switchroom 0.17.10 → 0.18.3

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "switchroom",
   "//version": "NOT the release version — source of truth is the git tag, resolved by scripts/build.mjs:resolveVersion() (see CLAUDE.md > Standard release process). This field is stale by design and only the Layer-4 dev/non-tag fallback for build.mjs + src/cli/resolve-version.ts; do NOT bump it expecting a release to pick it up. npm-pack tarball naming needs a real version — do that as an UNCOMMITTED pack-time bump (see release step 6), never a committed one.",
-  "version": "0.17.10",
+  "version": "0.18.3",
   "description": "Run Claude Code 24/7 on your Claude Pro/Max subscription over Telegram. Open-source alternative to OpenClaw and NanoClaw — no API keys.",
   "type": "module",
   "bin": {

package/profiles/_base/settings.json.hbs

@@ -21,8 +21,8 @@
 {
   "permissions": {
     "allow": {{{json permissionAllow}}},
-    "deny": {{{json toolsDeny}}}{{#if defaultModeAcceptEdits}},
-    "defaultMode": "acceptEdits"{{/if}}
+    "deny": {{{json toolsDeny}}},
+    "defaultMode": "{{defaultMode}}"
   }{{#if hindsightEnabled}},
   "autoMemoryEnabled": false{{/if}}{{#if mcpServers}},
   "mcpServers": {{{json mcpServers}}}

package/profiles/_base/start.sh.hbs

@@ -33,6 +33,19 @@ if [ "$SWITCHROOM_RUNTIME" = "docker" ] && [ -z "$SWITCHROOM_DOCKER_TMUX_INNER"
   # same path the rest of start.sh + the MCP sidecar expects.
   export TELEGRAM_STATE_DIR="{{agentDir}}/telegram"
 
+  # SWITCHROOM_AGENT_NAME is the canonical "which agent am I" identity. It is
+  # normally supplied by the container env (compose.ts) so it is already
+  # present here, but the authoritative inner-pass export lives at line ~387,
+  # AFTER the gateway fork below. On any runtime where the compose env is NOT
+  # the source (non-docker / local dev), the forked gateway daemon would then
+  # start with the var UNSET — which collapses its worktree-ownership filter
+  # (worktree-watch-cwds.ts) to [], so a worktree-isolated background
+  # sub-agent gets NO live progress feed for its whole run (#1116 / #2893).
+  # Hoist the export here, before the fork, so the gateway ALWAYS has its
+  # identity on the fast path regardless of runtime. Idempotent with the
+  # compose env and the inner-pass export. Pinned by the scaffold-order test.
+  export SWITCHROOM_AGENT_NAME="{{name}}"
+
   # Gateway-consumed env MUST be exported HERE, before the gateway fork
   # below. The gateway daemon reads channels.telegram.* knobs (and any
   # agent env) from process.env at startup — e.g. SWITCHROOM_TG_STREAM_
@@ -57,9 +70,17 @@ if [ "$SWITCHROOM_RUNTIME" = "docker" ] && [ -z "$SWITCHROOM_DOCKER_TMUX_INNER"
   # ANTHROPIC_CUSTOM_HEADERS exported BEFORE the gateway fork below, or
   # discoverSrModels() returns [] and /model never shows OpenRouter entries.
   #
-  # Mirrors the INNER block's fail-open logic exactly:
-  #   - missing key   → log + skip export (gateway talks direct OAuth)
-  #   - proxy down    → log + strip ALL routing env (fail-open)
+  # Mirrors the INNER block's split boot contract EXACTLY (see the long note
+  # at the inner block for the full rationale). This OUTER pass runs BEFORE
+  # `exec tmux`, so whatever it does to the routing env is inherited by the
+  # inner pass — which is precisely why the old permanent strip-on-unreachable
+  # was so damaging: it removed SWITCHROOM_LITELLM here, and the inner
+  # self-heal block is gated on SWITCHROOM_LITELLM, so the entire inner fix
+  # was dead on the real docker path. The two boot failure modes:
+  #   - MISSING KEY → log LOUDLY + fail-open (strip routing; gateway direct OAuth)
+  #   - PROXY UNREACHABLE → log LOUDLY + KEEP routing in place (NO strip) so it
+  #     survives into the inner pass and self-heals when litellm returns. Boot
+  #     is non-fatal either way.
   #   - ANTHROPIC_CUSTOM_HEADERS already set → skip (idempotent)
   #
   # SWITCHROOM_AGENT_NAME is injected by compose env (compose.ts:1816)
@@ -67,8 +88,9 @@ if [ "$SWITCHROOM_RUNTIME" = "docker" ] && [ -z "$SWITCHROOM_DOCKER_TMUX_INNER"
   if [ -n "${SWITCHROOM_LITELLM:-}" ] && [ -z "$ANTHROPIC_CUSTOM_HEADERS" ] && command -v switchroom >/dev/null 2>&1; then
     sr_ll_key="$(switchroom vault get "litellm/$SWITCHROOM_AGENT_NAME/api-key" 2>/dev/null || true)"
     sr_ll_ok=""
+    sr_ll_unreachable=""
     if [ -z "$sr_ll_key" ]; then
-      echo "litellm(outer): no virtual key for agent '$SWITCHROOM_AGENT_NAME' — gateway will use direct OAuth (no tracking/guardrail)" >&2
+      echo "litellm(outer): WARNING — no virtual key for agent '$SWITCHROOM_AGENT_NAME'; gateway falling back to direct Anthropic OAuth (untracked, unguarded)." >&2
     elif command -v curl >/dev/null 2>&1 && [ -n "$ANTHROPIC_BASE_URL" ]; then
       # Bounded retry probe (co-boot race fix, 2026-07): when the whole stack
       # co-boots, the litellm proxy's heavy Python app is often not yet healthy
@@ -85,7 +107,12 @@ if [ "$SWITCHROOM_RUNTIME" = "docker" ] && [ -z "$SWITCHROOM_DOCKER_TMUX_INNER"
         sleep 3
       done
       if [ -z "$sr_ll_up" ]; then
-        echo "litellm(outer): proxy unreachable at ${SWITCHROOM_LITELLM_BASE:-$ANTHROPIC_BASE_URL} after 120s of retries — falling back to direct OAuth (no tracking/guardrail this session)" >&2
+        # Proxy unreachable but the key is present. Do NOT strip: leave routing
+        # pointed at litellm so it survives into the inner (tmux) pass and
+        # self-heals once the proxy is back (socat forwarder reconnects
+        # per-connection). Boot continues.
+        sr_ll_unreachable="1"
+        echo "litellm(outer): WARNING — proxy unreachable at ${SWITCHROOM_LITELLM_BASE:-$ANTHROPIC_BASE_URL} after 120s of retries; gateway discovery will FAIL until it recovers — routing LEFT IN PLACE so it self-heals. NOT falling back to untracked direct Anthropic OAuth." >&2
       else
         sr_ll_ok="1"
       fi
@@ -98,10 +125,17 @@ if [ "$SWITCHROOM_RUNTIME" = "docker" ] && [ -z "$SWITCHROOM_DOCKER_TMUX_INNER"
 x-litellm-customer-id: $SWITCHROOM_AGENT_NAME
 x-litellm-tags: agent:$SWITCHROOM_AGENT_NAME,profile:${SWITCHROOM_AGENT_PROFILE:-default}"
       export CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY=1
+    elif [ -n "$sr_ll_unreachable" ]; then
+      # Proxy unreachable at boot: routing intentionally LEFT IN PLACE (loud
+      # warning already emitted) so it survives into the inner pass and
+      # self-heals once litellm returns. NO unset — the permanent strip here
+      # was what made the inner self-heal fix inert on docker.
+      :
     else
+      # Missing-key fail-open: gateway talks direct OAuth, unproxied.
       unset ANTHROPIC_BASE_URL ANTHROPIC_SMALL_FAST_MODEL SWITCHROOM_LITELLM SWITCHROOM_LITELLM_BASE
     fi
-    unset sr_ll_key sr_ll_ok
+    unset sr_ll_key sr_ll_ok sr_ll_unreachable
   fi
 
   # Tiny in-process supervisor: runs cmd in a respawn loop with
@@ -911,12 +945,21 @@ fi
 # content-safety guardrails — it never alters the model or Claude's operation.
 # See reference/invariants.md § "Operator-controlled gateway carve-out".
 #
-# FAIL-OPEN (operator decision 2026-06-28): if the key is missing OR the proxy
-# is unreachable at boot, strip the routing env and fall back to the direct
-# broker-OAuth Anthropic path, logging the reason LOUDLY. Availability wins over
-# tracking/guardrails — a proxy outage must never take an agent dark. The
-# tradeoff is an explicit, logged guardrail lapse for that session, not a silent
-# one. Re-probed on every (re)boot, so recovery is automatic.
+# TWO boot failure modes, handled DIFFERENTLY (2026-07-08 — was a single
+# fail-open path that silently took an agent off-proxy for its whole lifetime):
+#   - MISSING KEY (no per-agent virtual key in the vault): fail-open — strip the
+#     routing env and fall back to the direct broker-OAuth Anthropic path,
+#     logging LOUDLY. Without a key there is nothing to authenticate to the
+#     proxy with, so there is no metered route to self-heal into.
+#   - PROXY UNREACHABLE at boot (key present, liveliness probe fails within the
+#     retry window): do NOT strip. Leave ANTHROPIC_BASE_URL / SWITCHROOM_LITELLM*
+#     pointed at the proxy (the socat forwarder at 127.0.0.1:4010 self-heals
+#     per-connection) and emit a LOUD warning. Claude traffic FAILS+retries until
+#     the proxy returns, then routes through it automatically — the metered path
+#     stays the metered path. We deliberately do NOT silently fall back to
+#     untracked direct Anthropic on a transient blip: an agent that boots during
+#     a brief litellm outage previously never routed through litellm again until
+#     a manual restart. Re-probed on every (re)boot.
 #
 # Static tags (x-litellm-customer-id / x-litellm-tags) give per-AGENT
 # attribution in LiteLLM. Per-SESSION is NOT achievable here: claude sends no
@@ -924,11 +967,22 @@ fi
 # per-session cost/issue tracking is handled out-of-band by correlating
 # LiteLLM's request log against switchroom's turn ledger, never by mutating the
 # claude protocol.
+# _LITELLM_OK is read by the session-model-override block below: an sr-*
+# (LiteLLM/OpenRouter) session override must be DROPPED when the proxy is
+# unreachable at boot, or claude would 4xx an unknown model against Anthropic.
+# Empty by default (proxy not confirmed live); set to "1" only on a successful
+# liveliness probe. Deliberately NOT unset with the sr_ll_* scratch vars.
+_LITELLM_OK=""
 if [ -n "${SWITCHROOM_LITELLM:-}" ] && command -v switchroom >/dev/null 2>&1; then
   sr_ll_key="$(switchroom vault get "litellm/$SWITCHROOM_AGENT_NAME/api-key" 2>/dev/null || true)"
   sr_ll_ok=""
+  sr_ll_unreachable=""
   if [ -z "$sr_ll_key" ]; then
-    echo "litellm: no virtual key for agent '$SWITCHROOM_AGENT_NAME' — falling back to direct OAuth (no tracking/guardrail)" >&2
+    echo "==================== litellm FAIL-OPEN ====================" >&2
+    echo "WARNING: no litellm virtual key for agent '$SWITCHROOM_AGENT_NAME'." >&2
+    echo "WARNING: falling back to direct Anthropic OAuth (untracked, unguarded)" >&2
+    echo "WARNING: — cannot authenticate to the proxy without a key." >&2
+    echo "==========================================================" >&2
   elif command -v curl >/dev/null 2>&1 && [ -n "$ANTHROPIC_BASE_URL" ]; then
     # Bounded retry probe (co-boot race fix, 2026-07): when the whole stack
     # co-boots, the litellm proxy's heavy Python app is often not yet healthy
@@ -945,7 +999,16 @@ if [ -n "${SWITCHROOM_LITELLM:-}" ] && command -v switchroom >/dev/null 2>&1; th
       sleep 3
     done
     if [ -z "$sr_ll_up" ]; then
-      echo "litellm: proxy unreachable at ${SWITCHROOM_LITELLM_BASE:-$ANTHROPIC_BASE_URL} after 120s of retries — falling back to direct OAuth (no tracking/guardrail this session)" >&2
+      # Proxy unreachable at boot but the key is present. Do NOT strip routing:
+      # leave it pointed at litellm so the fleet self-heals once the proxy is
+      # back (the socat forwarder at 127.0.0.1:4010 reconnects per-connection).
+      sr_ll_unreachable="1"
+      echo "==================== litellm UNREACHABLE ====================" >&2
+      echo "WARNING: litellm proxy unreachable at ${SWITCHROOM_LITELLM_BASE:-$ANTHROPIC_BASE_URL} after 120s of retries;" >&2
+      echo "WARNING: Claude traffic will FAIL until it recovers — routing LEFT IN PLACE" >&2
+      echo "WARNING: so it self-heals (socat forwarder reconnects per-connection)." >&2
+      echo "WARNING: NOT falling back to untracked direct Anthropic OAuth." >&2
+      echo "============================================================" >&2
     else
       sr_ll_ok="1"
     fi
@@ -954,6 +1017,7 @@ if [ -n "${SWITCHROOM_LITELLM:-}" ] && command -v switchroom >/dev/null 2>&1; th
     sr_ll_ok="1"
   fi
   if [ -n "$sr_ll_ok" ]; then
+    _LITELLM_OK="1"
     # Newline-separated Name: Value pairs (claude CLI ANTHROPIC_CUSTOM_HEADERS format).
     # Tags: agent:<name> for per-agent spend tracking; profile:<profile> for
     # fleet-level cost breakdown by role. Per-turn tags (cron vs telegram) are
@@ -967,24 +1031,109 @@ x-litellm-tags: agent:$SWITCHROOM_AGENT_NAME,profile:${SWITCHROOM_AGENT_PROFILE:
     # models configured in the proxy appear in the /model picker and can be
     # selected via --model. Without this, the CLI only knows its bundled list.
     export CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY=1
+  elif [ -n "$sr_ll_unreachable" ]; then
+    # Proxy unreachable at boot: routing intentionally LEFT IN PLACE (loud
+    # warning already emitted above) so it self-heals when litellm returns.
+    # _LITELLM_OK stays empty so any sr-* session model override is still
+    # dropped below (claude would 4xx an unknown model against a down endpoint).
+    # NO unset here — that permanent strip was the bug this branch fixes.
+    :
   else
-    # Fail-open: drop every routing var so the claude CLI talks to Anthropic
-    # directly on its OAuth credential (subscription path), unproxied.
+    # Missing key fail-open: drop every routing var so the claude CLI talks to
+    # Anthropic directly on its OAuth credential (subscription path), unproxied.
     unset ANTHROPIC_BASE_URL ANTHROPIC_SMALL_FAST_MODEL SWITCHROOM_LITELLM SWITCHROOM_LITELLM_BASE
   fi
-  unset sr_ll_key sr_ll_ok
+  unset sr_ll_key sr_ll_ok sr_ll_unreachable
+fi
+
+# --- Session-only model override (carrier: .session-model-override) ---
+#
+# The Telegram `/model <sr-*>` switch can't use claude's in-REPL `/model`
+# picker for non-Anthropic (LiteLLM/OpenRouter `sr-*`) models — the CLI's
+# native picker rejects unknown ids ("Model not found"). Instead the gateway
+# writes the chosen model token to `.session-model-override` and gracefully
+# restarts the agent; THIS boot picks it up and launches `claude --model
+# <token>` directly (no picker validation at launch — LiteLLM routes it).
+#
+# One-shot + session-only: the carrier is consumed (rm) on this one boot
+# regardless of validity, so the next restart reverts to the configured
+# default `{{{modelQ}}}`. Mirrors the `.force-fresh-session` marker's
+# gateway↔start.sh round-trip. See telegram-plugin/gateway/model-command.ts.
+# NB {{{modelQ}}} is already shell-single-quoted by the scaffold (it renders as
+# a quoted token, e.g. 'claude-sonnet-5'), so it is assigned BARE here — never
+# inside additional double quotes, which would embed the literal quote chars in
+# the value and break `claude --model`.
+_EFFECTIVE_MODEL={{{modelQ}}}
+if [ -f "{{agentDir}}/.session-model-override" ]; then
+  _override="$(tr -d '[:space:]' < "{{agentDir}}/.session-model-override" 2>/dev/null || true)"
+  rm -f "{{agentDir}}/.session-model-override"
+  # Shape gate — kept aligned with MODEL_ARG_RE in telegram-plugin/gateway/model-command.ts.
+  # `/` is allowed for OpenRouter-style `sr-vendor/model` ids; it is not a shell
+  # metachar inside the double-quoted `claude --model "$_EFFECTIVE_MODEL"` usage below.
+  if printf '%s' "$_override" | grep -Eq '^[A-Za-z0-9][]A-Za-z0-9._[/-]{0,99}$'; then
+    _EFFECTIVE_MODEL="$_override"
+    # LiteLLM-down guard for an sr-* OVERRIDE only (operator decision 2026-07):
+    # with the proxy unreachable at boot there IS a Claude configured default to
+    # fall back to, so DROP the override rather than boot on an unreachable sr-*
+    # model that would 4xx against Anthropic — log LOUDLY and write an alert
+    # sentinel the gateway turns into a Telegram message. (The passthrough→router
+    # repoint for a LIVE sr-* — override OR configured default — is done once,
+    # post-resolution, below.)
+    case "$_override" in
+      sr-*)
+        if [ -z "$_LITELLM_OK" ]; then
+          _EFFECTIVE_MODEL={{{modelQ}}}
+          echo "session-model: LiteLLM proxy unreachable at boot — DROPPING sr-* override '$_override', booting on configured default '$_EFFECTIVE_MODEL' instead (would otherwise 4xx against Anthropic)" >&2
+          echo "session-model: the requested sr-* model is UNAVAILABLE this session; re-issue /model $_override once LiteLLM is reachable" >&2
+          printf 'LiteLLM proxy was unreachable at boot, so the session-only model switch to `%s` was dropped — the agent booted on its configured default `%s` instead. Re-issue /model %s once LiteLLM is reachable.\n' "$_override" "$_EFFECTIVE_MODEL" "$_override" > "{{agentDir}}/.session-model-alert" 2>/dev/null || true
+        fi
+        ;;
+    esac
+  else
+    echo "session-model: ignoring malformed .session-model-override (failed shape gate) — using configured default '$_EFFECTIVE_MODEL'" >&2
+  fi
+  unset _override
 fi
 
+# sr-* passthrough→router repoint — ONE post-resolution gate covering BOTH the
+# /model override path AND the configured-default path (`model: sr-*` in
+# switchroom.yaml, which has NO override carrier). sr-* (OpenRouter) models route
+# by MODEL NAME through LiteLLM's model-mapped root. The default ANTHROPIC_BASE_URL
+# points at the `/anthropic` PASSTHROUGH (raw byte-forward to api.anthropic.com,
+# chosen to dodge the Opus SSE re-chunk stall for Claude traffic) — but the
+# passthrough is model-agnostic and ships EVERY request to Anthropic regardless of
+# --model, so an sr-* model 4xxs "model not found". Repoint at the LiteLLM router
+# root so claude's /v1/messages hits the model router → OpenRouter. Claude
+# (default/override) sessions are untouched — they keep the passthrough.
+#
+# Guarded on the proxy being reachable at boot ($_LITELLM_OK). If it is NOT, we
+# leave routing exactly as compose/start.sh set it (compose already points a
+# non-Claude default at the router root) and run degraded until litellm returns —
+# there is NO Claude default to fall back to for a persistent sr-* agent, and
+# that (loud-warned, non-fatal) degraded state is the correct behavior.
+case "$_EFFECTIVE_MODEL" in
+  sr-*)
+    if [ -n "$_LITELLM_OK" ] && [ -n "$SWITCHROOM_LITELLM_BASE" ]; then
+      export ANTHROPIC_BASE_URL="$SWITCHROOM_LITELLM_BASE"
+      echo "session-model: effective model '$_EFFECTIVE_MODEL' is sr-* — routing via LiteLLM model router '$SWITCHROOM_LITELLM_BASE' (off /anthropic passthrough) so it reaches OpenRouter" >&2
+    fi
+    ;;
+esac
+# Record the EFFECTIVE launched model so the gateway can re-hydrate its
+# in-memory session-model state after this restart, keeping /status and the
+# welcome card honest. Overwrite (not consumed) — the gateway reads it at boot.
+printf '%s\n' "$_EFFECTIVE_MODEL" > "{{agentDir}}/.active-session-model" 2>/dev/null || true
+
 {{#if useSwitchroomPlugin}}
 if [ -n "$APPEND_PROMPT" ]; then
-  exec claude $CONTINUE_FLAG --dangerously-load-development-channels server:switchroom-telegram --plugin-dir "{{securityPluginDir}}"{{#if hindsightEnabled}} --plugin-dir "{{agentDir}}/.claude/plugins/hindsight-memory"{{/if}} $SR_FLEET_ARG{{#if modelQ}} --model {{{modelQ}}}{{/if}}{{#if thinkingEffort}} --effort {{thinkingEffort}}{{/if}}{{#if permissionMode}} --permission-mode {{permissionMode}}{{/if}}{{#if fallbackModelQ}} --fallback-model {{{fallbackModelQ}}}{{/if}} --append-system-prompt "$APPEND_PROMPT"{{#if dangerousMode}} --dangerously-skip-permissions{{/if}}{{#if extraCliArgs}}{{{extraCliArgs}}}{{/if}}
+  exec claude $CONTINUE_FLAG --dangerously-load-development-channels server:switchroom-telegram --plugin-dir "{{securityPluginDir}}"{{#if hindsightEnabled}} --plugin-dir "{{agentDir}}/.claude/plugins/hindsight-memory"{{/if}} $SR_FLEET_ARG --model "$_EFFECTIVE_MODEL"{{#if thinkingEffort}} --effort {{thinkingEffort}}{{/if}}{{#if permissionMode}} --permission-mode {{permissionMode}}{{/if}}{{#if fallbackModelQ}} --fallback-model {{{fallbackModelQ}}}{{/if}} --append-system-prompt "$APPEND_PROMPT"{{#if dangerousMode}} --dangerously-skip-permissions{{/if}}{{#if extraCliArgs}}{{{extraCliArgs}}}{{/if}}
 else
-  exec claude $CONTINUE_FLAG --dangerously-load-development-channels server:switchroom-telegram --plugin-dir "{{securityPluginDir}}"{{#if hindsightEnabled}} --plugin-dir "{{agentDir}}/.claude/plugins/hindsight-memory"{{/if}} $SR_FLEET_ARG{{#if modelQ}} --model {{{modelQ}}}{{/if}}{{#if thinkingEffort}} --effort {{thinkingEffort}}{{/if}}{{#if permissionMode}} --permission-mode {{permissionMode}}{{/if}}{{#if fallbackModelQ}} --fallback-model {{{fallbackModelQ}}}{{/if}}{{#if dangerousMode}} --dangerously-skip-permissions{{/if}}{{#if extraCliArgs}}{{{extraCliArgs}}}{{/if}}
+  exec claude $CONTINUE_FLAG --dangerously-load-development-channels server:switchroom-telegram --plugin-dir "{{securityPluginDir}}"{{#if hindsightEnabled}} --plugin-dir "{{agentDir}}/.claude/plugins/hindsight-memory"{{/if}} $SR_FLEET_ARG --model "$_EFFECTIVE_MODEL"{{#if thinkingEffort}} --effort {{thinkingEffort}}{{/if}}{{#if permissionMode}} --permission-mode {{permissionMode}}{{/if}}{{#if fallbackModelQ}} --fallback-model {{{fallbackModelQ}}}{{/if}}{{#if dangerousMode}} --dangerously-skip-permissions{{/if}}{{#if extraCliArgs}}{{{extraCliArgs}}}{{/if}}
 fi
 {{else}}
 if [ -n "$APPEND_PROMPT" ]; then
-  exec claude $CONTINUE_FLAG --channels plugin:telegram@claude-plugins-official --plugin-dir "{{securityPluginDir}}"{{#if hindsightEnabled}} --plugin-dir "{{agentDir}}/.claude/plugins/hindsight-memory"{{/if}} $SR_FLEET_ARG{{#if modelQ}} --model {{{modelQ}}}{{/if}}{{#if thinkingEffort}} --effort {{thinkingEffort}}{{/if}}{{#if permissionMode}} --permission-mode {{permissionMode}}{{/if}}{{#if fallbackModelQ}} --fallback-model {{{fallbackModelQ}}}{{/if}} --append-system-prompt "$APPEND_PROMPT"{{#if dangerousMode}} --dangerously-skip-permissions{{/if}}{{#if extraCliArgs}}{{{extraCliArgs}}}{{/if}}
+  exec claude $CONTINUE_FLAG --channels plugin:telegram@claude-plugins-official --plugin-dir "{{securityPluginDir}}"{{#if hindsightEnabled}} --plugin-dir "{{agentDir}}/.claude/plugins/hindsight-memory"{{/if}} $SR_FLEET_ARG --model "$_EFFECTIVE_MODEL"{{#if thinkingEffort}} --effort {{thinkingEffort}}{{/if}}{{#if permissionMode}} --permission-mode {{permissionMode}}{{/if}}{{#if fallbackModelQ}} --fallback-model {{{fallbackModelQ}}}{{/if}} --append-system-prompt "$APPEND_PROMPT"{{#if dangerousMode}} --dangerously-skip-permissions{{/if}}{{#if extraCliArgs}}{{{extraCliArgs}}}{{/if}}
 else
-  exec claude $CONTINUE_FLAG --channels plugin:telegram@claude-plugins-official --plugin-dir "{{securityPluginDir}}"{{#if hindsightEnabled}} --plugin-dir "{{agentDir}}/.claude/plugins/hindsight-memory"{{/if}} $SR_FLEET_ARG{{#if modelQ}} --model {{{modelQ}}}{{/if}}{{#if thinkingEffort}} --effort {{thinkingEffort}}{{/if}}{{#if permissionMode}} --permission-mode {{permissionMode}}{{/if}}{{#if fallbackModelQ}} --fallback-model {{{fallbackModelQ}}}{{/if}}{{#if dangerousMode}} --dangerously-skip-permissions{{/if}}{{#if extraCliArgs}}{{{extraCliArgs}}}{{/if}}
+  exec claude $CONTINUE_FLAG --channels plugin:telegram@claude-plugins-official --plugin-dir "{{securityPluginDir}}"{{#if hindsightEnabled}} --plugin-dir "{{agentDir}}/.claude/plugins/hindsight-memory"{{/if}} $SR_FLEET_ARG --model "$_EFFECTIVE_MODEL"{{#if thinkingEffort}} --effort {{thinkingEffort}}{{/if}}{{#if permissionMode}} --permission-mode {{permissionMode}}{{/if}}{{#if fallbackModelQ}} --fallback-model {{{fallbackModelQ}}}{{/if}}{{#if dangerousMode}} --dangerously-skip-permissions{{/if}}{{#if extraCliArgs}}{{{extraCliArgs}}}{{/if}}
 fi
 {{/if}}

package/profiles/coding/CLAUDE.md.hbs

@@ -41,7 +41,7 @@ You are a senior software engineering agent. You write, review, debug, and archi
 Claude Code's file-based auto-memory is disabled. Use **Hindsight** MCP tools:
 
 - `mcp__hindsight__recall` — search past memories. Auto-fires on every message.
-- `mcp__hindsight__retain` — store important facts. Auto-retains transcript every ~10 turns.
+- `mcp__hindsight__retain` — store important facts. Auto-retains every turn (chunked, a small ~3-turn window each time), so it's prompt and cheap.
 - `mcp__hindsight__reflect` — synthesize across memories for complex queries.
 - `mcp__hindsight__create_mental_model` — maintain semantic summaries (e.g. "codebase architecture").
 

package/profiles/default/CLAUDE.md

@@ -35,7 +35,7 @@ Hindsight is a memory bank with semantic search, knowledge graph, entity resolut
 
 ### Day-to-day tools
 - `mcp__hindsight__recall` — semantic-search the bank for relevant past memories. Auto-fires on every inbound user message via the plugin's UserPromptSubmit hook (you'll see "Relevant memories from past conversations" in your context). Call manually when you need a more specific query than the auto-fired one.
-- `mcp__hindsight__retain` — store a new memory. The plugin automatically retains the conversation transcript every ~10 turns via the Stop hook, so you usually don't need this. Call manually for significant decisions, corrections, or facts you want immediately searchable.
+- `mcp__hindsight__retain` — store a new memory. The plugin auto-retains every turn via the Stop hook, but in chunked mode each retain only processes a small recent window (~3 turns) — so it captures memory promptly and survives restarts without re-sending the whole transcript, and you usually don't need this. Call manually for significant decisions, corrections, or facts you want immediately searchable.
 - `mcp__hindsight__reflect` — Hindsight's LLM-powered "answer this query using the bank's content + directives". Use when the user asks a question that requires synthesis across multiple past memories.
 
 ### Mental Models
@@ -64,7 +64,7 @@ Don't retain:
 - Sensitive content the user explicitly asked you to not remember
 - Things already in a mental model — they'll be re-derived from underlying memories
 
-The plugin's auto-retain (Stop hook) handles transcript-level storage on a 10-turn cadence, so you don't need to manually retain everything. Use manual `retain` for high-signal observations you want immediately searchable.
+The plugin's auto-retain (Stop hook) fires every turn, but in chunked mode each retain only processes a small recent window (~3 turns) — so storage stays prompt and cheap and survives restarts without re-sending the whole transcript, and you don't need to manually retain everything. Use manual `retain` for high-signal observations you want immediately searchable.
 
 ## Sub-Agent Delegation
 

package/profiles/default/CLAUDE.md.hbs

@@ -39,7 +39,7 @@ Hindsight is a memory bank with semantic search, knowledge graph, entity resolut
 
 ### Day-to-day tools
 - `mcp__hindsight__recall` — semantic-search the bank for relevant past memories. Auto-fires on every inbound user message via the plugin's UserPromptSubmit hook (you'll see "Relevant memories from past conversations" in your context). Call manually when you need a more specific query than the auto-fired one.
-- `mcp__hindsight__retain` — store a new memory. The plugin automatically retains the conversation transcript every ~10 turns via the Stop hook, so you usually don't need this. Call manually for significant decisions, corrections, or facts you want immediately searchable.
+- `mcp__hindsight__retain` — store a new memory. The plugin auto-retains every turn via the Stop hook, but in chunked mode each retain only processes a small recent window (~3 turns) — so it captures memory promptly and survives restarts without re-sending the whole transcript, and you usually don't need this. Call manually for significant decisions, corrections, or facts you want immediately searchable.
 - `mcp__hindsight__reflect` — Hindsight's LLM-powered "answer this query using the bank's content + directives". Use when the user asks a question that requires synthesis across multiple past memories.
 
 ### Mental Models
@@ -68,7 +68,7 @@ Don't retain:
 - Sensitive content the user explicitly asked you to not remember
 - Things already in a mental model — they'll be re-derived from underlying memories
 
-The plugin's auto-retain (Stop hook) handles transcript-level storage on a 10-turn cadence, so you don't need to manually retain everything. Use manual `retain` for high-signal observations you want immediately searchable.
+The plugin's auto-retain (Stop hook) fires every turn, but in chunked mode each retain only processes a small recent window (~3 turns) — so storage stays prompt and cheap and survives restarts without re-sending the whole transcript, and you don't need to manually retain everything. Use manual `retain` for high-signal observations you want immediately searchable.
 
 ## Sub-Agent Delegation
 

package/profiles/executive-assistant/CLAUDE.md.hbs

@@ -40,7 +40,7 @@ You help the user stay organized, prepared, and focused on high-leverage work. Y
 Claude Code's file-based auto-memory is disabled. Use **Hindsight** MCP tools:
 
 - `mcp__hindsight__recall` — search past memories. Auto-fires every message.
-- `mcp__hindsight__retain` — store important facts. Auto-retains every ~10 turns.
+- `mcp__hindsight__retain` — store important facts. Auto-retains every turn (chunked, a small ~3-turn window each time), so it's prompt and cheap.
 - `mcp__hindsight__create_mental_model` — maintain models for "contacts", "active projects", "user preferences".
 
 Save proactively: contacts and their roles, scheduling preferences, project status, decisions with rationale, communication templates. Only Hindsight memories survive compaction.

package/profiles/health-coach/CLAUDE.md.hbs

@@ -34,7 +34,7 @@ Recommend the user consult a professional for: persistent pain/injury, medical c
 Claude Code's file-based auto-memory is disabled. Use **Hindsight** MCP tools:
 
 - `mcp__hindsight__recall` — search past memories. Auto-fires on every message.
-- `mcp__hindsight__retain` — store important facts. Auto-retains every ~10 turns.
+- `mcp__hindsight__retain` — store important facts. Auto-retains every turn (chunked, a small ~3-turn window each time), so it's prompt and cheap.
 - `mcp__hindsight__create_mental_model` — maintain a "fitness profile" mental model.
 
 Save proactively: workout logs, goals, PRs, preferences, patterns (e.g. "poor sleep on Sundays"), injuries/limitations. Only Hindsight memories survive session compaction.

package/telegram-plugin/auth-snapshot-format.ts

@@ -447,30 +447,27 @@ function pctCells(
 }
 
 /**
- * The Status cell: for a blocked account, when the binding window comes back
- * (`back <when>`); for a healthy/throttling account, when the soonest window
- * refills (`refills <when>`). `<when>` is the tz-aware absolute time (date shown
- * only when not today) plus the concise relative hint in parens.
+ * The per-window reset cell (`5h resets` / `7d resets`): the tz-aware absolute
+ * reset time for THAT specific window (date shown only when not today) plus the
+ * concise relative hint in parens — e.g. `1:20 PM (in 2h)`.
+ *
+ * Degrades in lockstep with `pctCells` so the percentage cell and its reset cell
+ * always agree: no quota → probe-failed message (or `—`); thin probe → `quota
+ * unknown`; missing reset on an otherwise-present window → `—`.
  */
-function statusCell(snap: AccountSnapshot, now: Date, tz: string): string {
+function windowResetCell(
+  snap: AccountSnapshot,
+  now: Date,
+  tz: string,
+  win: '5h' | '7d',
+): string {
   if (!snap.quota) {
-    return snap.quotaError ? `probe failed (${snap.quotaError})` : 'probe failed';
+    return snap.quotaError ? `probe failed (${snap.quotaError})` : '—';
   }
   if (isProbeThin(snap.quota)) return 'quota unknown';
-  const q = snap.quota;
-  const health = classifyHealth(snap, now);
-  if (health === 'blocked') {
-    const win = bindingWindow(q);
-    const reset = win === '5h' ? q.fiveHourResetAt : q.sevenDayResetAt;
-    if (!reset) return 'back — (reset unknown)';
-    return `back ${formatStatusTime(reset, now, tz)} (in ${formatRelative(reset, now)})`;
-  }
-  // healthy / throttling — show the soonest refill across both windows.
-  const fiveIn = q.fiveHourResetAt ? q.fiveHourResetAt.getTime() - now.getTime() : Infinity;
-  const sevenIn = q.sevenDayResetAt ? q.sevenDayResetAt.getTime() - now.getTime() : Infinity;
-  const soonest = fiveIn <= sevenIn ? q.fiveHourResetAt : q.sevenDayResetAt;
-  if (!soonest) return 'refills —';
-  return `refills ${formatStatusTime(soonest, now, tz)} (in ${formatRelative(soonest, now)})`;
+  const reset = win === '5h' ? snap.quota.fiveHourResetAt : snap.quota.sevenDayResetAt;
+  if (!reset) return '—';
+  return `${formatStatusTime(reset, now, tz)} (in ${formatRelative(reset, now)})`;
 }
 
 export function renderAuthSnapshotFormat2(
@@ -495,8 +492,8 @@ export function renderAuthSnapshotFormat2(
 
   if (ordered.length > 0) {
     lines.push('');
-    lines.push('| State | Account | 5h | 7d | Status |');
-    lines.push('| --- | --- | --- | --- | --- |');
+    lines.push('| State | Account | 5h | 5h resets | 7d | 7d resets |');
+    lines.push('| --- | --- | --- | --- | --- | --- |');
     for (const s of ordered) {
       const emoji = HEALTH_EMOJI[classifyHealth(s, now)];
       // Account cell: FULL email, never truncated; active gets a (active) suffix.
@@ -512,9 +509,10 @@ export function renderAuthSnapshotFormat2(
       // tableCell wrap around the finished span.
       const accountCell = `\`${codeSpanSafe(s.isActive ? `${label} (active)` : label)}\``;
       const { five, seven } = pctCells(s, now);
-      const status = statusCell(s, now, tz);
+      const fiveReset = windowResetCell(s, now, tz, '5h');
+      const sevenReset = windowResetCell(s, now, tz, '7d');
       lines.push(
-        `| ${emoji} | ${tableCell(accountCell)} | ${five} | ${seven} | ${tableCell(status)} |`,
+        `| ${emoji} | ${tableCell(accountCell)} | ${five} | ${tableCell(fiveReset)} | ${seven} | ${tableCell(sevenReset)} |`,
       );
     }
   }

package/telegram-plugin/context-exhaustion.ts

@@ -48,3 +48,127 @@ export function shouldArmOrphanedReplyTimeout(params: {
     !params.progressCardActive
   )
 }
+
+/**
+ * Default "recently streaming" window (ms) for the orphaned-reply liveness
+ * stamp. The gateway overrides this from
+ * SWITCHROOM_ORPHANED_REPLY_STREAM_WINDOW_MS; this constant is the fallback and
+ * the value the LivenessTracker tests pin against.
+ */
+export const ORPHANED_REPLY_STREAM_WINDOW_MS = 120_000
+
+/**
+ * Result of a fuse-expiry decision.
+ *
+ *  - `rearm`           — re-arm the fuse (keep the turn alive) instead of
+ *                        firing the synthetic turn_end backstop.
+ *  - `countsAgainstCap`— this rearm (or the fire it turned into at the cap) was
+ *                        a working/recently-streaming rearm, i.e. subject to the
+ *                        ORPHANED_REPLY_MAX_REARMS cap. Human-wait rearms are
+ *                        uncapped and report `false` here.
+ */
+export interface OrphanedReplyExpiryDecision {
+  rearm: boolean
+  countsAgainstCap: boolean
+}
+
+/**
+ * Per-turn liveness tracker for the orphaned-reply backstop.
+ *
+ * WHY THIS EXISTS (the thinking-pause fix):
+ *   The orphaned-reply fuse (ORPHANED_REPLY_TIMEOUT_MS = 30 s) used to be reset
+ *   ONLY by `tool_label` and `text` stream events. During a long model
+ *   reasoning pause the gateway sees NO such events (thinking events carry no
+ *   text), so the fuse ran down and force-ended a genuinely-live turn mid-work
+ *   ("orphaned-reply timeout (30000ms) — forcing backstop" ~1 ms before
+ *   turn_end, with minutes of real work still to come).
+ *
+ * THE FIX:
+ *   Stamp `lastStreamEventAt` on ANY genuine stream event (via onStreamEvent,
+ *   called from the gateway dispatcher entry). If a genuine event arrived
+ *   within `windowMs` (default 120 s) the turn is "recently streaming" and the
+ *   fuse re-arms instead of firing — a reasoning pause is survivable while a
+ *   genuine multi-minute hang (no events at all) still fires.
+ *
+ * This is a small, pure, side-effect-free seam so the decision logic is unit
+ * testable without the full gateway. The gateway holds one instance per
+ * CurrentTurn (so per-turn identity / supersession semantics are unchanged) and
+ * delegates: the dispatcher calls onStreamEvent; the fire callback calls
+ * decideOnExpiry; the defensive turn_end guard reads recentlyStreaming.
+ */
+export class LivenessTracker {
+  /** Wall-clock (ms) of the last genuine stream event for this turn. */
+  lastStreamEventAt: number
+  /**
+   * How many times the fuse re-armed on a working / recently-streaming
+   * expiry. Bounded by ORPHANED_REPLY_MAX_REARMS. Zeroed by onStreamEvent
+   * whenever a genuine stream event lands, so the cap only bites CONSECUTIVE
+   * silent expiries (a genuinely wedged single tool with no stream at all).
+   */
+  orphanedReplyRearmCount = 0
+
+  constructor(startedAt: number) {
+    this.lastStreamEventAt = startedAt
+  }
+
+  /**
+   * Stamp liveness for a genuine stream event and reset the rearm counter.
+   *
+   * F4 predicate: everything EXCEPT the synthetic `turn_end` re-entry
+   * (durationMs === -1, the fire callback's own re-dispatch) counts as a
+   * genuine stream event. Stamping a REAL turn_end (durationMs >= 0) is
+   * harmless — the turn is ending anyway.
+   *
+   * The counter reset lives HERE (driven by the dispatcher), NOT in the fuse
+   * re-arm path — otherwise every rearm would zero its own counter and nullify
+   * the 20-cap.
+   */
+  onStreamEvent(kind: string, durationMs: number | undefined, now: number): void {
+    if (kind === 'turn_end' && durationMs === -1) return
+    this.lastStreamEventAt = now
+    this.orphanedReplyRearmCount = 0
+  }
+
+  /** True iff a genuine stream event landed within `windowMs` of `now`. */
+  recentlyStreaming(now: number, windowMs: number): boolean {
+    return now - this.lastStreamEventAt < windowMs
+  }
+
+  /**
+   * Decide what to do when the orphaned-reply fuse expires.
+   *
+   * Rearm when the turn is working OR recently streaming OR a human is being
+   * waited on. Working / recently-streaming rearms count against `maxRearms`
+   * (so a genuinely wedged single tool that never streams still surfaces after
+   * the cap). Human-wait rearms are uncapped (the human simply hasn't tapped
+   * yet). Once the cap is hit with nothing else keeping the turn alive, fire
+   * (rearm:false) — matching the existing fail-safe.
+   *
+   * Mutates `orphanedReplyRearmCount` on each rearm.
+   */
+  decideOnExpiry(opts: {
+    working: boolean
+    humanWaiting: boolean
+    now: number
+    windowMs: number
+    maxRearms: number
+  }): OrphanedReplyExpiryDecision {
+    // Human-wait rearms are uncapped (unchanged from prior behaviour).
+    if (opts.humanWaiting) {
+      this.orphanedReplyRearmCount++
+      return { rearm: true, countsAgainstCap: false }
+    }
+    const recently = this.recentlyStreaming(opts.now, opts.windowMs)
+    if (opts.working || recently) {
+      if (this.orphanedReplyRearmCount < opts.maxRearms) {
+        this.orphanedReplyRearmCount++
+        return { rearm: true, countsAgainstCap: true }
+      }
+      // Cap reached with only working/recently-streaming keeping it alive:
+      // fire to surface the wedge.
+      return { rearm: false, countsAgainstCap: true }
+    }
+    // Nothing keeping the turn alive → fire (fail-safe).
+    return { rearm: false, countsAgainstCap: false }
+  }
+}