switchroom 0.18.6 → 0.18.8

package/telegram-plugin/model-label.ts

@@ -0,0 +1,69 @@
+/**
+ * Shared friendly-model formatter for progress / activity surfaces.
+ *
+ * Every progress card renders the model actually in use, sourced LIVE from the
+ * session transcripts (`message.model` on each `type:"assistant"` line — the
+ * exact resolved model for that API call). This module owns the two pure
+ * decisions both the capture side (session-tail projection) and the render side
+ * (activity/worker cards) depend on:
+ *
+ *   - `isModelSentinel(v)` — is this a value we must NOT treat as a real model?
+ *     Compaction / synthetic transcript lines carry `model:"<synthetic>"`, and
+ *     test fixtures may carry junk. Anything starting with `<`, empty, or not
+ *     shaped like a model id is a sentinel: the capture side SKIPS it and keeps
+ *     the previous value; it is never rendered.
+ *   - `formatModelLabel(v)` — the short friendly form shown on a card's metrics
+ *     line (e.g. `claude-opus-4-8` → `opus 4.8`). Returns null for sentinels so
+ *     the caller simply omits the model field (never guesses from config).
+ *
+ * Friendly-form rules (verified against live fleet transcript values):
+ *   - `claude-opus-4-8`            → `opus 4.8`
+ *   - `claude-sonnet-5`           → `sonnet 5`
+ *   - `claude-haiku-4-5-20251001` → `haiku 4.5`   (trailing YYYYMMDD dropped)
+ *   - `sr-glm-5`, `sr-gpt-5.5`    → verbatim (LiteLLM routing ids stay literal)
+ *   - anything else               → verbatim (unknown but model-shaped)
+ */
+
+/** Trailing 8-digit date stamp (YYYYMMDD) on a claude model id — dropped. */
+const DATE_SUFFIX = /^\d{8}$/
+
+/**
+ * True when `model` must NOT be treated as a real resolved model. Compaction /
+ * synthetic lines write `model:"<synthetic>"`; fixtures may carry junk. Callers
+ * that see a sentinel keep the previously-seen model (or omit the field).
+ */
+export function isModelSentinel(model: unknown): boolean {
+  if (typeof model !== 'string') return true
+  const m = model.trim()
+  if (m.length === 0) return true
+  // Synthetic / placeholder sentinels: `<synthetic>`, `<compact>`, etc.
+  if (m.startsWith('<')) return true
+  // Model ids are simple tokens (letters, digits, dot, dash, underscore,
+  // slash). Anything with whitespace or leading punctuation is junk.
+  if (!/^[A-Za-z0-9][A-Za-z0-9._/-]*$/.test(m)) return true
+  return false
+}
+
+/**
+ * Short friendly label for a resolved model id, or null when `model` is absent
+ * or a sentinel (caller omits the field — never guesses). See module header for
+ * the rules.
+ */
+export function formatModelLabel(model: string | null | undefined): string | null {
+  if (model == null) return null
+  const m = model.trim()
+  if (isModelSentinel(m)) return null
+  // LiteLLM / self-routed ids stay verbatim — the sr- prefix is meaningful.
+  if (m.startsWith('sr-')) return m
+  if (m.startsWith('claude-')) {
+    const rest = m.slice('claude-'.length)
+    const parts = rest.split('-').filter((p) => p.length > 0)
+    if (parts.length === 0) return m
+    const family = parts[0]
+    const version = parts.slice(1).filter((p) => !DATE_SUFFIX.test(p))
+    if (version.length === 0) return family
+    return `${family} ${version.join('.')}`
+  }
+  // Unknown but model-shaped (a future family, a bare alias) — show verbatim.
+  return m
+}

package/telegram-plugin/model-unavailable.ts

@@ -69,6 +69,32 @@ export function detectModelUnavailable(
   const sample = stderr.length > 16_384 ? stderr.slice(0, 16_384) : stderr
   const lower = sample.toLowerCase()
 
+  // ── 0. Transient / server-side 429 (NOT account quota) — issue #2922 ────
+  // Anthropic emits a `rate_limit_error` whose message explicitly negates the
+  // account-quota reading: "Server is temporarily limiting requests (not your
+  // usage limit)". A negation-blind substring match on "usage limit" (step 1
+  // below) would misclassify this as `quota_exhausted`, firing a phantom fleet
+  // failover that self-cancels and leaves the turn dead. These are upstream
+  // throttles Claude Code retries internally with backoff — classify them as
+  // `overload` (the calm rate-limit path) BEFORE the quota substrings run, so
+  // the negation is honoured and no failover is announced.
+  const transientUpstreamSignals = [
+    'not your usage limit',
+    'not your account',
+    "not your account's",
+    'temporarily limiting requests',
+    'temporarily rate',
+    'server is temporarily',
+    'would exceed your account’s rate limit',
+    "would exceed your account's rate limit",
+  ]
+  if (transientUpstreamSignals.some(s => lower.includes(s))) {
+    const resetAt = parseResetTime(sample)
+    return resetAt !== undefined
+      ? { kind: 'overload', resetAt, raw: stderr }
+      : { kind: 'overload', raw: stderr }
+  }
+
   // ── 1. Quota / billing exhaustion ──────────────────────────────────────
   const quotaSignals = [
     'out of extra usage',

package/telegram-plugin/operator-events.ts

@@ -27,6 +27,7 @@ export type OperatorEventKind =
   | 'unknown-4xx'
   | 'unknown-5xx'
   | 'config-warning'
+  | 'always-allow-persist-failed'
 
 export interface OperatorEvent {
   kind: OperatorEventKind
@@ -396,6 +397,29 @@ export function renderOperatorEvent(ev: OperatorEvent): RenderResult {
           ],
         },
       }
+
+    // #2973 pt.3 — a durable "Always allow" persist exhausted its retry
+    // budget (always-allow-persist-queue.ts) or hit a non-retryable error
+    // (e.g. E_CONFIG_EDIT_DISABLED). MUST be a NEW message, not a card
+    // edit — the original permission card was already edited to the
+    // interim "saving durably in background…" state and card edits don't
+    // ping the operator, so a silent edit here would leave the failure
+    // unnoticed indefinitely.
+    case 'always-allow-persist-failed':
+      return {
+        text: [
+          `⚠️ Your "Always allow" for **${agent}** didn't stick.`,
+          detail ? `_${detail}_` : '',
+          `It will ask again.`,
+        ]
+          .filter(Boolean)
+          .join('\n'),
+        keyboard: {
+          inline_keyboard: [
+            [{ text: '❌ Dismiss', callback_data: `op:dismiss:${encodeURIComponent(ev.agent)}` }],
+          ],
+        },
+      }
   }
 }
 

package/telegram-plugin/permission-diff.ts

@@ -156,6 +156,73 @@ function locateAllowLine(
   return null;
 }
 
+/** Internal: a located multi-line flow list (`allow:` then `[` on a
+ * subsequent line, one entry per line, closing `]` on its own line — the
+ * shape clerk's config uses, `switchroom.yaml:507-514`). */
+interface MultilineFlowList {
+  /** 0-based index of the line containing the opening `[`. */
+  openIdx: number;
+  /** 0-based index of the line containing the matching closing `]`. */
+  closeIdx: number;
+  /** Indentation to use for a newly-inserted entry line. */
+  itemIndent: number;
+  /** 0-based index of the last existing entry line, or -1 if the list is
+   * empty (`[` immediately followed by `]`, possibly across lines). */
+  lastEntryIdx: number;
+}
+
+/**
+ * Scan forward from `scanStart` (the line right after `allow:` when its
+ * inline remainder is empty) for a flow list whose opening `[` is on its
+ * OWN subsequent line (issue #2973 — clerk's exact shape). Tracks bracket
+ * depth char-by-char so a matching `]` is found even several lines down.
+ * Returns null if the first non-blank/comment line doesn't open a flow
+ * list, or the list is unterminated within the block.
+ */
+function locateMultilineFlowList(
+  lines: string[],
+  scanStart: number,
+  blockEnd: number,
+): MultilineFlowList | null {
+  let i = scanStart;
+  while (i < blockEnd && isBlankOrComment(lines[i]!)) i++;
+  if (i >= blockEnd) return null;
+  const firstLine = lines[i]!;
+  if (!firstLine.trim().startsWith("[")) return null;
+  const openIdx = i;
+
+  let depth = 0;
+  let closeIdx = -1;
+  for (let j = openIdx; j < blockEnd && closeIdx === -1; j++) {
+    const line = lines[j]!;
+    for (const ch of line) {
+      if (ch === "[") depth++;
+      else if (ch === "]") {
+        depth--;
+        if (depth === 0) {
+          closeIdx = j;
+          break;
+        }
+      }
+    }
+  }
+  if (closeIdx === -1) return null; // unterminated — caller falls back.
+
+  // Entry lines: strictly between the open and close bracket lines,
+  // one per line (the observed shape). Lines that carry entries AND a
+  // bracket on the same line (e.g. inline `[ all,`) aren't split out
+  // here — they're handled upstream by the single-line flow-list case.
+  let lastEntryIdx = -1;
+  for (let j = openIdx + 1; j < closeIdx; j++) {
+    if (isBlankOrComment(lines[j]!)) continue;
+    lastEntryIdx = j;
+  }
+  const itemIndent =
+    lastEntryIdx !== -1 ? indentOf(lines[lastEntryIdx]!) : indentOf(firstLine) + 2;
+
+  return { openIdx, closeIdx, itemIndent, lastEntryIdx };
+}
+
 /**
  * Build a unified-diff hunk from a contiguous slice of the original
  * file. `lines` is the whole file split on `\n`. The hunk replaces the
@@ -282,6 +349,45 @@ export function synthesizeAllowRuleDiff(
     return wrapDiff(hunk);
   }
 
+  // Case (a2): multi-line flow list — `allow:` has an EMPTY inline
+  // remainder, but the `[` opens on a subsequent line and entries run one
+  // per line down to a closing `]` on its own line (clerk's exact shape,
+  // issue #2973). Must be checked before the block-sequence fallback below
+  // — that fallback would otherwise misread the `[`/entries/`]` lines as
+  // block-sequence context and insert a `- <rule>` line ABOVE the `[`,
+  // corrupting the YAML (`E_YAML_UNSAFE_CONSTRUCT`).
+  if (inlineTrimmed.length === 0) {
+    const flow = locateMultilineFlowList(lines, allow.idx + 1, block.agentBlockEnd);
+    if (flow) {
+      if (flow.lastEntryIdx === -1) {
+        // Empty multi-line list (`[` immediately followed by `]`) — insert
+        // the first entry right after the opening bracket line.
+        const insertAt = flow.openIdx + 1;
+        const added = [`${" ".repeat(flow.itemIndent)}${rule}`];
+        const hunk = buildHunk(lines, insertAt, insertAt, [], added);
+        return wrapDiff(hunk);
+      }
+      // Ensure the current last entry carries a trailing comma (YAML flow
+      // sequences accept it, and it's required here since we're adding a
+      // sibling entry on its own line), then append the new entry —
+      // replacing the single last-entry line with both lines.
+      const lastLine = lines[flow.lastEntryIdx]!;
+      const lastTrimmedEnd = lastLine.replace(/\s+$/, "");
+      const fixedLast = lastTrimmedEnd.endsWith(",")
+        ? lastTrimmedEnd
+        : `${lastTrimmedEnd},`;
+      const itemLine = `${" ".repeat(flow.itemIndent)}${rule}`;
+      const hunk = buildHunk(
+        lines,
+        flow.lastEntryIdx,
+        flow.lastEntryIdx + 1,
+        [lastLine],
+        [fixedLast, itemLine],
+      );
+      return wrapDiff(hunk);
+    }
+  }
+
   // Case (b): block sequence. Find the last `- ` entry at indent
   // allow.indent + 2 and insert a new entry after it.
   const itemIndent = allow.indent + 2;
@@ -348,6 +454,14 @@ export function extractAddedAllowRule(unifiedDiff: string): string | null {
       })
       .filter((x): x is string => x !== null);
     if (items.length === 1) return items[0]!;
+    // Multi-line flow-list first-entry insert (list was empty): a single
+    // bare `+` line with no `- ` prefix — the plain entry text itself,
+    // possibly comma-suffixed.
+    if (items.length === 0 && plus.length === 1) {
+      const bare = plus[0]!.trim();
+      const stripped = bare.endsWith(",") ? bare.slice(0, -1).trim() : bare;
+      return stripped.length > 0 ? stripped : null;
+    }
     return null;
   }
 
@@ -368,6 +482,20 @@ export function extractAddedAllowRule(unifiedDiff: string): string | null {
     return added;
   }
 
+  // Multi-line flow-list append: one `-` line (the previous last entry)
+  // replaced by TWO `+` lines — that same entry now comma-terminated,
+  // plus the new entry on its own line.
+  if (minus.length === 1 && plus.length === 2) {
+    const orig = minus[0]!.trim();
+    const first = plus[0]!.trim();
+    const second = plus[1]!.trim();
+    const origStripped = orig.endsWith(",") ? orig.slice(0, -1).trim() : orig;
+    const firstStripped = first.endsWith(",") ? first.slice(0, -1).trim() : first;
+    if (firstStripped !== origStripped) return null;
+    const added = second.endsWith(",") ? second.slice(0, -1).trim() : second;
+    return added.length > 0 ? added : null;
+  }
+
   return null;
 }
 

package/telegram-plugin/pty-partial-handler.ts

@@ -32,6 +32,7 @@ export type PtyPartialAction =
   | 'dedup-skip' // same text as the previous partial; no-op
   | 'update-existing' // pushed into an already-live stream
   | 'update-new' // created a new stream and pushed into it
+  | 'error-suppressed' // raw API-error TUI line; dropped (issue #2922 Bug 3)
 
 export interface PtyHandlerState {
   /**
@@ -84,6 +85,32 @@ export interface PtyHandlerDeps {
   writeError?: (line: string) => void
 }
 
+/**
+ * Detect a raw API-error line scraped from Claude Code's TUI — issue #2922
+ * Bug 3. When the model 429s / errors, the CLI renders an `API Error: … ·
+ * b'{"type":"error",…}'` line into the terminal; the PTY tail would otherwise
+ * scrape it as the assistant reply and relay the raw bytes verbatim to chat.
+ * These lines are suppressed here so the model-unavailable operator-event
+ * pipeline owns the user-facing rendering (a clean ⚠️ card), not the raw tail.
+ *
+ * Kept deliberately tight (anchored error markers, not any mention of "error")
+ * so genuine assistant text that happens to discuss errors is NOT swallowed.
+ */
+export function looksLikeRawApiError(text: string): boolean {
+  if (typeof text !== 'string' || text.length === 0) return false
+  const lower = text.toLowerCase()
+  return (
+    lower.includes('api error:')
+    || lower.includes('"type":"error"')
+    || lower.includes("'type': 'error'")
+    || lower.includes('rate_limit_error')
+    || lower.includes('overloaded_error')
+    || lower.includes('"is_error":true')
+    // The CLI's Python-style raw-body render: · b'{...}'
+    || / b'\{/.test(text)
+  )
+}
+
 function streamKey(chatId: string, threadId?: number): string {
   // Canonical chat-key derivation lives in gateway/chat-key.ts — keep this
   // expression in lockstep (treats 0/null/undefined the same). See #1564.
@@ -96,6 +123,13 @@ function streamKey(chatId: string, threadId?: number): string {
  *
  * Returns the action taken. All state mutation happens through the
  * supplied `state` object so callers can inspect before/after.
+ *
+ * NOTE on `looksLikeRawApiError` suppression (#2922 Bug 3): this is
+ * *preview-only* scope. PTY partials are the live-streaming terminal tail,
+ * never the authoritative reply (that flows through the operator-event /
+ * reply pipelines). So the worst case of an over-eager match here is a
+ * missing streaming flicker for one snapshot — NOT a dropped user answer.
+ * That asymmetry is why the matcher can stay aggressive on raw error shapes.
  */
 export function handlePtyPartialPure(
   text: string,
@@ -132,6 +166,11 @@ export function handlePtyPartialPure(
 
   if (suppressed) return 'suppressed'
 
+  // Drop raw API-error TUI lines so they never leak to chat as the reply —
+  // the model-unavailable card (operator-event pipeline) renders these
+  // instead. See issue #2922 Bug 3.
+  if (looksLikeRawApiError(text)) return 'error-suppressed'
+
   if (state.lastPtyPreviewByChat.get(sKey) === text) return 'dedup-skip'
 
   const isFirst = !state.lastPtyPreviewByChat.has(sKey)

package/telegram-plugin/registry/subagents-schema.ts

@@ -116,6 +116,16 @@ export interface Subagent {
    * chain instead.
    */
   parent_agent_id: string | null
+  /**
+   * Live model the sub-agent is running, as a raw resolved model id (e.g.
+   * `claude-opus-4-8`, `sr-glm-5`). Seeded at dispatch from the Agent tool's
+   * `tool_input.model` (first-paint fallback, written by the pretool hook), then
+   * updated on change by the watcher from the worker's own transcript
+   * `message.model` (transcript wins). Persisted so boot-replay / handback cards
+   * can render the model even with no live watcher entry. NULL when never
+   * observed — the card omits the model rather than guessing from config.
+   */
+  model: string | null
 }
 
 export interface RecordSubagentStartArgs {
@@ -207,7 +217,8 @@ const SUBAGENTS_SCHEMA_SQL = `
     status            TEXT    NOT NULL,
     result_summary    TEXT,
     jsonl_agent_id    TEXT,
-    parent_agent_id   TEXT
+    parent_agent_id   TEXT,
+    model             TEXT
   );
   CREATE INDEX IF NOT EXISTS subagents_turn      ON subagents(parent_turn_key);
   CREATE INDEX IF NOT EXISTS subagents_status    ON subagents(status);
@@ -240,6 +251,12 @@ export function applySubagentsSchema(db: SqliteDatabase): void {
   if (!hasParentAgentId) {
     db.exec('ALTER TABLE subagents ADD COLUMN parent_agent_id TEXT')
   }
+  // Idempotent migration for DBs created before the live-model column existed
+  // (progress-card live model — see the Subagent.model doc).
+  const hasModel = cols.some((c) => c.name === 'model')
+  if (!hasModel) {
+    db.exec('ALTER TABLE subagents ADD COLUMN model TEXT')
+  }
   // Always (re-)apply the index. `IF NOT EXISTS` makes this a no-op when it
   // already exists. Splitting it from SUBAGENTS_SCHEMA_SQL is what fixes the
   // pre-existing-table failure mode — by the time we reach this line, the
@@ -316,6 +333,7 @@ interface RawSubagentRow {
   result_summary: string | null
   jsonl_agent_id: string | null
   parent_agent_id?: string | null
+  model?: string | null
 }
 
 function mapSubagentRow(row: RawSubagentRow): Subagent {
@@ -333,6 +351,7 @@ function mapSubagentRow(row: RawSubagentRow): Subagent {
     result_summary: row.result_summary,
     jsonl_agent_id: row.jsonl_agent_id,
     parent_agent_id: row.parent_agent_id ?? null,
+    model: row.model ?? null,
   }
 }
 
@@ -566,6 +585,29 @@ export function bumpSubagentActivity(db: SqliteDatabase, args: BumpSubagentActiv
   `).run(args.ts, args.id)
 }
 
+export interface RecordSubagentModelArgs {
+  id: string
+  /** Raw resolved model id (e.g. `claude-opus-4-8`). Callers pass only
+   *  non-sentinel, non-empty values — the watcher filters at the projection. */
+  model: string
+}
+
+/**
+ * Persist the live model on a subagent row (update-on-change, like
+ * last_activity_at). Written by the watcher whenever it observes a NEW model on
+ * the worker's transcript, so a later boot-replay / handback card renders the
+ * model even with no live in-memory entry. Unconditional UPDATE by `id`; no-ops
+ * gracefully if the row is not found. Idempotent — the caller only calls it on
+ * an actual change, but a repeat write is harmless.
+ */
+export function recordSubagentModel(db: SqliteDatabase, args: RecordSubagentModelArgs): void {
+  db.prepare(`
+    UPDATE subagents
+    SET model = ?
+    WHERE id = ?
+  `).run(args.model, args.id)
+}
+
 /**
  * Return all subagents, optionally filtered by status, ordered by
  * started_at DESC. Intended for the REST API endpoint
@@ -590,6 +632,43 @@ export function listSubagents(
   return rows.map(mapSubagentRow)
 }
 
+/**
+ * List the sub-agents of a given parent turn that had NOT reached a terminal
+ * state (`completed` / `failed`) — i.e. `running` or `stalled`. Ordered by
+ * `started_at ASC` (dispatch order) so the resume inbound lists them the way
+ * they were spawned.
+ *
+ * This is the boot-resume accessor: when a turn is interrupted mid-flight, its
+ * in-flight workers were killed with it, so the resumed session needs to know
+ * which ones didn't finish to re-dispatch them. Deliberately includes
+ * `stalled` alongside `running` — a row the reaper flipped to `stalled` (1h
+ * TTL, JSONL linkage missing) still never completed, so it belongs in the
+ * "these died, re-dispatch if still needed" list. Only genuine terminals are
+ * excluded. This also makes the read robust to boot ordering: even if the
+ * watcher's reaper transitions a row to `stalled` before this runs, the row is
+ * still surfaced rather than dropped.
+ *
+ * Known gap: rows with NULL parent_turn_key are silently omitted — the
+ * INSERT-time stamp can be missing (no turn-active marker at dispatch, e.g.
+ * nested workers) and the watcher's async backfill may not have run before the
+ * killing restart. Those workers won't appear in the resume inbound; the
+ * wake-audit orphan-check (switchroom-runtime skill) is the backstop.
+ */
+export function listNonTerminalSubagentsForTurn(
+  db: SqliteDatabase,
+  parentTurnKey: string,
+): Subagent[] {
+  const rows = db
+    .prepare(`
+      SELECT * FROM subagents
+      WHERE parent_turn_key = ?
+        AND status NOT IN ('completed', 'failed')
+      ORDER BY started_at ASC
+    `)
+    .all(parentTurnKey) as RawSubagentRow[]
+  return rows.map(mapSubagentRow)
+}
+
 /**
  * Retrieve a single subagent row by id. Returns null if not found.
  * Useful in tests and for callers that need to inspect current state.

package/telegram-plugin/registry/subagents.test.ts

@@ -26,9 +26,11 @@ import {
   recordSubagentStall,
   recordSubagentResume,
   bumpSubagentActivity,
+  recordSubagentModel,
   getSubagent,
   reapStuckRunningRows,
   countRunningBackgroundSubagents,
+  listNonTerminalSubagentsForTurn,
 } from './subagents-schema.js'
 
 // ---------------------------------------------------------------------------
@@ -68,6 +70,54 @@ describe('migration on fresh DB', () => {
     expect(() => applySubagentsSchema(db)).not.toThrow()
     db.close()
   })
+
+  it('creates the model column on a fresh DB', () => {
+    const db = openFreshSubagentsDbInMemory()
+    const cols = db.prepare("SELECT name FROM pragma_table_info('subagents')").all() as { name: string }[]
+    expect(cols.map((c) => c.name)).toContain('model')
+    db.close()
+  })
+})
+
+// ---------------------------------------------------------------------------
+// Live-model column — migration + record helper
+// ---------------------------------------------------------------------------
+
+describe('live-model column', () => {
+  it('migrates a pre-model subagents table by adding the model column (idempotent)', () => {
+    const db = openFreshSubagentsDbInMemory()
+    // Simulate a legacy table with no model column.
+    db.exec('ALTER TABLE subagents DROP COLUMN model')
+    let cols = db.prepare("SELECT name FROM pragma_table_info('subagents')").all() as { name: string }[]
+    expect(cols.map((c) => c.name)).not.toContain('model')
+    // Re-applying the schema must add it back, and be safe to repeat.
+    applySubagentsSchema(db)
+    applySubagentsSchema(db)
+    cols = db.prepare("SELECT name FROM pragma_table_info('subagents')").all() as { name: string }[]
+    expect(cols.map((c) => c.name)).toContain('model')
+    db.close()
+  })
+
+  it('recordSubagentStart leaves model null; recordSubagentModel persists on change', () => {
+    const db = openFreshSubagentsDbInMemory()
+    const now = Date.now()
+    recordSubagentStart(db, { id: 'toolu_m1', background: true, startedAt: now, jsonlAgentId: 'a1' })
+    expect(getSubagent(db, 'toolu_m1')?.model).toBeNull()
+
+    recordSubagentModel(db, { id: 'toolu_m1', model: 'claude-opus-4-8' })
+    expect(getSubagent(db, 'toolu_m1')?.model).toBe('claude-opus-4-8')
+
+    // Update-on-change: a later model overwrites.
+    recordSubagentModel(db, { id: 'toolu_m1', model: 'sr-glm-5' })
+    expect(getSubagent(db, 'toolu_m1')?.model).toBe('sr-glm-5')
+    db.close()
+  })
+
+  it('recordSubagentModel no-ops gracefully on a missing id', () => {
+    const db = openFreshSubagentsDbInMemory()
+    expect(() => recordSubagentModel(db, { id: 'nope', model: 'claude-opus-4-8' })).not.toThrow()
+    db.close()
+  })
 })
 
 // ---------------------------------------------------------------------------
@@ -616,3 +666,43 @@ describe('reapStuckRunningRows', () => {
     expect(result.ids.sort()).toEqual(['sa-0', 'sa-1', 'sa-2', 'sa-3', 'sa-4'])
   })
 })
+
+// ---------------------------------------------------------------------------
+// listNonTerminalSubagentsForTurn — the boot-resume accessor
+// ---------------------------------------------------------------------------
+
+describe('listNonTerminalSubagentsForTurn', () => {
+  it('returns running + stalled workers of a turn, excluding terminals, ordered by started_at', () => {
+    const db = openFreshSubagentsDbInMemory()
+    const turn = 'chat-1:7'
+    recordSubagentStart(db, { id: 'sa-run', parentTurnKey: turn, agentType: 'worker', description: 'refactor auth', background: true, startedAt: 1000 })
+    recordSubagentStart(db, { id: 'sa-stall', parentTurnKey: turn, agentType: 'researcher', description: 'survey competitors', background: true, startedAt: 2000 })
+    recordSubagentStall(db, { id: 'sa-stall', stalledAt: 3000 })
+    recordSubagentStart(db, { id: 'sa-done', parentTurnKey: turn, agentType: 'worker', description: 'done work', background: true, startedAt: 500 })
+    recordSubagentEnd(db, { id: 'sa-done', endedAt: 4000, status: 'completed' })
+    recordSubagentStart(db, { id: 'sa-fail', parentTurnKey: turn, background: true, startedAt: 600 })
+    recordSubagentEnd(db, { id: 'sa-fail', endedAt: 4100, status: 'failed' })
+
+    const rows = listNonTerminalSubagentsForTurn(db, turn)
+    expect(rows.map((r) => r.id)).toEqual(['sa-run', 'sa-stall']) // started_at ASC, terminals excluded
+    expect(rows[0].agent_type).toBe('worker')
+    expect(rows[0].description).toBe('refactor auth')
+    expect(rows[1].status).toBe('stalled')
+    db.close()
+  })
+
+  it('does not return workers of a different turn', () => {
+    const db = openFreshSubagentsDbInMemory()
+    recordSubagentStart(db, { id: 'sa-a', parentTurnKey: 'chat:1', background: true, startedAt: 1000 })
+    recordSubagentStart(db, { id: 'sa-b', parentTurnKey: 'chat:2', background: true, startedAt: 1000 })
+    const rows = listNonTerminalSubagentsForTurn(db, 'chat:1')
+    expect(rows.map((r) => r.id)).toEqual(['sa-a'])
+    db.close()
+  })
+
+  it('returns empty for a turn with no in-flight workers', () => {
+    const db = openFreshSubagentsDbInMemory()
+    expect(listNonTerminalSubagentsForTurn(db, 'nope:0')).toEqual([])
+    db.close()
+  })
+})