switchroom 0.16.11 → 0.16.13

package/dist/cli/switchroom.js

@@ -51674,8 +51674,8 @@ import { existsSync, readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 
 // src/build-info.ts
-var VERSION = "0.16.11";
-var COMMIT_SHA = "7846a496";
+var VERSION = "0.16.13";
+var COMMIT_SHA = "d4f3ac38";
 
 // src/cli/resolve-version.ts
 function readPackageVersion() {
@@ -77783,6 +77783,13 @@ function extractBearerToken(req) {
     if (idx >= 0 && idx + 1 < parts.length)
       return parts[idx + 1];
   }
+  const url = new URL(req.url);
+  const queryToken = url.searchParams.get("token");
+  if (queryToken)
+    return queryToken;
+  const hermesHeader = req.headers.get("X-Hermes-Session-Token");
+  if (hermesHeader)
+    return hermesHeader;
   return null;
 }
 function checkAuth(req, token, server) {

package/dist/host-control/main.js

@@ -22587,7 +22587,7 @@ import { existsSync as existsSync6, readFileSync as readFileSync4 } from "node:f
 import { dirname as dirname4, join as join2 } from "node:path";
 
 // src/build-info.ts
-var VERSION = "0.16.11";
+var VERSION = "0.16.13";
 
 // src/cli/resolve-version.ts
 function readPackageVersion() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switchroom",
-  "version": "0.16.11",
+  "version": "0.16.13",
   "description": "Run Claude Code 24/7 on your Claude Pro/Max subscription over Telegram. Open-source alternative to OpenClaw and NanoClaw — no API keys.",
   "type": "module",
   "bin": {

package/telegram-plugin/dist/gateway/gateway.js

@@ -50062,7 +50062,8 @@ function buildObligationRepresentInbound(o, now) {
     meta: {
       source: "obligation_represent",
       origin_turn_id: o.originTurnId,
-      represent_count: String(o.representCount + 1)
+      represent_count: String(o.representCount + 1),
+      chat_id: o.chatId
     }
   };
 }
@@ -56063,11 +56064,11 @@ function readTurnActiveMarkerAgeMs(stateDir, now) {
 }
 
 // ../src/build-info.ts
-var VERSION = "0.16.11";
-var COMMIT_SHA = "7846a496";
-var COMMIT_DATE = "2026-06-28T09:51:30Z";
-var LATEST_PR = 2630;
-var COMMITS_AHEAD_OF_TAG = 0;
+var VERSION = "0.16.13";
+var COMMIT_SHA = "d4f3ac38";
+var COMMIT_DATE = "2026-06-28T21:45:50+10:00";
+var LATEST_PR = null;
+var COMMITS_AHEAD_OF_TAG = 2;
 
 // gateway/boot-version.ts
 function formatRelativeAgo(iso) {
@@ -58111,9 +58112,11 @@ var progressUpdateLastSent = new Map;
 var progressUpdateTurnCount = new Map;
 var currentTurn = null;
 var currentTurnMap = new CurrentTurnMap;
+var lastActiveTurnChatId;
 function setCurrentTurn(turn, key) {
   currentTurnMap.set(turn, key);
   currentTurn = currentTurnMap.get();
+  lastActiveTurnChatId = turn.sessionChatId;
 }
 function endCurrentTurnForKey(turn, key) {
   const ended = currentTurnMap.endTurnForKey(turn, key);
@@ -60795,9 +60798,22 @@ function redactOutboundText(text2, site) {
 }
 async function executeReply(args) {
   const turn = currentTurn;
-  const chat_id = String(args.chat_id ?? "");
-  if (!chat_id)
+  const _rawChatId = String(args.chat_id ?? "");
+  if (!_rawChatId)
     throw new Error("reply: chat_id is required");
+  const chat_id = (() => {
+    const _a = loadAccess();
+    if (_a.allowFrom.includes(_rawChatId) || _rawChatId in _a.groups)
+      return _rawChatId;
+    const fallbackChatId = turn?.sessionChatId ?? lastActiveTurnChatId;
+    if (fallbackChatId && (_a.allowFrom.includes(fallbackChatId) || (fallbackChatId in _a.groups))) {
+      const tier = turn == null ? "last-known" : "active";
+      process.stderr.write(`telegram gateway: reply: model passed chat_id "${_rawChatId}" (not allowlisted) \u2014 ` + `routing to ${tier} turn chat "${fallbackChatId}"
+`);
+      return fallbackChatId;
+    }
+    return _rawChatId;
+  })();
   const rawText = args.text;
   if (rawText == null || rawText === "")
     throw new Error("reply: text is required and cannot be empty");

package/telegram-plugin/gateway/gateway.ts

@@ -2216,6 +2216,13 @@ type CurrentTurn = {
 // is never written and this is exactly the old singleton.
 let currentTurn: CurrentTurn | null = null
 const currentTurnMap = new CurrentTurnMap<CurrentTurn>()
+// Captures the most-recently-started turn's sessionChatId. Unlike currentTurn,
+// this is NOT cleared by the silence poke (firePoke/clearTurnStarted). It lets
+// the Bug B fallback in executeReply route to the correct chat even when the
+// model calls reply AFTER the silence poke has nulled currentTurn (Bug D).
+// Safe in single-tenant gateways: the fallback only fires when the raw chat_id
+// fails the allowlist, and this value was itself validated at inbound receipt.
+let lastActiveTurnChatId: string | undefined
 
 /**
  * Set the live turn for `key`. Flag-branches in ONE place (inside the map):
@@ -2227,6 +2234,7 @@ const currentTurnMap = new CurrentTurnMap<CurrentTurn>()
 function setCurrentTurn(turn: CurrentTurn, key: string): void {
   currentTurnMap.set(turn, key)
   currentTurn = currentTurnMap.get() // mirror most-recent-set (== `turn`)
+  lastActiveTurnChatId = turn.sessionChatId
 }
 
 /**
@@ -7972,8 +7980,31 @@ async function executeReply(args: Record<string, unknown>): Promise<{ content: A
   // module-scope currentTurn, which a future refactor could let roll over
   // mid-call.
   const turn = currentTurn
-  const chat_id = String(args.chat_id ?? '')
-  if (!chat_id) throw new Error('reply: chat_id is required')
+  const _rawChatId = String(args.chat_id ?? '')
+  if (!_rawChatId) throw new Error('reply: chat_id is required')
+  // Non-Claude models (e.g. Gemini via LiteLLM sr-* routing) sometimes pass a
+  // chat_id that is not in the allowlist — either an int/string mismatch, or
+  // the model echoing the wrong identifier from context. When the raw value
+  // fails the allowlist check, fall back to the active (or last-known) turn's
+  // validated sessionChatId so the reply still lands correctly.
+  // Tier 1: live turn (currentTurn was non-null at reply entry).
+  // Tier 2: last-known turn (survives silence poke — Bug D fix; currentTurn is
+  //   null because clearTurnStarted fired ≥5 min of model silence, but the model
+  //   finally called reply after the poke).
+  const chat_id = (() => {
+    const _a = loadAccess()
+    if (_a.allowFrom.includes(_rawChatId) || _rawChatId in _a.groups) return _rawChatId
+    const fallbackChatId = turn?.sessionChatId ?? lastActiveTurnChatId
+    if (fallbackChatId && (_a.allowFrom.includes(fallbackChatId) || fallbackChatId in _a.groups)) {
+      const tier = turn == null ? 'last-known' : 'active'
+      process.stderr.write(
+        `telegram gateway: reply: model passed chat_id "${_rawChatId}" (not allowlisted) — ` +
+          `routing to ${tier} turn chat "${fallbackChatId}"\n`,
+      )
+      return fallbackChatId
+    }
+    return _rawChatId // let assertAllowedChat below throw the human-readable error
+  })()
   const rawText = args.text as string | undefined
   if (rawText == null || rawText === '') throw new Error('reply: text is required and cannot be empty')
   let text = repairEscapedWhitespace(rawText)

package/telegram-plugin/gateway/obligation-ledger.ts

@@ -381,6 +381,7 @@ export function buildObligationRepresentInbound(o: Obligation, now: number): Inb
       source: 'obligation_represent',
       origin_turn_id: o.originTurnId,
       represent_count: String(o.representCount + 1),
+      chat_id: o.chatId,
     },
   }
 }

package/telegram-plugin/tests/obligation-ledger.test.ts

@@ -184,6 +184,7 @@ describe("buildObligationRepresentInbound", () => {
     expect(m.meta.origin_turn_id).toBe("-100123:3#715");
     expect(m.meta.source).toBe("obligation_represent"); // synthetic → not tracked, no new obligation
     expect(m.meta.represent_count).toBe("1");
+    expect(m.meta.chat_id).toBe("-100123"); // Bug C fix: chat_id in meta drives the <channel> tag
     expect(m.text).toContain("do the Meta report");
     expect(m.text).toMatch(/answer it now|reply tool/i);
   });

package/telegram-plugin/uat/scenarios/jtbd-model-litellm-sr-dm.test.ts

@@ -59,10 +59,13 @@ describe("uat: /model sr-* LiteLLM routing — section headers + session switch
         const openrouterHeader = flat.find(
           (b) => b.text.includes("OpenRouter") && b.callbackData === "mdl:h",
         );
-        // Prefer a fast non-reasoning model for the E2E test; reasoning models
-        // (deepseek-r1, o1, o3) take 2-5 min per response and hit the silence poke.
+        // Prefer deepseek-v3 (non-thinking, consistently fast) for the E2E test.
+        // gemini-2.5-flash may run in thinking mode via OpenRouter (5+ min latency),
+        // reasoning models (deepseek-r1, o1, o3) also take 2-5 min and hit the
+        // silence poke — both are OK now (Bug D fallback), but slow tests are painful.
         const srButton =
-          flat.find((b) => b.callbackData?.startsWith("mdl:sr:") && /flash/.test(b.callbackData)) ??
+          flat.find((b) => b.callbackData?.startsWith("mdl:sr:") && /deepseek-v3/.test(b.callbackData)) ??
+          flat.find((b) => b.callbackData?.startsWith("mdl:sr:") && /flash/.test(b.callbackData) && !/thinking/.test(b.callbackData)) ??
           flat.find((b) => b.callbackData?.startsWith("mdl:sr:") && !/r1|o1|o3|thinking/.test(b.callbackData)) ??
           flat.find((b) => b.callbackData?.startsWith("mdl:sr:"));
 
@@ -93,10 +96,12 @@ describe("uat: /model sr-* LiteLLM routing — section headers + session switch
         expect((kbAfter ?? []).flat().length, "menu keeps buttons after sr-* tap").toBeGreaterThan(0);
 
         // ── 3. Send a quick message to generate a LiteLLM-routed turn ──
-        // Use 120s — fast models (gemini-flash, deepseek-v3) respond in <10s,
-        // but the request still has to go through the model switch inject + proxy.
+        // 480s budget: fast models (deepseek-v3) reply in <10s; Gemini 2.5 Flash
+        // may run thinking mode via OpenRouter and take 5+ min. The silence poke
+        // fires at 300s, which is OK — the Bug D fallback (lastActiveTurnChatId)
+        // routes the reply even when currentTurn was nulled by the poke.
         await sc.sendDM("Just reply with the word OK.");
-        await sc.expectMessage(/ok/i, { from: "bot", timeout: 120_000 });
+        await sc.expectMessage(/ok/i, { from: "bot", timeout: 480_000 });
 
         // ── 4. LiteLLM spend attribution ────────────────────────────────
         if (spendBefore >= 0) {
@@ -126,7 +131,7 @@ describe("uat: /model sr-* LiteLLM routing — section headers + session switch
         await sc.tearDown();
       }
     },
-    210_000,
+    660_000,
   );
 
   it(