switchroom 0.18.6 → 0.18.8

package/telegram-plugin/gateway/session-model-source.ts

@@ -0,0 +1,73 @@
+/**
+ * Freshness-aware source of truth for the /status session model.
+ *
+ * Two independent signals report what model the live session is running:
+ *
+ *   - the TRANSCRIPT: `message.model` on each assistant line (session-tail's
+ *     `model` event) — ground truth for the model that served the LAST API
+ *     call, but only advances when a new assistant line lands;
+ *   - the OVERRIDE: the in-memory `/model` switch record (#2982) — set the
+ *     moment a switch is positively confirmed, ahead of any assistant line.
+ *
+ * Neither is unconditionally right. Preferring the transcript regresses the
+ * idle-after-switch window (#2982's core fix): a native `/model` inject while
+ * idle sets the override to the NEW model, but the transcript still holds the
+ * OLD one until the next assistant line — /status would lie. Preferring the
+ * override goes stale the other way (a relaunch carrier that never applied).
+ *
+ * The invariant is "prefer the NEWER observation": every write from either
+ * source is stamped with a shared monotonic sequence, and `resolve()` returns
+ * whichever was observed last. A fresh assistant line always reclaims the
+ * transcript as the source; a confirmed switch always beats an older
+ * transcript line. Pinned by tests/session-model-source.test.ts.
+ */
+
+export interface SessionModelResolution {
+  /** The raw value from the winning source. Transcript entries are resolved
+   *  model ids (`claude-opus-4-8`); override entries may be friendly labels
+   *  ("Opus 4.8") or sr-* ids depending on the /model path that set them. */
+  model: string
+  source: 'transcript' | 'override'
+}
+
+export interface SessionModelSource {
+  /** Record a transcript observation (an assistant line's `message.model`,
+   *  already sentinel-filtered by the session-tail projection). */
+  noteTranscriptModel(model: string): void
+  /** Record an override set (a positively-confirmed /model switch), or clear
+   *  it with null. Setting stamps a fresh sequence, so the override wins over
+   *  every EARLIER transcript observation until a new assistant line lands. */
+  setOverride(model: string | null): void
+  /** Current override value (the #2982 in-memory record), independent of
+   *  freshness — for callers that need the override itself (e.g. the model
+   *  menu's "session" marker), not the /status resolution. */
+  getOverride(): string | null
+  /** The freshest observation across both sources, or null when neither has
+   *  reported yet. */
+  resolve(): SessionModelResolution | null
+}
+
+export function createSessionModelSource(): SessionModelSource {
+  let seq = 0
+  let transcript: { model: string; seq: number } | null = null
+  let override: { model: string; seq: number } | null = null
+  return {
+    noteTranscriptModel(model: string): void {
+      transcript = { model, seq: ++seq }
+    },
+    setOverride(model: string | null): void {
+      override = model == null ? null : { model, seq: ++seq }
+    },
+    getOverride(): string | null {
+      return override?.model ?? null
+    },
+    resolve(): SessionModelResolution | null {
+      if (transcript == null && override == null) return null
+      if (override == null) return { model: transcript!.model, source: 'transcript' }
+      if (transcript == null || transcript.seq < override.seq) {
+        return { model: override.model, source: 'override' }
+      }
+      return { model: transcript.model, source: 'transcript' }
+    },
+  }
+}

package/telegram-plugin/gateway/status-pin-store.ts

@@ -12,10 +12,13 @@
  * a dead session lingers.
  *
  * This makes cleanup self-contained across restart: every pin claim persists
- * here; on boot the gateway loads the persisted set and unpins each entry
- * (a status pin from a PRIOR session is stale by definition — the turn it
- * represented is over or crashed), then clears the store. It does NOT re-adopt
- * or re-pin — it only cleans up.
+ * here; on boot the gateway loads the persisted set and unpins each
+ * work-scoped entry (a status pin from a PRIOR session is stale by definition
+ * — the turn it represented is over or crashed), dropping rows only after a
+ * successful unpin (failed ones are retained with an attempt counter for a
+ * next-boot retry — see runStatusPinBootCleanup). Time-scoped `tool:` rows
+ * (the `pin_message` MCP tool, #3001) survive boots until their `expiresAt`.
+ * It does NOT re-adopt or re-pin — it only cleans up.
  *
  * Shape choice — SNAPSHOT, not append-log, mirroring obligation-store.ts. The
  * claim set is tiny and bounded (one entry per in-flight pinned key, normally
@@ -55,8 +58,27 @@ export interface PersistedStatusPin {
   messageId: number
   /** True while the pin API call is in-flight / unconfirmed (see above). */
   pending?: boolean
+  /** Wall-clock ms after which this pin is stale and boot cleanup unpins it.
+   *  Rows WITHOUT this field are work-scoped (fg:/wk:/banner:) — stale the
+   *  moment their owning session dies, so boot cleanup unpins them
+   *  unconditionally. Rows WITH it (the `tool:` pins written by the
+   *  `pin_message` MCP tool, #3001) represent deliberate agent pins that have
+   *  no "work finished" event: they SURVIVE restarts and are only swept once
+   *  expired. */
+  expiresAt?: number
+  /** Boot-cleanup unpin retry counter (#3001). Incremented each boot the
+   *  unpin fails (flood-wait exhausted / transient 5xx); the row is retained
+   *  for retry until BOOT_UNPIN_MAX_ATTEMPTS, then forfeited. Absent = 0. */
+  attempts?: number
 }
 
+/** How many boots may retry a failing boot-cleanup unpin before the row is
+ *  forfeited. Unpins are idempotent (unpinning an already-unpinned or deleted
+ *  message no-ops), so retrying across boots is safe; the cap only bounds a
+ *  permanently-undeliverable unpin (chat gone, bot removed) so it cannot
+ *  re-fail on every boot forever. */
+export const BOOT_UNPIN_MAX_ATTEMPTS = 5
+
 /** Envelope version. v1 had no `pending` field; a v1 row loads as a confirmed
  *  pin (pending undefined). v2 adds the optional `pending` flag. Both load
  *  fail-open — an unknown/newer version yields []. */
@@ -74,7 +96,9 @@ function isPinRow(x: unknown): x is PersistedStatusPin {
     typeof o.chatId === 'string' &&
     o.chatId.length > 0 &&
     typeof o.messageId === 'number' &&
-    (o.pending === undefined || typeof o.pending === 'boolean')
+    (o.pending === undefined || typeof o.pending === 'boolean') &&
+    (o.expiresAt === undefined || typeof o.expiresAt === 'number') &&
+    (o.attempts === undefined || typeof o.attempts === 'number')
   )
 }
 
@@ -170,16 +194,27 @@ export function pinnedMessageIsOurs(
  * the ordering + best-effort contract is unit-testable against the REAL code
  * (the gateway's thin wrapper just binds the live fs / unpin api / logger).
  *
- * Any pin persisted by a PRIOR session is stale by definition — its turn ended
- * or the session crashed before its unpin reconcile ran. This includes records
- * left `pending` (the persist-intent-first write from `reconcileAndPersist-
- * StatusPin`): a crash between the pin API call and its confirming rewrite
- * leaves a pending record whose pin MAY have landed in Telegram, so we must
- * treat it exactly like a confirmed one and unpin it. We therefore best-effort
- * unpin EVERY persisted entry (confirmed and pending alike — a failure is
- * non-fatal) and then EMPTY the store regardless, so a permanently-
- * undeliverable unpin can't re-run on every boot. We do NOT re-adopt or re-pin.
- * Returns the counts for logging/testing.
+ * The restart rule (#3001): a WORK-SCOPED pin persisted by a PRIOR session
+ * (fg:/wk:/banner: — any row without `expiresAt`) is stale by definition — its
+ * work ended or the session crashed before its unpin reconcile ran, so
+ * restart = reset: it is unpinned here. This includes records left `pending`
+ * (the persist-intent-first write from `reconcileAndPersistStatusPin`): a
+ * crash between the pin API call and its confirming rewrite leaves a pending
+ * record whose pin MAY have landed in Telegram, so we must treat it exactly
+ * like a confirmed one and unpin it.
+ *
+ * TIME-SCOPED rows (`tool:` pins from the `pin_message` MCP tool, carrying
+ * `expiresAt`) have no "work finished" event, so a restart does NOT reset
+ * them: an unexpired row is RETAINED untouched across boots and only unpinned
+ * once `now >= expiresAt`.
+ *
+ * RETRY-SAFETY (#3001): a row is dropped only AFTER its unpin resolves. A
+ * failing unpin (flood-wait exhausted / transient 5xx) retains the row with an
+ * incremented `attempts` counter so the NEXT boot retries, up to
+ * BOOT_UNPIN_MAX_ATTEMPTS — then the row is forfeited (a permanently-
+ * undeliverable unpin must not re-fail on every boot forever). Unpins are
+ * idempotent, so the retry can never double-unpin harmfully. We do NOT
+ * re-adopt or re-pin. Returns the counts for logging/testing.
  *
  * CRITICAL: the caller MUST only invoke this AFTER winning the startup mutex.
  * The store is a shared per-agent file; on a double-boot a losing gateway
@@ -189,27 +224,52 @@ export async function runStatusPinBootCleanup(args: {
   path: string
   fs: StatusPinStoreFsSeam
   unpin: (chatId: string, messageId: number) => Promise<unknown>
+  now?: number
   log?: (line: string) => void
-}): Promise<{ cleared: number; total: number }> {
+}): Promise<{ cleared: number; retained: number; kept: number; total: number }> {
   const log = args.log ?? ((l: string) => process.stderr.write(l))
+  const now = args.now ?? Date.now()
   const persisted = loadStatusPins(args.path, args.fs)
-  if (persisted.length === 0) return { cleared: 0, total: 0 }
+  if (persisted.length === 0) return { cleared: 0, retained: 0, kept: 0, total: 0 }
   let cleared = 0
+  let retained = 0
+  let kept = 0
+  const next: PersistedStatusPin[] = []
   for (const pin of persisted) {
+    // Unexpired time-scoped row (tool: pin): deliberately survives the
+    // restart — keep it as-is, no unpin.
+    if (pin.expiresAt != null && pin.expiresAt > now) {
+      next.push(pin)
+      kept++
+      continue
+    }
     try {
       await args.unpin(pin.chatId, pin.messageId)
       cleared++
     } catch (err) {
+      const attempts = (pin.attempts ?? 0) + 1
       log(
         `status-pin-store: boot cleanup unpin failed ` +
-          `(chat=${pin.chatId} msg=${pin.messageId}): ${(err as Error).message}\n`,
+          `(chat=${pin.chatId} msg=${pin.messageId} attempt=${attempts}): ` +
+          `${(err as Error).message}\n`,
       )
+      if (attempts < BOOT_UNPIN_MAX_ATTEMPTS) {
+        // Retain for a retry on the next boot instead of forfeiting the
+        // orphan permanently (retry-safe boot sweep, #3001).
+        next.push({ ...pin, attempts })
+        retained++
+      } else {
+        log(
+          `status-pin-store: boot cleanup FORFEITING pin after ` +
+            `${attempts} failed unpin attempts ` +
+            `(key=${pin.pinKey} chat=${pin.chatId} msg=${pin.messageId}) — ` +
+            `will not retry again\n`,
+        )
+      }
     }
   }
-  // Empty the store regardless — these claims belong to a dead session; leaving
-  // them would re-attempt the same (already-tried) unpins on every future boot.
-  persistStatusPins(args.path, args.fs, [], log)
-  return { cleared, total: persisted.length }
+  persistStatusPins(args.path, args.fs, next, log)
+  return { cleared, retained, kept, total: persisted.length }
 }
 
 /**

package/telegram-plugin/gateway/worker-feed-dispatch.ts

@@ -25,6 +25,15 @@ export interface WorkerFeedDispatch {
    * result returns to its dispatching worker as the Task tool result).
    */
   isNested: boolean
+  /**
+   * Dispatch-time / last-persisted model for the worker, from the registry
+   * row's `model` column (seeded by the pretool hook from `tool_input.model`,
+   * later updated by the watcher from the worker's transcript). The FIRST-PAINT
+   * fallback the worker card renders before the live watcher entry has observed
+   * a transcript model. Null when the row is missing or never carried a model —
+   * the card then omits the model rather than guessing from config.
+   */
+  feedModel: string | null
 }
 
 /**
@@ -43,14 +52,28 @@ export interface WorkerFeedDispatch {
  * decision again: a regression here silently reverts the feed header to
  * "· sub-agent".
  */
+/**
+ * `entryBackground` (fix #1(+#2)): the in-memory watcher entry's own cached
+ * `background` flag (`WorkerEntry.background`), passed by the gateway as a
+ * graceful-degradation fallback for when the registry row (`sub`) is
+ * missing — most often because `jsonl_agent_id` never linked (unreadable
+ * meta.json, or an ambiguous fuzzy backfill — see fix #3). Without this, a
+ * missing row hard-defaults `isBackground` to `false`, silently dropping a
+ * completed background worker's handback (the gateway's `onFinish` treats
+ * `false` as "nothing to deliver — it returns inline"). Ignored entirely
+ * when `sub` resolves — the registry row is always the authoritative
+ * source once it links.
+ */
 export function resolveWorkerFeedDispatch(
   sub: Subagent | null,
   watcherDescription: string,
+  entryBackground?: boolean,
 ): WorkerFeedDispatch {
   return {
-    isBackground: sub?.background ?? false,
+    isBackground: sub?.background ?? entryBackground ?? false,
     feedDescription: (sub?.description ?? '') || watcherDescription,
     hasRow: sub != null,
     isNested: sub?.parent_agent_id != null,
+    feedModel: sub?.model ?? null,
   }
 }

package/telegram-plugin/gateway/worker-pin-reaper.ts

@@ -0,0 +1,114 @@
+/**
+ * worker-pin-reaper.ts — pure decision for the mid-session `wk:` pin sweep
+ * (#3001).
+ *
+ * Why this exists: the background-worker pin (`wk:<agentId>`, pinned on the
+ * `🛠 Worker` feed message while the worker runs) is normally unpinned by the
+ * worker's completion handler (`reconcileWorkerPin(agentId, null, false)` on
+ * the watcher's onFinish). But that event can be MISSED — watcher crash, SDK
+ * subprocess SIGKILL, a dropped JSONL tail — and then nothing ever unpins the
+ * worker's message until the next gateway boot. Log evidence on one agent:
+ * ~1120 pinChatMessage vs ~1014 unpinChatMessage with zero logged failures —
+ * a long tail of stale pins glued to the top of the chat.
+ *
+ * This module is the pure half (mirrors `runActivityCardMidSessionReaper`'s
+ * decide-over-injected-seams shape): given the currently-claimed `wk:` pins,
+ * a terminality predicate over the sub-agent registry, and a TTL, it returns
+ * the pins that should be unpinned NOW. The gateway executes each reap via
+ * `reconcileStatusPin(key, chat, { pinned: false })` so the in-memory claim
+ * AND the durable store row clear together.
+ *
+ * A pin is reaped when EITHER:
+ *   - `terminal` — the registry says the worker reached a terminal status
+ *     (completed | failed): its work is finished, the pin must go, however
+ *     young it is. (A missed onFinish is exactly this case.)
+ *   - `ttl` — the pin has been held past `ttlMs` AND the registry cannot
+ *     vouch for the worker (no row / never linked / `stalled` / lookup
+ *     error). A registry-confirmed RUNNING row exempts the pin from the TTL
+ *     entirely: a healthy 7h worker keeps its pin for the whole run instead
+ *     of churning unpin→re-pin every TTL. The stall detector demotes a dead
+ *     worker's row out of 'running' within ~60s, so the TTL still catches
+ *     true zombies.
+ *
+ * A worker the registry can't vouch for is still never touched before the
+ * TTL — the sweep can only ever shorten a stale pin's life, not a live one's.
+ */
+
+/** Default TTL for a held worker pin: 6 hours. Rationale: worker turns are
+ *  expected to run minutes-to-a-couple-of-hours (the watcher's own stall
+ *  detection fires after ~60s of JSONL inactivity, and the longest sanctioned
+ *  background dispatches are bounded by a single Claude session's lifetime).
+ *  6h comfortably exceeds any legitimate worker turn while bounding the
+ *  stale-pin window to the same day instead of "until the next restart". */
+export const WORKER_PIN_TTL_MS_DEFAULT = 6 * 60 * 60_000
+
+export const WORKER_PIN_KEY_PREFIX = 'wk:'
+
+/** One currently-claimed worker pin, flattened from the gateway's Maps. */
+export interface WorkerPinCandidate {
+  /** Full pin key, `wk:<agentId>` shape. */
+  pinKey: string
+  /** Chat the pin lives in (from the gateway's pinKey → chatId registry). */
+  chatId: string
+  /** Wall-clock ms the claim was first taken (gateway's pinnedAt registry). */
+  pinnedAt: number
+}
+
+export interface WorkerPinReap extends WorkerPinCandidate {
+  reason: 'terminal' | 'ttl'
+}
+
+/** Extract the agentId from a `wk:<agentId>` pin key, or null for any other
+ *  key shape (fg:/banner:/tool: keys are never worker-reaped). */
+export function workerAgentIdOfPinKey(pinKey: string): string | null {
+  if (!pinKey.startsWith(WORKER_PIN_KEY_PREFIX)) return null
+  const agentId = pinKey.slice(WORKER_PIN_KEY_PREFIX.length)
+  return agentId.length > 0 ? agentId : null
+}
+
+/** The registry's view of a worker, distilled for the reap decision.
+ *  - 'terminal' — row exists in completed | failed: reap now.
+ *  - 'running'  — row exists and is still 'running': NEVER reap, not even
+ *    past the TTL. A healthy 7h worker must not get unpinned mid-run only
+ *    for the next feed edit to re-pin it (pin/unpin churn every TTL). The
+ *    subagent-watcher's stall detection demotes a dead worker's row out of
+ *    'running' within ~60s of its JSONL going quiet, so a true zombie can
+ *    only hold 'running' briefly — the TTL still catches everything the
+ *    registry has lost track of.
+ *  - 'unknown'  — no row / never linked / 'stalled' / lookup error: the
+ *    TTL gate applies (the registry can't vouch for it). */
+export type WorkerRegistryStatus = 'terminal' | 'running' | 'unknown'
+
+/**
+ * Decide which claimed worker pins to unpin now. Pure: the registry lookup is
+ * an injected predicate (`statusOf` must return 'terminal' ONLY for a row in
+ * completed | failed, 'running' only for a live 'running' row, and 'unknown'
+ * for stalled / missing / lookup-error; a DB hiccup must degrade to 'unknown'
+ * — kept until the TTL — never to a spurious 'terminal' unpin).
+ */
+export function decideWorkerPinReaps(args: {
+  pins: Iterable<WorkerPinCandidate>
+  statusOf: (agentId: string) => WorkerRegistryStatus
+  ttlMs: number
+  now: number
+}): WorkerPinReap[] {
+  const reaps: WorkerPinReap[] = []
+  for (const pin of args.pins) {
+    const agentId = workerAgentIdOfPinKey(pin.pinKey)
+    if (agentId == null) continue // not a worker pin — never ours to reap
+    if (pin.chatId.length === 0) continue // can't unpin without a chat
+    const status = args.statusOf(agentId)
+    if (status === 'terminal') {
+      reaps.push({ ...pin, reason: 'terminal' })
+      continue
+    }
+    // A registry-confirmed RUNNING worker keeps its pin regardless of age —
+    // the TTL only reaps pins the registry can't vouch for (see
+    // WorkerRegistryStatus doc).
+    if (status === 'running') continue
+    if (args.now - pin.pinnedAt >= args.ttlMs) {
+      reaps.push({ ...pin, reason: 'ttl' })
+    }
+  }
+  return reaps
+}

package/telegram-plugin/hooks/hooks.json

@@ -5,7 +5,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/secret-guard-pretool.mjs\"",
+            "command": "sh \"${CLAUDE_PLUGIN_ROOT}/hooks/run-hook.sh\" node \"${CLAUDE_PLUGIN_ROOT}/hooks/secret-guard-pretool.mjs\"",
             "timeout": 10
           }
         ]
@@ -14,7 +14,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/sentinel-reply-guard-pretool.mjs\"",
+            "command": "sh \"${CLAUDE_PLUGIN_ROOT}/hooks/run-hook.sh\" node \"${CLAUDE_PLUGIN_ROOT}/hooks/sentinel-reply-guard-pretool.mjs\"",
             "timeout": 5
           }
         ]
@@ -24,7 +24,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/subagent-tracker-pretool.mjs\"",
+            "command": "sh \"${CLAUDE_PLUGIN_ROOT}/hooks/run-hook.sh\" node \"${CLAUDE_PLUGIN_ROOT}/hooks/subagent-tracker-pretool.mjs\"",
             "timeout": 10
           }
         ]
@@ -33,7 +33,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/tool-label-pretool.mjs\"",
+            "command": "sh \"${CLAUDE_PLUGIN_ROOT}/hooks/run-hook.sh\" node \"${CLAUDE_PLUGIN_ROOT}/hooks/tool-label-pretool.mjs\"",
             "timeout": 5
           }
         ]
@@ -43,7 +43,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/repo-context-pretool.mjs\"",
+            "command": "sh \"${CLAUDE_PLUGIN_ROOT}/hooks/run-hook.sh\" node \"${CLAUDE_PLUGIN_ROOT}/hooks/repo-context-pretool.mjs\"",
             "timeout": 5
           }
         ]
@@ -55,7 +55,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/subagent-tracker-posttool.mjs\"",
+            "command": "sh \"${CLAUDE_PLUGIN_ROOT}/hooks/run-hook.sh\" node \"${CLAUDE_PLUGIN_ROOT}/hooks/subagent-tracker-posttool.mjs\"",
             "timeout": 10
           }
         ]
@@ -65,7 +65,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/sandbox-hint-posttool.mjs\"",
+            "command": "sh \"${CLAUDE_PLUGIN_ROOT}/hooks/run-hook.sh\" node \"${CLAUDE_PLUGIN_ROOT}/hooks/sandbox-hint-posttool.mjs\"",
             "timeout": 3
           }
         ]
@@ -76,7 +76,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/secret-scrub-stop.mjs\"",
+            "command": "sh \"${CLAUDE_PLUGIN_ROOT}/hooks/run-hook.sh\" node \"${CLAUDE_PLUGIN_ROOT}/hooks/secret-scrub-stop.mjs\"",
             "timeout": 15,
             "async": true
           }
@@ -86,7 +86,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/silent-end-interrupt-stop.mjs\"",
+            "command": "sh \"${CLAUDE_PLUGIN_ROOT}/hooks/run-hook.sh\" node \"${CLAUDE_PLUGIN_ROOT}/hooks/silent-end-interrupt-stop.mjs\"",
             "timeout": 5
           }
         ]
@@ -95,7 +95,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/tool-label-stop.mjs\"",
+            "command": "sh \"${CLAUDE_PLUGIN_ROOT}/hooks/run-hook.sh\" node \"${CLAUDE_PLUGIN_ROOT}/hooks/tool-label-stop.mjs\"",
             "timeout": 5,
             "async": true
           }

package/telegram-plugin/hooks/run-hook.sh

@@ -0,0 +1,84 @@
+#!/bin/sh
+# run-hook.sh — resilient launcher for Claude Code Node hooks (issue #2555).
+#
+# Under cgroup memory-ceiling pressure (the cgroup pinned at memory.max with
+# reclaim lagging, page cache ~= cap), a freshly-spawned Node process can abort
+# at STARTUP with exit 134 (SIGABRT) inside the libuv threadpool constructor —
+# `Assertion failed: (0) == (uv_thread_create(...))` — BEFORE any hook code
+# runs. It is a transient allocation failure, not a real hook error, but it
+# surfaces a 🔴 issues card and skips the hook's work on that one tool call.
+#
+# This wrapper makes the invocation tolerant:
+#   1. Shrink the libuv threadpool to 1 so Node needs the fewest possible
+#      thread-stack mmaps at startup (minimises the failure window).
+#   2. Capture the hook payload from stdin ONCE and replay it on each attempt.
+#      The abort can land AFTER Node started draining the pipe, so a naive
+#      retry would feed the second attempt EMPTY stdin — a secret scanner would
+#      then scan nothing. Replaying the captured payload keeps the retry
+#      faithful.
+#   3. Retry ONCE on a 134 abort after a brief backoff.
+#   4. If it STILL aborts:
+#        - for SECURITY-CRITICAL hooks (secret-guard / secret-scrub) FAIL
+#          CLOSED — propagate 134 so the runtime cards it. 134 is a generic
+#          SIGABRT (assertion / OOM / any abort), not memory-pressure-specific,
+#          so silently returning 0 for a genuinely broken scanner would be a
+#          silent security BYPASS. Those hooks must never fail open.
+#        - for all other hooks, SKIP CLEANLY (exit 0) with a single stderr
+#          warn. A skipped label/context hook on one call is the documented,
+#          accepted degradation; a crash-card storm under memory pressure is
+#          not.
+#
+# Any non-134 exit status is passed through unchanged — real hook decisions
+# (block/allow/non-zero) are never masked. `sleep 0.15` uses a fractional
+# second (supported by GNU/BusyBox sleep, both present in the agent image).
+#
+# Usage (from hooks.json):
+#   sh "${CLAUDE_PLUGIN_ROOT}/hooks/run-hook.sh" node "${CLAUDE_PLUGIN_ROOT}/hooks/<name>.mjs"
+
+export UV_THREADPOOL_SIZE="${UV_THREADPOOL_SIZE:-1}"
+
+# Identify the hook script (the .mjs argument) to decide fail-open vs closed.
+hook_path=""
+for a in "$@"; do
+  case "$a" in
+    *.mjs) hook_path="$a" ;;
+  esac
+done
+hook_name=$(basename "$hook_path" 2>/dev/null)
+
+# Security-critical hooks MUST fail closed on a persistent abort.
+fail_closed=0
+case "$hook_name" in
+  secret-guard-pretool.mjs | secret-scrub-stop.mjs) fail_closed=1 ;;
+esac
+
+# Capture stdin once so both attempts see the SAME payload. Claude Code feeds
+# the hook a single JSON object on stdin and closes it, so `cat` returns at
+# EOF. (Command substitution strips trailing newlines, which JSON parsing does
+# not care about.)
+payload=$(cat)
+
+run_hook() {
+  printf '%s' "$payload" | "$@"
+}
+
+run_hook "$@"
+status=$?
+if [ "$status" -ne 134 ]; then
+  exit "$status"
+fi
+
+# Transient thread-create abort — brief backoff, then retry once with the
+# faithfully-replayed payload.
+sleep 0.15
+run_hook "$@"
+status=$?
+if [ "$status" -eq 134 ]; then
+  if [ "$fail_closed" -eq 1 ]; then
+    echo "run-hook: security hook '$hook_name' aborted twice with exit 134 — FAILING CLOSED (not skipping) (#2555)" >&2
+    exit 134
+  fi
+  echo "run-hook: '$hook_name' aborted twice with exit 134 (uv_thread_create under memory pressure) — skipping hook cleanly (#2555)" >&2
+  exit 0
+fi
+exit "$status"

package/telegram-plugin/hooks/subagent-tracker-pretool.mjs

@@ -55,7 +55,8 @@ const SCHEMA_SQL = `
     status            TEXT    NOT NULL,
     result_summary    TEXT,
     jsonl_agent_id    TEXT,
-    parent_agent_id   TEXT
+    parent_agent_id   TEXT,
+    model             TEXT
   );
   CREATE INDEX IF NOT EXISTS subagents_turn      ON subagents(parent_turn_key);
   CREATE INDEX IF NOT EXISTS subagents_status    ON subagents(status);
@@ -157,14 +158,14 @@ function spawnSql(dbPath, sql, cb) {
 // DB write
 // ---------------------------------------------------------------------------
 
-function writeRow(dbPath, { id, parentSessionId, parentTurnKey, agentType, description, background, now }, done) {
+function writeRow(dbPath, { id, parentSessionId, parentTurnKey, agentType, description, background, model, now }, done) {
   const INSERT_SQL = `
     INSERT OR IGNORE INTO subagents
       (id, parent_session_id, parent_turn_key, agent_type, description,
-       background, started_at, last_activity_at, status)
-    VALUES (?, ?, ?, ?, ?, ?, ?, ?, 'running')
+       background, started_at, last_activity_at, status, model)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, 'running', ?)
   `
-  const params = [id, parentSessionId, parentTurnKey, agentType, description, background, now, now]
+  const params = [id, parentSessionId, parentTurnKey, agentType, description, background, now, now, model ?? null]
 
   // Resolve a synchronous SQLite binding. Try in order:
   //   1. node:sqlite (Node 22+, production path) — exposes DatabaseSync
@@ -207,6 +208,13 @@ function writeRow(dbPath, { id, parentSessionId, parentTurnKey, agentType, descr
         if (hasParentAgentCol == null) {
           db.exec('ALTER TABLE subagents ADD COLUMN parent_agent_id TEXT')
         }
+        // Migrate older DBs that pre-date the live-model column.
+        const hasModelCol = db
+          .prepare("SELECT name FROM pragma_table_info('subagents') WHERE name = 'model'")
+          .get()
+        if (hasModelCol == null) {
+          db.exec('ALTER TABLE subagents ADD COLUMN model TEXT')
+        }
         // Verify the marker-derived parent_turn_key (snapParams[2]) actually has
         // a row in the turns table before trusting it. The gateway writes the
         // turn-active marker even when recordTurnStart's INSERT failed (the two
@@ -235,7 +243,7 @@ function writeRow(dbPath, { id, parentSessionId, parentTurnKey, agentType, descr
     return
   }
 
-  // sqlite3 CLI fallback — two non-blocking spawns sequenced via callbacks.
+  // sqlite3 CLI fallback — non-blocking spawns sequenced via callbacks.
   // This legacy path (neither node:sqlite nor bun:sqlite available) can't
   // cheaply verify the marker's turn_key against the turns table, so drop
   // parent_turn_key and let the gateway's window backfill attribute it.
@@ -244,7 +252,15 @@ function writeRow(dbPath, { id, parentSessionId, parentTurnKey, agentType, descr
   params[2] = null
   spawnSql(dbPath, SCHEMA_SQL.replace(/\n\s+/g, ' '), (err) => {
     if (err) { done(err); return }
-    spawnSql(dbPath, fillPlaceholders(INSERT_SQL.trim(), params), done)
+    // Best-effort model-column migration for a legacy DB: the INSERT below
+    // references the model column, which a pre-model table lacks (CREATE TABLE
+    // IF NOT EXISTS is a no-op there, so the schema exec doesn't add it). The
+    // ALTER fails with "duplicate column name" when the column already exists —
+    // that error is EXPECTED and deliberately ignored; on any failure we still
+    // proceed to the INSERT, which surfaces a real problem via `done`.
+    spawnSql(dbPath, 'ALTER TABLE subagents ADD COLUMN model TEXT', () => {
+      spawnSql(dbPath, fillPlaceholders(INSERT_SQL.trim(), params), done)
+    })
   })
 }
 
@@ -363,6 +379,13 @@ function main() {
       agentType: input.subagent_type ?? null,
       description: input.description ?? null,
       background: input.run_in_background === true ? 1 : 0,
+      // First-paint model for the worker card: the Agent tool payload carries
+      // the model the sub-agent will run under (`tool_input.model`), available
+      // BEFORE the sub-agent writes its first assistant line. Persisted so the
+      // card can render the model from dispatch; the watcher later overwrites it
+      // from the worker's own transcript (transcript wins). Only a non-empty
+      // string is stored — never guess from config.
+      model: typeof input.model === 'string' && input.model.length > 0 ? input.model : null,
       now: Date.now(),
     },
     (err) => {