talon-agent 3.8.0 → 3.8.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "talon-agent",
-  "version": "3.8.0",
+  "version": "3.8.1",
   "description": "Multi-frontend AI agent with full tool access, streaming, cron jobs, and plugin system",
   "author": "Dylan Neve",
   "license": "MIT",

package/src/backend/codex/handler/message.ts

@@ -29,7 +29,6 @@ import {
   recordTokens,
   finalizeResponseText,
   formatUserPrompt,
-  formatPromptWithRetrievedMemory,
   prepareSystemPrompt,
   extractSessionName,
   summarizeUsage,
@@ -259,18 +258,12 @@ export async function handleMessage(
     sessionEpoch: session.createdAt,
   });
 
-  // Retrieved memory wraps the FORMATTED live prompt (Phase B): it stays
-  // outside the frozen system prompt, so the first-turn concatenation below
-  // keeps the boundary "cached systemPrompt, separator, live prompt wrapper".
-  const prompt = formatPromptWithRetrievedMemory(
-    formatUserPrompt({
-      text,
-      senderName: senderName ?? "user",
-      isGroup,
-      messageId,
-    }),
-    params.retrievedMemory,
-  );
+  const prompt = formatUserPrompt({
+    text,
+    senderName: senderName ?? "user",
+    isGroup,
+    messageId,
+  });
 
   log("agent", `[${chatId}] <- (${text.length} chars)`);
   traceMessage(chatId, "in", text, { senderName, isGroup });

package/src/backend/opencode/handler/message.ts

@@ -39,7 +39,6 @@ import {
   recordTokens,
   finalizeResponseText,
   formatUserPrompt,
-  formatPromptWithRetrievedMemory,
   prepareSystemPrompt,
   extractSessionName,
   summarizeUsage,
@@ -90,18 +89,13 @@ export async function handleMessage(
   await ensureChatMcpServer(oc, chatId);
   await ensurePluginMcpServers(oc, chatId);
 
-  // Build the prompt (time tag + sender + msg_id reference), then wrap it
-  // with any retrieved memory (Phase B). The wrapper goes into the live user
-  // part only — `system` below stays byte-identical to the prepared prompt.
-  const prompt = formatPromptWithRetrievedMemory(
-    formatUserPrompt({
-      text,
-      senderName: senderName ?? "user",
-      isGroup,
-      messageId,
-    }),
-    params.retrievedMemory,
-  );
+  // Build the prompt (time tag + sender + msg_id reference)
+  const prompt = formatUserPrompt({
+    text,
+    senderName: senderName ?? "user",
+    isGroup,
+    messageId,
+  });
 
   // Per-session frozen prompt + OpenCode-specific delivery suffix
   const { text: systemPrompt } = prepareSystemPrompt({

package/src/backend/shared/handler-to-events.ts

@@ -84,7 +84,6 @@ export async function* handlerToEvents(
     senderName: params.senderName,
     isGroup: params.isGroup,
     messageId: params.messageId,
-    retrievedMemory: params.retrievedMemory,
     onStreamDelta: (accumulated) => {
       if (typeof accumulated !== "string" || accumulated.length === 0) {
         return;

package/src/backend/shared/handler-types.ts

@@ -17,8 +17,6 @@
 
 // ── Query lifecycle (backend-internal) ──────────────────────────────────────
 
-import type { RetrievedMemory } from "../../core/agent-runtime/capabilities.js";
-
 /** Parameters for a backend AI query. */
 export type QueryParams = {
   chatId: string;
@@ -35,12 +33,6 @@ export type QueryParams = {
    * Provider message ID. Telegram is numeric; Discord snowflakes are strings.
    */
   messageId?: number | string;
-  /**
-   * Optional pre-retrieved memory slice for this turn (Phase B). Handlers
-   * fold it into the live user prompt via `formatPromptWithRetrievedMemory`;
-   * it must never reach `prepareSystemPrompt()` or a backend `system` field.
-   */
-  retrievedMemory?: RetrievedMemory;
   onStreamDelta?: (accumulated: string, phase?: "thinking" | "text") => void;
   onTextBlock?: (text: string) => Promise<void>;
   /**

package/src/backend/shared/index.ts

@@ -47,12 +47,7 @@ export {
 
 export { registerTurnInterrupt, interruptChatTurn } from "./turn-interrupt.js";
 
-export {
-  formatUserPrompt,
-  formatPromptWithRetrievedMemory,
-  RETRIEVED_MEMORY_DEFAULT_MAX_CHARS,
-  type PromptFormatInputs,
-} from "./prompt-format.js";
+export { formatUserPrompt, type PromptFormatInputs } from "./prompt-format.js";
 
 export {
   buildDeliveryContract,

package/src/backend/shared/prompt-format.ts

@@ -15,7 +15,6 @@
  *   DM (no msg_id): "[2026-05-15 11:01:23] actual text"
  */
 
-import type { RetrievedMemory } from "../../core/agent-runtime/capabilities.js";
 import { formatFullDatetime } from "../../util/time.js";
 
 // ── Public API ──────────────────────────────────────────────────────────────
@@ -62,74 +61,6 @@ export function formatUserPrompt(inputs: PromptFormatInputs): string {
   return joinNonEmpty(timeTag, inputs.text);
 }
 
-// ── Retrieved-memory wrapper (Phase B pre-retrieval) ────────────────────────
-
-/** Default hard cap on the injected memory block, provenance labels included. */
-export const RETRIEVED_MEMORY_DEFAULT_MAX_CHARS = 3000;
-
-/**
- * Wrap an already-formatted live user prompt with a bounded retrieved-memory
- * block. This is the ONLY place retrieved memory enters a prompt, and it
- * wraps the whole `formatUserPrompt(...)` output rather than rebuilding its
- * internals — the existing sender/time/msg_id wrapper stays intact inside the
- * `User message:` section.
- *
- * Contract (see docs/memory-phase-b-pre-retrieval.md):
- *   - `memory` undefined or empty items → the prompt is returned
- *     BYTE-IDENTICAL. Prompt-cache and prompt-format tests stay valid.
- *   - Non-empty → emit `Relevant memory:` with one provenance-labelled line
- *     per item, a blank line, `User message:`, then the original prompt.
- *   - The memory block (labels included) is capped at `maxChars`; item text
- *     is truncated deterministically with an ellipsis marker. The user
- *     message itself is NEVER dropped or truncated.
- *   - This block is dynamic turn context: callers must keep it out of
- *     `prepareSystemPrompt()`, prompt additions, and backend `system` fields.
- */
-export function formatPromptWithRetrievedMemory(
-  prompt: string,
-  memory?: RetrievedMemory,
-  maxChars: number = RETRIEVED_MEMORY_DEFAULT_MAX_CHARS,
-): string {
-  if (!memory || memory.items.length === 0) return prompt;
-
-  const header = "Relevant memory:";
-  const footer = "User message:";
-  // Budget applies to the memory block only (header + item lines), so the
-  // user message can never be squeezed out.
-  let budget = Math.max(0, maxChars) - header.length - 1; // "\n" after header
-  const lines: string[] = [];
-  for (const item of memory.items) {
-    const label = provenanceLabel(item.wing, item.room, item.sourceFile);
-    const prefix = `- ${label} `;
-    if (prefix.length >= budget) break;
-    const text = sanitizeInline(item.text);
-    const room = budget - prefix.length - 1; // "\n" for this line
-    const body =
-      text.length <= room ? text : `${text.slice(0, Math.max(0, room - 1))}…`;
-    if (body.length === 0) break;
-    const line = `${prefix}${body}`;
-    lines.push(line);
-    budget -= line.length + 1;
-  }
-  if (lines.length === 0) return prompt;
-
-  return `${header}\n${lines.join("\n")}\n\n${footer}\n${prompt}`;
-}
-
-function provenanceLabel(
-  wing: string,
-  room?: string,
-  sourceFile?: string,
-): string {
-  const path = room ? `${wing}/${room}` : wing;
-  return sourceFile ? `[${path} ${sourceFile}]` : `[${path}]`;
-}
-
-/** Collapse newlines/control whitespace so one item stays one labelled line. */
-function sanitizeInline(text: string): string {
-  return text.replace(/\s+/g, " ").trim();
-}
-
 // ── Helpers ─────────────────────────────────────────────────────────────────
 
 function joinNonEmpty(...parts: string[]): string {

package/src/core/agent-runtime/capabilities.ts

@@ -35,54 +35,16 @@ import type {
 
 // ── Run parameters ──────────────────────────────────────────────────────────
 
-/**
- * Provenance trust level of a retrieved memory item, per the memory-poisoning
- * threat model (#373). Only the first three levels are ever eligible for
- * automatic injection; `user_claim` and `group_chat` content must stay
- * pull-only (explicit search), never auto-injected.
- */
-export type RetrievedMemoryTrustLevel =
-  | "dylan_direct" // stated by the operator in a verified DM
-  | "bot_inferred" // inferred by the bot from code/docs/verified primary source
-  | "heartbeat_synthesis" // synthesized in a background run, no external input
-  | "user_claim" // claimed by a non-operator user, unverified
-  | "group_chat"; // sourced from group chat content
-
-/** One retrieved memory fragment with its provenance. */
-export interface RetrievedMemoryItem {
-  /** Palace wing (top-level category), e.g. "technical". */
-  wing: string;
-  /** Palace room within the wing, when known. */
-  room?: string;
-  /** Source file locator, when known (e.g. "memory-phase-b.md"). */
-  sourceFile?: string;
-  /** The retrieved text fragment. */
-  text: string;
-  /** Retrieval relevance score, when the retriever provides one. */
-  score?: number;
-  /** Provenance trust level; absent means unknown (treat as untrusted). */
-  trustLevel?: RetrievedMemoryTrustLevel;
-}
-
-/**
- * A bounded, sanitized slice of long-term memory retrieved for one turn.
- * This is DYNAMIC turn context: it is injected into the live user prompt by
- * the backend prompt formatter and must never enter `prepareSystemPrompt()`
- * output, frozen prompt snapshots, plugin prompt additions, or backend
- * `system` fields — that would break the prompt-cache contract.
- */
-export interface RetrievedMemory {
-  source: "mempalace";
-  /** The (possibly trimmed) query the retriever ran. */
-  query: string;
-  items: RetrievedMemoryItem[];
-}
-
 /**
  * Parameters for a chat turn. `model` is a resolved `ModelRef`,
  * carrying everything the backend needs to identify the model and
  * render the resulting reply. Streaming callbacks aren't part of
  * this shape — backends emit `AgentEvent`s.
+ *
+ * Long-term memory is deliberately NOT part of this shape. `memory.md` is
+ * loaded once into the cached system prompt (`core/prompt/assemble.ts`);
+ * anything deeper the model searches for itself with the MemPalace tools.
+ * Nothing is auto-injected into a turn.
  */
 export interface ChatRunParams {
   chatId: string;
@@ -92,12 +54,6 @@ export interface ChatRunParams {
   isGroup?: boolean;
   /** Provider message ID. Telegram is numeric; Discord snowflakes are strings. */
   messageId?: number | string;
-  /**
-   * Optional pre-retrieved memory slice for this turn. Backends fold it into
-   * the live user prompt (after the cached system prompt), never into
-   * `system` — see `formatPromptWithRetrievedMemory`.
-   */
-  retrievedMemory?: RetrievedMemory;
 }
 
 // ── Catalog types ───────────────────────────────────────────────────────────

package/src/core/errors.ts

@@ -60,6 +60,68 @@ export class TalonError extends Error {
   }
 }
 
+// ── Transport-failure detection ─────────────────────────────────────────────
+
+/**
+ * Node / undici error codes that mean "the connection failed, try again".
+ *
+ * Codes beat message text: they're stable across Node versions and
+ * locales, and undici in particular throws bare `TypeError: terminated`
+ * / `TypeError: fetch failed` whose message says nothing while the
+ * `code` on the cause chain says everything.
+ *
+ * `ENOTFOUND` is deliberately absent — a DNS name that doesn't resolve
+ * is a config error, not a blip. `EAI_AGAIN` (temporary resolver
+ * failure) IS here, because that one does clear.
+ */
+const RETRYABLE_TRANSPORT_CODES: ReadonlySet<string> = new Set([
+  "ECONNRESET",
+  "ECONNREFUSED",
+  "ECONNABORTED",
+  "EPIPE",
+  "ETIMEDOUT",
+  "EHOSTUNREACH",
+  "ENETUNREACH",
+  "ENETDOWN",
+  "EAI_AGAIN",
+  "UND_ERR_CONNECT_TIMEOUT",
+  "UND_ERR_HEADERS_TIMEOUT",
+  "UND_ERR_BODY_TIMEOUT",
+  "UND_ERR_SOCKET",
+  "ERR_STREAM_PREMATURE_CLOSE",
+  "ERR_SOCKET_CONNECTION_TIMEOUT",
+]);
+
+/**
+ * Transient transport failures that surface as prose with no usable
+ * `code` — Node's own `socket hang up`, undici's `other side closed` /
+ * `Premature close`, and the named 5xx bodies proxies return as text.
+ *
+ * `timeout`/`timed out` is here but bare `abort` deliberately is NOT: a
+ * user interrupt (`controller.abort()` → "This operation was aborted")
+ * must stay non-retryable, or cancelling a turn would restart it.
+ * `AbortSignal.timeout()` says "aborted due to timeout" and is caught by
+ * the timeout half, which is the distinction we want.
+ */
+const TRANSIENT_TRANSPORT_RE =
+  /socket hang up|other side closed|premature close|connection (?:closed|reset|lost)|timed out|time-?out|bad gateway|service unavailable|gateway time-?out|internal server error|upstream connect error|server disconnected/i;
+
+/**
+ * Walk the `cause` chain collecting `code` / `errno` / `name` values.
+ * undici nests the real fault one or two levels down (`TypeError: fetch
+ * failed` → `cause: Error { code: 'ECONNREFUSED' }`), so a shallow look
+ * at the thrown object misses it entirely.
+ */
+function errorCodes(err: unknown, depth = 0): string[] {
+  if (depth > 5 || err === null || typeof err !== "object") return [];
+  const e = err as { code?: unknown; errno?: unknown; cause?: unknown };
+  const codes: string[] = [];
+  if (typeof e.code === "string") codes.push(e.code);
+  if (typeof e.errno === "string") codes.push(e.errno);
+  codes.push(...errorCodes(e.cause, depth + 1));
+  return codes;
+}
+
 // ── Classify any error ──────────────────────────────────────────────────────
 
 /**
@@ -115,6 +177,27 @@ export function classify(err: unknown): TalonError {
     });
   }
 
+  // Transport failure by CODE, before any prose matching. undici wraps
+  // the real fault ("TypeError: fetch failed" → cause.code) so the
+  // message alone is often empty of signal while the code is decisive.
+  //
+  // `TimeoutError` (what AbortSignal.timeout throws) is a transient
+  // deadline and retries. `AbortError` is NOT handled here on purpose —
+  // it means a user interrupt, and retrying a cancelled turn would
+  // restart work the user just stopped.
+  const errName = err instanceof Error ? err.name : "";
+  const transportCode = errorCodes(err).find((code) =>
+    RETRYABLE_TRANSPORT_CODES.has(code),
+  );
+  if (transportCode !== undefined || errName === "TimeoutError") {
+    return new TalonError(msg, {
+      reason: "network",
+      retryable: true,
+      retryAfterMs: 2_000,
+      cause,
+    });
+  }
+
   // Overloaded / capacity
   if (/overloaded|503|capacity/i.test(msg)) {
     return new TalonError(msg, {
@@ -126,11 +209,19 @@ export function classify(err: unknown): TalonError {
     });
   }
 
-  // Network errors
+  // Network errors — codes echoed into the message text (a stringified
+  // cause, a provider wrapping the errno into prose), plus the
+  // code-less transient shapes in TRANSIENT_TRANSPORT_RE.
+  //
+  // The prose half only applies when NO HTTP status was found. A real
+  // status is the stronger signal and its own branches below own it:
+  // "500 Internal Server Error" must stay `overloaded` carrying
+  // status 500, not become a status-less `network`.
   if (
-    /network|ECONNREFUSED|ECONNRESET|ECONNABORTED|ETIMEDOUT|ENOTFOUND|fetch failed|connection reset/i.test(
+    /network|ECONNREFUSED|ECONNRESET|ECONNABORTED|ETIMEDOUT|ENOTFOUND|EAI_AGAIN|EPIPE|UND_ERR_|fetch failed|connection reset/i.test(
       msg,
-    )
+    ) ||
+    (status === undefined && TRANSIENT_TRANSPORT_RE.test(msg))
   ) {
     return new TalonError(msg, {
       reason: "network",
@@ -140,6 +231,19 @@ export function classify(err: unknown): TalonError {
     });
   }
 
+  // 408 Request Timeout — a transient deadline like any other, but it
+  // is neither 4xx-terminal nor 5xx, so it used to fall through to
+  // `unknown`/non-retryable and strand the request.
+  if (status === 408) {
+    return new TalonError(msg, {
+      reason: "network",
+      retryable: true,
+      status: 408,
+      retryAfterMs: 2_000,
+      cause,
+    });
+  }
+
   // Session expired
   if (/session.*expired|expired.*session|invalid.*resume/i.test(msg)) {
     return new TalonError(msg, {

package/src/core/weaver/index.ts

@@ -3,7 +3,6 @@ export { ThreadSession, type SessionSummary } from "./thread-session.js";
 export { Loom, type ContextRegistry } from "./loom.js";
 export { carryTurnEvents, type EventSink } from "./shuttle.js";
 export { startTypingLoop, TYPING_REFRESH_MS } from "./typing-loop.js";
-export { prefetchMemory } from "./memory-prefetch.js";
 export {
   resolveWarp,
   type WarpResolution,

package/src/core/weaver/weaver.ts

@@ -7,8 +7,6 @@
  *     null-model guard and per-run override fallback;
  *   - `startTypingLoop` (typing-loop.ts) — keeps the frontend's typing
  *     indicator alive for the duration of the turn;
- *   - `prefetchMemory` (memory-prefetch.ts) — optional fail-closed
- *     palace pre-retrieval for live user messages;
  *   - `carryTurnEvents` (shuttle.ts) — pumps the backend's AgentEvent
  *     stream into the frontend sink, settles delivery acks, captures
  *     the result and rethrows error terminators.
@@ -22,13 +20,11 @@ import { randomBytes } from "node:crypto";
 import type { Backend } from "../agent-runtime/capabilities.js";
 import type { AgentResult } from "../agent-runtime/events.js";
 import type { ModelRef } from "../agent-runtime/model-ref.js";
-import type { MemoryRetriever } from "../memory/retrieval.js";
 import type { ContextManager, ExecuteParams, ExecuteResult } from "../types.js";
 import { bus } from "../bus/index.js";
 import { taskTable, type TaskHandle } from "../tasks/index.js";
 import { log, logDebug, logWarn } from "../../util/log.js";
 import { Loom } from "./loom.js";
-import { prefetchMemory } from "./memory-prefetch.js";
 import { carryTurnEvents } from "./shuttle.js";
 import type { Thread, ThreadSnapshot } from "./thread.js";
 import { startTypingLoop } from "./typing-loop.js";
@@ -52,13 +48,6 @@ export type WeaverDeps = {
   ) => Promise<ModelRef | null>;
   context: ContextManager;
   sendTyping: (chatId: number, stringId?: string) => Promise<void>;
-  /**
-   * Optional memory pre-retrieval (Phase B). Called for `source: "message"`
-   * turns after model/backend resolution and context acquisition, before
-   * `runChatTurn(...)`. Fail-closed: errors are logged and the turn runs
-   * without injected memory. Absent dep ⇒ prompts byte-identical to before.
-   */
-  retrieveMemory?: MemoryRetriever;
 };
 
 export class Weaver {
@@ -163,7 +152,7 @@ export class Weaver {
     params: ExecuteParams,
     task: TaskHandle,
   ): Promise<ExecuteResult> {
-    const { context, retrieveMemory } = this.deps;
+    const { context } = this.deps;
     const backend = this.deps.getBackend(params.chatId);
     const reqId = randomBytes(4).toString("hex");
 
@@ -237,17 +226,6 @@ export class Weaver {
         );
       }
 
-      const retrievedMemory =
-        retrieveMemory && params.source === "message"
-          ? await prefetchMemory(retrieveMemory, {
-              chatId: params.chatId,
-              text: params.prompt,
-              senderName: params.senderName,
-              isGroup: params.isGroup,
-              reqId,
-            })
-          : undefined;
-
       const stream = backend.chat.runChatTurn({
         chatId: params.chatId,
         model: warp.ref,
@@ -255,7 +233,6 @@ export class Weaver {
         senderName: params.senderName,
         isGroup: params.isGroup,
         messageId: params.messageId,
-        retrievedMemory,
       });
       const agentResult = await carryTurnEvents(stream, params.onEvent);
 

package/src/frontend/telegram/callbacks/index.ts

@@ -7,6 +7,7 @@
  *   - `settings` — `settings:*` (effort/proactive + stale-picker handling)
  *   - `pulse`    — `pulse:*`
  *   - `effort`   — `effort:*`
+ *   - `metrics`  — `metrics:*` (today ↔ all-time panel grain)
  *   - `model`    — `model:*` (menu / backend / browse controller)
  *
  * `registerCallbacks` installs one `callback_query:data` listener that
@@ -22,6 +23,7 @@ import type { CallbackDeps } from "./shared.js";
 import { handleSettingsCallback } from "./settings.js";
 import { handlePulseCallback } from "./pulse.js";
 import { handleEffortCallback } from "./effort.js";
+import { handleMetricsCallback } from "./metrics.js";
 import { handleModelCallback } from "./model.js";
 
 export { answerCallbackQuerySafe } from "./shared.js";
@@ -56,6 +58,12 @@ export function registerCallbacks(
       return;
     }
 
+    // Handle /metrics grain switching (today ↔ all time).
+    if (data.startsWith("metrics:")) {
+      await handleMetricsCallback(ctx, data);
+      return;
+    }
+
     // Handle /model callbacks via the pure parser + menu controller.
     if (data.startsWith("model:")) {
       await handleModelCallback(ctx, data, cid, deps);

package/src/frontend/telegram/callbacks/metrics.ts

@@ -0,0 +1,36 @@
+/**
+ * `metrics:*` callbacks — swap the /metrics panel between the today and
+ * all-time grains by editing the message in place.
+ *
+ * Admin-gated like the command that posts the panel: in a group chat the
+ * buttons sit on a message anyone can tap.
+ */
+
+import type { Context } from "grammy";
+import { getMetrics, getTodayMetrics } from "../../../util/metrics.js";
+import {
+  renderMetricsKeyboard,
+  renderMetricsPanel,
+  type MetricsView,
+} from "../helpers/index.js";
+import { isAuthorizedAdmin } from "../commands/state.js";
+import { answerCallbackQuerySafe, editOrIgnoreSame } from "./shared.js";
+
+export async function handleMetricsCallback(
+  ctx: Context,
+  data: string,
+): Promise<void> {
+  if (!isAuthorizedAdmin(ctx)) {
+    await answerCallbackQuerySafe(ctx, { text: "Not authorized." });
+    return;
+  }
+
+  const view: MetricsView = data === "metrics:all" ? "all" : "today";
+  await answerCallbackQuerySafe(ctx);
+  const metrics = view === "all" ? getMetrics() : getTodayMetrics();
+  await editOrIgnoreSame(
+    ctx,
+    renderMetricsPanel(metrics, view),
+    renderMetricsKeyboard(view),
+  );
+}

package/src/frontend/telegram/commands/admin.ts

@@ -19,11 +19,12 @@ import { closestMatch } from "../../../native/strsim.js";
 import {
   formatDuration,
   renderDoctorMessage,
-  renderMetricsMessages,
+  renderMetricsKeyboard,
+  renderMetricsPanel,
 } from "../helpers/index.js";
 import { collectDoctorReport } from "../../../core/doctor.js";
 import { handleAdminCommand } from "../admin.js";
-import { getMetrics, getTodayMetrics } from "../../../util/metrics.js";
+import { getTodayMetrics } from "../../../util/metrics.js";
 import { isAuthorizedAdmin, type RegisterDeps } from "./state.js";
 import { telegramCommandMenu } from "./definitions.js";
 
@@ -44,17 +45,12 @@ export function registerAdminCommands(
       await ctx.reply("Not authorized.");
       return;
     }
-    const messages = [
-      ...renderMetricsMessages(getMetrics()),
-      ...renderMetricsMessages(
-        getTodayMetrics(),
-        undefined,
-        "📊 Metrics — today (UTC)",
-      ),
-    ];
-    for (const message of messages) {
-      await ctx.reply(message, { parse_mode: "HTML" });
-    }
+    // One message, two grains. Today opens first — it is the smaller,
+    // more actionable view; All time is a tap away on the same message.
+    await ctx.reply(renderMetricsPanel(getTodayMetrics(), "today"), {
+      parse_mode: "HTML",
+      reply_markup: { inline_keyboard: renderMetricsKeyboard("today") },
+    });
   });
 
   bot.command("doctor", async (ctx) => {

package/src/frontend/telegram/commands/info.ts

@@ -5,7 +5,7 @@
 import type { Bot } from "grammy";
 import { isUserClientReady } from "../userbot.js";
 import { escapeHtml } from "../formatting.js";
-import { formatDuration } from "../helpers/index.js";
+import { formatDuration, renderMeshReport } from "../helpers/index.js";
 import { getLoadedPlugins } from "../../../core/plugin/index.js";
 import { getMeshService } from "../../../core/mesh/index.js";
 import type { MeshPingResult } from "../../../core/mesh/service.js";
@@ -104,7 +104,7 @@ export function registerInfoCommands(bot: Bot): void {
   });
 
   bot.command("mesh", async (ctx) => {
-    const sent = await ctx.reply("🛰️ Pinging mesh devices…");
+    const sent = await ctx.reply("Pinging mesh devices…");
     let results: MeshPingResult[];
     try {
       results = await getMeshService().pingAll();
@@ -117,33 +117,11 @@ export function registerInfoCommands(bot: Bot): void {
       );
       return;
     }
-    if (results.length === 0) {
-      await editOrReply(
-        bot,
-        ctx.chat.id,
-        sent.message_id,
-        "<b>🛰️ Mesh</b>\n\nNo devices have registered yet.",
-      );
-      return;
-    }
-    // Online (reachable first, by latency) before offline; a stable, useful
-    // order for a glance at the fleet.
-    const sorted = [...results].sort((a, b) => {
-      if (a.device.online !== b.device.online) return a.device.online ? -1 : 1;
-      return (a.latencyMs ?? Infinity) - (b.latencyMs ?? Infinity);
-    });
-    const online = results.filter((r) => r.device.online).length;
-    const reachable = results.filter((r) => r.reachable).length;
-    const lines = sorted.map((r) => meshLine(r));
     await editOrReply(
       bot,
       ctx.chat.id,
       sent.message_id,
-      [
-        `<b>🛰️ Mesh</b> — ${results.length} device(s), ${online} online, ${reachable} responding`,
-        "",
-        ...lines,
-      ].join("\n"),
+      renderMeshReport(results),
     );
   });
 
@@ -171,25 +149,6 @@ export function registerInfoCommands(bot: Bot): void {
   });
 }
 
-/** One `/mesh` line: presence + reachability + latency + platform. */
-function meshLine(r: MeshPingResult): string {
-  const d = r.device;
-  const dot = r.reachable ? "🟢" : d.online ? "🟡" : "⚪";
-  const name = `<b>${escapeHtml(d.name)}</b>`;
-  const bits: string[] = [`${d.platform}`];
-  if (r.reachable && typeof r.latencyMs === "number") {
-    bits.push(`${r.latencyMs}ms`);
-  } else if (d.online && r.error) {
-    bits.push(escapeHtml(r.error));
-  } else if (!d.online) {
-    bits.push(`offline, last seen ${formatDuration(Date.now() - d.lastSeen)}`);
-  }
-  if (typeof d.battery === "number") {
-    bits.push(`${d.battery}%${d.charging ? "⚡" : ""}`);
-  }
-  return `${dot} ${name} — ${bits.join(" · ")}`;
-}
-
 /** Edit the placeholder in place, falling back to a fresh reply. */
 async function editOrReply(
   bot: Bot,

package/src/frontend/telegram/helpers/diagnostics.ts

@@ -1,13 +1,24 @@
 /**
- * Metrics + doctor report rendering for Telegram (HTML messages).
+ * Metrics, doctor, and mesh report rendering for Telegram (HTML messages).
  */
 
 import { escapeHtml } from "../formatting.js";
 import type { DoctorReport } from "../../../core/doctor.js";
+import type { MeshPingResult } from "../../../core/mesh/service.js";
+import type { SettingsButton } from "./menu.js";
 import { formatDuration, formatBytes } from "./format.js";
 
 const DEFAULT_METRICS_MESSAGE_MAX = 3800;
 
+/**
+ * Rows shown in the `tool_calls` leaderboard before the tail collapses
+ * into a "…and N more" line. A long-lived bot accumulates a lifetime
+ * tool-call entry per distinct tool name (easily 100+ once plugin and
+ * MCP tools are counted), which is what used to push /metrics past
+ * Telegram's message limit and split it across messages.
+ */
+const TOOL_CALLS_TOP_N = 12;
+
 type MetricsSnapshot = {
   counters: Record<string, number>;
   histograms: Record<
@@ -16,18 +27,26 @@ type MetricsSnapshot = {
   >;
 };
 
+/** Which grain the /metrics panel is currently showing. */
+export type MetricsView = "today" | "all";
+
+const VIEW_TITLES: Record<MetricsView, string> = {
+  today: "Metrics — today (UTC)",
+  all: "Metrics — all time",
+};
+
+/**
+ * One titled block of the panel. `hidden` counts rows dropped to make
+ * the panel fit one message; it renders as a trailing "…and N more".
+ */
+type Section = { title: string; rows: string[]; hidden: number };
+
 function truncateMetricLabel(label: string, max = 80): string {
   return label.length <= max ? label : `${label.slice(0, max - 3)}...`;
 }
 
-export function renderMetricsMessages(
-  metrics: MetricsSnapshot,
-  maxLen = DEFAULT_METRICS_MESSAGE_MAX,
-  title = "📊 Metrics",
-): string[] {
-  const firstHeader = `<b>${escapeHtml(title)}</b>`;
-  const continuationHeader = `<b>${escapeHtml(title)} (cont.)</b>`;
-  const sections: string[][] = [];
+function buildMetricsSections(metrics: MetricsSnapshot): Section[] {
+  const sections: Section[] = [];
 
   // Histograms come in two flavours: durations (keys ending in `_ms`,
   // rendered as human times) and plain counts like `tool_calls_per_turn`
@@ -44,16 +63,18 @@ export function renderMetricsMessages(
     );
   };
   if (durationKeys.length > 0) {
-    sections.push([
-      "<b>Latency</b>",
-      ...durationKeys.map((key) => histLine(key, formatDuration)),
-    ]);
+    sections.push({
+      title: "<b>Latency</b>",
+      rows: durationKeys.map((key) => histLine(key, formatDuration)),
+      hidden: 0,
+    });
   }
   if (countKeys.length > 0) {
-    sections.push([
-      "<b>Distributions</b>",
-      ...countKeys.map((key) => histLine(key, String)),
-    ]);
+    sections.push({
+      title: "<b>Distributions</b>",
+      rows: countKeys.map((key) => histLine(key, String)),
+      hidden: 0,
+    });
   }
 
   const counterKeys = Object.keys(metrics.counters).sort();
@@ -68,17 +89,20 @@ export function renderMetricsMessages(
     for (const prefix of [...groups.keys()].sort()) {
       // tool_calls reads best as a leaderboard — busiest tools first.
       // Other groups keep alphabetical order (stable lookup by name).
-      const keys =
-        prefix === "tool_calls"
-          ? [...groups.get(prefix)!].sort(
-              (a, b) =>
-                metrics.counters[b]! - metrics.counters[a]! ||
-                a.localeCompare(b),
-            )
-          : groups.get(prefix)!;
-      sections.push([
-        `<b>${escapeHtml(prefix)}</b>`,
-        ...keys.map((key) => {
+      const isToolCalls = prefix === "tool_calls";
+      const keys = isToolCalls
+        ? [...groups.get(prefix)!].sort(
+            (a, b) =>
+              metrics.counters[b]! - metrics.counters[a]! || a.localeCompare(b),
+          )
+        : groups.get(prefix)!;
+      // The leaderboard is pre-capped: past the top N the tail is a long
+      // list of one-call tools nobody reads, and on the all-time view it
+      // is what made the panel overflow.
+      const shown = isToolCalls ? keys.slice(0, TOOL_CALLS_TOP_N) : keys;
+      sections.push({
+        title: `<b>${escapeHtml(prefix)}</b>`,
+        rows: shown.map((key) => {
           const label = key.includes(".")
             ? key.split(".").slice(1).join(".")
             : key;
@@ -87,59 +111,88 @@ export function renderMetricsMessages(
             `${metrics.counters[key]!.toLocaleString()}`
           );
         }),
-      ]);
+        hidden: keys.length - shown.length,
+      });
     }
   }
 
-  if (sections.length === 0) {
-    return [`${firstHeader}\n\n<i>No metrics recorded yet.</i>`];
-  }
-
-  const chunks: string[] = [];
-  let header = firstHeader;
-  let current = header;
-
-  const flush = () => {
-    chunks.push(current);
-    header = continuationHeader;
-    current = header;
-  };
+  return sections;
+}
 
-  const appendLine = (line: string) => {
-    if (!line && current === header) return;
+function renderSection(section: Section): string {
+  const lines = [section.title, ...section.rows];
+  if (section.hidden > 0) {
+    lines.push(`  <i>…and ${section.hidden} more</i>`);
+  }
+  return lines.join("\n");
+}
 
-    const candidate = `${current}\n${line}`;
-    if (candidate.length <= maxLen) {
-      current = candidate;
-      return;
-    }
+/**
+ * Render the sections under `header`, shrinking to fit `maxLen`.
+ *
+ * Telegram hard-caps a message at 4096 characters. Rather than split the
+ * report across messages — which is what the panel replaced — rows are
+ * dropped from the longest section first (each drop bumping that
+ * section's "…and N more") until the whole thing fits. Sections always
+ * keep at least their first row, so every group stays visible.
+ */
+function fitPanel(header: string, sections: Section[], maxLen: number): string {
+  const render = () => [header, ...sections.map(renderSection)].join("\n\n");
 
-    if (current !== header) {
-      flush();
-      if (!line) return;
+  let out = render();
+  while (out.length > maxLen) {
+    let target: Section | undefined;
+    for (const section of sections) {
+      if (section.rows.length <= 1) continue;
+      if (!target || section.rows.length > target.rows.length) target = section;
     }
-
-    const available = maxLen - header.length - 1;
-    if (available < 0) return; // header alone already fills maxLen — skip line
-    const safeLine =
-      line.length <= available
-        ? line
-        : available >= 4
-          ? `${line.slice(0, available - 3)}...`
-          : line.slice(0, available); // not enough room for ellipsis — just truncate
-    current = `${current}\n${safeLine}`;
-  };
-
-  for (const section of sections) {
-    appendLine("");
-    for (const line of section) appendLine(line);
+    if (!target) break;
+    target.rows.pop();
+    target.hidden += 1;
+    out = render();
   }
 
-  if (current !== header || chunks.length === 0) {
-    chunks.push(current);
+  if (out.length <= maxLen) return out;
+  // Nothing left to shed (a pathologically small maxLen). Cut on a line
+  // boundary so we never slice through an HTML tag and fail the parse.
+  const cut = out.lastIndexOf("\n", maxLen - 1);
+  return cut > 0 ? out.slice(0, cut) : out.slice(0, maxLen);
+}
+
+/**
+ * Render the /metrics panel for one grain as a SINGLE Telegram message.
+ * Pair it with `renderMetricsKeyboard(view)` — the Today / All time
+ * buttons swap grains by editing this message in place.
+ */
+export function renderMetricsPanel(
+  metrics: MetricsSnapshot,
+  view: MetricsView,
+  maxLen = DEFAULT_METRICS_MESSAGE_MAX,
+): string {
+  const header = `<b>${escapeHtml(VIEW_TITLES[view])}</b>`;
+  const sections = buildMetricsSections(metrics);
+  if (sections.length === 0) {
+    return `${header}\n\n<i>No metrics recorded yet.</i>`;
   }
+  return fitPanel(header, sections, maxLen);
+}
 
-  return chunks;
+/** Grain-switch buttons for the /metrics panel. */
+export function renderMetricsKeyboard(
+  view: MetricsView,
+): Array<Array<SettingsButton>> {
+  return [
+    [
+      {
+        text: view === "today" ? "✓ Today" : "Today",
+        callback_data: "metrics:today",
+      },
+      {
+        text: view === "all" ? "✓ All time" : "All time",
+        callback_data: "metrics:all",
+      },
+    ],
+  ];
 }
 
 const DOCTOR_ICONS: Record<string, string> = {
@@ -187,3 +240,70 @@ export function renderDoctorMessage(report: DoctorReport): string {
 
   return lines.join("\n");
 }
+
+// ── /mesh ───────────────────────────────────────────────────────────────────
+
+function meshDeviceLine(r: MeshPingResult, now: number): string {
+  const d = r.device;
+  const bits: string[] = [escapeHtml(d.platform)];
+  if (r.reachable && typeof r.latencyMs === "number") {
+    bits.push(`${r.latencyMs} ms`);
+  } else if (d.online && r.error) {
+    bits.push(escapeHtml(r.error));
+  } else if (!d.online) {
+    bits.push(`last seen ${formatDuration(now - d.lastSeen)} ago`);
+  }
+  if (typeof d.battery === "number") {
+    bits.push(`${d.battery}%${d.charging ? " charging" : ""}`);
+  }
+  return `  <b>${escapeHtml(d.name)}</b> — ${bits.join(" · ")}`;
+}
+
+/**
+ * Render the `/mesh` fleet report as one HTML message.
+ *
+ * Devices group under a state heading — Responding, Unreachable, Offline
+ * — rather than carrying a coloured status glyph per row: the grouping
+ * already says what the glyph said, and the report stays readable when
+ * the fleet grows. Empty groups are omitted entirely.
+ */
+export function renderMeshReport(
+  results: MeshPingResult[],
+  now = Date.now(),
+): string {
+  if (results.length === 0) {
+    return "<b>Mesh</b>\n\n<i>No devices have registered yet.</i>";
+  }
+
+  const responding = results
+    .filter((r) => r.reachable)
+    .sort((a, b) => (a.latencyMs ?? Infinity) - (b.latencyMs ?? Infinity));
+  const unreachable = results
+    .filter((r) => !r.reachable && r.device.online)
+    .sort((a, b) => a.device.name.localeCompare(b.device.name));
+  const offline = results
+    .filter((r) => !r.reachable && !r.device.online)
+    .sort((a, b) => b.device.lastSeen - a.device.lastSeen);
+
+  const summary = [
+    `${results.length} device${results.length === 1 ? "" : "s"}`,
+    `${responding.length} responding`,
+    ...(unreachable.length > 0 ? [`${unreachable.length} unreachable`] : []),
+    ...(offline.length > 0 ? [`${offline.length} offline`] : []),
+  ].join(" · ");
+
+  const lines = ["<b>Mesh</b>", summary];
+  const section = (title: string, entries: MeshPingResult[]): void => {
+    if (entries.length === 0) return;
+    lines.push(
+      "",
+      `<b>${title}</b>`,
+      ...entries.map((r) => meshDeviceLine(r, now)),
+    );
+  };
+  section("Responding", responding);
+  section("Unreachable", unreachable);
+  section("Offline", offline);
+
+  return lines.join("\n");
+}

package/src/util/config.ts

@@ -256,23 +256,6 @@ const mem0SettingsSchema = z.object({
   userId: z.string().min(1).optional(),
 });
 
-/**
- * Memory pre-retrieval (Phase B) — automatic per-turn palace retrieval.
- * Ships INERT: the flag gates wiring a real retriever into the dispatcher.
- * With `enabled: false` (default) prompts are byte-identical to previous
- * behavior. See docs in core/memory/retrieval.ts for the trust policy.
- */
-const memoryPreRetrievalSchema = z.object({
-  /** Master switch. Default off — plumbing merges disabled. */
-  enabled: z.boolean().default(false),
-  /** Maximum retrieved items injected per turn. */
-  maxResults: z.number().int().min(1).max(10).default(3),
-  /** Hard cap on injected characters, provenance labels included. */
-  maxChars: z.number().int().min(200).max(20000).default(3000),
-  /** In groups, filter private-user drawers before injection. */
-  groupPrivateUserFiltering: z.boolean().default(true),
-});
-
 const configSchema = z.object({
   frontend: z.union([frontendEnum, z.array(frontendEnum)]).default("telegram"),
   botToken: z.string().optional(),
@@ -351,8 +334,6 @@ const configSchema = z.object({
   pulseIntervalMs: z.number().int().min(60000).default(300000),
   /** Background memory-consolidation (dream) runs. Mirrors `pulse`/`heartbeat`. */
   dream: z.boolean().default(true),
-  /** Memory pre-retrieval (Phase B). Optional; absent = disabled. */
-  memoryPreRetrieval: memoryPreRetrievalSchema.optional(),
   /**
    * Periodic background agent (default: on, hourly). Advances open
    * goals, runs user-defined maintenance, and proactively messages

package/src/core/memory/retrieval.ts

@@ -1,92 +0,0 @@
-/**
- * Memory pre-retrieval (Phase B) — injectable retriever boundary.
- *
- * Phase A made `memory.md` the compact always-loaded layer; Phase B closes the
- * recall gap by handing each chat turn a small, relevant palace slice without
- * depending on the model to call `mempalace_search` itself. This module owns
- * the CORE side of that boundary: a typed retriever dependency the Weaver can
- * call before `runChatTurn(...)`, returning plain data
- * (`RetrievedMemory | undefined`) that backends fold into the live user
- * prompt via `formatPromptWithRetrievedMemory`.
- *
- * Deliberate constraints (see docs/memory-phase-b-pre-retrieval.md):
- *
- *   - The retriever receives a small context object and returns plain data.
- *     It never imports backend handlers, and retrieval output never enters
- *     `prepareSystemPrompt()` / frozen prompt snapshots — cache safety first.
- *   - Fail closed: a broken retriever must never block chat delivery. The
- *     Weaver catches errors, logs one warning, and runs the turn without
- *     injected memory.
- *   - The PRODUCTION retriever is intentionally absent in this first pass.
- *     There is no clean in-process MemPalace call surface yet (the plugin is
- *     an MCP server, not a typed module), and shelling out per message from
- *     the dispatch hot path is explicitly forbidden. Until a deliberate
- *     bridge exists, deployments get `noopMemoryRetriever` — plumbing lands
- *     inert, prompts stay byte-identical.
- *   - Trust-aware injection (#373): when a real adapter lands, only items
- *     with `trustLevel` in `AUTO_INJECT_TRUST_LEVELS` may be auto-injected.
- *     `user_claim` / `group_chat` content stays pull-only, or a poisoned
- *     drawer becomes a persistent prompt injection in every session.
- */
-
-import type {
-  RetrievedMemory,
-  RetrievedMemoryTrustLevel,
-} from "../agent-runtime/capabilities.js";
-
-// ── Retriever contract ──────────────────────────────────────────────────────
-
-/** Context handed to a retriever for one chat turn. */
-export type MemoryRetrievalContext = {
-  runKind: "chat";
-  chatId: string;
-  /** The raw incoming message text (retrievers trim/cap it themselves). */
-  text: string;
-  senderName: string;
-  isGroup?: boolean;
-};
-
-/**
- * A memory retriever: small context in, bounded plain data out.
- * `undefined` means "inject nothing" — the turn proceeds unchanged.
- */
-export type MemoryRetriever = (
-  context: MemoryRetrievalContext,
-) => Promise<RetrievedMemory | undefined>;
-
-// ── Trust policy (#373) ─────────────────────────────────────────────────────
-
-/**
- * Trust levels eligible for automatic injection. Anything else (including an
- * absent `trustLevel`) must be filtered by adapters before returning items.
- */
-export const AUTO_INJECT_TRUST_LEVELS: ReadonlySet<RetrievedMemoryTrustLevel> =
-  new Set(["dylan_direct", "bot_inferred", "heartbeat_synthesis"]);
-
-/** True when an item's trust level allows automatic injection. */
-export function isAutoInjectTrusted(
-  trustLevel: RetrievedMemoryTrustLevel | undefined,
-): boolean {
-  return trustLevel !== undefined && AUTO_INJECT_TRUST_LEVELS.has(trustLevel);
-}
-
-/**
- * Enforce the #373 trust policy on a retrieval result: drop every item that
- * is not explicitly auto-inject trusted. Adapters should call this as their
- * last step, and the Weaver's `prefetchMemory` applies it again to whatever
- * a retriever returns — a buggy adapter cannot leak low-trust items into
- * the prompt.
- */
-export function filterAutoInjectable(
-  memory: RetrievedMemory | undefined,
-): RetrievedMemory | undefined {
-  if (!memory) return undefined;
-  const items = memory.items.filter((i) => isAutoInjectTrusted(i.trustLevel));
-  if (items.length === 0) return undefined;
-  return { ...memory, items };
-}
-
-// ── Default (inert) retriever ───────────────────────────────────────────────
-
-/** The no-op retriever: Phase B plumbing present, injection disabled. */
-export const noopMemoryRetriever: MemoryRetriever = async () => undefined;

package/src/core/weaver/memory-prefetch.ts

@@ -1,65 +0,0 @@
-/**
- * Memory prefetch (Phase B) — optional pre-retrieval of palace memory
- * for live user messages, strictly fail-closed: a broken palace must
- * never block chat delivery. The result is dynamic turn context passed
- * through ChatRunParams; it never touches the frozen prompt.
- *
- * The #373 trust policy is enforced HERE, not just in adapters: whatever a
- * retriever returns is passed through `filterAutoInjectable` before it can
- * reach the prompt, so a buggy or future adapter cannot leak `user_claim` /
- * `group_chat` items into auto-injection.
- */
-
-import type { RetrievedMemory } from "../agent-runtime/capabilities.js";
-import type { MemoryRetriever } from "../memory/retrieval.js";
-import { filterAutoInjectable } from "../memory/retrieval.js";
-import { logDebug, logWarn } from "../../util/log.js";
-
-export type PrefetchMemoryInput = {
-  chatId: string;
-  text: string;
-  senderName: string;
-  isGroup: boolean;
-  /** Request id for log correlation. */
-  reqId: string;
-};
-
-export async function prefetchMemory(
-  retrieve: MemoryRetriever,
-  input: PrefetchMemoryInput,
-): Promise<RetrievedMemory | undefined> {
-  try {
-    const raw = await retrieve({
-      runKind: "chat",
-      chatId: input.chatId,
-      text: input.text,
-      senderName: input.senderName,
-      isGroup: input.isGroup,
-    });
-    const retrieved = filterAutoInjectable(raw);
-    const droppedCount =
-      (raw?.items.length ?? 0) - (retrieved?.items.length ?? 0);
-    if (droppedCount > 0) {
-      logWarn(
-        "dispatcher",
-        `[${input.reqId}] memory pre-retrieval: dropped ${droppedCount} ` +
-          `low-trust item(s) the retriever failed to filter (#373)`,
-      );
-    }
-    if (retrieved) {
-      logDebug(
-        "dispatcher",
-        `[${input.reqId}] memory pre-retrieval: ${retrieved.items.length} item(s), ` +
-          `${retrieved.items.reduce((n, i) => n + i.text.length, 0)} chars`,
-      );
-    }
-    return retrieved;
-  } catch (err) {
-    logWarn(
-      "dispatcher",
-      `[${input.reqId}] memory pre-retrieval failed (running turn without it): ` +
-        (err instanceof Error ? err.message : String(err)),
-    );
-    return undefined;
-  }
-}