HINDSIGHT_RECALL_TAGS` | `[]` | Optional tags to pass to the recall API, such as `["memory_type:rule"]`. The env var accepts JSON or a comma-separated list. |
+| `recallTagsMatch` | `HINDSIGHT_RECALL_TAGS_MATCH` | `"any"` | Tag matching mode used with `recallTags` or `recallTagGroups`: `"any"`, `"all"`, `"any_strict"`, or `"all_strict"`. |
+| `recallTagGroups` | `HINDSIGHT_RECALL_TAG_GROUPS` | `null` | Optional compound tag filter passed through to the recall API. The env var must be JSON. |
+| `recallAdditionalBankFilters` | `HINDSIGHT_RECALL_ADDITIONAL_BANK_FILTERS` | `{}` | Optional per-bank tag filter overrides for banks listed in `recallAdditionalBanks`, keyed by bank ID. Each value may set `recallTags`, `recallTagsMatch`, and `recallTagGroups`. The env var must be JSON. |
+| `requestTimeoutSeconds` | `HINDSIGHT_REQUEST_TIMEOUT_SECONDS` | unset | Optional global HTTP request timeout override (seconds) for retain and API calls. The recall hook keeps its own 8s hook-budget timeout regardless. |
 | `recallPromptPreamble` | — | built-in string | Text placed above the recalled memories in the injected context block. Customize this to change how Claude interprets the memories. |
 
 ---

package/vendor/hindsight-memory/scripts/lib/client.py

@@ -44,9 +44,29 @@ def _validate_api_url(url: str) -> str:
 class HindsightClient:
     """HTTP client for the Hindsight API."""
 
-    def __init__(self, api_url: str, api_token: Optional[str] = None):
+    def __init__(
+        self,
+        api_url: str,
+        api_token: Optional[str] = None,
+        request_timeout_override: Optional[int] = None,
+    ):
         self.api_url = _validate_api_url(api_url)
         self.api_token = api_token
+        self.request_timeout_override = request_timeout_override
+
+    def _resolve_timeout(self, timeout: int) -> int:
+        """Return the override if configured, otherwise the caller's timeout.
+
+        Upstream 55ef70679. NOTE: recall.py deliberately does not pass the
+        override — its 8s timeout is a hook-budget invariant.
+
+        The override is clamped to >= 1: a zero/negative env value would
+        otherwise reach urlopen as a nonsensical timeout (0 fails every
+        request immediately), turning a config typo into a dead client.
+        """
+        if self.request_timeout_override is None:
+            return timeout
+        return max(1, self.request_timeout_override)
 
     def _headers(self) -> dict:
         headers = {
@@ -58,6 +78,7 @@ class HindsightClient:
         return headers
 
     def _request(self, method: str, path: str, body: Optional[dict] = None, timeout: int = DEFAULT_TIMEOUT) -> dict:
+        timeout = self._resolve_timeout(timeout)
         url = f"{self.api_url}{path}"
         data = json.dumps(body).encode() if body else None
         req = urllib.request.Request(url, data=data, headers=self._headers(), method=method)
@@ -100,6 +121,9 @@ class HindsightClient:
         max_tokens: int = 1024,
         budget: str = "mid",
         types: Optional[list] = None,
+        tags: Optional[list] = None,
+        tags_match: Optional[str] = None,
+        tag_groups: Optional[object] = None,
         timeout: int = 10,
     ) -> dict:
         """Recall memories from a bank.
@@ -115,6 +139,12 @@ class HindsightClient:
             body["budget"] = budget
         if types:
             body["types"] = types
+        if tags:
+            body["tags"] = tags
+        if tags_match:
+            body["tags_match"] = tags_match
+        if tag_groups:
+            body["tag_groups"] = tag_groups
         return self._request("POST", path, body, timeout=timeout)
 
     def retain(