switchroom 0.13.53 → 0.13.55

package/telegram-plugin/tests/ipc-validator.test.ts

@@ -271,4 +271,65 @@ describe('validateClientMessage', () => {
       expect(validateClientMessage({ type: 'heartbeat' })).toBe(false)
     })
   })
+
+  describe('request_ms365_approval (RFC #1873 §8 PR 4)', () => {
+    const valid = {
+      type: 'request_ms365_approval',
+      correlationId: 'abc123',
+      agentName: 'clerk',
+      preview: { agentName: 'clerk', toolName: 'mcp__ms-365__upload-file-content' },
+      ttlMs: 300000,
+    }
+
+    it('accepts a valid request_ms365_approval', () => {
+      expect(validateClientMessage(valid)).toBe(true)
+    })
+
+    it('accepts when ttlMs is omitted (handler uses default)', () => {
+      const { ttlMs: _, ...without } = valid
+      expect(validateClientMessage(without)).toBe(true)
+    })
+
+    it('rejects missing correlationId', () => {
+      const { correlationId: _, ...m } = valid
+      expect(validateClientMessage(m)).toBe(false)
+    })
+
+    it('rejects empty correlationId', () => {
+      expect(validateClientMessage({ ...valid, correlationId: '' })).toBe(false)
+    })
+
+    it('rejects oversized correlationId (>64 chars)', () => {
+      expect(validateClientMessage({ ...valid, correlationId: 'x'.repeat(65) })).toBe(false)
+    })
+
+    it('rejects missing agentName', () => {
+      const { agentName: _, ...m } = valid
+      expect(validateClientMessage(m)).toBe(false)
+    })
+
+    it('rejects malformed agentName (caps, spaces)', () => {
+      expect(validateClientMessage({ ...valid, agentName: 'NOT-LOWER' })).toBe(false)
+      expect(validateClientMessage({ ...valid, agentName: 'has space' })).toBe(false)
+    })
+
+    it('rejects null / non-object preview', () => {
+      expect(validateClientMessage({ ...valid, preview: null })).toBe(false)
+      expect(validateClientMessage({ ...valid, preview: 'string' })).toBe(false)
+      expect(validateClientMessage({ ...valid, preview: 42 })).toBe(false)
+    })
+
+    it('rejects negative ttlMs', () => {
+      expect(validateClientMessage({ ...valid, ttlMs: -1 })).toBe(false)
+    })
+
+    it('rejects non-finite ttlMs', () => {
+      expect(validateClientMessage({ ...valid, ttlMs: Infinity })).toBe(false)
+      expect(validateClientMessage({ ...valid, ttlMs: NaN })).toBe(false)
+    })
+
+    it('rejects non-number ttlMs', () => {
+      expect(validateClientMessage({ ...valid, ttlMs: '300000' })).toBe(false)
+    })
+  })
 })

package/telegram-plugin/tests/slash-command-smart-split.test.ts

@@ -0,0 +1,115 @@
+import { describe, expect, it } from 'vitest'
+import { resolveOutboundTopic } from '../../src/telegram/topic-router.js'
+
+/**
+ * PR5 — supergroup-mode slash-command smart-split (CPO #4).
+ *
+ * The gateway wires `runSwitchroomCommand` → `switchroomReply` →
+ * `slashCommandReplyOpts(ctx, classification)` → `resolveOutboundTopic`.
+ * The helper is a thin classifier on top of the existing router; this
+ * test pins the END contract that drives all 4 heavy-output commands
+ * (/logs, /audit, /upgradestatus, /memory) and any future mutation
+ * additions:
+ *
+ *   - query → follows the originating topic (or undefined for fleet/DM)
+ *   - mutation → admin alias (or undefined for fleet/DM)
+ *   - heavy → admin alias (or undefined for fleet/DM)
+ *
+ * The gateway wrapper additionally collapses `target === originThreadId`
+ * back to `{}` so a query in the originating topic doesn't write a
+ * redundant `message_thread_id` opt. That's a wire-shape micro-opt
+ * tested separately at the call site.
+ */
+
+describe('PR5 slash-command smart split — router contract', () => {
+  const supergroup = {
+    default_topic_id: 1,
+    topic_aliases: { planning: 17, admin: 31, alerts: 42 },
+  }
+  const fleet = {} // no chat_id / default_topic_id → fleet/DM
+
+  describe('query class', () => {
+    it('supergroup: follows originThreadId', () => {
+      expect(
+        resolveOutboundTopic(supergroup, {
+          kind: 'command-query',
+          originThreadId: 17,
+        }),
+      ).toBe(17)
+    })
+
+    it('fleet: returns originThreadId unchanged (caller passes-through)', () => {
+      expect(
+        resolveOutboundTopic(fleet, {
+          kind: 'command-query',
+          originThreadId: 17,
+        }),
+      ).toBe(17)
+    })
+
+    it('supergroup, no origin thread (chat root): default_topic_id fallback', () => {
+      // command-query returns originThreadId verbatim, including
+      // undefined; the wrapper collapses undefined to "no override"
+      // and grammY's ctx.reply picks the originating topic anyway.
+      expect(
+        resolveOutboundTopic(supergroup, {
+          kind: 'command-query',
+          originThreadId: undefined,
+        }),
+      ).toBeUndefined()
+    })
+  })
+
+  describe('mutation class', () => {
+    it('supergroup: routes to admin alias', () => {
+      expect(resolveOutboundTopic(supergroup, { kind: 'command-mutation' })).toBe(31)
+    })
+
+    it('supergroup with no admin alias: default_topic_id fallback', () => {
+      const cfg = { default_topic_id: 1, topic_aliases: { planning: 17 } }
+      expect(resolveOutboundTopic(cfg, { kind: 'command-mutation' })).toBe(1)
+    })
+
+    it('fleet: returns undefined (caller falls through to ctx.reply)', () => {
+      expect(resolveOutboundTopic(fleet, { kind: 'command-mutation' })).toBeUndefined()
+    })
+  })
+
+  describe('heavy class (the 4 commands actually wired in PR5)', () => {
+    it('supergroup: /logs /audit /upgradestatus /memory all route to admin', () => {
+      // All four commands fold through the same `slashCommandReplyOpts(ctx, "heavy")`
+      // wrapper, which fires the same router event. One assertion covers
+      // all of them.
+      expect(resolveOutboundTopic(supergroup, { kind: 'command-heavy' })).toBe(31)
+    })
+
+    it('supergroup with no admin alias: default_topic_id fallback', () => {
+      const cfg = { default_topic_id: 1, topic_aliases: { planning: 17 } }
+      expect(resolveOutboundTopic(cfg, { kind: 'command-heavy' })).toBe(1)
+    })
+
+    it('fleet: returns undefined (caller falls through to ctx.reply)', () => {
+      expect(resolveOutboundTopic(fleet, { kind: 'command-heavy' })).toBeUndefined()
+    })
+  })
+
+  describe('separation contract: query vs mutation/heavy take different paths', () => {
+    // Pins the structural intent: a query and a mutation issued from
+    // the SAME originating topic in the SAME supergroup must resolve
+    // to DIFFERENT topics. If anyone collapses the three classes back
+    // to one event kind, this test fails loudly.
+    it('query.originThread !== mutation.adminAlias', () => {
+      const q = resolveOutboundTopic(supergroup, {
+        kind: 'command-query',
+        originThreadId: 17,
+      })
+      const m = resolveOutboundTopic(supergroup, { kind: 'command-mutation' })
+      const h = resolveOutboundTopic(supergroup, { kind: 'command-heavy' })
+      expect(q).toBe(17)
+      expect(m).toBe(31)
+      expect(h).toBe(31)
+      expect(q).not.toBe(m)
+      expect(m).toBe(h) // mutation and heavy both → admin
+    })
+  })
+})

package/vendor/hindsight-memory/scripts/lib/gateway_ipc.py

@@ -54,6 +54,41 @@ def extract_chat_id_from_prompt(prompt: str) -> Optional[str]:
     return chat_id or None
 
 
+# Switchroom PR6a — extract topic context (chat_id + message_thread_id)
+# from the `<channel ...>` envelope. message_thread_id is present only
+# when the inbound came from a forum topic in a supergroup; for DMs and
+# fleet-shared groups it's absent. Topic alias resolution is the
+# caller's responsibility (env-injected JSON map of thread_id → alias).
+_THREAD_ID_RE = re.compile(
+    r"<channel\b[^>]*\bmessage_thread_id=[\"']([^\"']+)[\"']",
+    re.IGNORECASE,
+)
+
+
+def extract_topic_from_prompt(
+    prompt: str,
+) -> tuple[Optional[str], Optional[str]]:
+    """Pull (chat_id, message_thread_id) out of the channel envelope.
+
+    Returns ``(None, None)`` when the prompt isn't channel-wrapped.
+    Returns ``(chat_id, None)`` for DMs / non-forum chats where
+    `message_thread_id` is absent.
+
+    Both values are strings (mirroring the wire format — Telegram
+    thread_ids are numeric but we keep them as strings for cache-key
+    stability and config-map lookups).
+    """
+    chat_id = extract_chat_id_from_prompt(prompt)
+    if chat_id is None:
+        return None, None
+    head = prompt[:1024] if isinstance(prompt, str) else ""
+    tmatch = _THREAD_ID_RE.search(head)
+    thread_id = tmatch.group(1).strip() if tmatch else None
+    if thread_id == "":
+        thread_id = None
+    return chat_id, thread_id
+
+
 def gateway_socket_path() -> Optional[str]:
     """Resolve the gateway socket path for the current agent.
 

package/vendor/hindsight-memory/scripts/recall.py

@@ -58,7 +58,7 @@ from lib.content import (
 )
 from lib.daemon import get_api_url
 from lib.directives import fetch_active_directives, format_active_directives_block
-from lib.gateway_ipc import extract_chat_id_from_prompt, update_placeholder
+from lib.gateway_ipc import extract_chat_id_from_prompt, extract_topic_from_prompt, update_placeholder
 from lib.state import read_state, write_state
 
 LAST_RECALL_STATE = "last_recall.json"
@@ -99,6 +99,70 @@ DEMOTE_TAG_VARIANTS = (
     "no-recall",
 )
 
+# Switchroom PR6 — supergroup-mode topic filter mode.
+#
+# Controls how memories from OTHER topics are surfaced to the model
+# during recall. Default is "soft-preamble": all topic-tagged memories
+# are returned (the model decides relevance via the preamble that names
+# the active topic). "hard-filter" drops any memory whose stored
+# `metadata.thread_id` doesn't match the active prompt's thread_id —
+# the escape hatch if instrumentation shows binding failures (model
+# applying the right memory to the wrong topic).
+#
+# The mode is process-wide via env var. Memories with no thread_id
+# tag (legacy retains pre-PR6, or fleet-shared/DM agents) are NEVER
+# dropped — they pass through both modes regardless of active topic.
+TOPIC_FILTER_MODE_ENV = "HINDSIGHT_TOPIC_FILTER_MODE"
+TOPIC_FILTER_MODES = ("soft-preamble", "hard-filter")
+
+
+def _topic_filter_mode() -> str:
+    raw = os.environ.get(TOPIC_FILTER_MODE_ENV, "").strip().lower()
+    if raw in TOPIC_FILTER_MODES:
+        return raw
+    return "soft-preamble"
+
+
+def _filter_by_active_topic(results: list, active_thread_id: str | None) -> tuple[list, int]:
+    """When hard-filter mode is on AND we know the active thread, drop
+    any memory whose stored metadata.thread_id is set to a different
+    value. Untagged memories pass through unconditionally.
+
+    Returns (filtered_results, dropped_count).
+    """
+    if active_thread_id is None:
+        return results, 0
+    kept: list = []
+    dropped = 0
+    for m in results:
+        meta = m.get("metadata") if isinstance(m, dict) else None
+        if not isinstance(meta, dict):
+            kept.append(m)
+            continue
+        source_thread = meta.get("thread_id")
+        if source_thread is None or str(source_thread) == str(active_thread_id):
+            kept.append(m)
+        else:
+            dropped += 1
+    return kept, dropped
+
+
+def _summarise_source_topics(results: list) -> dict:
+    """Build a {thread_id: count} summary of recalled memories'
+    source topics. Used for instrumented binding-failure analysis
+    in the recall log.
+    """
+    summary: dict = {}
+    for m in results:
+        meta = m.get("metadata") if isinstance(m, dict) else None
+        if not isinstance(meta, dict):
+            summary["__untagged__"] = summary.get("__untagged__", 0) + 1
+            continue
+        tid = meta.get("thread_id")
+        key = str(tid) if tid is not None else "__no_thread__"
+        summary[key] = summary.get(key, 0) + 1
+    return summary
+
 # Switchroom #432 phase 4.3 — recall telemetry log.
 #
 # Every recall (cache hit or miss) appends a JSONL record to
@@ -123,15 +187,29 @@ def _cache_ttl_secs() -> int:
         return 0
 
 
-def _cache_key(session_id: str, prompt: str, bank_id: str, extra_banks: list) -> str:
+def _cache_key(
+    session_id: str,
+    prompt: str,
+    bank_id: str,
+    extra_banks: list,
+    active_thread_id: str | None = None,
+) -> str:
     """Stable hash for cache keying. Session_id is included so a new
     session always misses, regardless of the TTL setting. Extra banks
-    are sorted so list-order doesn't change the key."""
+    are sorted so list-order doesn't change the key.
+
+    PR6a: `active_thread_id` is included so cross-topic prompts in
+    supergroup mode (same session, same model, same prompt verbatim
+    but different topic) don't collide on the cache. Empty/None
+    collapses to the empty string — backward-compatible for
+    fleet-shared / DM agents where no thread_id is present.
+    """
     parts = [
         session_id or "",
         prompt or "",
         bank_id or "",
         ",".join(sorted(extra_banks or [])),
+        active_thread_id or "",
     ]
     payload = "\x1f".join(parts)
     return hashlib.sha256(payload.encode("utf-8")).hexdigest()
@@ -458,6 +536,25 @@ def main():
     if placeholder_chat_id:
         update_placeholder(placeholder_chat_id, "📚 recalling memories")
 
+    # PR6a — supergroup-mode topic context for the current turn.
+    # active_thread_id is the message_thread_id from the inbound
+    # envelope, used to (a) key the cache so cross-topic prompts
+    # don't collide, (b) optionally hard-filter memories by source
+    # topic, and (c) log source-vs-active distribution for
+    # binding-failure instrumentation.
+    active_chat_id, active_thread_id = extract_topic_from_prompt(prompt)
+    active_topic_alias = None
+    if active_thread_id is not None:
+        aliases_json = os.environ.get("HINDSIGHT_TOPIC_ALIASES_JSON", "")
+        if aliases_json:
+            try:
+                aliases = json.loads(aliases_json)
+                if isinstance(aliases, dict):
+                    inverse = {str(v): k for k, v in aliases.items()}
+                    active_topic_alias = inverse.get(str(active_thread_id))
+            except (json.JSONDecodeError, ValueError, TypeError):
+                pass
+
     # Resolve API URL (handles all three connection modes)
     def _dbg(*a):
         debug_log(config, *a)
@@ -483,7 +580,7 @@ def main():
     # Whole-session-scoped, opt-in via HINDSIGHT_RECALL_CACHE_TTL_SECS.
     cache_ttl = _cache_ttl_secs()
     cache_key = (
-        _cache_key(session_id, prompt, bank_id, additional_banks)
+        _cache_key(session_id, prompt, bank_id, additional_banks, active_thread_id)
         if cache_ttl > 0
         else ""
     )
@@ -507,6 +604,13 @@ def main():
                 "demoted_count": 0,
                 "capped": False,
                 "cache_hit": True,
+                # PR6 — record the active topic on cache hits too so the
+                # log is uniformly queryable (cache_key now includes
+                # active_thread_id, so a hit means the prior recall was
+                # for the same topic — no source_topics inferable here).
+                "active_thread_id": active_thread_id,
+                "active_topic_alias": active_topic_alias,
+                "topic_filter_mode": _topic_filter_mode(),
             })
             return
         debug_log(config, f"Recall cache MISS (key={cache_key[:12]}…)")
@@ -612,6 +716,28 @@ def main():
     if demoted_count > 0:
         debug_log(config, f"Filtered {demoted_count} demote-from-recall memories")
 
+    # PR6 — capture source-topic distribution BEFORE optional
+    # hard-filter so we can log the would-have-leaked count for
+    # binding-failure analysis. Computed unconditionally so the
+    # log row carries this for soft-preamble mode too (the
+    # whole point is to instrument binding rate over time).
+    source_topic_summary = _summarise_source_topics(results)
+
+    # PR6b — optional hard topic filter. Default soft-preamble (no-op);
+    # operator flips HINDSIGHT_TOPIC_FILTER_MODE=hard-filter when
+    # binding failures are observed. See _filter_by_active_topic and
+    # the TOPIC_FILTER_MODE_ENV comment block above for design notes.
+    topic_filter_mode = _topic_filter_mode()
+    topic_dropped = 0
+    if topic_filter_mode == "hard-filter":
+        results, topic_dropped = _filter_by_active_topic(results, active_thread_id)
+        if topic_dropped > 0:
+            debug_log(
+                config,
+                f"Topic hard-filter dropped {topic_dropped} cross-topic "
+                f"memories (active_thread_id={active_thread_id})",
+            )
+
     # Switchroom #475 — lexical-overlap relevance gate. Drops memories
     # whose Jaccard overlap with the query is below
     # `recallMinOverlap` (default 0.0 = disabled). Runs after the
@@ -660,9 +786,29 @@ def main():
         memories_formatted = format_memories(results)
         preamble = config.get("recallPromptPreamble", "")
         current_time = format_current_time()
+
+        # PR6 — supergroup-mode topic preamble (neutral tone per
+        # 2026-05-27 product decision). Only added when we know the
+        # active topic AND any of the recalled memories carries a
+        # thread_id tag — i.e. we have something for the model to
+        # be "topic-aware" about. Fleet-shared / DM agents never
+        # see this line.
+        topic_line = ""
+        if active_thread_id is not None and any(
+            isinstance(m.get("metadata"), dict)
+            and m["metadata"].get("thread_id") is not None
+            for m in results
+        ):
+            topic_label = active_topic_alias or f"thread {active_thread_id}"
+            topic_line = (
+                f"Current topic: {topic_label}. Recalled memories are "
+                f"tagged with their source topic.\n"
+            )
+
         memories_block = (
             f"<hindsight_memories>\n"
             f"{preamble}\n"
+            f"{topic_line}"
             f"Current time - {current_time}\n\n"
             f"{memories_formatted}\n"
             f"</hindsight_memories>"
@@ -732,6 +878,20 @@ def main():
             if isinstance(m, dict) and m.get("id")
         ],
         "cache_hit": False,
+        # PR6 — instrumentation for binding-failure analysis.
+        # `active_thread_id`: the current prompt's topic (null on
+        # DM / fleet-shared). `source_topics`: distribution of
+        # source thread_ids in the recall set (before optional
+        # hard-filter). `topic_filter_mode`: "soft-preamble" or
+        # "hard-filter". `topic_dropped`: count dropped by hard
+        # filter. From these fields we can derive the cross-topic
+        # recall rate over time and decide whether to flip to
+        # hard-filter mode based on real data.
+        "active_thread_id": active_thread_id,
+        "active_topic_alias": active_topic_alias,
+        "source_topics": source_topic_summary,
+        "topic_filter_mode": topic_filter_mode,
+        "topic_dropped": topic_dropped,
     })
 
     # Output JSON for Claude Code hook system

package/vendor/hindsight-memory/scripts/retain.py

@@ -225,6 +225,58 @@ def run_retain(hook_input: dict, force: bool = False) -> dict:
     for k, v in config.get("retainMetadata", {}).items():
         metadata[k] = _resolve_template(str(v))
 
+    # Switchroom PR6a — topic tagging for supergroup-mode agents.
+    # Scan the messages we're retaining for the latest `<channel
+    # chat_id=... message_thread_id=...>` envelope and stamp the
+    # tuple into metadata. Downstream (recall.py) uses this to log
+    # active-vs-source topic for binding-failure analysis and to
+    # support hard-filter mode when an operator opts in.
+    #
+    # No-op for fleet-shared / DM topology where every inbound from
+    # this agent carries the same chat_id (or no chat envelope at all
+    # for interactive / cron-only sessions) — the metadata is added
+    # but doesn't change behaviour.
+    try:
+        from lib.gateway_ipc import extract_topic_from_prompt
+        topic_chat_id = None
+        topic_thread_id = None
+        # Walk in reverse — most recent user message is the authoritative
+        # "active topic" at retain time.
+        for m in reversed(messages_to_retain):
+            if not isinstance(m, dict) or m.get("role") != "user":
+                continue
+            content = m.get("content")
+            text = content if isinstance(content, str) else (
+                # Claude Code list-content shape: [{type:"text", text:"..."}, ...]
+                next((p.get("text", "") for p in content if isinstance(p, dict) and p.get("type") == "text"), "")
+                if isinstance(content, list) else ""
+            )
+            c_id, t_id = extract_topic_from_prompt(text)
+            if c_id is not None:
+                topic_chat_id, topic_thread_id = c_id, t_id
+                break
+        if topic_chat_id is not None:
+            metadata["chat_id"] = topic_chat_id
+            if topic_thread_id is not None:
+                metadata["thread_id"] = topic_thread_id
+                # Resolve alias from operator-injected env map.
+                aliases_json = os.environ.get("HINDSIGHT_TOPIC_ALIASES_JSON", "")
+                if aliases_json:
+                    try:
+                        aliases = json.loads(aliases_json)
+                        # aliases is {alias_name: thread_id_int_or_str}; build
+                        # the inverse lookup once.
+                        if isinstance(aliases, dict):
+                            inverse = {str(v): k for k, v in aliases.items()}
+                            alias = inverse.get(str(topic_thread_id))
+                            if alias:
+                                metadata["topic_alias"] = alias
+                    except (json.JSONDecodeError, ValueError, TypeError):
+                        pass  # malformed env is non-fatal
+    except Exception as e:
+        # Topic tagging is best-effort — never fail a retain over it.
+        debug_log(config, f"Topic tagging skipped: {e}")
+
     debug_log(
         config, f"Retaining to bank '{bank_id}', doc '{document_id}', {message_count} messages, {len(transcript)} chars"
     )

package/vendor/hindsight-memory/scripts/tests/test_gateway_ipc.py

@@ -25,11 +25,53 @@ if SCRIPTS_DIR not in sys.path:
 
 from lib.gateway_ipc import (  # noqa: E402
     extract_chat_id_from_prompt,
+    extract_topic_from_prompt,
     gateway_socket_path,
     update_placeholder,
 )
 
 
+class ExtractTopicTests(unittest.TestCase):
+    """PR6a — (chat_id, message_thread_id) extraction for supergroup mode."""
+
+    def test_dm_returns_chat_id_thread_none(self):
+        # DM and fleet-shared envelopes carry chat_id only.
+        prompt = '<channel source="switchroom-telegram" chat_id="12345">hi</channel>'
+        self.assertEqual(extract_topic_from_prompt(prompt), ("12345", None))
+
+    def test_supergroup_topic_returns_both(self):
+        prompt = (
+            '<channel source="switchroom-telegram" '
+            'chat_id="-1001234" message_thread_id="17">hi</channel>'
+        )
+        self.assertEqual(extract_topic_from_prompt(prompt), ("-1001234", "17"))
+
+    def test_attribute_order_independent(self):
+        prompt = (
+            '<channel message_thread_id="42" chat_id="999" '
+            'source="x">hi</channel>'
+        )
+        self.assertEqual(extract_topic_from_prompt(prompt), ("999", "42"))
+
+    def test_single_quoted_thread_id(self):
+        prompt = "<channel chat_id='1' message_thread_id='7'>hi</channel>"
+        self.assertEqual(extract_topic_from_prompt(prompt), ("1", "7"))
+
+    def test_no_channel_envelope_returns_none_pair(self):
+        self.assertEqual(extract_topic_from_prompt("plain prompt"), (None, None))
+
+    def test_empty_thread_id_collapses_to_none(self):
+        # Defensive against malformed envelopes that include the attribute
+        # but with no value.
+        prompt = '<channel chat_id="1" message_thread_id="">hi</channel>'
+        self.assertEqual(extract_topic_from_prompt(prompt), ("1", None))
+
+    def test_only_inspects_first_kb(self):
+        # Pad BEFORE the envelope; both chat_id AND thread_id should be lost.
+        prompt = ("x" * 2000) + '<channel chat_id="1" message_thread_id="7">hi</channel>'
+        self.assertEqual(extract_topic_from_prompt(prompt), (None, None))
+
+
 class ExtractChatIdTests(unittest.TestCase):
     def test_double_quoted_attribute(self):
         prompt = '<channel source="switchroom-telegram" chat_id="12345" thread_id="-">\nhi\n</channel>'