switchroom 0.18.11 → 0.18.13

package/telegram-plugin/tests/callback-query-handlers.test.ts

@@ -41,6 +41,43 @@ import { createSweepableStore } from '../gateway/pending-state-stores.js'
 import { StagingMap } from '../secret-detect/staging.js'
 import { InlineKeyboard } from 'grammy'
 
+// Mock the auth-broker client so the `auth:use:` swap path is observable
+// (spy on setActive) without a live UDS broker. Only handleAuthDashboardCallback
+// touches getAuthBrokerClient, so this is inert for every other family here.
+//
+// The spy is created *inside* the factory and re-exported as a test-only
+// handle (`__setActiveSpy`) rather than closed over from a `vi.hoisted`
+// binding: bun's vitest-compat layer implements `vi.mock`/`vi.fn` but NOT
+// `vi.hoisted`, so a hoisted-closure mock throws `vi.hoisted is not a
+// function` under `bun test` (CI's bun-test-run shard runs this whole dir).
+// A single `setActive` instance is closed over and returned by every
+// `getAuthBrokerClient()` call, so the handler and the tests observe the
+// same spy.
+vi.mock('../gateway/auth-broker-client.js', () => {
+  const setActive = vi.fn(async () => ({ active: 'acct-b', fanned: ['a1'] }))
+  return {
+    getAuthBrokerClient: vi.fn(async () => ({ setActive })),
+  }
+})
+import { getAuthBrokerClient } from '../gateway/auth-broker-client.js'
+// The mocked getAuthBrokerClient closes over one shared `setActive` spy and
+// returns it on every call, so resolving the client here yields the SAME spy
+// the handler observes. A getter defers the read to test-run time (after the
+// mock is live under both runners); a beforeEach caches the resolved spy.
+let resolvedSetActiveSpy: ReturnType<typeof vi.fn> | undefined
+const brokerMock = {
+  get setActive(): ReturnType<typeof vi.fn> {
+    if (!resolvedSetActiveSpy) throw new Error('setActive spy not resolved yet')
+    return resolvedSetActiveSpy
+  },
+}
+beforeEach(async () => {
+  const client = (await getAuthBrokerClient('test-agent')) as {
+    setActive: ReturnType<typeof vi.fn>
+  }
+  resolvedSetActiveSpy = client.setActive
+})
+
 // ── Fakes ────────────────────────────────────────────────────────────────
 
 interface FakeCtxOpts {
@@ -568,6 +605,34 @@ describe('handleAuthDashboardCallback', () => {
       show_alert: false,
     })
   })
+
+  // Security gate (found in an adversarial security review): the auth: family
+  // is a mutating callback family (auth:use:<label> → broker.setActive, a
+  // fleet-wide OAuth account swap) and MUST enforce the same allowFrom gate as
+  // every sibling family. Without the gate, any tapper on an admin forum/
+  // supergroup with an empty group allowFrom could swap the active account.
+  it('rejects an auth:use swap from a sender not on allowFrom (never reaches setActive)', async () => {
+    const { deps } = makeDeps() // allowFrom = ['111','222']
+    const h = createCallbackQueryHandlers(deps)
+    brokerMock.setActive.mockClear()
+    const { ctx, raw } = makeCtx({ senderId: '999', data: 'auth:use:acct-b' })
+    await h.handleAuthDashboardCallback(ctx)
+    expect(raw.answerCallbackQuery).toHaveBeenCalledWith({ text: 'Not authorized.' })
+    // The load-bearing assertion: the swap must not fire for an unauthorized tap.
+    expect(brokerMock.setActive).not.toHaveBeenCalled()
+  })
+
+  it('lets an allowFrom sender through to the setActive swap path', async () => {
+    const { deps } = makeDeps()
+    const h = createCallbackQueryHandlers(deps)
+    brokerMock.setActive.mockClear()
+    const { ctx, raw } = makeCtx({ senderId: '111', data: 'auth:use:acct-b' })
+    await h.handleAuthDashboardCallback(ctx)
+    expect(brokerMock.setActive).toHaveBeenCalledWith('acct-b')
+    expect(raw.answerCallbackQuery).toHaveBeenCalledWith(
+      expect.objectContaining({ text: expect.stringContaining('Switched fleet → acct-b') }),
+    )
+  })
 })
 
 // ── vg:* — grant wizard + management ────────────────────────────────────

package/telegram-plugin/tests/dispatch-claim-scan.test.ts

@@ -0,0 +1,250 @@
+/**
+ * Tests for the #396 dispatch-claim Stop-hook scan logic — the pure
+ * `dispatch-claim-scan.mjs` helpers (mirrors the silent-end-scan test
+ * style: synthetic JSONL fixtures against a pure function rather than
+ * spawning the .mjs subprocess).
+ *
+ * The defect: a reply that TELLS the user work was dispatched
+ * ("Dispatching a worker now") while the turn contains no Agent/Task call
+ * and no backgrounded Bash. These assert OUTCOMES (block vs allow), not
+ * code paths.
+ */
+
+import { describe, it, expect } from 'vitest'
+import {
+  scanTurnForDispatchClaim,
+  replyClaimsDispatch,
+  applyRetryBudget,
+  turnSignature,
+} from '../hooks/dispatch-claim-scan.mjs'
+
+// ── Fixture builders ────────────────────────────────────────────────
+
+const REPLY = 'mcp__switchroom-telegram__reply'
+
+const ENQUEUE = JSON.stringify({
+  type: 'queue-operation',
+  operation: 'enqueue',
+  content: '<channel source="switchroom-telegram" chat_id="111" message_id="42">fix the bug</channel>',
+})
+
+function assistantToolUse(
+  name: string,
+  input: Record<string, unknown>,
+  opts: { isSidechain?: boolean } = {},
+) {
+  const base: Record<string, unknown> = {
+    type: 'assistant',
+    message: { content: [{ type: 'tool_use', name, input }] },
+  }
+  if (opts.isSidechain) base.isSidechain = true
+  return JSON.stringify(base)
+}
+
+function reply(text: string, opts: { isSidechain?: boolean } = {}) {
+  return assistantToolUse(REPLY, { text, chat_id: '111' }, opts)
+}
+
+function jsonl(...lines: string[]) {
+  return lines.join('\n')
+}
+
+// ── (a) claim + no dispatch tool_use → block ────────────────────────
+
+describe('scanTurnForDispatchClaim — narrate-without-execute', () => {
+  it('(a) blocks a dispatch claim with no Agent/Task call in the turn', () => {
+    const t = jsonl(ENQUEUE, reply('Dispatching a worker now to fix this bug.'))
+    const d = scanTurnForDispatchClaim(t)
+    expect(d.decided).toBe('block')
+    expect(d.reason).toBe('claim-without-dispatch')
+    expect(d.turnSig).toBeTruthy()
+  })
+
+  // ── (b) claim + Agent tool_use in turn → allow ────────────────────
+  it('(b) allows when the turn actually dispatched an Agent', () => {
+    const t = jsonl(
+      ENQUEUE,
+      reply('Dispatching a worker now to fix this bug.'),
+      assistantToolUse('Agent', { subagent_type: 'worker', description: 'fix bug' }),
+    )
+    const d = scanTurnForDispatchClaim(t)
+    expect(d.decided).toBe('allow')
+    expect(d.reason).toBe('dispatched')
+  })
+
+  it('(b2) allows when the dispatch tool is the newer Task name', () => {
+    const t = jsonl(
+      ENQUEUE,
+      reply('Spinning up a researcher to dig into this.'),
+      assistantToolUse('Task', { subagent_type: 'researcher' }),
+    )
+    expect(scanTurnForDispatchClaim(t).decided).toBe('allow')
+  })
+
+  // ── (c) claim + backgrounded Bash → allow ─────────────────────────
+  it('(c) allows when the turn launched a backgrounded Bash', () => {
+    const t = jsonl(
+      ENQUEUE,
+      reply('Kicking off the build agent in the background.'),
+      assistantToolUse('Bash', { command: 'npm run build', run_in_background: true }),
+    )
+    const d = scanTurnForDispatchClaim(t)
+    expect(d.decided).toBe('allow')
+    expect(d.reason).toBe('dispatched')
+  })
+
+  it('(c2) a FOREGROUND Bash does not count as a dispatch', () => {
+    const t = jsonl(
+      ENQUEUE,
+      reply('Dispatching a worker to handle this.'),
+      assistantToolUse('Bash', { command: 'ls', run_in_background: false }),
+    )
+    expect(scanTurnForDispatchClaim(t).decided).toBe('block')
+  })
+
+  // ── (d) conditional offer → allow ─────────────────────────────────
+  it('(d) allows a conditional offer to dispatch (question)', () => {
+    const t = jsonl(ENQUEUE, reply('Want me to dispatch a worker to fix this?'))
+    const d = scanTurnForDispatchClaim(t)
+    expect(d.decided).toBe('allow')
+    expect(d.reason).toBe('no-claim')
+  })
+
+  it('(d2) allows a conditional "I could spin up a reviewer if you like"', () => {
+    const t = jsonl(ENQUEUE, reply('I could spin up a reviewer if you want me to.'))
+    expect(scanTurnForDispatchClaim(t).decided).toBe('allow')
+  })
+
+  // ── (e) non-dispatch reply → allow ────────────────────────────────
+  it('(e) allows an ordinary non-dispatch reply', () => {
+    const t = jsonl(ENQUEUE, reply('Here is the answer: the bug is a null deref on line 12.'))
+    const d = scanTurnForDispatchClaim(t)
+    expect(d.decided).toBe('allow')
+    expect(d.reason).toBe('no-claim')
+  })
+
+  // ── (f) NO_REPLY-only turn → allow ────────────────────────────────
+  it('(f) allows a NO_REPLY-only turn', () => {
+    const t = jsonl(ENQUEUE, reply('NO_REPLY'))
+    expect(scanTurnForDispatchClaim(t).decided).toBe('allow')
+  })
+
+  // ── (g) sidechain lines ───────────────────────────────────────────
+  it('(g) sidechain Agent lines do NOT count as the parent dispatching', () => {
+    // A sub-agent's own Agent tool_use leaks in with isSidechain — it must
+    // not satisfy the PARENT's dispatch obligation. Parent reply claims a
+    // dispatch, parent itself dispatched nothing → block.
+    const t = jsonl(
+      ENQUEUE,
+      reply('Dispatching a worker now.'),
+      assistantToolUse('Agent', { subagent_type: 'worker' }, { isSidechain: true }),
+    )
+    expect(scanTurnForDispatchClaim(t).decided).toBe('block')
+  })
+
+  it('(g2) sidechain replies do NOT count as the parent making a claim', () => {
+    // A sub-agent's own reply narrating a dispatch leaks in with
+    // isSidechain; the parent made no claim → allow.
+    const t = jsonl(
+      ENQUEUE,
+      reply('Working on the fix directly.'),
+      reply('Dispatching a worker to handle the subtask.', { isSidechain: true }),
+    )
+    const d = scanTurnForDispatchClaim(t)
+    expect(d.decided).toBe('allow')
+    expect(d.reason).toBe('no-claim')
+  })
+
+  // ── (i) malformed / missing transcript → allow (fail-open) ────────
+  it('(i) fails open on an empty transcript', () => {
+    expect(scanTurnForDispatchClaim('').decided).toBe('unknown')
+  })
+
+  it('(i2) fails open when no turn-start anchor is present', () => {
+    const t = jsonl(reply('Dispatching a worker now.'))
+    expect(scanTurnForDispatchClaim(t).decided).toBe('unknown')
+  })
+
+  it('(i3) tolerates malformed JSONL lines mixed in', () => {
+    const t = jsonl(ENQUEUE, '{ not valid json', reply('Dispatching a worker now.'))
+    const d = scanTurnForDispatchClaim(t)
+    expect(d.decided).toBe('block')
+  })
+
+  // ── past-tense reference (registry-check substitute) ──────────────
+  it('does NOT block a bare past-tense reference to an earlier dispatch', () => {
+    const t = jsonl(
+      ENQUEUE,
+      reply('The worker I dispatched earlier finished; here are its results.'),
+    )
+    const d = scanTurnForDispatchClaim(t)
+    expect(d.decided).toBe('allow')
+    expect(d.reason).toBe('no-claim')
+  })
+})
+
+// ── replyClaimsDispatch unit coverage ───────────────────────────────
+
+describe('replyClaimsDispatch', () => {
+  it('matches present/progressive commitments', () => {
+    expect(replyClaimsDispatch('Dispatching a worker now.')).toBe(true)
+    expect(replyClaimsDispatch("I'll dispatch a reviewer to check this.")).toBe(true)
+    expect(replyClaimsDispatch('Spinning up a sub-agent for the research.')).toBe(true)
+    expect(replyClaimsDispatch('Kicking off a worker on that task.')).toBe(true)
+    expect(replyClaimsDispatch('Delegating this to a researcher.')).toBe(true)
+  })
+
+  it('excludes interrogative / conditional sentences', () => {
+    expect(replyClaimsDispatch('Want me to dispatch a worker?')).toBe(false)
+    expect(replyClaimsDispatch('I could dispatch a reviewer if you like.')).toBe(false)
+    expect(replyClaimsDispatch('Should I spin up a worker for this?')).toBe(false)
+  })
+
+  it('excludes pure past-tense references', () => {
+    expect(replyClaimsDispatch('The worker I dispatched earlier is done.')).toBe(false)
+    expect(replyClaimsDispatch('I launched a reviewer last turn.')).toBe(false)
+  })
+
+  it('ignores unrelated prose and bare silent markers', () => {
+    expect(replyClaimsDispatch('The fix is a null-deref guard on line 12.')).toBe(false)
+    expect(replyClaimsDispatch('NO_REPLY')).toBe(false)
+    expect(replyClaimsDispatch('')).toBe(false)
+  })
+
+  it('scopes conditional exclusion to the sentence carrying the verb', () => {
+    // First sentence is a real commitment; a later unrelated question must
+    // not amnesty it.
+    expect(
+      replyClaimsDispatch('Dispatching a worker now. Anything else you need?'),
+    ).toBe(true)
+  })
+})
+
+// ── (h) retry budget: exactly one re-prompt per turn ────────────────
+
+describe('applyRetryBudget — exactly one re-prompt per turn', () => {
+  const sig = turnSignature(ENQUEUE)
+
+  it('(h) blocks on the first Stop, then fails open on the second same-turn Stop', () => {
+    const first = applyRetryBudget({}, sig, 1)
+    expect(first.block).toBe(true)
+    expect(first.nextState?.retryCount).toBe(1)
+    expect(first.nextState?.turnSig).toBe(sig)
+
+    // Second Stop fire on the SAME turn reads back the persisted state.
+    const second = applyRetryBudget(first.nextState, sig, 1)
+    expect(second.block).toBe(false)
+  })
+
+  it('resets the budget for a genuinely new turn (different signature)', () => {
+    const spent = { turnSig: sig, retryCount: 1 }
+    const newTurn = applyRetryBudget(spent, turnSignature('a different inbound'), 1)
+    expect(newTurn.block).toBe(true)
+    expect(newTurn.nextState?.retryCount).toBe(1)
+  })
+
+  it('tolerates a null / corrupt prior state', () => {
+    expect(applyRetryBudget(null, sig, 1).block).toBe(true)
+    expect(applyRetryBudget(undefined, sig, 1).block).toBe(true)
+  })
+})

package/telegram-plugin/tests/flood-breaker-blindness.test.ts

@@ -0,0 +1,213 @@
+/**
+ * #3106 — a permissions error must not silently blind the flood breaker.
+ *
+ * The bug: `readFloodState` swallowed EVERY error and returned `null`, so an
+ * unreadable marker (EACCES) was indistinguishable from "no marker" — the
+ * probe reported "no flood window" forever and every flood protection we ship
+ * (#2923 boot-card suppression, #3084/#3094 pre-call short-circuit, #3097
+ * typing suppression) failed open SILENTLY. A restart would then post a boot
+ * card straight into an open ban.
+ *
+ * Two behaviours pull in OPPOSITE directions and both are pinned here:
+ *
+ *   - ABSENT / CORRUPT marker → still fails OPEN everywhere. A junk state file
+ *     must never become a silent gag (#3094's deliberate posture).
+ *   - UNREADABLE marker → the breaker is BLIND. Essential sends still proceed
+ *     (fail-open, so a chmod accident can never mute the agent), but it says so
+ *     LOUDLY, and non-essential sends (boot card, typing) are held back rather
+ *     than fired into a ban we cannot rule out.
+ *
+ * All paths are under `mkdtempSync(join(tmpdir(), …))` — no production state.
+ */
+import { describe, it, expect, beforeEach, afterEach } from 'vitest'
+import {
+  mkdtempSync,
+  rmSync,
+  writeFileSync,
+  readFileSync,
+  chmodSync,
+  mkdirSync,
+  statSync,
+} from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import {
+  computeFloodWait,
+  writeFloodState,
+  readFloodStateResult,
+  makeFloodWaitProbe,
+  makeFloodWaitRecorder,
+  suppressNonEssentialSendMs,
+  nonEssentialSendSuppression,
+  resetFloodBlindLogThrottle,
+  floodStatePath,
+  FLOOD_STATE_MODE,
+} from '../flood-circuit-breaker.js'
+
+const NOW = 1_800_000_000_000
+const isRoot = typeof process.getuid === 'function' && process.getuid() === 0
+
+/**
+ * Make `path` genuinely unreadable to THIS process and prove it. Returns false
+ * when the process is root (root bypasses DAC — EACCES is unreachable), so the
+ * caller can skip rather than assert a lie.
+ */
+function makeUnreadable(path: string): boolean {
+  writeFileSync(path, JSON.stringify({ untilTs: NOW + 60_000, retryAfterSec: 60, recordedTs: NOW }))
+  chmodSync(path, 0o000)
+  if (isRoot) return false
+  try {
+    readFileSync(path, 'utf-8')
+    return false // somehow still readable — don't pretend we tested EACCES
+  } catch {
+    return true
+  }
+}
+
+describe('#3106 flood breaker — blind is not clear', () => {
+  let dir: string
+  let path: string
+  let logs: string[]
+  const log = (l: string) => {
+    logs.push(l)
+  }
+
+  beforeEach(() => {
+    dir = mkdtempSync(join(tmpdir(), 'flood-blind-'))
+    path = floodStatePath(dir)
+    logs = []
+    resetFloodBlindLogThrottle()
+  })
+  afterEach(() => {
+    try {
+      chmodSync(path, 0o644)
+    } catch {
+      /* may not exist */
+    }
+    rmSync(dir, { recursive: true, force: true })
+  })
+
+  // ---------------------------------------------------------------- classify
+
+  it('classifies absent / corrupt / unreadable as DIFFERENT things', () => {
+    expect(readFloodStateResult(path).status).toBe('absent')
+
+    writeFileSync(path, 'not json at all{{{')
+    expect(readFloodStateResult(path).status).toBe('corrupt')
+
+    writeFileSync(path, JSON.stringify({ untilTs: 'soon' }))
+    expect(readFloodStateResult(path).status).toBe('corrupt')
+
+    // A directory where the marker should be: readable-check fails with EISDIR,
+    // not ENOENT. uid-independent (works even under root) — "cannot read".
+    const d = join(dir, 'as-a-dir.json')
+    mkdirSync(d)
+    expect(readFloodStateResult(d).status).toBe('unreadable')
+  })
+
+  // ------------------------------------------------- UNREADABLE → not silent
+
+  it.skipIf(isRoot)(
+    'REGRESSION: an unreadable marker does NOT silently report "no flood window"',
+    () => {
+      expect(makeUnreadable(path)).toBe(true)
+
+      const res = readFloodStateResult(path)
+      // The bug was: status indistinguishable from absent, state null, nobody told.
+      expect(res.status).toBe('unreadable')
+      expect(res.error).toMatch(/EACCES/)
+
+      // The probe still FAILS OPEN (0 = proceed) — an essential reply to the
+      // user must never be gagged by a permissions error...
+      const probe = makeFloodWaitProbe(path, () => NOW, log)
+      expect(probe()).toBe(0)
+
+      // ...but it is no longer SILENT. That is the whole fix.
+      expect(logs.join('')).toMatch(/BLIND/)
+      expect(logs.join('')).toContain(path)
+    },
+  )
+
+  it.skipIf(isRoot)('an unreadable marker SUPPRESSES non-essential sends (boot card, typing)', () => {
+    expect(makeUnreadable(path)).toBe(true)
+
+    // The #2923/#3097 surfaces: we cannot rule out an open ban, so we do not
+    // post a restart card / typing ping into one.
+    expect(suppressNonEssentialSendMs(path, NOW, log)).toBeGreaterThan(0)
+    expect(logs.join('')).toMatch(/BLIND/)
+
+    const s = nonEssentialSendSuppression(path, NOW)
+    expect(s.suppress).toBe(true)
+    expect(s.suppress && s.reason).toBe('blind')
+  })
+
+  it.skipIf(isRoot)('the BLIND warning is throttled — a per-call probe cannot spam the log', () => {
+    expect(makeUnreadable(path)).toBe(true)
+    let t = NOW
+    const probe = makeFloodWaitProbe(path, () => t, log)
+    for (let i = 0; i < 50; i++) probe()
+    expect(logs.length).toBe(1)
+    t = NOW + 61_000
+    probe()
+    expect(logs.length).toBe(2)
+  })
+
+  // --------------------------------------------- ABSENT / CORRUPT → fail OPEN
+
+  it('an ABSENT marker fails OPEN and stays silent (no ban, nothing to say)', () => {
+    const probe = makeFloodWaitProbe(path, () => NOW, log)
+    expect(probe()).toBe(0)
+    expect(suppressNonEssentialSendMs(path, NOW, log)).toBe(0)
+    expect(nonEssentialSendSuppression(path, NOW).suppress).toBe(false)
+    expect(logs.join('')).not.toMatch(/BLIND/)
+  })
+
+  it('a CORRUPT marker still fails OPEN — a junk file must never gag the bot', () => {
+    for (const junk of ['', 'null', '{}', 'not json{{', JSON.stringify({ untilTs: 'x' })]) {
+      writeFileSync(path, junk)
+      const probe = makeFloodWaitProbe(path, () => NOW, log)
+      expect(probe()).toBe(0)
+      // Non-essential sends proceed too: corrupt is a CONTENT problem, and we
+      // deliberately do NOT let it suppress. (Contrast: unreadable, above.)
+      expect(suppressNonEssentialSendMs(path, NOW, log)).toBe(0)
+      expect(nonEssentialSendSuppression(path, NOW).suppress).toBe(false)
+    }
+  })
+
+  it('a REAL open window still suppresses (the #2923 behaviour is intact)', () => {
+    writeFloodState(path, computeFloodWait(null, 68 * 60, NOW), log)
+    const probe = makeFloodWaitProbe(path, () => NOW, log)
+    expect(probe()).toBe(68 * 60 * 1000)
+    const s = nonEssentialSendSuppression(path, NOW)
+    expect(s.suppress && s.reason).toBe('flood_wait')
+    // ...and lifts on its own.
+    expect(makeFloodWaitProbe(path, () => NOW + 68 * 60_000 + 1, log)()).toBe(0)
+  })
+
+  // ------------------------------------------------------- root cause: 0600
+
+  it('ROOT CAUSE: the marker is written 0644, readable by a sibling uid', () => {
+    writeFloodState(path, computeFloodWait(null, 60, NOW), log)
+    expect(statSync(path).mode & 0o777).toBe(FLOOD_STATE_MODE)
+    // Group/other read bits set — the whole point. At 0600 a marker created by
+    // a root gateway (`compose.ts:1967`, `root: true` agents) is unreadable to
+    // the same agent's non-root gateway forever.
+    expect(statSync(path).mode & 0o044).toBe(0o044)
+  })
+
+  it('SELF-HEAL: a pre-existing 0600 marker is chmodded back to 0644 on write', () => {
+    // Simulate the live overlord marker: created 0600 by an earlier build.
+    writeFileSync(path, JSON.stringify({ untilTs: NOW, retryAfterSec: 1, recordedTs: NOW }), {
+      mode: 0o600,
+    })
+    chmodSync(path, 0o600)
+    expect(statSync(path).mode & 0o777).toBe(0o600)
+
+    // The next observed 429 rewrites it — and heals the mode. (writeFileSync's
+    // `mode` option is ignored for an EXISTING file, so the explicit chmod is
+    // load-bearing.)
+    makeFloodWaitRecorder(path, () => NOW, log)(120)
+    expect(statSync(path).mode & 0o777).toBe(FLOOD_STATE_MODE)
+    expect(readFloodStateResult(path).status).toBe('ok')
+  })
+})