switchroom 0.18.11 → 0.18.12

package/profiles/_base/start.sh.hbs

@@ -165,8 +165,70 @@ x-litellm-tags: agent:$SWITCHROOM_AGENT_NAME,profile:${SWITCHROOM_AGENT_PROFILE:
   # The sidecar's own structured logging is written
   # directly to its log file; this wrapper only handles process
   # lifecycle. Ampersand-backgrounded by callers below.
+  # Size-based log rotation for a supervised sidecar's logfile (#3025).
+  # The gateway sidecar appends per-poll trace lines and can run for
+  # WEEKS without the supervise loop regaining control (it only loops on
+  # child exit), so rotate-at-restart alone let gateway-supervisor.log
+  # grow to 555MB on clerk / 162MB on klanker and fill the host disk.
+  # This background checker runs independently of the child's lifecycle.
+  #
+  # copytruncate (cp + `: >`), NOT `mv`: the supervised child holds an
+  # open fd on $_logfile (its stdout/stderr is redirected there with
+  # `>> "$_logfile"`). A plain `mv` would leave the child writing to the
+  # now-renamed inode, so the live log would silently stop growing and
+  # the rotated file would keep filling. copytruncate preserves the fd —
+  # the child keeps appending to the same (now-empty) inode. Worst-case
+  # race is a few log lines written between the cp and the truncate being
+  # lost; acceptable for a debug trace log. Keeps at most ~2×cap on disk
+  # (live + one .1 generation). Cap + interval are env-overridable.
+  _switchroom_log_rotator() {
+    local _logfile="$1"
+    local _max="${SWITCHROOM_SIDECAR_LOG_MAX_BYTES:-52428800}"   # 50 MiB default
+    local _interval="${SWITCHROOM_SIDECAR_LOG_ROTATE_INTERVAL_SEC:-300}"  # 5 min
+    # Validate BOTH env overrides up front; garbage falls back to the
+    # default. Unvalidated, a non-numeric interval makes `sleep` fail
+    # instantly and the `while true` loop hot-spins a CPU core for the
+    # container lifetime; a non-numeric cap makes the -gt test below
+    # error (a shell error line to stdout) every cycle forever. A zero
+    # interval would also hot-spin, so it falls back too.
+    case "$_max" in ''|*[!0-9]*) _max=52428800;; esac
+    case "$_interval" in ''|0|*[!0-9]*) _interval=300;; esac
+    # A cap of 0 disables rotation entirely (operator escape hatch).
+    # (Negative values contain '-' → non-numeric per the guard above →
+    # default cap, i.e. rotation stays on.)
+    [ "$_max" -eq 0 ] && return 0
+    while true; do
+      sleep "$_interval"
+      [ -f "$_logfile" ] || continue
+      local _size
+      _size=$(wc -c < "$_logfile" 2>/dev/null || echo 0)
+      # `wc -c < file` yields a bare integer; guard against empty/non-numeric.
+      case "$_size" in ''|*[!0-9]*) continue;; esac
+      if [ "$_size" -gt "$_max" ]; then
+        if cp "$_logfile" "$_logfile.1" 2>/dev/null; then
+          : > "$_logfile"
+          echo "[supervise] rotated $_logfile (${_size} bytes > ${_max} cap) → ${_logfile}.1" >> "$_logfile"
+        else
+          # cp failed (e.g. ENOSPC — exactly when rotation matters most).
+          # Fall back to truncate-without-backup: dropping the .1 backup
+          # beats a rotator that can never free space (#3025 review).
+          : > "$_logfile"
+          echo "[supervise] rotated $_logfile (${_size} bytes > ${_max} cap) WITHOUT backup — cp to ${_logfile}.1 failed (disk full?)" >> "$_logfile"
+        fi
+      fi
+    done
+  }
+
   _switchroom_supervise() {
     local _name="$1"; local _logfile="$2"; shift 2
+    # Start the size-based rotator for this sidecar's log (#3025). One
+    # per supervised sidecar; lives for the container lifetime alongside
+    # the respawn loop below.
+    _switchroom_log_rotator "$_logfile" &
+    # Record the rotator's pid so the oneshot-ok return path below can
+    # reap it — otherwise every completed one-shot sidecar leaks a
+    # background sleep loop for the container lifetime (#3025 review).
+    local _rotator_pid=$!
     # Optional `--oneshot-ok` flag (must directly follow the logfile):
     # marks a sidecar that can LEGITIMATELY complete. For such a sidecar
     # a clean exit 0 means "job done" → stop supervising, no respawn.
@@ -211,6 +273,9 @@ x-litellm-tags: agent:$SWITCHROOM_AGENT_NAME,profile:${SWITCHROOM_AGENT_PROFILE:
       # below — a crash always self-heals.
       if [ $_oneshot_ok -eq 1 ] && [ $_exit -eq 0 ]; then
         echo "[supervise] $_name completed cleanly (exit 0) — one-shot-ok, not respawning." >> "$_logfile"
+        # The sidecar is done — its log stops growing, so reap the
+        # rotator instead of leaking its sleep loop forever (#3025).
+        kill "$_rotator_pid" 2>/dev/null || true
         return 0
       fi
       # A run that stayed up for at least the backoff cap means the

package/profiles/_shared/vault-protocol.md.hbs

@@ -3,7 +3,9 @@
   Rendered automatically by `switchroom apply` / `agent reconcile` from
   profiles/_shared/vault-protocol.md.hbs. Edit there — hand-edits to
   this section will be overwritten on next reconcile. To add agent-
-  specific guidance, put it in workspace/CLAUDE.custom.md (sidecar).
+  specific guidance, edit CLAUDE.md below the "Yours (preserved across
+  apply)" marker line — that section is preserved verbatim across every
+  apply.
 -->
 
 ## Vault & secrets

package/profiles/coding/CLAUDE.md.hbs

@@ -43,7 +43,7 @@ Claude Code's file-based auto-memory is disabled. Use **Hindsight** MCP tools:
 - `mcp__hindsight__recall` — search past memories. Auto-fires on every message.
 - `mcp__hindsight__retain` — store important facts. Auto-retains every turn (chunked, a small ~3-turn window each time), so it's prompt and cheap.
 - `mcp__hindsight__reflect` — synthesize across memories for complex queries.
-- `mcp__hindsight__create_mental_model` — maintain semantic summaries (e.g. "codebase architecture").
+- `mcp__switchroom-telegram__mental_model_propose` — propose a mental model: a standing semantic summary refreshed over the bank (e.g. "codebase architecture"). Mental-model writes are operator-approved: this posts an approval card and persists on approval. Don't call `mcp__hindsight__create_mental_model`/`update_mental_model` directly (they're denied and redirected here).
 
 Save proactively: architecture decisions, codebase patterns, conventions, known issues, user preferences. Your session may be compacted at any time — only Hindsight memories survive.
 

package/profiles/default/CLAUDE.md.hbs

@@ -45,14 +45,14 @@ Hindsight is a memory bank with semantic search, knowledge graph, entity resolut
 ### Mental Models
 A mental model is a pre-computed semantic summary backed by reflection over the bank — a way to maintain a standing answer to a recurring question, semantically populated and refreshed.
 
-- `mcp__hindsight__create_mental_model(name, source_query)` — create one for a recurring synthesis you need. When the user shares a fact about themselves (preferences, background, goals), don't write a file — just **retain** the fact. You do NOT need to build or maintain a per-agent "user profile": who the user is lives in dedicated per-user profile banks that the operator curates out-of-band, and recall surfaces it automatically.
+Creating, updating, or refreshing a mental model is **operator-approved** — don't call `create_mental_model` / `update_mental_model` / `refresh_mental_model` / `delete_mental_model` directly (a direct call is denied and redirected). Use `mcp__switchroom-telegram__mental_model_propose(name, source_query)` when you need a recurring synthesis: it posts an approval card and persists the model on approval. When the user shares a fact about themselves (preferences, background, goals), don't write a file and don't propose a model — just **retain** the fact. You do NOT need to build or maintain a per-agent "user profile": who the user is lives in dedicated per-user profile banks that the operator curates out-of-band, and recall surfaces it automatically.
 
 ### Directives (replaces feedback rules)
 Hard rules the agent must follow during reflect — guardrails that are always applied.
 
 - `mcp__hindsight__create_directive(text)` — e.g., `create_directive("Always prefer TypeScript over JavaScript for this user's projects")`. When the user gives you a correction or "always do X" rule, create a directive instead of writing a feedback `.md` file.
 
-(Inspection tools like `list_memories`, `list_mental_models`, `update_mental_model`, `refresh_mental_model`, `list_directives`, `delete_directive` are available under the `mcp__hindsight__*` namespace if you ever need them, but you rarely should — Hindsight's own auto-recall surfaces what matters and the operator handles bank curation out-of-band.)
+(Read-only inspection tools like `list_memories`, `list_mental_models`, `get_mental_model`, `list_directives` are available under the `mcp__hindsight__*` namespace if you ever need them, but you rarely should — Hindsight's own auto-recall surfaces what matters and the operator handles bank curation out-of-band. The mental-model WRITE tools — `create`/`update`/`refresh`/`delete_mental_model` — are gated: propose via `mcp__switchroom-telegram__mental_model_propose`, don't call them directly.)
 
 ### What to retain — and what NOT to retain
 

package/profiles/executive-assistant/CLAUDE.md.hbs

@@ -41,7 +41,7 @@ Claude Code's file-based auto-memory is disabled. Use **Hindsight** MCP tools:
 
 - `mcp__hindsight__recall` — search past memories. Auto-fires every message.
 - `mcp__hindsight__retain` — store important facts. Auto-retains every turn (chunked, a small ~3-turn window each time), so it's prompt and cheap.
-- `mcp__hindsight__create_mental_model` — maintain models for "contacts", "active projects", "user preferences".
+- `mcp__switchroom-telegram__mental_model_propose` — propose a mental model: a standing semantic summary refreshed over the bank (e.g. "contacts", "active projects", "user preferences"). Mental-model writes are operator-approved: this posts an approval card and persists on approval. Don't call `mcp__hindsight__create_mental_model`/`update_mental_model` directly (they're denied and redirected here).
 
 Save proactively: contacts and their roles, scheduling preferences, project status, decisions with rationale, communication templates. Only Hindsight memories survive compaction.
 

package/profiles/health-coach/CLAUDE.md.hbs

@@ -35,7 +35,7 @@ Claude Code's file-based auto-memory is disabled. Use **Hindsight** MCP tools:
 
 - `mcp__hindsight__recall` — search past memories. Auto-fires on every message.
 - `mcp__hindsight__retain` — store important facts. Auto-retains every turn (chunked, a small ~3-turn window each time), so it's prompt and cheap.
-- `mcp__hindsight__create_mental_model` — maintain a "fitness profile" mental model.
+- `mcp__switchroom-telegram__mental_model_propose` — propose a mental model (e.g. a "fitness profile" — a standing semantic summary refreshed over the bank). Mental-model writes are operator-approved: this posts an approval card and persists on approval. Don't call `mcp__hindsight__create_mental_model`/`update_mental_model` directly (they're denied and redirected here).
 
 Save proactively: workout logs, goals, PRs, preferences, patterns (e.g. "poor sleep on Sundays"), injuries/limitations. Only Hindsight memories survive session compaction.
 

package/telegram-plugin/bridge/bridge.ts

@@ -32,6 +32,7 @@ import type { InboundMessage, PermissionEvent, StatusEvent } from '../gateway/ip
 import { matchesAllowRule } from '../permission-rule.js'
 import { createOutstandingPermissionLedger } from './permission-ledger.js'
 import { appendCrashBreadcrumb } from './crash-breadcrumb.js'
+import { InboundDedup, shouldDedupInbound, dedupChatKey } from './inbound-dedup.js'
 
 installPluginLogger()
 
@@ -127,6 +128,7 @@ const TOOL_SCHEMAS = [
                 callback_data: { type: 'string', description: 'Opaque tag delivered back to the agent on tap. Max 58 chars (gateway prepends an `agent:` prefix to the 64-byte Telegram limit). Mutually exclusive with url.' },
                 ack_text: { type: 'string', description: 'Toast text shown to the user the instant they tap this button (#710). Default "✓ received". Max ~200 chars (Telegram answerCallbackQuery limit). Has no effect on URL buttons.' },
                 single_use: { type: 'boolean', description: 'When true (default) tapping any single_use button on the message removes the entire keyboard so the user can\'t double-fire. Set false on buttons that should stay tappable (e.g. a "Refresh" button). If ANY button on the message has single_use:false the keyboard is preserved on tap.' },
+                inline_keyboard_confirm: { type: 'boolean', description: 'Per-message override for the "✅ You chose: <label> · HH:MM" body annotation on tap (#789). true forces the annotation even if the agent default is off; false skips it even if the agent default is on; omit to use the agent default. Only applies to single-use keyboards and requires the agent parseMode to be the default html. Has no effect on URL buttons. Note: annotation rebuilds the body from the message\'s plain text, so formatting entities on the original message are lost.' },
               },
               required: ['text'],
             },
@@ -563,6 +565,18 @@ mcp.setRequestHandler(CallToolRequestSchema, async (req) => {
       }
     }
 
+    // #2094 finding 4 — turn-complete reset. A successful reply / stream_reply
+    // is the bridge's turn-complete proxy: the agent delivered its answer for
+    // this chat, so the per-chat inbound-dedup set can be cleared (thread-
+    // agnostic — the reply may omit message_thread_id). Bounds memory and lets
+    // a genuinely NEW turn re-use ids the sweep might legitimately resend.
+    if (inboundDedupEnabled && (tool === 'reply' || tool === 'stream_reply')) {
+      const replyChatId = args.chat_id
+      if (typeof replyChatId === 'string' && replyChatId.length > 0) {
+        inboundDedup.clearChat(replyChatId)
+      }
+    }
+
     // The gateway returns the same shape as the legacy server.ts handlers:
     // { content: [{ type: 'text', text: '...' }] }
     if (result.result && typeof result.result === 'object' && 'content' in (result.result as object)) {
@@ -709,7 +723,30 @@ mcp.setNotificationHandler(
 
 let ipc: IpcClientHandle | null = null
 
+// #2094 finding 4 — bridge-side messageId dedup. Guards against the
+// stranded-message sweep re-delivering a genuine user message that was
+// already forwarded to claude (double-executing side-effectful commands,
+// double 👀). Cleared per-chat on turn-complete (a successful reply /
+// stream_reply, below) and capped defensively. Kill switch:
+// SWITCHROOM_INBOUND_DEDUP=0.
+const inboundDedup = new InboundDedup()
+const inboundDedupEnabled = process.env.SWITCHROOM_INBOUND_DEDUP !== '0'
+
 function onInbound(msg: InboundMessage): void {
+  // Drop a re-delivered duplicate of a plain user message before it reaches
+  // the claude session. Only genuine re-deliverable messages are eligible
+  // (see shouldDedupInbound) — synthetic / button / structured-event inbounds
+  // are always forwarded.
+  if (inboundDedupEnabled && shouldDedupInbound(msg)) {
+    const chatKey = dedupChatKey(msg.chatId, msg.threadId)
+    if (inboundDedup.checkAndRecord(chatKey, msg.messageId) === 'duplicate') {
+      process.stderr.write(
+        `telegram bridge: dropping duplicate inbound messageId=${msg.messageId} ` +
+        `chat=${chatKey} (already forwarded this turn — sweep re-delivery, #2094)\n`,
+      )
+      return
+    }
+  }
   // Convert IPC InboundMessage → MCP channel notification
   mcp.notification({
     method: 'notifications/claude/channel',

package/telegram-plugin/bridge/inbound-dedup.ts

@@ -0,0 +1,101 @@
+/**
+ * Bridge-side inbound messageId dedup (#2094 finding 4).
+ *
+ * `onInbound` forwards every IPC inbound to the claude session with no dedup.
+ * A genuine user message that was delivered successfully but slow to ack can
+ * be RE-SENT by the offline/stranded-message sweep — and claude then processes
+ * it twice: a side-effectful slash command double-executes, a 👀 is painted
+ * twice, etc. #2093's idle-gating shrank the window but did not close it.
+ *
+ * Durable fix: a per-chat set of already-forwarded messageIds. A repeat of a
+ * messageId within the same turn is dropped. The set is cleared on
+ * turn-complete (the bridge's turn-complete proxy is a successful
+ * reply/stream_reply for that chat) so memory stays bounded, and it is capped
+ * defensively so a chat that never replies can't grow the set without limit.
+ *
+ * SCOPE — only PLAIN user messages are deduped (see `shouldDedupInbound`).
+ * Synthetic inbounds (meta.source: cron / resume / vault, messageId == a
+ * timestamp), button callbacks, and structured events (checklist task changes,
+ * reactions) are NEVER deduped: they either carry unique ids already or
+ * legitimately repeat the same messageId for genuinely distinct events.
+ */
+
+/** Defensive cap on tracked ids per chat (FIFO-evicted). Bounds memory for a
+ * chat that produces many messages without ever hitting a turn-complete. */
+export const INBOUND_DEDUP_MAX_PER_CHAT = 512
+
+export interface DedupInboundLike {
+  messageId: number
+  meta: Record<string, string>
+}
+
+/**
+ * Only genuine, re-deliverable user messages are eligible for dedup. Excludes:
+ *  - messageId <= 0 (no real Telegram id to key on),
+ *  - meta.source set (synthetic: cron / resume / vault / secret_* — unique
+ *    timestamp ids, and re-delivery is handled upstream),
+ *  - meta.button_callback (a tap; repeats are the user's intent),
+ *  - meta.kind (structured events like checklist_task_changed — the same
+ *    checklist messageId legitimately repeats for distinct state changes),
+ *  - meta.event (reaction-class inbounds).
+ */
+export function shouldDedupInbound(msg: DedupInboundLike): boolean {
+  if (!Number.isFinite(msg.messageId) || msg.messageId <= 0) return false
+  const m = msg.meta ?? {}
+  if (m.source != null) return false
+  if (m.button_callback != null) return false
+  if (m.kind != null) return false
+  if (m.event != null) return false
+  return true
+}
+
+/**
+ * Per-chat forwarded-messageId tracker. Keyed by chatKey (`chatId:threadId`).
+ */
+export class InboundDedup {
+  private readonly byChat = new Map<string, Set<number>>()
+
+  constructor(private readonly maxPerChat: number = INBOUND_DEDUP_MAX_PER_CHAT) {}
+
+  /**
+   * Record `messageId` as forwarded for `chatKey`. Returns 'fresh' the first
+   * time a messageId is seen (caller forwards it) and 'duplicate' on a repeat
+   * (caller drops it). FIFO-evicts the oldest id once the per-chat cap is hit.
+   */
+  checkAndRecord(chatKey: string, messageId: number): 'fresh' | 'duplicate' {
+    let set = this.byChat.get(chatKey)
+    if (set == null) {
+      set = new Set<number>()
+      this.byChat.set(chatKey, set)
+    }
+    if (set.has(messageId)) return 'duplicate'
+    if (set.size >= this.maxPerChat) {
+      // Set iteration order is insertion order — drop the oldest.
+      const oldest = set.values().next().value
+      if (oldest !== undefined) set.delete(oldest)
+    }
+    set.add(messageId)
+    return 'fresh'
+  }
+
+  /** Clear every tracked id for a chat (all threads) — the turn-complete
+   * reset. Thread-agnostic so a reply that omits message_thread_id still
+   * clears the inbound's thread-scoped key. */
+  clearChat(chatId: string): void {
+    const prefix = `${chatId}:`
+    for (const key of this.byChat.keys()) {
+      if (key === chatId || key.startsWith(prefix)) this.byChat.delete(key)
+    }
+  }
+
+  /** Test/introspection helper: number of tracked ids for a chatKey. */
+  size(chatKey: string): number {
+    return this.byChat.get(chatKey)?.size ?? 0
+  }
+}
+
+/** Canonical chat-key derivation (mirrors gateway/chat-key.ts): a null/0
+ * thread collapses to '_'. */
+export function dedupChatKey(chatId: string, threadId?: number): string {
+  return `${chatId}:${threadId == null || threadId === 0 ? '_' : threadId}`
+}

package/telegram-plugin/dist/bridge/bridge.js

@@ -24562,6 +24562,7 @@ var BROAD_ONLY_TOOLS = new Set([
   "WebSearch",
   "Task",
   "Agent",
+  "Workflow",
   "TodoWrite",
   "ExitPlanMode"
 ]);
@@ -24697,6 +24698,60 @@ function appendCrashBreadcrumb(logPath, kind, err, now = new Date) {
   } catch {}
 }
 
+// bridge/inbound-dedup.ts
+var INBOUND_DEDUP_MAX_PER_CHAT = 512;
+function shouldDedupInbound(msg) {
+  if (!Number.isFinite(msg.messageId) || msg.messageId <= 0)
+    return false;
+  const m = msg.meta ?? {};
+  if (m.source != null)
+    return false;
+  if (m.button_callback != null)
+    return false;
+  if (m.kind != null)
+    return false;
+  if (m.event != null)
+    return false;
+  return true;
+}
+
+class InboundDedup {
+  maxPerChat;
+  byChat = new Map;
+  constructor(maxPerChat = INBOUND_DEDUP_MAX_PER_CHAT) {
+    this.maxPerChat = maxPerChat;
+  }
+  checkAndRecord(chatKey, messageId) {
+    let set2 = this.byChat.get(chatKey);
+    if (set2 == null) {
+      set2 = new Set;
+      this.byChat.set(chatKey, set2);
+    }
+    if (set2.has(messageId))
+      return "duplicate";
+    if (set2.size >= this.maxPerChat) {
+      const oldest = set2.values().next().value;
+      if (oldest !== undefined)
+        set2.delete(oldest);
+    }
+    set2.add(messageId);
+    return "fresh";
+  }
+  clearChat(chatId) {
+    const prefix = `${chatId}:`;
+    for (const key of this.byChat.keys()) {
+      if (key === chatId || key.startsWith(prefix))
+        this.byChat.delete(key);
+    }
+  }
+  size(chatKey) {
+    return this.byChat.get(chatKey)?.size ?? 0;
+  }
+}
+function dedupChatKey(chatId, threadId) {
+  return `${chatId}:${threadId == null || threadId === 0 ? "_" : threadId}`;
+}
+
 // bridge/bridge.ts
 installPluginLogger();
 var STATE_DIR = process.env.TELEGRAM_STATE_DIR ?? join4(homedir3(), ".claude", "channels", "telegram");
@@ -24764,7 +24819,8 @@ var TOOL_SCHEMAS = [
                 url: { type: "string", description: "Open this URL when tapped. Mutually exclusive with callback_data." },
                 callback_data: { type: "string", description: "Opaque tag delivered back to the agent on tap. Max 58 chars (gateway prepends an `agent:` prefix to the 64-byte Telegram limit). Mutually exclusive with url." },
                 ack_text: { type: "string", description: 'Toast text shown to the user the instant they tap this button (#710). Default "\u2713 received". Max ~200 chars (Telegram answerCallbackQuery limit). Has no effect on URL buttons.' },
-                single_use: { type: "boolean", description: `When true (default) tapping any single_use button on the message removes the entire keyboard so the user can't double-fire. Set false on buttons that should stay tappable (e.g. a "Refresh" button). If ANY button on the message has single_use:false the keyboard is preserved on tap.` }
+                single_use: { type: "boolean", description: `When true (default) tapping any single_use button on the message removes the entire keyboard so the user can't double-fire. Set false on buttons that should stay tappable (e.g. a "Refresh" button). If ANY button on the message has single_use:false the keyboard is preserved on tap.` },
+                inline_keyboard_confirm: { type: "boolean", description: `Per-message override for the "\u2705 You chose: <label> \xB7 HH:MM" body annotation on tap (#789). true forces the annotation even if the agent default is off; false skips it even if the agent default is on; omit to use the agent default. Only applies to single-use keyboards and requires the agent parseMode to be the default html. Has no effect on URL buttons. Note: annotation rebuilds the body from the message's plain text, so formatting entities on the original message are lost.` }
               },
               required: ["text"]
             }
@@ -25175,6 +25231,12 @@ mcp.setRequestHandler(CallToolRequestSchema2, async (req) => {
         isError: true
       };
     }
+    if (inboundDedupEnabled && (tool === "reply" || tool === "stream_reply")) {
+      const replyChatId = args.chat_id;
+      if (typeof replyChatId === "string" && replyChatId.length > 0) {
+        inboundDedup.clearChat(replyChatId);
+      }
+    }
     if (result.result && typeof result.result === "object" && "content" in result.result) {
       return result.result;
     }
@@ -25259,7 +25321,17 @@ mcp.setNotificationHandler(exports_external.object({
   });
 });
 var ipc = null;
+var inboundDedup = new InboundDedup;
+var inboundDedupEnabled = process.env.SWITCHROOM_INBOUND_DEDUP !== "0";
 function onInbound(msg) {
+  if (inboundDedupEnabled && shouldDedupInbound(msg)) {
+    const chatKey = dedupChatKey(msg.chatId, msg.threadId);
+    if (inboundDedup.checkAndRecord(chatKey, msg.messageId) === "duplicate") {
+      process.stderr.write(`telegram bridge: dropping duplicate inbound messageId=${msg.messageId} ` + `chat=${chatKey} (already forwarded this turn \u2014 sweep re-delivery, #2094)
+`);
+      return;
+    }
+  }
   mcp.notification({
     method: "notifications/claude/channel",
     params: {