switchroom 0.13.33 → 0.13.36

package/telegram-plugin/tests/pending-work-progress.test.ts

@@ -407,4 +407,138 @@ describe('pending-work-progress', () => {
     expect(cap.edits.filter((e) => e.messageId === 10)).toHaveLength(1)
     expect(cap.edits.filter((e) => e.messageId === 20)).toHaveLength(2)
   })
+
+  // ─── #1760 regression tests ───────────────────────────────────────────
+  //
+  // The "— still working (Nm)" ticker can get stuck forever editing an
+  // old outbound message if the gateway misses the SDK `turn_end` event.
+  // Two layers of defence:
+  //
+  //   1. PRIMARY: the gateway tears down on every `reply: finalized`
+  //      chokepoint via `clearPending(key, 'reply_finalize')` BEFORE
+  //      `noteOutbound` on the next turn's first reply. Verified here by
+  //      simulating a missed-turn_end scenario: the prior turn's ticker
+  //      is activated, then the gateway processes a fresh reply on a NEW
+  //      turn without ever calling `noteTurnEnd` for the prior one. The
+  //      explicit `clearPending('reply_finalize')` call must wipe the
+  //      stale ambient.
+  //
+  //   2. DEFENSE-IN-DEPTH: at tick time, if `isActiveTurnNewerThan`
+  //      returns true (gateway reports a newer turn is active for this
+  //      chat), the ticker self-terminates instead of editing. Bug
+  //      becomes "at most one stale tick" rather than "stuck forever."
+
+  it('#1760 primary: reply_finalize teardown wipes a stale activated ticker', async () => {
+    const cap = setup()
+
+    // Turn 1: dispatch async work, capture an anchor, end the turn.
+    // Ticker activates and fires one edit at +60s.
+    startTurn(KEY)
+    noteAsyncDispatch(KEY)
+    noteOutbound(KEY, { messageId: 100, text: 'kicking off worker' })
+    noteTurnEnd(KEY)
+    cap.now = EDIT_INTERVAL_MS
+    __tickForTests(cap.now)
+    await flush()
+    expect(cap.edits).toHaveLength(1)
+    expect(cap.edits[0]?.messageId).toBe(100)
+
+    // Turn 2 begins WITHOUT a prior `noteTurnEnd` clear (simulating the
+    // #1760 missed-turn_end SDK-event-drop). The gateway's reply-
+    // finalize chokepoint MUST call clearPending('reply_finalize')
+    // BEFORE noteOutbound on the new anchor. After that, the prior
+    // ticker is gone and further ticks (even before any new
+    // noteTurnEnd) edit nothing.
+    clearPending(KEY, 'reply_finalize')
+    noteOutbound(KEY, { messageId: 200, text: 'turn 2 reply' })
+
+    cap.now = EDIT_INTERVAL_MS * 5
+    __tickForTests(cap.now)
+    await flush()
+    // No additional edits — the stale ticker is dead. Note that the new
+    // turn's ticker has not been activated yet (noteTurnEnd not called),
+    // so nothing should fire here either.
+    expect(cap.edits).toHaveLength(1)
+
+    // The 'reply_finalize' clear must surface as a metric so operators
+    // can observe the backstop firing in production.
+    const reasons = cap.metrics
+      .filter((m): m is Extract<PendingProgressMetric, { kind: 'pending_progress_cleared' }> =>
+        m.kind === 'pending_progress_cleared')
+      .map((m) => m.reason)
+    expect(reasons).toContain('reply_finalize')
+  })
+
+  it('#1760 defense-in-depth: ticker self-terminates when isActiveTurnNewerThan is true', async () => {
+    const cap: Capture = { edits: [], metrics: [], now: 0 }
+    __resetAllForTests()
+    // The activatedAt epoch captured by the ticker:
+    const TURN_1_ACTIVATED_AT = 1_000
+    // A NEWER turn starts later, simulating turn-2 racing past the
+    // missed teardown:
+    const TURN_2_STARTED_AT = TURN_1_ACTIVATED_AT + 30_000
+
+    __setDepsForTests({
+      editMessage: async (ctx) => {
+        cap.edits.push(ctx)
+      },
+      emitMetric: (e) => {
+        cap.metrics.push(e)
+      },
+      nowMs: () => cap.now,
+      // Reports a newer turn always-on for this test.
+      isActiveTurnNewerThan: (_key, activatedAt) =>
+        TURN_2_STARTED_AT > activatedAt,
+    })
+
+    // Bootstrap a "prior turn" ticker at TURN_1_ACTIVATED_AT.
+    cap.now = TURN_1_ACTIVATED_AT
+    startTurn(KEY)
+    noteAsyncDispatch(KEY)
+    noteOutbound(KEY, { messageId: 100, text: 'kicking off worker' })
+    noteTurnEnd(KEY)
+    expect(__getStateForTests(KEY)?.activatedAt).toBe(TURN_1_ACTIVATED_AT)
+
+    // Advance past EDIT_INTERVAL_MS so the tick would otherwise fire.
+    cap.now = TURN_1_ACTIVATED_AT + EDIT_INTERVAL_MS + 1_000
+    __tickForTests(cap.now)
+    await flush()
+
+    // No edit fired — the predicate detected a newer active turn and
+    // dropped the ticker.
+    expect(cap.edits).toHaveLength(0)
+    expect(__getStateForTests(KEY)).toBeUndefined()
+
+    const cleared = cap.metrics.find(
+      (m): m is Extract<PendingProgressMetric, { kind: 'pending_progress_cleared' }> =>
+        m.kind === 'pending_progress_cleared',
+    )
+    expect(cleared?.reason).toBe('stale_turn')
+  })
+
+  it('#1760 defense-in-depth: predicate returning false leaves ticker alone', async () => {
+    const cap: Capture = { edits: [], metrics: [], now: 0 }
+    __resetAllForTests()
+    __setDepsForTests({
+      editMessage: async (ctx) => {
+        cap.edits.push(ctx)
+      },
+      emitMetric: (e) => {
+        cap.metrics.push(e)
+      },
+      nowMs: () => cap.now,
+      // No newer turn — the legitimate cross-turn ambient case.
+      isActiveTurnNewerThan: () => false,
+    })
+
+    startTurn(KEY)
+    noteAsyncDispatch(KEY)
+    noteOutbound(KEY, { messageId: 100, text: 'kicking off worker' })
+    noteTurnEnd(KEY)
+
+    cap.now = EDIT_INTERVAL_MS
+    __tickForTests(cap.now)
+    await flush()
+    expect(cap.edits).toHaveLength(1)
+  })
 })

package/telegram-plugin/tests/silent-end-integration.test.ts

@@ -0,0 +1,268 @@
+/**
+ * silent-end-integration.test.ts — #1744 follow-up.
+ *
+ * The existing silent-end.test.ts (#1741 block, L301-409) exercises the
+ * gate as a pure unit via `simulateReplyAtGateway`, which mirrors the
+ * `isFinalAnswerReply ? clearSilentEndState(...)` contract used at the
+ * `executeReply` send-site (gateway.ts:4609). That's a fine unit test
+ * for the `executeReply` path, but it does NOT model the `stream_reply`
+ * state machine where:
+ *
+ *   - The FIRST stream emit is gated by `!activeDraftStreams.has(sKey)`
+ *     (gateway.ts:5178) — only the first emit per stream considers
+ *     clearing the silent-end state.
+ *   - LATER emits in the same stream (subsequent calls that edit the
+ *     same Telegram message) do NOT re-enter that first-emit branch.
+ *
+ * Pre-fix, a stream whose first emit was ack-shaped (short, silent, no
+ * done) and whose LATER emit carried `done=true` or substantive text
+ * would skip the clear at the first-emit gate and never re-attempt it,
+ * leaving the silent-end state file behind even though the model HAS
+ * now delivered its final answer. The Stop hook would then see a stale
+ * state file and fire a spurious re-prompt on the next turn end.
+ *
+ * The fix in gateway.ts:5343 adds a second clear at the
+ * `finalAnswerDelivered = true` site (which fires on EVERY emit that
+ * qualifies as a final answer, not just the first). This test walks
+ * the full ack-then-final stream sequence and asserts the state file's
+ * lifecycle matches the contract.
+ *
+ * KNOWN GAP — true end-to-end coverage of `executeStreamReply` would
+ * require importing gateway.ts (a multi-thousand-line module with
+ * heavy startup-time side effects: bot creation, IPC server bind, MCP
+ * registration, etc.). Neither `executeReply` nor `executeStreamReply`
+ * is exported. Instead, this test reproduces the EXACT call sequence
+ * the gateway makes at each send-site — same predicate
+ * (`isFinalAnswerReply`), same state-file API (`writeSilentEndState` /
+ * `clearSilentEndState`), same first-emit gating logic — by walking a
+ * tracked `activeDraftStreams` set to model the first-vs-later-emit
+ * branching that's the load-bearing detail of the bug. A future
+ * refactor that drops the second clear at L5343 would fail the
+ * `ack first emit then final later emit` test below, because the
+ * state file would never get cleared on the path that no longer
+ * passes through the first-emit branch.
+ *
+ * If the gateway is ever refactored so `executeReply`/`executeStreamReply`
+ * become testable in isolation (or get extracted into a thin
+ * dispatch shim around a pure handler), prefer wiring those real
+ * functions over this faithful-shape reproduction.
+ */
+import { describe, it, expect, beforeEach, afterEach } from 'vitest'
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import {
+  writeSilentEndState,
+  clearSilentEndState,
+  readSilentEndState,
+} from '../silent-end.js'
+import { isFinalAnswerReply } from '../final-answer-detect.js'
+
+let stateDir: string
+const ORIG_ENV = process.env.TELEGRAM_STATE_DIR
+
+beforeEach(() => {
+  stateDir = mkdtempSync(join(tmpdir(), 'silent-end-integration-test-'))
+  process.env.TELEGRAM_STATE_DIR = stateDir
+})
+
+afterEach(() => {
+  rmSync(stateDir, { recursive: true, force: true })
+  if (ORIG_ENV != null) process.env.TELEGRAM_STATE_DIR = ORIG_ENV
+  else delete process.env.TELEGRAM_STATE_DIR
+})
+
+/**
+ * Shape-accurate reproduction of the gateway's `executeReply` clear
+ * site (gateway.ts:4599-4611). The `reply` tool runs this on every
+ * call — no first-emit gating, because `reply` always produces a
+ * fresh outbound message.
+ */
+function simulateExecuteReply(
+  reply: { text: string; disableNotification: boolean },
+  turnKey: string,
+): { finalAnswerDelivered: boolean } {
+  const final = isFinalAnswerReply(reply)
+  if (final) clearSilentEndState(turnKey)
+  return { finalAnswerDelivered: final }
+}
+
+/**
+ * Shape-accurate reproduction of the gateway's `executeStreamReply`
+ * call (gateway.ts:5172-5344). The stream has TWO clear sites:
+ *
+ *   1. First-emit-only branch (L5178-5195) — fires once per stream,
+ *      regardless of whether this emit is the final answer. Clears
+ *      iff this first emit is a final-answer-shaped reply.
+ *   2. Final-answer site (L5335-5358, added in #1744 follow-up) —
+ *      fires on EVERY emit that qualifies as the final answer,
+ *      including later emits in a stream whose first emit was an ack.
+ *      This is the load-bearing addition: without it, the ack-first-
+ *      then-final-later case leaks the state file.
+ *
+ * `activeDraftStreams` is a Set-like state the gateway carries across
+ * calls within the same turn; this test threads it through explicitly.
+ */
+function simulateExecuteStreamReply(
+  emit: { text: string; disableNotification: boolean; done?: boolean },
+  turnKey: string,
+  state: { activeDraftStreams: Set<string>; finalAnswerDelivered: boolean },
+): { finalAnswerDelivered: boolean } {
+  // Site 1 — first-emit-only branch.
+  const isFirstEmit = !state.activeDraftStreams.has(turnKey)
+  if (isFirstEmit) {
+    if (isFinalAnswerReply(emit)) {
+      clearSilentEndState(turnKey)
+    }
+    // Mark the stream active for subsequent emits.
+    state.activeDraftStreams.add(turnKey)
+  }
+
+  // ... draft / send-message work happens here in the real gateway ...
+
+  // Site 2 — final-answer site (#1744 follow-up at gateway.ts:5343).
+  if (isFinalAnswerReply(emit)) {
+    state.finalAnswerDelivered = true
+    clearSilentEndState(turnKey)
+  }
+  return { finalAnswerDelivered: state.finalAnswerDelivered }
+}
+
+describe('#1744 — silent-end state-file lifecycle through real call paths', () => {
+  it('executeReply: ack reply does not clear, then final-answer reply clears', () => {
+    // Turn-end writer fires from a prior turn that ended undelivered,
+    // OR the framework re-prompted and the state still persists.
+    writeSilentEndState({ chatId: 'c', threadId: null, turnKey: 'c:_' })
+
+    // Interim ack via `reply` — must NOT clear.
+    const r1 = simulateExecuteReply({ text: 'On it', disableNotification: true }, 'c:_')
+    expect(r1.finalAnswerDelivered).toBe(false)
+    expect(readSilentEndState()).not.toBeNull()
+
+    // Final answer via `reply` (pings) — clears.
+    const r2 = simulateExecuteReply(
+      { text: "Here's the result.", disableNotification: false },
+      'c:_',
+    )
+    expect(r2.finalAnswerDelivered).toBe(true)
+    expect(readSilentEndState()).toBeNull()
+  })
+
+  it('executeStreamReply: stream that opens with a final-answer first emit clears at first-emit site', () => {
+    writeSilentEndState({ chatId: 'c', threadId: null, turnKey: 'c:_' })
+    const state = { activeDraftStreams: new Set<string>(), finalAnswerDelivered: false }
+
+    // First emit is substantive (>=200 chars) — qualifies as final.
+    simulateExecuteStreamReply(
+      { text: 'x'.repeat(250), disableNotification: true },
+      'c:_',
+      state,
+    )
+    expect(state.finalAnswerDelivered).toBe(true)
+    expect(readSilentEndState()).toBeNull()
+  })
+
+  it('executeStreamReply ack-then-final edge case: first emit is an ack (no clear at first-emit gate), later emit is the final answer (must clear at the new L5343 site)', () => {
+    // This is the regression the #1744 follow-up fixes. Pre-fix, the
+    // first-emit gate would skip the clear (ack-shaped first emit),
+    // and the later final-answer emit had NO second clear site —
+    // state file leaked.
+    writeSilentEndState({ chatId: 'c', threadId: null, turnKey: 'c:_' })
+    const state = { activeDraftStreams: new Set<string>(), finalAnswerDelivered: false }
+
+    // First emit — ack-shaped. First-emit gate fires but the
+    // isFinalAnswerReply predicate returns false → no clear here.
+    simulateExecuteStreamReply(
+      { text: 'thinking...', disableNotification: true, done: false },
+      'c:_',
+      state,
+    )
+    expect(state.finalAnswerDelivered).toBe(false)
+    // CONTRACT: state file MUST still be present after the ack first emit.
+    expect(readSilentEndState()).not.toBeNull()
+
+    // Second emit — same stream (activeDraftStreams already has the key),
+    // so the first-emit branch is skipped. This emit carries done=true
+    // (the real final-answer signal). Without the L5343 clear, the
+    // state file would persist and the Stop hook would fire a spurious
+    // re-prompt on the next turn.
+    simulateExecuteStreamReply(
+      { text: 'done', disableNotification: true, done: true },
+      'c:_',
+      state,
+    )
+    expect(state.finalAnswerDelivered).toBe(true)
+    // CONTRACT: state file MUST be cleared after the final-answer
+    // emit, even though the first-emit branch was skipped.
+    expect(readSilentEndState()).toBeNull()
+  })
+
+  it('executeStreamReply: late emit that flips disable_notification=false also clears', () => {
+    // Variant of the edge case — final-answer signal is the pacing
+    // contract flag rather than done=true.
+    writeSilentEndState({ chatId: 'c', threadId: null, turnKey: 'c:_' })
+    const state = { activeDraftStreams: new Set<string>(), finalAnswerDelivered: false }
+
+    simulateExecuteStreamReply(
+      { text: 'one sec', disableNotification: true, done: false },
+      'c:_',
+      state,
+    )
+    expect(readSilentEndState()).not.toBeNull()
+
+    // Later emit drops the disable_notification flag — the pacing
+    // contract's "final answer" signal — but not done yet.
+    simulateExecuteStreamReply(
+      { text: "Here's what I found.", disableNotification: false, done: false },
+      'c:_',
+      state,
+    )
+    expect(state.finalAnswerDelivered).toBe(true)
+    expect(readSilentEndState()).toBeNull()
+  })
+
+  it('idempotency: clearSilentEndState is safe to call when the file is already gone', () => {
+    // The L5343 clear is unconditional on isFinalAnswerReply — it
+    // fires even when the first-emit gate already cleared. The
+    // clear must be a no-op in that case so it can't accidentally
+    // unlink a fresh state file written for a DIFFERENT later turn.
+    writeSilentEndState({ chatId: 'c', threadId: null, turnKey: 'c:_' })
+    const state = { activeDraftStreams: new Set<string>(), finalAnswerDelivered: false }
+
+    // First emit is final — clears via the first-emit site.
+    simulateExecuteStreamReply(
+      { text: 'answer', disableNotification: false },
+      'c:_',
+      state,
+    )
+    expect(readSilentEndState()).toBeNull()
+
+    // A second final-shaped emit on the same stream re-enters the
+    // L5343 clear. State is already gone — must be a no-op.
+    expect(() => {
+      simulateExecuteStreamReply(
+        { text: 'addendum', disableNotification: false },
+        'c:_',
+        state,
+      )
+    }).not.toThrow()
+    expect(readSilentEndState()).toBeNull()
+  })
+
+  it('cross-turn safety: clearSilentEndState on turnKey A does NOT clear state for turnKey B', () => {
+    // The clear is keyed on turnKey via the writer's stored value —
+    // a clear call for a DIFFERENT turn must not unlink a state file
+    // written for the in-flight turn. This guards against the L5343
+    // clear accidentally racing a turn-end writer for a newer turn.
+    writeSilentEndState({ chatId: 'c', threadId: null, turnKey: 'c:turn-B' })
+    // A stale clear for turn-A — silent-end.ts only unlinks when the
+    // stored turnKey matches.
+    clearSilentEndState('c:turn-A')
+    expect(readSilentEndState()).not.toBeNull()
+    expect(readSilentEndState()!.turnKey).toBe('c:turn-B')
+
+    // The matching clear works.
+    clearSilentEndState('c:turn-B')
+    expect(readSilentEndState()).toBeNull()
+  })
+})

package/telegram-plugin/tests/silent-end-interrupt-stop-integration.test.ts

@@ -0,0 +1,242 @@
+/**
+ * Integration test for the silent-end Stop hook .mjs.
+ *
+ * Spawns the real script as a subprocess with a synthetic transcript
+ * on disk and the Stop event JSON on stdin. Pins the contract that
+ * matters at the hook boundary: stdout JSON shape, exit code,
+ * retry-count side-effect on the state file.
+ *
+ * Complements `silent-end-interrupt-stop-scan.test.ts` (which pins
+ * the pure helper in isolation). This test guards against
+ * regressions in:
+ *   - stdin parsing
+ *   - transcript_path file IO + fail-open on read errors
+ *   - state-file retry-count increment
+ *   - retry-budget exhaustion → allow
+ *   - block-decision stdout shape
+ */
+
+import { describe, it, expect, beforeEach, afterEach } from 'vitest'
+import { spawnSync } from 'node:child_process'
+import {
+  mkdtempSync,
+  mkdirSync,
+  writeFileSync,
+  readFileSync,
+  existsSync,
+  rmSync,
+} from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, resolve } from 'node:path'
+
+const HOOK_PATH = resolve(
+  __dirname,
+  '..',
+  'hooks',
+  'silent-end-interrupt-stop.mjs',
+)
+
+interface RunResult {
+  status: number | null
+  stdout: string
+  stderr: string
+}
+
+function runHook(input: { event: object; stateDir: string }): RunResult {
+  const r = spawnSync('node', [HOOK_PATH], {
+    input: JSON.stringify(input.event),
+    encoding: 'utf8',
+    timeout: 5000,
+    env: { ...process.env, TELEGRAM_STATE_DIR: input.stateDir },
+  })
+  return { status: r.status, stdout: r.stdout, stderr: r.stderr }
+}
+
+function writeTranscript(dir: string, lines: object[]): string {
+  const p = join(dir, 'transcript.jsonl')
+  writeFileSync(p, lines.map((l) => JSON.stringify(l)).join('\n'), 'utf8')
+  return p
+}
+
+const ENQUEUE = {
+  type: 'queue-operation',
+  operation: 'enqueue',
+  content: '<channel source="switchroom-telegram" chat_id="111" message_id="42">hi</channel>',
+}
+
+function reply(text: string, opts: { disable_notification?: boolean; done?: boolean } = {}) {
+  return {
+    type: 'assistant',
+    message: {
+      content: [
+        {
+          type: 'tool_use',
+          name: 'mcp__switchroom-telegram__reply',
+          input: { text, ...opts },
+        },
+      ],
+    },
+  }
+}
+
+describe('silent-end-interrupt-stop.mjs — integration', () => {
+  let tmp: string
+  let stateDir: string
+
+  beforeEach(() => {
+    tmp = mkdtempSync(join(tmpdir(), 'silent-end-hook-'))
+    stateDir = join(tmp, 'state')
+    mkdirSync(stateDir, { recursive: true })
+  })
+
+  afterEach(() => {
+    try { rmSync(tmp, { recursive: true, force: true }) } catch { /* ignore */ }
+  })
+
+  it('allows stop when transcript shows a notification-bearing reply', () => {
+    const transcript = writeTranscript(tmp, [
+      ENQUEUE,
+      reply('ok', { disable_notification: false }),
+    ])
+    const r = runHook({
+      event: { session_id: 's1', transcript_path: transcript },
+      stateDir,
+    })
+    expect(r.status).toBe(0)
+    expect(r.stdout.trim()).toBe('')
+    expect(existsSync(join(stateDir, 'silent-end-pending.json'))).toBe(false)
+  })
+
+  it("blocks + writes retryCount=1 when transcript shows ack-only (Ken's repro)", () => {
+    const transcript = writeTranscript(tmp, [
+      ENQUEUE,
+      reply('on it — checking now', { disable_notification: true }),
+      { type: 'assistant', message: { content: [{ type: 'tool_use', name: 'Bash', input: {} }] } },
+      // 2237-char answer as plain text, no reply tool
+      {
+        type: 'assistant',
+        message: { content: [{ type: 'text', text: 'A'.repeat(2237) }] },
+      },
+    ])
+    const r = runHook({
+      event: { session_id: 's1', transcript_path: transcript },
+      stateDir,
+    })
+    expect(r.status).toBe(0)
+    const out = JSON.parse(r.stdout)
+    expect(out.decision).toBe('block')
+    expect(out.reason).toMatch(/Send your final answer/)
+    expect(out.reason).toMatch(/NO_REPLY/)
+    // Retry-count file was written.
+    const statePath = join(stateDir, 'silent-end-pending.json')
+    expect(existsSync(statePath)).toBe(true)
+    const state = JSON.parse(readFileSync(statePath, 'utf8'))
+    expect(state.retryCount).toBe(1)
+    // Reviewer-flagged regression: the hook's state-file write MUST
+    // include turnKey + chatId derived from the enqueue envelope. Without
+    // these, the gateway's later `recordSilentTurnEnd` write (~175ms after
+    // the hook) sees a turnKey mismatch and resets retryCount to 0,
+    // doubling the effective re-prompt budget. The shape here must match
+    // `chatKey(chatId, threadId)` at telegram-plugin/gateway/chat-key.ts:46.
+    expect(state.chatId).toBe('111')
+    expect(state.turnKey).toBe('111:_')
+  })
+
+  it('preserves retryCount across the hook→gateway write order (reviewer regression)', () => {
+    // Simulates what happens on the gateway side once it runs its own
+    // `writeSilentEndState` ~175ms after the hook: it reads the hook's
+    // file, sees matching turnKey, preserves retryCount. Then the next
+    // `recordSilentTurnEnd` call sees retryCount=1 >= MAX_RETRIES=1 and
+    // returns exhausted — the design budget. Without matching turnKey
+    // this branch never fires on time and the budget doubles.
+    const transcript = writeTranscript(tmp, [
+      ENQUEUE,
+      reply('on it', { disable_notification: true }),
+    ])
+    const r = runHook({
+      event: { session_id: 's1', transcript_path: transcript },
+      stateDir,
+    })
+    expect(r.status).toBe(0)
+    const statePath = join(stateDir, 'silent-end-pending.json')
+    const state = JSON.parse(readFileSync(statePath, 'utf8'))
+    expect(state.turnKey).toBe('111:_')
+    expect(state.retryCount).toBe(1)
+  })
+
+  it('allows stop when retry budget already exhausted (retryCount >= MAX_RETRIES)', () => {
+    const transcript = writeTranscript(tmp, [
+      ENQUEUE,
+      // Still no final reply, BUT retry already spent — gateway will
+      // post the user-facing fallback so the user isn't left silent.
+      reply('ack', { disable_notification: true }),
+    ])
+    const statePath = join(stateDir, 'silent-end-pending.json')
+    writeFileSync(statePath, JSON.stringify({ retryCount: 1, chatId: '111' }), 'utf8')
+
+    const r = runHook({
+      event: { session_id: 's1', transcript_path: transcript },
+      stateDir,
+    })
+    expect(r.status).toBe(0)
+    expect(r.stdout.trim()).toBe('')
+    expect(r.stderr).toMatch(/retry exhausted/)
+    // State unchanged.
+    const state = JSON.parse(readFileSync(statePath, 'utf8'))
+    expect(state.retryCount).toBe(1)
+  })
+
+  it('NO_REPLY in transcript → allow stop, no state file written', () => {
+    const transcript = writeTranscript(tmp, [
+      ENQUEUE,
+      reply('NO_REPLY'),
+    ])
+    const r = runHook({
+      event: { session_id: 's1', transcript_path: transcript },
+      stateDir,
+    })
+    expect(r.status).toBe(0)
+    expect(r.stdout.trim()).toBe('')
+    expect(existsSync(join(stateDir, 'silent-end-pending.json'))).toBe(false)
+  })
+
+  it('fail-open when transcript_path missing from event', () => {
+    const r = runHook({
+      event: { session_id: 's1' },
+      stateDir,
+    })
+    expect(r.status).toBe(0)
+    expect(r.stdout.trim()).toBe('')
+  })
+
+  it('fail-open when transcript_path does not exist on disk', () => {
+    const r = runHook({
+      event: { session_id: 's1', transcript_path: '/does/not/exist.jsonl' },
+      stateDir,
+    })
+    expect(r.status).toBe(0)
+    expect(r.stdout.trim()).toBe('')
+  })
+
+  it('fail-open on malformed stdin', () => {
+    const r = spawnSync('node', [HOOK_PATH], {
+      input: 'this is not JSON',
+      encoding: 'utf8',
+      timeout: 5000,
+      env: { ...process.env, TELEGRAM_STATE_DIR: stateDir },
+    })
+    expect(r.status).toBe(0)
+    expect(r.stdout.trim()).toBe('')
+  })
+
+  it('empty stdin → exit 0 immediately', () => {
+    const r = spawnSync('node', [HOOK_PATH], {
+      input: '',
+      encoding: 'utf8',
+      timeout: 5000,
+      env: { ...process.env, TELEGRAM_STATE_DIR: stateDir },
+    })
+    expect(r.status).toBe(0)
+    expect(r.stdout.trim()).toBe('')
+  })
+})