switchroom 0.15.2 → 0.15.4

package/telegram-plugin/gateway/gateway.ts

@@ -247,6 +247,7 @@ import {
 import {
   fetchQuota,
   formatQuotaBlock,
+  formatQuotaLine,
   type QuotaResult,
 } from '../quota-check.js'
 import {
@@ -258,7 +259,17 @@ import { DEFAULT_SLOT } from '../../src/auth/accounts.js'
 import { currentActiveSlot, type AuthCodeOutcome } from '../../src/auth/manager.js'
 import { injectSlashCommand as injectSlashCommandImpl } from '../../src/agents/inject.js'
 import { handleInjectCommand } from './inject-handler.js'
-import { parseModelCommand, handleModelCommand } from './model-command.js'
+import {
+  parseModelCommand,
+  handleModelCommand,
+  buildModelMenu,
+  handleModelMenuCallback,
+  MODEL_CALLBACK_PREFIX,
+  type ModelMenuDeps,
+  type ModelCommandDeps,
+  type ModelMenuReply,
+} from './model-command.js'
+import { discoverModels, selectModel } from '../../src/agents/model-picker.js'
 import { type BannerState } from '../slot-banner.js'
 import { refreshBanner } from '../slot-banner-driver.js'
 import { loadConfig as loadSwitchroomConfig, findConfigFile as findSwitchroomConfigFile } from '../../src/config/loader.js'; import { resolveAgentConfig } from '../../src/config/merge.js'
@@ -6598,7 +6609,7 @@ if (!STATIC) {
     // promise EXPLICITLY (honest failure) instead of letting it sit
     // forever. This is what makes the guarantee deterministic: every
     // queued message ends either delivered or visibly retracted.
-    inboundSpool?.sweepEscalations((e) => {
+    inboundSpool?.sweepEscalations((e, { postNotice }) => {
       const chat = e.msg.chatId
       const escThread =
         typeof e.msg.meta?.threadId === 'string' && e.msg.meta.threadId
@@ -6609,7 +6620,14 @@ if (!STATIC) {
       // the message is being declared undeliverable, so the queued-status must
       // not dangle beside the "couldn't deliver" notice (idempotent best-effort;
       // a normal turn-start/turn-end reaps far sooner — this is the 15-min edge).
+      // Reaping happens for EVERY dropped entry; only the user-facing notice is
+      // coalesced (postNotice), so a burst of undeliverable inbounds doesn't
+      // leave dangling placeholders even when its notice is suppressed.
       reapQueuedStatus(chat, escThread)
+      // Coalesced per chat by the spool's sliding window — a multi-restart
+      // outage that re-ages a synthetic into the bound every 15 min posts ONE
+      // notice, not one per cycle (the 2026-06-09 marko "please resend" spam).
+      if (!postNotice) return
       void swallowingApiCall(
         () =>
           bot.api.sendMessage(
@@ -13756,6 +13774,14 @@ function buildAgentAudit(agentName: string): AgentAudit | undefined {
 // broker's fleet-wide `ListStateData` payload via
 // `buildAuthSummaryFromBroker`, with billingType pulled from the
 // agent's `.claude.json` (the broker doesn't track plan tier).
+/**
+ * Live session-model override set by the `/model` picker (session-only). Held
+ * in gateway memory so it clears on restart, the same point at which claude's
+ * session reverts to the configured model — keeping `/status` honest without
+ * a persisted store. Null when no session switch is active.
+ */
+let activeSessionModelOverride: string | null = null
+
 async function buildAgentMetadata(agentName: string): Promise<AgentMetadata> {
   type AgentListResp = {
     agents: Array<{
@@ -13784,6 +13810,7 @@ async function buildAgentMetadata(agentName: string): Promise<AgentMetadata> {
   return {
     agentName,
     model: a?.model ?? null,
+    sessionModel: activeSessionModelOverride,
     extendsProfile: (a?.extends ?? a?.template) ?? null,
     topicName: a?.topic_name ?? null,
     topicEmoji: a?.topic_emoji ?? null,
@@ -13922,19 +13949,39 @@ bot.command('inject', async ctx => {
   })
 })
 
-// /model — show or switch the Claude model for this agent's live
-// session. The argument form rides the same allowlisted inject
-// primitive as /inject (claude's native `/model <name>` REPL command);
-// the bare form never injects (the no-arg picker is an undriveable TUI
-// modal from Telegram). Implementation in model-command.ts so it's
+// /model — model dashboard + switch for this agent's live session.
+// Bare form: drives claude's own /model picker (open → parse → Esc,
+// src/agents/model-picker.ts) to discover the live option list — no
+// hardcoded model names — and renders it as an inline-keyboard menu
+// with the current model + a brief quota line. A tap re-opens the
+// picker fresh and applies session-only (`s`). Kill-switch
+// SWITCHROOM_MODEL_MENU=0 reverts the bare form to the static v1
+// text. The typed argument form rides the allowlisted inject
+// primitive unchanged. Implementation in model-command.ts so it's
 // unit-testable without booting the bot.
-bot.command('model', async ctx => {
-  if (!isAuthorizedSender(ctx)) return
-  const text = ctx.message?.text ?? ctx.channelPost?.text ?? ''
-  const parsed = parseModelCommand(text) ?? { kind: 'show' as const }
-  const reply = await handleModelCommand(parsed, {
-    inject: injectSlashCommandImpl,
+function buildModelDeps(): ModelMenuDeps & ModelCommandDeps {
+  return {
+    discover: (a) => discoverModels(a),
+    select: (a, label) => selectModel(a, label),
+    isBusy: () => currentTurn !== null,
     getAgentName: getMyAgentName,
+    getQuotaBrief: async () => {
+      // Broker-routed probe first (authoritative), local headers as
+      // fallback — same ladder as the boot card / legacy /usage.
+      try {
+        const probed = await probeQuotaForBootCard(getMyAgentName(), 4000)
+        if (probed?.ok) return formatQuotaLine(probed.data)
+      } catch { /* fall through */ }
+      try {
+        const agentDir = resolveAgentDirFromEnv()
+        if (agentDir) {
+          const local = await fetchQuota({ claudeConfigDir: join(agentDir, '.claude') })
+          if (local.ok) return formatQuotaLine(local.data)
+        }
+      } catch { /* quota is garnish — never block the menu on it */ }
+      return null
+    },
+    inject: injectSlashCommandImpl,
     getConfiguredModel: () => {
       type AgentListResp = { agents: Array<{ name: string; model?: string | null }> }
       const data = switchroomExecJson<AgentListResp>(['agent', 'list'])
@@ -13942,7 +13989,30 @@ bot.command('model', async ctx => {
     },
     escapeHtml: escapeHtmlForTg,
     preBlock,
-  })
+  }
+}
+
+function modelMenuReplyMarkup(reply: ModelMenuReply): InlineKeyboard | undefined {
+  if (!reply.keyboard) return undefined
+  const kb = new InlineKeyboard()
+  for (const row of reply.keyboard) {
+    for (const btn of row) kb.text(btn.text, btn.callback_data)
+    kb.row()
+  }
+  return kb
+}
+
+bot.command('model', async ctx => {
+  if (!isAuthorizedSender(ctx)) return
+  const text = ctx.message?.text ?? ctx.channelPost?.text ?? ''
+  const parsed = parseModelCommand(text) ?? { kind: 'show' as const }
+  const deps = buildModelDeps()
+  if (parsed.kind === 'show' && process.env.SWITCHROOM_MODEL_MENU !== '0') {
+    const menu = await buildModelMenu(deps)
+    await switchroomReply(ctx, menu.text, { html: true, reply_markup: modelMenuReplyMarkup(menu) })
+    return
+  }
+  const reply = await handleModelCommand(parsed, deps)
   await switchroomReply(ctx, reply.text, { html: reply.html })
 })
 
@@ -18330,6 +18400,74 @@ bot.on('callback_query:data', async ctx => {
     return
   }
 
+  // `mdl:*` — model-menu taps (/model dashboard). `mdl:s:<tag>`
+  // selects a model by label-tag via a fresh picker discovery (never
+  // a stale index); `mdl:r` re-renders. Strict allowFrom gate like
+  // every other mutating callback family — a model switch changes the
+  // fleet's quota burn profile.
+  if (data.startsWith(MODEL_CALLBACK_PREFIX)) {
+    const access = loadAccess()
+    const senderId = String(ctx.from?.id ?? '')
+    if (!access.allowFrom.includes(senderId)) {
+      await ctx.answerCallbackQuery({ text: 'Not authorized.' })
+      return
+    }
+    // Kill-switch covers the callback family too — stale menus keep
+    // their buttons after the flag flips, and the flag exists exactly
+    // for "picker-driving is misbehaving" (#2263 review blocker 2).
+    if (process.env.SWITCHROOM_MODEL_MENU === '0') {
+      await ctx.answerCallbackQuery({ text: 'Model menu is disabled (SWITCHROOM_MODEL_MENU=0).' }).catch(() => {})
+      await ctx
+        .editMessageText('Model menu is disabled on this agent. Use <code>/model &lt;name&gt;</code>.', {
+          parse_mode: 'HTML',
+          reply_markup: { inline_keyboard: [] },
+        })
+        .catch(() => {})
+      return
+    }
+    const modelDeps = buildModelDeps()
+    // Mid-turn refusal is INSTANT (a sync isBusy() check, no picker drive),
+    // so handle it before the "Working…" ack: toast WHY and leave the menu
+    // message untouched (buttons intact) so the operator taps again when
+    // idle. Editing the menu into a button-less "try again" line was the
+    // "nothing happened" report — the menu looked dead.
+    if (modelDeps.isBusy()) {
+      await ctx
+        .answerCallbackQuery({ text: '⏳ Agent is mid-turn — tap again when it’s idle', show_alert: false })
+        .catch(() => {})
+      return
+    }
+    // Ack IMMEDIATELY — the select path drives the picker (multi-second);
+    // leaving the tap spinning invites a double-tap, which queues a second
+    // drive behind the pane lock. A callback can only be answered once, so
+    // the rich result (what was set / why it failed) is conveyed by the
+    // message edit — which now ALWAYS keeps the menu buttons.
+    await ctx.answerCallbackQuery({ text: 'Switching…' }).catch(() => {})
+    try {
+      const outcome = await handleModelMenuCallback(data, modelDeps)
+      // Record a successful session switch so /status reflects what's
+      // actually running. In-memory only → clears when the gateway (and thus
+      // claude's session) restarts, exactly matching the session-only scope.
+      if (outcome.selectedModel) {
+        activeSessionModelOverride = outcome.selectedModel
+      }
+      // toastOnly: a no-op outcome that should not disturb the menu (defence
+      // in depth — the isBusy() short-circuit above is the live path).
+      if (outcome.toastOnly) return
+      await ctx
+        .editMessageText(outcome.reply.text, {
+          parse_mode: 'HTML',
+          reply_markup: modelMenuReplyMarkup(outcome.reply) ?? { inline_keyboard: [] },
+        })
+        .catch(() => {})
+    } catch (err) {
+      process.stderr.write(
+        `telegram gateway: model-menu callback failed: ${(err as Error)?.message ?? String(err)}\n`,
+      )
+    }
+    return
+  }
+
   // `cn:cancel:<key>` — cancel a pending Microsoft connect flow (the
   // Cancel button on the /connect card). RFC #1873 Phase 2.
   if (data.startsWith('cn:')) {

package/telegram-plugin/gateway/inbound-spool.ts

@@ -102,14 +102,31 @@ export function spoolId(msg: InboundMessage): string {
 }
 
 interface SpoolRecord {
-  t: 'put' | 'ack'
-  id: string
+  t: 'put' | 'ack' | 'esc'
+  /** Present on `put`/`ack` (spoolId). Absent on `esc`. */
+  id?: string
   /** Present only on `put`. The full inbound to replay. */
   msg?: InboundMessage
   /** Present only on `put`. Owning agent (replay re-pushes per agent). */
   agent?: string
   /** Present only on `put`. ms epoch first-spooled — drives escalation. */
   firstAt?: number
+  /** Present only on `esc` — the chat the give-up notice was/would be
+   *  posted to, and when. Durably records the per-chat escalation-notice
+   *  window so a burst of undeliverable inbounds (or a multi-restart
+   *  outage) produces ONE "couldn't deliver" notice per chat, not one
+   *  per dropped entry. */
+  chat?: string | number
+  thread?: string
+  at?: number
+}
+
+/** Stable per-(chat,thread) key for coalescing give-up notices. */
+function escChatKey(msg: InboundMessage): string {
+  const threadRaw = msg.meta?.threadId
+  const thread =
+    typeof threadRaw === 'string' && threadRaw.length > 0 ? threadRaw : '-'
+  return `${msg.chatId}:${thread}`
 }
 
 export interface InboundSpoolFsSeam {
@@ -134,6 +151,14 @@ export interface InboundSpoolOptions {
   escalateAfterMs?: number
   /** Rewrite-compact the JSONL once it exceeds this. Default 256 KiB. */
   compactAtBytes?: number
+  /** Coalescing window for the user-facing "couldn't deliver" notice,
+   *  per chat. The window SLIDES on every escalation attempt (posted or
+   *  suppressed), so a sustained burst posts exactly one notice and only
+   *  re-notifies after the burst goes quiet for this long. Must exceed
+   *  the rate at which undeliverable entries age out (the 15-min
+   *  `escalateAfterMs` here) or back-to-back attempts wouldn't coalesce.
+   *  Default 30 min. */
+  escalateNoticeCooldownMs?: number
 }
 
 export interface ReplayEntry {
@@ -165,10 +190,20 @@ export interface InboundSpool {
    *  finished could land on top of the handback turn. Tombstones the
    *  dropped entries durably. */
   dropMatching: (predicate: (id: string) => boolean) => number
-  /** Escalate+drop entries older than `escalateAfterMs`. Calls
-   *  `onEscalate` once per dropped entry (post the "couldn't deliver"
-   *  card there). Returns the count escalated. Safe to call on a timer. */
-  sweepEscalations: (onEscalate: (e: ReplayEntry) => void) => number
+  /** Escalate+drop entries older than `escalateAfterMs`. Every dropped
+   *  entry is tombstoned (the promise is retracted deterministically),
+   *  but the user-facing notice is COALESCED per chat: `onEscalate` is
+   *  called for every dropped entry with `postNotice` indicating whether
+   *  to actually post the "couldn't deliver" card. `postNotice` is true
+   *  only for the first escalation to a given chat within
+   *  `escalateNoticeCooldownMs` — a burst of undeliverable inbounds (e.g.
+   *  a synthetic re-created every 15 min while the agent is down, across
+   *  restarts) yields ONE notice, not one per entry. The window is
+   *  persisted, so it holds across a gateway restart. Returns the count
+   *  of entries dropped. Safe to call on a timer. */
+  sweepEscalations: (
+    onEscalate: (e: ReplayEntry, opts: { postNotice: boolean }) => void,
+  ) => number
   /** Test/observability: count of live (un-acked) ids. */
   liveCount: () => number
 }
@@ -179,11 +214,18 @@ export function createInboundSpool(opts: InboundSpoolOptions): InboundSpool {
   const log = opts.log ?? ((l: string) => process.stderr.write(l))
   const escalateAfterMs = opts.escalateAfterMs ?? 15 * 60 * 1000
   const compactAtBytes = opts.compactAtBytes ?? 256 * 1024
+  const escalateNoticeCooldownMs = opts.escalateNoticeCooldownMs ?? 30 * 60 * 1000
 
   // In-memory projection of the on-disk log, rebuilt from the file at
   // construction. `live` maps spoolId → the put record (insertion order
   // preserved via the Map). An `ack` deletes from `live`.
   const live = new Map<string, { agent: string; msg: InboundMessage; firstAt: number }>()
+  // Per-chat last escalation-ATTEMPT time (posted or suppressed). Drives
+  // the sliding coalescing window so a burst of give-up escalations posts
+  // one notice. Rebuilt from durable `esc` records at construction so the
+  // window survives a gateway restart (the actual 2026-06-09 spam: a
+  // synthetic re-aged into the bound every 15 min across many restarts).
+  const escAttemptByChat = new Map<string, number>()
 
   function parseLine(line: string): SpoolRecord | null {
     const s = line.trim()
@@ -196,7 +238,13 @@ export function createInboundSpool(opts: InboundSpoolOptions): InboundSpool {
     }
     if (rec == null || typeof rec !== 'object') return null
     const r = rec as Record<string, unknown>
-    if (r.t !== 'put' && r.t !== 'ack') return null
+    if (r.t !== 'put' && r.t !== 'ack' && r.t !== 'esc') return null
+    if (r.t === 'esc') {
+      // esc records key on chat, not a spoolId.
+      if (typeof r.chat !== 'string' && typeof r.chat !== 'number') return null
+      if (typeof r.at !== 'number') return null
+      return r as unknown as SpoolRecord
+    }
     if (typeof r.id !== 'string' || r.id.length === 0) return null
     if (r.t === 'put') {
       if (r.msg == null || typeof r.msg !== 'object') return null
@@ -209,6 +257,7 @@ export function createInboundSpool(opts: InboundSpoolOptions): InboundSpool {
   // Rebuild `live` from the file. Tolerates a torn last line.
   function hydrate(): void {
     live.clear()
+    escAttemptByChat.clear()
     if (!fs.existsSync(path)) return
     let raw = ''
     try {
@@ -221,13 +270,17 @@ export function createInboundSpool(opts: InboundSpoolOptions): InboundSpool {
       if (rec == null) continue
       if (rec.t === 'put') {
         // Last put for an id wins; an ack later removes it.
-        live.set(rec.id, {
+        live.set(rec.id as string, {
           agent: rec.agent as string,
           msg: rec.msg as InboundMessage,
           firstAt: rec.firstAt as number,
         })
+      } else if (rec.t === 'esc') {
+        // Last escalation-attempt time per chat wins (records are in
+        // append order). Restores the sliding window across a restart.
+        escAttemptByChat.set(`${rec.chat}:${rec.thread ?? '-'}`, rec.at as number)
       } else {
-        live.delete(rec.id)
+        live.delete(rec.id as string)
       }
     }
   }
@@ -269,6 +322,22 @@ export function createInboundSpool(opts: InboundSpoolOptions): InboundSpool {
         JSON.stringify({ t: 'put', id, agent: e.agent, msg: e.msg, firstAt: e.firstAt } satisfies SpoolRecord),
       )
     }
+    // Preserve the latest escalation-attempt time per chat so the sliding
+    // coalescing window isn't reset by compaction (which would let the next
+    // burst re-spam). One record per chat — bounded by the chat count.
+    for (const [key, at] of escAttemptByChat) {
+      const sep = key.lastIndexOf(':')
+      const chat = key.slice(0, sep)
+      const thread = key.slice(sep + 1)
+      lines.push(
+        JSON.stringify({
+          t: 'esc',
+          chat,
+          ...(thread !== '-' ? { thread } : {}),
+          at,
+        } satisfies SpoolRecord),
+      )
+    }
     const tmp = path + '.compact.tmp'
     try {
       fs.writeFileSync(tmp, lines.length ? lines.join('\n') + '\n' : '')
@@ -328,24 +397,46 @@ export function createInboundSpool(opts: InboundSpoolOptions): InboundSpool {
       return n
     },
     sweepEscalations(onEscalate) {
-      const cutoff = now() - escalateAfterMs
-      let n = 0
+      const tNow = now()
+      const cutoff = tNow - escalateAfterMs
+      let dropped = 0
+      let posted = 0
       for (const [id, e] of [...live.entries()]) {
         if (e.firstAt > cutoff) continue
         live.delete(id)
         appendRecord({ t: 'ack', id }) // tombstone — promise retracted
+        // Coalesce the user-facing notice per chat on a SLIDING window:
+        // post only when the last attempt to this chat was longer ago than
+        // the cooldown; every attempt (posted or not) slides the window, so
+        // a sustained burst stays quiet after the first notice and only
+        // re-notifies once the burst goes quiet. Durable via `esc` records.
+        const key = escChatKey(e.msg)
+        const lastAttempt = escAttemptByChat.get(key)
+        const postNotice =
+          lastAttempt === undefined || tNow - lastAttempt >= escalateNoticeCooldownMs
+        escAttemptByChat.set(key, tNow)
+        const threadRaw = e.msg.meta?.threadId
+        const thread =
+          typeof threadRaw === 'string' && threadRaw.length > 0 ? threadRaw : undefined
+        appendRecord({ t: 'esc', chat: e.msg.chatId, thread, at: tNow })
         try {
-          onEscalate({ agent: e.agent, msg: e.msg })
+          onEscalate({ agent: e.agent, msg: e.msg }, { postNotice })
         } catch (err) {
           log(`inbound-spool: onEscalate threw id=${id}: ${(err as Error).message}\n`)
         }
-        n++
+        if (postNotice) posted++
+        dropped++
       }
-      if (n > 0) {
-        log(`inbound-spool: escalated+dropped ${n} undelivered entr${n === 1 ? 'y' : 'ies'} (older than ${escalateAfterMs}ms)\n`)
+      if (dropped > 0) {
+        const suppressed = dropped - posted
+        log(
+          `inbound-spool: escalated+dropped ${dropped} undelivered entr${dropped === 1 ? 'y' : 'ies'} ` +
+          `(older than ${escalateAfterMs}ms; ${posted} notice${posted === 1 ? '' : 's'} posted` +
+          `${suppressed > 0 ? `, ${suppressed} coalesced` : ''})\n`,
+        )
         maybeCompact()
       }
-      return n
+      return dropped
     },
     liveCount() {
       return live.size