switchroom 0.15.45 → 0.16.5

package/telegram-plugin/tests/fleet-fallback-resume.test.ts

@@ -0,0 +1,197 @@
+/**
+ * Unit tests for the resume-after-swap gate (auth-failover-stall Fix 1).
+ *
+ * The gate owns the decision the gateway consults in doFireFleetAutoFallback
+ * after a SUCCESSFUL swap: should we restart to resume the turn the mid-turn
+ * 429 killed? It must:
+ *   - return 'resume' on the first switched outcome (so exactly one restart
+ *     fires), recorded so a follow-on swap is suppressed;
+ *   - return 'skip-inflight' on a SECOND swap within the single-flight window
+ *     (a 429 storm cannot loop-restart the agent);
+ *   - return 'skip-stale' when the failed turn is older than maxAgeMs (an
+ *     ancient interrupted turn is not resurrected);
+ *   - never be consulted on all-blocked (verified by the gateway-seam test
+ *     below, which only calls decide() on 'switched').
+ *
+ * The gate is pure (no process restart), so these tests run with a fake clock
+ * and never touch a real process — the restart itself is a separate seam
+ * (triggerSelfRestart) that the gateway wires to a 'resume' verdict.
+ */
+
+import { describe, it, expect } from 'vitest'
+import {
+  createFleetFallbackResumeGate,
+  DEFAULT_RESUME_MAX_AGE_MS,
+  DEFAULT_RESUME_SINGLE_FLIGHT_MS,
+} from '../fleet-fallback-resume.js'
+
+function fakeClock(start = 1_000_000) {
+  let t = start
+  return {
+    now: () => t,
+    advance: (ms: number) => {
+      t += ms
+    },
+    set: (ms: number) => {
+      t = ms
+    },
+  }
+}
+
+describe('createFleetFallbackResumeGate — resume verdict', () => {
+  it("returns 'resume' on the first switched outcome", () => {
+    const clk = fakeClock()
+    const gate = createFleetFallbackResumeGate({ nowFn: clk.now })
+    // Failed turn started just now → fresh, not stale.
+    expect(gate.decide(clk.now())).toBe('resume')
+  })
+
+  it("treats a null (unknown) failed-turn timestamp as resumable", () => {
+    const clk = fakeClock()
+    const gate = createFleetFallbackResumeGate({ nowFn: clk.now })
+    // null defers staleness to the boot-resume 3h failsafe → resume here.
+    expect(gate.decide(null)).toBe('resume')
+  })
+})
+
+describe('createFleetFallbackResumeGate — single-flight guard', () => {
+  it('suppresses a SECOND swap inside the single-flight window (no double-resume)', () => {
+    const clk = fakeClock()
+    const gate = createFleetFallbackResumeGate({
+      nowFn: clk.now,
+      singleFlightMs: DEFAULT_RESUME_SINGLE_FLIGHT_MS,
+    })
+    expect(gate.decide(clk.now())).toBe('resume')
+    // A 429 storm: a second swap fires 1s later. Must NOT re-arm.
+    clk.advance(1_000)
+    expect(gate.decide(clk.now())).toBe('skip-inflight')
+    // Still suppressed near the end of the window.
+    clk.advance(DEFAULT_RESUME_SINGLE_FLIGHT_MS - 2_000)
+    expect(gate.decide(clk.now())).toBe('skip-inflight')
+  })
+
+  it('re-arms once the single-flight window has fully elapsed', () => {
+    const clk = fakeClock()
+    const gate = createFleetFallbackResumeGate({ nowFn: clk.now, singleFlightMs: 60_000 })
+    expect(gate.decide(clk.now())).toBe('resume')
+    clk.advance(60_001)
+    // A genuinely new swap after the window resumes again (one per swap).
+    expect(gate.decide(clk.now())).toBe('resume')
+  })
+
+  it('a rapid burst of N swaps yields exactly ONE resume', () => {
+    const clk = fakeClock()
+    const gate = createFleetFallbackResumeGate({ nowFn: clk.now, singleFlightMs: 60_000 })
+    let resumes = 0
+    for (let i = 0; i < 10; i++) {
+      if (gate.decide(clk.now()) === 'resume') resumes++
+      clk.advance(500) // 0.5s between storm events, all inside the window
+    }
+    expect(resumes).toBe(1)
+  })
+})
+
+describe('createFleetFallbackResumeGate — staleness guard', () => {
+  it("suppresses ('skip-stale') a failed turn older than maxAgeMs", () => {
+    const clk = fakeClock()
+    const gate = createFleetFallbackResumeGate({ nowFn: clk.now })
+    const ancientStart = clk.now() - (DEFAULT_RESUME_MAX_AGE_MS + 60_000)
+    expect(gate.decide(ancientStart)).toBe('skip-stale')
+  })
+
+  it('a stale verdict does NOT arm the single-flight window', () => {
+    const clk = fakeClock()
+    const gate = createFleetFallbackResumeGate({ nowFn: clk.now })
+    expect(gate.decide(clk.now() - (DEFAULT_RESUME_MAX_AGE_MS + 1))).toBe('skip-stale')
+    // A subsequent FRESH turn must still resume — the stale skip must not have
+    // recorded an arm time.
+    expect(gate.decide(clk.now())).toBe('resume')
+  })
+
+  it('a turn just under maxAgeMs still resumes', () => {
+    const clk = fakeClock()
+    const gate = createFleetFallbackResumeGate({ nowFn: clk.now, maxAgeMs: 10_800_000 })
+    expect(gate.decide(clk.now() - (10_800_000 - 1_000))).toBe('resume')
+  })
+
+  it('honours a custom maxAgeMs', () => {
+    const clk = fakeClock()
+    const gate = createFleetFallbackResumeGate({ nowFn: clk.now, maxAgeMs: 60_000 })
+    expect(gate.decide(clk.now() - 61_000)).toBe('skip-stale')
+    expect(gate.decide(clk.now() - 30_000)).toBe('resume')
+  })
+})
+
+describe('createFleetFallbackResumeGate — reset / inspect seams', () => {
+  it('reset() clears the single-flight arm', () => {
+    const clk = fakeClock()
+    const gate = createFleetFallbackResumeGate({ nowFn: clk.now })
+    expect(gate.decide(clk.now())).toBe('resume')
+    expect(gate.decide(clk.now())).toBe('skip-inflight')
+    gate.reset()
+    expect(gate.inspect().lastResumedAtMs).toBe(Number.NEGATIVE_INFINITY)
+    expect(gate.decide(clk.now())).toBe('resume')
+  })
+})
+
+/**
+ * Gateway-seam contract test. Mirrors how doFireFleetAutoFallback consults the
+ * gate: it calls decide() ONLY on outcome.kind === 'switched', and translates a
+ * 'resume' verdict into exactly one restart. We mock the restart as a counter,
+ * so no process is touched. This pins the "all-blocked is a no-op" and
+ * "exactly-once" contracts at the call-site shape.
+ */
+describe('gateway seam — decide() consulted only on switched, restart fires once', () => {
+  type Outcome = { kind: 'switched' | 'all-blocked' }
+
+  function simulateDispatch(
+    gate: ReturnType<typeof createFleetFallbackResumeGate>,
+    outcome: Outcome,
+    failedTurnStartedAtMs: number | null,
+    restart: () => void,
+  ): void {
+    // The actual gateway code path: resume is reached ONLY on 'switched'.
+    if (outcome.kind === 'switched') {
+      if (gate.decide(failedTurnStartedAtMs) === 'resume') restart()
+    }
+  }
+
+  it('switched → restart fires exactly once', () => {
+    const clk = fakeClock()
+    const gate = createFleetFallbackResumeGate({ nowFn: clk.now })
+    let restarts = 0
+    simulateDispatch(gate, { kind: 'switched' }, clk.now(), () => restarts++)
+    expect(restarts).toBe(1)
+  })
+
+  it('all-blocked → decide() is never consulted, restart never fires', () => {
+    const clk = fakeClock()
+    const gate = createFleetFallbackResumeGate({ nowFn: clk.now })
+    let restarts = 0
+    simulateDispatch(gate, { kind: 'all-blocked' }, clk.now(), () => restarts++)
+    expect(restarts).toBe(0)
+    // The gate stayed unarmed, so a subsequent real switch still resumes.
+    simulateDispatch(gate, { kind: 'switched' }, clk.now(), () => restarts++)
+    expect(restarts).toBe(1)
+  })
+
+  it('a 429 storm of switched outcomes restarts exactly once', () => {
+    const clk = fakeClock()
+    const gate = createFleetFallbackResumeGate({ nowFn: clk.now, singleFlightMs: 60_000 })
+    let restarts = 0
+    for (let i = 0; i < 5; i++) {
+      simulateDispatch(gate, { kind: 'switched' }, clk.now(), () => restarts++)
+      clk.advance(1_000)
+    }
+    expect(restarts).toBe(1)
+  })
+
+  it('a stale switched outcome does not restart', () => {
+    const clk = fakeClock()
+    const gate = createFleetFallbackResumeGate({ nowFn: clk.now })
+    let restarts = 0
+    const ancient = clk.now() - (DEFAULT_RESUME_MAX_AGE_MS + 1)
+    simulateDispatch(gate, { kind: 'switched' }, ancient, () => restarts++)
+    expect(restarts).toBe(0)
+  })
+})

package/telegram-plugin/tests/gateway-clean-shutdown-marker.test.ts

@@ -35,6 +35,7 @@ import {
   readCleanShutdownMarker,
   clearCleanShutdownMarker,
   shouldSuppressRecoveryBanner,
+  shouldSuppressBootResume,
   resolveShutdownMarker,
   DEFAULT_MAX_AGE_MS,
   EXTERNAL_RESTART_FALLBACK_REASON,
@@ -344,6 +345,122 @@ describe("resolveShutdownMarker (SIGTERM-handler sequencing)", () => {
   });
 });
 
+// ---------------------------------------------------------------------------
+// Boot-resume gate: shouldSuppressBootResume
+// ---------------------------------------------------------------------------
+
+describe("shouldSuppressBootResume", () => {
+  // Core contract: clean shutdown (fresh marker) → suppress; crash (no marker
+  // or stale) → do not suppress; forceAlways override → never suppress.
+
+  it("returns false when no marker is present (crash/OOM — resume as before)", () => {
+    expect(shouldSuppressBootResume(null, Date.now())).toBe(false);
+  });
+
+  it("returns true for a fresh clean-shutdown marker (operator/roll restart — suppress)", () => {
+    const now = 1_700_000_000_000;
+    const marker: CleanShutdownMarker = { ts: now - 5_000, signal: "SIGTERM" };
+    expect(shouldSuppressBootResume(marker, now)).toBe(true);
+  });
+
+  it("returns true at age=0 (marker written right before boot)", () => {
+    const now = 1_700_000_000_000;
+    const marker: CleanShutdownMarker = { ts: now, signal: "SIGTERM" };
+    expect(shouldSuppressBootResume(marker, now)).toBe(true);
+  });
+
+  it("returns false when marker age equals maxAgeMs (boundary is exclusive)", () => {
+    const now = 1_700_000_000_000;
+    const marker: CleanShutdownMarker = { ts: now - DEFAULT_MAX_AGE_MS, signal: "SIGTERM" };
+    expect(shouldSuppressBootResume(marker, now)).toBe(false);
+  });
+
+  it("returns false for a stale marker (drain took >60s — treat as crash)", () => {
+    const now = 1_700_000_000_000;
+    const marker: CleanShutdownMarker = { ts: now - 90_000, signal: "SIGTERM" };
+    expect(shouldSuppressBootResume(marker, now)).toBe(false);
+  });
+
+  it("treats clock skew (future ts) as stale to avoid false suppression", () => {
+    const now = 1_700_000_000_000;
+    const marker: CleanShutdownMarker = { ts: now + 10_000, signal: "SIGTERM" };
+    expect(shouldSuppressBootResume(marker, now)).toBe(false);
+  });
+
+  it("respects a custom maxAgeMs", () => {
+    const now = 1_700_000_000_000;
+    const marker: CleanShutdownMarker = { ts: now - 30_000, signal: "SIGTERM" };
+    expect(shouldSuppressBootResume(marker, now, { maxAgeMs: 60_000 })).toBe(true);
+    expect(shouldSuppressBootResume(marker, now, { maxAgeMs: 10_000 })).toBe(false);
+  });
+
+  it("forceAlways=true disables suppression even for a fresh clean marker (escape hatch)", () => {
+    // SWITCHROOM_BOOT_RESUME_ALWAYS=1 must restore unconditional resume.
+    const now = 1_700_000_000_000;
+    const marker: CleanShutdownMarker = { ts: now - 1_000, signal: "SIGTERM" };
+    expect(shouldSuppressBootResume(marker, now, { forceAlways: true })).toBe(false);
+  });
+
+  it("forceAlways=false has no effect (default behaviour is the gate)", () => {
+    const now = 1_700_000_000_000;
+    const marker: CleanShutdownMarker = { ts: now - 1_000, signal: "SIGTERM" };
+    expect(shouldSuppressBootResume(marker, now, { forceAlways: false })).toBe(true);
+  });
+
+  it("works for SIGTERM and SIGINT (signal value is opaque)", () => {
+    const now = 1_700_000_000_000;
+    expect(shouldSuppressBootResume({ ts: now, signal: "SIGTERM" }, now)).toBe(true);
+    expect(shouldSuppressBootResume({ ts: now, signal: "SIGINT" }, now)).toBe(true);
+  });
+
+  it("works with a marker that carries a reason field (rollout attribution is preserved)", () => {
+    const now = 1_700_000_000_000;
+    const marker: CleanShutdownMarker = {
+      ts: now - 2_000,
+      signal: "SIGTERM",
+      reason: "operator: switchroom update",
+    };
+    expect(shouldSuppressBootResume(marker, now)).toBe(true);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Boot-resume gate: gateway wiring (source-level)
+// ---------------------------------------------------------------------------
+
+describe("gateway.ts boot-resume clean-shutdown gate (source-level)", () => {
+  // Source-grep pins ensure the gate wiring in gateway.ts stays present
+  // after refactors. Pure unit tests on shouldSuppressBootResume cover the
+  // decision logic; these cover the wiring.
+  const gatewaySource = readFileSync(
+    join(import.meta.dir, "..", "gateway", "gateway.ts"),
+    "utf8",
+  );
+
+  it("imports shouldSuppressBootResume from clean-shutdown-marker", () => {
+    expect(gatewaySource).toContain("shouldSuppressBootResume");
+  });
+
+  it("reads the clean-shutdown marker before building the boot-resume inbound", () => {
+    expect(gatewaySource).toContain("bootResumeCleanMarker");
+    expect(gatewaySource).toContain("readCleanShutdownMarker(bootResumeMarkerPath)");
+  });
+
+  it("calls shouldSuppressBootResume with the marker, now, and forceAlways", () => {
+    expect(gatewaySource).toContain("shouldSuppressBootResume(bootResumeCleanMarker, Date.now()");
+    expect(gatewaySource).toContain("forceAlways: bootResumeForceAlways");
+  });
+
+  it("provides the SWITCHROOM_BOOT_RESUME_ALWAYS escape hatch", () => {
+    expect(gatewaySource).toContain("SWITCHROOM_BOOT_RESUME_ALWAYS");
+    expect(gatewaySource).toContain("=== '1'");
+  });
+
+  it("logs a diagnostic when boot-resume is suppressed", () => {
+    expect(gatewaySource).toContain("boot-resume suppressed (clean shutdown");
+  });
+});
+
 describe("gateway.ts shutdown-handler wiring (source-level)", () => {
   // Source-grep pins so a future refactor can't silently drop the
   // reason-preserving + fallback-writing behaviour the 2026-04-24 fix

package/telegram-plugin/tests/gateway-no-reply-single-emit.test.ts

@@ -1,5 +1,5 @@
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
-import { createAnswerStream, __resetDraftIdForTests } from '../answer-stream.js'
+import { createAnswerStream } from '../answer-stream.js'
 
 /**
  * #656 — gateway turn_end no-reply path.
@@ -30,7 +30,6 @@ async function flushMicrotasks(times = 10): Promise<void> {
 let nextMessageId = 5000
 
 beforeEach(() => {
-  __resetDraftIdForTests()
   nextMessageId = 5000
   vi.useFakeTimers()
 })
@@ -46,9 +45,7 @@ describe('#656 — answer-stream retract() at turn_end emits nothing', () => {
     const deleteMessage = vi.fn(async () => {})
 
     const stream = createAnswerStream({
-      chatId: 'chat-no-reply',
-      isPrivateChat: false,
-      minInitialChars: 400,
+      chatId: 'chat-no-reply',      minInitialChars: 400,
       throttleMs: 250,
       sendMessage: sendMessage as never,
       editMessageText: editMessageText as never,
@@ -81,9 +78,7 @@ describe('#656 — answer-stream retract() at turn_end emits nothing', () => {
     const deleteMessage = vi.fn(async () => {})
 
     const stream = createAnswerStream({
-      chatId: 'supergroup-topic',
-      isPrivateChat: false, // supergroup → message transport (no draft)
-      threadId: 4,
+      chatId: 'supergroup-topic',      threadId: 4,
       minInitialChars: Number.MAX_SAFE_INTEGER,
       throttleMs: 250,
       sendMessage: sendMessage as never,
@@ -110,9 +105,7 @@ describe('#656 — answer-stream retract() at turn_end emits nothing', () => {
     const deleteMessage = vi.fn(async () => {})
 
     const stream = createAnswerStream({
-      chatId: 'chat-no-reply',
-      isPrivateChat: false,
-      minInitialChars: 10,
+      chatId: 'chat-no-reply',      minInitialChars: 10,
       throttleMs: THROTTLE,
       sendMessage: sendMessage as never,
       editMessageText: editMessageText as never,

package/telegram-plugin/tests/history.test.ts

@@ -444,6 +444,66 @@ describe('hasOutboundDeliveredSince', () => {
   it('returns false when no history is present for the chat', () => {
     expect(hasOutboundDeliveredSince('-999', 0)).toBe(false)
   })
+
+  // #2474 follow-up — the duplicate-represent guard passes a LOW minChars so a
+  // terse-but-genuine reply counts as "the user was answered". The escalate
+  // branch keeps the 200-char default.
+  describe('minChars parameter (decoupled represent-guard threshold)', () => {
+    it('default threshold (200) does NOT count a terse real reply', () => {
+      const openedAt = 1_000_000 * 1000
+      recordOutbound({
+        chat_id: '-100',
+        thread_id: null,
+        message_ids: [10],
+        texts: ['Yes — done.'], // < 200 chars
+        ts: 1_000_001,
+      })
+      // escalate-branch behavior is unchanged: a terse reply is NOT substantive
+      expect(hasOutboundDeliveredSince('-100', openedAt)).toBe(false)
+    })
+
+    it('minChars=1 DOES count a terse real reply (fixes the #2472 terse-reply gap)', () => {
+      const openedAt = 1_000_000 * 1000
+      recordOutbound({
+        chat_id: '-100',
+        thread_id: null,
+        message_ids: [10],
+        texts: ['Merged, all three landed.'], // genuine short reply
+        ts: 1_000_001,
+      })
+      // represent-guard threshold: any real reply suppresses the duplicate
+      expect(hasOutboundDeliveredSince('-100', openedAt, undefined, 1)).toBe(true)
+    })
+
+    it('minChars=1 still does NOT count an empty/whitespace-only row', () => {
+      // A degenerate outbound (no real content) must never read as "answered",
+      // even at the lowest threshold — minChars is clamped to >= 1.
+      const openedAt = 1_000_000 * 1000
+      recordOutbound({
+        chat_id: '-100',
+        thread_id: null,
+        message_ids: [10],
+        texts: [''],
+        ts: 1_000_001,
+      })
+      expect(hasOutboundDeliveredSince('-100', openedAt, undefined, 1)).toBe(false)
+      // minChars=0 is clamped up to 1, so an empty row is still excluded
+      expect(hasOutboundDeliveredSince('-100', openedAt, undefined, 0)).toBe(false)
+    })
+
+    it('minChars=1 respects the thread filter (terse reply scoped to its thread)', () => {
+      const openedAt = 1_000_000 * 1000
+      recordOutbound({
+        chat_id: '-100',
+        thread_id: 5,
+        message_ids: [10],
+        texts: ['ok'],
+        ts: 1_000_001,
+      })
+      expect(hasOutboundDeliveredSince('-100', openedAt, 5, 1)).toBe(true)
+      expect(hasOutboundDeliveredSince('-100', openedAt, 6, 1)).toBe(false)
+    })
+  })
 })
 
 describe('secret redaction at persistence (both directions)', () => {

package/telegram-plugin/tests/model-command.test.ts

@@ -253,7 +253,10 @@ import {
   handleModelMenuCallback,
   modelSelectCallbackData,
   sessionModelFromConfirmation,
+  classifyDiscoveredOptions,
   MODEL_CALLBACK_REFRESH,
+  MODEL_CALLBACK_SR,
+  SR_MODEL_LABELS,
   type ModelMenuDeps,
 } from "../gateway/model-command.js";
 import { labelTag } from "../../src/agents/model-picker.js";
@@ -422,3 +425,134 @@ describe("sessionModelFromConfirmation", () => {
     expect(out.reply.keyboard).toBeDefined();
   });
 });
+
+// ---------------------------------------------------------------------------
+// Ship D — sr-* (LiteLLM non-Anthropic) model support
+// ---------------------------------------------------------------------------
+
+const OPTIONS_WITH_SR = [
+  { index: 1, label: "Default (recommended)", detail: "Opus 4.8 with 1M context", current: false },
+  { index: 2, label: "Sonnet", detail: "Sonnet 4.6", current: true },
+  { index: 3, label: "sr-gemini-2.5-pro", detail: "", current: false },
+  { index: 4, label: "sr-deepseek-r1", detail: "", current: false },
+  // internal path — should be filtered out
+  { index: 5, label: "openrouter/google/gemini-2.5-pro", detail: "", current: false },
+  // bare OpenAI models from GATEWAY_MODEL_DISCOVERY — should also be filtered out
+  { index: 6, label: "gpt-4", detail: "", current: false },
+  { index: 7, label: "gpt-4o", detail: "", current: false },
+  { index: 8, label: "voyage-law-2", detail: "", current: false },
+  // full claude ID — should be in claude bucket
+  { index: 9, label: "claude-opus-4-8", detail: "", current: false },
+];
+
+describe("classifyDiscoveredOptions", () => {
+  it("puts native Claude options in claude, sr-* in sr, drops others", () => {
+    const { claude, sr } = classifyDiscoveredOptions(OPTIONS_WITH_SR);
+    expect(claude.map((o) => o.label)).toEqual([
+      "Default (recommended)", "Sonnet", "claude-opus-4-8",
+    ]);
+    expect(sr.map((o) => o.label)).toEqual(["sr-gemini-2.5-pro", "sr-deepseek-r1"]);
+    // openrouter/*, gpt-*, voyage-* not present in either bucket
+    const all = [...claude, ...sr];
+    expect(all.find((o) => o.label.includes("openrouter"))).toBeUndefined();
+    expect(all.find((o) => o.label.startsWith("gpt-"))).toBeUndefined();
+    expect(all.find((o) => o.label.startsWith("voyage-"))).toBeUndefined();
+  });
+
+  it("handles a list with no sr-* models", () => {
+    const { claude, sr } = classifyDiscoveredOptions(OPTIONS);
+    expect(claude).toHaveLength(3);
+    expect(sr).toHaveLength(0);
+  });
+});
+
+describe("SR_MODEL_LABELS", () => {
+  it("has friendly names for the standard sr-* models", () => {
+    expect(SR_MODEL_LABELS["sr-gemini-2.5-pro"]).toBe("Gemini 2.5 Pro");
+    expect(SR_MODEL_LABELS["sr-deepseek-r1"]).toBe("DeepSeek R1");
+  });
+});
+
+describe("buildModelMenu — with sr-* models", () => {
+  function makeMenuDepsWithSr(overrides: Partial<ModelMenuDeps> = {}) {
+    return makeMenuDeps({
+      discover: async () => ({
+        ok: true as const,
+        options: OPTIONS_WITH_SR,
+        currentLabel: "Sonnet",
+      }),
+      ...overrides,
+    });
+  }
+
+  it("shows 🌐 buttons for sr-* models, normal buttons for claude models", async () => {
+    const { deps } = makeMenuDepsWithSr();
+    const menu = await buildModelMenu(deps);
+    expect(menu.keyboard).toBeDefined();
+    const allButtons = menu.keyboard!.flat();
+    // 🌐 buttons for sr-*
+    expect(allButtons.find((b) => b.text === "🌐 Gemini 2.5 Pro")).toBeDefined();
+    expect(allButtons.find((b) => b.text === "🌐 DeepSeek R1")).toBeDefined();
+    // Regular buttons for Claude models
+    expect(allButtons.find((b) => b.text === "Default (recommended)")).toBeDefined();
+    // openrouter/* not shown at all
+    expect(allButtons.find((b) => b.text.includes("openrouter"))).toBeUndefined();
+  });
+
+  it("sr-* buttons use mdl:sr: callback prefix", async () => {
+    const { deps } = makeMenuDepsWithSr();
+    const menu = await buildModelMenu(deps);
+    const srButton = menu.keyboard!.flat().find((b) => b.text === "🌐 Gemini 2.5 Pro");
+    expect(srButton?.callback_data).toBe(`${MODEL_CALLBACK_SR}sr-gemini-2.5-pro`);
+  });
+
+  it("shows 🌐 = non-Anthropic legend when sr-* models are present", async () => {
+    const { deps } = makeMenuDepsWithSr();
+    const menu = await buildModelMenu(deps);
+    expect(menu.text).toContain("🌐 = non-Anthropic");
+  });
+
+  it("no legend when no sr-* models in picker", async () => {
+    const { deps } = makeMenuDeps();
+    const menu = await buildModelMenu(deps);
+    expect(menu.text).not.toContain("🌐 = non-Anthropic");
+  });
+});
+
+describe("handleModelMenuCallback — sr-* selection", () => {
+  function makeMenuDepsWithSr(overrides: Partial<ModelMenuDeps> = {}) {
+    return makeMenuDeps({
+      discover: async () => ({
+        ok: true as const,
+        options: OPTIONS_WITH_SR,
+        currentLabel: "Sonnet",
+      }),
+      ...overrides,
+    });
+  }
+
+  it("sr-* tap uses inject path, not cursor nav", async () => {
+    const { deps, calls, injectCalls } = makeMenuDepsWithSr();
+    const out = await handleModelMenuCallback(`${MODEL_CALLBACK_SR}sr-gemini-2.5-pro`, deps);
+    // inject was called with the raw /model command
+    expect(injectCalls).toContainEqual({ agent: "klanker", command: "/model sr-gemini-2.5-pro" });
+    // select (cursor nav) was NOT called
+    expect(calls.select).toHaveLength(0);
+    expect(out.answer).toContain("Set model to sonnet");
+    expect(out.selectedModel).toBe("sr-gemini-2.5-pro");
+    expect(out.reply.keyboard).toBeDefined();
+  });
+
+  it("sr-* tap while busy returns toast-only with no inject", async () => {
+    const { deps, injectCalls } = makeMenuDepsWithSr({ isBusy: () => true });
+    const out = await handleModelMenuCallback(`${MODEL_CALLBACK_SR}sr-gemini-2.5-pro`, deps);
+    expect(out.toastOnly).toBe(true);
+    expect(injectCalls).toHaveLength(0);
+  });
+
+  it("rejects malformed sr-* callback data", async () => {
+    const { deps } = makeMenuDepsWithSr();
+    const out = await handleModelMenuCallback(`${MODEL_CALLBACK_SR}bad name with spaces`, deps);
+    expect(out.answer).toBe("Invalid model name");
+  });
+});