talon-agent 4.3.2 → 4.3.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "talon-agent",
-  "version": "4.3.2",
+  "version": "4.3.3",
   "description": "Multi-frontend AI agent with full tool access, streaming, cron jobs, and plugin system",
   "author": "Dylan Neve",
   "license": "MIT",

package/src/backend/claude-sdk/doctor.ts

@@ -7,7 +7,7 @@
 import type {
   DoctorCheck,
   DoctorConfigSlice,
-} from "../../core/doctor-types.js";
+} from "../../core/doctor/types.js";
 import { getModels } from "../../core/models/catalog.js";
 import { binaryOnPath } from "../../util/binary-on-path.js";
 import { resolveModel } from "./model-provider.js";

package/src/backend/codex/doctor.ts

@@ -6,7 +6,7 @@
 import type {
   DoctorCheck,
   DoctorConfigSlice,
-} from "../../core/doctor-types.js";
+} from "../../core/doctor/types.js";
 import { binaryOnPath } from "../../util/binary-on-path.js";
 import { detectCodexAuth } from "./auth.js";
 

package/src/backend/openai-agents/doctor.ts

@@ -6,7 +6,7 @@
 import type {
   DoctorCheck,
   DoctorConfigSlice,
-} from "../../core/doctor-types.js";
+} from "../../core/doctor/types.js";
 
 export async function openAIAgentsDoctorChecks(
   config: DoctorConfigSlice | undefined,

package/src/bootstrap.ts

@@ -27,7 +27,7 @@ import { appendToJournal } from "./storage/journal.js";
 import { initPulse, resetPulseTimer } from "./core/background/pulse.js";
 import { initCron } from "./core/background/cron.js";
 import { initPlanAlerts } from "./core/background/plan-alerts.js";
-import { setAdminNotifier } from "./core/notify.js";
+import { setAdminNotifier } from "./core/frontend-runtime/admin-notify.js";
 import { startAuthExpiryMonitor } from "./core/auth/expiry-monitor.js";
 import {
   initTriggers,

package/src/cli/doctor.ts

@@ -19,7 +19,7 @@ const DOCTOR_ICONS: Record<string, string> = {
 export async function runDoctor(): Promise<void> {
   printBanner();
   console.log(`  ${pc.bold("Environment check")}\n`);
-  const { collectDoctorReport } = await import("../core/doctor.js");
+  const { collectDoctorReport } = await import("../core/doctor/index.js");
   // Doctor composes each backend's own checks off the registry, and the
   // CLI runs standalone — nothing else has registered them yet.
   const { loadBuiltinBackends } = await import("../backend/builtins.js");

package/src/core/agent-runtime/backend-registry.ts

@@ -30,7 +30,7 @@
  */
 
 import type { Backend } from "./capabilities.js";
-import type { DoctorCheck, DoctorConfigSlice } from "../doctor-types.js";
+import type { DoctorCheck, DoctorConfigSlice } from "../doctor/types.js";
 import type { TalonConfig } from "../../util/config.js";
 
 // ── Types ───────────────────────────────────────────────────────────────────

package/src/core/auth/expiry-monitor.ts

@@ -9,7 +9,7 @@
  * fresh login clears it, so the next expiry warns again).
  */
 
-import { notifyAdmin } from "../notify.js";
+import { notifyAdmin } from "../frontend-runtime/admin-notify.js";
 import {
   daysUntil,
   PROVIDER_LABELS,

package/src/core/{doctor.ts → doctor/index.ts}

@@ -13,22 +13,22 @@
 
 import { existsSync } from "node:fs";
 import { stat } from "node:fs/promises";
-import { NATIVE_MODULES } from "../native/registry.js";
-import { dirs } from "../util/paths.js";
-import { getBackend, listBackends } from "./agent-runtime/backend-registry.js";
+import { NATIVE_MODULES } from "../../native/registry.js";
+import { dirs } from "../../util/paths.js";
+import { getBackend, listBackends } from "../agent-runtime/backend-registry.js";
 import type {
   DoctorCheck,
   DoctorConfigSlice,
   DoctorReport,
   NativeModuleCheck,
-} from "./doctor-types.js";
+} from "./types.js";
 
 export type {
   DoctorCheck,
   DoctorConfigSlice,
   DoctorReport,
   NativeModuleCheck,
-} from "./doctor-types.js";
+} from "./types.js";
 
 function errorNote(err: unknown): string {
   return err instanceof Error ? err.message : String(err);
@@ -180,7 +180,7 @@ async function checkPluginRuntimes(
   config: DoctorConfigSlice | undefined,
 ): Promise<DoctorCheck[]> {
   const checks: DoctorCheck[] = [];
-  const { NATIVE_RUNTIMES } = await import("./plugin/native-runtimes.js");
+  const { NATIVE_RUNTIMES } = await import("../plugin/native-runtimes.js");
   for (const runtime of NATIVE_RUNTIMES) {
     if (!runtime.enabled(config)) continue;
     try {
@@ -322,7 +322,7 @@ export async function collectDoctorReport(opts: {
   // on the in-process TS path. When present, report the live version.
   {
     const { wardenBinaryPath, wardenVersion } =
-      await import("../native/warden.js");
+      await import("../../native/warden.js");
     const wardenBin = wardenBinaryPath();
     if (wardenBin) {
       const version = wardenVersion();
@@ -350,7 +350,7 @@ export async function collectDoctorReport(opts: {
   // and on the event loop), so it's informational, not an issue. The
   // addon was digest-verified at load time by nativeBlake3().
   {
-    const { nativeBlake3 } = await import("../native/blake3.js");
+    const { nativeBlake3 } = await import("../../native/blake3.js");
     const addon = nativeBlake3();
     checks.push(
       addon
@@ -370,7 +370,7 @@ export async function collectDoctorReport(opts: {
   // ~/.talon/ns is the symlink farm only (file mounts fine, no live
   // proc//plugins views), so it's informational, not an issue.
   {
-    const { nativeFuseFs } = await import("../native/fusefs.js");
+    const { nativeFuseFs } = await import("../../native/fusefs.js");
     const addon = nativeFuseFs();
     checks.push(
       addon
@@ -392,7 +392,7 @@ export async function collectDoctorReport(opts: {
   // stale or the package is incomplete — caught at check time, not
   // mid-message when a backend assembles its system prompt.
   {
-    const { loadSystemTemplate } = await import("./prompt/index.js");
+    const { loadSystemTemplate } = await import("../prompt/index.js");
     try {
       const sample = loadSystemTemplate("workspace");
       checks.push(
@@ -423,7 +423,7 @@ export async function collectDoctorReport(opts: {
   // is which is the difference between "why didn't my prompt update?"
   // and a one-line answer.
   {
-    const { promptSeedReport } = await import("../util/workspace.js");
+    const { promptSeedReport } = await import("../../util/workspace.js");
     try {
       const { tracking, edited } = promptSeedReport();
       if (tracking.length + edited.length > 0) {

package/src/core/{notify.ts → frontend-runtime/admin-notify.ts}

@@ -14,7 +14,7 @@
  * watches. Alerts about a dead frontend must travel over a LIVE one.
  */
 
-import { log, logWarn } from "./../util/log.js";
+import { log, logWarn } from "../../util/log.js";
 
 let deliver: ((text: string) => Promise<void>) | null = null;
 

package/src/core/plugin/native-runtimes.ts

@@ -13,7 +13,7 @@
  * import-cheap for consumers that only need the id list.
  */
 
-import type { DoctorCheck } from "../doctor.js";
+import type { DoctorCheck } from "../doctor/index.js";
 import type { ProvisionOutcome } from "./provision.js";
 import type { MempalaceSection } from "../../plugins/mempalace/provision.js";
 import type { PlaywrightSection } from "../../plugins/playwright/provision.js";

package/src/frontend/discord/commands/admin.ts

@@ -19,7 +19,7 @@ import {
   renderMetricsMessages,
   renderDoctorMessages,
 } from "../render.js";
-import { collectDoctorReport } from "../../../core/doctor.js";
+import { collectDoctorReport } from "../../../core/doctor/index.js";
 import { getSoul } from "../../../core/soul/service.js";
 import { getMetrics, getTodayMetrics } from "../../../storage/metrics.js";
 import { handleAdminSubcommand } from "../admin.js";

package/src/frontend/discord/render.ts

@@ -14,7 +14,7 @@ import {
   DISCORD_SAFE_RESERVE,
   splitMessage,
 } from "./formatting.js";
-import type { DoctorReport } from "../../core/doctor.js";
+import type { DoctorReport } from "../../core/doctor/index.js";
 import type { MeshPingResult } from "../../core/mesh/service.js";
 import type { BackendUsageEntry } from "../shared/plan-usage-report.js";
 import {

package/src/frontend/telegram/actions/index.ts

@@ -22,7 +22,7 @@ import type { ActionResult } from "../../../core/types.js";
 import { messagingHandlers, restoreScheduledMessages } from "./messaging.js";
 import { mediaHandlers } from "./media.js";
 import { chatInfoHandlers } from "./chat-info.js";
-import { moderationHandlers } from "./moderation.js";
+import { moderationHandlers } from "./moderation/index.js";
 import type { TelegramActionContext, TelegramActionHandlers } from "./types.js";
 
 export { sendText } from "./shared.js";

package/src/frontend/telegram/actions/moderation/chat.ts

@@ -0,0 +1,63 @@
+/**
+ * Chat-level ops — permissions, invite links, chat photo, unpin_all,
+ * leave_chat.
+ */
+
+import { toPositiveId } from "../shared.js";
+import { resolveMediaInput } from "../media.js";
+import { toChatPermissions } from "./permissions.js";
+import type { ModerationOps } from "./types.js";
+
+export const chatOps: ModerationOps = {
+  set_permissions: async ({ body, chatId, ctx: { bot } }) => {
+    const raw = body.permissions;
+    if (!raw || typeof raw !== "object")
+      return { ok: false, error: "set_permissions: permissions required" };
+    await bot.api.setChatPermissions(
+      chatId,
+      toChatPermissions(raw as Record<string, boolean>),
+    );
+    return { ok: true };
+  },
+  create_invite_link: async ({ body, chatId, ctx: { bot } }) => {
+    const expireMin = Number(body.expire_minutes);
+    const link = await bot.api.createChatInviteLink(chatId, {
+      name: body.title ? String(body.title) : undefined,
+      expire_date:
+        Number.isFinite(expireMin) && expireMin > 0
+          ? Math.floor(Date.now() / 1000) + Math.round(expireMin * 60)
+          : undefined,
+      member_limit: toPositiveId(body.member_limit),
+    });
+    return { ok: true, invite_link: link.invite_link };
+  },
+  revoke_invite_link: async ({ body, chatId, ctx: { bot } }) => {
+    if (!body.link)
+      return { ok: false, error: "revoke_invite_link: link required" };
+    await bot.api.revokeChatInviteLink(chatId, String(body.link));
+    return { ok: true };
+  },
+  set_chat_photo: async ({ body, chatId, ctx: { bot, InputFileClass } }) => {
+    const resolved = resolveMediaInput(body, "set_chat_photo", InputFileClass);
+    if ("error" in resolved) return { ok: false, error: resolved.error };
+    if (typeof resolved.file === "string")
+      return {
+        ok: false,
+        error: "set_chat_photo needs a local file_path (no url/file_id)",
+      };
+    await bot.api.setChatPhoto(chatId, resolved.file);
+    return { ok: true };
+  },
+  delete_chat_photo: async ({ chatId, ctx: { bot } }) => {
+    await bot.api.deleteChatPhoto(chatId);
+    return { ok: true };
+  },
+  unpin_all: async ({ chatId, ctx: { bot } }) => {
+    await bot.api.unpinAllChatMessages(chatId);
+    return { ok: true };
+  },
+  leave_chat: async ({ chatId, ctx: { bot } }) => {
+    await bot.api.leaveChat(chatId);
+    return { ok: true };
+  },
+};

package/src/frontend/telegram/actions/moderation/index.ts

@@ -0,0 +1,74 @@
+/**
+ * Moderation actions — the `moderate` tool's member/chat/topic operations,
+ * plus profile-photo lookup.
+ *
+ * Handlers call the Bot API directly and let Telegram's own errors surface
+ * (missing admin rights come back as descriptive 400s the model can read);
+ * pre-checking rights here would just race the real check.
+ *
+ * `moderate` dispatches on `body.op` through the table below:
+ *   - `members` — ban / unban / mute / unmute / promote / demote /
+ *                 set_admin_title / *_join_request(s)
+ *   - `chat`    — set_permissions / *_invite_link / *_chat_photo /
+ *                 unpin_all / leave_chat
+ *   - `topics`  — create / edit / close / reopen / delete_topic
+ */
+
+import { toPositiveId } from "../shared.js";
+import type { TelegramActionHandlers } from "../types.js";
+import { memberOps } from "./members.js";
+import { chatOps } from "./chat.js";
+import { topicOps } from "./topics.js";
+import type { ModerationOps } from "./types.js";
+
+// Null-prototype so an `op` of "toString" / "constructor" / etc. can't
+// resolve an inherited Object.prototype method via `ops[op]`.
+export const MODERATION_OPS: ModerationOps = Object.assign(
+  Object.create(null),
+  {
+    ...memberOps,
+    ...chatOps,
+    ...topicOps,
+  },
+);
+
+/** Ops that fail up front without a `user_id`. */
+export const OPS_NEEDING_USER = [
+  "ban",
+  "unban",
+  "mute",
+  "unmute",
+  "promote",
+  "demote",
+  "set_admin_title",
+  "approve_join_request",
+  "decline_join_request",
+];
+
+export const moderationHandlers: TelegramActionHandlers = {
+  moderate: async (body, chatId, ctx) => {
+    const op = String(body.op ?? "");
+    const userId = toPositiveId(body.user_id);
+    if (OPS_NEEDING_USER.includes(op) && userId === undefined)
+      return { ok: false, error: `${op}: user_id is required` };
+    const run = MODERATION_OPS[op];
+    if (!run) return { ok: false, error: `Unknown moderation op: ${op}` };
+    return run({ op, body, chatId, ctx, userId });
+  },
+
+  get_user_profile_photos: async (body, _chatId, { bot }) => {
+    const userId = toPositiveId(body.user_id);
+    if (userId === undefined)
+      return { ok: false, error: "user_id is required" };
+    const limit = toPositiveId(body.limit) ?? 5;
+    const photos = await bot.api.getUserProfilePhotos(userId, {
+      limit: Math.min(limit, 100),
+    });
+    return {
+      ok: true,
+      total: photos.total_count,
+      // Largest size of each photo; its file_id sends/downloads like media.
+      file_ids: photos.photos.map((sizes) => sizes[sizes.length - 1].file_id),
+    };
+  },
+};

package/src/frontend/telegram/actions/moderation/members.ts

@@ -0,0 +1,77 @@
+/**
+ * Member ops — ban / unban / mute / unmute / promote / demote /
+ * set_admin_title, plus the join-request trio. Every op here except
+ * `list_join_requests` needs a `user_id`; the router has already checked
+ * that, so `userId!` is safe.
+ */
+
+import { clearJoinRequest, listJoinRequests } from "../../join-requests.js";
+import {
+  DEFAULT_ADMIN_RIGHTS,
+  FULL_MEMBER_PERMISSIONS,
+  untilDate,
+} from "./permissions.js";
+import type { ModerationOps } from "./types.js";
+
+export const memberOps: ModerationOps = {
+  ban: async ({ body, chatId, ctx: { bot }, userId }) => {
+    await bot.api.banChatMember(chatId, userId!, {
+      until_date: untilDate(body.minutes),
+      revoke_messages: body.delete_messages === true || undefined,
+    });
+    return { ok: true };
+  },
+  unban: async ({ chatId, ctx: { bot }, userId }) => {
+    // only_if_banned keeps this from kicking a current member.
+    await bot.api.unbanChatMember(chatId, userId!, {
+      only_if_banned: true,
+    });
+    return { ok: true };
+  },
+  mute: async ({ body, chatId, ctx: { bot }, userId }) => {
+    await bot.api.restrictChatMember(
+      chatId,
+      userId!,
+      { can_send_messages: false },
+      { until_date: untilDate(body.minutes) },
+    );
+    return { ok: true };
+  },
+  unmute: async ({ chatId, ctx: { bot }, userId }) => {
+    await bot.api.restrictChatMember(chatId, userId!, FULL_MEMBER_PERMISSIONS);
+    return { ok: true };
+  },
+  promote: async ({ chatId, ctx: { bot }, userId }) => {
+    await bot.api.promoteChatMember(chatId, userId!, DEFAULT_ADMIN_RIGHTS);
+    return { ok: true };
+  },
+  demote: async ({ chatId, ctx: { bot }, userId }) => {
+    const revoked = Object.fromEntries(
+      Object.keys(DEFAULT_ADMIN_RIGHTS).map((k) => [k, false]),
+    );
+    await bot.api.promoteChatMember(chatId, userId!, revoked);
+    return { ok: true };
+  },
+  set_admin_title: async ({ body, chatId, ctx: { bot }, userId }) => {
+    await bot.api.setChatAdministratorCustomTitle(
+      chatId,
+      userId!,
+      String(body.title ?? ""),
+    );
+    return { ok: true };
+  },
+  approve_join_request: async ({ chatId, ctx: { bot }, userId }) => {
+    await bot.api.approveChatJoinRequest(chatId, userId!);
+    clearJoinRequest(chatId, userId!);
+    return { ok: true };
+  },
+  decline_join_request: async ({ chatId, ctx: { bot }, userId }) => {
+    await bot.api.declineChatJoinRequest(chatId, userId!);
+    clearJoinRequest(chatId, userId!);
+    return { ok: true };
+  },
+  list_join_requests: async ({ chatId }) => ({
+    ok: true,
+    requests: listJoinRequests(chatId),
+  }),
+};

package/src/frontend/telegram/actions/moderation/permissions.ts

@@ -0,0 +1,69 @@
+/**
+ * Permission vocabulary shared by the member and chat ops.
+ */
+
+import type { ChatPermissions } from "grammy/types";
+
+/** Seconds-from-now → Telegram until_date, honouring "omit = forever". */
+export function untilDate(minutes: unknown): number | undefined {
+  const n = Number(minutes);
+  if (!Number.isFinite(n) || n <= 0) return undefined;
+  return Math.floor(Date.now() / 1000) + Math.round(n * 60);
+}
+
+/**
+ * Friendly permission names → ChatPermissions. `send_media` fans out to all
+ * the per-kind media flags; raw `can_*` keys pass through untouched so the
+ * full API surface stays reachable.
+ */
+export function toChatPermissions(
+  raw: Record<string, boolean>,
+): ChatPermissions {
+  const out: Record<string, boolean> = {};
+  const alias: Record<string, string[]> = {
+    send_messages: ["can_send_messages"],
+    send_media: [
+      "can_send_audios",
+      "can_send_documents",
+      "can_send_photos",
+      "can_send_videos",
+      "can_send_video_notes",
+      "can_send_voice_notes",
+    ],
+    send_polls: ["can_send_polls"],
+    send_other: ["can_send_other_messages"],
+    web_previews: ["can_add_web_page_previews"],
+    change_info: ["can_change_info"],
+    invite_users: ["can_invite_users"],
+    pin_messages: ["can_pin_messages"],
+    manage_topics: ["can_manage_topics"],
+  };
+  for (const [key, value] of Object.entries(raw)) {
+    if (typeof value !== "boolean") continue;
+    for (const target of alias[key] ?? (key.startsWith("can_") ? [key] : [])) {
+      out[target] = value;
+    }
+  }
+  return out;
+}
+
+/** Everything a mute takes away; unmute grants it back. */
+export const FULL_MEMBER_PERMISSIONS: ChatPermissions = toChatPermissions({
+  send_messages: true,
+  send_media: true,
+  send_polls: true,
+  send_other: true,
+  web_previews: true,
+});
+
+/** The workaday admin kit `promote` grants; demote sets all of these false. */
+export const DEFAULT_ADMIN_RIGHTS = {
+  can_manage_chat: true,
+  can_delete_messages: true,
+  can_restrict_members: true,
+  can_pin_messages: true,
+  can_invite_users: true,
+  can_change_info: true,
+  can_manage_topics: true,
+  can_manage_video_chats: true,
+};

package/src/frontend/telegram/actions/moderation/topics.ts

@@ -0,0 +1,48 @@
+/**
+ * Forum-topic ops — create / edit / close / reopen / delete.
+ */
+
+import type { Bot } from "grammy";
+import { toPositiveId } from "../shared.js";
+import type { ModerationOp, ModerationOps } from "./types.js";
+
+/** An op on an existing topic: validates `thread_id`, then runs `call`. */
+function topicOp(
+  call: (
+    api: Bot["api"],
+    chatId: number,
+    threadId: number,
+    body: Record<string, unknown>,
+  ) => Promise<unknown>,
+): ModerationOp {
+  return async ({ op, body, chatId, ctx: { bot } }) => {
+    const threadId = toPositiveId(body.thread_id);
+    if (threadId === undefined)
+      return { ok: false, error: `${op}: thread_id required` };
+    await call(bot.api, chatId, threadId, body);
+    return { ok: true };
+  };
+}
+
+export const topicOps: ModerationOps = {
+  create_topic: async ({ body, chatId, ctx: { bot } }) => {
+    if (!body.title)
+      return { ok: false, error: "create_topic: title required" };
+    const topic = await bot.api.createForumTopic(chatId, String(body.title));
+    return { ok: true, thread_id: topic.message_thread_id };
+  },
+  edit_topic: topicOp((api, chatId, threadId, body) =>
+    api.editForumTopic(chatId, threadId, {
+      name: body.title ? String(body.title) : undefined,
+    }),
+  ),
+  close_topic: topicOp((api, chatId, threadId) =>
+    api.closeForumTopic(chatId, threadId),
+  ),
+  reopen_topic: topicOp((api, chatId, threadId) =>
+    api.reopenForumTopic(chatId, threadId),
+  ),
+  delete_topic: topicOp((api, chatId, threadId) =>
+    api.deleteForumTopic(chatId, threadId),
+  ),
+};

package/src/frontend/telegram/actions/moderation/types.ts

@@ -0,0 +1,16 @@
+import type { ActionResult } from "../../../../core/types.js";
+import type { TelegramActionContext } from "../types.js";
+
+/** One `moderate` call, pre-parsed: the op name, the raw body, and the
+ * `user_id` the router already validated for ops that need one. */
+type ModerationRequest = {
+  op: string;
+  body: Record<string, unknown>;
+  chatId: number;
+  ctx: TelegramActionContext;
+  userId: number | undefined;
+};
+
+export type ModerationOp = (req: ModerationRequest) => Promise<ActionResult>;
+
+export type ModerationOps = Record<string, ModerationOp>;

package/src/frontend/telegram/admin/background.ts

@@ -0,0 +1,66 @@
+/**
+ * `/admin cron` / `pulse` — the background-job subcommands.
+ */
+
+import type { Bot, Context } from "grammy";
+import { escapeHtml } from "../formatting.js";
+import {
+  getAllCronJobs,
+  describeSchedule,
+  nextRunAt,
+} from "../../../storage/cron.js";
+import { getPulseStatus } from "../../../core/background/pulse.js";
+import { replyHtmlChunked } from "./chunked-reply.js";
+
+export async function replyCronJobs(ctx: Context): Promise<void> {
+  const jobs = getAllCronJobs();
+  if (jobs.length === 0) {
+    await ctx.reply("No cron jobs.");
+    return;
+  }
+  const lines = jobs.map((j) => {
+    const nextMs = nextRunAt(j);
+    const last = j.lastRunAt
+      ? new Date(j.lastRunAt).toISOString().slice(0, 16).replace("T", " ")
+      : "never";
+    const next = nextMs
+      ? new Date(nextMs).toISOString().slice(0, 16).replace("T", " ")
+      : "?";
+    return `${j.enabled ? "✓" : "✗"} <b>${escapeHtml(j.name)}</b>\n  <code>${escapeHtml(describeSchedule(j))}</code> | ${j.type} | runs: ${j.runCount} | last: ${last} | next: ${next}`;
+  });
+  await replyHtmlChunked(
+    ctx,
+    `<b>Cron Jobs (${jobs.length})</b>\n\n` + lines.join("\n\n"),
+  );
+}
+
+export async function replyPulseStatus(
+  ctx: Context,
+  _rest: string[],
+  bot: Bot,
+): Promise<void> {
+  const chats = getPulseStatus();
+  if (chats.length === 0) {
+    await ctx.reply("No pulse chats.");
+    return;
+  }
+  const lines = await Promise.all(
+    chats.map(async (p) => {
+      let title = p.chatId;
+      try {
+        const id = parseInt(p.chatId, 10);
+        if (!isNaN(id)) {
+          const chat = await bot.api.getChat(id);
+          title = "title" in chat ? (chat.title ?? p.chatId) : p.chatId;
+        }
+      } catch {
+        /* skip */
+      }
+      return `${p.enabled ? "✓" : "✗"} ${escapeHtml(title)}`;
+    }),
+  );
+  await replyHtmlChunked(
+    ctx,
+    `<b>Pulse (${chats.length})</b>\n\n` + lines.join("\n"),
+  );
+}

package/src/frontend/telegram/admin/chunked-reply.ts

@@ -0,0 +1,20 @@
+import type { Context } from "grammy";
+import { splitMessage } from "../formatting.js";
+import { TELEGRAM_MAX_TEXT } from "../actions/types.js";
+
+/**
+ * Reply with an HTML listing, split across messages when it outgrows
+ * Telegram's 4096-char cap. The per-item listings (chats, cron, pulse)
+ * scale with the daemon's chat count, and a single oversized
+ * `ctx.reply` fails the whole command with 400 "message is too long".
+ * Entries are `\n\n`-separated and each carries balanced tags, so the
+ * paragraph-first splitter never cuts through markup.
+ */
+export async function replyHtmlChunked(
+  ctx: Context,
+  text: string,
+): Promise<void> {
+  for (const chunk of splitMessage(text, TELEGRAM_MAX_TEXT)) {
+    await ctx.reply(chunk, { parse_mode: "HTML" });
+  }
+}