switchroom 0.16.29 → 0.16.46

package/telegram-plugin/tests/voice-transcribe.test.ts

@@ -10,10 +10,18 @@
  */
 
 import { describe, it, expect } from 'bun:test'
+import { readFileSync } from 'node:fs'
+import { fileURLToPath } from 'node:url'
 import {
   transcribeViaWhisper,
   OPENAI_WHISPER_MAX_BYTES,
 } from '../voice-transcribe.js'
+import {
+  materializeVoiceKey,
+  DEFAULT_VOICE_API_KEY_REF,
+} from '../../src/telegram/materialize-voice-key.js'
+import type { resolveVaultReferencesViaBroker } from '../../src/vault/resolver.js'
+import type { SwitchroomConfig } from '../../src/config/schema.js'
 
 const SMALL_AUDIO = new Uint8Array([0x4f, 0x67, 0x67, 0x53]) // OggS magic; not real audio
 
@@ -194,3 +202,183 @@ describe('transcribeViaWhisper — error paths', () => {
     expect(r).toMatchObject({ ok: false, reason: 'timeout' })
   })
 })
+
+// ── PR-A: STT key resolves via the vault broker, not a plaintext file ──
+
+const EMPTY_CONFIG = {} as unknown as SwitchroomConfig
+
+/** A fake broker resolver that returns the value mapped to bot_token (the
+ *  key materializeVoiceKey narrows the reference onto). */
+function makeBrokerResolver(
+  resolvedRefs: Record<string, string>,
+): typeof resolveVaultReferencesViaBroker {
+  return (async (config: SwitchroomConfig) => {
+    const ref = config.telegram?.bot_token
+    if (ref && resolvedRefs[ref] !== undefined) {
+      return {
+        ok: true,
+        config: {
+          ...config,
+          telegram: { ...config.telegram, bot_token: resolvedRefs[ref] },
+        },
+      }
+    }
+    return { ok: false, reason: 'not_found' as const }
+  }) as unknown as typeof resolveVaultReferencesViaBroker
+}
+
+describe('materializeVoiceKey — vault resolution', () => {
+  it('resolves the configured vault ref via the broker', async () => {
+    const key = await materializeVoiceKey({
+      apiKeyRef: 'vault:openai/api-key',
+      config: EMPTY_CONFIG,
+      env: {},
+      resolveViaBroker: makeBrokerResolver({
+        'vault:openai/api-key': 'sk-' + 'resolved' + '-key',
+      }),
+    })
+    expect(key).toBe('sk-' + 'resolved' + '-key')
+  })
+
+  it('defaults to vault:openai/api-key when no ref is configured', async () => {
+    expect(DEFAULT_VOICE_API_KEY_REF).toBe('vault:openai/api-key')
+    const key = await materializeVoiceKey({
+      apiKeyRef: undefined,
+      config: EMPTY_CONFIG,
+      env: {},
+      resolveViaBroker: makeBrokerResolver({
+        'vault:openai/api-key': 'sk-' + 'default' + '-key',
+      }),
+    })
+    expect(key).toBe('sk-' + 'default' + '-key')
+  })
+
+  it('returns a literal (non-vault) key directly without touching the broker', async () => {
+    let brokerCalled = false
+    const key = await materializeVoiceKey({
+      apiKeyRef: 'sk-' + 'literal',
+      config: EMPTY_CONFIG,
+      env: {},
+      resolveViaBroker: (async () => {
+        brokerCalled = true
+        return { ok: false, reason: 'not_found' as const }
+      }) as unknown as typeof resolveVaultReferencesViaBroker,
+    })
+    expect(key).toBe('sk-' + 'literal')
+    expect(brokerCalled).toBe(false)
+  })
+
+  it('returns null (graceful fallback, no throw) when the key is unresolvable', async () => {
+    const key = await materializeVoiceKey(
+      {
+        apiKeyRef: 'vault:openai/api-key',
+        config: EMPTY_CONFIG,
+        env: {}, // no SWITCHROOM_VAULT_PASSPHRASE → no direct-decrypt fallback
+        resolveViaBroker: makeBrokerResolver({}), // broker resolves nothing
+      },
+      () => {}, // swallow the diagnostic log
+    )
+    expect(key).toBeNull()
+  })
+
+  // ── Regression: single-key isolation (voice token bug) ──
+  //
+  // The batch resolver (resolveVaultReferencesViaBroker) fails the WHOLE
+  // resolution unless EVERY vault: ref it finds resolves. Admin-only refs
+  // like litellm.admin_key / google_workspace.google_client_secret are
+  // (correctly) DENIED to a normal agent, so if the materializer passes the
+  // full config those denials sink the resolution even though openai/api-key
+  // itself is granted. The fix passes a MINIMAL config carrying only the one
+  // ref. These tests would fail against the old `...config` spread.
+
+  /** Regex of every vault: ref the resolver sees; denies if it sees any admin-only key. */
+  function collectRefs(v: unknown, out: Set<string>): void {
+    if (typeof v === 'string' && v.startsWith('vault:')) out.add(v.slice('vault:'.length).split('#')[0])
+    else if (Array.isArray(v)) for (const i of v) collectRefs(i, out)
+    else if (v !== null && typeof v === 'object') for (const val of Object.values(v as Record<string, unknown>)) collectRefs(val, out)
+  }
+
+  /**
+   * A resolver stub with the SAME batch semantics as the real one: it fails
+   * (denied) unless every ref it collects is in `granted`. Mirrors how a real
+   * broker denies admin-only keys to a normal agent.
+   */
+  function makeBatchResolver(
+    granted: Record<string, string>,
+    onCall?: (refs: Set<string>) => void,
+  ): typeof resolveVaultReferencesViaBroker {
+    return (async (config: SwitchroomConfig) => {
+      const refs = new Set<string>()
+      collectRefs(config, refs)
+      onCall?.(refs)
+      for (const r of refs) {
+        if (granted[`vault:${r}`] === undefined) {
+          return { ok: false, reason: 'denied' as const }
+        }
+      }
+      const resolvedToken = granted[config.telegram?.bot_token ?? '']
+      return {
+        ok: true,
+        config: { ...config, telegram: { ...config.telegram, bot_token: resolvedToken } },
+      }
+    }) as unknown as typeof resolveVaultReferencesViaBroker
+  }
+
+  const CONFIG_WITH_ADMIN_REFS = {
+    telegram: { bot_token: 'vault:tg/bot' },
+    litellm: { admin_key: 'vault:litellm/master-key' },
+    google_workspace: { google_client_secret: 'vault:google/client-secret' },
+    agents: { klanker: { some_key: 'vault:per-agent/secret' } },
+    vault: { path: '~/.switchroom/vault.enc' },
+  } as unknown as SwitchroomConfig
+
+  it('resolves the STT key even when the config carries admin-only vault refs the broker DENIES', async () => {
+    const key = await materializeVoiceKey({
+      apiKeyRef: 'vault:openai/api-key',
+      config: CONFIG_WITH_ADMIN_REFS,
+      env: {},
+      // ONLY openai/api-key is granted; litellm/google/per-agent all DENY.
+      resolveViaBroker: makeBatchResolver({ 'vault:openai/api-key': 'sk-granted-key' }),
+    })
+    expect(key).toBe('sk-granted-key')
+  })
+
+  it('invokes the resolver with a config containing exactly ONE vault ref (the STT key)', async () => {
+    let seen: Set<string> | null = null
+    await materializeVoiceKey({
+      apiKeyRef: 'vault:openai/api-key',
+      config: CONFIG_WITH_ADMIN_REFS,
+      env: {},
+      resolveViaBroker: makeBatchResolver(
+        { 'vault:openai/api-key': 'sk-granted-key' },
+        (refs) => { seen = refs },
+      ),
+    })
+    expect(seen).not.toBeNull()
+    expect([...seen!]).toEqual(['openai/api-key'])
+  })
+})
+
+describe('voice-in — no plaintext key file is read', () => {
+  it('the gateway never reads ~/.switchroom/openai-api-key as a path', () => {
+    const gatewayPath = fileURLToPath(
+      new URL('../gateway/gateway.ts', import.meta.url),
+    )
+    const src = readFileSync(gatewayPath, 'utf8')
+    // The plaintext file basename must not appear as a path segment in
+    // any source string (it lived in a join(..., 'openai-api-key')).
+    expect(src).not.toContain("'openai-api-key'")
+    expect(src).not.toContain('"openai-api-key"')
+  })
+
+  it('the voice-key materializer reads no openai-api-key path', () => {
+    const helperPath = fileURLToPath(
+      new URL('../../src/telegram/materialize-voice-key.ts', import.meta.url),
+    )
+    const src = readFileSync(helperPath, 'utf8')
+    // The basename appears only inside a code-comment sentence (prose),
+    // never quoted as a path literal that fs would read.
+    expect(src).not.toContain("'openai-api-key'")
+    expect(src).not.toContain('"openai-api-key"')
+  })
+})

package/telegram-plugin/tests/worker-activity-feed.test.ts

@@ -115,7 +115,7 @@ describe('renderWorkerActivity', () => {
     expect(out).toContain('─────')
     expect(out).toContain('✅ _PR #21 opened_')
     // latestSummary is the RESULT on the finished path, never also a step.
-    expect(out).not.toContain('_✓ PR #21 opened_')
+    expect(out).not.toContain('~~_✓ PR #21 opened_~~')
   })
 
   it('renders a failed terminal recap', () => {
@@ -155,8 +155,8 @@ describe('renderWorkerActivity', () => {
         narrativeLines: ['read the brief', 'scanned vendor A', 'scanned vendor B'],
       }),
     )
-    expect(out).toContain('_✓ read the brief_')
-    expect(out).toContain('_✓ scanned vendor A_')
+    expect(out).toContain('~~_✓ read the brief_~~')
+    expect(out).toContain('~~_✓ scanned vendor A_~~')
     expect(out).toContain('**→ scanned vendor B**')
     // The single-line latestSummary fallback is NOT used when a block is present.
     expect(out).not.toContain('newest only')
@@ -171,7 +171,7 @@ describe('renderWorkerActivity', () => {
 
   it('drops blank narrative lines from the feed', () => {
     const out = renderWorkerActivity(view({ narrativeLines: ['kept', '   ', 'also kept'] }))
-    expect(out).toContain('_✓ kept_')
+    expect(out).toContain('~~_✓ kept_~~')
     expect(out).toContain('**→ also kept**')
     expect(stepCount(out)).toBe(2)
   })
@@ -183,7 +183,7 @@ describe('renderWorkerActivity', () => {
     expect(out).toContain(`_✓ +${total - STATUS_ROLLING_LINES} earlier…_`)
     expect(out).not.toContain('step 1<')
     const firstVisible = total - STATUS_ROLLING_LINES + 1
-    expect(out).toContain(`_✓ step ${firstVisible}_`)
+    expect(out).toContain(`~~_✓ step ${firstVisible}_~~`)
     expect(out).toContain(`**→ step ${total}**`)
     // STATUS_ROLLING_LINES visible step lines (the overflow header isn't a step).
     expect(out.match(/step \d/g) ?? []).toHaveLength(STATUS_ROLLING_LINES)
@@ -191,7 +191,7 @@ describe('renderWorkerActivity', () => {
 
   it('strips the CONTENT Markdown markup (the card keeps its own ** / _ wrappers, #2669)', () => {
     // Post-#2669 the card itself is rich markdown — the header is **Worker**
-    // and steps are _✓ …_ / **→ …**. The per-line pipeline still runs
+    // and steps are ~~_✓ …_~~ / **→ …**. The per-line pipeline still runs
     // stripMarkdown over the user-supplied CONTENT so a model-authored
     // `**full**` / `` `git push` `` doesn't inject extra emphasis, but the
     // card's own wrapper markup is expected.
@@ -276,6 +276,24 @@ describe('createWorkerActivityFeed', () => {
     expect(feed.has('w1')).toBe(true)
   })
 
+  it('messageIdOf exposes the posted message id (for status-pin) and is null before paint / after finish', async () => {
+    const bot = makeFakeBot()
+    let clock = 0
+    const feed = createWorkerActivityFeed({ bot, now: () => clock, firstPaintMinMs: 8000 })
+    // Before paint: no message, no id to pin.
+    clock = 5000
+    await feed.update('w1', 'chat', view({ elapsedMs: 5000 }))
+    expect(feed.messageIdOf('w1')).toBeNull()
+    // After paint: id is the posted message the gateway pins.
+    clock = 9000
+    await feed.update('w1', 'chat', view({ elapsedMs: 9000 }))
+    // The fake mints message ids starting at 1000; first paint → 1000.
+    expect(feed.messageIdOf('w1')).toBe(1000)
+    // After finish: handle is dropped → null (gateway unpins independently).
+    await feed.finish('w1', view({ state: 'done' }))
+    expect(feed.messageIdOf('w1')).toBeNull()
+  })
+
   it('dedups an identical body (no edit)', async () => {
     const bot = makeFakeBot()
     let clock = 10_000
@@ -406,8 +424,8 @@ describe('createWorkerActivityFeed', () => {
     await feed.update('w1', 'chat', view({ toolCount: 3, latestSummary: 'scanned vendor B' }))
 
     const last = bot.edits.at(-1)!
-    expect(last.text).toContain('_✓ read the brief_')
-    expect(last.text).toContain('_✓ scanned vendor A_')
+    expect(last.text).toContain('~~_✓ read the brief_~~')
+    expect(last.text).toContain('~~_✓ scanned vendor A_~~')
     expect(last.text).toContain('**→ scanned vendor B**')
     expect(last.text.match(/[✓→]/g) ?? []).toHaveLength(3)
   })
@@ -462,8 +480,8 @@ describe('createWorkerActivityFeed', () => {
     clock = 13_000
     await feed.update('w1', 'chat', view({ toolCount: 3, latestSummary: 'line C' }))
     const last = bot.edits.at(-1)!
-    expect(last.text).toContain('_✓ line A_')
-    expect(last.text).toContain('_✓ line B_')
+    expect(last.text).toContain('~~_✓ line A_~~')
+    expect(last.text).toContain('~~_✓ line B_~~')
     expect(last.text).toContain('**→ line C**')
   })
 
@@ -649,6 +667,55 @@ describe('createWorkerActivityFeed — heartbeat', () => {
     expect(edit1!.text).toContain(`· ${Math.floor((26_000 - dispatchAt) / 1000)}s`)
   })
 
+  it('(i-b) heartbeat repaint keeps the header master elapsed >= the step timer (same clock anchor)', async () => {
+    // Ken-observed defect: the heartbeat computed a LIVE `· Ns` step suffix
+    // from dispatchAtMs but re-rendered the header from the STALE
+    // lastView.elapsedMs (frozen at the last watcher event), so the current
+    // step's timer could read MORE than the card's master elapsed. Both must
+    // derive from the same anchor at render time.
+    const bot = makeFakeBot()
+    let clock = 10_000
+    const feed = createWorkerActivityFeed({
+      bot,
+      now: () => clock,
+      minEditIntervalMs: 2500,
+      heartbeatTickMs: 6000,
+      setInterval: () => 1,
+      clearInterval: () => {},
+    })
+    // First paint: view says elapsed 9s → dispatchAt = 19_000 - 9_000 = 10_000.
+    clock = 19_000
+    await feed.update('w1', 'chat', view({ elapsedMs: 9000, latestSummary: 'pulling data' }))
+    expect(bot.sent).toHaveLength(1)
+
+    // No watcher events for a long stretch; the heartbeat repaints at 80s.
+    clock = 80_000 // live elapsed = 70_000 ms = 1m10s
+    feed.heartbeatTick()
+    // Drain the handle's promise chain.
+    await new Promise((r) => setTimeout(r, 0))
+
+    const edit = bot.edits[bot.edits.length - 1]
+    expect(edit).toBeDefined()
+    // Header line 2 (`_{elapsed} · {n} tools_`) must show the LIVE master
+    // elapsed — not the stale 9s from the last view.
+    const headerMatch = /_(\d+(?:m\d+)?s) · \d+ tools?_/.exec(edit.text)
+    expect(headerMatch, `no header elapsed in: ${edit.text}`).not.toBeNull()
+    // Step suffix (`· Ns**`) on the in-progress line.
+    const stepMatch = /· (\d+(?:m\d+)?s)\*\*/.exec(edit.text)
+    expect(stepMatch, `no step suffix in: ${edit.text}`).not.toBeNull()
+
+    const toMs = (s: string): number => {
+      const m = /^(?:(\d+)m)?(\d+)s$/.exec(s)!
+      return (m[1] ? Number(m[1]) * 60_000 : 0) + Number(m[2]) * 1000
+    }
+    const headerMs = toMs(headerMatch![1])
+    const stepMs = toMs(stepMatch![1])
+    // Outcome: both timers advance together off one anchor — the header is
+    // live (not frozen at 9s) and the step never exceeds the master.
+    expect(headerMs).toBeGreaterThanOrEqual(stepMs)
+    expect(headerMs).toBe(70_000) // 1m10s — refreshed to the live value
+  })
+
   it('(ii) respects a 429 cooldown — no edit while cooldownUntil is in the future', async () => {
     const bot = makeFakeBot()
     let clock = 10_000

package/telegram-plugin/text-voice-scrub.ts

@@ -203,15 +203,27 @@ function restore(
  * Replace em / en dashes with context-appropriate punctuation.
  *
  * Rules, applied in order:
- *   1. ` — ` / ` – ` (flanked by single space) → `, ` if followed by a
- *      lowercase or open-paren character; otherwise `. ` if followed by
- *      an uppercase or end-of-string. Heuristic: lowercase = mid-clause
- *      continuation (comma reads naturally); uppercase = new sentence
- *      (period reads naturally).
+ *   1. ` — ` / ` – ` (flanked by single space) → `. ` + the following
+ *      word recapitalized, in the common case. A spaced em-dash in prose
+ *      almost always joins two INDEPENDENT clauses ("voice came back —
+ *      three PRs stacked"); degrading that to a comma produces a comma
+ *      splice ("voice came back, three PRs stacked"), which reads as
+ *      broken grammar. A period (full stop) is the substitution that
+ *      never corrupts meaning: two independent clauses become two
+ *      sentences. The genuine appositive/parenthetical use of a dash
+ *      ("the lead — a tall man — spoke") is the minority case and still
+ *      reads acceptably as two short sentences, so we default to the
+ *      period rather than risk a splice. A dash already followed by a
+ *      lowercased conjunction/pronoun that only makes sense mid-sentence
+ *      is the rare exception the heuristic can't recover; a clean period
+ *      beats a comma splice there too. Original PR #1683 used a comma for
+ *      lowercase continuations; that was the #2737-era source of splices
+ *      in real replies (fixed here).
  *   2. End-of-line dash (` —\n` / ` –\n`) → `.\n` — treat as full stop.
  *   3. Bare dash with no flanking spaces between word chars
- *      (e.g. "word—word") → `, ` — the missing-space form is rarer but
- *      semantically the same as #1.
+ *      (e.g. "word—word") → `. ` + recapitalized following word — the
+ *      missing-space form is rarer but semantically the same as #1, so it
+ *      gets the same splice-free full-stop treatment.
  *   4. Surviving dash (uncommon, e.g. at sentence start "— note") → `-`
  *      so the message still renders without the AI tell.
  */
@@ -219,14 +231,27 @@ function replaceDashes(text: string): { out: string; replaced: number } {
   let replaced = 0
   let out = text
 
-  // #1: spaced em-dash mid-prose. Decide between ", " and ". " on
-  // the leading character of the following token.
-  out = out.replace(/(\S) [—–] (\S)/g, (_m, before: string, after: string) => {
+  // Recapitalize the first ASCII-lowercase letter of `after` so the new
+  // sentence that a full-stop substitution creates reads correctly. A
+  // non-letter start (digit, `(`, quote) is left as-is. A lowercase-initial
+  // mixed-case brand token (iOS, eBay, iPhone, macOS — second char is
+  // uppercase) is ALSO left as-is: recapitalizing it to "IOS" corrupts the
+  // brand, and the token's own capitalization already reads as intentional.
+  const capFirst = (after: string): string => {
+    if (/^[a-z][A-Z]/.test(after)) return after
+    return after.replace(/^([a-z])/, (_m, ch: string) => ch.toUpperCase())
+  }
+
+  // #1: spaced em-dash mid-prose. A spaced dash joins two independent
+  // clauses far more often than it sets off an appositive, so degrade it
+  // to a full stop (never a comma — that produces a comma splice) and
+  // recapitalize the following word into a new sentence. A digit-flanked
+  // dash is a numeric range (10–20), not a clause break, so it's excluded
+  // here and falls through to rule #4 (→ ASCII hyphen, "10-20").
+  out = out.replace(/(\S) [—–] (\S)(\S?)/g, (m, before: string, after: string, peek: string) => {
+    if (/\d/.test(before) && /\d/.test(after)) return m
     replaced++
-    // If `after` is uppercase ASCII or one of a known sentence-starter
-    // set, treat as new sentence; otherwise a parenthetical comma.
-    const sentenceStart = /[A-Z]/.test(after)
-    return sentenceStart ? `${before}. ${after}` : `${before}, ${after}`
+    return `${before}. ${capFirst(after + peek)}`
   })
 
   // #2: dash at end of line. Treat as full stop.
@@ -235,11 +260,14 @@ function replaceDashes(text: string): { out: string; replaced: number } {
     return `.${ws}`
   })
 
-  // #3: bare dash between word chars (no flanking spaces). Treat as
-  // missing-space form of #1; comma is the safe fallback.
-  out = out.replace(/(\w)[—–](\w)/g, (_m, before: string, after: string) => {
+  // #3: bare dash between word chars (no flanking spaces). Missing-space
+  // form of #1 — same full-stop treatment so it can't create a splice. A
+  // digit-flanked dash (3–2) is a numeric range, not a clause break, so it's
+  // excluded and falls through to rule #4 (→ ASCII hyphen, "3-2").
+  out = out.replace(/(\w)[—–](\w)(\w?)/g, (m, before: string, after: string, peek: string) => {
+    if (/\d/.test(before) && /\d/.test(after)) return m
     replaced++
-    return `${before}, ${after}`
+    return `${before}. ${capFirst(after + peek)}`
   })
 
   // #4: anything still standing — convert to ASCII hyphen so no
@@ -266,6 +294,28 @@ function replaceDashes(text: string): { out: string; replaced: number } {
  * checked per call so an operator can flip it via env var without a
  * restart of an in-process test.
  */
+/**
+ * Dash-only normalization — the em/en-dash substitution from `scrubVoice`
+ * WITHOUT the opener-strip or the metric/result-object side effects.
+ *
+ * Exists so non-reply surfaces (progress cards, worker narration, PTY
+ * previews via card-format.ts) can close the em-dash leak on model-authored
+ * prose without pulling in the opener strip (which those paths must not do)
+ * and without duplicating the dash regexes. Reuses the exact same
+ * `park`/`replaceDashes`/`restore` mechanism as `scrubVoice`, so code spans
+ * and fenced blocks are masked identically and dashes inside them survive.
+ *
+ * Honors the same `SWITCHROOM_DISABLE_VOICE_SCRUB` kill switch. Returns the
+ * input unchanged when disabled, empty, or nothing changed.
+ */
+export function normalizeDashes(text: string): string {
+  if (!enabled() || text.length === 0) return text
+  const { parked, parts } = park(text)
+  const { out, replaced } = replaceDashes(parked)
+  if (replaced === 0) return text
+  return restore(out, parts)
+}
+
 export function scrubVoice(text: string): VoiceScrubResult {
   if (!enabled() || text.length === 0) {
     return { scrubbed: text, replaced: 0, openersStripped: 0 }