switchroom 0.18.11 → 0.18.13

package/telegram-plugin/tests/history.test.ts

@@ -542,6 +542,121 @@ describe('hasOutboundDeliveredSince', () => {
   })
 })
 
+// Review finding H5 regression: the original PRIMARY KEY (chat_id, thread_id, message_id) does
+// NOT dedupe thread-less rows because SQLite treats NULL as distinct from NULL
+// in a UNIQUE/PK index. The documented at-least-once boot replay re-records an
+// already-stored DM/non-topic message, so `INSERT OR REPLACE` appended a
+// DUPLICATE row instead of replacing — over-counting the silence / over-ping
+// detectors. The COALESCE(thread_id,'') unique index makes the upsert
+// idempotent. These tests fail (duplicate rows) without the fix.
+describe('idempotent upsert for null-thread rows (H5)', () => {
+  beforeEach(() => initHistory(stateDir, 30))
+
+  it('re-recording the same null-thread inbound yields exactly ONE row', () => {
+    const msg = {
+      chat_id: '-100',
+      thread_id: null,
+      message_id: 7,
+      user: 'alice',
+      user_id: '111',
+      ts: 1000,
+      text: 'hello',
+    }
+    // Simulate the at-least-once replay: record the same message twice.
+    recordInbound(msg)
+    recordInbound(msg)
+    const rows = query({ chat_id: '-100' })
+    expect(rows).toHaveLength(1)
+    expect(rows[0]).toMatchObject({ message_id: 7, role: 'user', text: 'hello' })
+    // The over-count surface the finding calls out must stay accurate.
+    expect(getRecentOutboundCount('-100', 999_999)).toBe(0)
+  })
+
+  it('re-recording the same null-thread outbound yields exactly ONE row', () => {
+    const now = Math.floor(Date.now() / 1000)
+    const send = {
+      chat_id: '-100',
+      thread_id: null,
+      message_ids: [42],
+      texts: ['the answer'],
+      ts: now,
+    }
+    recordOutbound(send)
+    recordOutbound(send)
+    const rows = query({ chat_id: '-100' })
+    expect(rows).toHaveLength(1)
+    // hasOutboundDeliveredSince / getRecentOutboundCount read this table; a
+    // duplicate here would double-count and over-ping.
+    expect(getRecentOutboundCount('-100', 60)).toBe(1)
+  })
+
+  it('a re-record REPLACES rather than appends (newest text wins)', () => {
+    recordInbound({ chat_id: '-100', thread_id: null, message_id: 7, user: 'a', user_id: '1', ts: 1000, text: 'first version' })
+    recordInbound({ chat_id: '-100', thread_id: null, message_id: 7, user: 'a', user_id: '1', ts: 1000, text: 'second version' })
+    const rows = query({ chat_id: '-100' })
+    expect(rows).toHaveLength(1)
+    expect(rows[0]?.text).toBe('second version')
+  })
+
+  it('a topic row and a general row with the SAME message_id stay DISTINCT', () => {
+    // Same chat_id + message_id, but one is in a forum topic (thread 5) and one
+    // is the general/DM row (null thread). These are different logical messages
+    // and must both survive — the COALESCE sentinel keeps them separate.
+    recordInbound({ chat_id: '-100', thread_id: 5, message_id: 9, user: 'a', user_id: '1', ts: 100, text: 'in topic 5' })
+    recordInbound({ chat_id: '-100', thread_id: null, message_id: 9, user: 'a', user_id: '1', ts: 100, text: 'in general' })
+    expect(query({ chat_id: '-100' })).toHaveLength(2)
+    expect(query({ chat_id: '-100', thread_id: 5 }).map(r => r.text)).toEqual(['in topic 5'])
+    expect(query({ chat_id: '-100', thread_id: null }).map(r => r.text)).toEqual(['in general'])
+  })
+
+  it('two distinct forum topics with the same message_id stay DISTINCT', () => {
+    recordInbound({ chat_id: '-100', thread_id: 5, message_id: 9, user: 'a', user_id: '1', ts: 100, text: 'topic5' })
+    recordInbound({ chat_id: '-100', thread_id: 6, message_id: 9, user: 'a', user_id: '1', ts: 100, text: 'topic6' })
+    expect(query({ chat_id: '-100' })).toHaveLength(2)
+    expect(query({ chat_id: '-100', thread_id: 5 }).map(r => r.text)).toEqual(['topic5'])
+    expect(query({ chat_id: '-100', thread_id: 6 }).map(r => r.text)).toEqual(['topic6'])
+  })
+
+  it('migration de-dupes pre-existing null-thread duplicates from a legacy DB', async () => {
+    // Simulate a DB written by the pre-fix build: insert duplicate null-thread
+    // rows DIRECTLY, bypassing the (now-fixed) upsert, to reproduce the exact
+    // corruption the finding describes. Then re-init to fire the migration.
+    const { Database } = await import('bun:sqlite')
+    const dbPath = join(stateDir, 'history.db')
+    const now = Math.floor(Date.now() / 1000) // recent ts so the retention sweep keeps them
+    _resetForTests()
+    const raw = new Database(dbPath)
+    // Drop the logical-key index so we're back to the legacy, dupe-permitting
+    // schema, then append two rows sharing the same (chat, null-thread, msg).
+    raw.exec('DROP INDEX IF EXISTS idx_messages_logical_key')
+    const insert = raw.prepare(
+      `INSERT INTO messages (chat_id, thread_id, message_id, role, user, user_id, ts, text, group_id)
+       VALUES (?, NULL, ?, 'user', 'a', '1', ?, ?, NULL)`,
+    )
+    insert.run('-100', 7, now, 'stale copy')
+    insert.run('-100', 7, now + 1, 'newest copy')
+    // A distinct topic row with the same message_id must survive the migration.
+    raw.prepare(
+      `INSERT INTO messages (chat_id, thread_id, message_id, role, user, user_id, ts, text, group_id)
+       VALUES (?, 5, ?, 'user', 'a', '1', ?, ?, NULL)`,
+    ).run('-100', 7, now, 'topic row')
+    raw.close()
+
+    // Re-open through initHistory → runs the H5 migration (dedupe + index).
+    initHistory(stateDir, 30)
+    const general = query({ chat_id: '-100', thread_id: null })
+    expect(general).toHaveLength(1)
+    expect(general[0]?.text).toBe('newest copy') // kept the newest (highest ts/rowid)
+    // The topic row with the same message_id is untouched.
+    expect(query({ chat_id: '-100', thread_id: 5 }).map(r => r.text)).toEqual(['topic row'])
+    expect(query({ chat_id: '-100' })).toHaveLength(2)
+
+    // And the upsert is idempotent going forward.
+    recordInbound({ chat_id: '-100', thread_id: null, message_id: 7, user: 'a', user_id: '1', ts: now + 2, text: 'replay' })
+    expect(query({ chat_id: '-100', thread_id: null })).toHaveLength(1)
+  })
+})
+
 describe('secret redaction at persistence (both directions)', () => {
   beforeEach(() => initHistory(stateDir, 30))
 

package/telegram-plugin/tests/idle-clear.test.ts

@@ -1,17 +1,231 @@
+/**
+ * Idle auto-clear — what "idle" MEANS.
+ *
+ * On 2026-07-11 `overlord` worked for three hours straight (sub-agents, ~25 PRs
+ * merged) and was `/clear`ed 12 s after the window elapsed — three hours of
+ * session context destroyed. Root cause: the idle window was measured from the
+ * last turn START, and nothing in a turn (tool calls, sub-agent work, the turn
+ * ENDING) counted as activity. The invariant was inverted: the longer and more
+ * productive the work, the more certain the wipe.
+ *
+ * These tests assert the OUTCOME: an agent that is doing things is not idle,
+ * and an agent that is doing nothing still gets cleared.
+ *
+ * Deterministic virtual clock only (`T + n * H`) — no fake timers, no
+ * `Date.now()`. Everything schedulable takes the clock as an argument, so the
+ * whole 3h window is exercised in microseconds and the suite stays portable if
+ * this file is ever moved to the bun runner. (It runs under vitest today: it is
+ * not in `package.json`'s `test:bun` list and not excluded in
+ * `vitest.config.ts`.)
+ */
+
 import { describe, it, expect } from 'vitest'
 import {
   decideIdleClear,
+  classifyIdleEvent,
   idleDurationToMs,
   DEFAULT_IDLE_CLEAR_MS,
   type IdleClearState,
 } from '../gateway/idle-clear.js'
 
 const H = 3_600_000
+const M = 60_000
+/** Gateway's IDLE_CLEAR_CHECK_MS default. */
+const TICK = 60_000
+
 function state(p: Partial<IdleClearState>): IdleClearState {
-  return { lastActivityAt: 0, idleClearMs: 3 * H, alreadyCleared: false, turnInFlight: false, ...p }
+  return {
+    lastActivityAt: 0,
+    lastTurnEndedAt: null,
+    idleClearMs: 3 * H,
+    alreadyCleared: false,
+    turnInFlight: false,
+    ...p,
+  }
+}
+
+/**
+ * A minimal model of the gateway's idle bookkeeping, driven by a virtual clock.
+ * Mirrors gateway.ts: `markIdleActivity()` on inbound / cron / ANY session
+ * event, `markIdleTurnEnd()` on a turn ending, `decideIdleClear()` on each
+ * IDLE_CLEAR_CHECK_MS tick, `alreadyCleared` latched on fire.
+ */
+class IdleModel {
+  lastActivityAt: number
+  lastTurnEndedAt: number | null = null
+  alreadyCleared = false
+  turnInFlight = false
+  clears: number[] = []
+
+  constructor(
+    startedAt: number,
+    readonly idleClearMs = 3 * H,
+  ) {
+    this.lastActivityAt = startedAt
+  }
+
+  /** A claude session-stream event (the gateway's handleSessionEvent stamp). */
+  sessionEvent(kind: string, now: number, durationMs?: number): void {
+    const signal = classifyIdleEvent(kind, durationMs)
+    if (signal.activity) {
+      this.lastActivityAt = now
+      this.alreadyCleared = false
+    }
+    if (signal.turnEnded) this.lastTurnEndedAt = now
+  }
+
+  /** Inbound / cron fire. */
+  activity(now: number): void {
+    this.lastActivityAt = now
+    this.alreadyCleared = false
+  }
+
+  tick(now: number): boolean {
+    const { clear } = decideIdleClear(
+      {
+        lastActivityAt: this.lastActivityAt,
+        lastTurnEndedAt: this.lastTurnEndedAt,
+        idleClearMs: this.idleClearMs,
+        alreadyCleared: this.alreadyCleared,
+        turnInFlight: this.turnInFlight,
+      },
+      now,
+    )
+    if (clear) {
+      this.alreadyCleared = true
+      this.clears.push(now)
+    }
+    return clear
+  }
+
+  /** Run the interval from `from` to `to` inclusive, one tick per TICK. */
+  ticksThrough(from: number, to: number): void {
+    for (let t = from; t <= to; t += TICK) this.tick(t)
+  }
 }
 
-describe('decideIdleClear', () => {
+describe('idle-clear: a working agent is not idle', () => {
+  it('HEADLINE — a turn that runs LONGER than the idle window is not cleared when it ends', () => {
+    // The overlord incident, replayed. Window 3h. Turn starts at T, runs 3h08m
+    // of real work (sub-agents, tool calls), ends at T+3h08m.
+    const T = 100 * H
+    const m = new IdleModel(T)
+
+    m.turnInFlight = true
+    m.sessionEvent('enqueue', T) // turn start
+
+    // ... 3h08m of work. The gate suppresses the clear while in flight.
+    m.ticksThrough(T, T + 3 * H + 8 * M)
+    expect(m.clears).toEqual([])
+
+    // Turn ends. `turnInFlight` flips false — the moment of truth.
+    const end = T + 3 * H + 8 * M
+    m.sessionEvent('turn_end', end, 11_314_000)
+    m.turnInFlight = false
+
+    // The very next tick (12 s later in production) must NOT clear...
+    expect(m.tick(end + 12_000)).toBe(false)
+    // ...nor the next several ticks, nor anything short of a full fresh window.
+    m.ticksThrough(end, end + 3 * H - TICK)
+    expect(m.clears).toEqual([])
+  })
+
+  it('in-turn work keeps the timer warm even when the gateway sees no turn boundary', () => {
+    // What ACTUALLY happened to overlord: the last turn ended at 07:05 and the
+    // agent then worked for ~3h under stop-hook continuations that opened no new
+    // turn. `turnInFlight` was false the whole time, so only the per-event stamp
+    // can save it.
+    const T = 100 * H
+    const m = new IdleModel(T)
+    m.sessionEvent('turn_end', T, 34_596) // last turn boundary
+    m.turnInFlight = false
+
+    // 3h30m of real work with no turn boundary: tool calls + sub-agent activity
+    // every ~10 min, and a tick between each.
+    for (let t = T; t <= T + 3 * H + 30 * M; t += 10 * M) {
+      m.sessionEvent('tool_use', t)
+      m.sessionEvent('sub_agent_tool_use', t + 60_000)
+      m.ticksThrough(t, t + 10 * M - TICK)
+    }
+    expect(m.clears).toEqual([])
+  })
+
+  it('every genuine session event counts as activity (sub-agents included)', () => {
+    for (const kind of [
+      'enqueue',
+      'thinking',
+      'model',
+      'tool_use',
+      'tool_result',
+      'text',
+      'sub_agent_started',
+      'sub_agent_tool_use',
+      'sub_agent_text',
+      'sub_agent_turn_end',
+    ]) {
+      expect(classifyIdleEvent(kind).activity).toBe(true)
+      expect(classifyIdleEvent(kind).turnEnded).toBe(false)
+    }
+    // A real turn_end is activity AND a turn boundary.
+    expect(classifyIdleEvent('turn_end', 5_000)).toEqual({ activity: true, turnEnded: true })
+    // The gateway's own synthetic turn_end (orphaned-reply backstop) is not the
+    // model doing something — but it still ends the turn.
+    expect(classifyIdleEvent('turn_end', -1)).toEqual({ activity: false, turnEnded: true })
+  })
+
+  it('a background sub-agent still emitting events after the main turn ends holds off the clear', () => {
+    const T = 100 * H
+    const m = new IdleModel(T)
+    m.sessionEvent('turn_end', T, 30_000)
+    m.turnInFlight = false
+    // Worker grinds for 4h past the main turn end.
+    for (let t = T; t <= T + 4 * H; t += 5 * M) {
+      m.sessionEvent('sub_agent_tool_use', t)
+      m.ticksThrough(t, t + 5 * M - TICK)
+    }
+    expect(m.clears).toEqual([])
+  })
+})
+
+describe('idle-clear: a genuinely idle agent is still cleared', () => {
+  it('no turn, no inbound, no session event for a full window → cleared exactly once', () => {
+    const T = 100 * H
+    const m = new IdleModel(T)
+    m.ticksThrough(T, T + 6 * H)
+    expect(m.clears).toEqual([T + 3 * H])
+  })
+
+  it('cleared once per idle period, and re-arms on the next inbound', () => {
+    const T = 100 * H
+    const m = new IdleModel(T)
+    m.ticksThrough(T, T + 5 * H)
+    expect(m.clears).toEqual([T + 3 * H])
+
+    const inbound = T + 5 * H
+    m.activity(inbound) // operator comes back
+    m.ticksThrough(inbound, inbound + 3 * H - TICK)
+    expect(m.clears).toEqual([T + 3 * H]) // not yet
+    m.ticksThrough(inbound, inbound + 3 * H)
+    expect(m.clears).toEqual([T + 3 * H, inbound + 3 * H])
+  })
+
+  it('a turn that ends is cleared one full window after it ended (not before)', () => {
+    const T = 100 * H
+    const m = new IdleModel(T)
+    m.turnInFlight = true
+    m.sessionEvent('enqueue', T)
+    const end = T + 3 * H + 8 * M
+    m.sessionEvent('turn_end', end, 11_314_000)
+    m.turnInFlight = false
+
+    m.ticksThrough(end, end + 3 * H - TICK)
+    expect(m.clears).toEqual([]) // still warm
+    m.ticksThrough(end, end + 3 * H + TICK)
+    expect(m.clears).toEqual([end + 3 * H]) // now genuinely idle → cleared
+  })
+})
+
+describe('decideIdleClear (pure gate)', () => {
   it('fires once the idle window has elapsed', () => {
     expect(decideIdleClear(state({ lastActivityAt: 0 }), 3 * H).clear).toBe(true)
     expect(decideIdleClear(state({ lastActivityAt: 0 }), 3 * H + 1).clear).toBe(true)
@@ -32,10 +246,26 @@ describe('decideIdleClear', () => {
   it('is disabled when idleClearMs <= 0', () => {
     expect(decideIdleClear(state({ lastActivityAt: 0, idleClearMs: 0 }), 10 * H).clear).toBe(false)
     expect(decideIdleClear(state({ lastActivityAt: 0, idleClearMs: -1 }), 10 * H).clear).toBe(false)
+    // ...even with a fresh turn end in play.
+    expect(
+      decideIdleClear(state({ lastActivityAt: 0, lastTurnEndedAt: 9 * H, idleClearMs: 0 }), 10 * H).clear,
+    ).toBe(false)
+  })
+
+  it('measures the window from max(lastActivityAt, lastTurnEndedAt)', () => {
+    // Turn started at 0 (lastActivityAt), ended at 5h. At 5h the window has long
+    // "elapsed" against the START — it must not be treated as idle.
+    const justEnded = state({ lastActivityAt: 0, lastTurnEndedAt: 5 * H })
+    expect(decideIdleClear(justEnded, 5 * H).clear).toBe(false)
+    expect(decideIdleClear(justEnded, 8 * H - 1).clear).toBe(false)
+    expect(decideIdleClear(justEnded, 8 * H).clear).toBe(true) // a full window after the END
+    // Symmetric: activity newer than the turn end wins.
+    const activeSince = state({ lastActivityAt: 6 * H, lastTurnEndedAt: 5 * H })
+    expect(decideIdleClear(activeSince, 8 * H).clear).toBe(false)
+    expect(decideIdleClear(activeSince, 9 * H).clear).toBe(true)
   })
 
   it('re-arms after activity (fresh lastActivityAt + alreadyCleared=false → waits again)', () => {
-    // Simulated: after a clear, activity resets lastActivityAt to `now` and the flag.
     const now = 100 * H
     const reArmed = state({ lastActivityAt: now, alreadyCleared: false })
     expect(decideIdleClear(reArmed, now + 3 * H - 1).clear).toBe(false) // not yet

package/telegram-plugin/tests/inbound-dedup.test.ts

@@ -0,0 +1,93 @@
+/**
+ * #2094 finding 4 — bridge-side messageId dedup.
+ *
+ * Outcome contract: a genuine user message re-delivered by the stranded-
+ * message sweep within one turn is forwarded to claude exactly ONCE; after
+ * the turn-complete clear (a successful reply for that chat) forwarding
+ * resumes. Synthetic / button / structured-event inbounds are never deduped,
+ * and per-chat memory is capped.
+ */
+import { describe, it, expect } from 'vitest'
+import {
+  InboundDedup,
+  shouldDedupInbound,
+  dedupChatKey,
+  INBOUND_DEDUP_MAX_PER_CHAT,
+  type DedupInboundLike,
+} from '../bridge/inbound-dedup.js'
+
+function userMsg(messageId: number, extra: Record<string, string> = {}): DedupInboundLike {
+  return { messageId, meta: { chat_id: '12345', message_id: String(messageId), ...extra } }
+}
+
+describe('shouldDedupInbound gate', () => {
+  it('dedups a plain user message', () => {
+    expect(shouldDedupInbound(userMsg(500))).toBe(true)
+  })
+  it('never dedups synthetic (meta.source), button, structured, or reaction inbounds', () => {
+    expect(shouldDedupInbound(userMsg(500, { source: 'cron' }))).toBe(false)
+    expect(shouldDedupInbound(userMsg(500, { button_callback: 'true' }))).toBe(false)
+    expect(shouldDedupInbound(userMsg(500, { kind: 'checklist_task_changed' }))).toBe(false)
+    expect(shouldDedupInbound(userMsg(500, { event: 'reaction' }))).toBe(false)
+  })
+  it('never dedups a non-positive messageId (no real Telegram id)', () => {
+    expect(shouldDedupInbound(userMsg(0))).toBe(false)
+    expect(shouldDedupInbound({ messageId: -1, meta: {} })).toBe(false)
+  })
+})
+
+describe('InboundDedup checkAndRecord + clearChat', () => {
+  it('processes a duplicate messageId within one turn exactly once', () => {
+    const d = new InboundDedup()
+    const key = dedupChatKey('12345')
+    expect(d.checkAndRecord(key, 500)).toBe('fresh')
+    // Sweep re-delivers the SAME messageId before the turn completes.
+    expect(d.checkAndRecord(key, 500)).toBe('duplicate')
+    expect(d.checkAndRecord(key, 500)).toBe('duplicate')
+    // A different message in the same turn is still forwarded.
+    expect(d.checkAndRecord(key, 501)).toBe('fresh')
+  })
+
+  it('resumes processing the same messageId after the turn-complete clear', () => {
+    const d = new InboundDedup()
+    const key = dedupChatKey('12345')
+    expect(d.checkAndRecord(key, 500)).toBe('fresh')
+    expect(d.checkAndRecord(key, 500)).toBe('duplicate')
+    // reply fired for the chat → turn-complete reset.
+    d.clearChat('12345')
+    expect(d.size(key)).toBe(0)
+    // A genuinely new turn may re-see the id (fresh again).
+    expect(d.checkAndRecord(key, 500)).toBe('fresh')
+  })
+
+  it('clearChat is thread-agnostic — clears every thread key for the chat', () => {
+    const d = new InboundDedup()
+    const dm = dedupChatKey('12345')
+    const topic = dedupChatKey('12345', 42)
+    d.checkAndRecord(dm, 500)
+    d.checkAndRecord(topic, 700)
+    d.checkAndRecord(dedupChatKey('999', 1), 800) // unrelated chat, untouched
+    d.clearChat('12345')
+    expect(d.size(dm)).toBe(0)
+    expect(d.size(topic)).toBe(0)
+    expect(d.size(dedupChatKey('999', 1))).toBe(1)
+  })
+
+  it('caps per-chat memory (FIFO-evicts the oldest id)', () => {
+    const d = new InboundDedup(3)
+    const key = dedupChatKey('12345')
+    d.checkAndRecord(key, 1)
+    d.checkAndRecord(key, 2)
+    d.checkAndRecord(key, 3)
+    d.checkAndRecord(key, 4) // evicts id 1
+    expect(d.size(key)).toBe(3)
+    // id 1 was evicted → treated as fresh again (bounded memory, accepted).
+    expect(d.checkAndRecord(key, 1)).toBe('fresh')
+    // ids still tracked are duplicates.
+    expect(d.checkAndRecord(key, 4)).toBe('duplicate')
+  })
+
+  it('default cap is a sane bound', () => {
+    expect(INBOUND_DEDUP_MAX_PER_CHAT).toBeGreaterThanOrEqual(128)
+  })
+})

package/telegram-plugin/tests/inbound-message-types.test.ts

@@ -206,7 +206,11 @@ describe('inbound message-type helpers: handleAckOnly + handleRefusal', () => {
     const fnStart = SRC.indexOf('async function handleAckOnly(')
     const fnSlice = SRC.slice(fnStart, fnStart + 2000)
     expect(fnSlice).toContain('gate(ctx)')
-    expect(fnSlice).toContain('setMessageReaction')
+    // #3155: the reaction now routes through the gated `sendReaction` helper
+    // (send gate + flood breaker, cosmetic) instead of a raw
+    // `bot.api.setMessageReaction`. The invariant is unchanged: it gates, THEN
+    // reacts.
+    expect(fnSlice).toContain('sendReaction(')
   })
 
   it('handleAckOnly drops non-allowlisted senders silently', () => {