switchroom 0.18.11 → 0.18.13

package/telegram-plugin/tests/mental-model-propose-resolve.test.ts

@@ -138,6 +138,129 @@ describe("resolveMentalModelProposal — APPROVE", () => {
   });
 });
 
+describe("resolveMentalModelProposal — #2975 Stage 1 rate-limit backstop", () => {
+  const NOW = 1_700_000_000_000;
+  const RETRY_AT = NOW + 55 * 60_000; // hostd's window-open time
+
+  /**
+   * Build deps whose dispatchConfigEdit yields `results` in order (one per
+   * attempt), plus a manual single-slot scheduler the test fires by hand — a
+   * mocked clock, no real timers.
+   */
+  function rateDeps(results: Array<Awaited<ReturnType<ResolveDeps["dispatchConfigEdit"]>>>) {
+    let call = 0;
+    let scheduled: { delayMs: number; fn: () => void | Promise<void> } | null = null;
+    const spies = {
+      registerPreApproval: vi.fn(),
+      clearPreApproval: vi.fn(),
+      dispatchConfigEdit: vi.fn(async () => results[Math.min(call++, results.length - 1)]!),
+      ensureModel: vi.fn(async () => {}),
+      injectInbound: vi.fn(),
+      scheduleRetry: vi.fn((delayMs: number, fn: () => void | Promise<void>) => {
+        scheduled = { delayMs, fn };
+      }),
+      editProposalCardRateWindow: vi.fn(),
+      notifyPersistFailed: vi.fn(),
+    };
+    const deps: ResolveDeps = {
+      readConfigText: () => CONFIG_NO_MODELS,
+      registerPreApproval: spies.registerPreApproval,
+      clearPreApproval: spies.clearPreApproval,
+      dispatchConfigEdit: spies.dispatchConfigEdit,
+      ensureModel: spies.ensureModel,
+      injectInbound: spies.injectInbound,
+      scheduleRetry: spies.scheduleRetry,
+      editProposalCardRateWindow: spies.editProposalCardRateWindow,
+      notifyPersistFailed: spies.notifyPersistFailed,
+      now: () => NOW,
+    };
+    return { deps, spies, fireScheduled: () => scheduled!.fn(), getScheduled: () => scheduled };
+  }
+
+  it("schedules EXACTLY ONE retry at retry_after, which persists with a byte-identical diff", async () => {
+    const { deps, spies, fireScheduled, getScheduled } = rateDeps([
+      { state: "rate_limited", reason: "config_propose_edit rate limit exceeded", retryAtMs: RETRY_AT },
+      { state: "applied" },
+    ]);
+
+    const out = await resolveMentalModelProposal("approve", pending(), "stage1", "op-42", deps);
+
+    // The turn is deferred, not lost: a single retry is scheduled at the window.
+    expect(out).toEqual({ outcome: "scheduled_retry", retryAtMs: RETRY_AT });
+    expect(spies.scheduleRetry).toHaveBeenCalledTimes(1);
+    expect(getScheduled()!.delayMs).toBe(RETRY_AT - NOW);
+    // Card flipped to the "applying at HH:MM" state so the operator sees it.
+    expect(spies.editProposalCardRateWindow).toHaveBeenCalledWith(RETRY_AT);
+    // First (rate-limited) attempt already registered+cleared its correlation.
+    expect(spies.dispatchConfigEdit).toHaveBeenCalledTimes(1);
+    const firstDiff = spies.dispatchConfigEdit.mock.calls[0][0].diff;
+    expect(spies.registerPreApproval).toHaveBeenCalledWith("coach", firstDiff);
+    // Nothing applied yet.
+    expect(spies.ensureModel).not.toHaveBeenCalled();
+    expect(spies.injectInbound).not.toHaveBeenCalled();
+
+    // Fire the ONE scheduled retry (mocked clock).
+    await fireScheduled();
+
+    // Persisted on the retry.
+    expect(spies.dispatchConfigEdit).toHaveBeenCalledTimes(2);
+    const retryDiff = spies.dispatchConfigEdit.mock.calls[1][0].diff;
+    // Forge-resistance contract: register + dispatch use IDENTICAL diff bytes,
+    // and the retry re-registers the SAME bytes as the first attempt.
+    expect(retryDiff).toBe(firstDiff);
+    expect(spies.registerPreApproval).toHaveBeenCalledTimes(2);
+    expect(spies.registerPreApproval.mock.calls[1]).toEqual(["coach", retryDiff]);
+    expect(spies.clearPreApproval).toHaveBeenCalledTimes(2);
+    // Applied: ensured + agent woken; NO loud failure.
+    expect(spies.ensureModel).toHaveBeenCalledWith(pending().spec);
+    expect(spies.injectInbound).toHaveBeenCalledTimes(1);
+    expect(spies.injectInbound.mock.calls[0][0].meta.source).toBe(
+      "mental_model_proposal_applied",
+    );
+    expect(spies.notifyPersistFailed).not.toHaveBeenCalled();
+  });
+
+  it("emits a loud operator failure when the single retry ALSO fails — and does NOT re-schedule", async () => {
+    const { deps, spies, fireScheduled } = rateDeps([
+      { state: "rate_limited", reason: "rate limit exceeded", retryAtMs: RETRY_AT },
+      { state: "error", reason: "hostd down" },
+    ]);
+
+    const out = await resolveMentalModelProposal("approve", pending(), "s", "op", deps);
+    expect(out.outcome).toBe("scheduled_retry");
+    expect(spies.scheduleRetry).toHaveBeenCalledTimes(1);
+
+    await fireScheduled();
+
+    // The retry failed: loud operator-events notification, exactly once.
+    expect(spies.notifyPersistFailed).toHaveBeenCalledTimes(1);
+    expect(spies.notifyPersistFailed.mock.calls[0][0]).toContain("hostd down");
+    // No second retry — bounded to exactly one.
+    expect(spies.scheduleRetry).toHaveBeenCalledTimes(1);
+    // Agent woken with the failed inbound; nothing ensured.
+    expect(spies.ensureModel).not.toHaveBeenCalled();
+    expect(spies.injectInbound).toHaveBeenCalledTimes(1);
+    expect(spies.injectInbound.mock.calls[0][0].meta.source).toBe(
+      "mental_model_proposal_failed",
+    );
+  });
+
+  it("with no scheduler wired, a rate-limited persist fails loudly instead of silently dropping", async () => {
+    const { deps, spies } = rateDeps([
+      { state: "rate_limited", reason: "rate limit exceeded", retryAtMs: RETRY_AT },
+    ]);
+    // Simulate a build without the Stage-1 scheduler dep.
+    delete (deps as { scheduleRetry?: unknown }).scheduleRetry;
+
+    const out = await resolveMentalModelProposal("approve", pending(), "s", "op", deps);
+    expect(out).toEqual({ outcome: "failed", reason: "rate limit exceeded" });
+    expect(spies.notifyPersistFailed).toHaveBeenCalledTimes(1);
+    expect(spies.injectInbound.mock.calls[0][0].meta.source).toBe(
+      "mental_model_proposal_failed",
+    );
+  });
+});
+
 describe("resolveMentalModelProposal — DENY writes NOTHING", () => {
   it("never reads config, builds a diff, dispatches an edit, or ensures", async () => {
     const { deps, spies } = makeDeps(CONFIG_NO_MODELS);

package/telegram-plugin/tests/missed-approvals-wiring.test.ts

@@ -37,7 +37,7 @@ describe('missed-approvals re-offer wiring (#2862)', () => {
 
   it('appends the miss at TTL auto-deny, anchored to the card origin, gated by the kill switch', () => {
     // Within the pending-permission TTL sweep block.
-    const sweep = slice(GATEWAY, 'for (const [k, v] of pendingPermissions)', 3600)
+    const sweep = slice(GATEWAY, 'sweepPermissionTtl({', 5400)
     expect(sweep).toContain('if (MISSED_APPROVAL_REOFFER_ENABLED) {')
     expect(sweep).toContain('missedApprovalsStore.add({')
     expect(sweep).toContain('const origin = v.cards[0]')

package/telegram-plugin/tests/model-command.test.ts

@@ -1359,4 +1359,18 @@ describe("isOfflineTrustedModelToken (#3042 blocker 2a)", () => {
     expect(isOfflineTrustedModelToken("sr-made-up/model")).toBe(false);
     expect(isOfflineTrustedModelToken("")).toBe(false);
   });
+
+  it("#3043 item 1: accepts case-variant aliases the live path already normalizes (OPUS, Sonnet)", () => {
+    // The live accept path lowercases (isClaudeModel / expandSrAlias) so a
+    // queued `/model OPUS` is accepted live — the persist gate must not then
+    // refuse it with the over-conservative "couldn't verify" card.
+    for (const a of MODEL_ALIASES) {
+      expect(isOfflineTrustedModelToken(a.toUpperCase())).toBe(true);
+    }
+    expect(isOfflineTrustedModelToken("OPUS")).toBe(true);
+    expect(isOfflineTrustedModelToken("Sonnet")).toBe(true);
+    // Curated sr-* alias, upper-cased, still resolves.
+    const [alias] = Object.entries(SR_MODEL_ALIASES)[0];
+    expect(isOfflineTrustedModelToken(alias.toUpperCase())).toBe(true);
+  });
 });

package/telegram-plugin/tests/operator-events-session-tail.test.ts

@@ -9,6 +9,7 @@ import { tmpdir } from 'os'
 import { join } from 'path'
 import { detectErrorInTranscriptLine, startSessionTail } from '../session-tail.js'
 import { resetAllCooldowns } from '../operator-events.js'
+import { resolveModelUnavailableFromOperatorEvent } from '../model-unavailable.js'
 
 // ─── detectErrorInTranscriptLine unit tests ───────────────────────────────────
 
@@ -155,6 +156,79 @@ describe('detectErrorInTranscriptLine — error detection', () => {
     expect(result!.detail).toContain('hit your limit')
   })
 
+  // Regression — the carrie incident (2026-07-12). Anthropic also emits a
+  // 429 for a TRANSIENT per-account burst / RPM throttle whose wording
+  // explicitly negates the account-quota reading ("would exceed your
+  // account's rate limit … not your usage limit"). That is a self-healing
+  // few-second throttle Claude Code retries internally — it must NOT be
+  // labeled quota-exhausted (which always shows the scary "model
+  // unavailable" card + drives failover). It must take the calm
+  // rate-limited path.
+  it('classifies a TRANSIENT burst 429 (explicit negation) as rate-limited, NOT quota-exhausted', () => {
+    const line = JSON.stringify({
+      type: 'assistant',
+      message: {
+        role: 'assistant',
+        model: '<synthetic>',
+        content: [
+          {
+            type: 'text',
+            text:
+              'API Error: 429 rate_limit_error This request would exceed ' +
+              "your account's rate limit. Please try again later. This is a " +
+              'short-term burst limit, not your usage limit.',
+          },
+        ],
+      },
+      error: 'rate_limit',
+      isApiErrorMessage: true,
+      apiErrorStatus: 429,
+    })
+    const result = detectErrorInTranscriptLine(line)
+    expect(result).not.toBeNull()
+    // Wording-based classification: explicit transient negation → calm path.
+    expect(result!.kind).toBe('rate-limited')
+    expect(result!.transient).toBe(true)
+    // End-to-end: the resolver must NOT produce a model-unavailable card for
+    // this kind (the calm rate-limited branch returns null on a bare burst).
+    const detection = resolveModelUnavailableFromOperatorEvent({
+      kind: result!.kind,
+      detail: result!.detail,
+    })
+    expect(detection).toBeNull()
+  })
+
+  // Guard against over-correcting: a GENUINE quota wall (no transient marker)
+  // must STILL be quota-exhausted AND still resolve to a card.
+  it('a genuine quota-wall 429 still produces the quota-exhausted card', () => {
+    const line = JSON.stringify({
+      type: 'assistant',
+      message: {
+        role: 'assistant',
+        model: '<synthetic>',
+        content: [
+          {
+            type: 'text',
+            text: "You've hit your limit · resets 8:50am (Australia/Melbourne)",
+          },
+        ],
+      },
+      error: 'rate_limit',
+      isApiErrorMessage: true,
+      apiErrorStatus: 429,
+    })
+    const result = detectErrorInTranscriptLine(line)
+    expect(result).not.toBeNull()
+    expect(result!.kind).toBe('quota-exhausted')
+    // The quota-exhausted branch ALWAYS returns a detection (the card).
+    const detection = resolveModelUnavailableFromOperatorEvent({
+      kind: result!.kind,
+      detail: result!.detail,
+    })
+    expect(detection).not.toBeNull()
+    expect(detection!.kind).toBe('quota_exhausted')
+  })
+
   it('still returns null for a normal (non-error) assistant message', () => {
     // No isApiErrorMessage flag → must NOT be treated as an error.
     const line = JSON.stringify({

package/telegram-plugin/tests/outbound-field-redact.test.ts

@@ -0,0 +1,107 @@
+import { describe, it, expect } from 'vitest'
+import {
+  redactAskUserFields,
+  redactChecklistFields,
+} from '../outbound-field-redact.js'
+import { redact } from '../secret-detect/redact.js'
+
+/**
+ * OUTCOME tests for the #2044 structured-payload outbound scrub (F1/F2).
+ *
+ * These exercise the exact helpers the gateway calls (redactAskUserFields
+ * for ask_user, redactChecklistFields for send_checklist / update_checklist),
+ * injecting the SAME real `redact()` the gateway's redactOutboundText wraps.
+ * The assertion is on the SENT PAYLOAD the helper returns — a secret echoed
+ * into a question, an option/button label, a checklist title, or a task's
+ * text must be masked (marker present, raw token absent) — not merely that a
+ * redactor was invoked.
+ *
+ * Secrets are assembled at runtime (per CLAUDE.md "Secrets in tests") so the
+ * source file never contains a contiguous token that trips push-protection.
+ */
+
+// A realistic GitHub classic PAT shape (ghp_ + 36 chars) — high-confidence,
+// masked by redact() to a [REDACTED:github_pat_classic] marker.
+const SECRET = 'ghp' + '_' + 'AbCdEfGhIj0123456789KlMnOpQrStUvWxYz'
+
+describe('redactAskUserFields — ask_user outbound scrub (F1)', () => {
+  it('masks a secret echoed into the QUESTION text', () => {
+    const out = redactAskUserFields(
+      `Deploy with token ${SECRET}?`,
+      ['Yes', 'No'],
+      redact,
+    )
+    expect(out.question).not.toContain(SECRET)
+    expect(out.question).toContain('[REDACTED')
+    // Non-secret prose is preserved.
+    expect(out.question).toContain('Deploy with token')
+  })
+
+  it('masks a secret echoed into an OPTION / button label', () => {
+    const out = redactAskUserFields(
+      'Which key?',
+      ['Cancel', `Use ${SECRET}`],
+      redact,
+    )
+    expect(out.options[0]).toBe('Cancel')
+    expect(out.options[1]).not.toContain(SECRET)
+    expect(out.options[1]).toContain('[REDACTED')
+  })
+
+  it('leaves clean question + options untouched', () => {
+    const out = redactAskUserFields('Proceed?', ['Yes', 'No'], redact)
+    expect(out.question).toBe('Proceed?')
+    expect(out.options).toEqual(['Yes', 'No'])
+  })
+
+  it('does not mutate the caller-supplied options array', () => {
+    const options = ['Cancel', `Use ${SECRET}`]
+    redactAskUserFields('q', options, redact)
+    expect(options[1]).toBe(`Use ${SECRET}`) // original array untouched
+  })
+})
+
+describe('redactChecklistFields — checklist outbound scrub (F2)', () => {
+  it('masks a secret in the checklist TITLE', () => {
+    const out = redactChecklistFields(
+      `Rotate ${SECRET}`,
+      [{ text: 'step one' }],
+      redact,
+    )
+    expect(out.title).not.toContain(SECRET)
+    expect(out.title).toContain('[REDACTED')
+  })
+
+  it('masks a secret in a TASK text and preserves other task fields', () => {
+    const out = redactChecklistFields(
+      'Onboarding',
+      [
+        { text: 'read the docs', done: true },
+        { text: `save ${SECRET} to vault`, id: '7' },
+      ],
+      redact,
+    )
+    expect(out.tasks![0]).toEqual({ text: 'read the docs', done: true })
+    expect(out.tasks![1]!.text).not.toContain(SECRET)
+    expect(out.tasks![1]!.text).toContain('[REDACTED')
+    // Sibling fields on the redacted task are carried through untouched.
+    expect(out.tasks![1]!.id).toBe('7')
+  })
+
+  it('passes undefined title / tasks through (update_checklist partial patch)', () => {
+    const out = redactChecklistFields(undefined, undefined, redact)
+    expect(out.title).toBeUndefined()
+    expect(out.tasks).toBeUndefined()
+  })
+
+  it('leaves an id-only task (no text) untouched', () => {
+    const out = redactChecklistFields(undefined, [{ id: '3', done: true }], redact)
+    expect(out.tasks![0]).toEqual({ id: '3', done: true })
+  })
+
+  it('does not mutate the caller-supplied task objects', () => {
+    const tasks = [{ text: `save ${SECRET}` }]
+    redactChecklistFields('t', tasks, redact)
+    expect(tasks[0]!.text).toBe(`save ${SECRET}`) // original untouched
+  })
+})

package/telegram-plugin/tests/pending-session-command.test.ts

@@ -319,4 +319,25 @@ describe('drainTakenCommands (#3042 blocker 1: an early stop must not drop the r
     await drainTakenCommands(batch(), io)
     expect(events).toEqual(['edit:model:persisted:model', 'edit:effort:persisted:effort'])
   })
+
+  it('#3021: restart-pending is snapshotted at entry → sync loop emptying pendingRestarts mid-drain still defers the SECOND command', async () => {
+    // Reproduces the turn-end idle-gate race: the drain is void-dispatched while
+    // a synchronous pendingRestarts loop empties the map right after. The first
+    // read sees the entry; by the second command the map has been emptied. A
+    // naive per-command re-check would let the second command apply live into a
+    // session ~100ms from triggerSelfRestart and falsely confirm.
+    let restartPresent = true
+    const { io, events } = makeIo({
+      // takeAll() first read latches true; the sync loop then empties the map,
+      // so every subsequent live read returns false.
+      restartPending: () => {
+        const was = restartPresent
+        restartPresent = false // the sync loop deleted the entry after dispatch
+        return was
+      },
+    })
+    await drainTakenCommands(batch(), io)
+    // BOTH commands must ride the carriers — the second must NOT apply live.
+    expect(events).toEqual(['edit:model:persisted:model', 'edit:effort:persisted:effort'])
+  })
 })

package/telegram-plugin/tests/permission-card-routing.test.ts

@@ -46,6 +46,24 @@ function onPermissionRequestBody(): string {
   return rest.slice(0, end)
 }
 
+/**
+ * Slice the body of `postPermissionCard` — THE card emitter.
+ *
+ * The send used to be inlined in `onPermissionRequest`. The #3084 follow-up
+ * extracted it here so it has two callers (the initial delivery, and the
+ * reaper's re-delivery of a card held through a flood ban). The routing
+ * contract these tests pin is unchanged; it just lives one function over, and
+ * now BOTH delivery paths inherit it — which is the point of the extraction.
+ */
+function postPermissionCardBody(): string {
+  const start = GATEWAY_SRC.indexOf('function postPermissionCard(')
+  expect(start).toBeGreaterThan(-1)
+  const rest = GATEWAY_SRC.slice(start)
+  const end = rest.indexOf('\nfunction ', 1)
+  expect(end).toBeGreaterThan(-1)
+  return rest.slice(0, end)
+}
+
 describe('permission card routing', () => {
   it('the shared target helper exists', () => {
     expect(
@@ -53,19 +71,26 @@ describe('permission card routing', () => {
     ).toBe(true)
   })
 
-  it('the initial card emitter routes via resolvePermissionCardTargets()', () => {
-    expect(onPermissionRequestBody()).toContain('resolvePermissionCardTargets()')
+  it('the card emitter routes via resolvePermissionCardTargets()', () => {
+    expect(postPermissionCardBody()).toContain('resolvePermissionCardTargets()')
   })
 
-  it('the initial card emitter no longer iterates access.allowFrom directly (the bug shape)', () => {
+  it('the card emitter no longer iterates access.allowFrom directly (the bug shape)', () => {
     // The raw fan-out loop is what sent supergroup cards to operator DMs.
-    expect(onPermissionRequestBody()).not.toMatch(
+    expect(postPermissionCardBody()).not.toMatch(
       /for\s*\(\s*const\s+chat_id\s+of\s+access\.allowFrom\s*\)/,
     )
   })
 
   it('the card send is wrapped in retryWithThreadFallback (stale-topic → thread-less, not a silent drop)', () => {
-    expect(onPermissionRequestBody()).toContain('retryWithThreadFallback')
+    expect(postPermissionCardBody()).toContain('retryWithThreadFallback')
+  })
+
+  it('the initial permission request still delivers through that one emitter', () => {
+    // Guards the extraction itself: onPermissionRequest must not regrow its own
+    // send path and drift from the re-delivery path.
+    expect(onPermissionRequestBody()).toContain('postPermissionCard(requestId, pendEntry)')
+    expect(onPermissionRequestBody()).not.toContain('retryWithThreadFallback')
   })
 
   it('the resume message uses the SAME helper, so card + resume cannot drift', () => {

package/telegram-plugin/tests/permission-no-repeat-wiring.test.ts

@@ -45,15 +45,15 @@ describe('no-repeat-on-timeout wiring', () => {
     // when Bug 2 added per-tool TTL + the timed-out keyboard-strip to this
     // block — the signature-record line now sits further down but the wiring
     // is intact.
-    const sweep = slice(GATEWAY, 'for (const [k, v] of pendingPermissions)', 3200)
+    const sweep = slice(GATEWAY, 'sweepPermissionTtl({', 5000)
     expect(sweep).toContain('timeoutDenyMessage(')
     expect(sweep).toContain('permissionTimeoutSignatures.set(')
   })
 
   it('the TTL auto-deny strips the timed-out card keyboard (Bug 2)', () => {
-    const sweep = slice(GATEWAY, 'for (const [k, v] of pendingPermissions)', 3200)
+    const sweep = slice(GATEWAY, 'sweepPermissionTtl({', 5000)
     // Per-tool TTL + keyboard-strip are both wired into the sweep.
-    expect(sweep).toContain('ttlForTool(')
+    expect(sweep).toContain('ttlForTool')
     expect(sweep).toContain('stripTimedOutPermissionCards(')
   })
 
@@ -91,14 +91,15 @@ describe('inbound gate holds while approval card is outstanding (#2841)', () =>
   // first interim reply. Without this, a new inbound delivered in that window
   // displaces the approval context and orphans the pending MCP call.
   it('turnInFlightForGate includes pendingPermissions.size > 0 on the legacy path', () => {
-    // span 1500: the function has a ~800-char comment block before the code lines.
-    const fn = slice(GATEWAY, 'function turnInFlightForGate()', 1500)
+    // span 2600: the function gained a ~1100-char note (#3084 follow-up) documenting
+    // the one case with no timeout valve — a HELD approval.
+    const fn = slice(GATEWAY, 'function turnInFlightForGate()', 2600)
     // Both paths (legacy claudeBusyKeys + machine-authoritative) must include the check.
     expect(fn).toMatch(/claudeBusyKeys\.size\s*>\s*0\s*\|\|\s*hasPendingApproval/)
   })
 
   it('turnInFlightForGate includes pendingPermissions.size > 0 on the machine path', () => {
-    const fn = slice(GATEWAY, 'function turnInFlightForGate()', 1600)
+    const fn = slice(GATEWAY, 'function turnInFlightForGate()', 2700)
     // probeGateParity(...) || hasPendingApproval — the inner arg contains its own
     // parens (isMachineInTurn()), so match the two tokens independently.
     expect(fn).toContain('probeGateParity(')
@@ -106,7 +107,7 @@ describe('inbound gate holds while approval card is outstanding (#2841)', () =>
   })
 
   it('hasPendingApproval reads pendingPermissions.size', () => {
-    const fn = slice(GATEWAY, 'function turnInFlightForGate()', 1500)
+    const fn = slice(GATEWAY, 'function turnInFlightForGate()', 2600)
     expect(fn).toMatch(/pendingPermissions\.size\s*>\s*0/)
   })
 })

package/telegram-plugin/tests/permission-rearm-wiring.test.ts

@@ -163,7 +163,7 @@ describe('gateway boot-sweep grace period', () => {
 
 describe('re-armed pending card re-holds the inbound gate (#2840)', () => {
   it('turnInFlightForGate counts pending approvals', () => {
-    const gate = slice(GATEWAY, 'function turnInFlightForGate()', 1200)
+    const gate = slice(GATEWAY, 'function turnInFlightForGate()', 2400)
     expect(gate).toMatch(/pendingPermissions\.size > 0/)
   })
   it('re-arm restores a pendingPermissions entry → gate held automatically', () => {

package/telegram-plugin/tests/pre-approval-check.test.ts

@@ -0,0 +1,148 @@
+/**
+ * #2975 Stage 2 — gateway-side read-only pre-approval predicate.
+ *
+ * `isDiffPreApproved` is what the gateway answers a hostd `check_pre_approved`
+ * query with. It MUST:
+ *   - return true ONLY for a byte-exact registered (agent, diff) pair
+ *     (mental-model proposal OR "🔁 Always allow" correlation);
+ *   - be forge-resistant: a diff differing by ONE byte from the registered one
+ *     is NOT pre-approved;
+ *   - NEVER mutate the correlation store (the single-use auto-resolve delete
+ *     stays on the real request_config_approval — a peek can't consume consent).
+ */
+
+import { describe, it, expect, vi } from "vitest";
+import { createHash } from "node:crypto";
+import {
+  isDiffPreApproved,
+  type PreApprovalCheckDeps,
+} from "../gateway/pre-approval-check.js";
+
+const AGENT = "klanker";
+const MM_DIFF =
+  "--- a/switchroom.yaml\n+++ b/switchroom.yaml\n@@ -1 +1,2 @@\n+  mental_models: [x]\n";
+const ALLOW_RULE = "Bash";
+const ALLOW_DIFF =
+  "--- a/switchroom.yaml\n+++ b/switchroom.yaml\n@@ -1 +1,2 @@\n+      - Bash\n";
+
+function mmKey(agent: string, diff: string): string {
+  return `${agent}::${createHash("sha256").update(diff).digest("hex")}`;
+}
+
+/** A Map-backed store exposing only sweep()+get(), plus spies to prove no
+ *  mutation happened (the ReadonlyCorrelationStore type has no delete/set, so
+ *  a mutating edit wouldn't even typecheck — these spies double-check sweep). */
+function makeStore(entries: Record<string, { unifiedDiff: string }>) {
+  const map = new Map(Object.entries(entries));
+  const sweep = vi.fn((_now: number) => {
+    /* no expiry in these tests */
+  });
+  return {
+    store: {
+      sweep,
+      get: (k: string) => map.get(k),
+    },
+    map,
+    sweep,
+  };
+}
+
+function makeDeps(overrides: {
+  alwaysAllow?: Record<string, { unifiedDiff: string }>;
+  mentalModel?: Record<string, { unifiedDiff: string }>;
+}): {
+  deps: PreApprovalCheckDeps;
+  aaMap: Map<string, { unifiedDiff: string }>;
+  mmMap: Map<string, { unifiedDiff: string }>;
+} {
+  const aa = makeStore(overrides.alwaysAllow ?? {});
+  const mm = makeStore(overrides.mentalModel ?? {});
+  const deps: PreApprovalCheckDeps = {
+    alwaysAllow: aa.store,
+    mentalModel: mm.store,
+    // Only recognise the ALLOW_RULE token when it appears as an added line.
+    extractAddedAllowRule: (diff) =>
+      diff.includes(`+      - ${ALLOW_RULE}`) ? ALLOW_RULE : null,
+    mentalModelCorrelationKey: mmKey,
+  };
+  return { deps, aaMap: aa.map, mmMap: mm.map };
+}
+
+describe("isDiffPreApproved — mental-model correlation", () => {
+  it("true for a byte-exact registered (agent, diff) pair", () => {
+    const { deps } = makeDeps({
+      mentalModel: { [mmKey(AGENT, MM_DIFF)]: { unifiedDiff: MM_DIFF } },
+    });
+    expect(isDiffPreApproved(AGENT, MM_DIFF, deps)).toBe(true);
+  });
+
+  it("false (forge-resistant) for a diff differing by one byte", () => {
+    const { deps } = makeDeps({
+      mentalModel: { [mmKey(AGENT, MM_DIFF)]: { unifiedDiff: MM_DIFF } },
+    });
+    // The key is derived from the tampered diff → no entry at that key; and even
+    // if an attacker could guess the key, the stored unifiedDiff wouldn't match.
+    expect(isDiffPreApproved(AGENT, MM_DIFF + " ", deps)).toBe(false);
+  });
+
+  it("false for a matching diff under a DIFFERENT agent name", () => {
+    const { deps } = makeDeps({
+      mentalModel: { [mmKey(AGENT, MM_DIFF)]: { unifiedDiff: MM_DIFF } },
+    });
+    expect(isDiffPreApproved("someone-else", MM_DIFF, deps)).toBe(false);
+  });
+
+  it("false when nothing is registered", () => {
+    const { deps } = makeDeps({});
+    expect(isDiffPreApproved(AGENT, MM_DIFF, deps)).toBe(false);
+  });
+});
+
+describe("isDiffPreApproved — always-allow correlation", () => {
+  it("true for a byte-exact registered always-allow diff", () => {
+    const { deps } = makeDeps({
+      alwaysAllow: {
+        [`${AGENT}::${ALLOW_RULE}`]: { unifiedDiff: ALLOW_DIFF },
+      },
+    });
+    expect(isDiffPreApproved(AGENT, ALLOW_DIFF, deps)).toBe(true);
+  });
+
+  it("false when the added rule token matches but the diff bytes differ (forge)", () => {
+    const { deps } = makeDeps({
+      alwaysAllow: {
+        [`${AGENT}::${ALLOW_RULE}`]: { unifiedDiff: ALLOW_DIFF },
+      },
+    });
+    // Same rule token, but the diff smuggles an extra byte → byte-match fails.
+    expect(isDiffPreApproved(AGENT, ALLOW_DIFF + "\n", deps)).toBe(false);
+  });
+});
+
+describe("isDiffPreApproved — read-only invariant", () => {
+  it("never mutates either correlation store on a match", () => {
+    const { deps, mmMap } = makeDeps({
+      mentalModel: { [mmKey(AGENT, MM_DIFF)]: { unifiedDiff: MM_DIFF } },
+    });
+    const sizeBefore = mmMap.size;
+    expect(isDiffPreApproved(AGENT, MM_DIFF, deps)).toBe(true);
+    // The matched correlation is STILL present — a peek cannot consume the
+    // single-use consent the real request_config_approval will spend later.
+    expect(mmMap.size).toBe(sizeBefore);
+    expect(mmMap.has(mmKey(AGENT, MM_DIFF))).toBe(true);
+    // A second identical query still answers true (idempotent, no consumption).
+    expect(isDiffPreApproved(AGENT, MM_DIFF, deps)).toBe(true);
+  });
+
+  it("never mutates the store on a miss", () => {
+    const { deps, aaMap, mmMap } = makeDeps({
+      alwaysAllow: {
+        [`${AGENT}::${ALLOW_RULE}`]: { unifiedDiff: ALLOW_DIFF },
+      },
+      mentalModel: { [mmKey(AGENT, MM_DIFF)]: { unifiedDiff: MM_DIFF } },
+    });
+    expect(isDiffPreApproved(AGENT, "totally-unrelated-diff", deps)).toBe(false);
+    expect(aaMap.size).toBe(1);
+    expect(mmMap.size).toBe(1);
+  });
+});