switchroom 0.18.14 → 0.18.17

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "switchroom",
   "//version": "NOT the release version — source of truth is the git tag, resolved by scripts/build.mjs:resolveVersion() (see CLAUDE.md > Standard release process). This field is stale by design and only the Layer-4 dev/non-tag fallback for build.mjs + src/cli/resolve-version.ts; do NOT bump it expecting a release to pick it up. npm-pack tarball naming needs a real version — do that as an UNCOMMITTED pack-time bump (see release step 6), never a committed one.",
-  "version": "0.18.14",
+  "version": "0.18.17",
   "description": "Run Claude Code 24/7 on your Claude Pro/Max subscription over Telegram. Open-source alternative to OpenClaw and NanoClaw — no API keys.",
   "type": "module",
   "bin": {

package/profiles/_base/start.sh.hbs

@@ -1130,23 +1130,28 @@ x-litellm-tags: agent:$SWITCHROOM_AGENT_NAME,profile:${SWITCHROOM_AGENT_PROFILE:
   unset sr_ll_key sr_ll_ok sr_ll_unreachable
 fi
 
-# --- Session model resolution (durable .session-model + .relaunch-model-intent) ---
+# --- Session model resolution (consume-once .session-model carrier) ---
 #
-# Contract: reference/rfcs/session-model-stickiness.md (#3039 revision). A
-# positively-confirmed `/model X` switch persists as
-# `{{agentDir}}/.session-model` (one-line JSON written by the gateway) and is
-# honored on EVERY boot — deploy, watchdog bounce, raw `docker restart`,
-# host reboot, crash. It is cleared only by:
+# Contract: reference/rfcs/session-model-stickiness.md §0.1 (rev 4, operator
+# decision 2026-07-12 — SESSION-SCOPED, superseding rev 3 keep-by-default). A
+# `/model` override lasts only for the current session:
 #
-#   - explicit user action (`/model default` deletes it live; a fresh
-#     (<10 min) explicit "revert" `.relaunch-model-intent` reverts at boot)
-#   - invalidation: corrupt/malformed file, or the configured yaml `model:`
-#     changed since the switch
+#   - Claude switches apply LIVE in-session (claude's native picker) and write
+#     NO carrier — the explicit `claude --model {{{modelQ}}}` this script execs
+#     reverts them for free on the next boot.
+#   - sr-* / sr→Claude switches and a queued /model persisted at shutdown need
+#     a relaunch to take effect, so the gateway writes `{{agentDir}}/.session-model`
+#     (one-line JSON) IMMEDIATELY before that relaunch. This block APPLIES the
+#     carrier on the single boot that reads it and then DELETES it (consume-once).
+#     Any SUBSEQUENT restart — deploy, `/restart`, `/new`, watchdog recovery,
+#     crash, raw `docker restart`, host reboot — finds no carrier and boots the
+#     configured default. That deletion is the marker distinguishing the
+#     model-apply relaunch from every later restart.
 #
-# Every clearing path writes `.session-model-alert`, which the gateway
-# relays to the operator chat once at boot — an override is never dropped
-# silently. Default (no intent / stale / corrupt intent) is KEEP (operator
-# decision 2026-07-11, superseding the earlier revert-by-default).
+# `/model default` deletes the carrier live. Invalidation paths (corrupt file,
+# configured yaml `model:` changed) also delete + write `.session-model-alert`,
+# which the gateway relays to the operator chat once at boot. The normal apply
+# path is silent here — the gateway already acked the `/model` in chat.
 #
 # NB {{{modelQ}}} is already shell-single-quoted by the scaffold (it renders as
 # a quoted token, e.g. 'claude-sonnet-5'), so it is assigned BARE here — never
@@ -1154,63 +1159,42 @@ fi
 # the value and break `claude --model`.
 _EFFECTIVE_MODEL={{{modelQ}}}
 # Record the RESOLVED configured default (raw, unquoted) every boot, before
-# override resolution. The gateway copies this into the override's
+# override resolution. The gateway copies this into the carrier's
 # `configuredDefaultAtWrite`, so both sides of the invalidation compare below
 # come from the same resolver. Overwrite, not consumed.
 printf '%s\n' "$_EFFECTIVE_MODEL" > "{{agentDir}}/.configured-default-model" 2>/dev/null || true
 
-# Migration shim (one release, RFC §7): a leftover one-shot
-# `.session-model-override` carrier means an OLD gateway wrote it immediately
-# before this very bounce — it is the newest user intent and WINS over any
-# `.session-model` on disk. Convert (overwrite) + consume, and apply THIS
-# boot (the carrier's presence is itself the keep signal).
-_sm_keep=""
+# Rev-4 hygiene (#3184 review LOW-2): remove the files retired with the
+# keep/revert intent subsystem and the crashloop self-heal. Nothing reads them
+# anymore; without this rm they would linger in the bind-mounted state dir
+# forever after rollout. Idempotent — a cheap no-op once clean.
+rm -f "{{agentDir}}/.relaunch-model-intent" "{{agentDir}}/.session-model-boot-attempts" "{{agentDir}}/.session-model-kept-notified"
+
+# Migration shim (one release): a leftover one-shot `.session-model-override`
+# carrier from a pre-consume-once gateway means an OLD gateway wrote it
+# immediately before this very bounce — convert it to `.session-model` so the
+# block below applies + consumes it this boot (same one-shot semantics).
 if [ -f "{{agentDir}}/.session-model-override" ]; then
   _mig="$(tr -d '[:space:]' < "{{agentDir}}/.session-model-override" 2>/dev/null || true)"
   rm -f "{{agentDir}}/.session-model-override"
   if printf '%s' "$_mig" | grep -Eq '^[A-Za-z0-9][]A-Za-z0-9._[/-]{0,99}$'; then
     printf '{"model":"%s","configuredDefaultAtWrite":"%s","ts":%s}\n' "$_mig" "$_EFFECTIVE_MODEL" "$(( $(date +%s) * 1000 ))" > "{{agentDir}}/.session-model" 2>/dev/null || true
-    _sm_keep="1"
-    echo "session-model: migrated legacy one-shot carrier '$_mig' to durable .session-model (applying this boot)" >&2
+    echo "session-model: migrated legacy one-shot carrier '$_mig' to .session-model (applying + consuming this boot)" >&2
   else
     echo "session-model: ignoring malformed legacy .session-model-override (failed shape gate)" >&2
   fi
   unset _mig
 fi
 
-# One-shot intent: consume unconditionally, honor only a fresh "keep".
-# Freshness clock is the EMBEDDED ts (ms), never file mtime — same clock the
-# gateway writes with.
-_sm_reason=""
-_sm_revert=""
-if [ -f "{{agentDir}}/.relaunch-model-intent" ]; then
-  _int_raw="$(cat "{{agentDir}}/.relaunch-model-intent" 2>/dev/null || true)"
-  rm -f "{{agentDir}}/.relaunch-model-intent"
-  _int="$(printf '%s' "$_int_raw" | sed -n 's/.*"intent"[[:space:]]*:[[:space:]]*"\([a-z]*\)".*/\1/p')"
-  _int_ts="$(printf '%s' "$_int_raw" | sed -n 's/.*"ts"[[:space:]]*:[[:space:]]*\([0-9]\{1,\}\).*/\1/p')"
-  _sm_reason="$(printf '%s' "$_int_raw" | sed -n 's/.*"reason"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p')"
-  # #3039: boot default is KEEP. Only a FRESH explicit "revert" intent
-  # (stamped by an explicit user/gateway revert path) clears the override.
-  # A stale or corrupt intent counts as no intent → keep.
-  if [ "$_int" = "revert" ] && [ -n "$_int_ts" ] && [ $(( $(date +%s) * 1000 - _int_ts )) -lt 600000 ]; then
-    _sm_revert="1"
-  fi
-  unset _int_raw _int _int_ts
-fi
-
 if [ -f "{{agentDir}}/.session-model" ]; then
   _smf="$(cat "{{agentDir}}/.session-model" 2>/dev/null || true)"
   _sm_model="$(printf '%s' "$_smf" | sed -n 's/.*"model"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p')"
   _sm_cfg="$(printf '%s' "$_smf" | sed -n 's/.*"configuredDefaultAtWrite"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p')"
-  _sm_ts="$(printf '%s' "$_smf" | sed -n 's/.*"ts"[[:space:]]*:[[:space:]]*\([0-9]\{1,\}\).*/\1/p')"
-  if [ -n "$_sm_revert" ]; then
-    # Explicit fresh revert intent — the ONLY boot path that clears a valid
-    # override by design (#3039). Everything else keeps.
-    rm -f "{{agentDir}}/.session-model" "{{agentDir}}/.session-model-kept-notified"
-    _sm_why="${_sm_reason:-explicit revert intent}"
-    echo "session-model: reverting to configured default '$_EFFECTIVE_MODEL' — $_sm_why (session override '$_sm_model' cleared)" >&2
-    printf 'Session model override `%s` was cleared as requested (%s) — this relaunch booted the configured default `%s`. Re-issue /model %s to switch back.\n' "$_sm_model" "$_sm_why" "$_EFFECTIVE_MODEL" "$_sm_model" > "{{agentDir}}/.session-model-alert" 2>/dev/null || true
-    unset _sm_why
+  # CONSUME-ONCE: delete the carrier now, before any apply/exec. The carrier
+  # governs exactly this one boot; a bad token can therefore crash at most one
+  # boot (the next boot has no carrier and reverts), so no crashloop self-heal
+  # is needed. Every branch below has already removed the file.
+  rm -f "{{agentDir}}/.session-model"
   # Shape gate — kept BYTE-IDENTICAL with MODEL_ARG_RE in
   # telegram-plugin/gateway/model-command.ts. `/` is allowed for
   # OpenRouter-style `sr-vendor/model` ids; it is not a shell metachar inside
@@ -1219,116 +1203,69 @@ if [ -f "{{agentDir}}/.session-model" ]; then
   # extraction above emits one match per matching LINE, and `grep -Eq`
   # passes if ANY line matches — a multiline value must never reach
   # `claude --model` (parity with parseSessionModel's single-string check).
-  elif [ "$(printf '%s' "$_sm_model" | wc -c)" -eq 0 ] || [ "$(printf '%s' "$_sm_model" | wc -l)" -ne 0 ] || ! printf '%s' "$_sm_model" | grep -Eq '^[A-Za-z0-9][]A-Za-z0-9._[/-]{0,99}$'; then
-    # Invalid carrier (#3039): fall back to the configured default AND tell
-    # the operator once — never a silent stderr-only drop.
-    rm -f "{{agentDir}}/.session-model" "{{agentDir}}/.session-model-kept-notified"
+  if [ "$(printf '%s' "$_sm_model" | wc -c)" -eq 0 ] || [ "$(printf '%s' "$_sm_model" | wc -l)" -ne 0 ] || ! printf '%s' "$_sm_model" | grep -Eq '^[A-Za-z0-9][]A-Za-z0-9._[/-]{0,99}$'; then
+    # Invalid carrier: fall back to the configured default AND tell the
+    # operator once — never a silent stderr-only drop.
     echo "session-model: ignoring malformed .session-model (failed shape gate) — using configured default '$_EFFECTIVE_MODEL'" >&2
     printf 'Your saved session model override could not be read (invalid or corrupt), so the agent booted on its configured default `%s`. Re-issue /model <name> if you want a different model.\n' "$_EFFECTIVE_MODEL" > "{{agentDir}}/.session-model-alert" 2>/dev/null || true
   elif [ "$_sm_cfg" != "$_EFFECTIVE_MODEL" ]; then
-    # switchroom.yaml `model:` changed since the switch → the override is
-    # against a default that no longer exists (it may name a retired model).
-    # Invalidate + announce once (#3039 invalid-carrier fallback).
-    rm -f "{{agentDir}}/.session-model" "{{agentDir}}/.session-model-kept-notified"
-    echo "session-model: configured default changed ('$_sm_cfg' → '$_EFFECTIVE_MODEL') — clearing session override '$_sm_model'" >&2
-    printf 'The configured default model changed (`%s` → `%s`), so your session override to `%s` was cleared — the agent booted on the new configured default. Re-issue /model %s if you still want it.\n' "$_sm_cfg" "$_EFFECTIVE_MODEL" "$_sm_model" "$_sm_model" > "{{agentDir}}/.session-model-alert" 2>/dev/null || true
+    # switchroom.yaml `model:` changed between the switch and this apply-boot →
+    # the carrier is against a default that no longer exists. Invalidate +
+    # announce once.
+    echo "session-model: configured default changed ('$_sm_cfg' → '$_EFFECTIVE_MODEL') — dropping session override '$_sm_model'" >&2
+    printf 'The configured default model changed (`%s` → `%s`), so your session override to `%s` was not applied — the agent booted on the new configured default. Re-issue /model %s if you still want it.\n' "$_sm_cfg" "$_EFFECTIVE_MODEL" "$_sm_model" "$_sm_model" > "{{agentDir}}/.session-model-alert" 2>/dev/null || true
+  elif [ "${_sm_model#sr-}" != "$_sm_model" ] && [ -z "$_LITELLM_OK" ]; then
+    # sr-* + LiteLLM unreachable at the apply-boot: booting the override would
+    # 4xx against Anthropic, and consume-once means we can't retain it for a
+    # later relaunch. Boot the configured default and tell the operator to
+    # re-issue once the proxy is back.
+    echo "session-model: LiteLLM proxy unreachable at boot — NOT applying sr-* override '$_sm_model'; booting configured default '$_EFFECTIVE_MODEL' (re-issue /model when the proxy is back)" >&2
+    printf 'LiteLLM proxy was unreachable at boot, so the session model override `%s` was not applied — the agent booted on its configured default `%s`. Re-issue /model %s once the proxy is reachable.\n' "$_sm_model" "$_EFFECTIVE_MODEL" "$_sm_model" > "{{agentDir}}/.session-model-alert" 2>/dev/null || true
   else
-    case "$_sm_model" in
-      sr-*)
-        if [ -z "$_LITELLM_OK" ]; then
-          # sr-* + LiteLLM unreachable: booting the override would 4xx against
-          # Anthropic. Boot the configured default but RETAIN the durable file
-          # — it re-applies on the next keep relaunch once the proxy is back.
-          echo "session-model: LiteLLM proxy unreachable at boot — NOT applying sr-* override '$_sm_model' this boot; booting configured default '$_EFFECTIVE_MODEL' (override retained, re-applies next relaunch)" >&2
-          printf 'LiteLLM proxy was unreachable at boot, so the session model override `%s` was not applied — the agent booted on its configured default `%s`. The override is retained and will re-apply on the next switchroom-managed relaunch once LiteLLM is reachable; /model default drops it.\n' "$_sm_model" "$_EFFECTIVE_MODEL" > "{{agentDir}}/.session-model-alert" 2>/dev/null || true
-        else
-          _EFFECTIVE_MODEL="$_sm_model"
-        fi
-        ;;
-      *)
-        _EFFECTIVE_MODEL="$_sm_model"
-        ;;
-    esac
-    if [ "$_EFFECTIVE_MODEL" = "$_sm_model" ]; then
-      echo "session-model: keeping session override '$_sm_model' across this relaunch${_sm_reason:+ ($_sm_reason)}" >&2
-      # #3042 item 4: notify the chat ONCE per kept value — a watchdog bounce
-      # loop must not storm the operator with identical "kept" alerts. The
-      # sentinel is cleared on every path that clears the override.
-      if [ "$(cat "{{agentDir}}/.session-model-kept-notified" 2>/dev/null || true)" != "$_sm_model" ]; then
-        printf 'Session model override `%s` kept across this relaunch%s. It persists across restarts and deploys; /model default clears it.\n' "$_sm_model" "${_sm_reason:+ ($_sm_reason)}" > "{{agentDir}}/.session-model-alert" 2>/dev/null || true
-        printf '%s\n' "$_sm_model" > "{{agentDir}}/.session-model-kept-notified" 2>/dev/null || true
-      fi
-    fi
+    # Apply the carrier for THIS session. No boot alert — the gateway already
+    # acked the /model switch in chat, and the override reverts on next restart.
+    _EFFECTIVE_MODEL="$_sm_model"
+    echo "session-model: applying session override '$_sm_model' this boot (consume-once — reverts on next restart)" >&2
   fi
-  unset _smf _sm_model _sm_cfg _sm_ts
+  unset _smf _sm_model _sm_cfg
 fi
-unset _sm_keep _sm_reason _sm_revert
 
-# --- Override crashloop self-heal (#3042 review blocker 2b) ---
+# --- Session effort resolution (consume-once .session-effort carrier, #3186) ---
 #
-# Under keep-by-default an invalid-but-shape-valid persisted model (a typo
-# persisted at shutdown, or a confirmed model later retired) would make every
-# boot exec `claude --model <bad>` and die with the gateway dead — recovery
-# would need a host shell. Detect the loop from inside: when an override is
-# ACTIVE, stamp a boot-attempt counter just before exec; a healthy run makes
-# the next boot arrive much later (stamp stale → counter resets), while a
-# fast crashloop re-enters here within seconds (docker backoff caps ≈1 min).
-# Three consecutive fast boots with the same override → clear the carrier,
-# boot the configured default, and alert the chat once.
-_SM_CFG_RECORDED="$(cat "{{agentDir}}/.configured-default-model" 2>/dev/null | tr -d '[:space:]' || true)"
-if [ -n "$_SM_CFG_RECORDED" ] && [ "$_EFFECTIVE_MODEL" != "$_SM_CFG_RECORDED" ] && [ -f "{{agentDir}}/.session-model" ]; then
-  _bl_now="$(date +%s)"
-  _bl_cnt=0
-  _bl_prev=0
-  if [ -f "{{agentDir}}/.session-model-boot-attempts" ]; then
-    read -r _bl_cnt _bl_prev < "{{agentDir}}/.session-model-boot-attempts" 2>/dev/null || true
-  fi
-  case "$_bl_cnt" in (''|*[!0-9]*) _bl_cnt=0;; esac
-  case "$_bl_prev" in (''|*[!0-9]*) _bl_prev=0;; esac
-  if [ $(( _bl_now - _bl_prev )) -lt 150 ]; then _bl_cnt=$(( _bl_cnt + 1 )); else _bl_cnt=1; fi
-  if [ "$_bl_cnt" -ge 3 ]; then
-    echo "session-model: override '$_EFFECTIVE_MODEL' appears to be crashlooping the session ($_bl_cnt fast boots) — clearing it, booting configured default '$_SM_CFG_RECORDED'" >&2
-    printf 'Session model override `%s` was cleared automatically: the agent failed to stay up %s boots in a row with it active (the model may be invalid or retired). Booting the configured default `%s`. Re-issue /model <name> if you want a different model.\n' "$_EFFECTIVE_MODEL" "$_bl_cnt" "$_SM_CFG_RECORDED" >> "{{agentDir}}/.session-model-alert" 2>/dev/null || true
-    rm -f "{{agentDir}}/.session-model" "{{agentDir}}/.session-model-boot-attempts" "{{agentDir}}/.session-model-kept-notified"
-    _EFFECTIVE_MODEL="$_SM_CFG_RECORDED"
-  else
-    printf '%s %s\n' "$_bl_cnt" "$_bl_now" > "{{agentDir}}/.session-model-boot-attempts" 2>/dev/null || true
-  fi
-  unset _bl_now _bl_cnt _bl_prev
-else
-  # No active override this boot — a stale counter must not bite a future one.
-  rm -f "{{agentDir}}/.session-model-boot-attempts"
-fi
-unset _SM_CFG_RECORDED
-
-# --- Session effort resolution (durable .session-effort, #3039) ---
+# The `/effort` sibling of the block above, session-scoped like /model
+# (rev 4). A live `/effort <level>` applies in-session via the applyEffort
+# driver and writes NO carrier — the explicit `--effort <configured>` below
+# reverts it on the next boot. The ONLY boot-applied case is a queued
+# mid-turn `/effort` the gateway persisted at shutdown: this block APPLIES
+# that carrier on the single boot that reads it and then DELETES it
+# (consume-once), so any subsequent restart reverts to the configured
+# `thinking_effort`. Invalidation (corrupt file / configured default
+# changed) appends to `.session-model-alert` so the gateway's boot relay
+# tells the operator once.
 #
-# The `/effort` sibling of the block above. A positively-confirmed `/effort`
-# apply persists `{{agentDir}}/.session-effort` (one-line JSON
-# {"level","configuredDefaultAtWrite","ts"} written by the gateway). It is
-# honored on every boot and cleared only by `/effort default` (live delete)
-# or invalidation here (corrupt file / configured `thinking_effort:` changed)
-# — each invalidation appends to `.session-model-alert` so the gateway's
-# boot relay tells the operator once.
+# NB: the CONFIGURED default resolution is untouched (#3186 constraint) —
+# the fleet `thinking_effort: low` pin (see #1978 /
+# src/config/thinking-effort-risk.ts) resolves exactly as before.
 _EFFECTIVE_EFFORT={{#if thinkingEffort}}'{{thinkingEffort}}'{{else}}''{{/if}}
 if [ -f "{{agentDir}}/.session-effort" ]; then
   _sef="$(cat "{{agentDir}}/.session-effort" 2>/dev/null || true)"
   _se_level="$(printf '%s' "$_sef" | sed -n 's/.*"level"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p')"
   _se_cfg="$(printf '%s' "$_sef" | sed -n 's/.*"configuredDefaultAtWrite"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p')"
+  # CONSUME-ONCE: delete the carrier now, before any apply/exec — it governs
+  # exactly this one boot (parity with the .session-model block above).
+  rm -f "{{agentDir}}/.session-effort"
   # Allowlist gate — kept in sync with EFFORT_LEVELS in
   # telegram-plugin/gateway/effort-command.ts. The level is passed verbatim
   # to `claude --effort`.
   if [ "$(printf '%s' "$_se_level" | wc -l)" -ne 0 ] || ! printf '%s' "$_se_level" | grep -Eq '^(low|medium|high|xhigh|max)$'; then
-    rm -f "{{agentDir}}/.session-effort"
     echo "session-effort: ignoring malformed .session-effort (failed allowlist gate) — using configured default '${_EFFECTIVE_EFFORT:-<unset>}'" >&2
     printf 'Your saved session effort override could not be read (invalid or corrupt), so the agent booted on its configured default effort. Re-issue /effort <level> if you want a different one.\n' >> "{{agentDir}}/.session-model-alert" 2>/dev/null || true
   elif [ "$_se_cfg" != "$_EFFECTIVE_EFFORT" ]; then
-    rm -f "{{agentDir}}/.session-effort"
-    echo "session-effort: configured thinking_effort changed ('$_se_cfg' → '${_EFFECTIVE_EFFORT:-<unset>}') — clearing session override '$_se_level'" >&2
-    printf 'The configured default effort changed (`%s` → `%s`), so your session effort override `%s` was cleared — the agent booted on the new configured default. Re-issue /effort %s if you still want it.\n' "${_se_cfg:-<unset>}" "${_EFFECTIVE_EFFORT:-<unset>}" "$_se_level" "$_se_level" >> "{{agentDir}}/.session-model-alert" 2>/dev/null || true
+    echo "session-effort: configured thinking_effort changed ('$_se_cfg' → '${_EFFECTIVE_EFFORT:-<unset>}') — dropping session override '$_se_level'" >&2
+    printf 'The configured default effort changed (`%s` → `%s`), so your session effort override `%s` was not applied — the agent booted on the new configured default. Re-issue /effort %s if you still want it.\n' "${_se_cfg:-<unset>}" "${_EFFECTIVE_EFFORT:-<unset>}" "$_se_level" "$_se_level" >> "{{agentDir}}/.session-model-alert" 2>/dev/null || true
   else
     _EFFECTIVE_EFFORT="$_se_level"
-    echo "session-effort: keeping session effort override '$_se_level' across this relaunch" >&2
+    echo "session-effort: applying session effort override '$_se_level' this boot (consume-once — reverts on next restart)" >&2
   fi
   unset _sef _se_level _se_cfg
 fi
@@ -1337,6 +1274,11 @@ if [ -n "$_EFFECTIVE_EFFORT" ]; then
 else
   _EFFORT_ARG=""
 fi
+# Record the EFFECTIVE launched effort so the gateway can re-hydrate its
+# in-memory session-effort state after a queued-apply boot, keeping the
+# /effort menu highlight honest. Overwrite (not consumed) — the effort
+# sibling of `.active-session-model` below.
+printf '%s\n' "$_EFFECTIVE_EFFORT" > "{{agentDir}}/.active-session-effort" 2>/dev/null || true
 
 # sr-* passthrough→router repoint — ONE post-resolution gate covering BOTH the
 # /model override path AND the configured-default path (`model: sr-*` in

package/telegram-plugin/dist/bridge/bridge.js

@@ -23061,6 +23061,26 @@ function isTransientUpstreamSignal(text) {
   const lower = sample.toLowerCase();
   return transientUpstreamSignals.some((s) => lower.includes(s));
 }
+var litellmProxyLocal429Signals = [
+  "deployment over user-defined ratelimit",
+  "model rate limit exceeded. tpm limit",
+  "model rate limit exceeded. rpm limit",
+  "deployment over defined rpm limit",
+  "no deployments available for selected model",
+  "litellm rate limit handler",
+  "crossed tpm / rpm",
+  "max parallel request limit reached"
+];
+var litellmV3LimiterSignalPair = ["rate limit exceeded for ", "limit type:"];
+function isLitellmProxyLocal429(text) {
+  if (typeof text !== "string" || text.length === 0)
+    return false;
+  const sample = text.length > 16384 ? text.slice(0, 16384) : text;
+  const lower = sample.toLowerCase();
+  if (litellmProxyLocal429Signals.some((s) => lower.includes(s)))
+    return true;
+  return litellmV3LimiterSignalPair.every((s) => lower.includes(s));
+}
 
 // tool-label-sidecar.ts
 import { existsSync as existsSync2, readFileSync, statSync as statSync2 } from "node:fs";
@@ -23481,6 +23501,7 @@ function detectErrorInTranscriptLine(line) {
     const errStr = typeof obj.error === "string" ? obj.error : "";
     const text = extractAssistantText(obj);
     const kind2 = status === 429 ? isTransientUpstreamSignal(`${text}
+${errStr}`) || isLitellmProxyLocal429(`${text}
 ${errStr}`) ? "rate-limited" : "quota-exhausted" : classifyClaudeError({ type: errStr, status, message: text });
     return {
       kind: kind2,