switchroom 0.18.11 → 0.18.13

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "switchroom",
   "//version": "NOT the release version — source of truth is the git tag, resolved by scripts/build.mjs:resolveVersion() (see CLAUDE.md > Standard release process). This field is stale by design and only the Layer-4 dev/non-tag fallback for build.mjs + src/cli/resolve-version.ts; do NOT bump it expecting a release to pick it up. npm-pack tarball naming needs a real version — do that as an UNCOMMITTED pack-time bump (see release step 6), never a committed one.",
-  "version": "0.18.11",
+  "version": "0.18.13",
   "description": "Run Claude Code 24/7 on your Claude Pro/Max subscription over Telegram. Open-source alternative to OpenClaw and NanoClaw — no API keys.",
   "type": "module",
   "bin": {
@@ -24,9 +24,9 @@
     "build": "node scripts/build.mjs",
     "build:cli": "node scripts/build.mjs && bun build --compile --target=bun-linux-x64 --minify bin/switchroom.ts --outfile switchroom-linux-amd64",
     "pretest": "npm run build",
-    "test": "vitest run && bun test telegram-plugin/tests/history.test.ts telegram-plugin/tests/cross-turn-card-gate.test.ts telegram-plugin/tests/emission-authority-open-gate.test.ts telegram-plugin/tests/emission-authority-ping-gate.test.ts telegram-plugin/tests/emission-authority-card-drain-gate.test.ts telegram-plugin/tests/per-topic-current-turn.test.ts telegram-plugin/tests/history-reaper.test.ts telegram-plugin/tests/ipc-server-client.test.ts telegram-plugin/tests/ipc-server-race.test.ts telegram-plugin/tests/ipc-server-query-pending-permission.test.ts telegram-plugin/tests/gateway-bridge.test.ts telegram-plugin/tests/gateway-startup-mutex.test.ts telegram-plugin/tests/gateway-clean-shutdown-marker.test.ts telegram-plugin/tests/boot-card-dedupe.test.ts telegram-plugin/tests/boot-card-reason.test.ts telegram-plugin/tests/progress-update.test.ts telegram-plugin/tests/quota-cache.test.ts telegram-plugin/tests/unhandled-rejection-policy.test.ts telegram-plugin/tests/registry-turns.test.ts telegram-plugin/registry/subagents.test.ts telegram-plugin/registry/subagents-bugs.test.ts telegram-plugin/tests/subagent-watcher-parent-turn-key.test.ts telegram-plugin/tests/subagent-nested-dispatch.test.ts telegram-plugin/tests/nested-worker-visibility-harness.test.ts telegram-plugin/tests/turns-writer.test.ts telegram-plugin/tests/resume-inbound-builder.test.ts telegram-plugin/registry/api-registry.test.ts telegram-plugin/registry/turns-schema.test.ts telegram-plugin/tests/idle-footer-wiring.test.ts telegram-plugin/tests/subagent-tracker-hooks.test.ts telegram-plugin/tests/gateway-update-placeholder-dispatch.test.ts telegram-plugin/tests/status-query-telemetry.test.ts telegram-plugin/tests/reaction-trigger.test.ts telegram-plugin/tests/reaction-trigger-flow.test.ts telegram-plugin/gateway/webhook-ingest-server.test.ts telegram-plugin/tests/skill-proposal-card.test.ts",
+    "test": "vitest run && bun test telegram-plugin/tests/history.test.ts telegram-plugin/tests/cross-turn-card-gate.test.ts telegram-plugin/tests/emission-authority-open-gate.test.ts telegram-plugin/tests/emission-authority-ping-gate.test.ts telegram-plugin/tests/emission-authority-card-drain-gate.test.ts telegram-plugin/tests/per-topic-current-turn.test.ts telegram-plugin/tests/history-reaper.test.ts telegram-plugin/tests/ipc-server-client.test.ts telegram-plugin/tests/ipc-server-race.test.ts telegram-plugin/tests/ipc-server-query-pending-permission.test.ts telegram-plugin/tests/ipc-server-check-pre-approved.test.ts telegram-plugin/tests/gateway-bridge.test.ts telegram-plugin/tests/gateway-startup-mutex.test.ts telegram-plugin/tests/gateway-clean-shutdown-marker.test.ts telegram-plugin/tests/boot-card-dedupe.test.ts telegram-plugin/tests/boot-card-reason.test.ts telegram-plugin/tests/progress-update.test.ts telegram-plugin/tests/quota-cache.test.ts telegram-plugin/tests/unhandled-rejection-policy.test.ts telegram-plugin/tests/registry-turns.test.ts telegram-plugin/registry/subagents.test.ts telegram-plugin/registry/subagents-bugs.test.ts telegram-plugin/tests/subagent-watcher-parent-turn-key.test.ts telegram-plugin/tests/subagent-nested-dispatch.test.ts telegram-plugin/tests/nested-worker-visibility-harness.test.ts telegram-plugin/tests/turns-writer.test.ts telegram-plugin/tests/resume-inbound-builder.test.ts telegram-plugin/registry/api-registry.test.ts telegram-plugin/registry/turns-schema.test.ts telegram-plugin/tests/idle-footer-wiring.test.ts telegram-plugin/tests/subagent-tracker-hooks.test.ts telegram-plugin/tests/gateway-update-placeholder-dispatch.test.ts telegram-plugin/tests/status-query-telemetry.test.ts telegram-plugin/tests/reaction-trigger.test.ts telegram-plugin/tests/reaction-trigger-flow.test.ts telegram-plugin/gateway/webhook-ingest-server.test.ts telegram-plugin/tests/skill-proposal-card.test.ts",
     "test:vitest": "vitest run",
-    "test:bun": "bun test src/vault/grants.test.ts src/vault/grants-db.test.ts src/vault/write-grants.test.ts src/vault/broker/server-grants.test.ts src/vault/broker/server-write-grants.test.ts src/vault/broker/server-mint-grant-passphrase-attest.test.ts src/vault/broker/server-passphrase-attest.test.ts src/vault/broker/server-mint-grant-posture-attest.test.ts src/vault/broker/server-admin-only-keys.test.ts src/vault/broker/client-token.test.ts src/vault/broker/server-unlock.test.ts src/vault/broker/auto-unlock.test.ts src/vault/broker/drift-detection.test.ts tests/vault-broker-passphrase.test.ts src/cli/vault-get-broker.test.ts src/vault/resolver-via-broker.test.ts src/vault/broker/scope.test.ts src/vault/broker/server.test.ts src/litellm/provision-apply-e2e.test.ts src/drive/disconnect.test.ts src/drive/grants.test.ts src/drive/oauth.test.ts src/drive/onboarding.test.ts src/drive/reconciler.test.ts src/drive/vault-slots.test.ts src/drive/wrapper.test.ts src/vault/approvals/kernel.test.ts src/vault/approvals/approval-origin.test.ts src/vault/approvals/schema-idempotent.test.ts src/vault/broker/server-approvals.test.ts telegram-plugin/tests/boot-probes.test.ts telegram-plugin/tests/boot-version-string.test.ts telegram-plugin/tests/history.test.ts telegram-plugin/tests/cross-turn-card-gate.test.ts telegram-plugin/tests/emission-authority-open-gate.test.ts telegram-plugin/tests/emission-authority-ping-gate.test.ts telegram-plugin/tests/emission-authority-card-drain-gate.test.ts telegram-plugin/tests/per-topic-current-turn.test.ts telegram-plugin/tests/history-reaper.test.ts telegram-plugin/tests/ipc-server-client.test.ts telegram-plugin/tests/ipc-server-race.test.ts telegram-plugin/tests/ipc-server-query-pending-permission.test.ts telegram-plugin/tests/gateway-bridge.test.ts telegram-plugin/tests/gateway-startup-mutex.test.ts telegram-plugin/tests/gateway-clean-shutdown-marker.test.ts telegram-plugin/tests/boot-card-dedupe.test.ts telegram-plugin/tests/boot-card-reason.test.ts telegram-plugin/tests/progress-update.test.ts telegram-plugin/tests/quota-cache.test.ts telegram-plugin/tests/silent-reply-guard.test.ts telegram-plugin/tests/unhandled-rejection-policy.test.ts telegram-plugin/tests/registry-turns.test.ts telegram-plugin/registry/subagents.test.ts telegram-plugin/registry/subagents-bugs.test.ts telegram-plugin/tests/subagent-watcher-parent-turn-key.test.ts telegram-plugin/tests/subagent-nested-dispatch.test.ts telegram-plugin/tests/nested-worker-visibility-harness.test.ts telegram-plugin/tests/turns-writer.test.ts telegram-plugin/tests/resume-inbound-builder.test.ts telegram-plugin/tests/subagent-tracker-hooks.test.ts telegram-plugin/tests/resolve-calling-subagent.test.ts telegram-plugin/tests/gateway-update-placeholder-dispatch.test.ts telegram-plugin/tests/status-query-telemetry.test.ts telegram-plugin/tests/reaction-trigger.test.ts telegram-plugin/tests/reaction-trigger-flow.test.ts telegram-plugin/tests/subagent-watcher-workflow-visibility.test.ts telegram-plugin/uat/load-env.test.ts telegram-plugin/uat/feed-matcher.test.ts telegram-plugin/uat/uat-driver.test.ts telegram-plugin/gateway/webhook-ingest-server.test.ts telegram-plugin/tests/skill-proposal-card.test.ts",
+    "test:bun": "bun test src/vault/grants.test.ts src/vault/grants-db.test.ts src/vault/write-grants.test.ts src/vault/broker/server-grants.test.ts src/vault/broker/server-write-grants.test.ts src/vault/broker/server-mint-grant-passphrase-attest.test.ts src/vault/broker/server-passphrase-attest.test.ts src/vault/broker/server-mint-grant-posture-attest.test.ts src/vault/broker/server-admin-only-keys.test.ts src/vault/broker/client-token.test.ts src/vault/broker/server-unlock.test.ts src/vault/broker/auto-unlock.test.ts src/vault/broker/drift-detection.test.ts tests/vault-broker-passphrase.test.ts src/cli/vault-get-broker.test.ts src/vault/resolver-via-broker.test.ts src/vault/broker/scope.test.ts src/vault/broker/server.test.ts src/litellm/provision-apply-e2e.test.ts src/drive/disconnect.test.ts src/drive/grants.test.ts src/drive/oauth.test.ts src/drive/onboarding.test.ts src/drive/reconciler.test.ts src/drive/vault-slots.test.ts src/drive/wrapper.test.ts src/vault/approvals/kernel.test.ts src/vault/approvals/approval-origin.test.ts src/vault/approvals/schema-idempotent.test.ts src/vault/broker/server-approvals.test.ts telegram-plugin/tests/boot-probes.test.ts telegram-plugin/tests/boot-version-string.test.ts telegram-plugin/tests/history.test.ts telegram-plugin/tests/cross-turn-card-gate.test.ts telegram-plugin/tests/emission-authority-open-gate.test.ts telegram-plugin/tests/emission-authority-ping-gate.test.ts telegram-plugin/tests/emission-authority-card-drain-gate.test.ts telegram-plugin/tests/per-topic-current-turn.test.ts telegram-plugin/tests/history-reaper.test.ts telegram-plugin/tests/ipc-server-client.test.ts telegram-plugin/tests/ipc-server-race.test.ts telegram-plugin/tests/ipc-server-query-pending-permission.test.ts telegram-plugin/tests/ipc-server-check-pre-approved.test.ts telegram-plugin/tests/gateway-bridge.test.ts telegram-plugin/tests/gateway-startup-mutex.test.ts telegram-plugin/tests/gateway-clean-shutdown-marker.test.ts telegram-plugin/tests/boot-card-dedupe.test.ts telegram-plugin/tests/boot-card-reason.test.ts telegram-plugin/tests/progress-update.test.ts telegram-plugin/tests/quota-cache.test.ts telegram-plugin/tests/silent-reply-guard.test.ts telegram-plugin/tests/unhandled-rejection-policy.test.ts telegram-plugin/tests/registry-turns.test.ts telegram-plugin/registry/subagents.test.ts telegram-plugin/registry/subagents-bugs.test.ts telegram-plugin/tests/subagent-watcher-parent-turn-key.test.ts telegram-plugin/tests/subagent-nested-dispatch.test.ts telegram-plugin/tests/nested-worker-visibility-harness.test.ts telegram-plugin/tests/turns-writer.test.ts telegram-plugin/tests/resume-inbound-builder.test.ts telegram-plugin/tests/subagent-tracker-hooks.test.ts telegram-plugin/tests/resolve-calling-subagent.test.ts telegram-plugin/tests/gateway-update-placeholder-dispatch.test.ts telegram-plugin/tests/status-query-telemetry.test.ts telegram-plugin/tests/reaction-trigger.test.ts telegram-plugin/tests/reaction-trigger-flow.test.ts telegram-plugin/tests/subagent-watcher-workflow-visibility.test.ts telegram-plugin/uat/load-env.test.ts telegram-plugin/uat/feed-matcher.test.ts telegram-plugin/uat/uat-driver.test.ts telegram-plugin/gateway/webhook-ingest-server.test.ts telegram-plugin/tests/skill-proposal-card.test.ts",
     "test:watch": "vitest",
     "lint": "tsc --noEmit && node scripts/check-plugin-references.mjs && bash scripts/check-bot-api-wrapping.sh && node scripts/check-bun-test-imports.mjs && node scripts/check-no-pii-secrets.mjs && node scripts/check-vault-test-hermeticity.mjs && node scripts/check-no-broadcast-delivery.mjs && node scripts/check-stale-tool-descriptions.mjs && node scripts/check-web-subscription-honest.mjs",
     "lint:tsc": "tsc --noEmit",
@@ -43,7 +43,6 @@
     "@modelcontextprotocol/sdk": "^1.0.0",
     "@secretlint/core": "^12.2.0",
     "@secretlint/secretlint-rule-preset-recommend": "^12.2.0",
-    "@secretlint/types": "^12.2.0",
     "@xterm/headless": "^6.0.0",
     "bcryptjs": "^3.0.3",
     "chalk": "^5.4.0",

package/profiles/_base/start.sh.hbs

@@ -165,8 +165,70 @@ x-litellm-tags: agent:$SWITCHROOM_AGENT_NAME,profile:${SWITCHROOM_AGENT_PROFILE:
   # The sidecar's own structured logging is written
   # directly to its log file; this wrapper only handles process
   # lifecycle. Ampersand-backgrounded by callers below.
+  # Size-based log rotation for a supervised sidecar's logfile (#3025).
+  # The gateway sidecar appends per-poll trace lines and can run for
+  # WEEKS without the supervise loop regaining control (it only loops on
+  # child exit), so rotate-at-restart alone let gateway-supervisor.log
+  # grow to 555MB on clerk / 162MB on klanker and fill the host disk.
+  # This background checker runs independently of the child's lifecycle.
+  #
+  # copytruncate (cp + `: >`), NOT `mv`: the supervised child holds an
+  # open fd on $_logfile (its stdout/stderr is redirected there with
+  # `>> "$_logfile"`). A plain `mv` would leave the child writing to the
+  # now-renamed inode, so the live log would silently stop growing and
+  # the rotated file would keep filling. copytruncate preserves the fd —
+  # the child keeps appending to the same (now-empty) inode. Worst-case
+  # race is a few log lines written between the cp and the truncate being
+  # lost; acceptable for a debug trace log. Keeps at most ~2×cap on disk
+  # (live + one .1 generation). Cap + interval are env-overridable.
+  _switchroom_log_rotator() {
+    local _logfile="$1"
+    local _max="${SWITCHROOM_SIDECAR_LOG_MAX_BYTES:-52428800}"   # 50 MiB default
+    local _interval="${SWITCHROOM_SIDECAR_LOG_ROTATE_INTERVAL_SEC:-300}"  # 5 min
+    # Validate BOTH env overrides up front; garbage falls back to the
+    # default. Unvalidated, a non-numeric interval makes `sleep` fail
+    # instantly and the `while true` loop hot-spins a CPU core for the
+    # container lifetime; a non-numeric cap makes the -gt test below
+    # error (a shell error line to stdout) every cycle forever. A zero
+    # interval would also hot-spin, so it falls back too.
+    case "$_max" in ''|*[!0-9]*) _max=52428800;; esac
+    case "$_interval" in ''|0|*[!0-9]*) _interval=300;; esac
+    # A cap of 0 disables rotation entirely (operator escape hatch).
+    # (Negative values contain '-' → non-numeric per the guard above →
+    # default cap, i.e. rotation stays on.)
+    [ "$_max" -eq 0 ] && return 0
+    while true; do
+      sleep "$_interval"
+      [ -f "$_logfile" ] || continue
+      local _size
+      _size=$(wc -c < "$_logfile" 2>/dev/null || echo 0)
+      # `wc -c < file` yields a bare integer; guard against empty/non-numeric.
+      case "$_size" in ''|*[!0-9]*) continue;; esac
+      if [ "$_size" -gt "$_max" ]; then
+        if cp "$_logfile" "$_logfile.1" 2>/dev/null; then
+          : > "$_logfile"
+          echo "[supervise] rotated $_logfile (${_size} bytes > ${_max} cap) → ${_logfile}.1" >> "$_logfile"
+        else
+          # cp failed (e.g. ENOSPC — exactly when rotation matters most).
+          # Fall back to truncate-without-backup: dropping the .1 backup
+          # beats a rotator that can never free space (#3025 review).
+          : > "$_logfile"
+          echo "[supervise] rotated $_logfile (${_size} bytes > ${_max} cap) WITHOUT backup — cp to ${_logfile}.1 failed (disk full?)" >> "$_logfile"
+        fi
+      fi
+    done
+  }
+
   _switchroom_supervise() {
     local _name="$1"; local _logfile="$2"; shift 2
+    # Start the size-based rotator for this sidecar's log (#3025). One
+    # per supervised sidecar; lives for the container lifetime alongside
+    # the respawn loop below.
+    _switchroom_log_rotator "$_logfile" &
+    # Record the rotator's pid so the oneshot-ok return path below can
+    # reap it — otherwise every completed one-shot sidecar leaks a
+    # background sleep loop for the container lifetime (#3025 review).
+    local _rotator_pid=$!
     # Optional `--oneshot-ok` flag (must directly follow the logfile):
     # marks a sidecar that can LEGITIMATELY complete. For such a sidecar
     # a clean exit 0 means "job done" → stop supervising, no respawn.
@@ -211,6 +273,9 @@ x-litellm-tags: agent:$SWITCHROOM_AGENT_NAME,profile:${SWITCHROOM_AGENT_PROFILE:
       # below — a crash always self-heals.
       if [ $_oneshot_ok -eq 1 ] && [ $_exit -eq 0 ]; then
         echo "[supervise] $_name completed cleanly (exit 0) — one-shot-ok, not respawning." >> "$_logfile"
+        # The sidecar is done — its log stops growing, so reap the
+        # rotator instead of leaking its sleep loop forever (#3025).
+        kill "$_rotator_pid" 2>/dev/null || true
         return 0
       fi
       # A run that stayed up for at least the backoff cap means the

package/profiles/_shared/vault-protocol.md.hbs

@@ -3,7 +3,9 @@
   Rendered automatically by `switchroom apply` / `agent reconcile` from
   profiles/_shared/vault-protocol.md.hbs. Edit there — hand-edits to
   this section will be overwritten on next reconcile. To add agent-
-  specific guidance, put it in workspace/CLAUDE.custom.md (sidecar).
+  specific guidance, edit CLAUDE.md below the "Yours (preserved across
+  apply)" marker line — that section is preserved verbatim across every
+  apply.
 -->
 
 ## Vault & secrets

package/profiles/coding/CLAUDE.md.hbs

@@ -43,7 +43,7 @@ Claude Code's file-based auto-memory is disabled. Use **Hindsight** MCP tools:
 - `mcp__hindsight__recall` — search past memories. Auto-fires on every message.
 - `mcp__hindsight__retain` — store important facts. Auto-retains every turn (chunked, a small ~3-turn window each time), so it's prompt and cheap.
 - `mcp__hindsight__reflect` — synthesize across memories for complex queries.
-- `mcp__hindsight__create_mental_model` — maintain semantic summaries (e.g. "codebase architecture").
+- `mcp__switchroom-telegram__mental_model_propose` — propose a mental model: a standing semantic summary refreshed over the bank (e.g. "codebase architecture"). Mental-model writes are operator-approved: this posts an approval card and persists on approval. Don't call `mcp__hindsight__create_mental_model`/`update_mental_model` directly (they're denied and redirected here).
 
 Save proactively: architecture decisions, codebase patterns, conventions, known issues, user preferences. Your session may be compacted at any time — only Hindsight memories survive.
 

package/profiles/default/CLAUDE.md.hbs

@@ -45,14 +45,14 @@ Hindsight is a memory bank with semantic search, knowledge graph, entity resolut
 ### Mental Models
 A mental model is a pre-computed semantic summary backed by reflection over the bank — a way to maintain a standing answer to a recurring question, semantically populated and refreshed.
 
-- `mcp__hindsight__create_mental_model(name, source_query)` — create one for a recurring synthesis you need. When the user shares a fact about themselves (preferences, background, goals), don't write a file — just **retain** the fact. You do NOT need to build or maintain a per-agent "user profile": who the user is lives in dedicated per-user profile banks that the operator curates out-of-band, and recall surfaces it automatically.
+Creating, updating, or refreshing a mental model is **operator-approved** — don't call `create_mental_model` / `update_mental_model` / `refresh_mental_model` / `delete_mental_model` directly (a direct call is denied and redirected). Use `mcp__switchroom-telegram__mental_model_propose(name, source_query)` when you need a recurring synthesis: it posts an approval card and persists the model on approval. When the user shares a fact about themselves (preferences, background, goals), don't write a file and don't propose a model — just **retain** the fact. You do NOT need to build or maintain a per-agent "user profile": who the user is lives in dedicated per-user profile banks that the operator curates out-of-band, and recall surfaces it automatically.
 
 ### Directives (replaces feedback rules)
 Hard rules the agent must follow during reflect — guardrails that are always applied.
 
 - `mcp__hindsight__create_directive(text)` — e.g., `create_directive("Always prefer TypeScript over JavaScript for this user's projects")`. When the user gives you a correction or "always do X" rule, create a directive instead of writing a feedback `.md` file.
 
-(Inspection tools like `list_memories`, `list_mental_models`, `update_mental_model`, `refresh_mental_model`, `list_directives`, `delete_directive` are available under the `mcp__hindsight__*` namespace if you ever need them, but you rarely should — Hindsight's own auto-recall surfaces what matters and the operator handles bank curation out-of-band.)
+(Read-only inspection tools like `list_memories`, `list_mental_models`, `get_mental_model`, `list_directives` are available under the `mcp__hindsight__*` namespace if you ever need them, but you rarely should — Hindsight's own auto-recall surfaces what matters and the operator handles bank curation out-of-band. The mental-model WRITE tools — `create`/`update`/`refresh`/`delete_mental_model` — are gated: propose via `mcp__switchroom-telegram__mental_model_propose`, don't call them directly.)
 
 ### What to retain — and what NOT to retain
 

package/profiles/executive-assistant/CLAUDE.md.hbs

@@ -41,7 +41,7 @@ Claude Code's file-based auto-memory is disabled. Use **Hindsight** MCP tools:
 
 - `mcp__hindsight__recall` — search past memories. Auto-fires every message.
 - `mcp__hindsight__retain` — store important facts. Auto-retains every turn (chunked, a small ~3-turn window each time), so it's prompt and cheap.
-- `mcp__hindsight__create_mental_model` — maintain models for "contacts", "active projects", "user preferences".
+- `mcp__switchroom-telegram__mental_model_propose` — propose a mental model: a standing semantic summary refreshed over the bank (e.g. "contacts", "active projects", "user preferences"). Mental-model writes are operator-approved: this posts an approval card and persists on approval. Don't call `mcp__hindsight__create_mental_model`/`update_mental_model` directly (they're denied and redirected here).
 
 Save proactively: contacts and their roles, scheduling preferences, project status, decisions with rationale, communication templates. Only Hindsight memories survive compaction.
 

package/profiles/health-coach/CLAUDE.md.hbs

@@ -35,7 +35,7 @@ Claude Code's file-based auto-memory is disabled. Use **Hindsight** MCP tools:
 
 - `mcp__hindsight__recall` — search past memories. Auto-fires on every message.
 - `mcp__hindsight__retain` — store important facts. Auto-retains every turn (chunked, a small ~3-turn window each time), so it's prompt and cheap.
-- `mcp__hindsight__create_mental_model` — maintain a "fitness profile" mental model.
+- `mcp__switchroom-telegram__mental_model_propose` — propose a mental model (e.g. a "fitness profile" — a standing semantic summary refreshed over the bank). Mental-model writes are operator-approved: this posts an approval card and persists on approval. Don't call `mcp__hindsight__create_mental_model`/`update_mental_model` directly (they're denied and redirected here).
 
 Save proactively: workout logs, goals, PRs, preferences, patterns (e.g. "poor sleep on Sundays"), injuries/limitations. Only Hindsight memories survive session compaction.
 

package/telegram-plugin/bridge/bridge.ts

@@ -32,6 +32,7 @@ import type { InboundMessage, PermissionEvent, StatusEvent } from '../gateway/ip
 import { matchesAllowRule } from '../permission-rule.js'
 import { createOutstandingPermissionLedger } from './permission-ledger.js'
 import { appendCrashBreadcrumb } from './crash-breadcrumb.js'
+import { InboundDedup, shouldDedupInbound, dedupChatKey } from './inbound-dedup.js'
 
 installPluginLogger()
 
@@ -127,6 +128,7 @@ const TOOL_SCHEMAS = [
                 callback_data: { type: 'string', description: 'Opaque tag delivered back to the agent on tap. Max 58 chars (gateway prepends an `agent:` prefix to the 64-byte Telegram limit). Mutually exclusive with url.' },
                 ack_text: { type: 'string', description: 'Toast text shown to the user the instant they tap this button (#710). Default "✓ received". Max ~200 chars (Telegram answerCallbackQuery limit). Has no effect on URL buttons.' },
                 single_use: { type: 'boolean', description: 'When true (default) tapping any single_use button on the message removes the entire keyboard so the user can\'t double-fire. Set false on buttons that should stay tappable (e.g. a "Refresh" button). If ANY button on the message has single_use:false the keyboard is preserved on tap.' },
+                inline_keyboard_confirm: { type: 'boolean', description: 'Per-message override for the "✅ You chose: <label> · HH:MM" body annotation on tap (#789). true forces the annotation even if the agent default is off; false skips it even if the agent default is on; omit to use the agent default. Only applies to single-use keyboards and requires the agent parseMode to be the default html. Has no effect on URL buttons. Note: annotation rebuilds the body from the message\'s plain text, so formatting entities on the original message are lost.' },
               },
               required: ['text'],
             },
@@ -563,6 +565,18 @@ mcp.setRequestHandler(CallToolRequestSchema, async (req) => {
       }
     }
 
+    // #2094 finding 4 — turn-complete reset. A successful reply / stream_reply
+    // is the bridge's turn-complete proxy: the agent delivered its answer for
+    // this chat, so the per-chat inbound-dedup set can be cleared (thread-
+    // agnostic — the reply may omit message_thread_id). Bounds memory and lets
+    // a genuinely NEW turn re-use ids the sweep might legitimately resend.
+    if (inboundDedupEnabled && (tool === 'reply' || tool === 'stream_reply')) {
+      const replyChatId = args.chat_id
+      if (typeof replyChatId === 'string' && replyChatId.length > 0) {
+        inboundDedup.clearChat(replyChatId)
+      }
+    }
+
     // The gateway returns the same shape as the legacy server.ts handlers:
     // { content: [{ type: 'text', text: '...' }] }
     if (result.result && typeof result.result === 'object' && 'content' in (result.result as object)) {
@@ -709,7 +723,30 @@ mcp.setNotificationHandler(
 
 let ipc: IpcClientHandle | null = null
 
+// #2094 finding 4 — bridge-side messageId dedup. Guards against the
+// stranded-message sweep re-delivering a genuine user message that was
+// already forwarded to claude (double-executing side-effectful commands,
+// double 👀). Cleared per-chat on turn-complete (a successful reply /
+// stream_reply, below) and capped defensively. Kill switch:
+// SWITCHROOM_INBOUND_DEDUP=0.
+const inboundDedup = new InboundDedup()
+const inboundDedupEnabled = process.env.SWITCHROOM_INBOUND_DEDUP !== '0'
+
 function onInbound(msg: InboundMessage): void {
+  // Drop a re-delivered duplicate of a plain user message before it reaches
+  // the claude session. Only genuine re-deliverable messages are eligible
+  // (see shouldDedupInbound) — synthetic / button / structured-event inbounds
+  // are always forwarded.
+  if (inboundDedupEnabled && shouldDedupInbound(msg)) {
+    const chatKey = dedupChatKey(msg.chatId, msg.threadId)
+    if (inboundDedup.checkAndRecord(chatKey, msg.messageId) === 'duplicate') {
+      process.stderr.write(
+        `telegram bridge: dropping duplicate inbound messageId=${msg.messageId} ` +
+        `chat=${chatKey} (already forwarded this turn — sweep re-delivery, #2094)\n`,
+      )
+      return
+    }
+  }
   // Convert IPC InboundMessage → MCP channel notification
   mcp.notification({
     method: 'notifications/claude/channel',

package/telegram-plugin/bridge/inbound-dedup.ts

@@ -0,0 +1,101 @@
+/**
+ * Bridge-side inbound messageId dedup (#2094 finding 4).
+ *
+ * `onInbound` forwards every IPC inbound to the claude session with no dedup.
+ * A genuine user message that was delivered successfully but slow to ack can
+ * be RE-SENT by the offline/stranded-message sweep — and claude then processes
+ * it twice: a side-effectful slash command double-executes, a 👀 is painted
+ * twice, etc. #2093's idle-gating shrank the window but did not close it.
+ *
+ * Durable fix: a per-chat set of already-forwarded messageIds. A repeat of a
+ * messageId within the same turn is dropped. The set is cleared on
+ * turn-complete (the bridge's turn-complete proxy is a successful
+ * reply/stream_reply for that chat) so memory stays bounded, and it is capped
+ * defensively so a chat that never replies can't grow the set without limit.
+ *
+ * SCOPE — only PLAIN user messages are deduped (see `shouldDedupInbound`).
+ * Synthetic inbounds (meta.source: cron / resume / vault, messageId == a
+ * timestamp), button callbacks, and structured events (checklist task changes,
+ * reactions) are NEVER deduped: they either carry unique ids already or
+ * legitimately repeat the same messageId for genuinely distinct events.
+ */
+
+/** Defensive cap on tracked ids per chat (FIFO-evicted). Bounds memory for a
+ * chat that produces many messages without ever hitting a turn-complete. */
+export const INBOUND_DEDUP_MAX_PER_CHAT = 512
+
+export interface DedupInboundLike {
+  messageId: number
+  meta: Record<string, string>
+}
+
+/**
+ * Only genuine, re-deliverable user messages are eligible for dedup. Excludes:
+ *  - messageId <= 0 (no real Telegram id to key on),
+ *  - meta.source set (synthetic: cron / resume / vault / secret_* — unique
+ *    timestamp ids, and re-delivery is handled upstream),
+ *  - meta.button_callback (a tap; repeats are the user's intent),
+ *  - meta.kind (structured events like checklist_task_changed — the same
+ *    checklist messageId legitimately repeats for distinct state changes),
+ *  - meta.event (reaction-class inbounds).
+ */
+export function shouldDedupInbound(msg: DedupInboundLike): boolean {
+  if (!Number.isFinite(msg.messageId) || msg.messageId <= 0) return false
+  const m = msg.meta ?? {}
+  if (m.source != null) return false
+  if (m.button_callback != null) return false
+  if (m.kind != null) return false
+  if (m.event != null) return false
+  return true
+}
+
+/**
+ * Per-chat forwarded-messageId tracker. Keyed by chatKey (`chatId:threadId`).
+ */
+export class InboundDedup {
+  private readonly byChat = new Map<string, Set<number>>()
+
+  constructor(private readonly maxPerChat: number = INBOUND_DEDUP_MAX_PER_CHAT) {}
+
+  /**
+   * Record `messageId` as forwarded for `chatKey`. Returns 'fresh' the first
+   * time a messageId is seen (caller forwards it) and 'duplicate' on a repeat
+   * (caller drops it). FIFO-evicts the oldest id once the per-chat cap is hit.
+   */
+  checkAndRecord(chatKey: string, messageId: number): 'fresh' | 'duplicate' {
+    let set = this.byChat.get(chatKey)
+    if (set == null) {
+      set = new Set<number>()
+      this.byChat.set(chatKey, set)
+    }
+    if (set.has(messageId)) return 'duplicate'
+    if (set.size >= this.maxPerChat) {
+      // Set iteration order is insertion order — drop the oldest.
+      const oldest = set.values().next().value
+      if (oldest !== undefined) set.delete(oldest)
+    }
+    set.add(messageId)
+    return 'fresh'
+  }
+
+  /** Clear every tracked id for a chat (all threads) — the turn-complete
+   * reset. Thread-agnostic so a reply that omits message_thread_id still
+   * clears the inbound's thread-scoped key. */
+  clearChat(chatId: string): void {
+    const prefix = `${chatId}:`
+    for (const key of this.byChat.keys()) {
+      if (key === chatId || key.startsWith(prefix)) this.byChat.delete(key)
+    }
+  }
+
+  /** Test/introspection helper: number of tracked ids for a chatKey. */
+  size(chatKey: string): number {
+    return this.byChat.get(chatKey)?.size ?? 0
+  }
+}
+
+/** Canonical chat-key derivation (mirrors gateway/chat-key.ts): a null/0
+ * thread collapses to '_'. */
+export function dedupChatKey(chatId: string, threadId?: number): string {
+  return `${chatId}:${threadId == null || threadId === 0 ? '_' : threadId}`
+}

package/telegram-plugin/dist/bridge/bridge.js

@@ -23035,6 +23035,33 @@ function getNestedObj(obj, key) {
 var DEFAULT_OPERATOR_EVENT_COOLDOWN_MS = 5 * 60000;
 var cooldownMap = new Map;
 
+// text-voice-scrub.ts
+var NULL = "\x00";
+var FENCE_PH = `${NULL}VS_FENCE`;
+var INLINE_PH = `${NULL}VS_INLINE`;
+var HTML_CODE_PH = `${NULL}VS_HTMLCODE`;
+var HTML_PRE_PH = `${NULL}VS_HTMLPRE`;
+var URL_PH = `${NULL}VS_URL`;
+
+// model-unavailable.ts
+var transientUpstreamSignals = [
+  "not your usage limit",
+  "not your account",
+  "not your account's",
+  "temporarily limiting requests",
+  "temporarily rate",
+  "server is temporarily",
+  "would exceed your account\u2019s rate limit",
+  "would exceed your account's rate limit"
+];
+function isTransientUpstreamSignal(text) {
+  if (typeof text !== "string" || text.length === 0)
+    return false;
+  const sample = text.length > 16384 ? text.slice(0, 16384) : text;
+  const lower = sample.toLowerCase();
+  return transientUpstreamSignals.some((s) => lower.includes(s));
+}
+
 // tool-label-sidecar.ts
 import { existsSync as existsSync2, readFileSync, statSync as statSync2 } from "node:fs";
 import { join as join2 } from "node:path";
@@ -23453,7 +23480,8 @@ function detectErrorInTranscriptLine(line) {
     const status = typeof obj.apiErrorStatus === "number" ? obj.apiErrorStatus : null;
     const errStr = typeof obj.error === "string" ? obj.error : "";
     const text = extractAssistantText(obj);
-    const kind2 = status === 429 ? "quota-exhausted" : classifyClaudeError({ type: errStr, status, message: text });
+    const kind2 = status === 429 ? isTransientUpstreamSignal(`${text}
+${errStr}`) ? "rate-limited" : "quota-exhausted" : classifyClaudeError({ type: errStr, status, message: text });
     return {
       kind: kind2,
       raw: obj,
@@ -23547,6 +23575,7 @@ function startSessionTail(config2) {
   const onOperatorEvent = config2.onOperatorEvent;
   log?.(`session-tail: projectsDir=${projectsDir}`);
   const sidecars = new Map;
+  const createSidecar = config2.createSidecar ?? createToolLabelSidecar;
   const stateDirForSidecar = process.env.TELEGRAM_STATE_DIR ?? null;
   function sessionIdForFile(file) {
     if (!file)
@@ -23561,7 +23590,7 @@ function startSessionTail(config2) {
     if (existing)
       return existing;
     try {
-      const s = createToolLabelSidecar({ stateDir: stateDirForSidecar, sessionId });
+      const s = createSidecar({ stateDir: stateDirForSidecar, sessionId });
       sidecars.set(sessionId, s);
       s.onLabel((toolUseId, label, toolName) => {
         rawOnEvent({ kind: "tool_label", toolUseId, label, toolName });
@@ -23572,6 +23601,17 @@ function startSessionTail(config2) {
       return null;
     }
   }
+  function stopSidecar(sessionId) {
+    if (!sessionId)
+      return;
+    const s = sidecars.get(sessionId);
+    if (!s)
+      return;
+    try {
+      s.stop();
+    } catch {}
+    sidecars.delete(sessionId);
+  }
   function decorate(ev, sessionId) {
     if (!sessionId)
       return ev;
@@ -23664,6 +23704,11 @@ function startSessionTail(config2) {
       } catch {}
       watcher = null;
     }
+    const rotatedAwaySid = sessionIdForFile(currentFile);
+    const nextSid = sessionIdForFile(file);
+    if (rotatedAwaySid != null && rotatedAwaySid !== nextSid) {
+      stopSidecar(rotatedAwaySid);
+    }
     currentFile = file;
     const prior = fileCursors.get(file);
     if (prior != null) {
@@ -23696,7 +23741,7 @@ function startSessionTail(config2) {
   const multiAgent = isMultiAgentEnabled();
   const CAP_TOOL_USE_THRESHOLD = 30;
   const subTails = new Map;
-  const IDLE_FSWATCH_TTL_MS = 5 * 60 * 1000;
+  const IDLE_FSWATCH_TTL_MS = Math.max(1000, config2.subTailIdleReapMs ?? 5 * 60 * 1000);
   function readSub(t) {
     if (stopped)
       return;
@@ -23803,6 +23848,7 @@ function startSessionTail(config2) {
           } catch {}
           t.watcher = null;
         }
+        stopSidecar(sessionIdForFile(t.file));
         subTails.delete(file);
         log?.(`session-tail: reaped idle sub ${t.agentId} (${file})`);
       }
@@ -24562,6 +24608,7 @@ var BROAD_ONLY_TOOLS = new Set([
   "WebSearch",
   "Task",
   "Agent",
+  "Workflow",
   "TodoWrite",
   "ExitPlanMode"
 ]);
@@ -24697,6 +24744,60 @@ function appendCrashBreadcrumb(logPath, kind, err, now = new Date) {
   } catch {}
 }
 
+// bridge/inbound-dedup.ts
+var INBOUND_DEDUP_MAX_PER_CHAT = 512;
+function shouldDedupInbound(msg) {
+  if (!Number.isFinite(msg.messageId) || msg.messageId <= 0)
+    return false;
+  const m = msg.meta ?? {};
+  if (m.source != null)
+    return false;
+  if (m.button_callback != null)
+    return false;
+  if (m.kind != null)
+    return false;
+  if (m.event != null)
+    return false;
+  return true;
+}
+
+class InboundDedup {
+  maxPerChat;
+  byChat = new Map;
+  constructor(maxPerChat = INBOUND_DEDUP_MAX_PER_CHAT) {
+    this.maxPerChat = maxPerChat;
+  }
+  checkAndRecord(chatKey, messageId) {
+    let set2 = this.byChat.get(chatKey);
+    if (set2 == null) {
+      set2 = new Set;
+      this.byChat.set(chatKey, set2);
+    }
+    if (set2.has(messageId))
+      return "duplicate";
+    if (set2.size >= this.maxPerChat) {
+      const oldest = set2.values().next().value;
+      if (oldest !== undefined)
+        set2.delete(oldest);
+    }
+    set2.add(messageId);
+    return "fresh";
+  }
+  clearChat(chatId) {
+    const prefix = `${chatId}:`;
+    for (const key of this.byChat.keys()) {
+      if (key === chatId || key.startsWith(prefix))
+        this.byChat.delete(key);
+    }
+  }
+  size(chatKey) {
+    return this.byChat.get(chatKey)?.size ?? 0;
+  }
+}
+function dedupChatKey(chatId, threadId) {
+  return `${chatId}:${threadId == null || threadId === 0 ? "_" : threadId}`;
+}
+
 // bridge/bridge.ts
 installPluginLogger();
 var STATE_DIR = process.env.TELEGRAM_STATE_DIR ?? join4(homedir3(), ".claude", "channels", "telegram");
@@ -24764,7 +24865,8 @@ var TOOL_SCHEMAS = [
                 url: { type: "string", description: "Open this URL when tapped. Mutually exclusive with callback_data." },
                 callback_data: { type: "string", description: "Opaque tag delivered back to the agent on tap. Max 58 chars (gateway prepends an `agent:` prefix to the 64-byte Telegram limit). Mutually exclusive with url." },
                 ack_text: { type: "string", description: 'Toast text shown to the user the instant they tap this button (#710). Default "\u2713 received". Max ~200 chars (Telegram answerCallbackQuery limit). Has no effect on URL buttons.' },
-                single_use: { type: "boolean", description: `When true (default) tapping any single_use button on the message removes the entire keyboard so the user can't double-fire. Set false on buttons that should stay tappable (e.g. a "Refresh" button). If ANY button on the message has single_use:false the keyboard is preserved on tap.` }
+                single_use: { type: "boolean", description: `When true (default) tapping any single_use button on the message removes the entire keyboard so the user can't double-fire. Set false on buttons that should stay tappable (e.g. a "Refresh" button). If ANY button on the message has single_use:false the keyboard is preserved on tap.` },
+                inline_keyboard_confirm: { type: "boolean", description: `Per-message override for the "\u2705 You chose: <label> \xB7 HH:MM" body annotation on tap (#789). true forces the annotation even if the agent default is off; false skips it even if the agent default is on; omit to use the agent default. Only applies to single-use keyboards and requires the agent parseMode to be the default html. Has no effect on URL buttons. Note: annotation rebuilds the body from the message's plain text, so formatting entities on the original message are lost.` }
               },
               required: ["text"]
             }
@@ -25175,6 +25277,12 @@ mcp.setRequestHandler(CallToolRequestSchema2, async (req) => {
         isError: true
       };
     }
+    if (inboundDedupEnabled && (tool === "reply" || tool === "stream_reply")) {
+      const replyChatId = args.chat_id;
+      if (typeof replyChatId === "string" && replyChatId.length > 0) {
+        inboundDedup.clearChat(replyChatId);
+      }
+    }
     if (result.result && typeof result.result === "object" && "content" in result.result) {
       return result.result;
     }
@@ -25259,7 +25367,17 @@ mcp.setNotificationHandler(exports_external.object({
   });
 });
 var ipc = null;
+var inboundDedup = new InboundDedup;
+var inboundDedupEnabled = process.env.SWITCHROOM_INBOUND_DEDUP !== "0";
 function onInbound(msg) {
+  if (inboundDedupEnabled && shouldDedupInbound(msg)) {
+    const chatKey = dedupChatKey(msg.chatId, msg.threadId);
+    if (inboundDedup.checkAndRecord(chatKey, msg.messageId) === "duplicate") {
+      process.stderr.write(`telegram bridge: dropping duplicate inbound messageId=${msg.messageId} ` + `chat=${chatKey} (already forwarded this turn \u2014 sweep re-delivery, #2094)
+`);
+      return;
+    }
+  }
   mcp.notification({
     method: "notifications/claude/channel",
     params: {