@securecoms/agent-bridge 0.20.0 → 0.23.0

package/connectors/openclaw/openclaw-entry.inbound.test.ts

@@ -0,0 +1,560 @@
+// packages/connect-agent-bridge/connectors/openclaw/openclaw-entry.inbound.test.ts
+//
+// P0 containment Task 8: the OpenClaw connector's INBOUND path.
+//
+//   1. Real sender + per-channel session: the frame's sender_id and
+//      channel_id reach OpenClaw; two channels never share a session key.
+//   2. Owner-only command authority: CommandAuthorized is true ONLY when the
+//      daemon's authorization block says audience "owner_dm" with an
+//      "active" sender (the same predicate the bridge itself uses for
+//      mayReadOpenClawMemoryForTurn). Group rooms are ChatType "group".
+//   3. At-least-once without re-running turns: message_id dedup, reply-receipt
+//      reconciliation before any dispatch, no ack on handler failure, no
+//      silent drop when the runtime is not registered.
+//
+// Drives the REAL plugin.gateway.startAccount path (same harness shape as
+// openclaw-entry.gate.test.ts) with a fake OpenClaw runtime that records what
+// the connector hands it, a fake loopback WebSocket that records acks, and a
+// fake fetch for /healthz, /v1/reply-receipt, /v1/send and /v1/status.
+
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { mkdtempSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { buildConnectionFile, writeConnectionFile } from "../../src/service/connection-file.js";
+
+const BOUND_ID = "agent-identity";
+const OWNER_ID = "owner-human";
+const MEMBER_ID = "team-member";
+const PORT = 7098;
+const TOKEN_VALUE = "inbound-test-token";
+const ORIGINAL_CONN_FILE_ENV = process.env.SECURECOMS_CONNECTION_FILE;
+
+type Auth = { version: 1; audience: string; sender_membership: string; tool_grants: unknown[] };
+const auth = (audience: string, sender_membership = "active"): Auth => ({
+  version: 1, audience, sender_membership, tool_grants: [],
+});
+
+function waitFor(predicate: () => boolean, timeout = 3000): Promise<void> {
+  const start = Date.now();
+  return new Promise((resolve, reject) => {
+    const check = () => {
+      if (predicate()) return resolve();
+      if (Date.now() - start > timeout) return reject(new Error("waitFor: condition never became true"));
+      setTimeout(check, 5);
+    };
+    check();
+  });
+}
+
+type FakeWs = {
+  url: string;
+  sent: Array<Record<string, unknown>>;
+  closed: boolean;
+  _emit: (type: string, ev?: unknown) => void;
+};
+
+function makeFakeWebSocket() {
+  const instances: FakeWs[] = [];
+  class FakeWebSocket {
+    url: string;
+    sent: Array<Record<string, unknown>> = [];
+    closed = false;
+    listeners: Record<string, Array<(ev?: unknown) => void>> = {};
+    constructor(url: string) {
+      this.url = url;
+      instances.push(this);
+    }
+    addEventListener(type: string, cb: (ev?: unknown) => void) {
+      (this.listeners[type] ??= []).push(cb);
+    }
+    send(data: string) {
+      this.sent.push(JSON.parse(data));
+    }
+    close() {
+      if (this.closed) return;
+      this.closed = true;
+      this._emit("close");
+    }
+    _emit(type: string, ev?: unknown) {
+      for (const cb of this.listeners[type] ?? []) cb(ev ?? {});
+    }
+  }
+  return { FakeWebSocket, instances };
+}
+
+/** A fake OpenClaw runtime recording every call the connector makes. */
+function makeRuntime() {
+  const routes: Array<Record<string, any>> = [];
+  const contexts: Array<Record<string, any>> = [];
+  const recorded: Array<Record<string, any>> = [];
+  const envelopes: Array<Record<string, any>> = [];
+  const dispatches: Array<Record<string, any>> = [];
+  let dispatchImpl: (args: any) => Promise<void> = async () => {};
+  const runtime = {
+    channel: {
+      routing: {
+        resolveAgentRoute: (args: any) => {
+          routes.push(args);
+          // Mirror OpenClaw's default dmScope="main": every direct peer
+          // collapses into ONE session key. The connector must not rely on
+          // this key for isolation.
+          return { agentId: "main", sessionKey: "agent:main:main" };
+        },
+      },
+      session: {
+        resolveStorePath: () => "/tmp/openclaw-store-unused",
+        readSessionUpdatedAt: () => undefined,
+        recordInboundSession: async (args: any) => { recorded.push(args); },
+      },
+      reply: {
+        resolveEnvelopeFormatOptions: () => ({}),
+        formatAgentEnvelope: (args: any) => { envelopes.push(args); return `ENV:${args.body}`; },
+        finalizeInboundContext: (ctx: any) => { contexts.push(ctx); return ctx; },
+        dispatchReplyWithBufferedBlockDispatcher: async (args: any) => {
+          dispatches.push(args);
+          await dispatchImpl(args);
+        },
+      },
+    },
+    error: () => {},
+  };
+  return {
+    runtime,
+    routes,
+    contexts,
+    recorded,
+    envelopes,
+    dispatches,
+    setDispatch(fn: (args: any) => Promise<void>) { dispatchImpl = fn; },
+  };
+}
+
+describe("openclaw-entry — inbound sender, session, authority, dedup (P0 Task 8)", () => {
+  let home: string;
+  let logs: string[];
+  let controller: AbortController;
+  let receiptFound: boolean;
+  let receiptStatus: number;
+  let receiptBadBody: boolean;
+  let receiptLookups: string[];
+  let sends: Array<Record<string, unknown>>;
+
+  beforeEach(() => {
+    home = mkdtempSync(join(tmpdir(), "sc-inbound-"));
+    const tokenFile = join(home, "bridge-token");
+    writeFileSync(tokenFile, TOKEN_VALUE, { mode: 0o600 });
+    writeConnectionFile(home, buildConnectionFile({
+      identityId: BOUND_ID,
+      port: PORT,
+      tokenFile,
+      slug: "inbound-test",
+      label: "Inbound Test",
+      instanceId: "inbound-test-instance",
+      now: new Date().toISOString(),
+    }));
+    process.env.SECURECOMS_CONNECTION_FILE = join(home, ".securecoms", "connections", `${BOUND_ID}.json`);
+
+    logs = [];
+    receiptFound = false;
+    receiptStatus = 200;
+    receiptBadBody = false;
+    receiptLookups = [];
+    sends = [];
+    vi.stubGlobal("fetch", vi.fn(async (url: string, init?: RequestInit) => {
+      const u = String(url);
+      if (u.endsWith("/healthz")) {
+        return { ok: true, json: async () => ({ identity_id: BOUND_ID, joined_channels: 2 }) };
+      }
+      if (u.includes("/v1/reply-receipt")) {
+        receiptLookups.push(new URL(u).searchParams.get("in_reply_to") ?? "");
+        if (receiptBadBody) {
+          return {
+            ok: true,
+            status: 200,
+            json: async () => { throw new SyntaxError("Unexpected token in JSON"); },
+          };
+        }
+        return { ok: receiptStatus === 200, status: receiptStatus, json: async () => ({ found: receiptFound }) };
+      }
+      if (u.endsWith("/v1/send")) {
+        sends.push(JSON.parse(String(init?.body)));
+        return { ok: true, json: async () => ({ message_id: "reply-1" }) };
+      }
+      if (u.endsWith("/v1/status")) return { ok: true, json: async () => ({ ok: true }) };
+      throw new Error(`unexpected fetch: ${u}`);
+    }));
+    controller = new AbortController();
+  });
+
+  afterEach(async () => {
+    controller.abort();
+    vi.unstubAllGlobals();
+    vi.unmock("node:os");
+    if (ORIGINAL_CONN_FILE_ENV === undefined) delete process.env.SECURECOMS_CONNECTION_FILE;
+    else process.env.SECURECOMS_CONNECTION_FILE = ORIGINAL_CONN_FILE_ENV;
+    vi.resetModules();
+  });
+
+  async function start(runtime: unknown) {
+    vi.resetModules();
+    vi.doMock("node:os", async (importOriginal) => {
+      const actual = await importOriginal<typeof import("node:os")>();
+      return { ...actual, homedir: () => home };
+    });
+    const mod = await import("./openclaw-entry.js");
+    let plugin: any;
+    mod.default.register({ runtime, registerChannel: ({ plugin: p }: { plugin: unknown }) => { plugin = p; } });
+    const { FakeWebSocket, instances } = makeFakeWebSocket();
+    vi.stubGlobal("WebSocket", FakeWebSocket);
+    const account = plugin.config.resolveAccount({}, "default");
+    const done = plugin.gateway.startAccount({
+      account,
+      cfg: {},
+      log: (m: string) => logs.push(String(m)),
+      abortSignal: controller.signal,
+    });
+    await waitFor(() => instances.length >= 1);
+    instances[0]._emit("open");
+    return { instances, done };
+  }
+
+  function deliver(ws: FakeWs, frame: Record<string, unknown>) {
+    ws._emit("message", { data: JSON.stringify({ type: "message", ts: 1_700_000_000_000, ...frame }) });
+  }
+
+  const acksOf = (ws: FakeWs) => ws.sent.filter((f) => f.type === "ack").map((f) => f.message_id);
+
+  // ---------------------------------------------------------------- 1 ----
+
+  it("passes the frame's REAL sender and channel, with a distinct session key per channel", async () => {
+    const rt = makeRuntime();
+    const { instances } = await start(rt.runtime);
+    const ws = instances[0];
+
+    deliver(ws, { channel_id: "chan-A", message_id: "m-A", sender_id: MEMBER_ID, sender_name: "Tess", text: "hi A", authorization: auth("team_room") });
+    deliver(ws, { channel_id: "chan-B", message_id: "m-B", sender_id: OWNER_ID, text: "hi B", authorization: auth("owner_dm") });
+    await waitFor(() => acksOf(ws).length === 2);
+
+    const [a, b] = rt.contexts;
+    expect(a.SenderId).toBe(MEMBER_ID);
+    expect(a.From).toBe(`securecoms:${MEMBER_ID}`);
+    expect(a.SenderName).toBe("Tess");
+    expect(b.SenderId).toBe(OWNER_ID);
+    expect(b.SenderName).toBe(OWNER_ID); // no roster name -> falls back to the id, never "Owner"
+    expect(rt.contexts.some((c) => c.SenderId === "securecoms:owner")).toBe(false);
+    expect(rt.envelopes.map((e) => e.from)).toEqual(["Tess", OWNER_ID]);
+
+    // Route + session are keyed by the CHANNEL, not by a shared owner peer.
+    expect(rt.routes.map((r) => r.peer.id)).toEqual(["chan-A", "chan-B"]);
+    expect(a.SessionKey).toContain("chan-A");
+    expect(b.SessionKey).toContain("chan-B");
+    expect(a.SessionKey).not.toBe(b.SessionKey);
+    // The runtime's collapsed DM key is never used for isolation.
+    expect(rt.contexts.map((c) => c.SessionKey)).not.toContain("agent:main:main");
+    expect(rt.recorded.map((r) => r.sessionKey)).toEqual([a.SessionKey, b.SessionKey]);
+  });
+
+  it("two DMs from different humans do not share a session", async () => {
+    const rt = makeRuntime();
+    const { instances } = await start(rt.runtime);
+    const ws = instances[0];
+    deliver(ws, { channel_id: "dm-1", message_id: "d1", sender_id: OWNER_ID, text: "x", authorization: auth("owner_dm") });
+    deliver(ws, { channel_id: "dm-2", message_id: "d2", sender_id: MEMBER_ID, text: "y", authorization: auth("other_human_dm") });
+    await waitFor(() => acksOf(ws).length === 2);
+    expect(rt.contexts[0].ChatType).toBe("direct");
+    expect(rt.contexts[1].ChatType).toBe("direct");
+    expect(rt.contexts[0].SessionKey).not.toBe(rt.contexts[1].SessionKey);
+  });
+
+  it("replies go back to the channel the message arrived on, correlated by in_reply_to", async () => {
+    const rt = makeRuntime();
+    rt.setDispatch(async (args) => { await args.dispatcherOptions.deliver({ text: "pong" }); });
+    const { instances } = await start(rt.runtime);
+    deliver(instances[0], { channel_id: "chan-R", message_id: "m-R", sender_id: MEMBER_ID, text: "ping", authorization: auth("team_room") });
+    await waitFor(() => acksOf(instances[0]).includes("m-R"));
+    expect(sends).toEqual([{ channel_id: "chan-R", text: "pong", in_reply_to: "m-R" }]);
+  });
+
+  // ---------------------------------------------------------------- 2 ----
+
+  it.each([
+    ["owner_dm", "active", true, "direct"],
+    ["owner_dm", "unknown", false, "direct"],
+    ["other_human_dm", "active", false, "direct"],
+    ["team_room", "active", false, "group"],
+    ["partner_room", "active", false, "group"],
+    ["agent_to_agent", "active", false, "group"],
+    ["unknown", "unknown", false, "group"],
+  ])("audience=%s membership=%s -> CommandAuthorized=%s, ChatType=%s", async (audience, membership, authorized, chatType) => {
+    const rt = makeRuntime();
+    const { instances } = await start(rt.runtime);
+    deliver(instances[0], { channel_id: "c", message_id: "m", sender_id: OWNER_ID, text: "/reset", authorization: auth(audience, membership) });
+    await waitFor(() => acksOf(instances[0]).includes("m"));
+    expect(rt.contexts).toHaveLength(1);
+    expect(rt.contexts[0].CommandAuthorized).toBe(authorized);
+    expect(rt.contexts[0].ChatType).toBe(chatType);
+  });
+
+  it("a frame with NO authorization block (older daemon) is never command-authorized", async () => {
+    const rt = makeRuntime();
+    const { instances } = await start(rt.runtime);
+    deliver(instances[0], { channel_id: "c", message_id: "m", sender_id: OWNER_ID, text: "/reset" });
+    await waitFor(() => acksOf(instances[0]).includes("m"));
+    expect(rt.contexts[0].CommandAuthorized).toBe(false);
+    expect(rt.contexts[0].ChatType).toBe("group");
+  });
+
+  it("a malformed authorization block (audience owner_dm but wrong version / non-object) is not authorized", async () => {
+    const rt = makeRuntime();
+    const { instances } = await start(rt.runtime);
+    deliver(instances[0], { channel_id: "c1", message_id: "m1", sender_id: OWNER_ID, text: "x", authorization: { ...auth("owner_dm"), version: 2 } });
+    deliver(instances[0], { channel_id: "c2", message_id: "m2", sender_id: OWNER_ID, text: "x", authorization: "owner_dm" });
+    await waitFor(() => acksOf(instances[0]).length === 2);
+    expect(rt.contexts.map((c) => c.CommandAuthorized)).toEqual([false, false]);
+  });
+
+  // ---------------------------------------------------------------- 3 ----
+
+  it("a redelivered message_id is acked again but never dispatched twice", async () => {
+    const rt = makeRuntime();
+    const { instances } = await start(rt.runtime);
+    const ws = instances[0];
+    deliver(ws, { channel_id: "c", message_id: "dup", sender_id: OWNER_ID, text: "run tool", authorization: auth("owner_dm") });
+    await waitFor(() => acksOf(ws).length === 1);
+    deliver(ws, { channel_id: "c", message_id: "dup", sender_id: OWNER_ID, text: "run tool", authorization: auth("owner_dm") });
+    await waitFor(() => acksOf(ws).length === 2);
+    expect(rt.dispatches).toHaveLength(1);
+    expect(acksOf(ws)).toEqual(["dup", "dup"]);
+  });
+
+  it("a concurrent duplicate while the first turn is still running is not dispatched twice", async () => {
+    const rt = makeRuntime();
+    let release!: () => void;
+    rt.setDispatch(() => new Promise<void>((r) => { release = r; }));
+    const { instances } = await start(rt.runtime);
+    const ws = instances[0];
+    const frame = { channel_id: "c", message_id: "slow", sender_id: OWNER_ID, text: "t", authorization: auth("owner_dm") };
+    deliver(ws, frame);
+    await waitFor(() => rt.dispatches.length === 1);
+    deliver(ws, frame);
+    await new Promise((r) => setTimeout(r, 30));
+    expect(rt.dispatches).toHaveLength(1);
+    release();
+    await waitFor(() => acksOf(ws).includes("slow"));
+    expect(rt.dispatches).toHaveLength(1);
+  });
+
+  it("a message whose reply the daemon already published (reply receipt) is acked without dispatch", async () => {
+    const rt = makeRuntime();
+    receiptFound = true;
+    const { instances } = await start(rt.runtime);
+    deliver(instances[0], { channel_id: "c", message_id: "answered", sender_id: OWNER_ID, text: "t", authorization: auth("owner_dm") });
+    await waitFor(() => acksOf(instances[0]).includes("answered"));
+    expect(receiptLookups).toEqual(["answered"]);
+    expect(rt.dispatches).toHaveLength(0);
+  });
+
+  it("the reply receipt is checked BEFORE dispatch on first sight", async () => {
+    const rt = makeRuntime();
+    const order: string[] = [];
+    rt.setDispatch(async () => { order.push(`dispatch:${receiptLookups.length}`); });
+    const { instances } = await start(rt.runtime);
+    deliver(instances[0], { channel_id: "c", message_id: "fresh", sender_id: OWNER_ID, text: "t", authorization: auth("owner_dm") });
+    await waitFor(() => acksOf(instances[0]).includes("fresh"));
+    expect(order).toEqual(["dispatch:1"]);
+  });
+
+  it("a failed reply-receipt lookup neither dispatches nor acks; the socket is closed for redelivery", async () => {
+    const rt = makeRuntime();
+    receiptStatus = 500;
+    const { instances } = await start(rt.runtime);
+    const ws = instances[0];
+    deliver(ws, { channel_id: "c", message_id: "r500", sender_id: OWNER_ID, text: "t", authorization: auth("owner_dm") });
+    await waitFor(() => ws.closed);
+    expect(rt.dispatches).toHaveLength(0);
+    expect(acksOf(ws)).toEqual([]);
+  });
+
+  it("a 200 reply-receipt response with a non-JSON body is a ReceiptLookupError, not a handler failure: it is neither dispatched nor acked, the socket is closed for redelivery, and it does NOT count toward MAX_INBOUND_ATTEMPTS", async () => {
+    const rt = makeRuntime();
+    receiptBadBody = true;
+    const { instances } = await start(rt.runtime);
+    const ws = instances[0];
+    deliver(ws, { channel_id: "c", message_id: "badbody", sender_id: OWNER_ID, text: "t", authorization: auth("owner_dm") });
+    await waitFor(() => ws.closed);
+    expect(rt.dispatches).toHaveLength(0);
+    expect(acksOf(ws)).toEqual([]);
+    expect(logs.some((m) => /giving up/i.test(m))).toBe(false);
+  });
+
+  it("a non-JSON 200 reply-receipt body never exhausts the poison cap (it is not a handler failure)", async () => {
+    const mod = await import("./openclaw-entry.js");
+    const cap = mod.MAX_INBOUND_ATTEMPTS as number;
+    expect(cap).toBeGreaterThan(1); // vacuity guard: the loop below must actually run
+    let invoked = 0;
+    const channel = new mod.LoopbackChannel({
+      boundIdentity: BOUND_ID,
+      log: (m: string) => logs.push(m),
+      onMessage: async () => { invoked++; },
+    });
+    const { FakeWebSocket } = makeFakeWebSocket();
+    channel.bridgeUrl = `http://127.0.0.1:${PORT}`;
+    channel.token = TOKEN_VALUE;
+    channel._ownIdentity = BOUND_ID;
+    vi.stubGlobal("fetch", vi.fn(async (url: string) => {
+      if (String(url).includes("/v1/reply-receipt")) {
+        return { ok: true, status: 200, json: async () => { throw new SyntaxError("bad body"); } };
+      }
+      throw new Error(`unexpected fetch: ${url}`);
+    }));
+    const frame = { type: "message", channel_id: "c", message_id: "badbody-poison", sender_id: OWNER_ID, text: "t" };
+    for (let i = 0; i < cap + 2; i++) {
+      const ws = new FakeWebSocket("ws://x") as unknown as FakeWs;
+      channel._ws = ws;
+      await channel._onInboundFrame(frame);
+      expect(acksOf(ws)).toEqual([]); // never given up on
+    }
+    expect(invoked).toBe(0); // never dispatched (the lookup itself failed each time)
+    expect(logs.some((m) => /giving up/i.test(m))).toBe(false);
+  });
+
+  it("a handler failure is NOT acked: the socket is closed so the daemon re-buffers the frame", async () => {
+    const rt = makeRuntime();
+    rt.setDispatch(async () => { throw new Error("model exploded"); });
+    const { instances } = await start(rt.runtime);
+    const ws = instances[0];
+    deliver(ws, { channel_id: "c", message_id: "boom", sender_id: OWNER_ID, text: "t", authorization: auth("owner_dm") });
+    await waitFor(() => ws.closed);
+    expect(rt.dispatches).toHaveLength(1);
+    expect(acksOf(ws)).toEqual([]);
+  });
+
+  it("after a handler failure, the redelivered copy IS dispatched again (not deduped as seen)", async () => {
+    const rt = makeRuntime();
+    let calls = 0;
+    rt.setDispatch(async () => { calls++; if (calls === 1) throw new Error("transient"); });
+    const { instances } = await start(rt.runtime);
+    const frame = { channel_id: "c", message_id: "retry", sender_id: OWNER_ID, text: "t", authorization: auth("owner_dm") };
+    deliver(instances[0], frame);
+    await waitFor(() => instances[0].closed);
+    await waitFor(() => instances.length >= 2, 10_000); // reconnect after backoff
+    instances[1]._emit("open");
+    deliver(instances[1], frame);
+    await waitFor(() => acksOf(instances[1]).includes("retry"));
+    expect(calls).toBe(2);
+  });
+
+  it("a poison message is given up on (acked, logged) after the attempt cap instead of looping forever", async () => {
+    const rt = makeRuntime();
+    rt.setDispatch(async () => { throw new Error("always fails"); });
+    const mod = await import("./openclaw-entry.js");
+    const cap = mod.MAX_INBOUND_ATTEMPTS as number;
+    expect(cap).toBeGreaterThan(1);
+    const { LoopbackChannel } = mod;
+    // Drive the channel directly (no reconnect backoff) to count attempts.
+    let n = 0;
+    const channel = new LoopbackChannel({
+      boundIdentity: BOUND_ID,
+      log: (m: string) => logs.push(m),
+      onMessage: async () => { n++; throw new Error("always fails"); },
+    });
+    const { FakeWebSocket } = makeFakeWebSocket();
+    channel.bridgeUrl = `http://127.0.0.1:${PORT}`;
+    channel.token = TOKEN_VALUE;
+    channel._ownIdentity = BOUND_ID;
+    const frame = { type: "message", channel_id: "c", message_id: "poison", sender_id: OWNER_ID, text: "t" };
+    const sockets: FakeWs[] = [];
+    for (let i = 0; i < cap; i++) {
+      const ws = new FakeWebSocket("ws://x") as unknown as FakeWs;
+      sockets.push(ws);
+      channel._ws = ws;
+      await channel._onInboundFrame(frame);
+    }
+    expect(n).toBe(cap);
+    for (const ws of sockets.slice(0, -1)) expect(acksOf(ws)).toEqual([]);
+    expect(acksOf(sockets[cap - 1])).toEqual(["poison"]);
+    expect(logs.some((m) => /giving up/i.test(m))).toBe(true);
+    // A later redelivery of the given-up id is acked without another attempt.
+    const ws = new FakeWebSocket("ws://x") as unknown as FakeWs;
+    channel._ws = ws;
+    await channel._onInboundFrame(frame);
+    expect(n).toBe(cap);
+    expect(acksOf(ws)).toEqual(["poison"]);
+  });
+
+  it("runtime NOT registered: the message is neither dropped-and-acked nor dispatched; it stays unacked for redelivery", async () => {
+    const { instances } = await start(undefined);
+    const ws = instances[0];
+    deliver(ws, { channel_id: "c", message_id: "early", sender_id: OWNER_ID, text: "t", authorization: auth("owner_dm") });
+    await waitFor(() => ws.closed);
+    expect(acksOf(ws)).toEqual([]);
+    expect(logs.some((m) => /dropping/i.test(m))).toBe(false);
+  });
+
+  it("runtime-not-ready never exhausts the poison cap (it is not a handler failure)", async () => {
+    const mod = await import("./openclaw-entry.js");
+    const cap = mod.MAX_INBOUND_ATTEMPTS as number;
+    expect(cap).toBeGreaterThan(1); // vacuity guard: the loop below must actually run
+    let invoked = 0;
+    const channel = new mod.LoopbackChannel({
+      boundIdentity: BOUND_ID,
+      log: () => {},
+      onMessage: async () => { invoked++; throw new mod.RuntimeNotReadyError(); },
+    });
+    const { FakeWebSocket } = makeFakeWebSocket();
+    channel.bridgeUrl = `http://127.0.0.1:${PORT}`;
+    channel.token = TOKEN_VALUE;
+    const frame = { type: "message", channel_id: "c", message_id: "wait", sender_id: OWNER_ID, text: "t" };
+    for (let i = 0; i < cap + 2; i++) {
+      const ws = new FakeWebSocket("ws://x") as unknown as FakeWs;
+      channel._ws = ws;
+      await channel._onInboundFrame(frame);
+      expect(acksOf(ws)).toEqual([]);
+      expect(ws.closed).toBe(true); // left for redelivery, not stranded in-flight
+    }
+    expect(invoked).toBe(cap + 2);
+  });
+
+  it("a failure-forced reconnect keeps backing off: a WS open does not reset backoff until a turn succeeds", async () => {
+    const mod = await import("./openclaw-entry.js");
+    const { FakeWebSocket, instances } = makeFakeWebSocket();
+    vi.stubGlobal("WebSocket", FakeWebSocket);
+    let fail = true;
+    const channel = new mod.LoopbackChannel({
+      boundIdentity: "no-such-identity-for-backoff-test",
+      log: () => {},
+      onMessage: async () => { if (fail) throw new Error("turn failed"); },
+    });
+    channel.bridgeUrl = `http://127.0.0.1:${PORT}`;
+    channel.wsUrl = `ws://127.0.0.1:${PORT}/v1/ws`;
+    channel.token = TOKEN_VALUE;
+    try {
+      channel._connect();
+      instances[0]._emit("open");
+      expect(channel._attempt).toBe(0);
+      await channel._onInboundFrame({ type: "message", channel_id: "c", message_id: "f1", sender_id: OWNER_ID, text: "t" });
+      expect(instances[0].closed).toBe(true); // close handler scheduled a backed-off reconnect
+      const afterClose = channel._attempt;
+      expect(afterClose).toBeGreaterThan(0);
+      channel._connect();
+      instances[1]._emit("open");
+      expect(channel._attempt).toBe(afterClose); // NOT reset while the turn keeps failing
+      fail = false;
+      await channel._onInboundFrame({ type: "message", channel_id: "c", message_id: "f2", sender_id: OWNER_ID, text: "t" });
+      channel._connect();
+      instances[2]._emit("open");
+      expect(channel._attempt).toBe(0); // a successful turn restores the normal reset
+    } finally {
+      await channel.stop();
+    }
+  });
+
+  it("our own echoed sends are acked and never dispatched", async () => {
+    const rt = makeRuntime();
+    const { instances } = await start(rt.runtime);
+    deliver(instances[0], { channel_id: "c", message_id: "self", sender_id: BOUND_ID, text: "t", authorization: auth("agent_to_agent") });
+    await waitFor(() => acksOf(instances[0]).includes("self"));
+    expect(rt.dispatches).toHaveLength(0);
+  });
+});