switchroom 0.18.10 → 0.18.12

package/telegram-plugin/tests/inline-keyboard-callbacks.test.ts

@@ -16,6 +16,11 @@ import {
   wrapAgentCallbacks,
   parseAgentCallback,
   validateAndWrapAgentKeyboard,
+  extractAgentButtonMeta,
+  buildButtonConfirmation,
+  resolveTapAnnotation,
+  escapeHtmlEntities,
+  applyTapAnnotationEdit,
 } from '../inline-keyboard-callbacks.js'
 
 describe('inline-keyboard-callbacks (#271)', () => {
@@ -147,4 +152,283 @@ describe('inline-keyboard-callbacks (#271)', () => {
       }
     })
   })
+
+  // ─── #789 button-choice-confirmation ("✅ You chose: X") ────────────────
+  describe('inline_keyboard_confirm meta plumbing (#789)', () => {
+    it('captures inline_keyboard_confirm into the per-button meta map', () => {
+      const meta = extractAgentButtonMeta([
+        [{ text: 'Approve', callback_data: 'ok', inline_keyboard_confirm: true }],
+        [{ text: 'Hold', callback_data: 'hold', inline_keyboard_confirm: false }],
+      ])
+      expect(meta.get('ok')).toEqual({ inline_keyboard_confirm: true })
+      expect(meta.get('hold')).toEqual({ inline_keyboard_confirm: false })
+    })
+
+    it('strips inline_keyboard_confirm from the wrapped Telegram payload', () => {
+      const wrapped = wrapAgentCallbacks([
+        [{ text: 'Approve', callback_data: 'ok', inline_keyboard_confirm: true }],
+      ])
+      expect(wrapped[0]![0]).toEqual({ text: 'Approve', callback_data: 'agent:ok' })
+      expect('inline_keyboard_confirm' in wrapped[0]![0]!).toBe(false)
+    })
+  })
+
+  describe('buildButtonConfirmation (#789)', () => {
+    // Fixed clock: 14:05 local. Use a UTC-explicit date and read via the
+    // matching timezone accessor so the assertion is host-TZ independent.
+    const fixedUtc = new Date('2026-07-11T14:05:00Z')
+
+    it('renders the default template with a bold, escaped label + HH:MM (utc)', () => {
+      const line = buildButtonConfirmation({
+        template: '✅ You chose: {label} · {time}',
+        label: 'Approve',
+        timezone: 'utc',
+        escapeLabel: (s) => s,
+        now: fixedUtc,
+      })
+      expect(line).toBe('✅ You chose: <b>Approve</b> · 14:05')
+    })
+
+    it('collapses newlines in the label to a single line', () => {
+      const line = buildButtonConfirmation({
+        template: '✅ You chose: {label} · {time}',
+        label: 'Line one\nLine two',
+        timezone: 'utc',
+        escapeLabel: (s) => s,
+        now: fixedUtc,
+      })
+      expect(line).toBe('✅ You chose: <b>Line one Line two</b> · 14:05')
+      expect(line).not.toContain('\n')
+    })
+
+    it('trims a long label to 60 chars and applies the injected escaper', () => {
+      const line = buildButtonConfirmation({
+        template: '{label}',
+        label: 'x'.repeat(80),
+        timezone: 'utc',
+        escapeLabel: (s) => `[esc:${s.length}]`,
+        now: fixedUtc,
+      })
+      expect(line).toBe('<b>[esc:60]</b>')
+    })
+  })
+
+  describe('resolveTapAnnotation (#789)', () => {
+    const escapeLabel = (s: string) => s
+    const now = new Date('2026-07-11T09:30:00Z')
+    const base = {
+      escapeLabel,
+      now,
+      parseMode: 'html' as const,
+      singleUse: true,
+      sourceText: 'Deploy to prod?',
+      label: 'Approve',
+    }
+
+    it('annotates when the agent default is ON and the keyboard is single-use', () => {
+      const r = resolveTapAnnotation({
+        ...base,
+        config: { enabled: true, timezone: 'utc' },
+      })
+      expect(r.annotate).toBe(true)
+      expect(r.text).toBe('Deploy to prod?\n\n✅ You chose: <b>Approve</b> · 09:30')
+      expect(r.warnParseMode).toBe(false)
+      expect(r.warnSingleUseMismatch).toBe(false)
+    })
+
+    it('per-message inline_keyboard_confirm:false overrides an ON agent default', () => {
+      const r = resolveTapAnnotation({
+        ...base,
+        config: { enabled: true, timezone: 'utc' },
+        perMessageOverride: false,
+      })
+      expect(r.annotate).toBe(false)
+      expect(r.text).toBeUndefined()
+      expect(r.warnParseMode).toBe(false)
+    })
+
+    it('per-message inline_keyboard_confirm:true fires even when the default is OFF', () => {
+      const r = resolveTapAnnotation({
+        ...base,
+        config: { enabled: false, timezone: 'utc' },
+        perMessageOverride: true,
+      })
+      expect(r.annotate).toBe(true)
+      expect(r.text).toBe('Deploy to prod?\n\n✅ You chose: <b>Approve</b> · 09:30')
+    })
+
+    it('replaces (not duplicates) a prior annotation on retap', () => {
+      const priorBody = 'Deploy to prod?\n\n✅ You chose: <b>Hold</b> · 08:15'
+      const r = resolveTapAnnotation({
+        ...base,
+        sourceText: priorBody,
+        config: { enabled: true, timezone: 'utc' },
+      })
+      expect(r.annotate).toBe(true)
+      expect(r.text).toBe('Deploy to prod?\n\n✅ You chose: <b>Approve</b> · 09:30')
+      // Exactly one confirmation line survives.
+      expect((r.text!.match(/✅ You chose:/g) ?? []).length).toBe(1)
+    })
+
+    it('strips a prior annotation whose label carried a stray newline (dotAll)', () => {
+      const priorBody = 'Deploy to prod?\n\n✅ You chose: <b>Hold\nnow</b> · 08:15'
+      const r = resolveTapAnnotation({
+        ...base,
+        sourceText: priorBody,
+        config: { enabled: true, timezone: 'utc' },
+      })
+      expect(r.text).toBe('Deploy to prod?\n\n✅ You chose: <b>Approve</b> · 09:30')
+    })
+
+    it('skips annotation + flags parseMode warning on a non-html parse mode', () => {
+      const r = resolveTapAnnotation({
+        ...base,
+        parseMode: 'markdownv2',
+        config: { enabled: true, timezone: 'utc' },
+      })
+      expect(r.annotate).toBe(false)
+      expect(r.warnParseMode).toBe(true)
+    })
+
+    it('never annotates a re-tappable (single_use:false) keyboard, flags mismatch', () => {
+      const r = resolveTapAnnotation({
+        ...base,
+        singleUse: false,
+        config: { enabled: true, timezone: 'utc' },
+      })
+      expect(r.annotate).toBe(false)
+      expect(r.warnSingleUseMismatch).toBe(true)
+      // No parseMode warning — we bail on single-use before the parse gate.
+      expect(r.warnParseMode).toBe(false)
+    })
+
+    it('skips annotation when the source message has no text (caption-only)', () => {
+      const r = resolveTapAnnotation({
+        ...base,
+        sourceText: undefined,
+        config: { enabled: true, timezone: 'utc' },
+      })
+      expect(r.annotate).toBe(false)
+      expect(r.warnParseMode).toBe(false)
+    })
+  })
+
+  // ─── real HTML-entity escaping (#789 round-2 blocker) ────────────────────
+  describe('escapeHtmlEntities + real-escaper wiring (#789)', () => {
+    const now = new Date('2026-07-11T09:30:00Z')
+
+    it('escapes exactly &, <, > — and nothing else (no markdown garbling)', () => {
+      expect(escapeHtmlEntities('a & b < c > d')).toBe('a &amp; b &lt; c &gt; d')
+      // The GFM escaper would turn Do_it into Do\_it; the HTML escaper must not.
+      expect(escapeHtmlEntities('Do_it `now` *bold*')).toBe('Do_it `now` *bold*')
+      // & first: no double-escaping of produced entities.
+      expect(escapeHtmlEntities('&lt;')).toBe('&amp;lt;')
+    })
+
+    it('is the DEFAULT escaper: labels with & < > render Telegram-parseable HTML', () => {
+      const line = buildButtonConfirmation({
+        template: '✅ You chose: {label} · {time}',
+        label: 'Yes & <no>',
+        timezone: 'utc',
+        now,
+      })
+      expect(line).toBe('✅ You chose: <b>Yes &amp; &lt;no&gt;</b> · 09:30')
+    })
+
+    it('escapes the BASE source text too, not just the label', () => {
+      const r = resolveTapAnnotation({
+        parseMode: 'html',
+        singleUse: true,
+        sourceText: 'Deploy <feature/x> & friends?',
+        label: 'Approve',
+        config: { enabled: true, timezone: 'utc' },
+        now,
+      })
+      expect(r.annotate).toBe(true)
+      expect(r.text).toBe(
+        'Deploy &lt;feature/x&gt; &amp; friends?\n\n✅ You chose: <b>Approve</b> · 09:30',
+      )
+      // Only the tags WE emit remain — no raw user-supplied angle brackets.
+      expect(r.text!.replace(/<\/?b>/g, '')).not.toMatch(/[<>]/)
+    })
+
+    it('retap dedup matches the annotation as Telegram returns it (plain text, no <b> tags)', () => {
+      // Telegram's message.text is plain text — entities are separate — so a
+      // real retap sees the prior line WITHOUT tags.
+      const r = resolveTapAnnotation({
+        parseMode: 'html',
+        singleUse: true,
+        sourceText: 'Deploy to prod?\n\n✅ You chose: Hold · 08:15',
+        label: 'Approve',
+        config: { enabled: true, timezone: 'utc' },
+        now,
+      })
+      expect(r.text).toBe('Deploy to prod?\n\n✅ You chose: <b>Approve</b> · 09:30')
+      expect((r.text!.match(/✅ You chose:/g) ?? []).length).toBe(1)
+    })
+
+    it('String.replace special patterns ($&, $\') in labels are inert', () => {
+      const line = buildButtonConfirmation({
+        template: '✅ You chose: {label} · {time}',
+        label: "$& $' $` $1",
+        timezone: 'utc',
+        now,
+      })
+      expect(line).toBe("✅ You chose: <b>$&amp; $' $` $1</b> · 09:30")
+    })
+  })
+
+  // ─── keyboard-strip fallback when the annotate edit rejects (#789) ───────
+  describe('applyTapAnnotationEdit (#789)', () => {
+    it('annotates via a single editMessageText call on success', async () => {
+      const calls: string[] = []
+      const outcome = await applyTapAnnotationEdit(
+        {
+          editMessageText: async (text, other) => {
+            calls.push(`text:${text}:${other.parse_mode}`)
+            expect(other.reply_markup).toEqual({ inline_keyboard: [] })
+          },
+          editMessageReplyMarkup: async () => {
+            calls.push('markup')
+          },
+        },
+        'body\n\n✅ You chose: <b>Approve</b> · 09:30',
+      )
+      expect(outcome).toBe('annotated')
+      expect(calls).toEqual(['text:body\n\n✅ You chose: <b>Approve</b> · 09:30:HTML'])
+    })
+
+    it('strips the keyboard via editMessageReplyMarkup when the edit rejects', async () => {
+      const calls: unknown[] = []
+      const outcome = await applyTapAnnotationEdit(
+        {
+          editMessageText: async () => {
+            throw new Error('400: Bad Request: can\'t parse entities')
+          },
+          editMessageReplyMarkup: async other => {
+            calls.push(other)
+          },
+        },
+        'whatever',
+      )
+      expect(outcome).toBe('stripped-fallback')
+      // Single-use protection held: the keyboard WAS stripped.
+      expect(calls).toEqual([{ reply_markup: { inline_keyboard: [] } }])
+    })
+
+    it('reports failed (without throwing) when both edits reject', async () => {
+      const outcome = await applyTapAnnotationEdit(
+        {
+          editMessageText: async () => {
+            throw new Error('400')
+          },
+          editMessageReplyMarkup: async () => {
+            throw new Error('400')
+          },
+        },
+        'whatever',
+      )
+      expect(outcome).toBe('failed')
+    })
+  })
 })

package/telegram-plugin/tests/ipc-server-check-pre-approved.test.ts

@@ -0,0 +1,194 @@
+/**
+ * #2975 Stage 2 — gateway-side IPC surface for `check_pre_approved`, the
+ * read-only pre-approval query hostd sends before applying the
+ * `config_propose_edit` rate limit.
+ *
+ * Exercises the REAL createIpcServer over a real (tmp) unix socket with a raw
+ * `net.createConnection` client — the same hostd → gateway approval-gateway
+ * transport. Pins:
+ *   - wire-shape validation (validateClientMessage);
+ *   - the wired handler is invoked and its `pre_approved_result` relayed;
+ *   - FAIL CLOSED: no handler wired (old gateway / mixed-version) → the server
+ *     itself replies `preApproved: false`.
+ *
+ * The message is hostd → gateway over the approval-gateway socket; it is NOT
+ * reachable via any agent-facing hostd verb (there is no hostd op that emits
+ * it), and the handler treats it as read-only.
+ */
+import { describe, it, expect, afterEach } from "vitest";
+import { createConnection } from "node:net";
+import { mkdtempSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import {
+  createIpcServer,
+  validateClientMessage,
+  type IpcServer,
+  type IpcClient,
+} from "../gateway/ipc-server.js";
+import type { CheckPreApprovedMessage } from "../gateway/ipc-protocol.js";
+
+function tmpSocket(): string {
+  const dir = mkdtempSync(join(tmpdir(), "ipc-cpa-test-"));
+  return join(dir, "test.sock");
+}
+
+function wait(ms: number): Promise<void> {
+  return new Promise((r) => setTimeout(r, ms));
+}
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+function queryOnce(
+  socketPath: string,
+  agentName: string,
+  correlationId: string,
+  unifiedDiff: string,
+): Promise<any> {
+  return new Promise((resolve, reject) => {
+    const sock = createConnection(socketPath);
+    let buffer = "";
+    sock.on("connect", () => {
+      sock.write(
+        JSON.stringify({
+          type: "check_pre_approved",
+          agentName,
+          correlationId,
+          unifiedDiff,
+        } as CheckPreApprovedMessage) + "\n",
+      );
+    });
+    sock.on("data", (chunk) => {
+      buffer += chunk.toString("utf8");
+      const idx = buffer.indexOf("\n");
+      if (idx >= 0) {
+        sock.end();
+        resolve(JSON.parse(buffer.slice(0, idx)));
+      }
+    });
+    sock.on("error", reject);
+  });
+}
+
+describe("validateClientMessage — check_pre_approved (#2975 Stage 2)", () => {
+  it("accepts a well-formed query", () => {
+    expect(
+      validateClientMessage({
+        type: "check_pre_approved",
+        agentName: "klanker",
+        correlationId: "abc",
+        unifiedDiff: "--- a\n+++ b\n",
+      }),
+    ).toBe(true);
+  });
+
+  it("rejects missing/malformed agentName", () => {
+    expect(
+      validateClientMessage({ type: "check_pre_approved", correlationId: "abc", unifiedDiff: "x" }),
+    ).toBe(false);
+    expect(
+      validateClientMessage({ type: "check_pre_approved", agentName: "Bad Name", correlationId: "abc", unifiedDiff: "x" }),
+    ).toBe(false);
+  });
+
+  it("rejects missing/oversized correlationId", () => {
+    expect(
+      validateClientMessage({ type: "check_pre_approved", agentName: "klanker", unifiedDiff: "x" }),
+    ).toBe(false);
+    expect(
+      validateClientMessage({ type: "check_pre_approved", agentName: "klanker", correlationId: "", unifiedDiff: "x" }),
+    ).toBe(false);
+    expect(
+      validateClientMessage({ type: "check_pre_approved", agentName: "klanker", correlationId: "x".repeat(65), unifiedDiff: "x" }),
+    ).toBe(false);
+  });
+
+  it("rejects an empty/missing unifiedDiff", () => {
+    expect(
+      validateClientMessage({ type: "check_pre_approved", agentName: "klanker", correlationId: "abc" }),
+    ).toBe(false);
+    expect(
+      validateClientMessage({ type: "check_pre_approved", agentName: "klanker", correlationId: "abc", unifiedDiff: "" }),
+    ).toBe(false);
+  });
+});
+
+describe("ipc-server — onCheckPreApproved handler (#2975 Stage 2)", () => {
+  const servers: IpcServer[] = [];
+
+  afterEach(async () => {
+    for (const s of servers) await s.close();
+    servers.length = 0;
+  });
+
+  it("fails CLOSED (preApproved:false) when no handler is wired — mixed-version-safe default", async () => {
+    const socketPath = tmpSocket();
+    const server = createIpcServer({
+      socketPath,
+      onClientRegistered: () => {},
+      onClientDisconnected: () => {},
+      onToolCall: async () => ({ type: "tool_call_result", id: "x", success: true }),
+      onSessionEvent: () => {},
+      onPermissionRequest: () => {},
+      onHeartbeat: () => {},
+      onScheduleRestart: () => {},
+      // onCheckPreApproved intentionally omitted.
+    });
+    servers.push(server);
+    await wait(50);
+
+    const reply = await queryOnce(socketPath, "klanker", "corr-1", "--- a\n+++ b\n");
+    expect(reply).toEqual({ type: "pre_approved_result", correlationId: "corr-1", preApproved: false });
+  });
+
+  it("invokes the wired handler with the query, and relays its reply", async () => {
+    const socketPath = tmpSocket();
+    let received: CheckPreApprovedMessage | null = null;
+    const server = createIpcServer({
+      socketPath,
+      onClientRegistered: () => {},
+      onClientDisconnected: () => {},
+      onToolCall: async () => ({ type: "tool_call_result", id: "x", success: true }),
+      onSessionEvent: () => {},
+      onPermissionRequest: () => {},
+      onHeartbeat: () => {},
+      onScheduleRestart: () => {},
+      onCheckPreApproved: (client: IpcClient, msg: CheckPreApprovedMessage) => {
+        received = msg;
+        client.send({ type: "pre_approved_result", correlationId: msg.correlationId, preApproved: true });
+      },
+    });
+    servers.push(server);
+    await wait(50);
+
+    const reply = await queryOnce(socketPath, "klanker", "corr-2", "--- a\n+++ b\n");
+    expect(received).toEqual({
+      type: "check_pre_approved",
+      agentName: "klanker",
+      correlationId: "corr-2",
+      unifiedDiff: "--- a\n+++ b\n",
+    });
+    expect(reply).toEqual({ type: "pre_approved_result", correlationId: "corr-2", preApproved: true });
+  });
+
+  it("relays preApproved:false from a wired handler", async () => {
+    const socketPath = tmpSocket();
+    const server = createIpcServer({
+      socketPath,
+      onClientRegistered: () => {},
+      onClientDisconnected: () => {},
+      onToolCall: async () => ({ type: "tool_call_result", id: "x", success: true }),
+      onSessionEvent: () => {},
+      onPermissionRequest: () => {},
+      onHeartbeat: () => {},
+      onScheduleRestart: () => {},
+      onCheckPreApproved: (client: IpcClient, msg: CheckPreApprovedMessage) => {
+        client.send({ type: "pre_approved_result", correlationId: msg.correlationId, preApproved: false });
+      },
+    });
+    servers.push(server);
+    await wait(50);
+
+    const reply = await queryOnce(socketPath, "klanker", "corr-3", "--- a\n+++ b\n");
+    expect(reply).toEqual({ type: "pre_approved_result", correlationId: "corr-3", preApproved: false });
+  });
+});

package/telegram-plugin/tests/mental-model-propose-resolve.test.ts

@@ -138,6 +138,129 @@ describe("resolveMentalModelProposal — APPROVE", () => {
   });
 });
 
+describe("resolveMentalModelProposal — #2975 Stage 1 rate-limit backstop", () => {
+  const NOW = 1_700_000_000_000;
+  const RETRY_AT = NOW + 55 * 60_000; // hostd's window-open time
+
+  /**
+   * Build deps whose dispatchConfigEdit yields `results` in order (one per
+   * attempt), plus a manual single-slot scheduler the test fires by hand — a
+   * mocked clock, no real timers.
+   */
+  function rateDeps(results: Array<Awaited<ReturnType<ResolveDeps["dispatchConfigEdit"]>>>) {
+    let call = 0;
+    let scheduled: { delayMs: number; fn: () => void | Promise<void> } | null = null;
+    const spies = {
+      registerPreApproval: vi.fn(),
+      clearPreApproval: vi.fn(),
+      dispatchConfigEdit: vi.fn(async () => results[Math.min(call++, results.length - 1)]!),
+      ensureModel: vi.fn(async () => {}),
+      injectInbound: vi.fn(),
+      scheduleRetry: vi.fn((delayMs: number, fn: () => void | Promise<void>) => {
+        scheduled = { delayMs, fn };
+      }),
+      editProposalCardRateWindow: vi.fn(),
+      notifyPersistFailed: vi.fn(),
+    };
+    const deps: ResolveDeps = {
+      readConfigText: () => CONFIG_NO_MODELS,
+      registerPreApproval: spies.registerPreApproval,
+      clearPreApproval: spies.clearPreApproval,
+      dispatchConfigEdit: spies.dispatchConfigEdit,
+      ensureModel: spies.ensureModel,
+      injectInbound: spies.injectInbound,
+      scheduleRetry: spies.scheduleRetry,
+      editProposalCardRateWindow: spies.editProposalCardRateWindow,
+      notifyPersistFailed: spies.notifyPersistFailed,
+      now: () => NOW,
+    };
+    return { deps, spies, fireScheduled: () => scheduled!.fn(), getScheduled: () => scheduled };
+  }
+
+  it("schedules EXACTLY ONE retry at retry_after, which persists with a byte-identical diff", async () => {
+    const { deps, spies, fireScheduled, getScheduled } = rateDeps([
+      { state: "rate_limited", reason: "config_propose_edit rate limit exceeded", retryAtMs: RETRY_AT },
+      { state: "applied" },
+    ]);
+
+    const out = await resolveMentalModelProposal("approve", pending(), "stage1", "op-42", deps);
+
+    // The turn is deferred, not lost: a single retry is scheduled at the window.
+    expect(out).toEqual({ outcome: "scheduled_retry", retryAtMs: RETRY_AT });
+    expect(spies.scheduleRetry).toHaveBeenCalledTimes(1);
+    expect(getScheduled()!.delayMs).toBe(RETRY_AT - NOW);
+    // Card flipped to the "applying at HH:MM" state so the operator sees it.
+    expect(spies.editProposalCardRateWindow).toHaveBeenCalledWith(RETRY_AT);
+    // First (rate-limited) attempt already registered+cleared its correlation.
+    expect(spies.dispatchConfigEdit).toHaveBeenCalledTimes(1);
+    const firstDiff = spies.dispatchConfigEdit.mock.calls[0][0].diff;
+    expect(spies.registerPreApproval).toHaveBeenCalledWith("coach", firstDiff);
+    // Nothing applied yet.
+    expect(spies.ensureModel).not.toHaveBeenCalled();
+    expect(spies.injectInbound).not.toHaveBeenCalled();
+
+    // Fire the ONE scheduled retry (mocked clock).
+    await fireScheduled();
+
+    // Persisted on the retry.
+    expect(spies.dispatchConfigEdit).toHaveBeenCalledTimes(2);
+    const retryDiff = spies.dispatchConfigEdit.mock.calls[1][0].diff;
+    // Forge-resistance contract: register + dispatch use IDENTICAL diff bytes,
+    // and the retry re-registers the SAME bytes as the first attempt.
+    expect(retryDiff).toBe(firstDiff);
+    expect(spies.registerPreApproval).toHaveBeenCalledTimes(2);
+    expect(spies.registerPreApproval.mock.calls[1]).toEqual(["coach", retryDiff]);
+    expect(spies.clearPreApproval).toHaveBeenCalledTimes(2);
+    // Applied: ensured + agent woken; NO loud failure.
+    expect(spies.ensureModel).toHaveBeenCalledWith(pending().spec);
+    expect(spies.injectInbound).toHaveBeenCalledTimes(1);
+    expect(spies.injectInbound.mock.calls[0][0].meta.source).toBe(
+      "mental_model_proposal_applied",
+    );
+    expect(spies.notifyPersistFailed).not.toHaveBeenCalled();
+  });
+
+  it("emits a loud operator failure when the single retry ALSO fails — and does NOT re-schedule", async () => {
+    const { deps, spies, fireScheduled } = rateDeps([
+      { state: "rate_limited", reason: "rate limit exceeded", retryAtMs: RETRY_AT },
+      { state: "error", reason: "hostd down" },
+    ]);
+
+    const out = await resolveMentalModelProposal("approve", pending(), "s", "op", deps);
+    expect(out.outcome).toBe("scheduled_retry");
+    expect(spies.scheduleRetry).toHaveBeenCalledTimes(1);
+
+    await fireScheduled();
+
+    // The retry failed: loud operator-events notification, exactly once.
+    expect(spies.notifyPersistFailed).toHaveBeenCalledTimes(1);
+    expect(spies.notifyPersistFailed.mock.calls[0][0]).toContain("hostd down");
+    // No second retry — bounded to exactly one.
+    expect(spies.scheduleRetry).toHaveBeenCalledTimes(1);
+    // Agent woken with the failed inbound; nothing ensured.
+    expect(spies.ensureModel).not.toHaveBeenCalled();
+    expect(spies.injectInbound).toHaveBeenCalledTimes(1);
+    expect(spies.injectInbound.mock.calls[0][0].meta.source).toBe(
+      "mental_model_proposal_failed",
+    );
+  });
+
+  it("with no scheduler wired, a rate-limited persist fails loudly instead of silently dropping", async () => {
+    const { deps, spies } = rateDeps([
+      { state: "rate_limited", reason: "rate limit exceeded", retryAtMs: RETRY_AT },
+    ]);
+    // Simulate a build without the Stage-1 scheduler dep.
+    delete (deps as { scheduleRetry?: unknown }).scheduleRetry;
+
+    const out = await resolveMentalModelProposal("approve", pending(), "s", "op", deps);
+    expect(out).toEqual({ outcome: "failed", reason: "rate limit exceeded" });
+    expect(spies.notifyPersistFailed).toHaveBeenCalledTimes(1);
+    expect(spies.injectInbound.mock.calls[0][0].meta.source).toBe(
+      "mental_model_proposal_failed",
+    );
+  });
+});
+
 describe("resolveMentalModelProposal — DENY writes NOTHING", () => {
   it("never reads config, builds a diff, dispatches an edit, or ensures", async () => {
     const { deps, spies } = makeDeps(CONFIG_NO_MODELS);

package/telegram-plugin/tests/missed-approvals-wiring.test.ts

@@ -37,7 +37,7 @@ describe('missed-approvals re-offer wiring (#2862)', () => {
 
   it('appends the miss at TTL auto-deny, anchored to the card origin, gated by the kill switch', () => {
     // Within the pending-permission TTL sweep block.
-    const sweep = slice(GATEWAY, 'for (const [k, v] of pendingPermissions)', 3600)
+    const sweep = slice(GATEWAY, 'sweepPermissionTtl({', 5400)
     expect(sweep).toContain('if (MISSED_APPROVAL_REOFFER_ENABLED) {')
     expect(sweep).toContain('missedApprovalsStore.add({')
     expect(sweep).toContain('const origin = v.cards[0]')

package/telegram-plugin/tests/model-command.test.ts

@@ -1359,4 +1359,18 @@ describe("isOfflineTrustedModelToken (#3042 blocker 2a)", () => {
     expect(isOfflineTrustedModelToken("sr-made-up/model")).toBe(false);
     expect(isOfflineTrustedModelToken("")).toBe(false);
   });
+
+  it("#3043 item 1: accepts case-variant aliases the live path already normalizes (OPUS, Sonnet)", () => {
+    // The live accept path lowercases (isClaudeModel / expandSrAlias) so a
+    // queued `/model OPUS` is accepted live — the persist gate must not then
+    // refuse it with the over-conservative "couldn't verify" card.
+    for (const a of MODEL_ALIASES) {
+      expect(isOfflineTrustedModelToken(a.toUpperCase())).toBe(true);
+    }
+    expect(isOfflineTrustedModelToken("OPUS")).toBe(true);
+    expect(isOfflineTrustedModelToken("Sonnet")).toBe(true);
+    // Curated sr-* alias, upper-cased, still resolves.
+    const [alias] = Object.entries(SR_MODEL_ALIASES)[0];
+    expect(isOfflineTrustedModelToken(alias.toUpperCase())).toBe(true);
+  });
 });

package/telegram-plugin/tests/pending-session-command.test.ts

@@ -319,4 +319,25 @@ describe('drainTakenCommands (#3042 blocker 1: an early stop must not drop the r
     await drainTakenCommands(batch(), io)
     expect(events).toEqual(['edit:model:persisted:model', 'edit:effort:persisted:effort'])
   })
+
+  it('#3021: restart-pending is snapshotted at entry → sync loop emptying pendingRestarts mid-drain still defers the SECOND command', async () => {
+    // Reproduces the turn-end idle-gate race: the drain is void-dispatched while
+    // a synchronous pendingRestarts loop empties the map right after. The first
+    // read sees the entry; by the second command the map has been emptied. A
+    // naive per-command re-check would let the second command apply live into a
+    // session ~100ms from triggerSelfRestart and falsely confirm.
+    let restartPresent = true
+    const { io, events } = makeIo({
+      // takeAll() first read latches true; the sync loop then empties the map,
+      // so every subsequent live read returns false.
+      restartPending: () => {
+        const was = restartPresent
+        restartPresent = false // the sync loop deleted the entry after dispatch
+        return was
+      },
+    })
+    await drainTakenCommands(batch(), io)
+    // BOTH commands must ride the carriers — the second must NOT apply live.
+    expect(events).toEqual(['edit:model:persisted:model', 'edit:effort:persisted:effort'])
+  })
 })