talon-agent 1.36.0 → 1.37.0

package/src/core/mesh/service.ts

@@ -31,6 +31,7 @@ import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { basename, dirname, join, resolve } from "node:path";
 import type { Readable } from "node:stream";
+import { clampExecOutput } from "../../util/exec-output.js";
 import { dirs } from "../../util/paths.js";
 import { MeshRegistry } from "./registry.js";
 import { TransferStore } from "./transfers.js";
@@ -87,6 +88,13 @@ const FILE_CHUNK_BYTES = 1024 * 1024;
 const STREAM_TRANSFER_TIMEOUT_MS = 60 * 60 * 1000;
 /** readFileBytes switches to the streaming path above this size. */
 const STREAM_READ_THRESHOLD_BYTES = 4 * 1024 * 1024;
+/**
+ * Hard ceiling on a chunked (command-channel) transfer. The chunked path
+ * assembles the whole file in daemon memory one mesh round trip at a time —
+ * past this size it's both a memory hazard and unusably slow, so fail with
+ * a pointer to the streaming path instead of grinding on.
+ */
+const MAX_CHUNKED_TRANSFER_BYTES = 64 * 1024 * 1024;
 /**
  * No policy size cap on transfers — a transfer is attempted whatever the
  * size and fails with a concrete error when a real limit bites (device read
@@ -108,7 +116,10 @@ export class MeshService {
   private readonly transports = new Set<MeshTransport>();
   private readonly pendingCommands = new Map<
     string,
-    (result: DeviceCommandResult) => void
+    {
+      deviceId: string;
+      resolve: (result: DeviceCommandResult) => void;
+    }
   >();
   /**
    * Server-side receipt time (this process's clock) of the last fix per
@@ -203,11 +214,19 @@ export class MeshService {
    * A device answered a command (bridge route POST /devices/command-result).
    * Resolves the pending sendCommand; false when nothing was waiting (late
    * or unknown correlation id — harmless, just ignored).
+   *
+   * The result must come from the device the command was sent to: a reply
+   * whose deviceId names a DIFFERENT device is dropped (a confused or
+   * misbehaving companion must not be able to answer for its peers). A
+   * missing deviceId is tolerated for older app builds.
    */
   completeCommand(body: Record<string, unknown>): boolean {
     const commandId = typeof body.commandId === "string" ? body.commandId : "";
-    const resolve = this.pendingCommands.get(commandId);
-    if (!resolve) return false;
+    const pending = this.pendingCommands.get(commandId);
+    if (!pending) return false;
+    const from = typeof body.deviceId === "string" ? body.deviceId : "";
+    if (from && from !== pending.deviceId) return false;
+    const { resolve } = pending;
     this.pendingCommands.delete(commandId);
     resolve({
       commandId,
@@ -253,9 +272,12 @@ export class MeshService {
         });
       }, timeoutMs);
       timer.unref?.();
-      this.pendingCommands.set(command.id, (result) => {
-        clearTimeout(timer);
-        resolve(result);
+      this.pendingCommands.set(command.id, {
+        deviceId: device.id,
+        resolve: (result) => {
+          clearTimeout(timer);
+          resolve(result);
+        },
       });
       for (const transport of this.transports) {
         try {
@@ -289,8 +311,9 @@ export class MeshService {
    */
   async locateDevice(query?: unknown): Promise<MeshToolResult> {
     await this.load();
-    const target = this.chooseDevice(query);
-    if (!target) return this.noSuchDevice(query);
+    const resolved = this.resolveDevice(query);
+    if ("error" in resolved) return { ok: false, text: resolved.error };
+    const target = resolved.target;
     const requestedAt = Date.now();
     // Only wait out the fresh-fix window when a transport can actually
     // deliver the locate AND the device is currently present — pinging an
@@ -334,8 +357,9 @@ export class MeshService {
     hours?: unknown,
   ): Promise<MeshToolResult> {
     await this.load();
-    const target = this.chooseDevice(query);
-    if (!target) return this.noSuchDevice(query);
+    const resolved = this.resolveDevice(query);
+    if ("error" in resolved) return { ok: false, text: resolved.error };
+    const target = resolved.target;
     const windowHours = clampHours(hours);
     const sinceTs = Date.now() - windowHours * 3_600_000;
     const fixes = this.registry.getHistory(target.id, sinceTs);
@@ -546,8 +570,10 @@ export class MeshService {
     const p = requirePath(path);
     if (!p) return { error: "A file path is required." };
     await this.load();
-    const target = this.chooseDevice(query);
-    if (target && this.canStream(target, "upload_file")) {
+    const resolved = this.resolveDevice(query);
+    if ("error" in resolved) return { error: resolved.error };
+    const target = resolved.target;
+    if (this.canStream(target, "upload_file")) {
       const size = await this.statSize(target.id, p);
       if (size !== undefined && size > STREAM_READ_THRESHOLD_BYTES) {
         const tmp = join(tmpdir(), `talon-pull-${randomUUID()}-${basename(p)}`);
@@ -565,7 +591,7 @@ export class MeshService {
         }
       }
     }
-    return this.pullBytes(query, p);
+    return this.pullBytes(target.id, p);
   }
 
   /** Size of a device path via the `stat` command, if the device can. */
@@ -607,8 +633,16 @@ export class MeshService {
   ): Promise<MeshToolResult> {
     const p = requirePath(path);
     if (!p) return { ok: false, text: "A file path is required." };
-    const text = typeof content === "string" ? content : "";
-    const written = await this.pushBytes(query, p, Buffer.from(text, "utf8"));
+    // A non-string body must fail, not silently truncate the target to an
+    // empty file (an empty string is a legitimate truncate-to-zero).
+    if (typeof content !== "string") {
+      return { ok: false, text: "File content must be a string." };
+    }
+    const written = await this.pushBytes(
+      query,
+      p,
+      Buffer.from(content, "utf8"),
+    );
     if ("error" in written) return { ok: false, text: written.error };
     return {
       ok: true,
@@ -627,8 +661,9 @@ export class MeshService {
     const remote = requirePath(remotePath);
     if (!remote) return { ok: false, text: "A remote file path is required." };
     await this.load();
-    const target = this.chooseDevice(query);
-    if (!target) return this.noSuchDevice(query);
+    const resolved = this.resolveDevice(query);
+    if ("error" in resolved) return { ok: false, text: resolved.error };
+    const target = resolved.target;
     const dest =
       typeof localPath === "string" && localPath.trim()
         ? resolve(dirs.workspace, localPath.trim())
@@ -672,8 +707,9 @@ export class MeshService {
         : "";
     if (!local) return { ok: false, text: "A local source path is required." };
     await this.load();
-    const target = this.chooseDevice(query);
-    if (!target) return this.noSuchDevice(query);
+    const resolved = this.resolveDevice(query);
+    if ("error" in resolved) return { ok: false, text: resolved.error };
+    const target = resolved.target;
     if (this.canStream(target, "download_file")) {
       const started = Date.now();
       const { token } = this.transfers.createPush(target.id, local);
@@ -725,6 +761,13 @@ export class MeshService {
   /**
    * Chunked read of a remote file into a Buffer. Loops `read_file` with
    * increasing offsets until the device reports EOF.
+   *
+   * End-of-file is the DEVICE's call (`eof: true`), never inferred from a
+   * short chunk: devices cap their chunk size (the companion serves at most
+   * 256KB per read regardless of the requested length), so a chunk shorter
+   * than the request is normal mid-file and treating it as EOF silently
+   * truncated every chunked read past the device's cap. A zero-length chunk
+   * without `eof` is a stuck transfer and fails loudly instead of looping.
    */
   private async pullBytes(
     query: unknown,
@@ -764,8 +807,17 @@ export class MeshService {
       const chunk = Buffer.from(b64, "base64");
       chunks.push(chunk);
       offset += chunk.length;
-      // EOF when the device says so, or when it returns a short/empty chunk.
-      if (result.data?.eof === true || chunk.length < FILE_CHUNK_BYTES) break;
+      if (result.data?.eof === true) break;
+      if (chunk.length === 0) {
+        return {
+          error: `${path} transfer stalled: the device returned an empty chunk without reporting end-of-file (after ${formatBytes(offset)}).`,
+        };
+      }
+      if (offset > MAX_CHUNKED_TRANSFER_BYTES) {
+        return {
+          error: `${path} exceeds the ${formatBytes(MAX_CHUNKED_TRANSFER_BYTES)} chunked-transfer limit (device never reported end-of-file after ${formatBytes(offset)}). Use device_pull_file with a streaming-capable companion build for large files.`,
+        };
+      }
     }
     try {
       return { data: Buffer.concat(chunks), deviceName };
@@ -853,8 +905,9 @@ export class MeshService {
     { target: DeviceInfo; result: DeviceCommandResult } | { error: string }
   > {
     await this.load();
-    const target = this.chooseDevice(query);
-    if (!target) return { error: this.noSuchDevice(query).text };
+    const resolved = this.resolveDevice(query);
+    if ("error" in resolved) return { error: resolved.error };
+    const target = resolved.target;
     // Devices advertise what they can do; an explicit list that lacks the
     // command is a clean "can't" — absent list means an older app build, so
     // attempt it and let the timeout speak.
@@ -878,17 +931,64 @@ export class MeshService {
     return { target, result };
   }
 
-  /** Resolve a device by exact id, name fragment, or default (most recently
-   *  seen mobile device, falling back to the most recent device overall). */
+  /** Resolve a device by exact id, exact name, or unique name fragment;
+   *  undefined when nothing (or more than one device) matches. */
   chooseDevice(query?: unknown): DeviceInfo | undefined {
+    const resolved = this.resolveDevice(query);
+    return "target" in resolved ? resolved.target : undefined;
+  }
+
+  /**
+   * Device resolution with a caller-facing error. Matching order: exact id,
+   * exact name (case-insensitive), then name fragment — with names and
+   * queries compared separator-insensitively ("pixel 10" finds
+   * "Google-Pixel10"). When several devices match, a sole ONLINE match wins
+   * (a stale duplicate registration must not shadow the live device);
+   * otherwise it's an explicit error, never a silent first pick — exec and
+   * file commands aimed at "pixel" must not land on whichever Pixel
+   * happened to register first. No query defaults to the most recently
+   * seen mobile device, then the most recent device overall.
+   */
+  resolveDevice(query?: unknown): { target: DeviceInfo } | { error: string } {
     const devices = this.registry.list().devices;
     if (typeof query === "string" && query.trim()) {
-      const q = query.trim().toLowerCase();
-      return devices.find(
-        (d) => d.id.toLowerCase() === q || d.name.toLowerCase().includes(q),
+      const raw = query.trim();
+      const q = raw.toLowerCase();
+      const byId = devices.find((d) => d.id.toLowerCase() === q);
+      if (byId) return { target: byId };
+      const fold = (s: string): string =>
+        s.toLowerCase().replace(/[^a-z0-9]+/g, "");
+      const folded = fold(raw);
+      const pick = (
+        candidates: DeviceInfo[],
+      ): { target: DeviceInfo } | { error: string } | undefined => {
+        if (candidates.length === 1) return { target: candidates[0]! };
+        if (candidates.length > 1) {
+          const online = candidates.filter((d) => d.online);
+          if (online.length === 1) return { target: online[0]! };
+          return {
+            error: `"${raw}" matches ${candidates.length} devices: ${candidates
+              .map(
+                (d) =>
+                  `${d.name} [id: ${d.id}, ${d.online ? "online" : "offline"}]`,
+              )
+              .join(", ")}. Use the device id or full name.`,
+          };
+        }
+        return undefined;
+      };
+      return (
+        pick(devices.filter((d) => fold(d.name) === folded)) ??
+        (folded
+          ? pick(devices.filter((d) => fold(d.name).includes(folded)))
+          : undefined) ?? { error: this.noSuchDevice(query).text }
       );
     }
-    return devices.find((d) => MOBILE_PLATFORMS.has(d.platform)) ?? devices[0];
+    const fallback =
+      devices.find((d) => MOBILE_PLATFORMS.has(d.platform)) ?? devices[0];
+    return fallback
+      ? { target: fallback }
+      : { error: this.noSuchDevice(query).text };
   }
 
   // ── Formatting ─────────────────────────────────────────────────────────────
@@ -1120,11 +1220,16 @@ function formatExecResult(
   const exit = typeof d.exitCode === "number" ? d.exitCode : "?";
   const stdout = typeof d.stdout === "string" ? d.stdout : "";
   const stderr = typeof d.stderr === "string" ? d.stderr : "";
-  const parts = [`[${device.name}] exit ${exit}`];
+  const via = typeof d.via === "string" && d.via ? ` via ${d.via}` : "";
+  const parts = [`[${device.name}${via}] exit ${exit}`];
   if (stdout.trim())
-    parts.push(`--- stdout ---\n${stdout.replace(/\s+$/, "")}`);
+    parts.push(
+      `--- stdout ---\n${clampExecOutput(stdout.replace(/\s+$/, ""))}`,
+    );
   if (stderr.trim())
-    parts.push(`--- stderr ---\n${stderr.replace(/\s+$/, "")}`);
+    parts.push(
+      `--- stderr ---\n${clampExecOutput(stderr.replace(/\s+$/, ""))}`,
+    );
   if (!stdout.trim() && !stderr.trim()) parts.push("(no output)");
   return parts.join("\n");
 }

package/src/core/mesh/teleport.ts

@@ -1,15 +1,14 @@
 /**
- * Teleport state — the single "active node" the native tools route through.
+ * Teleport state — the active node each chat's native tools route through.
  *
  * When a node is active, Talon's native shell/file tools (bash/read/write/
  * edit/glob/search) execute ON that companion device via the mesh exec/fs
  * channel instead of on the daemon host — Talon acts as if it were running
  * on the phone. `teleport_back` clears it and everything runs locally again.
  *
- * State is a tiny JSON sidecar under the Talon root so it survives restarts
- * and is shared across the process (the native gateway actions read it on
- * every call). Deliberately global, not per-chat: teleport is an operator
- * mode for the whole daemon, matching how Dylan drives a single bot.
+ * State is a tiny JSON sidecar under the Talon root so it survives restarts.
+ * The sidecar is keyed by chat id: teleporting in one chat must not redirect
+ * native tools in another chat.
  */
 
 import { readFile } from "node:fs/promises";
@@ -32,6 +31,10 @@ export type TeleportState = {
   since: number;
 };
 
+type TeleportStore = {
+  chats: Record<string, TeleportState>;
+};
+
 /** Resolved lazily so a test can point it at a tmp file via env. */
 function stateFile(): string {
   return (
@@ -40,34 +43,73 @@ function stateFile(): string {
   );
 }
 
-let cache: TeleportState | null | undefined;
+let cache: TeleportStore | undefined;
 
-/** The active teleport target, or null when operating locally. */
-export async function getTeleport(): Promise<TeleportState | null> {
+function emptyStore(): TeleportStore {
+  return { chats: Object.create(null) as Record<string, TeleportState> };
+}
+
+function normalizeChatId(chatId: number | string): string {
+  return String(chatId);
+}
+
+function parseState(value: unknown): TeleportState | null {
+  const parsed = value as Partial<TeleportState> | null;
+  if (!parsed || typeof parsed.deviceId !== "string" || !parsed.deviceId) {
+    return null;
+  }
+  return {
+    deviceId: parsed.deviceId,
+    deviceName:
+      typeof parsed.deviceName === "string" && parsed.deviceName
+        ? parsed.deviceName
+        : parsed.deviceId,
+    ...(typeof parsed.cwd === "string" ? { cwd: parsed.cwd } : {}),
+    since: typeof parsed.since === "number" ? parsed.since : Date.now(),
+  };
+}
+
+async function readStore(): Promise<TeleportStore> {
   if (cache !== undefined) return cache;
   try {
     const raw = await readFile(stateFile(), "utf8");
-    const parsed = JSON.parse(raw) as Partial<TeleportState>;
-    cache =
-      parsed && typeof parsed.deviceId === "string" && parsed.deviceId
-        ? {
-            deviceId: parsed.deviceId,
-            deviceName:
-              typeof parsed.deviceName === "string" && parsed.deviceName
-                ? parsed.deviceName
-                : parsed.deviceId,
-            ...(typeof parsed.cwd === "string" ? { cwd: parsed.cwd } : {}),
-            since: typeof parsed.since === "number" ? parsed.since : Date.now(),
-          }
-        : null;
+    const parsed = JSON.parse(raw) as unknown;
+    const store = emptyStore();
+    if (
+      parsed &&
+      typeof parsed === "object" &&
+      "chats" in parsed &&
+      parsed.chats &&
+      typeof parsed.chats === "object"
+    ) {
+      for (const [chatId, state] of Object.entries(
+        parsed.chats as Record<string, unknown>,
+      )) {
+        const normalized = parseState(state);
+        if (normalized) store.chats[chatId] = normalized;
+      }
+    } else {
+      // Legacy singleton file from pre-chat-scoped teleport. Keep reading it
+      // harmlessly, but do not bind it to any chat.
+    }
+    cache = store;
   } catch {
-    cache = null;
+    cache = emptyStore();
   }
   return cache;
 }
 
+/** The active teleport target, or null when operating locally. */
+export async function getTeleport(
+  chatId: number | string,
+): Promise<TeleportState | null> {
+  const store = await readStore();
+  return store.chats[normalizeChatId(chatId)] ?? null;
+}
+
 /** Engage teleport onto a device. */
 export async function setTeleport(
+  chatId: number | string,
   deviceId: string,
   deviceName: string,
 ): Promise<TeleportState> {
@@ -76,25 +118,37 @@ export async function setTeleport(
     deviceName,
     since: Date.now(),
   };
-  cache = state;
-  await writePrivateJson(stateFile(), state);
+  const store = await readStore();
+  store.chats[normalizeChatId(chatId)] = state;
+  cache = store;
+  await writePrivateJson(stateFile(), store);
   return state;
 }
 
 /** Persist an updated working directory for the active teleport. */
-export async function setTeleportCwd(cwd: string): Promise<void> {
-  const current = await getTeleport();
+export async function setTeleportCwd(
+  chatId: number | string,
+  cwd: string,
+): Promise<void> {
+  const current = await getTeleport(chatId);
   if (!current) return;
   const next: TeleportState = { ...current, cwd };
-  cache = next;
-  await writePrivateJson(stateFile(), next);
+  const store = await readStore();
+  store.chats[normalizeChatId(chatId)] = next;
+  cache = store;
+  await writePrivateJson(stateFile(), store);
 }
 
 /** Return to local operation. Returns the prior target (for the message). */
-export async function clearTeleport(): Promise<TeleportState | null> {
-  const prior = await getTeleport();
-  cache = null;
-  await writePrivateJson(stateFile(), null);
+export async function clearTeleport(
+  chatId: number | string,
+): Promise<TeleportState | null> {
+  const store = await readStore();
+  const key = normalizeChatId(chatId);
+  const prior = store.chats[key] ?? null;
+  delete store.chats[key];
+  cache = store;
+  await writePrivateJson(stateFile(), store);
   return prior;
 }
 

package/src/core/tools/mesh.ts

@@ -12,7 +12,7 @@ const deviceParam = z
   .string()
   .optional()
   .describe(
-    "Device id or part of the device name (see list_devices). Defaults to the most recently seen mobile mesh device.",
+    "Device id, exact name, or unique name fragment (case/separator-insensitive; see list_devices). A fragment matching several devices errors unless exactly one is online — prefer the id when duplicates exist. Defaults to the most recently seen mobile mesh device.",
   );
 
 export const meshTools: ToolDefinition[] = [

package/src/core/tools/native.ts

@@ -21,7 +21,7 @@ export const nativeTools: ToolDefinition[] = [
         .string()
         .optional()
         .describe(
-          "Device id or name fragment (see list_devices). Defaults to the most recent mobile device.",
+          "Device id, exact name, or unique name fragment (case/separator-insensitive; see list_devices). Ambiguous fragments error unless exactly one match is online — prefer the id when duplicates exist. Defaults to the most recent mobile device.",
         ),
     },
     execute: (params, bridge) => bridge("teleport", params),

package/src/frontend/discord/commands/admin.ts

@@ -9,7 +9,7 @@ import type { Gateway } from "../../../core/engine/gateway.js";
 import { respawnSelf } from "../../../util/respawn.js";
 import { forceDream } from "../../../core/background/dream.js";
 import { formatDuration, renderMetricsMessages } from "../helpers.js";
-import { getMetrics } from "../../../util/metrics.js";
+import { getMetrics, getTodayMetrics } from "../../../util/metrics.js";
 import { handleAdminSubcommand } from "../admin.js";
 import { isAdmin } from "../handlers/index.js";
 import { suppressMentions, DISCORD_MAX_TEXT } from "../formatting.js";
@@ -35,7 +35,14 @@ export async function handleMetrics(
   }
   // Ephemeral — admin counters (token usage, latencies, errors) shouldn't leak
   // into a public channel where non-admins can read them.
-  const messages = renderMetricsMessages(getMetrics());
+  const messages = [
+    ...renderMetricsMessages(getMetrics()),
+    ...renderMetricsMessages(
+      getTodayMetrics(),
+      undefined,
+      "📊 Metrics — today (UTC)",
+    ),
+  ];
   for (const m of messages) {
     await reply(i, m, true);
   }

package/src/frontend/discord/helpers.ts

@@ -35,7 +35,7 @@ type MetricsSnapshot = {
   counters: Record<string, number>;
   histograms: Record<
     string,
-    { count: number; p50: number; p95: number; p99: number; avg: number }
+    { count: number; avg: number; min: number; max: number }
   >;
 };
 
@@ -50,14 +50,15 @@ function truncateMetricLabel(label: string, max = 60): string {
 export function renderMetricsMessages(
   metrics: MetricsSnapshot,
   maxLen = DEFAULT_METRICS_MESSAGE_MAX,
+  title = "📊 Metrics",
 ): string[] {
-  const firstHeader = "**📊 Metrics**";
-  const continuationHeader = "**📊 Metrics (cont.)**";
+  const firstHeader = `**${title}**`;
+  const continuationHeader = `**${title} (cont.)**`;
   const sections: string[][] = [];
 
   // Histograms come in two flavours: durations (keys ending in `_ms`,
   // rendered as human times) and plain counts like `tool_calls_per_turn`
-  // (rendered as bare numbers — "p50=1ms" for a count is nonsense).
+  // (rendered as bare numbers — "min=1ms" for a count is nonsense).
   const histKeys = Object.keys(metrics.histograms).sort();
   const durationKeys = histKeys.filter((key) => key.endsWith("_ms"));
   const countKeys = histKeys.filter((key) => !key.endsWith("_ms"));
@@ -65,8 +66,8 @@ export function renderMetricsMessages(
     const h = metrics.histograms[key];
     return (
       `  \`${truncateMetricLabel(key)}\`  n=${h.count} ` +
-      `p50=${fmt(h.p50)}  p95=${fmt(h.p95)} ` +
-      `p99=${fmt(h.p99)}  avg=${fmt(h.avg)}`
+      `avg=${fmt(h.avg)}  min=${fmt(h.min)} ` +
+      `max=${fmt(h.max)}`
     );
   };
   if (durationKeys.length > 0) {

package/src/frontend/native/chats.ts

@@ -15,7 +15,7 @@ import {
 import {
   getAllSessions,
   setSessionName,
-  resetSession,
+  deleteSession,
 } from "../../storage/sessions.js";
 import { getRecentHistory, clearHistory } from "../../storage/history.js";
 import { previewOf } from "./protocol.js";
@@ -125,7 +125,7 @@ export class NativeChats {
     if (!entry) return false;
     this.byId.delete(id);
     this.byNum.delete(entry.numericId);
-    resetSession(id);
+    deleteSession(id);
     clearHistory(id);
     return true;
   }

package/src/frontend/telegram/commands/admin.ts

@@ -23,7 +23,7 @@ import {
 } from "../helpers/index.js";
 import { collectDoctorReport } from "../../../core/doctor.js";
 import { handleAdminCommand } from "../admin.js";
-import { getMetrics } from "../../../util/metrics.js";
+import { getMetrics, getTodayMetrics } from "../../../util/metrics.js";
 import { isAuthorizedAdmin, type RegisterDeps } from "./state.js";
 import { telegramCommandMenu } from "./definitions.js";
 
@@ -44,7 +44,15 @@ export function registerAdminCommands(
       await ctx.reply("Not authorized.");
       return;
     }
-    for (const message of renderMetricsMessages(getMetrics())) {
+    const messages = [
+      ...renderMetricsMessages(getMetrics()),
+      ...renderMetricsMessages(
+        getTodayMetrics(),
+        undefined,
+        "📊 Metrics — today (UTC)",
+      ),
+    ];
+    for (const message of messages) {
       await ctx.reply(message, { parse_mode: "HTML" });
     }
   });

package/src/frontend/telegram/helpers/diagnostics.ts

@@ -12,7 +12,7 @@ type MetricsSnapshot = {
   counters: Record<string, number>;
   histograms: Record<
     string,
-    { count: number; p50: number; p95: number; p99: number; avg: number }
+    { count: number; avg: number; min: number; max: number }
   >;
 };
 
@@ -23,14 +23,15 @@ function truncateMetricLabel(label: string, max = 80): string {
 export function renderMetricsMessages(
   metrics: MetricsSnapshot,
   maxLen = DEFAULT_METRICS_MESSAGE_MAX,
+  title = "📊 Metrics",
 ): string[] {
-  const firstHeader = "<b>📊 Metrics</b>";
-  const continuationHeader = "<b>📊 Metrics (cont.)</b>";
+  const firstHeader = `<b>${escapeHtml(title)}</b>`;
+  const continuationHeader = `<b>${escapeHtml(title)} (cont.)</b>`;
   const sections: string[][] = [];
 
   // Histograms come in two flavours: durations (keys ending in `_ms`,
   // rendered as human times) and plain counts like `tool_calls_per_turn`
-  // (rendered as bare numbers — "p50=1ms" for a count is nonsense).
+  // (rendered as bare numbers — "min=1ms" for a count is nonsense).
   const histKeys = Object.keys(metrics.histograms).sort();
   const durationKeys = histKeys.filter((key) => key.endsWith("_ms"));
   const countKeys = histKeys.filter((key) => !key.endsWith("_ms"));
@@ -38,8 +39,8 @@ export function renderMetricsMessages(
     const h = metrics.histograms[key];
     return (
       `  <code>${escapeHtml(truncateMetricLabel(key))}</code>  n=${h.count} ` +
-      `p50=${fmt(h.p50)}  p95=${fmt(h.p95)} ` +
-      `p99=${fmt(h.p99)}  avg=${fmt(h.avg)}`
+      `avg=${fmt(h.avg)}  min=${fmt(h.min)} ` +
+      `max=${fmt(h.max)}`
     );
   };
   if (durationKeys.length > 0) {

package/src/storage/db.ts

@@ -68,7 +68,7 @@ let db: SqlDatabase | null = null;
  *
  * Column reconciliation runs first: `ALTER TABLE … ADD COLUMN` has no
  * IF NOT EXISTS form, so columns added to already-shipped tables
- * (media_index.content_hash) are ensured by attempting the ALTER and
+ * (media_index.content_hash, sessions.metrics) are ensured by attempting the ALTER and
  * swallowing the two expected failures — "duplicate column name"
  * (column already there) and "no such table" (fresh database; the
  * CREATE TABLE in schema.sql includes the column).
@@ -84,6 +84,11 @@ function ensureSchema(database: SqlDatabase): void {
   } catch {
     /* duplicate column or no such table — both mean nothing to do */
   }
+  try {
+    database.exec(dbSql.addSessionsMetricsColumn);
+  } catch {
+    /* duplicate column or no such table — both mean nothing to do */
+  }
   database.exec("BEGIN");
   try {
     database.exec(SCHEMA);