switchroom 0.18.15 → 0.18.18

package/dist/host-control/main.js

@@ -18836,6 +18836,19 @@ var TelegramChannelSchema = exports_external.object({
   approval_timeout_minutes: exports_external.number().int().nonnegative().optional().describe("Operator approval-card lifetime (minutes) for the tool-use 'Allow " + "once' card and the vault grant decision wait. After this long with " + "no operator tap, the card auto-denies (a TIMEOUT, not a denial — the " + "agent is told not to retry). Default 60. hostd-gated verbs " + "(mcp__hostd__*) keep their own longer window; the hostd " + "config-propose card is not governed by this key."),
   sub_agent_tick_interval_ms: exports_external.number().int().nonnegative().optional().describe("Heartbeat tick interval (ms) for sub-agent rendering. Forces a " + "re-render of the elapsed-time counter while sub-agents are running, " + "even during silent stretches between tool calls. Default 10000 (10 s). " + "Set to 0 to disable the elapsed-ticker path."),
   edit_budget_threshold: exports_external.number().int().nonnegative().optional().describe("Telegram API edit budget per minute before the progress-card driver " + "falls back to a slower coalesce window. When a chat accumulates more " + "than this many card edits in the trailing 60 s, the driver switches " + "to a wider coalesce interval until the rate drops back. Default 18. " + "Increase if your gateway frequently bumps the Telegram edit-rate ceiling " + "with many parallel sub-agents; decrease for a more conservative buffer."),
+  send_gate: exports_external.object({
+    enabled: exports_external.boolean().optional().describe("Master switch for the deterministic outbound send gate " + "(telegram-plugin/send-gate.ts) — the token-bucket scheduler every " + "Bot API call transits so per-surface throttles can't add up past a " + "flood ceiling. ON by default. Precedence: the operator break-glass " + "env var SWITCHROOM_TELEGRAM_SEND_GATE (0/false/off/no) ALWAYS wins " + "when explicitly set; this key only decides when that env var is " + "unset. Omit to keep the gate on."),
+    global_per_sec: exports_external.number().positive().optional().describe("Global bucket sustained rate (Bot API calls/sec across ALL chats). " + "Default 25 (headroom under Telegram's ~30/s). Must be > 0 — a zero " + "or negative rate would wedge all outbound sends. Omit to keep 25."),
+    global_burst: exports_external.number().int().positive().describe("Global bucket burst capacity. Default 4; worst-case 1s window " + "admits global_burst + global_per_sec = 29 < 30, a real margin under " + "the ceiling. Must be an integer >= 1 (a 0 capacity never admits a " + "token and wedges sends). Omit to keep 4.").optional(),
+    per_chat_per_sec: exports_external.number().positive().optional().describe("Per-chat sustained rate (calls/sec to a single chat). Default 1. " + "Must be > 0 (zero/negative wedges that chat). Omit to keep 1."),
+    per_chat_burst: exports_external.number().int().positive().optional().describe("Per-chat burst capacity. Default 3. Must be an integer >= 1 " + "(0 wedges the chat's bucket). Omit to keep 3."),
+    per_group_per_min: exports_external.number().positive().optional().describe("Per-group sustained rate (calls/min to a single group/supergroup). " + "Default 18 (headroom under Telegram's ~20/min group ceiling). Must " + "be > 0. Omit to keep 18."),
+    per_group_burst: exports_external.number().int().positive().optional().describe("Per-group burst capacity. Default 2. Must be an integer >= 1 " + "(0 wedges the group's bucket). Omit to keep 2."),
+    edit_floor_ms: exports_external.number().int().nonnegative().optional().describe("Minimum ms between successive edits of the SAME message_id " + "(last-write-wins coalescing enforces this floor). Default 1500 " + "(Telegram's ~1 edit/sec/message practical ceiling). 0 disables the " + "floor. Must be an integer >= 0. Omit to keep 1500.")
+  }).optional().describe("Tunable rate limits for the deterministic outbound send gate " + "(telegram-plugin/send-gate.ts). Every key is optional and defaults to " + "the send gate's built-in value, so omitting the whole block reproduces " + "today's exact behaviour — this is pure operator tuning, no default is " + "changed. Cascades from defaults.channels.telegram.send_gate."),
+  worker_feed: exports_external.object({
+    max_rows: exports_external.number().int().positive().optional().describe("Max live-worker rows rendered in the COMBINED worker-activity feed " + "(2+ background workers in one chat/thread coalesce into ONE message; " + "telegram-plugin/worker-activity-feed.ts) before a compact " + "'+M more working…' spill line — keeps the coalesced body compact and " + "legible (and under the rich-message wire ceiling). Default 8. A " + "single-worker chat renders the full \uD83D\uDEE0 Worker card and ignores this. " + "Must be an integer >= 1. Omit to keep 8.")
+  }).optional().describe("Tuning for the coalesced worker-activity feed " + "(telegram-plugin/worker-activity-feed.ts). Cascades from " + "defaults.channels.telegram.worker_feed."),
   stickers: exports_external.record(exports_external.string(), exports_external.string()).optional().describe("Sticker aliases for the `send_sticker` MCP tool (#576). Maps a " + "short alias name (e.g. 'happy', 'thinking') to a Telegram file_id. " + "Operator-curated — capture file_ids from inbound stickers the user " + "sends and add them here. The agent calls send_sticker(chat_id, " + "alias='happy') and the gateway resolves to the file_id at send " + "time. Aliases enable persona-flavored expressiveness without " + "exposing raw file_ids in the agent prompt. Personal-assistant / " + "health-coach personas benefit; coding agents typically don't " + "configure any."),
   voice_in: exports_external.object({
     enabled: exports_external.boolean().optional().describe("Master switch for voice-message transcription."),
@@ -18861,6 +18874,9 @@ var TelegramChannelSchema = exports_external.object({
     window_ms: exports_external.number().int().nonnegative().optional().describe("Sliding-window (ms) for merging consecutive inbound messages from " + "the same sender+topic into ONE Claude turn. Each new message resets " + "the timer; the turn starts once the sender pauses for this long. " + "Catches forwarded bursts, pasted text the Telegram client split " + "into several messages, and mixed text+media forwards. Default 500. " + "Set 0 to disable (every message becomes its own turn). Raise for " + "users who think in multiple short messages; the trade-off is the " + "single-message turn start is delayed by this much (the \uD83D\uDC40 ack still " + "fires immediately, so perceived latency is unchanged)."),
     max_attachments: exports_external.number().int().positive().optional().describe("Maximum number of media attachments carried into ONE coalesced " + "Claude turn. Default 10 — a full Telegram album (media_group caps " + "at 10) or a text+multi-image forwarded burst arrives as a single " + "turn; the agent sees numbered attachment fields (image_path, " + "image_path_2, …). Set 1 to restore the historical " + "single-attachment-per-turn behaviour. Excess attachments beyond " + "the cap spill into the next turn. Each attachment is downloaded, " + "so a high cap on a slow link delays turn start.")
   }).optional().describe("Inbound coalescing — how the gateway groups rapid consecutive messages " + "into a single turn so a forwarded album or split paste doesn't fan out " + "into N separate turns. Cascades from defaults.channels.telegram.coalesce."),
+  litellm_notice: exports_external.object({
+    window_ms: exports_external.number().int().positive().optional().describe("Per-agent cooldown window (ms) for the litellm-local 429 notice. " + "When the agent trips the LiteLLM proxy's OWN tpm_limit/rpm_limit " + "cap (a `litellm-local` classified 429 — see docs/auth.md § " + "LiteLLM-proxy-local 429s), the gateway posts ONE calm notice " + "naming the fleet token limiter, then counts further hits silently " + "for this long; the first notice after the window expires says " + "how many were absorbed. Default 900000 (15 min). Invalid values " + "fall back to the default.")
+  }).optional().describe("Debounce tuning for the litellm-local throttle notice — the calm " + "'fleet token limiter engaged' message posted when the LiteLLM " + "proxy's own rate cap trips (never an Anthropic account limit). " + "Cascades from defaults.channels.telegram.litellm_notice."),
   interrupt: exports_external.object({
     safe_boundary: exports_external.boolean().optional().describe("When true (the default), a `!`-prefix interrupt that arrives while " + "the agent is mid-tool-call is DEFERRED: the SIGINT and the " + "replacement turn wait until the in-flight tool call finishes (a " + "clean boundary) instead of C-c'ing the agent mid-write/mid-bash. If " + "no tool is in flight the interrupt still fires immediately. Bounded " + "by max_wait_ms so a long tool never strands the user. Set false to " + "fire synchronously the moment `!` is received (historical " + "behaviour). Rapid repeated `!` while one is pending coalesce into a " + "single deferred interrupt carrying the latest body."),
     max_wait_ms: exports_external.number().int().positive().optional().describe("Upper bound (ms) the gateway waits for a safe boundary before firing " + "a deferred `!` interrupt anyway. Only consulted when safe_boundary is " + "true. Default 8000. Keep it short — the user explicitly asked to " + "interrupt, so a long in-flight tool shouldn't ghost them; the cap " + "trades a tiny risk of a mid-tool C-c for a guaranteed response.")
@@ -26589,7 +26605,7 @@ import { existsSync as existsSync9, readFileSync as readFileSync7 } from "node:f
 import { dirname as dirname4, join as join7 } from "node:path";
 
 // src/build-info.ts
-var VERSION = "0.18.15";
+var VERSION = "0.18.18";
 
 // src/cli/resolve-version.ts
 function readPackageVersion() {
@@ -29102,6 +29118,9 @@ ${output.recovery.stderr}` : "";
     return release;
   }
   async handleAgentSmoke(req, started) {
+    const rejected = this.rejectUnconfiguredTarget(req.args.name, req.request_id, "agent_smoke", started);
+    if (rejected)
+      return rejected;
     const container = `switchroom-${req.args.name}`;
     const respond = (containerState, probes2) => ({
       v: 1,

package/dist/vault/approvals/kernel-server.js

@@ -4256,6 +4256,19 @@ var init_schema = __esm(() => {
     approval_timeout_minutes: exports_external.number().int().nonnegative().optional().describe("Operator approval-card lifetime (minutes) for the tool-use 'Allow " + "once' card and the vault grant decision wait. After this long with " + "no operator tap, the card auto-denies (a TIMEOUT, not a denial — the " + "agent is told not to retry). Default 60. hostd-gated verbs " + "(mcp__hostd__*) keep their own longer window; the hostd " + "config-propose card is not governed by this key."),
     sub_agent_tick_interval_ms: exports_external.number().int().nonnegative().optional().describe("Heartbeat tick interval (ms) for sub-agent rendering. Forces a " + "re-render of the elapsed-time counter while sub-agents are running, " + "even during silent stretches between tool calls. Default 10000 (10 s). " + "Set to 0 to disable the elapsed-ticker path."),
     edit_budget_threshold: exports_external.number().int().nonnegative().optional().describe("Telegram API edit budget per minute before the progress-card driver " + "falls back to a slower coalesce window. When a chat accumulates more " + "than this many card edits in the trailing 60 s, the driver switches " + "to a wider coalesce interval until the rate drops back. Default 18. " + "Increase if your gateway frequently bumps the Telegram edit-rate ceiling " + "with many parallel sub-agents; decrease for a more conservative buffer."),
+    send_gate: exports_external.object({
+      enabled: exports_external.boolean().optional().describe("Master switch for the deterministic outbound send gate " + "(telegram-plugin/send-gate.ts) — the token-bucket scheduler every " + "Bot API call transits so per-surface throttles can't add up past a " + "flood ceiling. ON by default. Precedence: the operator break-glass " + "env var SWITCHROOM_TELEGRAM_SEND_GATE (0/false/off/no) ALWAYS wins " + "when explicitly set; this key only decides when that env var is " + "unset. Omit to keep the gate on."),
+      global_per_sec: exports_external.number().positive().optional().describe("Global bucket sustained rate (Bot API calls/sec across ALL chats). " + "Default 25 (headroom under Telegram's ~30/s). Must be > 0 — a zero " + "or negative rate would wedge all outbound sends. Omit to keep 25."),
+      global_burst: exports_external.number().int().positive().describe("Global bucket burst capacity. Default 4; worst-case 1s window " + "admits global_burst + global_per_sec = 29 < 30, a real margin under " + "the ceiling. Must be an integer >= 1 (a 0 capacity never admits a " + "token and wedges sends). Omit to keep 4.").optional(),
+      per_chat_per_sec: exports_external.number().positive().optional().describe("Per-chat sustained rate (calls/sec to a single chat). Default 1. " + "Must be > 0 (zero/negative wedges that chat). Omit to keep 1."),
+      per_chat_burst: exports_external.number().int().positive().optional().describe("Per-chat burst capacity. Default 3. Must be an integer >= 1 " + "(0 wedges the chat's bucket). Omit to keep 3."),
+      per_group_per_min: exports_external.number().positive().optional().describe("Per-group sustained rate (calls/min to a single group/supergroup). " + "Default 18 (headroom under Telegram's ~20/min group ceiling). Must " + "be > 0. Omit to keep 18."),
+      per_group_burst: exports_external.number().int().positive().optional().describe("Per-group burst capacity. Default 2. Must be an integer >= 1 " + "(0 wedges the group's bucket). Omit to keep 2."),
+      edit_floor_ms: exports_external.number().int().nonnegative().optional().describe("Minimum ms between successive edits of the SAME message_id " + "(last-write-wins coalescing enforces this floor). Default 1500 " + "(Telegram's ~1 edit/sec/message practical ceiling). 0 disables the " + "floor. Must be an integer >= 0. Omit to keep 1500.")
+    }).optional().describe("Tunable rate limits for the deterministic outbound send gate " + "(telegram-plugin/send-gate.ts). Every key is optional and defaults to " + "the send gate's built-in value, so omitting the whole block reproduces " + "today's exact behaviour — this is pure operator tuning, no default is " + "changed. Cascades from defaults.channels.telegram.send_gate."),
+    worker_feed: exports_external.object({
+      max_rows: exports_external.number().int().positive().optional().describe("Max live-worker rows rendered in the COMBINED worker-activity feed " + "(2+ background workers in one chat/thread coalesce into ONE message; " + "telegram-plugin/worker-activity-feed.ts) before a compact " + "'+M more working…' spill line — keeps the coalesced body compact and " + "legible (and under the rich-message wire ceiling). Default 8. A " + "single-worker chat renders the full \uD83D\uDEE0 Worker card and ignores this. " + "Must be an integer >= 1. Omit to keep 8.")
+    }).optional().describe("Tuning for the coalesced worker-activity feed " + "(telegram-plugin/worker-activity-feed.ts). Cascades from " + "defaults.channels.telegram.worker_feed."),
     stickers: exports_external.record(exports_external.string(), exports_external.string()).optional().describe("Sticker aliases for the `send_sticker` MCP tool (#576). Maps a " + "short alias name (e.g. 'happy', 'thinking') to a Telegram file_id. " + "Operator-curated — capture file_ids from inbound stickers the user " + "sends and add them here. The agent calls send_sticker(chat_id, " + "alias='happy') and the gateway resolves to the file_id at send " + "time. Aliases enable persona-flavored expressiveness without " + "exposing raw file_ids in the agent prompt. Personal-assistant / " + "health-coach personas benefit; coding agents typically don't " + "configure any."),
     voice_in: exports_external.object({
       enabled: exports_external.boolean().optional().describe("Master switch for voice-message transcription."),
@@ -4281,6 +4294,9 @@ var init_schema = __esm(() => {
       window_ms: exports_external.number().int().nonnegative().optional().describe("Sliding-window (ms) for merging consecutive inbound messages from " + "the same sender+topic into ONE Claude turn. Each new message resets " + "the timer; the turn starts once the sender pauses for this long. " + "Catches forwarded bursts, pasted text the Telegram client split " + "into several messages, and mixed text+media forwards. Default 500. " + "Set 0 to disable (every message becomes its own turn). Raise for " + "users who think in multiple short messages; the trade-off is the " + "single-message turn start is delayed by this much (the \uD83D\uDC40 ack still " + "fires immediately, so perceived latency is unchanged)."),
       max_attachments: exports_external.number().int().positive().optional().describe("Maximum number of media attachments carried into ONE coalesced " + "Claude turn. Default 10 — a full Telegram album (media_group caps " + "at 10) or a text+multi-image forwarded burst arrives as a single " + "turn; the agent sees numbered attachment fields (image_path, " + "image_path_2, …). Set 1 to restore the historical " + "single-attachment-per-turn behaviour. Excess attachments beyond " + "the cap spill into the next turn. Each attachment is downloaded, " + "so a high cap on a slow link delays turn start.")
     }).optional().describe("Inbound coalescing — how the gateway groups rapid consecutive messages " + "into a single turn so a forwarded album or split paste doesn't fan out " + "into N separate turns. Cascades from defaults.channels.telegram.coalesce."),
+    litellm_notice: exports_external.object({
+      window_ms: exports_external.number().int().positive().optional().describe("Per-agent cooldown window (ms) for the litellm-local 429 notice. " + "When the agent trips the LiteLLM proxy's OWN tpm_limit/rpm_limit " + "cap (a `litellm-local` classified 429 — see docs/auth.md § " + "LiteLLM-proxy-local 429s), the gateway posts ONE calm notice " + "naming the fleet token limiter, then counts further hits silently " + "for this long; the first notice after the window expires says " + "how many were absorbed. Default 900000 (15 min). Invalid values " + "fall back to the default.")
+    }).optional().describe("Debounce tuning for the litellm-local throttle notice — the calm " + "'fleet token limiter engaged' message posted when the LiteLLM " + "proxy's own rate cap trips (never an Anthropic account limit). " + "Cascades from defaults.channels.telegram.litellm_notice."),
     interrupt: exports_external.object({
       safe_boundary: exports_external.boolean().optional().describe("When true (the default), a `!`-prefix interrupt that arrives while " + "the agent is mid-tool-call is DEFERRED: the SIGINT and the " + "replacement turn wait until the in-flight tool call finishes (a " + "clean boundary) instead of C-c'ing the agent mid-write/mid-bash. If " + "no tool is in flight the interrupt still fires immediately. Bounded " + "by max_wait_ms so a long tool never strands the user. Set false to " + "fire synchronously the moment `!` is received (historical " + "behaviour). Rapid repeated `!` while one is pending coalesce into a " + "single deferred interrupt carrying the latest body."),
       max_wait_ms: exports_external.number().int().positive().optional().describe("Upper bound (ms) the gateway waits for a safe boundary before firing " + "a deferred `!` interrupt anyway. Only consulted when safe_boundary is " + "true. Default 8000. Keep it short — the user explicitly asked to " + "interrupt, so a long in-flight tool shouldn't ghost them; the cap " + "trades a tiny risk of a mid-tool C-c for a guaranteed response.")

package/dist/vault/broker/server.js

@@ -4256,6 +4256,19 @@ var init_schema = __esm(() => {
     approval_timeout_minutes: exports_external.number().int().nonnegative().optional().describe("Operator approval-card lifetime (minutes) for the tool-use 'Allow " + "once' card and the vault grant decision wait. After this long with " + "no operator tap, the card auto-denies (a TIMEOUT, not a denial — the " + "agent is told not to retry). Default 60. hostd-gated verbs " + "(mcp__hostd__*) keep their own longer window; the hostd " + "config-propose card is not governed by this key."),
     sub_agent_tick_interval_ms: exports_external.number().int().nonnegative().optional().describe("Heartbeat tick interval (ms) for sub-agent rendering. Forces a " + "re-render of the elapsed-time counter while sub-agents are running, " + "even during silent stretches between tool calls. Default 10000 (10 s). " + "Set to 0 to disable the elapsed-ticker path."),
     edit_budget_threshold: exports_external.number().int().nonnegative().optional().describe("Telegram API edit budget per minute before the progress-card driver " + "falls back to a slower coalesce window. When a chat accumulates more " + "than this many card edits in the trailing 60 s, the driver switches " + "to a wider coalesce interval until the rate drops back. Default 18. " + "Increase if your gateway frequently bumps the Telegram edit-rate ceiling " + "with many parallel sub-agents; decrease for a more conservative buffer."),
+    send_gate: exports_external.object({
+      enabled: exports_external.boolean().optional().describe("Master switch for the deterministic outbound send gate " + "(telegram-plugin/send-gate.ts) — the token-bucket scheduler every " + "Bot API call transits so per-surface throttles can't add up past a " + "flood ceiling. ON by default. Precedence: the operator break-glass " + "env var SWITCHROOM_TELEGRAM_SEND_GATE (0/false/off/no) ALWAYS wins " + "when explicitly set; this key only decides when that env var is " + "unset. Omit to keep the gate on."),
+      global_per_sec: exports_external.number().positive().optional().describe("Global bucket sustained rate (Bot API calls/sec across ALL chats). " + "Default 25 (headroom under Telegram's ~30/s). Must be > 0 — a zero " + "or negative rate would wedge all outbound sends. Omit to keep 25."),
+      global_burst: exports_external.number().int().positive().describe("Global bucket burst capacity. Default 4; worst-case 1s window " + "admits global_burst + global_per_sec = 29 < 30, a real margin under " + "the ceiling. Must be an integer >= 1 (a 0 capacity never admits a " + "token and wedges sends). Omit to keep 4.").optional(),
+      per_chat_per_sec: exports_external.number().positive().optional().describe("Per-chat sustained rate (calls/sec to a single chat). Default 1. " + "Must be > 0 (zero/negative wedges that chat). Omit to keep 1."),
+      per_chat_burst: exports_external.number().int().positive().optional().describe("Per-chat burst capacity. Default 3. Must be an integer >= 1 " + "(0 wedges the chat's bucket). Omit to keep 3."),
+      per_group_per_min: exports_external.number().positive().optional().describe("Per-group sustained rate (calls/min to a single group/supergroup). " + "Default 18 (headroom under Telegram's ~20/min group ceiling). Must " + "be > 0. Omit to keep 18."),
+      per_group_burst: exports_external.number().int().positive().optional().describe("Per-group burst capacity. Default 2. Must be an integer >= 1 " + "(0 wedges the group's bucket). Omit to keep 2."),
+      edit_floor_ms: exports_external.number().int().nonnegative().optional().describe("Minimum ms between successive edits of the SAME message_id " + "(last-write-wins coalescing enforces this floor). Default 1500 " + "(Telegram's ~1 edit/sec/message practical ceiling). 0 disables the " + "floor. Must be an integer >= 0. Omit to keep 1500.")
+    }).optional().describe("Tunable rate limits for the deterministic outbound send gate " + "(telegram-plugin/send-gate.ts). Every key is optional and defaults to " + "the send gate's built-in value, so omitting the whole block reproduces " + "today's exact behaviour — this is pure operator tuning, no default is " + "changed. Cascades from defaults.channels.telegram.send_gate."),
+    worker_feed: exports_external.object({
+      max_rows: exports_external.number().int().positive().optional().describe("Max live-worker rows rendered in the COMBINED worker-activity feed " + "(2+ background workers in one chat/thread coalesce into ONE message; " + "telegram-plugin/worker-activity-feed.ts) before a compact " + "'+M more working…' spill line — keeps the coalesced body compact and " + "legible (and under the rich-message wire ceiling). Default 8. A " + "single-worker chat renders the full \uD83D\uDEE0 Worker card and ignores this. " + "Must be an integer >= 1. Omit to keep 8.")
+    }).optional().describe("Tuning for the coalesced worker-activity feed " + "(telegram-plugin/worker-activity-feed.ts). Cascades from " + "defaults.channels.telegram.worker_feed."),
     stickers: exports_external.record(exports_external.string(), exports_external.string()).optional().describe("Sticker aliases for the `send_sticker` MCP tool (#576). Maps a " + "short alias name (e.g. 'happy', 'thinking') to a Telegram file_id. " + "Operator-curated — capture file_ids from inbound stickers the user " + "sends and add them here. The agent calls send_sticker(chat_id, " + "alias='happy') and the gateway resolves to the file_id at send " + "time. Aliases enable persona-flavored expressiveness without " + "exposing raw file_ids in the agent prompt. Personal-assistant / " + "health-coach personas benefit; coding agents typically don't " + "configure any."),
     voice_in: exports_external.object({
       enabled: exports_external.boolean().optional().describe("Master switch for voice-message transcription."),
@@ -4281,6 +4294,9 @@ var init_schema = __esm(() => {
       window_ms: exports_external.number().int().nonnegative().optional().describe("Sliding-window (ms) for merging consecutive inbound messages from " + "the same sender+topic into ONE Claude turn. Each new message resets " + "the timer; the turn starts once the sender pauses for this long. " + "Catches forwarded bursts, pasted text the Telegram client split " + "into several messages, and mixed text+media forwards. Default 500. " + "Set 0 to disable (every message becomes its own turn). Raise for " + "users who think in multiple short messages; the trade-off is the " + "single-message turn start is delayed by this much (the \uD83D\uDC40 ack still " + "fires immediately, so perceived latency is unchanged)."),
       max_attachments: exports_external.number().int().positive().optional().describe("Maximum number of media attachments carried into ONE coalesced " + "Claude turn. Default 10 — a full Telegram album (media_group caps " + "at 10) or a text+multi-image forwarded burst arrives as a single " + "turn; the agent sees numbered attachment fields (image_path, " + "image_path_2, …). Set 1 to restore the historical " + "single-attachment-per-turn behaviour. Excess attachments beyond " + "the cap spill into the next turn. Each attachment is downloaded, " + "so a high cap on a slow link delays turn start.")
     }).optional().describe("Inbound coalescing — how the gateway groups rapid consecutive messages " + "into a single turn so a forwarded album or split paste doesn't fan out " + "into N separate turns. Cascades from defaults.channels.telegram.coalesce."),
+    litellm_notice: exports_external.object({
+      window_ms: exports_external.number().int().positive().optional().describe("Per-agent cooldown window (ms) for the litellm-local 429 notice. " + "When the agent trips the LiteLLM proxy's OWN tpm_limit/rpm_limit " + "cap (a `litellm-local` classified 429 — see docs/auth.md § " + "LiteLLM-proxy-local 429s), the gateway posts ONE calm notice " + "naming the fleet token limiter, then counts further hits silently " + "for this long; the first notice after the window expires says " + "how many were absorbed. Default 900000 (15 min). Invalid values " + "fall back to the default.")
+    }).optional().describe("Debounce tuning for the litellm-local throttle notice — the calm " + "'fleet token limiter engaged' message posted when the LiteLLM " + "proxy's own rate cap trips (never an Anthropic account limit). " + "Cascades from defaults.channels.telegram.litellm_notice."),
     interrupt: exports_external.object({
       safe_boundary: exports_external.boolean().optional().describe("When true (the default), a `!`-prefix interrupt that arrives while " + "the agent is mid-tool-call is DEFERRED: the SIGINT and the " + "replacement turn wait until the in-flight tool call finishes (a " + "clean boundary) instead of C-c'ing the agent mid-write/mid-bash. If " + "no tool is in flight the interrupt still fires immediately. Bounded " + "by max_wait_ms so a long tool never strands the user. Set false to " + "fire synchronously the moment `!` is received (historical " + "behaviour). Rapid repeated `!` while one is pending coalesce into a " + "single deferred interrupt carrying the latest body."),
       max_wait_ms: exports_external.number().int().positive().optional().describe("Upper bound (ms) the gateway waits for a safe boundary before firing " + "a deferred `!` interrupt anyway. Only consulted when safe_boundary is " + "true. Default 8000. Keep it short — the user explicitly asked to " + "interrupt, so a long in-flight tool shouldn't ghost them; the cap " + "trades a tiny risk of a mid-tool C-c for a guaranteed response.")

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "switchroom",
   "//version": "NOT the release version — source of truth is the git tag, resolved by scripts/build.mjs:resolveVersion() (see CLAUDE.md > Standard release process). This field is stale by design and only the Layer-4 dev/non-tag fallback for build.mjs + src/cli/resolve-version.ts; do NOT bump it expecting a release to pick it up. npm-pack tarball naming needs a real version — do that as an UNCOMMITTED pack-time bump (see release step 6), never a committed one.",
-  "version": "0.18.15",
+  "version": "0.18.18",
   "description": "Run Claude Code 24/7 on your Claude Pro/Max subscription over Telegram. Open-source alternative to OpenClaw and NanoClaw — no API keys.",
   "type": "module",
   "bin": {

package/profiles/_base/start.sh.hbs

@@ -1130,23 +1130,28 @@ x-litellm-tags: agent:$SWITCHROOM_AGENT_NAME,profile:${SWITCHROOM_AGENT_PROFILE:
   unset sr_ll_key sr_ll_ok sr_ll_unreachable
 fi
 
-# --- Session model resolution (durable .session-model + .relaunch-model-intent) ---
+# --- Session model resolution (consume-once .session-model carrier) ---
 #
-# Contract: reference/rfcs/session-model-stickiness.md (#3039 revision). A
-# positively-confirmed `/model X` switch persists as
-# `{{agentDir}}/.session-model` (one-line JSON written by the gateway) and is
-# honored on EVERY boot — deploy, watchdog bounce, raw `docker restart`,
-# host reboot, crash. It is cleared only by:
+# Contract: reference/rfcs/session-model-stickiness.md §0.1 (rev 4, operator
+# decision 2026-07-12 — SESSION-SCOPED, superseding rev 3 keep-by-default). A
+# `/model` override lasts only for the current session:
 #
-#   - explicit user action (`/model default` deletes it live; a fresh
-#     (<10 min) explicit "revert" `.relaunch-model-intent` reverts at boot)
-#   - invalidation: corrupt/malformed file, or the configured yaml `model:`
-#     changed since the switch
+#   - Claude switches apply LIVE in-session (claude's native picker) and write
+#     NO carrier — the explicit `claude --model {{{modelQ}}}` this script execs
+#     reverts them for free on the next boot.
+#   - sr-* / sr→Claude switches and a queued /model persisted at shutdown need
+#     a relaunch to take effect, so the gateway writes `{{agentDir}}/.session-model`
+#     (one-line JSON) IMMEDIATELY before that relaunch. This block APPLIES the
+#     carrier on the single boot that reads it and then DELETES it (consume-once).
+#     Any SUBSEQUENT restart — deploy, `/restart`, `/new`, watchdog recovery,
+#     crash, raw `docker restart`, host reboot — finds no carrier and boots the
+#     configured default. That deletion is the marker distinguishing the
+#     model-apply relaunch from every later restart.
 #
-# Every clearing path writes `.session-model-alert`, which the gateway
-# relays to the operator chat once at boot — an override is never dropped
-# silently. Default (no intent / stale / corrupt intent) is KEEP (operator
-# decision 2026-07-11, superseding the earlier revert-by-default).
+# `/model default` deletes the carrier live. Invalidation paths (corrupt file,
+# configured yaml `model:` changed) also delete + write `.session-model-alert`,
+# which the gateway relays to the operator chat once at boot. The normal apply
+# path is silent here — the gateway already acked the `/model` in chat.
 #
 # NB {{{modelQ}}} is already shell-single-quoted by the scaffold (it renders as
 # a quoted token, e.g. 'claude-sonnet-5'), so it is assigned BARE here — never
@@ -1154,63 +1159,42 @@ fi
 # the value and break `claude --model`.
 _EFFECTIVE_MODEL={{{modelQ}}}
 # Record the RESOLVED configured default (raw, unquoted) every boot, before
-# override resolution. The gateway copies this into the override's
+# override resolution. The gateway copies this into the carrier's
 # `configuredDefaultAtWrite`, so both sides of the invalidation compare below
 # come from the same resolver. Overwrite, not consumed.
 printf '%s\n' "$_EFFECTIVE_MODEL" > "{{agentDir}}/.configured-default-model" 2>/dev/null || true
 
-# Migration shim (one release, RFC §7): a leftover one-shot
-# `.session-model-override` carrier means an OLD gateway wrote it immediately
-# before this very bounce — it is the newest user intent and WINS over any
-# `.session-model` on disk. Convert (overwrite) + consume, and apply THIS
-# boot (the carrier's presence is itself the keep signal).
-_sm_keep=""
+# Rev-4 hygiene (#3184 review LOW-2): remove the files retired with the
+# keep/revert intent subsystem and the crashloop self-heal. Nothing reads them
+# anymore; without this rm they would linger in the bind-mounted state dir
+# forever after rollout. Idempotent — a cheap no-op once clean.
+rm -f "{{agentDir}}/.relaunch-model-intent" "{{agentDir}}/.session-model-boot-attempts" "{{agentDir}}/.session-model-kept-notified"
+
+# Migration shim (one release): a leftover one-shot `.session-model-override`
+# carrier from a pre-consume-once gateway means an OLD gateway wrote it
+# immediately before this very bounce — convert it to `.session-model` so the
+# block below applies + consumes it this boot (same one-shot semantics).
 if [ -f "{{agentDir}}/.session-model-override" ]; then
   _mig="$(tr -d '[:space:]' < "{{agentDir}}/.session-model-override" 2>/dev/null || true)"
   rm -f "{{agentDir}}/.session-model-override"
   if printf '%s' "$_mig" | grep -Eq '^[A-Za-z0-9][]A-Za-z0-9._[/-]{0,99}$'; then
     printf '{"model":"%s","configuredDefaultAtWrite":"%s","ts":%s}\n' "$_mig" "$_EFFECTIVE_MODEL" "$(( $(date +%s) * 1000 ))" > "{{agentDir}}/.session-model" 2>/dev/null || true
-    _sm_keep="1"
-    echo "session-model: migrated legacy one-shot carrier '$_mig' to durable .session-model (applying this boot)" >&2
+    echo "session-model: migrated legacy one-shot carrier '$_mig' to .session-model (applying + consuming this boot)" >&2
   else
     echo "session-model: ignoring malformed legacy .session-model-override (failed shape gate)" >&2
   fi
   unset _mig
 fi
 
-# One-shot intent: consume unconditionally, honor only a fresh "keep".
-# Freshness clock is the EMBEDDED ts (ms), never file mtime — same clock the
-# gateway writes with.
-_sm_reason=""
-_sm_revert=""
-if [ -f "{{agentDir}}/.relaunch-model-intent" ]; then
-  _int_raw="$(cat "{{agentDir}}/.relaunch-model-intent" 2>/dev/null || true)"
-  rm -f "{{agentDir}}/.relaunch-model-intent"
-  _int="$(printf '%s' "$_int_raw" | sed -n 's/.*"intent"[[:space:]]*:[[:space:]]*"\([a-z]*\)".*/\1/p')"
-  _int_ts="$(printf '%s' "$_int_raw" | sed -n 's/.*"ts"[[:space:]]*:[[:space:]]*\([0-9]\{1,\}\).*/\1/p')"
-  _sm_reason="$(printf '%s' "$_int_raw" | sed -n 's/.*"reason"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p')"
-  # #3039: boot default is KEEP. Only a FRESH explicit "revert" intent
-  # (stamped by an explicit user/gateway revert path) clears the override.
-  # A stale or corrupt intent counts as no intent → keep.
-  if [ "$_int" = "revert" ] && [ -n "$_int_ts" ] && [ $(( $(date +%s) * 1000 - _int_ts )) -lt 600000 ]; then
-    _sm_revert="1"
-  fi
-  unset _int_raw _int _int_ts
-fi
-
 if [ -f "{{agentDir}}/.session-model" ]; then
   _smf="$(cat "{{agentDir}}/.session-model" 2>/dev/null || true)"
   _sm_model="$(printf '%s' "$_smf" | sed -n 's/.*"model"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p')"
   _sm_cfg="$(printf '%s' "$_smf" | sed -n 's/.*"configuredDefaultAtWrite"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p')"
-  _sm_ts="$(printf '%s' "$_smf" | sed -n 's/.*"ts"[[:space:]]*:[[:space:]]*\([0-9]\{1,\}\).*/\1/p')"
-  if [ -n "$_sm_revert" ]; then
-    # Explicit fresh revert intent — the ONLY boot path that clears a valid
-    # override by design (#3039). Everything else keeps.
-    rm -f "{{agentDir}}/.session-model" "{{agentDir}}/.session-model-kept-notified"
-    _sm_why="${_sm_reason:-explicit revert intent}"
-    echo "session-model: reverting to configured default '$_EFFECTIVE_MODEL' — $_sm_why (session override '$_sm_model' cleared)" >&2
-    printf 'Session model override `%s` was cleared as requested (%s) — this relaunch booted the configured default `%s`. Re-issue /model %s to switch back.\n' "$_sm_model" "$_sm_why" "$_EFFECTIVE_MODEL" "$_sm_model" > "{{agentDir}}/.session-model-alert" 2>/dev/null || true
-    unset _sm_why
+  # CONSUME-ONCE: delete the carrier now, before any apply/exec. The carrier
+  # governs exactly this one boot; a bad token can therefore crash at most one
+  # boot (the next boot has no carrier and reverts), so no crashloop self-heal
+  # is needed. Every branch below has already removed the file.
+  rm -f "{{agentDir}}/.session-model"
   # Shape gate — kept BYTE-IDENTICAL with MODEL_ARG_RE in
   # telegram-plugin/gateway/model-command.ts. `/` is allowed for
   # OpenRouter-style `sr-vendor/model` ids; it is not a shell metachar inside
@@ -1219,116 +1203,69 @@ if [ -f "{{agentDir}}/.session-model" ]; then
   # extraction above emits one match per matching LINE, and `grep -Eq`
   # passes if ANY line matches — a multiline value must never reach
   # `claude --model` (parity with parseSessionModel's single-string check).
-  elif [ "$(printf '%s' "$_sm_model" | wc -c)" -eq 0 ] || [ "$(printf '%s' "$_sm_model" | wc -l)" -ne 0 ] || ! printf '%s' "$_sm_model" | grep -Eq '^[A-Za-z0-9][]A-Za-z0-9._[/-]{0,99}$'; then
-    # Invalid carrier (#3039): fall back to the configured default AND tell
-    # the operator once — never a silent stderr-only drop.
-    rm -f "{{agentDir}}/.session-model" "{{agentDir}}/.session-model-kept-notified"
+  if [ "$(printf '%s' "$_sm_model" | wc -c)" -eq 0 ] || [ "$(printf '%s' "$_sm_model" | wc -l)" -ne 0 ] || ! printf '%s' "$_sm_model" | grep -Eq '^[A-Za-z0-9][]A-Za-z0-9._[/-]{0,99}$'; then
+    # Invalid carrier: fall back to the configured default AND tell the
+    # operator once — never a silent stderr-only drop.
     echo "session-model: ignoring malformed .session-model (failed shape gate) — using configured default '$_EFFECTIVE_MODEL'" >&2
     printf 'Your saved session model override could not be read (invalid or corrupt), so the agent booted on its configured default `%s`. Re-issue /model <name> if you want a different model.\n' "$_EFFECTIVE_MODEL" > "{{agentDir}}/.session-model-alert" 2>/dev/null || true
   elif [ "$_sm_cfg" != "$_EFFECTIVE_MODEL" ]; then
-    # switchroom.yaml `model:` changed since the switch → the override is
-    # against a default that no longer exists (it may name a retired model).
-    # Invalidate + announce once (#3039 invalid-carrier fallback).
-    rm -f "{{agentDir}}/.session-model" "{{agentDir}}/.session-model-kept-notified"
-    echo "session-model: configured default changed ('$_sm_cfg' → '$_EFFECTIVE_MODEL') — clearing session override '$_sm_model'" >&2
-    printf 'The configured default model changed (`%s` → `%s`), so your session override to `%s` was cleared — the agent booted on the new configured default. Re-issue /model %s if you still want it.\n' "$_sm_cfg" "$_EFFECTIVE_MODEL" "$_sm_model" "$_sm_model" > "{{agentDir}}/.session-model-alert" 2>/dev/null || true
+    # switchroom.yaml `model:` changed between the switch and this apply-boot →
+    # the carrier is against a default that no longer exists. Invalidate +
+    # announce once.
+    echo "session-model: configured default changed ('$_sm_cfg' → '$_EFFECTIVE_MODEL') — dropping session override '$_sm_model'" >&2
+    printf 'The configured default model changed (`%s` → `%s`), so your session override to `%s` was not applied — the agent booted on the new configured default. Re-issue /model %s if you still want it.\n' "$_sm_cfg" "$_EFFECTIVE_MODEL" "$_sm_model" "$_sm_model" > "{{agentDir}}/.session-model-alert" 2>/dev/null || true
+  elif [ "${_sm_model#sr-}" != "$_sm_model" ] && [ -z "$_LITELLM_OK" ]; then
+    # sr-* + LiteLLM unreachable at the apply-boot: booting the override would
+    # 4xx against Anthropic, and consume-once means we can't retain it for a
+    # later relaunch. Boot the configured default and tell the operator to
+    # re-issue once the proxy is back.
+    echo "session-model: LiteLLM proxy unreachable at boot — NOT applying sr-* override '$_sm_model'; booting configured default '$_EFFECTIVE_MODEL' (re-issue /model when the proxy is back)" >&2
+    printf 'LiteLLM proxy was unreachable at boot, so the session model override `%s` was not applied — the agent booted on its configured default `%s`. Re-issue /model %s once the proxy is reachable.\n' "$_sm_model" "$_EFFECTIVE_MODEL" "$_sm_model" > "{{agentDir}}/.session-model-alert" 2>/dev/null || true
   else
-    case "$_sm_model" in
-      sr-*)
-        if [ -z "$_LITELLM_OK" ]; then
-          # sr-* + LiteLLM unreachable: booting the override would 4xx against
-          # Anthropic. Boot the configured default but RETAIN the durable file
-          # — it re-applies on the next keep relaunch once the proxy is back.
-          echo "session-model: LiteLLM proxy unreachable at boot — NOT applying sr-* override '$_sm_model' this boot; booting configured default '$_EFFECTIVE_MODEL' (override retained, re-applies next relaunch)" >&2
-          printf 'LiteLLM proxy was unreachable at boot, so the session model override `%s` was not applied — the agent booted on its configured default `%s`. The override is retained and will re-apply on the next switchroom-managed relaunch once LiteLLM is reachable; /model default drops it.\n' "$_sm_model" "$_EFFECTIVE_MODEL" > "{{agentDir}}/.session-model-alert" 2>/dev/null || true
-        else
-          _EFFECTIVE_MODEL="$_sm_model"
-        fi
-        ;;
-      *)
-        _EFFECTIVE_MODEL="$_sm_model"
-        ;;
-    esac
-    if [ "$_EFFECTIVE_MODEL" = "$_sm_model" ]; then
-      echo "session-model: keeping session override '$_sm_model' across this relaunch${_sm_reason:+ ($_sm_reason)}" >&2
-      # #3042 item 4: notify the chat ONCE per kept value — a watchdog bounce
-      # loop must not storm the operator with identical "kept" alerts. The
-      # sentinel is cleared on every path that clears the override.
-      if [ "$(cat "{{agentDir}}/.session-model-kept-notified" 2>/dev/null || true)" != "$_sm_model" ]; then
-        printf 'Session model override `%s` kept across this relaunch%s. It persists across restarts and deploys; /model default clears it.\n' "$_sm_model" "${_sm_reason:+ ($_sm_reason)}" > "{{agentDir}}/.session-model-alert" 2>/dev/null || true
-        printf '%s\n' "$_sm_model" > "{{agentDir}}/.session-model-kept-notified" 2>/dev/null || true
-      fi
-    fi
+    # Apply the carrier for THIS session. No boot alert — the gateway already
+    # acked the /model switch in chat, and the override reverts on next restart.
+    _EFFECTIVE_MODEL="$_sm_model"
+    echo "session-model: applying session override '$_sm_model' this boot (consume-once — reverts on next restart)" >&2
   fi
-  unset _smf _sm_model _sm_cfg _sm_ts
+  unset _smf _sm_model _sm_cfg
 fi
-unset _sm_keep _sm_reason _sm_revert
 
-# --- Override crashloop self-heal (#3042 review blocker 2b) ---
+# --- Session effort resolution (consume-once .session-effort carrier, #3186) ---
 #
-# Under keep-by-default an invalid-but-shape-valid persisted model (a typo
-# persisted at shutdown, or a confirmed model later retired) would make every
-# boot exec `claude --model <bad>` and die with the gateway dead — recovery
-# would need a host shell. Detect the loop from inside: when an override is
-# ACTIVE, stamp a boot-attempt counter just before exec; a healthy run makes
-# the next boot arrive much later (stamp stale → counter resets), while a
-# fast crashloop re-enters here within seconds (docker backoff caps ≈1 min).
-# Three consecutive fast boots with the same override → clear the carrier,
-# boot the configured default, and alert the chat once.
-_SM_CFG_RECORDED="$(cat "{{agentDir}}/.configured-default-model" 2>/dev/null | tr -d '[:space:]' || true)"
-if [ -n "$_SM_CFG_RECORDED" ] && [ "$_EFFECTIVE_MODEL" != "$_SM_CFG_RECORDED" ] && [ -f "{{agentDir}}/.session-model" ]; then
-  _bl_now="$(date +%s)"
-  _bl_cnt=0
-  _bl_prev=0
-  if [ -f "{{agentDir}}/.session-model-boot-attempts" ]; then
-    read -r _bl_cnt _bl_prev < "{{agentDir}}/.session-model-boot-attempts" 2>/dev/null || true
-  fi
-  case "$_bl_cnt" in (''|*[!0-9]*) _bl_cnt=0;; esac
-  case "$_bl_prev" in (''|*[!0-9]*) _bl_prev=0;; esac
-  if [ $(( _bl_now - _bl_prev )) -lt 150 ]; then _bl_cnt=$(( _bl_cnt + 1 )); else _bl_cnt=1; fi
-  if [ "$_bl_cnt" -ge 3 ]; then
-    echo "session-model: override '$_EFFECTIVE_MODEL' appears to be crashlooping the session ($_bl_cnt fast boots) — clearing it, booting configured default '$_SM_CFG_RECORDED'" >&2
-    printf 'Session model override `%s` was cleared automatically: the agent failed to stay up %s boots in a row with it active (the model may be invalid or retired). Booting the configured default `%s`. Re-issue /model <name> if you want a different model.\n' "$_EFFECTIVE_MODEL" "$_bl_cnt" "$_SM_CFG_RECORDED" >> "{{agentDir}}/.session-model-alert" 2>/dev/null || true
-    rm -f "{{agentDir}}/.session-model" "{{agentDir}}/.session-model-boot-attempts" "{{agentDir}}/.session-model-kept-notified"
-    _EFFECTIVE_MODEL="$_SM_CFG_RECORDED"
-  else
-    printf '%s %s\n' "$_bl_cnt" "$_bl_now" > "{{agentDir}}/.session-model-boot-attempts" 2>/dev/null || true
-  fi
-  unset _bl_now _bl_cnt _bl_prev
-else
-  # No active override this boot — a stale counter must not bite a future one.
-  rm -f "{{agentDir}}/.session-model-boot-attempts"
-fi
-unset _SM_CFG_RECORDED
-
-# --- Session effort resolution (durable .session-effort, #3039) ---
+# The `/effort` sibling of the block above, session-scoped like /model
+# (rev 4). A live `/effort <level>` applies in-session via the applyEffort
+# driver and writes NO carrier — the explicit `--effort <configured>` below
+# reverts it on the next boot. The ONLY boot-applied case is a queued
+# mid-turn `/effort` the gateway persisted at shutdown: this block APPLIES
+# that carrier on the single boot that reads it and then DELETES it
+# (consume-once), so any subsequent restart reverts to the configured
+# `thinking_effort`. Invalidation (corrupt file / configured default
+# changed) appends to `.session-model-alert` so the gateway's boot relay
+# tells the operator once.
 #
-# The `/effort` sibling of the block above. A positively-confirmed `/effort`
-# apply persists `{{agentDir}}/.session-effort` (one-line JSON
-# {"level","configuredDefaultAtWrite","ts"} written by the gateway). It is
-# honored on every boot and cleared only by `/effort default` (live delete)
-# or invalidation here (corrupt file / configured `thinking_effort:` changed)
-# — each invalidation appends to `.session-model-alert` so the gateway's
-# boot relay tells the operator once.
+# NB: the CONFIGURED default resolution is untouched (#3186 constraint) —
+# the fleet `thinking_effort: low` pin (see #1978 /
+# src/config/thinking-effort-risk.ts) resolves exactly as before.
 _EFFECTIVE_EFFORT={{#if thinkingEffort}}'{{thinkingEffort}}'{{else}}''{{/if}}
 if [ -f "{{agentDir}}/.session-effort" ]; then
   _sef="$(cat "{{agentDir}}/.session-effort" 2>/dev/null || true)"
   _se_level="$(printf '%s' "$_sef" | sed -n 's/.*"level"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p')"
   _se_cfg="$(printf '%s' "$_sef" | sed -n 's/.*"configuredDefaultAtWrite"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p')"
+  # CONSUME-ONCE: delete the carrier now, before any apply/exec — it governs
+  # exactly this one boot (parity with the .session-model block above).
+  rm -f "{{agentDir}}/.session-effort"
   # Allowlist gate — kept in sync with EFFORT_LEVELS in
   # telegram-plugin/gateway/effort-command.ts. The level is passed verbatim
   # to `claude --effort`.
   if [ "$(printf '%s' "$_se_level" | wc -l)" -ne 0 ] || ! printf '%s' "$_se_level" | grep -Eq '^(low|medium|high|xhigh|max)$'; then
-    rm -f "{{agentDir}}/.session-effort"
     echo "session-effort: ignoring malformed .session-effort (failed allowlist gate) — using configured default '${_EFFECTIVE_EFFORT:-<unset>}'" >&2
     printf 'Your saved session effort override could not be read (invalid or corrupt), so the agent booted on its configured default effort. Re-issue /effort <level> if you want a different one.\n' >> "{{agentDir}}/.session-model-alert" 2>/dev/null || true
   elif [ "$_se_cfg" != "$_EFFECTIVE_EFFORT" ]; then
-    rm -f "{{agentDir}}/.session-effort"
-    echo "session-effort: configured thinking_effort changed ('$_se_cfg' → '${_EFFECTIVE_EFFORT:-<unset>}') — clearing session override '$_se_level'" >&2
-    printf 'The configured default effort changed (`%s` → `%s`), so your session effort override `%s` was cleared — the agent booted on the new configured default. Re-issue /effort %s if you still want it.\n' "${_se_cfg:-<unset>}" "${_EFFECTIVE_EFFORT:-<unset>}" "$_se_level" "$_se_level" >> "{{agentDir}}/.session-model-alert" 2>/dev/null || true
+    echo "session-effort: configured thinking_effort changed ('$_se_cfg' → '${_EFFECTIVE_EFFORT:-<unset>}') — dropping session override '$_se_level'" >&2
+    printf 'The configured default effort changed (`%s` → `%s`), so your session effort override `%s` was not applied — the agent booted on the new configured default. Re-issue /effort %s if you still want it.\n' "${_se_cfg:-<unset>}" "${_EFFECTIVE_EFFORT:-<unset>}" "$_se_level" "$_se_level" >> "{{agentDir}}/.session-model-alert" 2>/dev/null || true
   else
     _EFFECTIVE_EFFORT="$_se_level"
-    echo "session-effort: keeping session effort override '$_se_level' across this relaunch" >&2
+    echo "session-effort: applying session effort override '$_se_level' this boot (consume-once — reverts on next restart)" >&2
   fi
   unset _sef _se_level _se_cfg
 fi
@@ -1337,6 +1274,11 @@ if [ -n "$_EFFECTIVE_EFFORT" ]; then
 else
   _EFFORT_ARG=""
 fi
+# Record the EFFECTIVE launched effort so the gateway can re-hydrate its
+# in-memory session-effort state after a queued-apply boot, keeping the
+# /effort menu highlight honest. Overwrite (not consumed) — the effort
+# sibling of `.active-session-model` below.
+printf '%s\n' "$_EFFECTIVE_EFFORT" > "{{agentDir}}/.active-session-effort" 2>/dev/null || true
 
 # sr-* passthrough→router repoint — ONE post-resolution gate covering BOTH the
 # /model override path AND the configured-default path (`model: sr-*` in

package/telegram-plugin/bridge/bridge.ts

@@ -21,6 +21,7 @@ import { homedir } from 'os'
 
 import { installPluginLogger } from '../plugin-logger.js'
 import { startSessionTail, type SessionEvent, type SessionTailHandle } from '../session-tail.js'
+import { truncateDetailPreservingRequestId } from '../raw-error-scrub.js'
 import {
   startPtyTail,
   V1ToolActivityExtractor,
@@ -851,7 +852,12 @@ if (sessionTailEnabled) {
             type: 'operator_event',
             kind: ev.kind,
             agent: AGENT_NAME,
-            detail: ev.detail.slice(0, 1000),
+            // Preserve the Anthropic request_id through the 1000-char cap: it
+            // sits in the trailing byte-blob (often past char 1000), and it is
+            // the reliable EXACT key for the cross-surface dedup gate. A naive
+            // slice would drop it → the gate degrades to the coarse per-kind key
+            // and wrongly collapses two distinct same-kind errors within 60s.
+            detail: truncateDetailPreservingRequestId(ev.detail, 1000),
             chatId: '',
           })
         } catch (err) {

package/telegram-plugin/dist/bridge/bridge.js

@@ -23323,6 +23323,10 @@ function projectTranscriptLine(line) {
     const content = message?.content;
     if (!Array.isArray(content))
       return [];
+    if (obj.isApiErrorMessage === true) {
+      const mainModel2 = message?.model;
+      return typeof mainModel2 === "string" && !isModelSentinel(mainModel2) ? [{ kind: "model", model: mainModel2 }] : [];
+    }
     const events = [];
     const mainModel = message?.model;
     if (typeof mainModel === "string" && !isModelSentinel(mainModel)) {
@@ -23952,6 +23956,27 @@ function startSessionTail(config2) {
   };
 }
 
+// raw-error-scrub.ts
+function extractRequestId(raw) {
+  if (typeof raw !== "string" || raw.length === 0)
+    return;
+  const m = raw.match(/["']request[_-]?id["']\s*:\s*["']([A-Za-z0-9._-]+)["']/i) ?? raw.match(/\brequest[_-]?id[=:]\s*([A-Za-z0-9._-]+)/i);
+  return m ? m[1] : undefined;
+}
+function truncateDetailPreservingRequestId(detail, max) {
+  if (typeof detail !== "string")
+    return "";
+  if (detail.length <= max)
+    return detail;
+  const rid = extractRequestId(detail);
+  const head = detail.slice(0, max);
+  if (rid == null || head.includes(rid))
+    return head;
+  const suffix = ` request_id=${rid}`;
+  const headBudget = Math.max(0, max - suffix.length);
+  return `${detail.slice(0, headBudget)}${suffix}`;
+}
+
 // pty-tail.ts
 var import_headless = __toESM(require_xterm_headless(), 1);
 import { existsSync as existsSync4, statSync as statSync4, watch as watch2, openSync as openSync2, readSync as readSync2, closeSync as closeSync2 } from "fs";
@@ -25475,7 +25500,7 @@ if (sessionTailEnabled) {
             type: "operator_event",
             kind: ev.kind,
             agent: AGENT_NAME,
-            detail: ev.detail.slice(0, 1000),
+            detail: truncateDetailPreservingRequestId(ev.detail, 1000),
             chatId: ""
           });
         } catch (err) {