switchroom 0.18.12 → 0.18.13

package/telegram-plugin/inline-keyboard-callbacks.ts

@@ -30,6 +30,7 @@
 
 import {
   validateInlineKeyboard,
+  TELEGRAM_BUTTON_LIMITS,
   type AnyButton,
   type ButtonValidationError,
 } from './telegram-button-constraints.js'
@@ -114,6 +115,99 @@ export function wrapAgentCallbacks(keyboard: AnyButton[][]): AnyButton[][] {
   )
 }
 
+/**
+ * Redact agent-authored free-text on an inline keyboard BEFORE it is sent to
+ * Telegram (#3148 fast-follow secret-scrub coverage). `wrapAgentCallbacks`
+ * rewrites only `callback_data`; the visible `text` label, the `ack_text`
+ * toast, and any `copy_text.text` clipboard payload pass through VERBATIM. An
+ * agent that puts a secret in any of those transmits it unmasked, and it
+ * resurfaces on tap — the label is echoed back (`button_text`), re-rendered in
+ * the "✅ You chose: <label>" annotation (#789), and `ack_text` is shown as the
+ * toast. `switch_inline_query` / `switch_inline_query_current_chat` /
+ * `switch_inline_query_chosen_chat.query` are also agent-authored free text
+ * that Telegram pastes into a chat's input box on tap (the current chat for
+ * the `_current_chat` variant, a user-picked chat for `_chosen_chat` — both
+ * user-visible), so they carry the same leak class. Route every one of these free-text fields
+ * through the SAME outbound redactor the reply `text` body uses, at the
+ * outbound boundary, so every downstream resurface reads already-masked bytes.
+ *
+ * `callback_data` is the routing key and is NEVER touched — redacting it would
+ * break tap round-tripping. Button structure/order is preserved; the redactor
+ * (`redact()`) only replaces detected secret byte-ranges with a non-empty
+ * marker, so it never empties a label (the non-empty-text invariant holds).
+ * Returns a fresh keyboard; does not mutate the input. `redactFn` is injected
+ * so this stays pure + unit-testable and carries no gateway import cycle.
+ *
+ * Only agent-authored keyboards flow through here (the `reply` tool path);
+ * framework-internal keyboards (approval cards, vault wizard, model menus) are
+ * built separately and are NOT redacted by this function.
+ */
+export function redactAgentKeyboard(
+  keyboard: AnyButton[][],
+  redactFn: (s: string) => string,
+): AnyButton[][] {
+  // The keyboard is validated for length BEFORE redaction, but the redaction
+  // marker (`[REDACTED:...]`) can be longer than the secret it replaces, so a
+  // field that was within a Telegram cap can exceed it after masking. An
+  // over-limit button field makes sendMessage 400 → the WHOLE reply is dropped
+  // (worse than the leak we just closed), so clamp each masked free-text field
+  // to its cap. Truncating a marker is harmless — it's already non-secret.
+  const clamp = (s: string, max: number): string =>
+    s.length > max ? s.slice(0, max) : s
+  return keyboard.map((row) =>
+    row.map((btn) => {
+      const out: AnyButton = { ...btn }
+      if (typeof out.text === 'string') {
+        out.text = clamp(redactFn(out.text), TELEGRAM_BUTTON_LIMITS.TEXT_MAX)
+      }
+      // ack_text is a switchroom-side toast (answerCallbackQuery), not a
+      // sendMessage field, so an over-length value can't drop the reply — no
+      // clamp needed, but redact it all the same.
+      if (typeof out.ack_text === 'string') out.ack_text = redactFn(out.ack_text)
+      // switch_inline_query* paste agent free text into a chat input box on tap
+      // — same leak class as the label. URL-class fields (url/web_app/login_url)
+      // are deliberately left exact: a [REDACTED] marker would corrupt a URL.
+      const siq = (out as { switch_inline_query?: unknown }).switch_inline_query
+      if (typeof siq === 'string') {
+        (out as { switch_inline_query?: string }).switch_inline_query = clamp(
+          redactFn(siq), TELEGRAM_BUTTON_LIMITS.SWITCH_INLINE_QUERY_MAX)
+      }
+      const siqc = (out as { switch_inline_query_current_chat?: unknown })
+        .switch_inline_query_current_chat
+      if (typeof siqc === 'string') {
+        (out as { switch_inline_query_current_chat?: string })
+          .switch_inline_query_current_chat = clamp(
+            redactFn(siqc), TELEGRAM_BUTTON_LIMITS.SWITCH_INLINE_QUERY_MAX)
+      }
+      // switch_inline_query_chosen_chat.query is the third variant: agent free
+      // text pasted into a user-picked chat's input box on tap — same leak class.
+      const cc = (out as { switch_inline_query_chosen_chat?: unknown })
+        .switch_inline_query_chosen_chat
+      if (cc != null && typeof cc === 'object' &&
+          typeof (cc as { query?: unknown }).query === 'string') {
+        (out as { switch_inline_query_chosen_chat?: Record<string, unknown> })
+          .switch_inline_query_chosen_chat = {
+            ...(cc as Record<string, unknown>),
+            query: clamp(
+              redactFn((cc as { query: string }).query),
+              TELEGRAM_BUTTON_LIMITS.SWITCH_INLINE_QUERY_MAX),
+          }
+      }
+      const ct = out.copy_text
+      if (ct != null && typeof ct === 'object' &&
+          typeof (ct as { text?: unknown }).text === 'string') {
+        out.copy_text = {
+          ...(ct as Record<string, unknown>),
+          text: clamp(
+            redactFn((ct as { text: string }).text),
+            TELEGRAM_BUTTON_LIMITS.COPY_TEXT_MAX),
+        }
+      }
+      return out
+    }),
+  )
+}
+
 /**
  * Extract per-button {@link AgentButtonMeta} from a raw (pre-wrap)
  * keyboard. Returns a map keyed by the raw (unprefixed) callback_data

package/telegram-plugin/model-unavailable.ts

@@ -41,6 +41,44 @@ export interface ModelUnavailableDetection {
   raw: string
 }
 
+// ─── Transient-burst signals (canonical, single source of truth) ─────────────
+
+/**
+ * Explicit markers of a TRANSIENT per-account burst / server-side throttle —
+ * a short-term RPM/burst 429 that Claude Code retries internally with backoff,
+ * NOT the 5h/7d subscription usage-limit wall. Anthropic emits these with a
+ * `rate_limit_error` whose wording explicitly NEGATES the account-quota reading
+ * ("not your usage limit" / "would exceed your account's rate limit … try again
+ * later"). Keyed on the explicit negation so a genuine wall that merely contains
+ * the word "limit" is never down-classified.
+ *
+ * Exported so `session-tail.ts` classifies a 429 by wording against THIS list
+ * rather than hand-rolling its own copy (keeps the two in sync — issue #2922).
+ */
+export const transientUpstreamSignals = [
+  'not your usage limit',
+  'not your account',
+  "not your account's",
+  'temporarily limiting requests',
+  'temporarily rate',
+  'server is temporarily',
+  'would exceed your account’s rate limit',
+  "would exceed your account's rate limit",
+]
+
+/**
+ * True when `text` carries an EXPLICIT transient-burst marker (see
+ * `transientUpstreamSignals`). Never throws on weird input. Used to keep the
+ * calm rate-limit path and the model-unavailable detector reading the same
+ * canonical signal list.
+ */
+export function isTransientUpstreamSignal(text: string): boolean {
+  if (typeof text !== 'string' || text.length === 0) return false
+  const sample = text.length > 16_384 ? text.slice(0, 16_384) : text
+  const lower = sample.toLowerCase()
+  return transientUpstreamSignals.some(s => lower.includes(s))
+}
+
 // ─── Detection ───────────────────────────────────────────────────────────────
 
 /**
@@ -77,17 +115,9 @@ export function detectModelUnavailable(
   // failover that self-cancels and leaves the turn dead. These are upstream
   // throttles Claude Code retries internally with backoff — classify them as
   // `overload` (the calm rate-limit path) BEFORE the quota substrings run, so
-  // the negation is honoured and no failover is announced.
-  const transientUpstreamSignals = [
-    'not your usage limit',
-    'not your account',
-    "not your account's",
-    'temporarily limiting requests',
-    'temporarily rate',
-    'server is temporarily',
-    'would exceed your account’s rate limit',
-    "would exceed your account's rate limit",
-  ]
+  // the negation is honoured and no failover is announced. The signal list is
+  // module-level (`transientUpstreamSignals`) so session-tail.ts classifies a
+  // 429 against the SAME canonical wording.
   if (transientUpstreamSignals.some(s => lower.includes(s))) {
     const resetAt = parseResetTime(sample)
     return resetAt !== undefined

package/telegram-plugin/outbound-field-redact.ts

@@ -0,0 +1,69 @@
+/**
+ * Structured-payload outbound redaction (#2044 coverage extension).
+ *
+ * The original #2044 outbound scrub masks agent-authored FREE TEXT on the
+ * reply / edit_message / progress_update paths (see gateway.ts
+ * `redactOutboundText`). But several other outbound surfaces carry
+ * agent-authored text to Telegram inside STRUCTURED payloads and had no
+ * redaction at all:
+ *
+ *   - ask_user      → the question text + every option/button label
+ *   - send_checklist / update_checklist → the title + every task's text
+ *
+ * An agent that echoes a token or a DATABASE_URL it just read into an
+ * ask_user question, a button label, or a checklist task would transmit it
+ * unmasked — defeating the same scrub invariant the reply `text` path
+ * honors.
+ *
+ * These helpers apply the SAME redactor to each such field. The redactor is
+ * INJECTED (the gateway passes its `redactOutboundText`; tests pass the real
+ * `redact`) so the masking is deterministic and unit-testable at the OUTCOME
+ * level: the object returned here is exactly what the downstream send call
+ * receives, so a test can assert the secret is gone from the sent payload —
+ * not merely that a redactor was invoked.
+ */
+
+/** A pure text redactor: maps input text to a masked copy. */
+export type FieldRedactor = (text: string) => string
+
+/**
+ * Redact the two agent-authored outbound fields of an ask_user prompt: the
+ * question and each option label. Returns fresh values (the input arrays are
+ * not mutated) so the caller can assign them onto the validated args.
+ */
+export function redactAskUserFields(
+  question: string,
+  options: readonly string[],
+  redact: FieldRedactor,
+): { question: string; options: string[] } {
+  return {
+    question: redact(question),
+    options: options.map((opt) => redact(opt)),
+  }
+}
+
+/** Minimal shape of a checklist task — only `text` is redacted; every other
+ *  field (id, done, …) is carried through untouched. */
+export interface ChecklistTaskLike {
+  text?: string
+  [key: string]: unknown
+}
+
+/**
+ * Redact the agent-authored outbound fields of a checklist: the title and
+ * each task's `text`. `title`/`tasks` may be undefined (update_checklist
+ * allows partial patches); undefined passes through untouched. A task whose
+ * `text` is undefined (an id-only patch) is left as-is.
+ */
+export function redactChecklistFields<T extends ChecklistTaskLike>(
+  title: string | undefined,
+  tasks: readonly T[] | undefined,
+  redact: FieldRedactor,
+): { title: string | undefined; tasks: T[] | undefined } {
+  return {
+    title: title != null ? redact(title) : title,
+    tasks: tasks?.map((task) =>
+      task.text != null ? { ...task, text: redact(task.text) } : task,
+    ),
+  }
+}

package/telegram-plugin/render/render.ts

@@ -30,7 +30,7 @@
 // equivalent entities rather than accidentally re-triggering formatting or
 // breaking out of a code span.
 
-import { escapeMarkdown, codeSpanSafe, RICH_MESSAGE_MAX_CHARS } from "../format.js";
+import { escapeMarkdown, codeSpanSafe, escapeLinkHref, RICH_MESSAGE_MAX_CHARS } from "../format.js";
 import type {
   Block,
   BlockquoteNode,
@@ -47,26 +47,44 @@ import type {
 // Inline rendering
 // ---------------------------------------------------------------------------
 
-function renderInline(node: Inline): string {
+/** Rendering context threaded through the inline walk. `inTableCell` is set
+ *  while rendering the inline content of a GFM table cell, where a literal `|`
+ *  — even inside an inline-code span — would be read as a column separator and
+ *  tear the row (F4). Plain-text `|` is already neutralised by `escapeMarkdown`
+ *  (`|` is one of its specials); the only gap is the code span, whose content
+ *  is otherwise verbatim, so we backslash-escape `|` there in the table
+ *  context. GFM strips the `\` and keeps the pipe literal inside the span. */
+interface InlineCtx {
+  inTableCell?: boolean;
+}
+
+function renderInline(node: Inline, ctx: InlineCtx = {}): string {
   switch (node.type) {
     case "plain":
       return escapeMarkdown(node.text);
     case "bold":
-      return `**${renderInlineChildren(node.children)}**`;
+      return `**${renderInlineChildren(node.children, ctx)}**`;
     case "italic":
-      return `*${renderInlineChildren(node.children)}*`;
+      return `*${renderInlineChildren(node.children, ctx)}*`;
     case "underline":
-      return `__${renderInlineChildren(node.children)}__`;
+      return `__${renderInlineChildren(node.children, ctx)}__`;
     case "strike":
-      return `~~${renderInlineChildren(node.children)}~~`;
+      return `~~${renderInlineChildren(node.children, ctx)}~~`;
     case "spoiler":
-      return `||${renderInlineChildren(node.children)}||`;
+      return `||${renderInlineChildren(node.children, ctx)}||`;
     case "highlight":
-      return `==${renderInlineChildren(node.children)}==`;
-    case "code":
-      return `\`${codeSpanSafe(node.text)}\``;
+      return `==${renderInlineChildren(node.children, ctx)}==`;
+    case "code": {
+      const safe = codeSpanSafe(node.text);
+      // In a table cell, an unescaped `|` inside the span closes the cell early
+      // and corrupts the row; `\|` survives (GFM keeps the pipe literal in the
+      // span and drops the backslash). Elsewhere the span content is verbatim.
+      return `\`${ctx.inTableCell ? safe.replace(/\|/g, "\\|") : safe}\``;
+    }
     case "link":
-      return `[${renderInlineChildren(node.children)}](${node.href})`;
+      // Escape the href so a literal `)` in the URL can't terminate the
+      // destination early and break the link (F3).
+      return `[${renderInlineChildren(node.children, ctx)}](${escapeLinkHref(node.href)})`;
     default: {
       // Exhaustiveness guard — the IR union is closed; a new variant must be
       // handled above rather than silently dropped.
@@ -76,8 +94,8 @@ function renderInline(node: Inline): string {
   }
 }
 
-function renderInlineChildren(children: Inline[]): string {
-  return children.map(renderInline).join("");
+function renderInlineChildren(children: Inline[], ctx: InlineCtx = {}): string {
+  return children.map((child) => renderInline(child, ctx)).join("");
 }
 
 // ---------------------------------------------------------------------------
@@ -154,7 +172,7 @@ function renderList(node: ListNode): string {
 /** Render a single cell's inline content for a table (no line breaks — GFM
  *  table cells can't contain them; pipes are escaped defensively). */
 function renderTableCell(cells: TableRow["cells"][number]): string {
-  return renderInlineChildren(cells.children).replace(/\n+/g, " ");
+  return renderInlineChildren(cells.children, { inTableCell: true }).replace(/\n+/g, " ");
 }
 
 function alignSeparator(align: TableNode["align"][number]): string {

package/telegram-plugin/scoped-approval.ts

@@ -307,9 +307,18 @@ export function isDestructiveBashCommand(command: string): boolean {
   if (/\b(chmod|chown|chgrp)\b[^|;&]*(\s-(-recursive|[a-z]*r[a-z]*)\b)/.test(c)) return true;
   // redirection clobbering devices or system dirs
   if (/>\s*\/(dev|etc|boot|sys|proc)\b/.test(c)) return true;
-  // destructive git
+  // destructive git — discards or rewrites history / working-tree state.
+  //   checkout: `-f`/`--force` (force-overwrite), `git checkout .` / `./`
+  //     / `./<path>` (path-restore of the whole tree or a subtree) and
+  //     `checkout … -- <path>` all discard uncommitted work. A plain
+  //     `git checkout <branch>` (branch switch, reversible) is deliberately
+  //     NOT flagged. NOTE: a bare single-path discard without `--`
+  //     (`git checkout src/x.ts`) is syntactically ambiguous with a branch
+  //     name and is a known uncaught form — not full coverage.
+  //   stash: `drop`/`clear`/`pop` remove stash state irreversibly
+  //     (`stash`/`list`/`show`/`apply` keep it and stay unflagged).
   if (/\bgit\b/.test(c) &&
-      /(push\b[^|;&]*(--force|-f\b|--force-with-lease)|push\s+[^\s]*\s+\+|reset\s+--hard|clean\s+-[a-z]*[fd]|filter-branch|reflog\s+expire|update-ref\s+-d|branch\s+-d{1,2}\b|checkout\s+--\s|restore\b)/.test(c)) return true;
+      /(push\b[^|;&]*(--force|-f\b|--force-with-lease)|push\s+[^\s]*\s+\+|reset\s+--hard|clean\s+-[a-z]*[fd]|filter-branch|reflog\s+expire|update-ref\s+-d|branch\s+-d{1,2}\b|checkout\b[^|;&]*(\s-f\b|\s--force\b|\s--(\s|$)|\s\.(\s|$|\/))|stash\s+(drop|clear|pop)\b|restore\b)/.test(c)) return true;
   // power / process control
   if (/(^|\s|;|&&|\|\||\()(shutdown|reboot|halt|poweroff|kill|killall|pkill)\b/.test(c)) return true;
   if (/(^|\s)init\s+0\b/.test(c)) return true;

package/telegram-plugin/secret-detect/chunker.ts

@@ -1,13 +1,21 @@
 /**
  * Sliding-window chunker for ReDoS-bounded detection.
  *
- * Inputs larger than 32 KB are split into 16 KB windows with 1 KB overlap.
+ * Inputs larger than 32 KB are split into 16 KB windows with 8 KB overlap.
  * Each window is scanned independently; the caller is responsible for
  * dedupe-by-byte-offset when merging per-window hits back together.
  *
  * The overlap exists so a secret that straddles a window boundary is still
- * matched by at least one scan (provided the secret is ≤ 1 KB, which covers
- * every known token format plus typical PEM private keys).
+ * fully contained in at least one scan. The guarantee is exact: a secret is
+ * only missed if its length EXCEEDS the overlap (if length ≤ OVERLAP, a
+ * boundary-straddling secret is wholly inside the next window, which starts
+ * OVERLAP bytes before the boundary). The old 1 KB overlap was smaller than
+ * a real PEM private key — a 4096-bit RSA key in PEM armor is ~3.2 KB, so a
+ * boundary-straddling RSA key in a >32 KB payload slipped through unmasked
+ * (2026-07 secret-scrub review, tp-support F2). At 8 KB the overlap clears
+ * a 4096-bit RSA PEM (~3.2 KB) with >2x margin and also covers larger EC /
+ * certificate blobs. Cost: windows advance by WINDOW_SIZE−OVERLAP = 8 KB,
+ * so a big payload is scanned in ~2x as many windows — bounded and cheap.
  */
 
 export interface Window {
@@ -19,7 +27,13 @@ export interface Window {
 
 export const CHUNK_THRESHOLD = 32 * 1024
 export const WINDOW_SIZE = 16 * 1024
-export const OVERLAP = 1024
+/**
+ * 8 KB. MUST be ≥ the largest secret we need to catch across a window
+ * boundary; a 4096-bit RSA private key in PEM armor is ~3.2 KB, so this
+ * clears it with >2x headroom. See the module header for the exact
+ * "missed only if secret length > OVERLAP" guarantee.
+ */
+export const OVERLAP = 8 * 1024
 
 export function chunk(text: string): Window[] {
   if (text.length <= CHUNK_THRESHOLD) {

package/telegram-plugin/secret-detect/index.ts

@@ -11,17 +11,23 @@
  *      PEM blocks, CLI flags)
  *   3. KEY=VALUE heuristic with Shannon-entropy gate (≥ 4.0)
  *
- * Big inputs (>32 KB) are chunked into 16 KB windows with 1 KB overlap
- * (chunker.ts) for ReDoS bounding; we dedupe by byte-offset after.
+ * Big inputs (>32 KB) are chunked into 16 KB windows with 8 KB overlap
+ * (chunker.ts) for ReDoS bounding; we dedupe by byte-offset after. The
+ * overlap must exceed the largest single secret (an 8192-bit RSA PEM is
+ * ~6.5 KB) so a boundary-straddling key is never split across windows.
  *
  * Nearby test/mock/example/fixture/dummy markers (within 40 chars) demote
  * a hit to `suppressed: true`. The caller decides what that means (our
  * convention: suppressed high-confidence → ambiguous, user is asked).
  *
- * Secretlint is integrated as an async supplementary source via
- * `detectSecretsAsync`. The sync `detectSecrets` keeps the fast vendored-
- * pattern path for callers on the hot path (Telegram message ingest).
- * Gitleaks TOML is loaded via `gitleaks-loader.ts`.
+ * Detection is vendored-patterns-only and synchronous: every live caller
+ * (inbound gate, outbound scrub, `redact.ts`, `pipeline.ts`) runs
+ * `detectSecrets`. There is deliberately NO Secretlint/async "safety net"
+ * layered underneath — an earlier `detectSecretsAsync` + Secretlint wrapper
+ * was never wired into any live path (test-only), so it was a false safety
+ * net and has been removed (2026-07 secret-scrub review, tp-support F1).
+ * Arming a new async scanner belongs in its own validated change, not the
+ * scrub-coverage PR. Gitleaks TOML is loaded via `gitleaks-loader.ts`.
  */
 import { ALL_PATTERNS } from './patterns.js'
 import { scanKeyValue, type RawHit } from './kv-scanner.js'
@@ -209,53 +215,3 @@ function dropOverlaps(hits: RawHit[]): RawHit[] {
 export { maskToken } from './mask.js'
 export { redactUrls } from './url-redact.js'
 export { deriveSlug } from './slug.js'
-export { detectViaSecretlint } from './secretlint-source.js'
-
-/**
- * Async detection pipeline — runs `detectSecrets` (fast vendored engine)
- * and Secretlint in parallel, then merges the results by deduping on
- * `[start, end)` byte ranges. If Secretlint and a vendored pattern both
- * match the same span, the first one wins (vendored, since it's listed
- * first in the merge array below).
- *
- * Slug collisions are re-resolved on the merged list so the overall
- * output has unique `suggested_slug` values.
- */
-export async function detectSecretsAsync(text: string): Promise<Detection[]> {
-  if (!text || text.length === 0) return []
-  const [vendored, viaSecretlint] = await Promise.all([
-    Promise.resolve(detectSecrets(text)),
-    // Lazy-import keeps the sync `detectSecrets` path free of Secretlint
-    // initialization cost; paid once on first async call.
-    import('./secretlint-source.js').then((m) => m.detectViaSecretlint(text)),
-  ])
-
-  // Merge with range-based dedupe. On an exact-range tie, prefer the
-  // higher-confidence detection (else vendored-first). This matters since
-  // the vendored generic high-entropy fallback emits `ambiguous` — without
-  // the confidence tie-break it would shadow a Secretlint `high` provider
-  // hit on the same span and silently downgrade it (mirrors the sync
-  // dedupeRaw's high-over-ambiguous rule).
-  const seen = new Map<string, Detection>()
-  const consider = (d: Detection): void => {
-    const key = `${d.start}:${d.end}`
-    const existing = seen.get(key)
-    if (!existing || (existing.confidence === 'ambiguous' && d.confidence === 'high')) {
-      seen.set(key, d)
-    }
-  }
-  for (const d of vendored) consider(d)
-  for (const d of viaSecretlint) consider(d)
-
-  // Re-derive slugs against the merged set (Secretlint and vendored each
-  // had independent `existing` sets; we coalesce here).
-  const existing = new Set<string>()
-  const out: Detection[] = Array.from(seen.values())
-    .sort((a, b) => a.start - b.start)
-    .map((d) => {
-      const slug = deriveSlug({ key_name: d.key_name, rule_id: d.rule_id }, existing)
-      existing.add(slug)
-      return { ...d, suggested_slug: slug }
-    })
-  return out
-}

package/telegram-plugin/send-gate-degraded.test.ts

@@ -405,6 +405,137 @@ describe('send-gate PR2: M2 critical wait re-evaluates the window each iteration
   })
 })
 
+describe('send-gate F4: a CRITICAL edit honours the fail-fast ceiling (no unbounded block)', () => {
+  it('fails fast with a structured FLOOD_WAIT_ACTIVE instead of blocking unbounded on the edit driver', async () => {
+    const clock = new FakeClock()
+    const { calls, fn } = recorder(clock)
+    const gate = createSendGate({
+      enabled: true,
+      clock,
+      criticalFailFastMs: 60_000,
+      // 10-minute ban >> the 60s ceiling. On the pre-fix edit path this window
+      // routed a `critical` card edit through the driver's UNBOUNDED admit and
+      // blocked for the whole ban; the fix must fail fast like the non-edit path.
+      initialWindows: [{ scopeKey: 'global', untilTs: 600_000 }],
+    })
+
+    let caught: unknown
+    try {
+      // messageId + editPayload → edit path; priorityClass:'critical' is the case
+      // handleEdit previously ignored (only 'cosmetic' was special-cased).
+      await gate.gate(fn('critical-edit'), {
+        messageId: 42,
+        editPayload: 'v1',
+        priorityClass: 'critical',
+      })
+    } catch (err) {
+      caught = err
+    }
+
+    // Fail fast (structured flood-wait), NOT an unbounded block that never
+    // settles — the multi-hour reply wedge the send-gate exists to eliminate.
+    expect(isFloodWaitActiveError(caught)).toBe(true)
+    const e = caught as { untilTs: number; retryAfterSec: number; error_code: number }
+    expect(e.error_code).toBe(429)
+    expect(e.untilTs).toBe(600_000)
+    expect(e.retryAfterSec).toBe(600)
+    expect(calls).toHaveLength(0) // never probed the API
+    expect(gate.stats().global.failedFast).toBe(1)
+    expect(gate.stats().global.sent).toBe(0)
+  })
+
+  it('waits out a SHORT window (<= ceiling) then sends the critical edit — mirrors the non-edit path', async () => {
+    const clock = new FakeClock()
+    const { calls, fn } = recorder(clock)
+    const gate = createSendGate({
+      enabled: true,
+      clock,
+      criticalFailFastMs: 60_000,
+      // 30s window, under the 60s ceiling → the critical edit waits it out and
+      // then sends (not shed, not failed fast).
+      initialWindows: [{ scopeKey: 'global', untilTs: 30_000 }],
+    })
+
+    const p = gate.gate(fn('critical-edit'), {
+      messageId: 7,
+      editPayload: 'v1',
+      priorityClass: 'critical',
+    })
+    await clock.advance(31_000)
+    const res = await p
+
+    expect(res).toBe('critical-edit')
+    expect(calls).toHaveLength(1)
+    expect(calls[0]!.at).toBeGreaterThanOrEqual(30_000)
+    expect(gate.stats().global.failedFast).toBe(0)
+    expect(gate.stats().global.sent).toBe(1)
+  })
+})
+
+describe('send-gate F2: a CRITICAL edit coalescing onto a non-critical driver still fail-fasts', () => {
+  it('a critical edit that coalesces onto a running useful driver rejects FLOOD_WAIT_ACTIVE (does NOT ride the unbounded admit)', async () => {
+    const clock = new FakeClock()
+    const { calls, fn } = recorder(clock)
+    const gate = createSendGate({
+      enabled: true,
+      clock,
+      criticalFailFastMs: 60_000,
+      // Large edit floor so a queued useful edit SITS in the driver's floor
+      // sleep long enough for a later critical edit to coalesce onto it BEFORE
+      // the driver dequeues — the exact race the fix closes.
+      editFloorMs: 10_000,
+    })
+
+    // 1. Warm the message so its edit floor is armed (a cold message would fire
+    //    the first edit at t=0 with no floor sleep, leaving no window to coalesce
+    //    into). This send happens BEFORE any ban.
+    const pWarm = gate.gate(fn('warm'), { messageId: 42, editPayload: 'warm' })
+    await flush()
+    await pWarm
+    expect(calls.map((c) => c.label)).toEqual(['warm'])
+
+    // 2. A 10-minute flood ban (>> the 60s ceiling) opens on the global scope.
+    gate.openFloodWindow('global', 600_000)
+
+    // 3. A USEFUL edit to the same message starts the driver and enters the
+    //    floor sleep (floor not yet cleared). It is NOT critical, so the
+    //    driver-start opts capture priorityClass='useful'.
+    const pUseful = gate
+      .gate(fn('useful'), { messageId: 42, editPayload: 'u', priorityClass: 'useful' })
+      .catch((e) => e)
+    await flush()
+
+    // 4. A CRITICAL edit to the SAME message arrives mid-ban and COALESCES onto
+    //    the pending useful edit (shared promise). With the driver-start-opts
+    //    bug this critical work rode the unbounded admit and blocked for the
+    //    whole 10-minute ban; the fix upgrades the pending edit's priority so
+    //    the driver reads `critical` and fails fast.
+    const pCritical = gate
+      .gate(fn('critical'), { messageId: 42, editPayload: 'c', priorityClass: 'critical' })
+      .catch((e) => e)
+    await flush()
+
+    // 5. Walk PAST the edit floor but NOT past the ban. On the fixed code the
+    //    driver wakes, sees the coalesced critical class, and fails fast.
+    await clock.advance(10_001)
+
+    const caughtCritical = await pCritical
+    const caughtUseful = await pUseful
+
+    // The coalesced (shared) promise rejects with a structured flood-wait —
+    // it did NOT block unbounded for the remaining ~10 minutes of the ban.
+    expect(isFloodWaitActiveError(caughtCritical)).toBe(true)
+    expect(isFloodWaitActiveError(caughtUseful)).toBe(true)
+    const e = caughtCritical as { untilTs: number; retryAfterSec: number; error_code: number }
+    expect(e.error_code).toBe(429)
+    expect(e.untilTs).toBe(600_000)
+    // Only the warm edit ever probed the API; the coalesced edit never did.
+    expect(calls.map((c) => c.label)).toEqual(['warm'])
+    expect(gate.stats().global.failedFast).toBe(1)
+    expect(gate.stats().global.sent).toBe(1)
+  })
+})
+
 describe('send-gate PR2: opening a window from a 429, and persistence hook', () => {
   it('opens scope windows via onWindowOpen when a non-edit send throws FLOOD_WAIT_ACTIVE', async () => {
     const clock = new FakeClock()

package/telegram-plugin/send-gate.test.ts

@@ -87,15 +87,34 @@ describe('send-gate: feature flag', () => {
     expect(calls.map((c) => c.label)).toEqual(['v1', 'v2'])
   })
 
-  it('sendGateEnabledFromEnv follows the SWITCHROOM_*=== "1" convention', () => {
-    expect(sendGateEnabledFromEnv({} as NodeJS.ProcessEnv)).toBe(false)
+  it('sendGateEnabledFromEnv is ON BY DEFAULT (escape hatch, not opt-in)', () => {
+    // Unset → enabled. This assertion is load-bearing: it fails if the default
+    // is ever flipped back to off.
+    expect(sendGateEnabledFromEnv({} as NodeJS.ProcessEnv)).toBe(true)
     expect(
-      sendGateEnabledFromEnv({ SWITCHROOM_TELEGRAM_SEND_GATE: '0' } as unknown as NodeJS.ProcessEnv),
-    ).toBe(false)
-    expect(
-      sendGateEnabledFromEnv({ SWITCHROOM_TELEGRAM_SEND_GATE: '1' } as unknown as NodeJS.ProcessEnv),
+      sendGateEnabledFromEnv({ SWITCHROOM_TELEGRAM_SEND_GATE: undefined } as NodeJS.ProcessEnv),
     ).toBe(true)
   })
+
+  it('sendGateEnabledFromEnv disables only on explicit off values (safety valve)', () => {
+    for (const off of ['0', 'false', 'off', 'no', 'FALSE', 'Off', ' no ', '  0 ']) {
+      expect(
+        sendGateEnabledFromEnv({
+          SWITCHROOM_TELEGRAM_SEND_GATE: off,
+        } as unknown as NodeJS.ProcessEnv),
+      ).toBe(false)
+    }
+  })
+
+  it('sendGateEnabledFromEnv stays enabled for any other value', () => {
+    for (const on of ['1', 'true', 'on', 'yes', 'enabled', '', 'anything']) {
+      expect(
+        sendGateEnabledFromEnv({
+          SWITCHROOM_TELEGRAM_SEND_GATE: on,
+        } as unknown as NodeJS.ProcessEnv),
+      ).toBe(true)
+    }
+  })
 })
 
 describe('send-gate: global bucket', () => {