switchroom 0.16.47 → 0.17.0

package/telegram-plugin/gateway/inbound-delivery-confirm.ts

@@ -72,6 +72,36 @@ export function trackDelivery<M>(
   q.pending.set(key, { key, inbound, messageId, lastAttemptAt: now })
 }
 
+/**
+ * Extract every `message_id="…"` value carried in a rendered enqueue envelope.
+ *
+ * The `enqueue` session-event's message id (`enqueueMessageId`) is a SINGLE
+ * value re-parsed from the transcript by `parseChannelMeta`, which grabs the
+ * FIRST `message_id` it finds. When claude's composer MERGES several inbound
+ * envelopes into one turn (or reformats the wrapper), that first-parsed id can
+ * be a sibling's — not the tracked message's — even though the tracked
+ * message's envelope is right there in the same content. Strict equality then
+ * mis-concludes "never delivered" and the sweep re-delivers a turn that is
+ * already running (#2786). Scanning ALL ids in the raw content makes the ack
+ * tolerant of that reorder/merge: the tracked id is present iff its envelope
+ * was delivered, regardless of parse order.
+ *
+ * The regex is LEFT-ANCHORED on an attribute boundary (start-of-string or a
+ * whitespace/quote before the name) so it matches ONLY the real `message_id`
+ * attribute — never a same-suffix sibling like `target_message_id`,
+ * `reply_to_message_id`, `original_message_id`, or `card_message_id`. This is
+ * what makes the tolerant-path match safe on a never-drop code path: a
+ * substring collision on some other `*_message_id` attribute cannot false-ack
+ * (and thus silently drop) a real user message still waiting to land.
+ */
+export function extractEnqueueMessageIds(content: string): string[] {
+  const ids: string[] = []
+  const re = /(?:^|[\s"'])message_id="([^"]+)"/g
+  let m: RegExpExecArray | null
+  while ((m = re.exec(content)) != null) ids.push(m[1]!)
+  return ids
+}
+
 /**
  * Ack a delivery — call from the `enqueue` session-event (claude started a
  * turn). `enqueue` fires for EVERY turn start regardless of source (user
@@ -80,21 +110,36 @@ export function trackDelivery<M>(
  * silently drop — a real user message still waiting under the same key. So
  * ack ONLY when the enqueue's source message id matches the tracked one.
  *
- * Matching rule: if we recorded a messageId for the pending entry, require the
- * enqueue's `enqueueMessageId` to equal it. If we never recorded one (legacy /
- * defensive null), fall back to key-only ack. Returns true if an entry was
- * cleared.
+ * Matching rule (composer-tolerant, #2786): if we recorded a messageId for the
+ * pending entry, ack when EITHER
+ *   - the single re-parsed `enqueueMessageId` equals it (the fast path), OR
+ *   - the tracked id appears among the message ids carried in `enqueueContent`
+ *     (the tolerant path — survives the composer merging/reordering envelopes
+ *     so the first-parsed id belongs to a sibling, not the tracked message).
+ * Matching on the exact `message_id="…"` token — not a loose substring —
+ * preserves the cross-source false-ack guard: a synthetic-source turn (cron /
+ * resume / vault) never carries the real user message's id, so it still can't
+ * clear a user message that is genuinely still waiting to land. If we never
+ * recorded a messageId (legacy / defensive null), fall back to key-only ack.
+ * Returns true if an entry was cleared.
  */
 export function ackDelivery<M>(
   q: DeliveryQueue<M>,
   key: string,
   enqueueMessageId: string | null = null,
+  enqueueContent: string | null = null,
 ): boolean {
   const entry = q.pending.get(key)
   if (!entry) return false
-  // A different message started this turn — don't ack ours (it may still be
-  // waiting to land; the sweep will re-deliver it if it stranded).
-  if (entry.messageId != null && entry.messageId !== enqueueMessageId) return false
+  if (entry.messageId != null) {
+    const matches =
+      entry.messageId === enqueueMessageId ||
+      (enqueueContent != null &&
+        extractEnqueueMessageIds(enqueueContent).includes(entry.messageId))
+    // A different message started this turn — don't ack ours (it may still be
+    // waiting to land; the sweep will re-deliver it if it stranded).
+    if (!matches) return false
+  }
   q.pending.delete(key)
   return true
 }
@@ -119,6 +164,43 @@ export function sweep<M>(
   return redeliver
 }
 
+/**
+ * #2787 — the set of chats/topics that currently hold a live permission or
+ * `ask_user` card, against which a swept entry is tested before re-delivery.
+ *
+ *   - `keys`  — full `chatKey(chatId, threadId)` values (topic known). A card
+ *               routed to a specific forum topic suspends re-delivery ONLY for
+ *               that topic; sibling topics in the same supergroup keep flowing.
+ *   - `chats` — bare chatIds (topic unknown — e.g. a permission card fanned to
+ *               the operator DMs records only the chatId). The conservative
+ *               fallback is to suspend the whole chat; that chat is almost never
+ *               a busy multi-topic supergroup, so the global stall is still gone.
+ */
+export interface SuspendedTargets {
+  readonly keys: ReadonlySet<string>
+  readonly chats: ReadonlySet<string>
+}
+
+/**
+ * #2787 Mechanism A — should re-delivery of a stranded inbound on `key` be
+ * suspended because a live permission / `ask_user` card is open for ITS OWN
+ * chat/topic?
+ *
+ * A pending card is a live interaction for its target: re-clearing the composer
+ * and re-sending there would clobber it. But the OLD gateway guard suspended the
+ * ENTIRE confirm sweep whenever ANY card was pending anywhere — so one card
+ * parked in a single topic (or the operator DM, a different chatId) froze
+ * re-delivery of every stranded inbound across EVERY topic until it resolved
+ * (the #1922 all-topics stall). Scoping the check to the card's own target keeps
+ * unrelated topics being re-delivered while the card sits open.
+ */
+export function isRedeliverySuspended(key: string, suspended: SuspendedTargets): boolean {
+  if (suspended.keys.has(key)) return true
+  const idx = key.indexOf(':')
+  const chatId = idx < 0 ? key : key.slice(0, idx)
+  return suspended.chats.has(chatId)
+}
+
 /** Forget a key without acking (e.g. the bridge went offline and the message
  *  was handed back to the offline buffer, which owns it now). */
 export function forgetDelivery<M>(q: DeliveryQueue<M>, key: string): void {

package/telegram-plugin/gateway/inbound-spool.ts

@@ -159,6 +159,21 @@ export interface InboundSpoolOptions {
    *  `escalateAfterMs` here) or back-to-back attempts wouldn't coalesce.
    *  Default 30 min. */
   escalateNoticeCooldownMs?: number
+  /**
+   * #2789 B: fired whenever spool durability changes state — an append
+   * fails (durability has silently degraded to in-memory-only, so a
+   * later crash loses those messages) or recovers. Latches: called once
+   * on the transition into degraded and once on the transition back to
+   * healthy, not on every append. Lets the gateway raise a health
+   * signal instead of quietly continuing as if the durable promise
+   * still held. Best-effort — a throw here never breaks delivery.
+   */
+  onDegraded?: (info: {
+    degraded: boolean
+    consecutiveFailures: number
+    path: string
+    error?: string
+  }) => void
 }
 
 export interface ReplayEntry {
@@ -199,13 +214,25 @@ export interface InboundSpool {
    *  `escalateNoticeCooldownMs` — a burst of undeliverable inbounds (e.g.
    *  a synthetic re-created every 15 min while the agent is down, across
    *  restarts) yields ONE notice, not one per entry. The window is
-   *  persisted, so it holds across a gateway restart. Returns the count
-   *  of entries dropped. Safe to call on a timer. */
+   *  persisted, so it holds across a gateway restart. `droppedCount` is
+   *  the real number of entries dropped for that entry's chat in THIS
+   *  sweep, so the coalesced notice reports the true multi-message loss
+   *  count instead of under-reporting it as one (#2789 C). Returns the
+   *  total count of entries dropped. Safe to call on a timer. */
   sweepEscalations: (
-    onEscalate: (e: ReplayEntry, opts: { postNotice: boolean }) => void,
+    onEscalate: (
+      e: ReplayEntry,
+      opts: { postNotice: boolean; droppedCount: number },
+    ) => void,
   ) => number
   /** Test/observability: count of live (un-acked) ids. */
   liveCount: () => number
+  /** #2789 B: true while spool appends are failing — durability has
+   *  degraded to in-memory-only. A health signal the gateway can surface
+   *  instead of quietly dropping the durability guarantee. */
+  isDegraded: () => boolean
+  /** #2789 B: consecutive append failures since the last success. */
+  appendFailureCount: () => number
 }
 
 export function createInboundSpool(opts: InboundSpoolOptions): InboundSpool {
@@ -227,6 +254,13 @@ export function createInboundSpool(opts: InboundSpoolOptions): InboundSpool {
   // synthetic re-aged into the bound every 15 min across many restarts).
   const escAttemptByChat = new Map<string, number>()
 
+  // #2789 B: append-durability health. `consecutiveAppendFailures`
+  // counts failed appends since the last success; `degraded` latches so
+  // the onDegraded callback fires exactly once per state transition
+  // (into degraded / back to healthy) rather than on every append.
+  let consecutiveAppendFailures = 0
+  let degraded = false
+
   function parseLine(line: string): SpoolRecord | null {
     const s = line.trim()
     if (!s) return null
@@ -288,15 +322,52 @@ export function createInboundSpool(opts: InboundSpoolOptions): InboundSpool {
   function appendRecord(rec: SpoolRecord): void {
     try {
       fs.appendFileSync(path, JSON.stringify(rec) + '\n')
+      // #2789 B: a successful append after a failure run means the spool
+      // is durable again — un-latch degraded state and surface recovery
+      // so the health signal clears.
+      if (consecutiveAppendFailures > 0) {
+        log(
+          `inbound-spool: append recovered path=${path} after ` +
+          `${consecutiveAppendFailures} failure(s) — durability restored\n`,
+        )
+        consecutiveAppendFailures = 0
+        if (degraded) {
+          degraded = false
+          try {
+            opts.onDegraded?.({ degraded: false, consecutiveFailures: 0, path })
+          } catch {
+            /* health signal is best-effort; never break delivery */
+          }
+        }
+      }
     } catch (err) {
       // Durability is best-effort relative to fs availability; a spool
-      // write failure must NOT break live delivery. Log loudly — a
-      // persistently failing spool means we're back to in-memory-only
-      // semantics and the operator should know.
+      // write failure must NOT break live delivery. But it must NOT be
+      // SILENT either (#2789 B) — a persistently failing spool means
+      // we're back to in-memory-only semantics and a later crash loses
+      // the message. Log loudly on every failure AND raise a latched
+      // health signal on the transition into degraded so the operator /
+      // health surface knows the durability guarantee is gone.
+      consecutiveAppendFailures++
+      const message = (err as Error).message
       log(
         `inbound-spool: append FAILED path=${path} id=${rec.id} t=${rec.t}: ` +
-        `${(err as Error).message} — durability degraded to in-memory\n`,
+        `${message} — durability degraded to in-memory ` +
+        `(consecutive failures=${consecutiveAppendFailures})\n`,
       )
+      if (!degraded) {
+        degraded = true
+        try {
+          opts.onDegraded?.({
+            degraded: true,
+            consecutiveFailures: consecutiveAppendFailures,
+            path,
+            error: message,
+          })
+        } catch {
+          /* health signal is best-effort; never break delivery */
+        }
+      }
     }
   }
 
@@ -399,10 +470,25 @@ export function createInboundSpool(opts: InboundSpoolOptions): InboundSpool {
     sweepEscalations(onEscalate) {
       const tNow = now()
       const cutoff = tNow - escalateAfterMs
+      // First pass (#2789 C): identify the entries to drop and count them
+      // per chat so the (coalesced) notice reports the REAL number of
+      // dropped messages instead of under-counting a multi-message drop
+      // as a single one. Iteration order is preserved so the tombstone /
+      // esc append order is unchanged.
+      const toDrop: {
+        id: string
+        e: { agent: string; msg: InboundMessage; firstAt: number }
+      }[] = []
+      const perChatCount = new Map<string, number>()
+      for (const [id, e] of live.entries()) {
+        if (e.firstAt > cutoff) continue
+        toDrop.push({ id, e })
+        const key = escChatKey(e.msg)
+        perChatCount.set(key, (perChatCount.get(key) ?? 0) + 1)
+      }
       let dropped = 0
       let posted = 0
-      for (const [id, e] of [...live.entries()]) {
-        if (e.firstAt > cutoff) continue
+      for (const { id, e } of toDrop) {
         live.delete(id)
         appendRecord({ t: 'ack', id }) // tombstone — promise retracted
         // Coalesce the user-facing notice per chat on a SLIDING window:
@@ -420,7 +506,13 @@ export function createInboundSpool(opts: InboundSpoolOptions): InboundSpool {
           typeof threadRaw === 'string' && threadRaw.length > 0 ? threadRaw : undefined
         appendRecord({ t: 'esc', chat: e.msg.chatId, thread, at: tNow })
         try {
-          onEscalate({ agent: e.agent, msg: e.msg }, { postNotice })
+          // #2789 C: hand the caller the real per-chat drop count for
+          // THIS sweep so the notice it posts can say "N messages" rather
+          // than under-reporting a multi-message drop as a single one.
+          onEscalate(
+            { agent: e.agent, msg: e.msg },
+            { postNotice, droppedCount: perChatCount.get(key) ?? 1 },
+          )
         } catch (err) {
           log(`inbound-spool: onEscalate threw id=${id}: ${(err as Error).message}\n`)
         }
@@ -441,5 +533,11 @@ export function createInboundSpool(opts: InboundSpoolOptions): InboundSpool {
     liveCount() {
       return live.size
     },
+    isDegraded() {
+      return degraded
+    },
+    appendFailureCount() {
+      return consecutiveAppendFailures
+    },
   }
 }

package/telegram-plugin/gateway/model-command.ts

@@ -227,11 +227,30 @@ export async function handleModelCommand(
   }
 
   if (result.outcome === 'ok') {
+    // claude's `/model <name>` switches the session SILENTLY — it does not
+    // print a confirmation line. So `result.output` on this path is almost
+    // always just whatever pane scrollback sat below the command echo (the
+    // agent's previous prose answer). `isTuiChromeLine` strips borders/glyphs
+    // but NOT ordinary prose, so blindly `preBlock`-ing `result.output` here
+    // dumped that unrelated scrollback back to the user as a code block
+    // (screenshot-confirmed on klanker, v0.16.47). Only relay output when it
+    // actually looks like a model-switch acknowledgement; otherwise suppress
+    // it and send a clean confirmation.
+    const confirmation = modelSwitchConfirmationLine(result.output)
+    if (confirmation) {
+      return {
+        text: [
+          `${verbHtml}`,
+          deps.preBlock(confirmation),
+          ...(result.truncated ? ['_truncated_'] : []),
+          PERSIST_NOTE,
+        ].join('\n'),
+        html: true,
+      }
+    }
     return {
       text: [
-        `${verbHtml}`,
-        deps.preBlock(result.output),
-        ...(result.truncated ? ['_truncated_'] : []),
+        `${verbHtml} — switched (session).`,
         PERSIST_NOTE,
       ].join('\n'),
       html: true,
@@ -808,6 +827,35 @@ export function isSrToClaudeTransition(
   return !!prevModel?.startsWith('sr-') && !nextModel.startsWith('sr-')
 }
 
+/**
+ * Return the single line of a pane capture that actually reads as claude's
+ * model-switch acknowledgement ("Set model to X…", "Switched to X", or
+ * "Kept model as X"), or null when no such line is present. Used by the
+ * direct `/model <name>` path to decide whether `result.output` carries a
+ * genuine confirmation worth relaying, versus mere scrollback that must NOT
+ * be echoed back to chat. Mirrors the line-scan already used by the picker
+ * alias/sr-* callback paths.
+ */
+export function modelSwitchConfirmationLine(output: string): string | null {
+  const line = output
+    .split('\n')
+    .map((l) => l.trim())
+    .find((l) => MODEL_SWITCH_CONFIRMATION_PREFIX.test(l))
+  return line && line.length > 0 ? line : null
+}
+
+/**
+ * claude's real model-switch confirmation always begins the line (optionally
+ * behind a status glyph like `⏺` + whitespace) with one of these exact
+ * phrasings. Anchoring to the line start keeps ordinary scrollback prose that
+ * merely *contains* words like "switched" or "set model" (e.g. "I switched the
+ * deploy to blue-green") from false-positiving as a confirmation worth
+ * relaying. Shared by `modelSwitchConfirmationLine` (does this line qualify?)
+ * and `sessionModelFromConfirmation` (pull the name out).
+ */
+const MODEL_SWITCH_CONFIRMATION_PREFIX =
+  /^\s*[⏺●•>-]?\s*(?:Set model to|Switched to|Kept model as)\b/i
+
 /**
  * Pull the model NAME out of claude's session-switch confirmation so it can
  * be shown in `/status` as the live session model. claude phrases it as

package/telegram-plugin/gateway/pending-inbound-buffer.ts

@@ -66,6 +66,19 @@ export interface PendingInboundBufferOptions {
    * than the old silent in-memory drop).
    */
   spool?: InboundSpool
+  /**
+   * Called when the in-memory cap forces an eviction of the OLDEST
+   * entry (#2789 defect A). The evicted message is NOT lost — `push`
+   * still records it durably in the spool (boot-replayed / escalated) —
+   * but within a live session it will not be re-delivered until boot or
+   * escalation, so the eviction must not be SILENT the way it was
+   * before. The caller wires this to a coalesced "N messages deferred"
+   * user-facing notice tied to the spool, turning a silent in-session
+   * drop into a visible deferral (chat-is-the-single-source-of-truth:
+   * surface the loss window, don't hide it). Best-effort: a throw here
+   * never breaks the push hot path.
+   */
+  onEvict?: (agent: string, evicted: InboundMessage) => void
 }
 
 /**
@@ -304,6 +317,19 @@ export function createPendingInboundBuffer(
           `pending-inbound-buffer: agent=${agent} cap=${cap} reached — ` +
           `dropped oldest entry source=${dropped?.meta?.source ?? '-'} ts=${dropped?.ts ?? '-'}\n`,
         )
+        // #2789 A: the cap eviction is no longer a SILENT in-session
+        // drop. `dropped` still lives in the durable spool (it was
+        // spool.put on its own push), so it survives to boot-replay /
+        // escalation — but it won't be re-delivered THIS session. Hand
+        // it to the caller so a coalesced "N messages deferred" notice
+        // can be surfaced. Best-effort: never let the notice break push.
+        if (dropped != null && opts.onEvict != null) {
+          try {
+            opts.onEvict(agent, dropped)
+          } catch {
+            /* user-facing notice is best-effort; never break the hot path */
+          }
+        }
       }
       q.push(msg)
       // Durable record FIRST-class to the in-memory queue: spool BEFORE

package/telegram-plugin/gateway/represent-guard.ts

@@ -14,14 +14,22 @@
  * no Telegram, no SQLite; the gateway injects `hasOutboundDeliveredSince` as a
  * predicate. The single load-bearing subtlety lives here in one testable place:
  *
- *   The cutoff is `lastRepresentedAt` (the time of the PREVIOUS represent), NOT
- *   `openedAt`. On the FIRST represent (`lastRepresentedAt` undefined) the guard
- *   is a no-op, so the genuine "agent wrote a plain-text answer and never called
- *   the reply tool" case still re-presents ONCE. Only the SECOND-and-later
- *   represent is gated — exactly where a reply that landed BETWEEN fires must
- *   suppress the re-ask. A reply that predates the last represent (e.g. the
- *   original plain-text answer) does not count, because it is not evidence the
- *   most recent represent was answered.
+ *   For the SECOND-and-later represent the cutoff is `lastRepresentedAt` (the
+ *   time of the PREVIOUS represent), NOT `openedAt` — exactly where a reply that
+ *   landed BETWEEN fires must suppress the re-ask, while a reply that predates
+ *   the last represent (e.g. the original plain-text answer) does not count,
+ *   because it is not evidence the most recent represent was answered.
+ *
+ *   For the FIRST represent (`lastRepresentedAt` undefined) the cutoff is
+ *   `openedAt` (#2788 Gap B). Previously the first represent was an unconditional
+ *   no-op, leaving a narrow window: if a genuine reply was already delivered
+ *   since the obligation was RAISED but its routing didn't resolve back to the
+ *   origin (so the ledger's normal close path missed it), the first represent
+ *   emitted a false "you never answered". Deduping against outbound history from
+ *   `openedAt` closes that window WITHOUT breaking the genuine "agent wrote a
+ *   plain-text answer and never called the reply tool" case: that case records NO
+ *   outbound row, so `hasOutboundDeliveredSince` reports false and the single
+ *   re-ask still fires.
  */
 
 /** The obligation fields the represent guard inspects. */
@@ -29,6 +37,8 @@ export interface RepresentGuardObligation {
   readonly originTurnId: string
   readonly chatId: string
   readonly threadId?: number
+  /** Wall-clock ms this obligation was RAISED — the FIRST-represent cutoff (#2788). */
+  readonly openedAt?: number
   /** Wall-clock ms this obligation was most recently re-presented, if ever. */
   readonly lastRepresentedAt?: number
 }
@@ -65,8 +75,15 @@ export function shouldSuppressRepresent(
   deps: RepresentGuardDeps,
 ): boolean {
   if (!deps.historyEnabled) return false
-  // First represent: nothing to compare against — let the single re-ask fire so
-  // the genuine plain-text-no-reply case is preserved.
-  if (o.lastRepresentedAt == null) return false
+  // First represent (#2788 Gap B): dedup against outbound history from `openedAt`.
+  // A genuine reply already delivered since the obligation was raised means the
+  // user WAS answered — suppress the false "you never answered". The genuine
+  // plain-text-no-reply case records no outbound row, so the predicate reports
+  // false there and the single re-ask still fires. If `openedAt` is unknown we
+  // cannot dedup safely, so fall back to the prior no-op (never suppress).
+  if (o.lastRepresentedAt == null) {
+    if (o.openedAt == null) return false
+    return deps.hasOutboundDeliveredSince(o.chatId, o.openedAt, o.threadId)
+  }
   return deps.hasOutboundDeliveredSince(o.chatId, o.lastRepresentedAt, o.threadId)
 }