switchroom 0.14.85 → 0.14.86

package/dist/auth-broker/index.js

@@ -13941,24 +13941,24 @@ class AuthBroker {
   }
   servingAccount(identity2) {
     const account = this.callerAccount(identity2);
-    if (identity2.kind !== "consumer")
+    if (identity2.kind === "operator")
       return account;
-    return this.consumerAccountWithFailover(account);
+    return this.accountWithFailover(account);
   }
   isAccountExhausted(account) {
     const q = this.quota[account];
     return q !== undefined && q.exhausted_until > this.now();
   }
-  consumerAccountWithFailover(pinned) {
-    if (!pinned || !this.isAccountExhausted(pinned))
-      return pinned;
+  accountWithFailover(account) {
+    if (!account || !this.isAccountExhausted(account))
+      return account ?? null;
     for (const cand of this.config.auth?.fallback_order ?? []) {
-      if (cand === pinned || this.isAccountExhausted(cand))
+      if (cand === account || this.isAccountExhausted(cand))
         continue;
       if (readAccountCredentials(cand, this.home))
         return cand;
     }
-    return pinned;
+    return account;
   }
   async opGetCredentials(socket, id, identity2) {
     const account = this.servingAccount(identity2);
@@ -14600,7 +14600,7 @@ class AuthBroker {
     const auth = this.config.auth ?? {};
     const fanned = [];
     for (const [name, agent] of Object.entries(this.config.agents ?? {})) {
-      const effective = agent.auth?.override ?? auth.active;
+      const effective = this.accountWithFailover(agent.auth?.override ?? auth.active);
       if (effective === label) {
         if (this.fanoutForAgent(name))
           fanned.push(name);
@@ -14645,7 +14645,7 @@ class AuthBroker {
     const agent = (this.config.agents ?? {})[name];
     if (!agent)
       return false;
-    const effective = agent.auth?.override ?? auth.active;
+    const effective = this.accountWithFailover(agent.auth?.override ?? auth.active);
     if (!effective)
       return false;
     return this.mirrorAccountToAgent(effective, name);

package/dist/cli/autoaccept-poll.js

@@ -176,7 +176,7 @@ function sendKeys2(agentName, keys) {
 
 // src/agents/wedge-watchdog.ts
 var WEDGE_FOOTER_SIGNATURE = /(?=[\s\S]*[Ee]sc(?:ape)?[^\n]*cancel)(?=[\s\S]*(?:to select|to navigate|\u2191\/\u2193))/;
-var RATE_LIMIT_MENU_SIGNATURE = /(?=[\s\S]*\/rate-limit-options)(?=[\s\S]*(?:Switch to usage credits|Upgrade your plan))/;
+var RATE_LIMIT_MENU_SIGNATURE = /(?=[\s\S]*Stop and wait for)(?=[\s\S]*(?:usage credits|Upgrade your plan|\/rate-limit-options))/;
 var MONTHS = {
   jan: 0,
   feb: 1,

package/dist/cli/switchroom.js

@@ -49815,8 +49815,8 @@ var {
 } = import__.default;
 
 // src/build-info.ts
-var VERSION = "0.14.85";
-var COMMIT_SHA = "292c683f";
+var VERSION = "0.14.86";
+var COMMIT_SHA = "8c518120";
 
 // src/cli/agent.ts
 init_source();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switchroom",
-  "version": "0.14.85",
+  "version": "0.14.86",
   "description": "Run Claude Code 24/7 on your Claude Pro/Max subscription over Telegram. Open-source alternative to OpenClaw and NanoClaw — no API keys.",
   "type": "module",
   "bin": {

package/telegram-plugin/dist/gateway/gateway.js

@@ -41381,6 +41381,15 @@ function createFleetFallbackGate(opts) {
   };
 }
 
+// gateway/exhaust-until.ts
+var EXHAUST_WEEKLY_FLOOR_MS = 7 * 24 * 60 * 60 * 1000;
+function resolveExhaustUntil(resetAtMs, now = Date.now()) {
+  if (typeof resetAtMs === "number" && Number.isFinite(resetAtMs) && resetAtMs > now) {
+    return resetAtMs;
+  }
+  return now + EXHAUST_WEEKLY_FLOOR_MS;
+}
+
 // gateway/auth-add-flow.ts
 import { spawn } from "node:child_process";
 import { existsSync as existsSync13, mkdirSync as mkdirSync10, readFileSync as readFileSync9, rmSync as rmSync3 } from "node:fs";
@@ -52880,11 +52889,11 @@ function sweepStaleTurnActiveMarker(stateDir, opts) {
 }
 
 // ../src/build-info.ts
-var VERSION = "0.14.85";
-var COMMIT_SHA = "292c683f";
-var COMMIT_DATE = "2026-06-07T14:50:17+10:00";
-var LATEST_PR = null;
-var COMMITS_AHEAD_OF_TAG = 2;
+var VERSION = "0.14.86";
+var COMMIT_SHA = "8c518120";
+var COMMIT_DATE = "2026-06-07T05:43:21Z";
+var LATEST_PR = 2223;
+var COMMITS_AHEAD_OF_TAG = 0;
 
 // gateway/boot-version.ts
 function formatRelativeAgo(iso) {
@@ -55245,7 +55254,8 @@ function emitGatewayOperatorEvent(event) {
     });
     renderedKeyboard = undefined;
     if (willActuallyFire) {
-      fireFleetAutoFallback(agent);
+      const untilMs = resolveExhaustUntil(modelUnavailable.resetAt?.getTime());
+      fireFleetAutoFallback(agent, untilMs);
     }
   } else {
     try {
@@ -56182,8 +56192,7 @@ var ipcServer = createIpcServer({
     }
   },
   onQuotaWallDetected(_client, msg) {
-    const WEEKLY_MS = 604800000;
-    const untilMs = typeof msg.resetAt === "number" && Number.isFinite(msg.resetAt) && msg.resetAt > Date.now() ? msg.resetAt : Date.now() + WEEKLY_MS;
+    const untilMs = resolveExhaustUntil(msg.resetAt);
     process.stderr.write(`telegram gateway: quota_wall_detected agent=${msg.agentName} until=${new Date(untilMs).toISOString()}` + (msg.resetAt == null ? " (reset unparsed \u2192 +7d default)" : "") + ` \u2014 triggering fleet auto-fallback
 `);
     fireFleetAutoFallback(msg.agentName, untilMs);

package/telegram-plugin/gateway/exhaust-until.ts

@@ -0,0 +1,45 @@
+/**
+ * exhaust-until.ts — the single decision for the `until` (epoch-ms) handed to
+ * the broker's mark-exhausted, shared by BOTH quota-wall paths in the gateway:
+ *   - the /rate-limit-options menu signal (onQuotaWallDetected), and
+ *   - the inference-path 429 (the model-unavailable operator-event path).
+ *
+ * Factored out of gateway.ts so the decision is unit-testable without importing
+ * the gateway module (heavy import-time side effects). Pure: no IPC, no clock
+ * except the injectable `now`.
+ *
+ * The ONE invariant both paths depend on: NEVER return undefined. A weekly wall
+ * reaches the gateway as a reset hint the parser can't always read:
+ *   - Menu path: the sidecar's parseWeeklyReset handles "resets Jun 9, 5am (tz)"
+ *     → a finite future epoch flows straight through.
+ *   - 429 path: model-unavailable.ts's parseResetTime handles the ROLLING
+ *     wordings ("resets in 2h", "retry after 60s") → a finite ~hours epoch. But
+ *     the WEEKLY wording reaches it as "resets <Mon> <D>, <H>am", which
+ *     parseResetTime CANNOT parse (`new Date('Jun 9, 5am 2026')` → Invalid Date)
+ *     → resetAtMs is undefined here EXACTLY when the wall is weekly.
+ *
+ * undefined (or a past / NaN reset) is the dangerous case: markExhausted's ~5h
+ * default would un-exhaust a weekly-walled account after 5h and let the broker
+ * re-mirror it onto the fleet (the #2218 rollback). So undefined → the +7d
+ * floor. A too-long `until` only delays the broker's re-probe of the account;
+ * it never serves an exhausted account, so erring long is the compliance-safe
+ * direction (vision.md pillar 3).
+ */
+
+/** Weekly-quota window — the safety floor for an exhaustion `until`. */
+export const EXHAUST_WEEKLY_FLOOR_MS = 7 * 24 * 60 * 60 * 1000
+
+/**
+ * Resolve the exhaustion `until` (epoch-ms) from a best-effort reset timestamp.
+ * Returns `resetAtMs` when it is a finite epoch in the future; otherwise the
+ * +7d floor anchored at `now`. NEVER returns undefined.
+ */
+export function resolveExhaustUntil(
+  resetAtMs: number | undefined,
+  now: number = Date.now(),
+): number {
+  if (typeof resetAtMs === 'number' && Number.isFinite(resetAtMs) && resetAtMs > now) {
+    return resetAtMs
+  }
+  return now + EXHAUST_WEEKLY_FLOOR_MS
+}

package/telegram-plugin/gateway/gateway.ts

@@ -125,6 +125,7 @@ import {
 } from './microsoft-connect-flow.js'
 import { resolveAuthBrokerSocketPath } from '../../src/auth/broker/client.js'
 import { createFleetFallbackGate } from '../fleet-fallback-gate.js'
+import { resolveExhaustUntil } from './exhaust-until.js'
 import {
   pendingAuthAddFlows,
   startAccountAuthSession,
@@ -4400,8 +4401,17 @@ function emitGatewayOperatorEvent(event: OperatorEvent): void {
     // separately with the causal-shape headline ("5-hour limit on
     // ken" instead of generic "quota exhausted") — see
     // auth-snapshot-format.ts → renderFallbackAnnouncement.
+    //
+    // Thread the parsed reset as markExhausted's `until` via the shared
+    // resolveExhaustUntil floor. parseResetTime gives a finite epoch for
+    // ROLLING wordings ("resets in 2h", "retry after 60s"); a WEEKLY wall
+    // ("resets Jun 9, 5am") is UNPARSEABLE here → undefined → +7d floor.
+    // Pre-fix this called fireFleetAutoFallback(agent) with no until, so a
+    // weekly wall that surfaced as a 429 got markExhausted's ~5h default and
+    // the broker re-mirrored the still-walled account onto the fleet after 5h.
     if (willActuallyFire) {
-      void fireFleetAutoFallback(agent)
+      const untilMs = resolveExhaustUntil(modelUnavailable.resetAt?.getTime())
+      void fireFleetAutoFallback(agent, untilMs)
     }
   } else {
     try {
@@ -6271,11 +6281,7 @@ const ipcServer: IpcServer = createIpcServer({
   // existing chain handles the rest (roll to a fallback subscription account,
   // or the all-exhausted operator alert when none has quota). Fire-and-forget.
   onQuotaWallDetected(_client: IpcClient, msg: QuotaWallDetectedMessage) {
-    const WEEKLY_MS = 7 * 24 * 60 * 60 * 1000
-    const untilMs =
-      typeof msg.resetAt === 'number' && Number.isFinite(msg.resetAt) && msg.resetAt > Date.now()
-        ? msg.resetAt
-        : Date.now() + WEEKLY_MS
+    const untilMs = resolveExhaustUntil(msg.resetAt)
     process.stderr.write(
       `telegram gateway: quota_wall_detected agent=${msg.agentName} ` +
         `until=${new Date(untilMs).toISOString()}` +
@@ -14681,10 +14687,12 @@ async function doFireFleetAutoFallback(triggerAgent: string, untilMs?: number):
       // operator is explicitly choosing, and is admin); only this automatic
       // path moves to the non-admin verb.
       failover: async () => {
-        // The 429 inference path passes no `until` (broker ~5h default). The
-        // rate-limit-MENU path (quota_wall_detected) passes the parsed WEEKLY
-        // reset, so the walled account isn't re-probed (and re-wedged) within
-        // the 5h default while it's weekly-capped.
+        // BOTH paths now pass a resolved `untilMs` via resolveExhaustUntil
+        // (never undefined): the rate-limit-MENU path threads the parsed weekly
+        // reset, and the 429 inference path threads parseResetTime's value or
+        // the +7d floor when it's a weekly wall it can't parse. So a
+        // weekly-capped account is never re-probed (and re-wedged) within the
+        // broker's ~5h default.
         const r = await client.markExhausted(untilMs)
         return { rolledTo: r.rolledTo ?? null, rolled: r.rolled }
       },

package/telegram-plugin/tests/exhaust-until.test.ts

@@ -0,0 +1,86 @@
+/**
+ * Unit tests for the shared exhaustion-`until` decision (exhaust-until.ts) and
+ * the 429-path composition it sits in.
+ *
+ * The load-bearing invariant (vision.md pillar 3 + the #2218 weekly-wall
+ * rollback): the value handed to markExhausted is NEVER undefined, so a weekly
+ * wall can never fall back to the broker's ~5h default and un-exhaust early.
+ *
+ * The 429-path composition test runs the REAL detectModelUnavailable
+ * (model-unavailable.ts) into the REAL resolveExhaustUntil — proving the gateway
+ * 429 branch (`resolveExhaustUntil(modelUnavailable.resetAt?.getTime())`) threads
+ * a finite `until` for both the rolling and the unparseable-weekly wordings.
+ */
+
+import { describe, it, expect } from 'vitest'
+import { resolveExhaustUntil, EXHAUST_WEEKLY_FLOOR_MS } from '../gateway/exhaust-until.js'
+import { detectModelUnavailable } from '../model-unavailable.js'
+
+const NOW = Date.UTC(2026, 5, 7, 0, 0, 0) // 2026-06-07
+
+describe('resolveExhaustUntil', () => {
+  it('passes through a finite reset in the future', () => {
+    const reset = NOW + 2 * 60 * 60 * 1000 // +2h (a rolling window)
+    expect(resolveExhaustUntil(reset, NOW)).toBe(reset)
+  })
+
+  it('undefined → +7d floor (the WEEKLY-wall case), never undefined', () => {
+    const until = resolveExhaustUntil(undefined, NOW)
+    expect(until).toBe(NOW + EXHAUST_WEEKLY_FLOOR_MS)
+    expect(until).toBeGreaterThan(NOW + 5 * 60 * 60 * 1000) // past the ~5h default
+  })
+
+  it('a past / now / NaN / non-finite reset → +7d floor (treated as unparsed)', () => {
+    expect(resolveExhaustUntil(NOW - 1, NOW)).toBe(NOW + EXHAUST_WEEKLY_FLOOR_MS)
+    expect(resolveExhaustUntil(NOW, NOW)).toBe(NOW + EXHAUST_WEEKLY_FLOOR_MS)
+    expect(resolveExhaustUntil(Number.NaN, NOW)).toBe(NOW + EXHAUST_WEEKLY_FLOOR_MS)
+    expect(resolveExhaustUntil(Number.POSITIVE_INFINITY, NOW)).toBe(NOW + EXHAUST_WEEKLY_FLOOR_MS)
+  })
+
+  it('the floor is comfortably longer than the broker ~5h mark-exhausted default', () => {
+    expect(EXHAUST_WEEKLY_FLOOR_MS).toBeGreaterThan(5 * 60 * 60 * 1000)
+    expect(EXHAUST_WEEKLY_FLOOR_MS).toBe(7 * 24 * 60 * 60 * 1000)
+  })
+})
+
+describe('429-path composition: detectModelUnavailable → resolveExhaustUntil', () => {
+  // This mirrors gateway.ts's 429 branch:
+  //   const untilMs = resolveExhaustUntil(modelUnavailable.resetAt?.getTime())
+  // NB: parseResetTime anchors RELATIVE wordings ("in 2h", "retry after Ns") at
+  // the real Date.now() — not injectable through detectModelUnavailable — so the
+  // rolling-window assertions check the SHAPE (finite, future, well below the
+  // +7d floor, no longer than the stated window), never an exact epoch.
+  function untilFor(stderr: string): { u: number; before: number } {
+    const before = Date.now()
+    const d = detectModelUnavailable(stderr)
+    expect(d).not.toBeNull()
+    return { u: resolveExhaustUntil(d?.resetAt?.getTime(), before), before }
+  }
+
+  it('ROLLING wording ("resets in 2h 15m") → a finite ~2h until, NOT the +7d floor', () => {
+    const { u, before } = untilFor('usage limit reached · resets in 2h 15m')
+    expect(Number.isFinite(u)).toBe(true)
+    expect(u).toBeGreaterThan(before)
+    const window = (2 * 60 + 15) * 60 * 1000
+    expect(u).toBeLessThanOrEqual(before + window + 2000) // ~2h15m, allow detect/resolve skew
+    expect(u).toBeLessThan(before + EXHAUST_WEEKLY_FLOOR_MS / 2) // unmistakably NOT the floor
+  })
+
+  it('ROLLING wording ("retry after 60 seconds") → a finite ~60s until, NOT the +7d floor', () => {
+    const { u, before } = untilFor('rate_limit_error: retry after 60 seconds — usage limit')
+    expect(u).toBeGreaterThan(before)
+    expect(u).toBeLessThanOrEqual(before + 60 * 1000 + 2000)
+    expect(u).toBeLessThan(before + EXHAUST_WEEKLY_FLOOR_MS / 2)
+  })
+
+  it("WEEKLY wording (\"resets Jun 9, 5am (tz)\") is UNPARSEABLE on the 429 path → +7d floor, NOT undefined/5h", () => {
+    // parseResetTime can't read the calendar weekly wording — Invalid Date →
+    // resetAt undefined. resolveExhaustUntil MUST floor it to +7d, otherwise
+    // markExhausted's ~5h default re-wedges the weekly-walled account.
+    const d = detectModelUnavailable("You've hit your limit · resets Jun 9, 5am (Australia/Melbourne)")
+    expect(d?.kind).toBe('quota_exhausted')
+    expect(d?.resetAt).toBeUndefined() // pins the parser-blind-spot premise
+    const u = resolveExhaustUntil(d?.resetAt?.getTime(), NOW)
+    expect(u).toBe(NOW + EXHAUST_WEEKLY_FLOOR_MS)
+  })
+})