switchroom 0.17.6 → 0.18.3

package/telegram-plugin/tests/scoped-grant-persist.test.ts

@@ -0,0 +1,223 @@
+/**
+ * Tests for the persistence of the 30-min scoped-approval windows across
+ * gateway restarts (#2863). The store (scopedGrants) is in-memory and used
+ * to evaporate on any gateway bounce, re-carding an action the operator
+ * allowed minutes ago. These pin:
+ *
+ *   - round-trip: record → persist → reload → lookup still hits in-window;
+ *   - entries already past their ABSOLUTE expiry are dropped at reload;
+ *   - a restart NEVER extends a window (grant at T, reload at T+29min →
+ *     ~1 min left, not a fresh 30);
+ *   - fail-closed survives a reload (a destructive Bash command still
+ *     re-cards even when a reloaded family grant matches; an expired grant
+ *     never matches);
+ *   - kill switch (SWITCHROOM_SCOPED_GRANT_PERSIST=0): no writes, boot
+ *     ignores any pre-existing file.
+ *
+ * The persistence I/O (createScopedGrantStore) is thin; the invariants live
+ * in the pure serialize/deserialize + lookup, so we drive both together with
+ * an isolated tmpdir (never ~/.switchroom or a shared STATE_DIR).
+ */
+
+import { describe, it, expect, beforeEach, afterEach } from 'vitest'
+import { mkdtempSync, rmSync, readFileSync, writeFileSync, existsSync, statSync } from 'node:fs'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import {
+  SCOPED_APPROVAL_DEFAULT_TTL_MS,
+  recordScopedGrant,
+  lookupScopedGrant,
+  sweepScopedGrants,
+  serializeScopedGrants,
+  deserializeScopedGrants,
+  countScopedGrants,
+  type ScopedGrantStore,
+} from '../scoped-approval.js'
+import { createScopedGrantStore, scopedGrantPersistEnabled } from '../gateway/scoped-grant-store.js'
+
+const T0 = 1_000_000
+const TTL = SCOPED_APPROVAL_DEFAULT_TTL_MS
+const AGENT = 'marko'
+
+const editInput = (path: string) => JSON.stringify({ file_path: path })
+const bashInput = (command: string) => JSON.stringify({ command })
+
+function makeTmpDir() {
+  return mkdtempSync(join(tmpdir(), 'scoped-grant-persist-test-'))
+}
+
+function filePath(dir: string) {
+  return join(dir, 'scoped-grants.json')
+}
+
+describe('scoped-grant persistence', () => {
+  let dir: string
+
+  beforeEach(() => {
+    dir = makeTmpDir()
+  })
+  afterEach(() => {
+    rmSync(dir, { recursive: true, force: true })
+  })
+
+  it('round-trips: record → persist → reload → lookup hits within the window', () => {
+    const store = createScopedGrantStore(dir, {})
+    expect(store.enabled).toBe(true)
+
+    // Operator taps Allow on a narrow file edit at T0.
+    const live: ScopedGrantStore = new Map()
+    recordScopedGrant(live, AGENT, 'Edit(/state/x.ts)', T0, TTL)
+    store.save(live)
+
+    expect(existsSync(filePath(dir))).toBe(true)
+
+    // Gateway restarts 5 minutes later; reload the store.
+    const reloadAt = T0 + 5 * 60_000
+    const reloaded = store.load(reloadAt)
+
+    // The window is still live → an identical action auto-allows (no re-card).
+    const hit = lookupScopedGrant(reloaded, AGENT, 'Edit', editInput('/state/x.ts'), reloadAt)
+    expect(hit).toBe('Edit(/state/x.ts)')
+  })
+
+  it('drops entries already past their absolute expiry at reload', () => {
+    const store = createScopedGrantStore(dir, {})
+    const live: ScopedGrantStore = new Map()
+    recordScopedGrant(live, AGENT, 'Edit(/state/x.ts)', T0, TTL)
+    store.save(live)
+
+    // Reload well after the 30-min window has elapsed.
+    const reloadAt = T0 + TTL + 60_000
+    const reloaded = store.load(reloadAt)
+
+    expect(countScopedGrants(reloaded)).toBe(0)
+    const hit = lookupScopedGrant(reloaded, AGENT, 'Edit', editInput('/state/x.ts'), reloadAt)
+    expect(hit).toBeNull()
+  })
+
+  it('a restart does NOT extend the window (absolute expiry preserved)', () => {
+    const store = createScopedGrantStore(dir, {})
+    const live: ScopedGrantStore = new Map()
+    recordScopedGrant(live, AGENT, 'Edit(/state/x.ts)', T0, TTL) // expiresAt = T0 + 30min
+    store.save(live)
+
+    // Reload at T0 + 29 min: only ~1 min should remain, not a fresh 30.
+    const reloadAt = T0 + 29 * 60_000
+    const reloaded = store.load(reloadAt)
+
+    // Still live one minute before expiry...
+    expect(lookupScopedGrant(reloaded, AGENT, 'Edit', editInput('/state/x.ts'), reloadAt)).toBe(
+      'Edit(/state/x.ts)',
+    )
+    // ...but dead ~90s later — the original absolute expiry is honoured, the
+    // reload gave it no new lease.
+    const afterOriginalExpiry = T0 + TTL + 1_000
+    expect(
+      lookupScopedGrant(reloaded, AGENT, 'Edit', editInput('/state/x.ts'), afterOriginalExpiry),
+    ).toBeNull()
+  })
+
+  it('fail-closed survives reload: destructive Bash never auto-allows', () => {
+    const store = createScopedGrantStore(dir, {})
+    const live: ScopedGrantStore = new Map()
+    // A benign `git status` earned a Bash(git:*) family window.
+    recordScopedGrant(live, AGENT, 'Bash(git:*)', T0, TTL)
+    store.save(live)
+
+    const reloadAt = T0 + 60_000
+    const reloaded = store.load(reloadAt)
+
+    // Benign member still auto-allows.
+    expect(lookupScopedGrant(reloaded, AGENT, 'Bash', bashInput('git status'), reloadAt)).toBe(
+      'Bash(git:*)',
+    )
+    // Destructive member of the SAME family fails closed after reload.
+    expect(
+      lookupScopedGrant(reloaded, AGENT, 'Bash', bashInput('git push --force'), reloadAt),
+    ).toBeNull()
+    expect(
+      lookupScopedGrant(reloaded, AGENT, 'Bash', bashInput('git reset --hard'), reloadAt),
+    ).toBeNull()
+  })
+
+  it('sweep-expiry removal is written through and a reload cannot resurrect it', () => {
+    const store = createScopedGrantStore(dir, {})
+    const live: ScopedGrantStore = new Map()
+    recordScopedGrant(live, AGENT, 'Edit(/state/x.ts)', T0, TTL)
+    store.save(live)
+
+    // Periodic sweep runs past expiry and removes the entry; write it through.
+    const sweepAt = T0 + TTL + 1_000
+    sweepScopedGrants(live, sweepAt)
+    store.save(live)
+
+    // A restart immediately after must see an empty store.
+    const reloaded = store.load(sweepAt + 1)
+    expect(countScopedGrants(reloaded)).toBe(0)
+  })
+
+  it('kill switch: no writes, and boot ignores a pre-existing file', () => {
+    // Seed a live grant on disk as if a prior (persist-enabled) boot wrote it.
+    const seeded = createScopedGrantStore(dir, {})
+    const live: ScopedGrantStore = new Map()
+    recordScopedGrant(live, AGENT, 'Edit(/state/x.ts)', T0, TTL)
+    seeded.save(live)
+    const onDiskBefore = readFileSync(filePath(dir), 'utf-8')
+
+    // Now boot with the kill switch on.
+    const killed = createScopedGrantStore(dir, { SWITCHROOM_SCOPED_GRANT_PERSIST: '0' })
+    expect(killed.enabled).toBe(false)
+    expect(scopedGrantPersistEnabled({ SWITCHROOM_SCOPED_GRANT_PERSIST: '0' })).toBe(false)
+
+    // Boot ignores the pre-existing file → empty store.
+    const reloaded = killed.load(T0 + 60_000)
+    expect(countScopedGrants(reloaded)).toBe(0)
+
+    // save() is a no-op — the file is not touched.
+    const grantsToPersist: ScopedGrantStore = new Map()
+    recordScopedGrant(grantsToPersist, AGENT, 'Edit(/state/y.ts)', T0, TTL)
+    killed.save(grantsToPersist)
+    expect(readFileSync(filePath(dir), 'utf-8')).toBe(onDiskBefore)
+  })
+
+  it('pure serialize/deserialize drops malformed and expired rows (fail-closed)', () => {
+    const now = T0
+    const raw = [
+      { agent: AGENT, rule: 'Edit(/state/live.ts)', expiresAt: now + TTL }, // keep
+      { agent: AGENT, rule: 'Edit(/state/gone.ts)', expiresAt: now - 1 }, // expired → drop
+      { agent: AGENT, rule: 'Edit(/state/x.ts)' }, // no expiresAt → drop
+      { rule: 'Edit(/state/x.ts)', expiresAt: now + TTL }, // no agent → drop
+      { agent: AGENT, rule: '', expiresAt: now + TTL }, // empty rule → drop
+      'garbage', // not an object → drop
+      null, // → drop
+    ]
+    const store = deserializeScopedGrants(raw, now)
+    expect(countScopedGrants(store)).toBe(1)
+    expect(lookupScopedGrant(store, AGENT, 'Edit', editInput('/state/live.ts'), now)).toBe(
+      'Edit(/state/live.ts)',
+    )
+  })
+
+  it('serialize captures absolute expiry, not a relative TTL', () => {
+    const live: ScopedGrantStore = new Map()
+    recordScopedGrant(live, AGENT, 'Edit(/state/x.ts)', T0, TTL)
+    const flat = serializeScopedGrants(live)
+    expect(flat).toEqual([{ agent: AGENT, rule: 'Edit(/state/x.ts)', expiresAt: T0 + TTL }])
+  })
+
+  it('corrupt on-disk JSON reloads as an empty store (fail-closed, no throw)', () => {
+    writeFileSync(filePath(dir), '{ this is not json', 'utf-8')
+    const store = createScopedGrantStore(dir, {})
+    const reloaded = store.load(T0)
+    expect(countScopedGrants(reloaded)).toBe(0)
+  })
+
+  it('persisted file is written with mode 0o600', () => {
+    const store = createScopedGrantStore(dir, {})
+    const live: ScopedGrantStore = new Map()
+    recordScopedGrant(live, AGENT, 'Edit(/state/x.ts)', T0, TTL)
+    store.save(live)
+    const mode = statSync(filePath(dir)).mode & 0o777
+    expect(mode).toBe(0o600)
+  })
+})

package/telegram-plugin/tests/silent-end-transport.test.ts

@@ -0,0 +1,290 @@
+/**
+ * silent-end-transport.test.ts — PR 2 of
+ * reference/rfcs/deterministic-turn-liveness.md (Phase 2: audit-and-harden
+ * the shipped dark-turn guard, per reference/jobs/know-what-my-agent-is-doing.md).
+ *
+ * Prior coverage (`silent-end.test.ts`, `silent-end-integration.test.ts`)
+ * proves the *decision* — state-file lifecycle, retryCount bookkeeping,
+ * the `{exhausted}` contract. It never asserts a byte reaches the
+ * transport, which is exactly the decision-vs-delivery gap the RFC calls
+ * out for the muted 45s floor (#2667) and asks Phase 2 to wall off for
+ * the dark-turn guard instead of re-creating it.
+ *
+ * This file reproduces the EXACT call sequence at the gateway's turn_end
+ * handler (gateway.ts ~14486-14535: `if (turn.finalAnswerDelivered ===
+ * false) { const silentEnd = recordUndeliveredTurnEnd(...); if
+ * (silentEnd.exhausted) { <send> } }`) against a spy transport standing in
+ * for `bot.api.sendMessage`, using the REAL exported
+ * `recordUndeliveredTurnEnd` / `silentEndFallbackText` /
+ * `isFinalAnswerReply` — same pattern `silent-end-integration.test.ts`
+ * already established for testing gateway call-sites that aren't
+ * themselves exported (gateway.ts is a multi-thousand-line module with
+ * process-level side effects on import; see that file's "KNOWN GAP" note).
+ * The spy asserts the SEND CALL is made (outcome, not a stubbed decision
+ * callback); it does not drive grammY itself — that last hop stays covered
+ * by the UAT harness.
+ */
+import { describe, it, expect, beforeEach, afterEach } from 'vitest'
+import { mkdtempSync, rmSync, writeFileSync as writeFileSyncState } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import {
+  writeSilentEndState,
+  readSilentEndState,
+  recordUndeliveredTurnEnd,
+  silentEndFallbackText,
+  SILENT_END_MAX_RETRIES,
+  type SilentEndDeps,
+} from '../silent-end.js'
+import { isFinalAnswerReply } from '../final-answer-detect.js'
+
+let stateDir: string
+const ORIG_ENV = process.env.TELEGRAM_STATE_DIR
+
+beforeEach(() => {
+  stateDir = mkdtempSync(join(tmpdir(), 'silent-end-transport-test-'))
+  process.env.TELEGRAM_STATE_DIR = stateDir
+})
+
+afterEach(() => {
+  rmSync(stateDir, { recursive: true, force: true })
+  if (ORIG_ENV != null) process.env.TELEGRAM_STATE_DIR = ORIG_ENV
+  else delete process.env.TELEGRAM_STATE_DIR
+})
+
+/** Spy transport — records every "send" with a wall-clock timestamp, the
+ * same shape a `bot.api.sendMessage` spy would capture at the real
+ * transport boundary. */
+interface SentMessage {
+  chatId: string
+  text: string
+  ts: number
+}
+
+function makeTransport() {
+  const sent: SentMessage[] = []
+  return {
+    sent,
+    send: (chatId: string, text: string) => {
+      sent.push({ chatId, text, ts: Date.now() })
+    },
+  }
+}
+
+/**
+ * Faithful reproduction of the gateway's turn_end branch
+ * (gateway.ts ~14486-14535). Real functions in, spy transport out —
+ * including the REAL `silentEndFallbackText` (exported from
+ * silent-end.ts so the assertions below validate the shipped copy,
+ * not a hand-maintained duplicate).
+ */
+function simulateTurnEnd(
+  args: {
+    chatId: string
+    threadId: number | null
+    turnKey: string
+    finalAnswerDelivered: boolean
+    turnDurationMs: number
+  },
+  transport: ReturnType<typeof makeTransport>,
+  deps?: SilentEndDeps,
+): { exhausted: boolean } | null {
+  if (args.finalAnswerDelivered === false) {
+    const silentEnd = recordUndeliveredTurnEnd(
+      { chatId: args.chatId, threadId: args.threadId, turnKey: args.turnKey },
+      deps,
+    )
+    if (silentEnd.exhausted) {
+      transport.send(args.chatId, silentEndFallbackText(args.turnDurationMs))
+    }
+    return silentEnd
+  }
+  return null
+}
+
+/** Drives the Stop-hook re-prompt ladder up to (but not past) MAX_RETRIES,
+ * exactly as `silent-end-interrupt-stop.mjs` does on each block. */
+function driveRetryLadderToMax(turnKey: string) {
+  const path = join(stateDir, 'silent-end-pending.json')
+  const s = readSilentEndState()!
+  writeFileSyncState(path, JSON.stringify({ ...s, retryCount: SILENT_END_MAX_RETRIES, turnKey }), 'utf8')
+}
+
+describe('silent-end dark-turn guard — transport-boundary outcome tests (RFC Phase 2)', () => {
+  it('(a) full dark turn: exactly one fallback message lands on the real surface', () => {
+    const transport = makeTransport()
+    const turnKey = 'c:_'
+
+    // First dark turn-end — writes state, does NOT deliver a fallback
+    // (the Stop-hook re-prompt ladder hasn't been exhausted yet).
+    simulateTurnEnd(
+      { chatId: 'c', threadId: null, turnKey, finalAnswerDelivered: false, turnDurationMs: 12_000 },
+      transport,
+    )
+    expect(transport.sent).toHaveLength(0)
+
+    // Stop hook re-prompts twice (SILENT_END_MAX_RETRIES), agent stays
+    // silent both times — ladder exhausted.
+    driveRetryLadderToMax(turnKey)
+
+    // Re-prompted turn ends dark again — budget spent, deliver fallback.
+    simulateTurnEnd(
+      { chatId: 'c', threadId: null, turnKey, finalAnswerDelivered: false, turnDurationMs: 47_000 },
+      transport,
+    )
+
+    expect(transport.sent).toHaveLength(1)
+    expect(transport.sent[0]!.chatId).toBe('c')
+    expect(transport.sent[0]!.text).toContain('waited 47s')
+    expect(transport.sent[0]!.text).toContain('didn’t send a reply')
+    // Once delivered, the state must not linger to double-fire on a
+    // subsequent, unrelated dark turn on the same chat/thread.
+    expect(readSilentEndState()).toBeNull()
+  })
+
+  it('(b) deliberate silent end (NO_REPLY / HEARTBEAT_OK) never fires the guard', () => {
+    // The gateway sets `turn.finalAnswerDelivered = true` for NO_REPLY /
+    // HEARTBEAT_OK silent markers BEFORE reaching this branch
+    // (gateway.ts ~14192, ~13880, ~10762 — the sentinel-suppression
+    // sites) — so the branch is never entered at all for a legitimately
+    // silent turn. Reproduce that gate here.
+    const transport = makeTransport()
+    simulateTurnEnd(
+      { chatId: 'c', threadId: null, turnKey: 'c:_', finalAnswerDelivered: true, turnDurationMs: 5_000 },
+      transport,
+    )
+    expect(transport.sent).toHaveLength(0)
+    expect(readSilentEndState()).toBeNull()
+  })
+
+  it('(c) normal replied turn: zero fallback messages, regardless of prior stale state', () => {
+    const transport = makeTransport()
+    // A prior turn on this chat/thread already reached exhaustion and
+    // was cleared (see test (a)) — simulate a completely normal turn
+    // afterwards; the branch must not even be entered.
+    simulateTurnEnd(
+      { chatId: 'c', threadId: null, turnKey: 'c:_', finalAnswerDelivered: true, turnDurationMs: 3_000 },
+      transport,
+    )
+    expect(transport.sent).toHaveLength(0)
+  })
+
+  it('(d) the guard never double-fires: two calls to the exhausted branch on the same spent record yield exactly one send', () => {
+    const transport = makeTransport()
+    const turnKey = 'c:dup'
+    writeSilentEndState({ chatId: 'c', threadId: null, turnKey })
+    driveRetryLadderToMax(turnKey)
+
+    simulateTurnEnd(
+      { chatId: 'c', threadId: null, turnKey, finalAnswerDelivered: false, turnDurationMs: 10_000 },
+      transport,
+    )
+    expect(transport.sent).toHaveLength(1)
+    // State is cleared by the first exhausted call — a defensive SECOND
+    // call for the exact same still-dark turn (e.g. a duplicate turn_end
+    // event) finds no prior state and starts a FRESH retry cycle rather
+    // than re-firing the fallback a second time.
+    const second = simulateTurnEnd(
+      { chatId: 'c', threadId: null, turnKey, finalAnswerDelivered: false, turnDurationMs: 10_050 },
+      transport,
+    )
+    expect(second?.exhausted).toBe(false)
+    expect(transport.sent).toHaveLength(1)
+  })
+
+  it('(d2) staleness hardening: an exhausted-looking record left by an ALREADY-ANSWERED turn on the same chat/thread must not fire the fallback for a brand-new dark turn', () => {
+    // silent-end's turnKey is `statusKey(chatId, threadId)` — stable
+    // across every turn on a chat/thread, not a per-turn nonce. If a
+    // reply's `clearSilentEndState` call is ever missed (it is
+    // fail-silent by design), a spent retryCount from an OLD,
+    // genuinely-answered turn could otherwise be misread as THIS
+    // brand-new dark turn's already-exhausted budget — firing the
+    // fallback without ever running the Stop-hook re-prompt ladder.
+    //
+    // This is the same class of bug #2472 fixed in the represent guard
+    // (gateway/represent-guard.ts shouldSuppressRepresent): a
+    // satisfied-but-misdetected obligation must be verified against real
+    // delivery history, not trusted from key equality + a counter alone.
+    const transport = makeTransport()
+    const turnKey = 'c:_'
+    const staleTimestamp = 1_000_000
+
+    // Simulate the missed-clear: an old, already-answered turn left the
+    // ladder pinned at MAX_RETRIES and (because the clear was missed) the
+    // file was never removed.
+    writeSilentEndState({ chatId: 'c', threadId: null, turnKey })
+    driveRetryLadderToMax(turnKey)
+    // Force the stale timestamp to predate the "reply" the deps stub
+    // reports below.
+    const path = join(stateDir, 'silent-end-pending.json')
+    const s = readSilentEndState()!
+    writeFileSyncState(path, JSON.stringify({ ...s, timestamp: staleTimestamp }), 'utf8')
+
+    // A reply WAS in fact delivered on this chat (the missed-clear case)
+    // at some point after the stale record's timestamp.
+    const deps: SilentEndDeps = {
+      hasOutboundDeliveredSince: (chatId, sinceMs) =>
+        chatId === 'c' && sinceMs <= staleTimestamp + 500,
+    }
+
+    // A genuinely NEW, unrelated dark turn now ends on the same
+    // chat/thread (same turnKey by construction).
+    const result = simulateTurnEnd(
+      { chatId: 'c', threadId: null, turnKey, finalAnswerDelivered: false, turnDurationMs: 8_000 },
+      transport,
+      deps,
+    )
+
+    expect(result?.exhausted).toBe(false)
+    expect(transport.sent).toHaveLength(0)
+    // CRITICAL (adversarial review of #2892): the "fresh retry cycle" must
+    // actually be fresh. writeSilentEndState re-inherits retryCount when
+    // the on-disk turnKey matches (which it ALWAYS does here — turnKey is
+    // statusKey). If the staleness branch writes without clearing first,
+    // the new record starts at retryCount=MAX: the Stop hook
+    // (silent-end-interrupt-stop.mjs) sees retryCount >= MAX_RETRIES and
+    // never re-prompts, while the gateway just got exhausted:false and
+    // sent no fallback either — pure silence, worse than no fix at all.
+    expect(readSilentEndState()!.retryCount).toBe(0)
+  })
+
+  it('(d3) staleness hardening does NOT suppress a genuine, fresh exhaustion (no reply since the record)', () => {
+    const transport = makeTransport()
+    const turnKey = 'c:_'
+    writeSilentEndState({ chatId: 'c', threadId: null, turnKey })
+    driveRetryLadderToMax(turnKey)
+
+    const deps: SilentEndDeps = {
+      // No reply has landed since the record — the exhaustion is real.
+      hasOutboundDeliveredSince: () => false,
+    }
+
+    const result = simulateTurnEnd(
+      { chatId: 'c', threadId: null, turnKey, finalAnswerDelivered: false, turnDurationMs: 9_000 },
+      transport,
+      deps,
+    )
+
+    expect(result?.exhausted).toBe(true)
+    expect(transport.sent).toHaveLength(1)
+  })
+
+  it('cross-check: isFinalAnswerReply gating means an ack-only turn still reaches the dark-turn branch', () => {
+    // Sanity cross-check against the real predicate used at the reply
+    // send-sites (executeReply/executeStreamReply) — an interim ack does
+    // NOT satisfy finalAnswerDelivered, so the branch is correctly
+    // entered (this is the #1664 case, not a legitimate silent end).
+    const ack = { text: 'On it', disableNotification: true }
+    expect(isFinalAnswerReply(ack)).toBe(false)
+
+    const transport = makeTransport()
+    const turnKey = 'c:ack-only'
+    writeSilentEndState({ chatId: 'c', threadId: null, turnKey })
+    driveRetryLadderToMax(turnKey)
+    simulateTurnEnd(
+      { chatId: 'c', threadId: null, turnKey, finalAnswerDelivered: isFinalAnswerReply(ack), turnDurationMs: 15_000 },
+      transport,
+    )
+    expect(transport.sent).toHaveLength(1)
+  })
+})