switchroom 0.18.32 → 0.19.0

package/telegram-plugin/gateway/boot-card.ts

@@ -68,6 +68,7 @@ import {
   type ConfigDiff,
 } from './config-snapshot.js'
 import { join } from 'path'
+import { readFileSync, statSync } from 'fs'
 import { bootCardChatKey, loadBootCardMsgId, saveBootCardMsgId } from './boot-card-msgid.js'
 import { nonEssentialSendSuppression } from '../flood-circuit-breaker.js'
 import { loadConfig as _loadSwitchroomConfig } from '../../src/config/loader.js'
@@ -278,6 +279,131 @@ const REASON_LABEL: Record<RestartReason, string> = {
   fresh:    'fresh start',
 }
 
+// ─── Routing-mode row (.routing-mode observability) ─────────────────────────
+
+/**
+ * Parsed `.routing-mode` state file — one overwrite-per-boot line written by
+ * start.sh immediately before `exec claude`:
+ *
+ *   mode=<router-root|passthrough|direct-oauth> base=<url> model=<effective>
+ *   litellm_ok=<0|1> declared=<mode> ts=<iso>
+ *
+ * `prevBoot` marks a RENDER-TIMING hazard, not file corruption: the gateway
+ * (outer pass) can render the boot card BEFORE the inner pass writes this
+ * boot's line (the inner LiteLLM probe can hold the write back for minutes on
+ * a degraded proxy). When the file's mtime predates this gateway process
+ * start, the value belongs to the PREVIOUS boot and must be labeled as such —
+ * never shown as current.
+ */
+export interface RoutingModeInfo {
+  /** Landed routing mode this boot: router-root | passthrough | direct-oauth. */
+  mode: string
+  /** Declared (apply-time) routing intent, when present in the file. */
+  declared?: string
+  /** Effective launched model recorded alongside the mode. */
+  model?: string
+  /** LiteLLM liveliness at boot ("1" ok / "0" not confirmed). */
+  litellmOk?: string
+  /** True when the file predates this gateway boot (stale — prev boot's value). */
+  prevBoot: boolean
+}
+
+/**
+ * Epoch-ms this CONTAINER booted, derived from PID 1's start time
+ * (`/proc/stat` btime + `/proc/1/stat` field 22 in USER_HZ ticks). This is the
+ * correct staleness threshold for `.routing-mode`: start.sh writes that file
+ * ONCE per container boot, before exec-ing claude/the gateway. Keying staleness
+ * on the gateway PROCESS start (`Date.now() - process.uptime()*1000`) mislabels
+ * a gateway-only respawn — supervisor restarts the gateway process while the
+ * container (and its still-current `.routing-mode`) stays up — as "(prev boot)".
+ * Container boot time is stable across such respawns (LOW-1). Returns null when
+ * /proc is unavailable or unparseable (non-Linux, tests), so callers fall back
+ * to the process-start estimate.
+ */
+export function containerBootStartMs(
+  fsImpl: { readFileSync: typeof readFileSync } = { readFileSync },
+): number | null {
+  try {
+    const btimeLine = fsImpl
+      .readFileSync('/proc/stat', 'utf-8')
+      .split('\n')
+      .find((l) => l.startsWith('btime '))
+    if (!btimeLine) return null
+    const btimeSec = Number(btimeLine.split(/\s+/)[1])
+    if (!Number.isFinite(btimeSec)) return null
+    // /proc/1/stat field 22 (starttime) is in clock ticks since system boot.
+    // Fields 2 (comm) may contain spaces/parens, so split on the last ')'.
+    const stat = fsImpl.readFileSync('/proc/1/stat', 'utf-8')
+    const afterComm = stat.slice(stat.lastIndexOf(')') + 2)
+    const fields = afterComm.split(/\s+/)
+    // starttime is field 22 overall → index 19 of the post-comm slice
+    // (field 1 pid + field 2 comm consumed; field 3 becomes index 0).
+    const startTicks = Number(fields[19])
+    if (!Number.isFinite(startTicks)) return null
+    const HZ = 100 // USER_HZ on effectively all Linux; sysconf unavailable in node
+    return (btimeSec + startTicks / HZ) * 1000
+  } catch {
+    return null
+  }
+}
+
+/**
+ * Read + parse `<agentDir>/.routing-mode`. Returns null when the file is
+ * absent, unreadable, or carries no `mode=` field (tolerant by design — the
+ * boot card must render fine on fleets that pre-date the state file).
+ *
+ * `bootStartMs` is the epoch-ms this CONTAINER booted (see
+ * `containerBootStartMs`); a file mtime strictly older than it belongs to a
+ * previous container boot and is flagged `prevBoot` so the renderer can label
+ * the row instead of presenting stale data as current. Keyed on container boot
+ * (not gateway process start) so a gateway-only respawn does not mislabel the
+ * still-current file.
+ */
+export function readRoutingMode(
+  agentDir: string,
+  bootStartMs: number,
+  fsImpl: { readFileSync: typeof readFileSync; statSync: typeof statSync } = { readFileSync, statSync },
+): RoutingModeInfo | null {
+  const path = join(agentDir, '.routing-mode')
+  try {
+    const raw = fsImpl.readFileSync(path, 'utf-8')
+    const line = raw.split('\n')[0] ?? ''
+    const field = (key: string): string | undefined => {
+      const m = line.match(new RegExp(`(?:^|\\s)${key}=([^\\s]+)`))
+      return m ? m[1] : undefined
+    }
+    const mode = field('mode')
+    if (!mode) return null
+    const mtimeMs = fsImpl.statSync(path).mtimeMs
+    return {
+      mode,
+      declared: field('declared'),
+      model: field('model'),
+      litellmOk: field('litellm_ok'),
+      prevBoot: mtimeMs < bootStartMs,
+    }
+  } catch {
+    return null
+  }
+}
+
+/**
+ * Render the routing row for the boot card. Divergence (landed ≠ declared)
+ * gets the warning dot; a converged mode renders as a dim informational row —
+ * deliberately always visible (2026-07-17 incident: both divergence cases
+ * were SILENT; the row is the standing observability surface).
+ */
+export function renderRoutingRow(r: RoutingModeInfo): string {
+  const diverged = r.declared != null && r.declared !== '' && r.mode !== r.declared
+  const dot = diverged ? DOT.degraded : '🔀'
+  const parts: string[] = [escapeMarkdown(r.mode)]
+  if (diverged) parts.push(`≠ declared ${escapeMarkdown(r.declared as string)}`)
+  if (r.model) parts.push(`\`${r.model}\``)
+  if (r.litellmOk != null) parts.push(r.litellmOk === '1' ? 'litellm ok' : 'litellm unconfirmed')
+  const suffix = r.prevBoot ? ' _(prev boot)_' : ''
+  return `${dot} **Routing**  ${parts.join(' · ')}${suffix}`
+}
+
 export interface RenderBootCardOpts {
   agentName: string
   /** Lowercase slug used for systemd unit names. Falls back to
@@ -338,6 +464,14 @@ export interface RenderBootCardOpts {
    * persisted snapshot from the prior boot. See `config-snapshot.ts`.
    */
   configChanges?: ConfigDiff
+  /**
+   * Parsed `.routing-mode` state (see `readRoutingMode`). When present, a
+   * "Routing" row is rendered — always visible, warning-dotted on
+   * landed≠declared divergence, suffixed "(prev boot)" when the file
+   * predates this gateway boot. Absent/null = row omitted entirely
+   * (fleets pre-dating the state file, unreadable file).
+   */
+  routing?: RoutingModeInfo | null
 }
 
 /**
@@ -456,8 +590,13 @@ export function renderBootCard(opts: RenderBootCardOpts): string {
     }
   }
 
+  // Routing row (.routing-mode observability) — rendered whenever the state
+  // file was readable. Sits with the probe rows so divergence reads like any
+  // other degraded surface.
+  const routingRows: string[] = opts.routing ? [renderRoutingRow(opts.routing)] : []
+
   const sections: string[] = [ack]
-  if (degradedRows.length > 0) sections.push('', ...degradedRows)
+  if (degradedRows.length > 0 || routingRows.length > 0) sections.push('', ...degradedRows, ...routingRows)
   if (accountRows.length > 0) sections.push('', ...accountRows)
   if (opts.updateOutcomeLine) {
     // PR C: each line of the update-outcome blob is its own row in the
@@ -616,6 +755,15 @@ export interface RunProbesOpts {
   floodStatePath?: string
   /** Injectable clock for the flood-wait check (tests). Defaults to Date.now. */
   nowMs?: () => number
+  /**
+   * Epoch-ms this gateway boot started — the staleness threshold for the
+   * `.routing-mode` row (a file mtime older than this is the PREVIOUS boot's
+   * value and is labeled, never shown as current). Defaults to the CONTAINER
+   * boot time (`containerBootStartMs`, stable across gateway-only respawns),
+   * falling back to the gateway process start when /proc is unavailable. Test
+   * override.
+   */
+  routingBootStartMs?: number
 }
 
 /** Run all six probes concurrently with their own per-probe timeouts.
@@ -879,6 +1027,23 @@ export async function startBootCard(
           }
         }
 
+        // Routing-mode row (.routing-mode observability). Read at settle
+        // time — by then a healthy inner pass has usually written this
+        // boot's line; a degraded LiteLLM probe can still delay the write,
+        // in which case the file mtime predates this gateway boot and the
+        // reader flags it prevBoot (rendered "(prev boot)", never as
+        // current). Absent/unreadable file → row omitted.
+        const routingBootStartMs =
+          opts.routingBootStartMs ??
+          containerBootStartMs() ??
+          Date.now() - process.uptime() * 1000
+        let routing: RoutingModeInfo | null = null
+        try {
+          routing = readRoutingMode(opts.agentDir, routingBootStartMs)
+        } catch {
+          routing = null
+        }
+
         // Render with current probe state and edit if anything changed.
         let currentText = renderBootCard({
           agentName: opts.agentName,
@@ -892,6 +1057,7 @@ export async function startBootCard(
           ...(snoozeRows.length > 0 ? { snoozeRows } : {}),
           ...(opts.updateOutcomeLine ? { updateOutcomeLine: opts.updateOutcomeLine } : {}),
           ...(configChanges.length > 0 ? { configChanges } : {}),
+          ...(routing ? { routing } : {}),
         })
 
         if (currentText !== ackText) {
@@ -947,6 +1113,8 @@ export async function startBootCard(
             // (computed once in Phase 1). Pass them through unchanged so
             // the live-agent-status edits keep the config-diff rows.
             ...(configChanges.length > 0 ? { configChanges } : {}),
+            // Routing row is stable for the card lifetime (read once above).
+            ...(routing ? { routing } : {}),
           })
 
           if (updatedText === currentText) continue

package/telegram-plugin/gateway/bot-commands-model-effort.ts

@@ -0,0 +1,209 @@
+/**
+ * `/model` and `/effort` slash commands extracted verbatim from gateway.ts
+ * (switchroom#2996 P6 bot.command drain).
+ *
+ * Pure-logic helpers (parse/plan/menu/handle from model-command.ts,
+ * effort-command.ts, pending-session-command.ts) are imported directly;
+ * every gateway-local surface (busy resolver, deps factories, reply/queue
+ * plumbing, history recording) is injected via `deps` (repo factory-deps
+ * precedent, same shape as registerOpsInfoCommands). `bot` is injected so
+ * grammy registration order is preserved at the original call site.
+ */
+
+import type { Bot, Context, InlineKeyboard } from 'grammy'
+import { richMessage } from '../rich-send.js'
+import { hardenCardBreaks } from '../format.js'
+import { escapeHtmlForTg } from '../shared/bot-runtime.js'
+import {
+  parseModelCommand,
+  planModelCommand,
+  buildModelMenu,
+  handleModelCommand,
+  modelCommandReceiptLine,
+  type ModelMenuDeps,
+  type ModelCommandDeps,
+  type ModelMenuReply,
+  type ParsedModelCommand,
+} from './model-command.js'
+import {
+  parseEffortCommand,
+  handleEffortCommand,
+  buildEffortMenu,
+  type EffortCommandDeps,
+  type EffortMenuReply,
+} from './effort-command.js'
+import {
+  ackText as pendingCmdAckText,
+  type PendingSessionCommand,
+} from './pending-session-command.js'
+
+export interface ModelEffortCommandDeps {
+  isAuthorizedSender: (ctx: Context) => boolean
+  getMyAgentName: () => string
+  resolveThreadId: (chat_id: string, explicit?: string | number | null) => number | undefined
+  /** Stale-aware busy resolver (#3262) shared by /model and /effort. */
+  resolveModelEffortBusy: () => { currentTurnActive: boolean; turnInFlight: boolean }
+  historyEnabled: boolean
+  recordInbound: (args: {
+    chat_id: string
+    thread_id: number | null
+    message_id: number
+    user: string | null
+    user_id: string | null
+    ts: number
+    text: string
+  }) => void
+  buildModelDeps: (restartCtx?: { chatId: string; threadId: number | undefined }) => ModelMenuDeps & ModelCommandDeps
+  buildEffortDeps: () => EffortCommandDeps
+  modelMenuReplyMarkup: (reply: ModelMenuReply) => InlineKeyboard | undefined
+  effortMenuReplyMarkup: (reply: EffortMenuReply) => InlineKeyboard | undefined
+  enqueueSessionCommand: (cmd: PendingSessionCommand) => void
+  switchroomReply: (
+    ctx: Context,
+    text: string,
+    options?: { html?: boolean; reply_markup?: InlineKeyboard },
+  ) => Promise<void>
+  modelMenuEnabled: () => boolean
+  /** stderr log sink. */
+  log: (line: string) => void
+}
+
+export function registerModelEffortCommands(bot: Bot, deps: ModelEffortCommandDeps): void {
+  const {
+    isAuthorizedSender,
+    getMyAgentName,
+    resolveThreadId,
+    resolveModelEffortBusy,
+    historyEnabled,
+    recordInbound,
+    buildModelDeps,
+    buildEffortDeps,
+    modelMenuReplyMarkup,
+    effortMenuReplyMarkup,
+    enqueueSessionCommand,
+    switchroomReply,
+    modelMenuEnabled,
+    log,
+  } = deps
+
+  bot.command('model', async ctx => {
+    if (!isAuthorizedSender(ctx)) return
+    const text = ctx.message?.text ?? ctx.channelPost?.text ?? ''
+    const parsed: ParsedModelCommand = parseModelCommand(text) ?? { kind: 'show' as const }
+    const chatId = String(ctx.chat!.id)
+    const threadId = resolveThreadId(chatId, ctx.message?.message_thread_id)
+    // #3177 — durable receipt FIRST. A typed /model must NEVER be invisible: even
+    // if every downstream reply is shed/dropped, or the session is in a
+    // phantom-idle window (turn atom cleared while claude is still busy), the
+    // command leaves a greppable log line + a history row before any branch. This
+    // is the fix for the finn 2026-07-12 zero-trace swallow (no log, no reply, no
+    // ack, no deferred apply). `busyNow` folds BOTH busy signals (turn atom AND
+    // the authoritative delivery-machine/approval gate) — but a STALE atom or a
+    // wedged approval older than the hard TTL is discounted as idle (#3262), so a
+    // phantom "active turn" on an idle session no longer blocks the switch. Resolve
+    // once (it may clear a dangling atom) and reuse for both the receipt log and
+    // the routing disposition.
+    const modelBusy = resolveModelEffortBusy()
+    const busyNow = modelBusy.currentTurnActive || modelBusy.turnInFlight
+    log(modelCommandReceiptLine(getMyAgentName(), parsed, busyNow) + '\n')
+    if (historyEnabled && ctx.message?.message_id != null) {
+      try {
+        recordInbound({
+          chat_id: chatId,
+          thread_id: threadId ?? null,
+          message_id: ctx.message.message_id,
+          user: ctx.from?.username ?? (ctx.from?.id != null ? String(ctx.from.id) : null),
+          user_id: ctx.from?.id != null ? String(ctx.from.id) : null,
+          ts: ctx.message.date ?? Math.floor(Date.now() / 1000),
+          text,
+        })
+      } catch (err) {
+        log(`telegram gateway: /model recordInbound failed: ${(err as Error)?.message ?? String(err)}\n`)
+      }
+    }
+    const cmdDeps = buildModelDeps({ chatId, threadId })
+    // Route on a pure disposition (#3177) that folds BOTH busy signals so a
+    // session busy by EITHER measure ack+queues instead of silently injecting
+    // into a busy pane. Every branch below produces a visible action.
+    const disposition = planModelCommand(parsed, {
+      currentTurnActive: modelBusy.currentTurnActive,
+      turnInFlight: modelBusy.turnInFlight,
+      menuEnabled: modelMenuEnabled(),
+    })
+    if (disposition.kind === 'menu') {
+      const menu = await buildModelMenu(cmdDeps)
+      await switchroomReply(ctx, menu.text, { html: true, reply_markup: modelMenuReplyMarkup(menu) })
+      return
+    }
+    // Mid-turn (by either busy signal): instead of dead-ending ("Try again in a
+    // moment") or silently injecting into a busy pane, ACK + QUEUE + apply-on-idle
+    // + confirm (#3017/#3177). The typed set path either injects into claude's
+    // input box or triggers a carrier restart — both unsafe while busy.
+    if (disposition.kind === 'queue') {
+      const target = disposition.target
+      const sent = await ctx.replyWithRichMessage(
+        richMessage(hardenCardBreaks(pendingCmdAckText('model', target, escapeHtmlForTg))),
+        threadId != null ? { message_thread_id: threadId } : {},
+      )
+      enqueueSessionCommand({
+        kind: 'model',
+        origin: 'typed',
+        arg: target,
+        targetLabel: target,
+        chatId,
+        threadId,
+        ackChatId: chatId,
+        ackMessageId: (sent as { message_id: number }).message_id,
+        requestedAt: Date.now(),
+      })
+      return
+    }
+    // Rev 5: the handler relaunches through the carrier and owns every side effect
+    // (override write, carrier, premium-recovery clear). There is no post-hoc
+    // recording — /status is reconciled at boot from `.active-session-model`, so
+    // an unapplied switch can never be optimistically recorded here.
+    const reply = await handleModelCommand(parsed, cmdDeps)
+    await switchroomReply(ctx, reply.text, { html: reply.html })
+  })
+  bot.command('effort', async ctx => {
+    if (!isAuthorizedSender(ctx)) return
+    const text = ctx.message?.text ?? ctx.channelPost?.text ?? ''
+    const parsed = parseEffortCommand(text) ?? { kind: 'show' as const }
+    const cmdDeps = buildEffortDeps()
+    if (parsed.kind === 'show') {
+      const menu = buildEffortMenu(cmdDeps)
+      await switchroomReply(ctx, menu.text, { html: true, reply_markup: effortMenuReplyMarkup(menu) })
+      return
+    }
+    // Mid-turn: ACK + QUEUE + apply-on-idle + confirm (#3017) — parity with
+    // /model. `applyEffort` mid-turn silently maybe-failed ("couldn't confirm it
+    // applied") before this gate existed. Use the SAME stale-aware busy resolver
+    // as /model (#3262) so a dangling turn atom older than the hard TTL is
+    // discounted as idle and the switch applies instead of queuing forever on an
+    // idle session.
+    const effortBusy = resolveModelEffortBusy()
+    if ((parsed.kind === 'set' || parsed.kind === 'default') && effortBusy.currentTurnActive) {
+      const requestedLevel = parsed.kind === 'set' ? parsed.level : 'default'
+      const chatId = String(ctx.chat!.id)
+      const threadId = resolveThreadId(chatId, ctx.message?.message_thread_id)
+      const sent = await ctx.replyWithRichMessage(
+        richMessage(hardenCardBreaks(pendingCmdAckText('effort', requestedLevel, escapeHtmlForTg))),
+        threadId != null ? { message_thread_id: threadId } : {},
+      )
+      enqueueSessionCommand({
+        kind: 'effort',
+        origin: 'typed',
+        arg: requestedLevel,
+        targetLabel: requestedLevel,
+        chatId,
+        threadId,
+        ackChatId: chatId,
+        ackMessageId: (sent as { message_id: number }).message_id,
+        requestedAt: Date.now(),
+      })
+      return
+    }
+    const reply = await handleEffortCommand(parsed, cmdDeps)
+    await switchroomReply(ctx, reply.text, { html: reply.html })
+  })
+}

package/telegram-plugin/gateway/bot-commands-start-info.ts

@@ -0,0 +1,108 @@
+/**
+ * Basic info slash commands extracted verbatim from gateway.ts
+ * (switchroom#2996 P6 bot.command drain): `/start`, `/help`, `/status`,
+ * `/agents`.
+ *
+ * Pure read-only info surfaces (welcome/help text, pairing status, agent
+ * list) with no send-path or turn-lifecycle coupling. Every gateway-local
+ * helper they close over is passed in via `deps` (repo factory-deps
+ * precedent, same shape as registerOpsInfoCommands) so the module never
+ * back-references the gateway singleton. `bot` is injected so grammy
+ * registration order is preserved at the original call site.
+ */
+
+import type { Bot, Context } from 'grammy'
+import { richMessage } from '../rich-send.js'
+import {
+  startText as buildStartText,
+  helpText as buildHelpText,
+  statusPairedText as buildStatusPairedText,
+  statusPendingText as buildStatusPendingText,
+  statusUnpairedText as buildStatusUnpairedText,
+  type AgentMetadata,
+} from '../welcome-text.js'
+import { escapeHtmlForTg } from '../shared/bot-runtime.js'
+import type { Access } from './gateway.js'
+
+export interface StartInfoCommandDeps {
+  /** #894 backport gate: silent drop on disabled / non-allowlisted senders. */
+  dmCommandGate: (ctx: Context) => { access: Access; senderId: string } | null
+  isAuthorizedSender: (ctx: Context) => boolean
+  getMyAgentName: () => string
+  getCommandArgs: (ctx: Context) => string
+  hasDemoFlag: (args: string) => boolean
+  buildAgentMetadata: (agentName: string) => Promise<AgentMetadata>
+  runSwitchroomCommandFormatted: (
+    ctx: Context,
+    args: string[],
+    label: string,
+    formatter: () => string | null,
+  ) => Promise<void>
+  switchroomExecJson: <T = unknown>(args: string[]) => T | null
+  statusIcon: (status: string) => string
+}
+
+export function registerStartInfoCommands(bot: Bot, deps: StartInfoCommandDeps): void {
+  const {
+    dmCommandGate,
+    isAuthorizedSender,
+    getMyAgentName,
+    getCommandArgs,
+    hasDemoFlag,
+    buildAgentMetadata,
+    runSwitchroomCommandFormatted,
+    switchroomExecJson,
+    statusIcon,
+  } = deps
+
+  bot.command('start', async ctx => {
+    // dmCommandGate (#894 backport): silent drop on disabled or
+    // non-allowlisted senders so the bot doesn't leak its existence.
+    const gated = dmCommandGate(ctx)
+    if (!gated) return
+    const disabled = gated.access.dmPolicy === 'disabled'
+    await ctx.replyWithRichMessage(richMessage(buildStartText(getMyAgentName(), disabled)))
+  })
+  bot.command('help', async ctx => {
+    if (!dmCommandGate(ctx)) return
+    await ctx.replyWithRichMessage(richMessage(buildHelpText(getMyAgentName())))
+  })
+  bot.command('status', async ctx => {
+    // dmCommandGate (#894 backport) drops disabled / non-allowlisted in
+    // allowlist mode. Pairing-mode users still fall through to either
+    // the pending-code branch or the unpaired branch.
+    const gated = dmCommandGate(ctx)
+    if (!gated) return
+    const { access, senderId } = gated
+    const from = ctx.from!
+    if (access.allowFrom.includes(senderId)) {
+      const demo = hasDemoFlag(getCommandArgs(ctx))
+      const userTag = from.username ? `@${from.username}` : senderId
+      const meta = await buildAgentMetadata(getMyAgentName())
+      await ctx.replyWithRichMessage(richMessage(buildStatusPairedText({ user: userTag, meta, demo })))
+      return
+    }
+    for (const [code, p] of Object.entries(access.pending)) {
+      if (p.senderId === senderId) {
+        await ctx.replyWithRichMessage(richMessage(buildStatusPendingText(code)))
+        return
+      }
+    }
+    await ctx.reply(buildStatusUnpairedText())
+  })
+  bot.command('agents', async ctx => {
+    if (!isAuthorizedSender(ctx)) return
+    await runSwitchroomCommandFormatted(ctx, ['agent', 'list'], 'agent list', () => {
+      type AgentListResp = { agents: Array<{ name: string; status: string; uptime: string; template: string; topic_name: string; topic_emoji?: string }> }
+      const data = switchroomExecJson<AgentListResp>(['agent', 'list'])
+      if (!data) return null
+      if (data.agents.length === 0) return '_No agents defined_'
+      const lines = ['**Agents**']
+      for (const a of data.agents) {
+        lines.push(`${statusIcon(a.status)} **${escapeHtmlForTg(a.name)}** · ${escapeHtmlForTg(a.status)} · ${escapeHtmlForTg(a.uptime)}`)
+        lines.push(`    _${escapeHtmlForTg(a.template)} → ${escapeHtmlForTg(a.topic_name)}${a.topic_emoji ? ' ' + a.topic_emoji : ''}_`)
+      }
+      return lines.join('\n')
+    })
+  })
+}