switchroom 0.18.12 → 0.18.13

package/telegram-plugin/dist/server.js

@@ -17062,6 +17062,48 @@ var init_operator_events = __esm(() => {
   cooldownMap = new Map;
 });
 
+// quota-check.ts
+var init_quota_check = () => {};
+
+// text-voice-scrub.ts
+var NULL = "\x00", FENCE_PH, INLINE_PH, HTML_CODE_PH, HTML_PRE_PH, URL_PH;
+var init_text_voice_scrub = __esm(() => {
+  FENCE_PH = `${NULL}VS_FENCE`;
+  INLINE_PH = `${NULL}VS_INLINE`;
+  HTML_CODE_PH = `${NULL}VS_HTMLCODE`;
+  HTML_PRE_PH = `${NULL}VS_HTMLPRE`;
+  URL_PH = `${NULL}VS_URL`;
+});
+
+// card-format.ts
+var init_card_format = __esm(() => {
+  init_text_voice_scrub();
+});
+
+// model-unavailable.ts
+function isTransientUpstreamSignal(text) {
+  if (typeof text !== "string" || text.length === 0)
+    return false;
+  const sample = text.length > 16384 ? text.slice(0, 16384) : text;
+  const lower = sample.toLowerCase();
+  return transientUpstreamSignals.some((s) => lower.includes(s));
+}
+var transientUpstreamSignals;
+var init_model_unavailable = __esm(() => {
+  init_quota_check();
+  init_card_format();
+  transientUpstreamSignals = [
+    "not your usage limit",
+    "not your account",
+    "not your account's",
+    "temporarily limiting requests",
+    "temporarily rate",
+    "server is temporarily",
+    "would exceed your account\u2019s rate limit",
+    "would exceed your account's rate limit"
+  ];
+});
+
 // tool-label-sidecar.ts
 import { existsSync as existsSync3, readFileSync as readFileSync2, statSync as statSync3 } from "node:fs";
 import { join as join3 } from "node:path";
@@ -17491,7 +17533,8 @@ function detectErrorInTranscriptLine(line) {
     const status = typeof obj.apiErrorStatus === "number" ? obj.apiErrorStatus : null;
     const errStr = typeof obj.error === "string" ? obj.error : "";
     const text = extractAssistantText(obj);
-    const kind2 = status === 429 ? "quota-exhausted" : classifyClaudeError({ type: errStr, status, message: text });
+    const kind2 = status === 429 ? isTransientUpstreamSignal(`${text}
+${errStr}`) ? "rate-limited" : "quota-exhausted" : classifyClaudeError({ type: errStr, status, message: text });
     return {
       kind: kind2,
       raw: obj,
@@ -17585,6 +17628,7 @@ function startSessionTail(config2) {
   const onOperatorEvent = config2.onOperatorEvent;
   log?.(`session-tail: projectsDir=${projectsDir}`);
   const sidecars = new Map;
+  const createSidecar = config2.createSidecar ?? createToolLabelSidecar;
   const stateDirForSidecar = process.env.TELEGRAM_STATE_DIR ?? null;
   function sessionIdForFile(file) {
     if (!file)
@@ -17599,7 +17643,7 @@ function startSessionTail(config2) {
     if (existing)
       return existing;
     try {
-      const s = createToolLabelSidecar({ stateDir: stateDirForSidecar, sessionId });
+      const s = createSidecar({ stateDir: stateDirForSidecar, sessionId });
       sidecars.set(sessionId, s);
       s.onLabel((toolUseId, label, toolName) => {
         rawOnEvent({ kind: "tool_label", toolUseId, label, toolName });
@@ -17610,6 +17654,17 @@ function startSessionTail(config2) {
       return null;
     }
   }
+  function stopSidecar(sessionId) {
+    if (!sessionId)
+      return;
+    const s = sidecars.get(sessionId);
+    if (!s)
+      return;
+    try {
+      s.stop();
+    } catch {}
+    sidecars.delete(sessionId);
+  }
   function decorate(ev, sessionId) {
     if (!sessionId)
       return ev;
@@ -17702,6 +17757,11 @@ function startSessionTail(config2) {
       } catch {}
       watcher = null;
     }
+    const rotatedAwaySid = sessionIdForFile(currentFile);
+    const nextSid = sessionIdForFile(file);
+    if (rotatedAwaySid != null && rotatedAwaySid !== nextSid) {
+      stopSidecar(rotatedAwaySid);
+    }
     currentFile = file;
     const prior = fileCursors.get(file);
     if (prior != null) {
@@ -17734,7 +17794,7 @@ function startSessionTail(config2) {
   const multiAgent = isMultiAgentEnabled();
   const CAP_TOOL_USE_THRESHOLD = 30;
   const subTails = new Map;
-  const IDLE_FSWATCH_TTL_MS = 5 * 60 * 1000;
+  const IDLE_FSWATCH_TTL_MS = Math.max(1000, config2.subTailIdleReapMs ?? 5 * 60 * 1000);
   function readSub(t) {
     if (stopped)
       return;
@@ -17841,6 +17901,7 @@ function startSessionTail(config2) {
           } catch {}
           t.watcher = null;
         }
+        stopSidecar(sessionIdForFile(t.file));
         subTails.delete(file);
         log?.(`session-tail: reaped idle sub ${t.agentId} (${file})`);
       }
@@ -17925,6 +17986,7 @@ function startSessionTail(config2) {
 var MAX_JSONL_LINE_BYTES, MAX_ERROR_TEXT_CHARS = 500;
 var init_session_tail = __esm(() => {
   init_operator_events();
+  init_model_unavailable();
   init_tool_label_sidecar();
   init_model_label();
   MAX_JSONL_LINE_BYTES = 2 * 1024 * 1024;

package/telegram-plugin/format.ts

@@ -71,6 +71,25 @@ export function codeSpanSafe(s: string): string {
   return s.replace(/`/g, '`​')
 }
 
+/**
+ * Make a URL safe to interpolate as the destination of a `[label](href)`
+ * inline link.
+ *
+ * In GFM / Bot API 10.1 markdown a link destination written as `(...)` is a
+ * bare destination whose parentheses must be BALANCED, or every paren must be
+ * backslash-escaped. An href containing a literal `)` (Wikipedia
+ * `..._(disambiguation)` URLs, tracking params, generated deep links) can
+ * either truncate the URL (a lone `)` closing the destination) or, if we
+ * escape only `)`, unbalance the parens and leak a literal backslash into the
+ * decoded href. The destination honours C-style backslash escapes, so escape
+ * `\` first (so we never double-escape a following escape), then BOTH `(` and
+ * `)` — the whole URL is preserved balanced and micromark decodes it back to
+ * the original href on round-trip. Bot API 10.1 lists `(`/`)` as escapable.
+ */
+export function escapeLinkHref(href: string): string {
+  return href.replace(/\\/g, '\\\\').replace(/\(/g, '\\(').replace(/\)/g, '\\)')
+}
+
 /**
  * Repair LLM-side JSON escape bungles.
  *

package/telegram-plugin/gateway/approval-hold.ts

@@ -268,12 +268,31 @@ export function createBlockedApprovalStore(
    *
    * This exists so the feature cannot silently no-op. If the shared bind is
    * missing (a container predating the volume), or auto-created root-owned, the
-   * record still lands somewhere the operator and switchroom-web can read —
-   * web mounts all of `~/.switchroom`, so both locations are reachable.
+   * record still lands somewhere the operator and switchroom-web can read.
+   *
+   * **Reachable by mount is not the same as readable, and neither is the same as
+   * READ.** That elision is a bug this comment used to paper over: it claimed
+   * "web mounts all of ~/.switchroom, so both locations are reachable" — true,
+   * and irrelevant, because the reader only ever scanned the shared dir. The
+   * fallback was written to a file nobody read (#3109). Two things must hold, and
+   * both are load-bearing: if either regresses, the record exists, the agent is
+   * held, and the dashboard still prints "No agent is blocked".
+   *
+   *   1. **Mode.** The record is written 0644 into the 0775 agent dir. Verified
+   *      live: `docker exec switchroom-web` reads a 0644 file under
+   *      `~/.switchroom/agents/<agent>/` fine and gets EACCES only on the 0600
+   *      files beside it. The FILE's mode locks web out, never the directory.
+   *   2. **The reader must LOOK here.** It now does —
+   *      `src/web/blocked-approvals-read.ts` scans the shared dir AND
+   *      `agents/<agent>/blocked-approval.json` (its `FALLBACK_RECORD_NAME`,
+   *      which must stay in sync with the filename below).
    */
   fallbackDir?: string,
 ): BlockedApprovalStore {
   const primary = join(dir, `${agent}.json`)
+  // Keep in sync with FALLBACK_RECORD_NAME in src/web/blocked-approvals-read.ts —
+  // the reader matches this filename exactly. Pinned by the fallback-contract
+  // tests in src/web/blocked-approvals.test.ts.
   const fallback = fallbackDir != null ? join(fallbackDir, 'blocked-approval.json') : null
 
   /** Where the last successful write landed — `read`/`clear` must agree with it. */

package/telegram-plugin/gateway/callback-query-handlers.ts

@@ -2534,6 +2534,18 @@ async function handleOperatorEventCallback(ctx: Context, data: string): Promise<
 // stub so any stale pinned message that fires an `auth:*` tap is
 // silently dismissed instead of crashing the gateway.
 async function handleAuthDashboardCallback(ctx: Context): Promise<void> {
+  // Strict allowFrom gate, identical to every other mutating handler in
+  // this file (handleOperatorEventCallback, the vra:/vrs:/vd:/vg: families).
+  // Its absence was a security hole: `auth:use:<label>` drives
+  // `client.setActive(label)` — a fleet-wide OAuth account swap — so an
+  // ungated handler let any tapper (e.g. a member of an admin forum/
+  // supergroup with an empty group allowFrom) swap the active account.
+  const senderId = String(ctx.from?.id ?? '')
+  const access = loadAccess()
+  if (!access.allowFrom.includes(senderId)) {
+    await ctx.answerCallbackQuery({ text: 'Not authorized.' }).catch(() => {})
+    return
+  }
   const data = ctx.callbackQuery?.data ?? ''
   const currentAgent = getMyAgentName()