switchroom 0.16.47 → 0.17.1

package/telegram-plugin/gateway/error-envelope-card.ts

@@ -1,64 +0,0 @@
-/**
- * Render a one-tap unlock card for hostd error_envelopes that carry a
- * `flip_yaml_flag` fix (#1758 Phase 1).
- *
- * CRITICAL safety: the `yaml_path` MUST be on the
- * `UNLOCK_CARD_YAML_ALLOWLIST` exported from
- * `src/host-control/config-edit-validator.ts`. A malformed or hostile
- * envelope from any backend could otherwise nudge the operator into
- * one-tap-approving an arbitrary flag flip. Non-allowlisted paths fall
- * back to plain-text rendering (the caller surfaces `resp.error` as
- * today).
- *
- * Phase 1 scope: ONLY `flip_yaml_flag`. `request_vault_grant` is
- * explicitly deferred to a later phase (still plain-text rendered).
- */
-
-import type { HostdResponse } from "../../src/host-control/protocol.js";
-import { isAllowlistedYamlPath } from "../../src/host-control/config-edit-validator.js";
-import {
-  buildApprovalCard,
-  type BuiltApprovalCard,
-} from "./approval-card.js";
-
-export type UnlockCardOutcome =
-  | { kind: "card"; card: BuiltApprovalCard; yaml_path: string; to: unknown }
-  | { kind: "plain-text" };
-
-/**
- * Decide whether to render a one-tap unlock card for the given
- * response. Returns `{kind: "plain-text"}` whenever the envelope
- * lacks a `flip_yaml_flag` fix OR the path isn't on the allowlist.
- *
- * `approvalRequestId` is the 32-hex nonce minted by the approval
- * kernel; caller is responsible for binding the card to that nonce
- * and recording the apply-on-tap intent.
- */
-export function renderErrorEnvelopeCard(
-  resp: HostdResponse,
-  agentName: string,
-  approvalRequestId: string,
-): UnlockCardOutcome {
-  const env = resp.error_envelope;
-  if (!env || !env.fix) return { kind: "plain-text" };
-  if (env.fix.kind !== "flip_yaml_flag") {
-    // request_vault_grant is Phase-2 work; everything else has no
-    // unlock-card UX. Caller falls back to plain-text rendering.
-    return { kind: "plain-text" };
-  }
-  const { yaml_path, to } = env.fix;
-  if (!isAllowlistedYamlPath(yaml_path)) {
-    // Defense-in-depth: never render a one-tap card for a path the
-    // operator hasn't explicitly opted into.
-    return { kind: "plain-text" };
-  }
-  const card = buildApprovalCard({
-    request_id: approvalRequestId,
-    agent: agentName,
-    scope_humanized: `flip ${yaml_path} → ${JSON.stringify(to)}`,
-    why: env.human + (env.why ? ` — ${env.why}` : ""),
-    offer_always: false,
-    offer_ttl: false,
-  });
-  return { kind: "card", card, yaml_path, to };
-}

package/telegram-plugin/gateway/resolve-calling-subagent.ts

@@ -1,78 +0,0 @@
-/**
- * Issue #305 Option A — resolve which sub-agent (by jsonl_agent_id) is
- * calling progress_update.
- *
- * Three resolution strategies, in priority order:
- *   1. agentIdHint — exact match on subagents.jsonl_agent_id
- *   2. toolUseIdHint — exact match on subagents.id (parent's Agent tool_use_id)
- *   3. Heuristic: most-recently-started running sub-agent in the active turn
- *      for this chat. Logs a stderr warning when multiple candidates exist.
- *
- * Returns null if no match (caller falls through to message-send).
- * Never throws; SQL errors return null.
- *
- * Extracted from gateway.ts so the resolver can be unit-tested against an
- * in-memory SQLite DB without spinning up the full grammY bot harness.
- */
-
-/**
- * Minimal duck-typed interface that matches both bun:sqlite's `Database`
- * and the `SqliteDatabase` shape returned by `openTurnsDb`. We accept the
- * narrowed shape so the resolver can run against any equivalent handle.
- */
-export interface ResolverDb {
-  prepare(sql: string): {
-    get(...params: unknown[]): unknown
-    all(...params: unknown[]): unknown[]
-  }
-}
-
-export interface ResolveCallingSubagentOpts {
-  db: ResolverDb | null
-  chatId: string
-  threadId?: number | string
-  agentIdHint: string | null
-  toolUseIdHint: string | null
-}
-
-export type ResolveCallingSubagentResult = { agentId: string } | null
-
-export function resolveCallingSubagent(
-  opts: ResolveCallingSubagentOpts,
-): ResolveCallingSubagentResult {
-  if (opts.db == null) return null
-  try {
-    if (opts.agentIdHint != null) {
-      const row = opts.db.prepare(
-        "SELECT jsonl_agent_id FROM subagents WHERE jsonl_agent_id = ? AND status = 'running'",
-      ).get(opts.agentIdHint) as { jsonl_agent_id: string } | undefined
-      if (row?.jsonl_agent_id) return { agentId: row.jsonl_agent_id }
-    }
-    if (opts.toolUseIdHint != null) {
-      const row = opts.db.prepare(
-        "SELECT jsonl_agent_id FROM subagents WHERE id = ? AND status = 'running'",
-      ).get(opts.toolUseIdHint) as { jsonl_agent_id: string | null } | undefined
-      if (row?.jsonl_agent_id) return { agentId: row.jsonl_agent_id }
-    }
-    // Heuristic fallback.
-    const turnRow = opts.db.prepare(
-      "SELECT turn_key FROM turns WHERE chat_id = ? AND ended_at IS NULL ORDER BY started_at DESC LIMIT 1",
-    ).get(opts.chatId) as { turn_key: string } | undefined
-    if (turnRow?.turn_key == null) return null
-    const candidates = opts.db.prepare(
-      "SELECT jsonl_agent_id FROM subagents WHERE parent_turn_key = ? AND status = 'running' AND jsonl_agent_id IS NOT NULL ORDER BY started_at DESC",
-    ).all(turnRow.turn_key) as Array<{ jsonl_agent_id: string }>
-    if (candidates.length === 0) return null
-    if (candidates.length > 1) {
-      // eslint-disable-next-line no-console
-      console.warn(
-        `progress_update: heuristic resolution selected most-recent of ${candidates.length} running sub-agents (chat=${opts.chatId}); pass agent_id explicitly to avoid mis-attribution`,
-      )
-    }
-    return { agentId: candidates[0].jsonl_agent_id }
-  } catch (err) {
-    // eslint-disable-next-line no-console
-    console.warn('progress_update: resolveCallingSubagent SQL error', err)
-    return null
-  }
-}

package/telegram-plugin/silent-reply.ts

@@ -1,58 +0,0 @@
-/**
- * Silent-reply markers + allowlist guard.
- *
- * Lives in its own module (separate from server.ts) so that tests and
- * other importers can pull these helpers in without booting the
- * full MCP server — server.ts has top-level side effects (env load,
- * TELEGRAM_BOT_TOKEN check, history.db open, session-tail spawn) that
- * are inappropriate for a unit-test import boundary.
- *
- * Sprint1 review finding #6: an earlier revision of the reply /
- * stream_reply tool handlers returned the silent-reply ack BEFORE
- * calling `assertAllowedChat`, so unauthorised chats could bypass the
- * outbound allowlist by having the agent emit `NO_REPLY`. The ack
- * itself is a cross-chat signal (it confirms to the LLM that the chat
- * exists and is reachable) even though no Telegram message is sent, so
- * we must refuse disallowed chats *before* producing it. The
- * guardSilentReply helper locks that ordering in.
- */
-
-const SILENT_REPLY_MARKERS = new Set(['NO_REPLY', 'HEARTBEAT_OK'])
-
-// Derive the char-length bound from the marker set so adding a new
-// marker doesn't silently desync with a hand-tuned constant.
-const SILENT_REPLY_MAX_LEN = Math.max(
-  ...Array.from(SILENT_REPLY_MARKERS, (m) => m.length),
-) + 2 // small buffer for trailing punctuation callers might add accidentally
-
-export function isSilentReplyMarker(text: string | undefined): boolean {
-  if (typeof text !== 'string') return false
-  const trimmed = text.trim()
-  if (trimmed.length === 0) return false
-  if (trimmed.length > SILENT_REPLY_MAX_LEN) return false
-  // Case-insensitive match: models occasionally emit `no_reply` or
-  // `NoReply`. Require letters/underscores/digits only so legitimate
-  // prose that happens to contain "NO_REPLY was suggested" still sends.
-  return SILENT_REPLY_MARKERS.has(trimmed.toUpperCase())
-}
-
-/**
- * Decide whether a `reply`/`stream_reply` invocation should be short-
- * circuited as a silent-reply ack, enforcing the allowlist FIRST.
- *
- * `assertAllowed` throws when `chat_id` is not on the allowlist; callers
- * let that propagate so the MCP tool call fails loudly.
- */
-export function guardSilentReply(params: {
-  chat_id: string
-  text: string | undefined
-  hasFiles: boolean
-  assertAllowed: (chat_id: string) => void
-}): { kind: 'silent'; markerText: string } | { kind: 'continue' } {
-  const { chat_id, text, hasFiles, assertAllowed } = params
-  if (hasFiles) return { kind: 'continue' }
-  if (!isSilentReplyMarker(text)) return { kind: 'continue' }
-  // Allowlist check BEFORE returning the ack — see docblock above.
-  assertAllowed(chat_id)
-  return { kind: 'silent', markerText: (text as string).trim() }
-}

package/telegram-plugin/tests/error-envelope-unlock-card.test.ts

@@ -1,79 +0,0 @@
-/**
- * Telegram bridge unlock-card safety (#1758 Phase 1).
- *
- * The bridge MUST validate `flip_yaml_flag.yaml_path` against the
- * config-edit-validator allowlist before rendering a one-tap approval
- * card. A malformed or hostile envelope from any backend could
- * otherwise nudge the operator into approving an arbitrary flag flip.
- */
-
-import { describe, it, expect } from "vitest";
-import { renderErrorEnvelopeCard } from "../gateway/error-envelope-card.js";
-import type { HostdResponse } from "../../src/host-control/protocol.js";
-
-function mkResp(fix: HostdResponse["error_envelope"]["fix"]): HostdResponse {
-  return {
-    v: 1,
-    request_id: "r-1",
-    result: "error",
-    exit_code: null,
-    duration_ms: 0,
-    error: "E_FOO: foo",
-    error_envelope: {
-      v: 1,
-      code: "E_FOO",
-      human: "foo",
-      fix,
-      request_id: "r-1",
-    },
-  } as HostdResponse;
-}
-
-describe("renderErrorEnvelopeCard — allowlist guard", () => {
-  it("renders an approval card for an allowlisted yaml_path", () => {
-    const resp = mkResp({
-      kind: "flip_yaml_flag",
-      yaml_path: "hostd.config_edit_enabled",
-      to: true,
-    });
-    const out = renderErrorEnvelopeCard(resp, "klanker", "a".repeat(32));
-    expect(out.kind).toBe("card");
-    if (out.kind === "card") {
-      expect(out.yaml_path).toBe("hostd.config_edit_enabled");
-      expect(out.to).toBe(true);
-      expect(out.card.text).toContain("klanker");
-    }
-  });
-
-  it("falls back to plain-text for a NON-allowlisted yaml_path", () => {
-    const resp = mkResp({
-      kind: "flip_yaml_flag",
-      yaml_path: "hostd.evil_backdoor_flag",
-      to: true,
-    });
-    const out = renderErrorEnvelopeCard(resp, "klanker", "a".repeat(32));
-    expect(out).toEqual({ kind: "plain-text" });
-  });
-
-  it("falls back to plain-text for request_vault_grant (Phase 2 scope)", () => {
-    const resp = mkResp({
-      kind: "request_vault_grant",
-      vault_key: "openai/api-key",
-    });
-    const out = renderErrorEnvelopeCard(resp, "klanker", "a".repeat(32));
-    expect(out).toEqual({ kind: "plain-text" });
-  });
-
-  it("falls back to plain-text when no envelope is present", () => {
-    const resp: HostdResponse = {
-      v: 1,
-      request_id: "r-1",
-      result: "error",
-      exit_code: null,
-      duration_ms: 0,
-      error: "legacy string",
-    };
-    const out = renderErrorEnvelopeCard(resp, "klanker", "a".repeat(32));
-    expect(out).toEqual({ kind: "plain-text" });
-  });
-});

package/telegram-plugin/tests/resolve-calling-subagent.test.ts

@@ -1,269 +0,0 @@
-/**
- * Unit tests for resolveCallingSubagent (issue #305 Option A).
- *
- * The resolver picks which sub-agent's row body should host the
- * progress_update narrative when called from a sub-agent context.
- * Resolution priority:
- *   1. agentIdHint  → exact match on subagents.jsonl_agent_id
- *   2. toolUseIdHint → exact match on subagents.id
- *   3. Heuristic   → most-recently-started running sub-agent in the active turn
- *
- * Tests run against an in-memory bun:sqlite DB with the same schema that
- * production uses (turns + subagents tables). Run via:
- *   bun test telegram-plugin/tests/resolve-calling-subagent.test.ts
- */
-
-import { describe, it, expect, beforeEach, afterEach } from 'bun:test'
-import {
-  openSubagentsDbInMemory,
-  recordSubagentStart,
-} from '../registry/subagents-schema.js'
-import { resolveCallingSubagent } from '../gateway/resolve-calling-subagent.js'
-
-type Db = ReturnType<typeof openSubagentsDbInMemory>
-
-function insertOpenTurn(db: Db, turnKey: string, chatId: string, startedAt: number): void {
-  db.prepare(`
-    INSERT INTO turns
-      (turn_key, chat_id, thread_id, started_at, last_user_msg_id, created_at, updated_at)
-    VALUES (?, ?, ?, ?, ?, ?, ?)
-  `).run(turnKey, chatId, null, startedAt, 'msg-1', startedAt, startedAt)
-}
-
-describe('resolveCallingSubagent', () => {
-  let db: Db
-
-  beforeEach(() => {
-    db = openSubagentsDbInMemory()
-  })
-
-  afterEach(() => {
-    db.close()
-  })
-
-  it('returns null when db is null', () => {
-    const result = resolveCallingSubagent({
-      db: null,
-      chatId: 'c1',
-      agentIdHint: 'jsonl-1',
-      toolUseIdHint: null,
-    })
-    expect(result).toBeNull()
-  })
-
-  it('matches by agentIdHint (jsonl_agent_id)', () => {
-    insertOpenTurn(db, 'c1:1', 'c1', 1000)
-    recordSubagentStart(db, {
-      id: 'toolu_alpha',
-      parentTurnKey: 'c1:1',
-      jsonlAgentId: 'jsonl-alpha',
-      background: false,
-      startedAt: 1100,
-    })
-    recordSubagentStart(db, {
-      id: 'toolu_beta',
-      parentTurnKey: 'c1:1',
-      jsonlAgentId: 'jsonl-beta',
-      background: false,
-      startedAt: 1200,
-    })
-
-    const result = resolveCallingSubagent({
-      db,
-      chatId: 'c1',
-      agentIdHint: 'jsonl-alpha',
-      toolUseIdHint: null,
-    })
-    expect(result).toEqual({ agentId: 'jsonl-alpha' })
-  })
-
-  it('agentIdHint miss on completed sub-agent does NOT match (only running rows)', () => {
-    insertOpenTurn(db, 'c1:1', 'c1', 1000)
-    recordSubagentStart(db, {
-      id: 'toolu_done',
-      parentTurnKey: 'c1:1',
-      jsonlAgentId: 'jsonl-done',
-      background: false,
-      startedAt: 1100,
-    })
-    // Mark as completed via direct SQL.
-    db.prepare("UPDATE subagents SET status = 'completed', ended_at = 2000 WHERE id = ?")
-      .run('toolu_done')
-
-    const result = resolveCallingSubagent({
-      db,
-      chatId: 'c1',
-      agentIdHint: 'jsonl-done',
-      toolUseIdHint: null,
-    })
-    expect(result).toBeNull()
-  })
-
-  it('matches by toolUseIdHint (subagents.id) when agentIdHint absent', () => {
-    insertOpenTurn(db, 'c1:1', 'c1', 1000)
-    recordSubagentStart(db, {
-      id: 'toolu_via_id',
-      parentTurnKey: 'c1:1',
-      jsonlAgentId: 'jsonl-via-id',
-      background: false,
-      startedAt: 1100,
-    })
-
-    const result = resolveCallingSubagent({
-      db,
-      chatId: 'c1',
-      agentIdHint: null,
-      toolUseIdHint: 'toolu_via_id',
-    })
-    expect(result).toEqual({ agentId: 'jsonl-via-id' })
-  })
-
-  it('heuristic fallback: returns most-recently-started running sub-agent in active turn', () => {
-    insertOpenTurn(db, 'c1:1', 'c1', 1000)
-    recordSubagentStart(db, {
-      id: 'toolu_old',
-      parentTurnKey: 'c1:1',
-      jsonlAgentId: 'jsonl-old',
-      background: false,
-      startedAt: 1100,
-    })
-    recordSubagentStart(db, {
-      id: 'toolu_new',
-      parentTurnKey: 'c1:1',
-      jsonlAgentId: 'jsonl-new',
-      background: false,
-      startedAt: 1500, // strictly newer
-    })
-
-    const result = resolveCallingSubagent({
-      db,
-      chatId: 'c1',
-      agentIdHint: null,
-      toolUseIdHint: null,
-    })
-    expect(result).toEqual({ agentId: 'jsonl-new' })
-  })
-
-  it('heuristic skips sub-agents without jsonl_agent_id', () => {
-    insertOpenTurn(db, 'c1:1', 'c1', 1000)
-    recordSubagentStart(db, {
-      id: 'toolu_nojson',
-      parentTurnKey: 'c1:1',
-      jsonlAgentId: null,
-      background: false,
-      startedAt: 1500,
-    })
-    recordSubagentStart(db, {
-      id: 'toolu_withjson',
-      parentTurnKey: 'c1:1',
-      jsonlAgentId: 'jsonl-resolved',
-      background: false,
-      startedAt: 1100,
-    })
-
-    const result = resolveCallingSubagent({
-      db,
-      chatId: 'c1',
-      agentIdHint: null,
-      toolUseIdHint: null,
-    })
-    expect(result).toEqual({ agentId: 'jsonl-resolved' })
-  })
-
-  it('heuristic returns null when no active turn exists', () => {
-    // Insert an ENDED turn.
-    db.prepare(`
-      INSERT INTO turns
-        (turn_key, chat_id, thread_id, started_at, ended_at, last_user_msg_id, created_at, updated_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?)
-    `).run('c1:1', 'c1', null, 1000, 2000, 'msg-1', 1000, 2000)
-    recordSubagentStart(db, {
-      id: 'toolu_orphan',
-      parentTurnKey: 'c1:1',
-      jsonlAgentId: 'jsonl-orphan',
-      background: false,
-      startedAt: 1100,
-    })
-
-    const result = resolveCallingSubagent({
-      db,
-      chatId: 'c1',
-      agentIdHint: null,
-      toolUseIdHint: null,
-    })
-    expect(result).toBeNull()
-  })
-
-  it('heuristic returns null when no running sub-agents in active turn', () => {
-    insertOpenTurn(db, 'c1:1', 'c1', 1000)
-    // No sub-agents inserted.
-    const result = resolveCallingSubagent({
-      db,
-      chatId: 'c1',
-      agentIdHint: null,
-      toolUseIdHint: null,
-    })
-    expect(result).toBeNull()
-  })
-
-  it('heuristic ignores sub-agents from a different chat', () => {
-    insertOpenTurn(db, 'c1:1', 'c1', 1000)
-    insertOpenTurn(db, 'c2:1', 'c2', 1000)
-    recordSubagentStart(db, {
-      id: 'toolu_other',
-      parentTurnKey: 'c2:1',
-      jsonlAgentId: 'jsonl-other-chat',
-      background: false,
-      startedAt: 1100,
-    })
-
-    const result = resolveCallingSubagent({
-      db,
-      chatId: 'c1',
-      agentIdHint: null,
-      toolUseIdHint: null,
-    })
-    expect(result).toBeNull()
-  })
-
-  it('agentIdHint takes priority over toolUseIdHint and heuristic', () => {
-    insertOpenTurn(db, 'c1:1', 'c1', 1000)
-    recordSubagentStart(db, {
-      id: 'toolu_priority',
-      parentTurnKey: 'c1:1',
-      jsonlAgentId: 'jsonl-priority',
-      background: false,
-      startedAt: 1100,
-    })
-    recordSubagentStart(db, {
-      id: 'toolu_other',
-      parentTurnKey: 'c1:1',
-      jsonlAgentId: 'jsonl-other',
-      background: false,
-      startedAt: 1500, // newer; would win heuristic
-    })
-
-    const result = resolveCallingSubagent({
-      db,
-      chatId: 'c1',
-      agentIdHint: 'jsonl-priority',
-      toolUseIdHint: 'toolu_other',
-    })
-    expect(result).toEqual({ agentId: 'jsonl-priority' })
-  })
-
-  it('returns null on SQL error (broken db.prepare)', () => {
-    const brokenDb = {
-      prepare: (): never => {
-        throw new Error('boom')
-      },
-    }
-    const result = resolveCallingSubagent({
-      db: brokenDb as unknown as Parameters<typeof resolveCallingSubagent>[0]['db'],
-      chatId: 'c1',
-      agentIdHint: 'whatever',
-      toolUseIdHint: null,
-    })
-    expect(result).toBeNull()
-  })
-})

package/telegram-plugin/tests/silent-reply-guard.test.ts

@@ -1,122 +0,0 @@
-import { describe, expect, it, vi } from 'vitest'
-
-// Import directly from the helper module (not server.js), so this test
-// doesn't boot the full MCP server — server.ts has top-level side
-// effects (env load, TELEGRAM_BOT_TOKEN check, session-tail spawn) that
-// kill the test process when run under bun-test without a real env.
-import { guardSilentReply, isSilentReplyMarker } from '../silent-reply.js'
-
-/**
- * Regression coverage for sprint1 review finding #6: the reply /
- * stream_reply tool handlers must call `assertAllowedChat(chat_id)`
- * BEFORE returning the silent-reply ack, so an unauthorised chat
- * cannot bypass the outbound allowlist by having the agent emit
- * `NO_REPLY` / `HEARTBEAT_OK`.
- *
- * We exercise the extracted `guardSilentReply` helper directly rather
- * than the full MCP tool handler; the handler scaffolding (IPC + Bot
- * harness + history DB) is heavy, and the ordering contract — "assert
- * first, then ack" — lives entirely inside the helper.
- */
-describe('guardSilentReply — allowlist ordering', () => {
-  it('asserts the allowlist BEFORE returning a silent ack (NO_REPLY)', () => {
-    const assertAllowed = vi.fn()
-    const result = guardSilentReply({
-      chat_id: '123',
-      text: 'NO_REPLY',
-      hasFiles: false,
-      assertAllowed,
-    })
-    expect(assertAllowed).toHaveBeenCalledOnce()
-    expect(assertAllowed).toHaveBeenCalledWith('123')
-    expect(result).toEqual({ kind: 'silent', markerText: 'NO_REPLY' })
-  })
-
-  it('recognises HEARTBEAT_OK as a silent marker and still gates on allowlist', () => {
-    const assertAllowed = vi.fn()
-    const result = guardSilentReply({
-      chat_id: '456',
-      text: '  heartbeat_ok  ',
-      hasFiles: false,
-      assertAllowed,
-    })
-    expect(assertAllowed).toHaveBeenCalledWith('456')
-    expect(result).toEqual({ kind: 'silent', markerText: 'heartbeat_ok' })
-  })
-
-  it('throws (does NOT return a silent ack) when the chat is disallowed', () => {
-    // This is the exact bypass the fix prevents: an unauthorised chat_id
-    // using NO_REPLY must NOT receive a successful silent-reply ack.
-    const assertAllowed = vi.fn((chat_id: string) => {
-      throw new Error(`chat ${chat_id} is not allowlisted`)
-    })
-    expect(() =>
-      guardSilentReply({
-        chat_id: '999',
-        text: 'NO_REPLY',
-        hasFiles: false,
-        assertAllowed,
-      }),
-    ).toThrow(/not allowlisted/)
-    expect(assertAllowed).toHaveBeenCalledOnce()
-  })
-
-  it('does not short-circuit (or call assertAllowed) when files are attached', () => {
-    // Silent-reply semantics are text-only; a NO_REPLY payload with files
-    // is a real send and must flow through the normal allowlist path
-    // inside the send codepath, not the silent short-circuit.
-    const assertAllowed = vi.fn()
-    const result = guardSilentReply({
-      chat_id: '123',
-      text: 'NO_REPLY',
-      hasFiles: true,
-      assertAllowed,
-    })
-    expect(assertAllowed).not.toHaveBeenCalled()
-    expect(result).toEqual({ kind: 'continue' })
-  })
-
-  it('does not short-circuit for normal prose that merely mentions the marker', () => {
-    const assertAllowed = vi.fn()
-    const result = guardSilentReply({
-      chat_id: '123',
-      text: 'the agent suggested NO_REPLY earlier',
-      hasFiles: false,
-      assertAllowed,
-    })
-    expect(assertAllowed).not.toHaveBeenCalled()
-    expect(result).toEqual({ kind: 'continue' })
-  })
-
-  it('does not short-circuit on undefined/empty text', () => {
-    const assertAllowed = vi.fn()
-    expect(
-      guardSilentReply({
-        chat_id: '123',
-        text: undefined,
-        hasFiles: false,
-        assertAllowed,
-      }),
-    ).toEqual({ kind: 'continue' })
-    expect(
-      guardSilentReply({
-        chat_id: '123',
-        text: '',
-        hasFiles: false,
-        assertAllowed,
-      }),
-    ).toEqual({ kind: 'continue' })
-    expect(assertAllowed).not.toHaveBeenCalled()
-  })
-
-  // Sanity: the helper the guard delegates to is exported for direct
-  // marker-recognition testing. Keep a thin smoke assertion so future
-  // marker-set tweaks break here rather than at the ordering layer.
-  it('isSilentReplyMarker recognises the documented marker set', () => {
-    expect(isSilentReplyMarker('NO_REPLY')).toBe(true)
-    expect(isSilentReplyMarker('HEARTBEAT_OK')).toBe(true)
-    expect(isSilentReplyMarker('no_reply')).toBe(true)
-    expect(isSilentReplyMarker('hello')).toBe(false)
-    expect(isSilentReplyMarker(undefined)).toBe(false)
-  })
-})