switchroom 0.16.29 → 0.16.46

package/telegram-plugin/gateway/approval-card.ts

@@ -14,8 +14,13 @@
  *     param  = (for ttl) 1h | 24h | 7d
  */
 
+import { escapeMarkdown, codeSpanSafe } from '../format.js';
 import { InlineKeyboard } from "grammy";
 
+// Re-export so existing importers (e.g. vault-request-access-card.ts) keep
+// resolving `codeSpanSafe` from here; the canonical impl lives in format.ts.
+export { codeSpanSafe };
+
 export interface ApprovalCardOptions {
   request_id: string;       // 8-hex from kernel.requestApproval
   agent: string;            // shown in the title
@@ -37,7 +42,7 @@ export interface BuiltApprovalCard {
  */
 export function buildApprovalCard(opts: ApprovalCardOptions): BuiltApprovalCard {
   const lines: string[] = [];
-  lines.push(`🔐 **${escapeHtml(opts.agent)}** wants approval`);
+  lines.push(`🔐 **${escapeMarkdown(opts.agent)}** wants approval`);
   // The scope rides in a `code span` — content there is LITERAL, so it must
   // NOT be markdown-escaped (escaping would leak visible backslashes, e.g.
   // `secret:OPENAI\_API\_KEY`). Only an embedded backtick could break out of
@@ -45,7 +50,7 @@ export function buildApprovalCard(opts: ApprovalCardOptions): BuiltApprovalCard
   lines.push(`\`${codeSpanSafe(opts.scope_humanized)}\``);
   if (opts.why && opts.why.trim().length > 0) {
     lines.push("");
-    lines.push(escapeHtml(opts.why.trim()));
+    lines.push(escapeMarkdown(opts.why.trim()));
   }
   const text = lines.join("\n");
 
@@ -123,15 +128,3 @@ export function ttlMsFromToken(token: string): number | null {
   return null;
 }
 
-function escapeHtml(s: string): string {
-  return s.replace(/([\\`*_~=\[\]|])/g, "\\$1");
-}
-
-/**
- * Make a string safe to interpolate INSIDE a `code span` without escaping
- * (content there is literal). The only character that can prematurely close
- * the span is a backtick, so split it with a zero-width space.
- */
-function codeSpanSafe(s: string): string {
-  return s.replace(/`/g, "`​");
-}

package/telegram-plugin/gateway/approvals-commands.ts

@@ -13,6 +13,7 @@
  * add on top of the same client. Tracked in the migration TODO inline.
  */
 
+import { escapeMarkdown, codeSpanSafe } from '../format.js';
 import type { Bot, Context } from "grammy";
 import { richMessage } from "../rich-send.js";
 import {
@@ -65,7 +66,7 @@ export function registerApprovalsCommands(
       const byAgent = new Map<string, number>();
       for (const d of decisions) byAgent.set(d.agent_unit, (byAgent.get(d.agent_unit) ?? 0) + 1);
       const summary = Array.from(byAgent.entries())
-        .map(([a, n]) => `• **${escapeHtml(a)}**: ${n}`)
+        .map(([a, n]) => `• **${escapeMarkdown(a)}**: ${n}`)
         .join("\n");
       const detail = decisions
         .slice(0, 20)
@@ -76,10 +77,10 @@ export function registerApprovalsCommands(
               : `until ${new Date(d.ttl_expires_at).toISOString().slice(0, 16).replace("T", " ")}`;
           return (
             `\`${d.id.slice(0, 8)}\` ` +
-            `${escapeHtml(d.agent_unit)} → ` +
-            `\`${d.scope}\` ` +
-            `(${escapeHtml(d.action)}, ${ttl}) ` +
-            `· /approvals revoke ${escapeHtml(d.id)}`
+            `${escapeMarkdown(d.agent_unit)} → ` +
+            `\`${codeSpanSafe(d.scope)}\` ` +
+            `(${escapeMarkdown(d.action)}, ${ttl}) ` +
+            `· /approvals revoke ${escapeMarkdown(d.id)}`
           );
         })
         .join("\n");
@@ -114,7 +115,3 @@ export function registerApprovalsCommands(
     ));
   });
 }
-
-function escapeHtml(s: string): string {
-  return s.replace(/([\\`*_~=\[\]|])/g, "\\$1");
-}

package/telegram-plugin/gateway/auth-command.ts

@@ -28,6 +28,7 @@
  * rather than throwing.
  */
 
+import { escapeMarkdown, codeSpanSafe } from '../format.js'
 import type { ListStateData, AccountState } from './auth-line.js'
 import {
   buildSnapshotsFromState,
@@ -158,7 +159,7 @@ export function parseAuthCommand(text: string): ParsedAuthCommand | null {
       if (tail.length > 0) {
         return {
           kind: 'help',
-          reason: `Unknown \`rm\` modifier: \`${escapeHtml(tail)}\`. Use \`/auth rm <label> confirm\` to confirm.`,
+          reason: `Unknown \`rm\` modifier: \`${codeSpanSafe(tail)}\`. Use \`/auth rm <label> confirm\` to confirm.`,
         }
       }
       return { kind: 'rm-prompt', label }
@@ -180,7 +181,7 @@ export function parseAuthCommand(text: string): ParsedAuthCommand | null {
       if (sub !== 'override') {
         return {
           kind: 'help',
-          reason: `Unknown \`agent\` subcommand: \`${escapeHtml(sub || '(none)')}\`. Try \`/auth agent override <agent> <label|clear>\`.`,
+          reason: `Unknown \`agent\` subcommand: \`${codeSpanSafe(sub || '(none)')}\`. Try \`/auth agent override <agent> <label|clear>\`.`,
         }
       }
       const agent = parts[2]
@@ -201,7 +202,7 @@ export function parseAuthCommand(text: string): ParsedAuthCommand | null {
     case 'help':
       return { kind: 'help' }
     default:
-      return { kind: 'help', reason: `Unknown verb: \`${escapeHtml(verb)}\`` }
+      return { kind: 'help', reason: `Unknown verb: \`${codeSpanSafe(verb)}\`` }
   }
 }
 
@@ -417,7 +418,7 @@ export async function handleAuthCommand(
       }
     } catch (err) {
       return {
-        text: `**/auth show failed:** ${escapeHtml((err as Error)?.message ?? String(err))}`,
+        text: `**/auth show failed:** ${escapeMarkdown((err as Error)?.message ?? String(err))}`,
         html: true,
       }
     }
@@ -432,7 +433,7 @@ export async function handleAuthCommand(
       if (!agent) {
         return {
           text:
-            `**/auth show:** no agent named \`${escapeHtml(agentName)}\` in broker view.\n` +
+            `**/auth show:** no agent named \`${codeSpanSafe(agentName)}\` in broker view.\n` +
             `Run \`/auth show\` for the fleet snapshot.`,
           html: true,
         }
@@ -440,7 +441,7 @@ export async function handleAuthCommand(
       return { text: renderAgentDetail(state, agent), html: true }
     } catch (err) {
       return {
-        text: `**/auth show failed:** ${escapeHtml((err as Error)?.message ?? String(err))}`,
+        text: `**/auth show failed:** ${escapeMarkdown((err as Error)?.message ?? String(err))}`,
         html: true,
       }
     }
@@ -476,13 +477,13 @@ export async function handleAuthCommand(
       const result = await ctx.client.setActive(parsed.label)
       return {
         text:
-          `**Active account →** \`${escapeHtml(result.active)}\`\n` +
+          `**Active account →** \`${codeSpanSafe(result.active)}\`\n` +
           `Re-mirrored credentials for ${result.fanned.length} agent${result.fanned.length === 1 ? '' : 's'}.`,
         html: true,
       }
     } catch (err) {
       return {
-        text: `**/auth use failed:** ${escapeHtml((err as Error)?.message ?? String(err))}`,
+        text: `**/auth use failed:** ${escapeMarkdown((err as Error)?.message ?? String(err))}`,
         html: true,
       }
     }
@@ -504,13 +505,13 @@ export async function handleAuthCommand(
       const result = await ctx.client.setActive(nextLabel)
       return {
         text:
-          `**Rotated:** active → \`${escapeHtml(result.active)}\`\n` +
+          `**Rotated:** active → \`${codeSpanSafe(result.active)}\`\n` +
           `Re-mirrored credentials for ${result.fanned.length} agent${result.fanned.length === 1 ? '' : 's'}.`,
         html: true,
       }
     } catch (err) {
       return {
-        text: `**/auth rotate failed:** ${escapeHtml((err as Error)?.message ?? String(err))}`,
+        text: `**/auth rotate failed:** ${escapeMarkdown((err as Error)?.message ?? String(err))}`,
         html: true,
       }
     }
@@ -525,7 +526,7 @@ export async function handleAuthCommand(
       state = await ctx.client.listState()
     } catch (err) {
       return {
-        text: `**/auth rm failed:** ${escapeHtml((err as Error)?.message ?? String(err))}`,
+        text: `**/auth rm failed:** ${escapeMarkdown((err as Error)?.message ?? String(err))}`,
         html: true,
       }
     }
@@ -533,7 +534,7 @@ export async function handleAuthCommand(
     if (!exists) {
       return {
         text:
-          `**/auth rm:** no account named \`${escapeHtml(parsed.label)}\`. ` +
+          `**/auth rm:** no account named \`${codeSpanSafe(parsed.label)}\`. ` +
           `Run \`/auth show\` for the current list.`,
         html: true,
       }
@@ -541,7 +542,7 @@ export async function handleAuthCommand(
     if (state.active === parsed.label) {
       return {
         text:
-          `**/auth rm refused.** \`${escapeHtml(parsed.label)}\` is the fleet active. ` +
+          `**/auth rm refused.** \`${codeSpanSafe(parsed.label)}\` is the fleet active. ` +
           `Switch with \`/auth use <other>\` or \`/auth rotate\` first.`,
         html: true,
       }
@@ -560,9 +561,9 @@ export async function handleAuthCommand(
     }
     return {
       text:
-        `**⚠ /auth rm** — about to remove \`${escapeHtml(parsed.label)}\` from the broker.\n` +
-        `The fleet active is unchanged. Any agent override pointing at \`${escapeHtml(parsed.label)}\` will stop working.\n\n` +
-        `Send \`/auth rm ${escapeHtml(parsed.label)} confirm\` within ${Math.round(
+        `**⚠ /auth rm** — about to remove \`${codeSpanSafe(parsed.label)}\` from the broker.\n` +
+        `The fleet active is unchanged. Any agent override pointing at \`${codeSpanSafe(parsed.label)}\` will stop working.\n\n` +
+        `Send \`/auth rm ${codeSpanSafe(parsed.label)} confirm\` within ${Math.round(
           AUTH_RM_CONFIRM_TTL_MS / 1000,
         )}s to proceed.`,
       html: true,
@@ -578,8 +579,8 @@ export async function handleAuthCommand(
       }
       return {
         text:
-          `**/auth rm:** no pending confirm for \`${escapeHtml(parsed.label)}\` (expired or not started). ` +
-          `Send \`/auth rm ${escapeHtml(parsed.label)}\` first.`,
+          `**/auth rm:** no pending confirm for \`${codeSpanSafe(parsed.label)}\` (expired or not started). ` +
+          `Send \`/auth rm ${codeSpanSafe(parsed.label)}\` first.`,
         html: true,
       }
     }
@@ -589,12 +590,12 @@ export async function handleAuthCommand(
     try {
       const data = await ctx.client.rmAccount(parsed.label)
       return {
-        text: `**Removed** \`${escapeHtml(data.label)}\` from the broker.`,
+        text: `**Removed** \`${codeSpanSafe(data.label)}\` from the broker.`,
         html: true,
       }
     } catch (err) {
       return {
-        text: `**/auth rm failed:** ${escapeHtml((err as Error)?.message ?? String(err))}`,
+        text: `**/auth rm failed:** ${escapeMarkdown((err as Error)?.message ?? String(err))}`,
         html: true,
       }
     }
@@ -609,7 +610,7 @@ export async function handleAuthCommand(
       if (parsed.label && targets.length === 0) {
         return {
           text:
-            `**/auth refresh:** no account named \`${escapeHtml(parsed.label)}\`.`,
+            `**/auth refresh:** no account named \`${codeSpanSafe(parsed.label)}\`.`,
           html: true,
         }
       }
@@ -629,13 +630,13 @@ export async function handleAuthCommand(
           ])
         } catch (err) {
           failures.push(
-            `${label}: ${escapeHtml((err as Error)?.message ?? String(err))}`,
+            `${label}: ${escapeMarkdown((err as Error)?.message ?? String(err))}`,
           )
         }
       }
       const head =
         targets.length === 1
-          ? `**Refreshed** \`${escapeHtml(targets[0]!)}\``
+          ? `**Refreshed** \`${codeSpanSafe(targets[0]!)}\``
           : `**Refreshed** ${rows.length - 1}/${targets.length} account${targets.length === 1 ? '' : 's'}`
       const table = rows.length > 1
         ? "\n```\n" + alignTable(rows) + "\n```"
@@ -646,7 +647,7 @@ export async function handleAuthCommand(
       return { text: head + table + failBlock, html: true }
     } catch (err) {
       return {
-        text: `**/auth refresh failed:** ${escapeHtml((err as Error)?.message ?? String(err))}`,
+        text: `**/auth refresh failed:** ${escapeMarkdown((err as Error)?.message ?? String(err))}`,
         html: true,
       }
     }
@@ -657,13 +658,13 @@ export async function handleAuthCommand(
       const data = await ctx.client.setOverride(parsed.agent, parsed.label)
       return {
         text:
-          `**Override set.** \`${escapeHtml(data.agent)}\` is now pinned to ` +
-          `\`${escapeHtml(data.account ?? parsed.label)}\`.`,
+          `**Override set.** \`${codeSpanSafe(data.agent)}\` is now pinned to ` +
+          `\`${codeSpanSafe(data.account ?? parsed.label)}\`.`,
         html: true,
       }
     } catch (err) {
       return {
-        text: `**/auth agent override failed:** ${escapeHtml((err as Error)?.message ?? String(err))}`,
+        text: `**/auth agent override failed:** ${escapeMarkdown((err as Error)?.message ?? String(err))}`,
         html: true,
       }
     }
@@ -674,13 +675,13 @@ export async function handleAuthCommand(
       const data = await ctx.client.setOverride(parsed.agent, null)
       return {
         text:
-          `**Override cleared** on \`${escapeHtml(data.agent)}\` ` +
+          `**Override cleared** on \`${codeSpanSafe(data.agent)}\` ` +
           `— back to fleet active.`,
         html: true,
       }
     } catch (err) {
       return {
-        text: `**/auth agent override failed:** ${escapeHtml((err as Error)?.message ?? String(err))}`,
+        text: `**/auth agent override failed:** ${escapeMarkdown((err as Error)?.message ?? String(err))}`,
         html: true,
       }
     }
@@ -852,7 +853,7 @@ function formatAccountsTable(state: ListStateData, now: number, demo = false): s
         ? formatRelativeMs(acc.exhausted_until - now)
         : '—'
     rows.push([
-      `${marker} ${escapeHtml(demo ? maskEmail(acc.label) : acc.label)}`,
+      `${marker} ${escapeMarkdown(demo ? maskEmail(acc.label) : acc.label)}`,
       status,
       expires,
       formatQuotaUtilCell(acc, now),
@@ -892,7 +893,7 @@ function formatAgentsTable(state: ListStateData, demo = false): string {
       : a.account === state.active
         ? 'fleet-active'
         : 'pinned'
-    rows.push([escapeHtml(a.name), escapeHtml(demo ? maskEmail(a.account) : a.account), source])
+    rows.push([escapeMarkdown(a.name), escapeMarkdown(demo ? maskEmail(a.account) : a.account), source])
   }
   return alignTable(rows)
 }
@@ -909,10 +910,10 @@ export function renderAgentDetail(
   now: number = Date.now(),
 ): string {
   const lines: string[] = []
-  lines.push(`**${escapeHtml(agent.name)}**`)
+  lines.push(`**${escapeMarkdown(agent.name)}**`)
   const source = agent.override ? 'override' : 'fleet-active'
   lines.push(
-    `Active account: \`${escapeHtml(agent.account)}\` (${source})`,
+    `Active account: \`${codeSpanSafe(agent.account)}\` (${source})`,
   )
   const acct = state.accounts.find((a) => a.label === agent.account)
   if (acct) {
@@ -948,17 +949,13 @@ function formatConsumersTable(state: ListStateData, now: number, demo = false):
       c.last_seen_at == null
         ? 'socket bound'
         : `socket bound (last seen ${formatRelativeMs(now - c.last_seen_at)} ago)`
-    rows.push([escapeHtml(c.name), escapeHtml(demo ? maskEmail(c.account) : c.account), status])
+    rows.push([escapeMarkdown(c.name), escapeMarkdown(demo ? maskEmail(c.account) : c.account), status])
   }
   return alignTable(rows)
 }
 
 // ─── Plain-text helpers ────────────────────────────────────────────────────
 
-function escapeHtml(s: string): string {
-  return s.replace(/([\\`*_~=\[\]|])/g, '\\$1')
-}
-
 function formatRelativeMs(ms: number): string {
   if (ms <= 0) return '0s'
   const totalSec = Math.floor(ms / 1000)

package/telegram-plugin/gateway/boot-card.ts

@@ -51,7 +51,7 @@ import {
   AGENT_LIVE_WINDOW_MS,
   AGENT_LIVE_POLL_INTERVAL_MS,
 } from './boot-probes.js'
-import { escapeMarkdown } from '../card-format.js'
+import { escapeMarkdown, stackCardLines } from '../card-format.js'
 import {
   loadCache as loadBootIssueCache,
   diffProbes as diffBootProbes,
@@ -468,7 +468,12 @@ export function renderBootCard(opts: RenderBootCardOpts): string {
     sections.push('', ...configChangeRows)
   }
   if (sections.length === 1) return ack
-  return sections.join('\n')
+  // Stack rows with GFM hard breaks so the boot card's styled prose rows don't
+  // collapse onto one visual line in the rich-message renderer (#2669). A
+  // section entry may itself carry an internal newline (a multi-line `ack`, an
+  // update-outcome blob), so flatten to single lines first — see stackCardLines.
+  const flatLines = sections.flatMap((s) => s.split('\n'))
+  return stackCardLines(flatLines)
 }
 
 /**

package/telegram-plugin/gateway/chat-id-fallback.ts

@@ -0,0 +1,46 @@
+/**
+ * Shared chat_id allowlist fallback for the reply / stream_reply final-answer
+ * paths.
+ *
+ * Non-Claude models (Gemini via LiteLLM `sr-*` routing) sometimes pass a
+ * chat_id that fails the allowlist:
+ *
+ *   - **Bug A (numeric coercion):** the model passes a JSON number, so the
+ *     caller must `String(...)`-coerce before the allowlist compare (the
+ *     allowlist is a string set). Without coercion `42 !== "42"` and every
+ *     reply looks un-allowlisted.
+ *   - **Bug B (executeReply fallback):** the raw value is wrong, so fall back
+ *     to the *active* turn's already-validated `sessionChatId`.
+ *   - **Bug D (lastActiveTurnChatId survives silence poke):** a ≥5-min silence
+ *     poke fires `clearTurnStarted`, so `currentTurn` is null by the time the
+ *     model finally replies. The active-turn tier is gone, but the last-known
+ *     turn's chat still routes the answer correctly.
+ *
+ * These hotfixes shipped test-free; this helper isolates the pure decision so
+ * each bug gets a focused regression test.
+ *
+ * Returns the resolved chat_id (rawChatId unchanged when no valid fallback
+ * exists, so the caller's `assertAllowedChat` throws the human-readable error)
+ * plus the tier used, for logging. Pure — no module state read.
+ */
+export interface ChatIdAllowlist {
+  allowFrom: string[]
+  groups: Record<string, unknown>
+}
+
+export function resolveChatIdFallback(
+  rawChatId: string,
+  access: ChatIdAllowlist,
+  turnSessionChatId: string | undefined,
+  lastKnownChatId: string | undefined,
+  hasLiveTurn: boolean,
+): { chatId: string; tier: 'raw' | 'active' | 'last-known' } {
+  if (access.allowFrom.includes(rawChatId) || rawChatId in access.groups) {
+    return { chatId: rawChatId, tier: 'raw' }
+  }
+  const fallbackChatId = turnSessionChatId ?? lastKnownChatId
+  if (fallbackChatId && (access.allowFrom.includes(fallbackChatId) || fallbackChatId in access.groups)) {
+    return { chatId: fallbackChatId, tier: hasLiveTurn ? 'active' : 'last-known' }
+  }
+  return { chatId: rawChatId, tier: 'raw' }
+}

package/telegram-plugin/gateway/config-approval-handler.ts

@@ -2,6 +2,7 @@
 // card, resolves the verdict back to hostd over IPC, and flips the card to
 // a terminal state on finalize.
 
+import { escapeMarkdown } from '../format.js';
 import { randomBytes } from "node:crypto";
 import type { IpcClient } from "./ipc-server.js";
 import type {
@@ -180,10 +181,6 @@ const REASON_ELLIPSIS = "…";
  */
 export const DIFF_SENTINEL = "\n[… diff continues, see attached file]";
 
-function escapeMd(s: string): string {
-  return s.replace(/([\\`*_~=\[\]|])/g, "\\$1");
-}
-
 function clipReason(reason: string): string {
   if (reason.length <= REASON_MAX_CHARS) return reason;
   return reason.slice(0, REASON_MAX_CHARS - REASON_ELLIPSIS.length) +
@@ -214,7 +211,7 @@ export function buildConfigApprovalCardBody(args: {
   const render = (diff: string): string =>
     `🛠 **Config edit proposed**\n` +
     `Agent: \`${args.agentName}\`\n` +
-    `Reason: ${escapeMd(safeReason)}\n\n` +
+    `Reason: ${escapeMarkdown(safeReason)}\n\n` +
     "```\n" + diff + "\n```";
 
   return truncateRawToFit({
@@ -447,8 +444,8 @@ export function buildLiveNote(affectedAgents?: string[], fleetWide?: boolean): s
   }
   const agents = (affectedAgents ?? []).filter((a) => typeof a === "string" && a.length > 0);
   if (agents.length === 0) return "";
-  const list = agents.map(escapeMd).join(", ");
-  const cmds = agents.map((a) => `/restart ${escapeMd(a)}`).join(" · ");
+  const list = agents.map(escapeMarkdown).join(", ");
+  const cmds = agents.map((a) => `/restart ${escapeMarkdown(a)}`).join(" · ");
   return `\n\n🔄 Not live until restart — affects: **${list}**\n${cmds}`;
 }
 
@@ -476,8 +473,8 @@ export async function handleRequestConfigFinalize(
     msg.outcome === "applied" ? buildLiveNote(msg.affectedAgents, msg.fleetWide) : "";
   const body =
     msg.outcome === "applied"
-      ? `✅ **Applied**${msg.detail ? `\n${escapeMd(msg.detail)}` : ""}${liveNote}`
-      : `⚠️ **Reconcile failed; rolled back**${msg.detail ? `\n${escapeMd(msg.detail)}` : ""}`;
+      ? `✅ **Applied**${msg.detail ? `\n${escapeMarkdown(msg.detail)}` : ""}${liveNote}`
+      : `⚠️ **Reconcile failed; rolled back**${msg.detail ? `\n${escapeMarkdown(msg.detail)}` : ""}`;
   try {
     // Finalize is terminal — strip the keyboard so the buttons are gone.
     await deps.editCard({

package/telegram-plugin/gateway/diff-preview-card.ts

@@ -21,6 +21,7 @@
  * single-shot "do this edit now" intent.
  */
 
+import { escapeMarkdown } from '../format.js';
 import { InlineKeyboard } from "grammy";
 import type { DiffPreview } from "../../src/drive/diff-preview.js";
 
@@ -88,9 +89,9 @@ export function buildDiffPreviewCard(
   // The 📍 + line-count rows are surfaced verbatim — they're
   // wrapper-attested and the agent has no input into their content.
   const bodyLines: string[] = [];
-  bodyLines.push(`**${escapeHtml(preview.title)}**`);
+  bodyLines.push(`**${escapeMarkdown(preview.title)}**`);
   for (const line of preview.lines) {
-    bodyLines.push(escapeHtml(line.text));
+    bodyLines.push(escapeMarkdown(line.text));
   }
   const text = bodyLines.join("\n");
 
@@ -161,7 +162,3 @@ export function buildDiffPreviewCard(
 
   return { text, reply_markup: kb };
 }
-
-function escapeHtml(s: string): string {
-  return s.replace(/([\\`*_~=\[\]|])/g, "\\$1");
-}