switchroom 0.18.12 → 0.18.14

package/telegram-plugin/tests/forward-origin.test.ts

@@ -0,0 +1,309 @@
+/**
+ * Unit tests for the forwarded-message origin helpers
+ * (telegram-plugin/gateway/forward-origin.ts).
+ *
+ * These pin the pure pieces of the forward-origin metadata path that live
+ * outside gateway.ts so they can be exercised without loadAccess()/IPC:
+ *   1. parseForwardOrigin — all four Bot API 7.0 origin shapes, missing
+ *      fields, hostile (attacker-controlled) names, hidden_user marking.
+ *   2. buildForwardOriginMeta — fixed attribute order, XML escaping at the
+ *      channel-meta boundary, numbered `_2..` siblings for multi-origin
+ *      bursts (same convention as image_path_2 / attachment_file_id_2).
+ *   3. dedupeForwardOrigins — the coalescer's burst collapse: a
+ *      single-origin album emits one attr set; distinct origins keep
+ *      arrival order and get numbered.
+ *
+ * Trust model under test: origin info rides the ATTRS lane only, names are
+ * truncated + escaped (they're attacker-controlled), and hidden_user is
+ * explicitly marked so agents don't treat a self-reported display name as
+ * an authenticated identity.
+ */
+
+import { describe, expect, it } from 'vitest'
+import type { MessageOrigin } from 'grammy/types'
+import {
+  parseForwardOrigin,
+  buildForwardOriginMeta,
+  dedupeForwardOrigins,
+  forwardOriginKey,
+  forwardOriginDateIso,
+  FORWARDED_FROM_NAME_MAX,
+  type ForwardOriginInfo,
+} from '../gateway/forward-origin.js'
+
+// Synthetic fixtures only — no real Telegram ids/names (check-no-pii-secrets).
+const DATE = 1750000000 // unix seconds
+const DATE_ISO = new Date(DATE * 1000).toISOString()
+
+function userOrigin(overrides: Partial<{
+  first_name: string
+  last_name?: string
+  username?: string
+  id: number
+}> = {}): MessageOrigin {
+  return {
+    type: 'user',
+    date: DATE,
+    sender_user: {
+      id: 42,
+      is_bot: false,
+      first_name: 'Ada',
+      last_name: 'Lovelace',
+      username: 'adalove',
+      ...overrides,
+    },
+  }
+}
+
+describe('parseForwardOrigin — the four origin shapes', () => {
+  it('user: first + last name plus (@username), id and date captured', () => {
+    const info = parseForwardOrigin(userOrigin())
+    expect(info).toEqual({
+      name: 'Ada Lovelace (@adalove)',
+      type: 'user',
+      id: 42,
+      date: DATE,
+    })
+  })
+
+  it('user: first name only, no username', () => {
+    const info = parseForwardOrigin(userOrigin({ last_name: undefined, username: undefined }))
+    expect(info?.name).toBe('Ada')
+    expect(info?.id).toBe(42)
+  })
+
+  it('hidden_user: self-reported name, marked hidden_user, NO id', () => {
+    const info = parseForwardOrigin({
+      type: 'hidden_user',
+      date: DATE,
+      sender_user_name: 'Mystery Sender',
+    })
+    expect(info).toEqual({
+      name: 'Mystery Sender',
+      type: 'hidden_user',
+      date: DATE,
+    })
+    // The whole point of the type marker: no verifiable id exists.
+    expect(info?.id).toBeUndefined()
+  })
+
+  it('chat: sender_chat title plus (@username)', () => {
+    const info = parseForwardOrigin({
+      type: 'chat',
+      date: DATE,
+      sender_chat: { id: -100200300, type: 'supergroup', title: 'Ops Room', username: 'opsroom' } as never,
+    })
+    expect(info).toEqual({
+      name: 'Ops Room (@opsroom)',
+      type: 'chat',
+      id: -100200300,
+      date: DATE,
+    })
+  })
+
+  it('channel: chat.title plus (@username), message_id captured', () => {
+    const info = parseForwardOrigin({
+      type: 'channel',
+      date: DATE,
+      message_id: 555,
+      chat: { id: -100400500, type: 'channel', title: 'Release Notes', username: 'relnotes' } as never,
+    })
+    expect(info).toEqual({
+      name: 'Release Notes (@relnotes)',
+      type: 'channel',
+      id: -100400500,
+      date: DATE,
+      messageId: 555,
+    })
+  })
+})
+
+describe('parseForwardOrigin — missing / malformed fields', () => {
+  it('returns undefined for a non-forwarded message (no origin)', () => {
+    expect(parseForwardOrigin(undefined)).toBeUndefined()
+  })
+
+  it('returns undefined for an unknown future origin type', () => {
+    expect(parseForwardOrigin({ type: 'giveaway', date: DATE } as never)).toBeUndefined()
+  })
+
+  it('user origin without sender_user is dropped', () => {
+    expect(parseForwardOrigin({ type: 'user', date: DATE } as never)).toBeUndefined()
+  })
+
+  it('hidden_user with an empty name is dropped (nothing to show)', () => {
+    expect(
+      parseForwardOrigin({ type: 'hidden_user', date: DATE, sender_user_name: '' }),
+    ).toBeUndefined()
+  })
+
+  it('user with no printable name falls back to the numeric id as name', () => {
+    const info = parseForwardOrigin({
+      type: 'user',
+      date: DATE,
+      sender_user: { id: 42, is_bot: false, first_name: '' },
+    })
+    expect(info).toEqual({ name: '42', type: 'user', id: 42, date: DATE })
+  })
+
+  it('missing date yields no date (and later no forwarded_date attr)', () => {
+    const info = parseForwardOrigin({
+      type: 'hidden_user',
+      sender_user_name: 'Mystery Sender',
+    } as never)
+    expect(info?.date).toBeUndefined()
+    expect(buildForwardOriginMeta([info!]).forwarded_date).toBeUndefined()
+    expect(forwardOriginDateIso(info)).toBeNull()
+  })
+
+  it('channel origin without a title falls back to first/last name shape, then id', () => {
+    const noName = parseForwardOrigin({
+      type: 'channel',
+      date: DATE,
+      message_id: 9,
+      chat: { id: -100777888, type: 'channel' } as never,
+    })
+    expect(noName).toEqual({
+      name: '-100777888',
+      type: 'channel',
+      id: -100777888,
+      date: DATE,
+      messageId: 9,
+    })
+  })
+})
+
+describe('parseForwardOrigin — hostile names (attacker-controlled)', () => {
+  it('truncates a 4KB name to the cap (raw, ellipsis-terminated)', () => {
+    const bomb = 'x'.repeat(4096)
+    const info = parseForwardOrigin(userOrigin({ first_name: bomb, last_name: undefined, username: undefined }))
+    expect(info?.name).toHaveLength(FORWARDED_FROM_NAME_MAX)
+    expect(info?.name?.endsWith('…')).toBe(true)
+  })
+
+  it('keeps XML metacharacters RAW in the parsed record (SQLite lane)', () => {
+    const info = parseForwardOrigin(
+      userOrigin({ first_name: '<b>"Bob"&\'friends\'</b>', last_name: undefined, username: undefined }),
+    )
+    // Escaping happens at the channel-meta boundary, not at parse time —
+    // the history buffer stores what the user actually saw.
+    expect(info?.name).toBe('<b>"Bob"&\'friends\'</b>')
+  })
+})
+
+describe('buildForwardOriginMeta — channel-tag attrs', () => {
+  it('single origin: bare keys in the fixed order name, type, id, date', () => {
+    const meta = buildForwardOriginMeta([parseForwardOrigin(userOrigin())!])
+    expect(Object.keys(meta)).toEqual([
+      'forwarded_from',
+      'forwarded_from_type',
+      'forwarded_from_id',
+      'forwarded_date',
+    ])
+    expect(meta).toEqual({
+      forwarded_from: 'Ada Lovelace (@adalove)',
+      forwarded_from_type: 'user',
+      forwarded_from_id: '42',
+      forwarded_date: DATE_ISO,
+    })
+  })
+
+  it('id-less origin (hidden_user) omits forwarded_from_id entirely', () => {
+    const meta = buildForwardOriginMeta([
+      { name: 'Mystery Sender', type: 'hidden_user', date: DATE },
+    ])
+    expect(Object.keys(meta)).toEqual([
+      'forwarded_from',
+      'forwarded_from_type',
+      'forwarded_date',
+    ])
+    expect(meta.forwarded_from_type).toBe('hidden_user')
+  })
+
+  it('XML-escapes hostile names — the rendered attribute value cannot break out', () => {
+    const meta = buildForwardOriginMeta([
+      { name: '<script>"a"&\'b\'</script>', type: 'user', id: 42, date: DATE },
+    ])
+    expect(meta.forwarded_from).toBe(
+      '&lt;script&gt;&quot;a&quot;&amp;&apos;b&apos;&lt;/script&gt;',
+    )
+    // Outcome assertion: rendered into a channel tag, the value carries no
+    // raw quote/angle characters that could terminate the attribute.
+    const rendered = `<channel source="telegram" forwarded_from="${meta.forwarded_from}">`
+    expect(rendered).not.toMatch(/forwarded_from="[^"]*[<>][^"]*"/)
+    expect((rendered.match(/"/g) ?? []).length).toBe(4) // only the delimiters
+  })
+
+  it('defense in depth: a name that skipped parse-time truncation is capped here too', () => {
+    const meta = buildForwardOriginMeta([
+      { name: 'y'.repeat(4096), type: 'user', id: 42, date: DATE },
+    ])
+    // 99 chars + '…' — no 4KB payload reaches the tag.
+    expect(meta.forwarded_from).toHaveLength(FORWARDED_FROM_NAME_MAX)
+  })
+
+  it('no origins → empty record (no attrs on a normal message)', () => {
+    expect(buildForwardOriginMeta([])).toEqual({})
+  })
+})
+
+describe('coalesced bursts — dedupe + numbered siblings', () => {
+  const alice: ForwardOriginInfo = { name: 'Alice Q (@aliceq)', type: 'user', id: 42, date: DATE }
+  const relnotes: ForwardOriginInfo = {
+    name: 'Release Notes (@relnotes)',
+    type: 'channel',
+    id: -100400500,
+    date: DATE + 60,
+    messageId: 7,
+  }
+
+  it('single-origin album (N parts, one sender) collapses to ONE attr set', () => {
+    const origins = dedupeForwardOrigins([alice, { ...alice, date: DATE + 5 }, { ...alice, date: DATE + 9 }])
+    expect(origins).toHaveLength(1)
+    const meta = buildForwardOriginMeta(origins)
+    expect(meta.forwarded_from).toBe('Alice Q (@aliceq)')
+    expect(meta.forwarded_from_2).toBeUndefined()
+    // First occurrence wins — the emitted date is the first part's.
+    expect(meta.forwarded_date).toBe(DATE_ISO)
+  })
+
+  it('multi-origin burst: first origin bare, second gets _2 keys in order', () => {
+    const meta = buildForwardOriginMeta(dedupeForwardOrigins([alice, relnotes]))
+    expect(Object.keys(meta)).toEqual([
+      'forwarded_from',
+      'forwarded_from_type',
+      'forwarded_from_id',
+      'forwarded_date',
+      'forwarded_from_2',
+      'forwarded_from_type_2',
+      'forwarded_from_id_2',
+      'forwarded_date_2',
+    ])
+    expect(meta.forwarded_from_2).toBe('Release Notes (@relnotes)')
+    expect(meta.forwarded_from_type_2).toBe('channel')
+    expect(meta.forwarded_from_id_2).toBe('-100400500')
+  })
+
+  it('non-forwarded entries in the burst are skipped', () => {
+    expect(dedupeForwardOrigins([undefined, alice, undefined])).toEqual([alice])
+    expect(dedupeForwardOrigins([undefined, undefined])).toEqual([])
+  })
+
+  it('id-less origins dedupe by name; same type+id dedupes despite name drift', () => {
+    const hidden: ForwardOriginInfo = { name: 'Mystery Sender', type: 'hidden_user', date: DATE }
+    expect(dedupeForwardOrigins([hidden, { ...hidden, date: DATE + 3 }])).toHaveLength(1)
+    // Same user id, renamed mid-burst — still one origin.
+    expect(dedupeForwardOrigins([alice, { ...alice, name: 'Alice Renamed' }])).toHaveLength(1)
+    // Same numeric id but different type stays distinct.
+    expect(forwardOriginKey(alice)).not.toBe(forwardOriginKey({ ...alice, type: 'chat' }))
+  })
+
+  it('arrival order is preserved across three distinct origins', () => {
+    const hidden: ForwardOriginInfo = { name: 'Mystery Sender', type: 'hidden_user', date: DATE }
+    const meta = buildForwardOriginMeta(dedupeForwardOrigins([relnotes, hidden, alice]))
+    expect(meta.forwarded_from).toBe('Release Notes (@relnotes)')
+    expect(meta.forwarded_from_2).toBe('Mystery Sender')
+    expect(meta.forwarded_from_3).toBe('Alice Q (@aliceq)')
+    expect(meta.forwarded_from_type_3).toBe('user')
+  })
+})

package/telegram-plugin/tests/gateway-outbound-redact.test.ts

@@ -77,6 +77,63 @@ describe('gateway outbound secret-scrub — structural wiring', () => {
     expect(truncIdx).toBeGreaterThan(redactIdx) // mask BEFORE the slice
   })
 
+  it('ask_user: redacts question + option labels at entry, BEFORE the send', () => {
+    // F1 — ask_user sent the question + button labels unredacted. The scrub
+    // must run at the top of executeAskUser (via redactAskUserFields), before
+    // the keyboard is built and the question is sent to Telegram.
+    const start = src.indexOf('async function executeAskUser(')
+    const redactIdx = src.indexOf('redactAskUserFields(args.question, args.options', start)
+    const keyboardIdx = src.indexOf('const keyboard = new InlineKeyboard()', start)
+    const sendIdx = src.indexOf('sendRichMessage(args.chatId, richMessage(args.question)', start)
+    expect(start).toBeGreaterThan(0)
+    expect(redactIdx).toBeGreaterThan(start)
+    expect(keyboardIdx).toBeGreaterThan(redactIdx) // mask BEFORE labels become buttons
+    expect(sendIdx).toBeGreaterThan(redactIdx) // mask BEFORE the question is sent
+  })
+
+  it('send_checklist: redacts title + task text BEFORE rawSendChecklist', () => {
+    // F2 — checklist title + task strings were sent unredacted.
+    const start = src.indexOf('async function executeSendChecklist(')
+    const redactIdx = src.indexOf('redactChecklistFields(', start)
+    const sendIdx = src.indexOf('rawSendChecklist({', start)
+    expect(start).toBeGreaterThan(0)
+    expect(redactIdx).toBeGreaterThan(start)
+    expect(sendIdx).toBeGreaterThan(redactIdx) // mask BEFORE the send
+  })
+
+  it('update_checklist: redacts title + task text BEFORE rawEditMessageChecklist', () => {
+    // F2 sibling — update_checklist shares the identical leak class.
+    const start = src.indexOf('async function executeUpdateChecklist(')
+    const redactIdx = src.indexOf('redactChecklistFields(', start)
+    const editIdx = src.indexOf('rawEditMessageChecklist({', start)
+    expect(start).toBeGreaterThan(0)
+    expect(redactIdx).toBeGreaterThan(start)
+    expect(editIdx).toBeGreaterThan(redactIdx) // mask BEFORE the edit
+  })
+
+  it('pty draft-preview: redacts at the gateway boundary BEFORE the stream', () => {
+    // F3 — the PTY-tail partial (assistant reply text extracted from the TUI)
+    // forwards straight to the draft-preview stream. Mask at the top of
+    // handlePtyPartial, before it hands off to handlePtyPartialPure.
+    const start = src.indexOf('function handlePtyPartial(text: string): void {')
+    const redactIdx = src.indexOf(`redactOutboundText(text, 'pty_preview')`, start)
+    const pureIdx = src.indexOf('handlePtyPartialPure(text, state', start)
+    expect(start).toBeGreaterThan(0)
+    expect(redactIdx).toBeGreaterThan(start)
+    expect(pureIdx).toBeGreaterThan(redactIdx) // mask BEFORE the stream push
+  })
+
+  it('pty activity: redacts at the gateway boundary BEFORE the stream', () => {
+    // F3 — the (currently-unwired) PTY-activity lane is masked too so the fix
+    // is durable if it is ever re-armed.
+    const start = src.indexOf('function handlePtyActivity(text: string): void {')
+    const redactIdx = src.indexOf(`redactOutboundText(text, 'pty_activity')`, start)
+    const streamIdx = src.indexOf('handleStreamReply(', start)
+    expect(start).toBeGreaterThan(0)
+    expect(redactIdx).toBeGreaterThan(start)
+    expect(streamIdx).toBeGreaterThan(redactIdx) // mask BEFORE the stream
+  })
+
   it('does not log the secret value when a mask fires', () => {
     const idx = src.indexOf('function redactOutboundText(')
     const body = src.slice(idx, idx + 400)

package/telegram-plugin/tests/history.test.ts

@@ -2,6 +2,9 @@ import { describe, it, expect, beforeEach, afterEach } from 'vitest'
 import { mkdtempSync, statSync, rmSync, existsSync } from 'fs'
 import { tmpdir } from 'os'
 import { join } from 'path'
+// bun-only (this file is vitest-excluded and runs under `bun test`): used to
+// build an OLD-schema DB file for the additive-migration test.
+import { Database } from 'bun:sqlite'
 import {
   initHistory,
   recordInbound,
@@ -542,6 +545,121 @@ describe('hasOutboundDeliveredSince', () => {
   })
 })
 
+// Review finding H5 regression: the original PRIMARY KEY (chat_id, thread_id, message_id) does
+// NOT dedupe thread-less rows because SQLite treats NULL as distinct from NULL
+// in a UNIQUE/PK index. The documented at-least-once boot replay re-records an
+// already-stored DM/non-topic message, so `INSERT OR REPLACE` appended a
+// DUPLICATE row instead of replacing — over-counting the silence / over-ping
+// detectors. The COALESCE(thread_id,'') unique index makes the upsert
+// idempotent. These tests fail (duplicate rows) without the fix.
+describe('idempotent upsert for null-thread rows (H5)', () => {
+  beforeEach(() => initHistory(stateDir, 30))
+
+  it('re-recording the same null-thread inbound yields exactly ONE row', () => {
+    const msg = {
+      chat_id: '-100',
+      thread_id: null,
+      message_id: 7,
+      user: 'alice',
+      user_id: '111',
+      ts: 1000,
+      text: 'hello',
+    }
+    // Simulate the at-least-once replay: record the same message twice.
+    recordInbound(msg)
+    recordInbound(msg)
+    const rows = query({ chat_id: '-100' })
+    expect(rows).toHaveLength(1)
+    expect(rows[0]).toMatchObject({ message_id: 7, role: 'user', text: 'hello' })
+    // The over-count surface the finding calls out must stay accurate.
+    expect(getRecentOutboundCount('-100', 999_999)).toBe(0)
+  })
+
+  it('re-recording the same null-thread outbound yields exactly ONE row', () => {
+    const now = Math.floor(Date.now() / 1000)
+    const send = {
+      chat_id: '-100',
+      thread_id: null,
+      message_ids: [42],
+      texts: ['the answer'],
+      ts: now,
+    }
+    recordOutbound(send)
+    recordOutbound(send)
+    const rows = query({ chat_id: '-100' })
+    expect(rows).toHaveLength(1)
+    // hasOutboundDeliveredSince / getRecentOutboundCount read this table; a
+    // duplicate here would double-count and over-ping.
+    expect(getRecentOutboundCount('-100', 60)).toBe(1)
+  })
+
+  it('a re-record REPLACES rather than appends (newest text wins)', () => {
+    recordInbound({ chat_id: '-100', thread_id: null, message_id: 7, user: 'a', user_id: '1', ts: 1000, text: 'first version' })
+    recordInbound({ chat_id: '-100', thread_id: null, message_id: 7, user: 'a', user_id: '1', ts: 1000, text: 'second version' })
+    const rows = query({ chat_id: '-100' })
+    expect(rows).toHaveLength(1)
+    expect(rows[0]?.text).toBe('second version')
+  })
+
+  it('a topic row and a general row with the SAME message_id stay DISTINCT', () => {
+    // Same chat_id + message_id, but one is in a forum topic (thread 5) and one
+    // is the general/DM row (null thread). These are different logical messages
+    // and must both survive — the COALESCE sentinel keeps them separate.
+    recordInbound({ chat_id: '-100', thread_id: 5, message_id: 9, user: 'a', user_id: '1', ts: 100, text: 'in topic 5' })
+    recordInbound({ chat_id: '-100', thread_id: null, message_id: 9, user: 'a', user_id: '1', ts: 100, text: 'in general' })
+    expect(query({ chat_id: '-100' })).toHaveLength(2)
+    expect(query({ chat_id: '-100', thread_id: 5 }).map(r => r.text)).toEqual(['in topic 5'])
+    expect(query({ chat_id: '-100', thread_id: null }).map(r => r.text)).toEqual(['in general'])
+  })
+
+  it('two distinct forum topics with the same message_id stay DISTINCT', () => {
+    recordInbound({ chat_id: '-100', thread_id: 5, message_id: 9, user: 'a', user_id: '1', ts: 100, text: 'topic5' })
+    recordInbound({ chat_id: '-100', thread_id: 6, message_id: 9, user: 'a', user_id: '1', ts: 100, text: 'topic6' })
+    expect(query({ chat_id: '-100' })).toHaveLength(2)
+    expect(query({ chat_id: '-100', thread_id: 5 }).map(r => r.text)).toEqual(['topic5'])
+    expect(query({ chat_id: '-100', thread_id: 6 }).map(r => r.text)).toEqual(['topic6'])
+  })
+
+  it('migration de-dupes pre-existing null-thread duplicates from a legacy DB', async () => {
+    // Simulate a DB written by the pre-fix build: insert duplicate null-thread
+    // rows DIRECTLY, bypassing the (now-fixed) upsert, to reproduce the exact
+    // corruption the finding describes. Then re-init to fire the migration.
+    const { Database } = await import('bun:sqlite')
+    const dbPath = join(stateDir, 'history.db')
+    const now = Math.floor(Date.now() / 1000) // recent ts so the retention sweep keeps them
+    _resetForTests()
+    const raw = new Database(dbPath)
+    // Drop the logical-key index so we're back to the legacy, dupe-permitting
+    // schema, then append two rows sharing the same (chat, null-thread, msg).
+    raw.exec('DROP INDEX IF EXISTS idx_messages_logical_key')
+    const insert = raw.prepare(
+      `INSERT INTO messages (chat_id, thread_id, message_id, role, user, user_id, ts, text, group_id)
+       VALUES (?, NULL, ?, 'user', 'a', '1', ?, ?, NULL)`,
+    )
+    insert.run('-100', 7, now, 'stale copy')
+    insert.run('-100', 7, now + 1, 'newest copy')
+    // A distinct topic row with the same message_id must survive the migration.
+    raw.prepare(
+      `INSERT INTO messages (chat_id, thread_id, message_id, role, user, user_id, ts, text, group_id)
+       VALUES (?, 5, ?, 'user', 'a', '1', ?, ?, NULL)`,
+    ).run('-100', 7, now, 'topic row')
+    raw.close()
+
+    // Re-open through initHistory → runs the H5 migration (dedupe + index).
+    initHistory(stateDir, 30)
+    const general = query({ chat_id: '-100', thread_id: null })
+    expect(general).toHaveLength(1)
+    expect(general[0]?.text).toBe('newest copy') // kept the newest (highest ts/rowid)
+    // The topic row with the same message_id is untouched.
+    expect(query({ chat_id: '-100', thread_id: 5 }).map(r => r.text)).toEqual(['topic row'])
+    expect(query({ chat_id: '-100' })).toHaveLength(2)
+
+    // And the upsert is idempotent going forward.
+    recordInbound({ chat_id: '-100', thread_id: null, message_id: 7, user: 'a', user_id: '1', ts: now + 2, text: 'replay' })
+    expect(query({ chat_id: '-100', thread_id: null })).toHaveLength(1)
+  })
+})
+
 describe('secret redaction at persistence (both directions)', () => {
   beforeEach(() => initHistory(stateDir, 30))
 
@@ -600,3 +718,157 @@ describe('secret redaction at persistence (both directions)', () => {
     expect(query({ chat_id: '-100' })[0]!.text).toBe('hello, how are you?')
   })
 })
+
+describe('forwarded-message origin columns', () => {
+  it('round-trips forwarded_* fields on an inbound row', () => {
+    initHistory(stateDir, 30)
+    recordInbound({
+      chat_id: '-100',
+      thread_id: null,
+      message_id: 7,
+      user: 'alice',
+      user_id: '111',
+      ts: 1000,
+      text: 'fwd: look at this',
+      forwarded_from: 'Release Notes (@relnotes)',
+      forwarded_from_type: 'channel',
+      forwarded_from_id: '-100400500',
+      forwarded_date: '2026-06-15T13:46:40.000Z',
+      forwarded_message_id: 555,
+    })
+    const row = query({ chat_id: '-100' })[0]!
+    expect(row).toMatchObject({
+      forwarded_from: 'Release Notes (@relnotes)',
+      forwarded_from_type: 'channel',
+      forwarded_from_id: '-100400500',
+      forwarded_date: '2026-06-15T13:46:40.000Z',
+      forwarded_message_id: 555,
+    })
+  })
+
+  it('non-forwarded inbound stores NULL origin fields', () => {
+    initHistory(stateDir, 30)
+    recordInbound({
+      chat_id: '-100',
+      thread_id: null,
+      message_id: 8,
+      user: 'alice',
+      user_id: '111',
+      ts: 1000,
+      text: 'plain message',
+    })
+    const row = query({ chat_id: '-100' })[0]!
+    expect(row.forwarded_from).toBeNull()
+    expect(row.forwarded_from_type).toBeNull()
+    expect(row.forwarded_from_id).toBeNull()
+    expect(row.forwarded_date).toBeNull()
+    expect(row.forwarded_message_id).toBeNull()
+  })
+
+  it('migrates additively: pre-existing DB without the columns gains them and round-trips', () => {
+    // Build an OLD-schema DB file the way a pre-forward-origin build would
+    // have left it: messages table without any forwarded_* columns, one row
+    // already stored.
+    const dbPath = join(stateDir, 'history.db')
+    const old = new Database(dbPath, { create: true })
+    old.exec(`
+      CREATE TABLE IF NOT EXISTS messages (
+        chat_id        TEXT    NOT NULL,
+        thread_id      INTEGER,
+        message_id     INTEGER NOT NULL,
+        role           TEXT    NOT NULL,
+        user           TEXT,
+        user_id        TEXT,
+        ts             INTEGER NOT NULL,
+        text           TEXT    NOT NULL,
+        attachment_kind TEXT,
+        group_id       INTEGER,
+        reply_to_message_id INTEGER,
+        reply_to_text  TEXT,
+        PRIMARY KEY (chat_id, thread_id, message_id)
+      )
+    `)
+    // Recent ts — initHistory's retention sweep deletes rows older than the
+    // cutoff, and this test is about migration, not retention.
+    const now = Math.floor(Date.now() / 1000)
+    old.exec(
+      `INSERT INTO messages (chat_id, thread_id, message_id, role, user, user_id, ts, text) ` +
+      `VALUES ('-100', NULL, 1, 'user', 'alice', '111', ${now - 60}, 'pre-migration row')`,
+    )
+    old.close()
+
+    // Re-open through the real init path — the additive ALTER TABLE loop
+    // must add the forwarded_* columns without touching existing rows.
+    initHistory(stateDir, 30)
+
+    const oldRow = query({ chat_id: '-100' })[0]!
+    expect(oldRow.text).toBe('pre-migration row')
+    expect(oldRow.forwarded_from).toBeNull()
+
+    recordInbound({
+      chat_id: '-100',
+      thread_id: null,
+      message_id: 2,
+      user: 'alice',
+      user_id: '111',
+      ts: now,
+      text: 'forwarded after migration',
+      forwarded_from: 'Ada Lovelace (@adalove)',
+      forwarded_from_type: 'user',
+      forwarded_from_id: '42',
+      forwarded_date: '2026-06-15T13:46:40.000Z',
+    })
+    const rows = query({ chat_id: '-100' })
+    expect(rows).toHaveLength(2)
+    const fwd = rows.find((r) => r.message_id === 2)!
+    expect(fwd.forwarded_from).toBe('Ada Lovelace (@adalove)')
+    expect(fwd.forwarded_from_type).toBe('user')
+    expect(fwd.forwarded_from_id).toBe('42')
+    expect(fwd.forwarded_date).toBe('2026-06-15T13:46:40.000Z')
+    expect(fwd.forwarded_message_id).toBeNull()
+  })
+
+  it('hostile origin name is stored raw (XML metachars belong to the meta lane)', () => {
+    initHistory(stateDir, 30)
+    // Raw XML metacharacters are EXPECTED here — escaping belongs to the
+    // channel-meta lane, the history buffer stores what the user saw.
+    recordInbound({
+      chat_id: '-100',
+      thread_id: null,
+      message_id: 9,
+      user: 'alice',
+      user_id: '111',
+      ts: 1000,
+      text: 'fwd',
+      forwarded_from: '<b>"Bob"&\'friends\'</b>',
+      forwarded_from_type: 'user',
+      forwarded_from_id: '42',
+    })
+    expect(query({ chat_id: '-100' })[0]!.forwarded_from).toBe('<b>"Bob"&\'friends\'</b>')
+  })
+
+  it('masks a secret-shaped origin name before it is stored (redaction backstop)', () => {
+    initHistory(stateDir, 30)
+    // Built by concatenation so the source never holds a contiguous
+    // secret-shaped literal (repo Push Protection / no-pii lint). Same
+    // pattern as the text/reply_to_text redaction tests above — a display
+    // name is user-controlled text and rides the same redact() backstop.
+    const GH_PAT = `ghp_${'F6g7H8i9J0'.repeat(3)}` // ghp_<30 base62>
+    recordInbound({
+      chat_id: '-100',
+      thread_id: null,
+      message_id: 10,
+      user: 'alice',
+      user_id: '111',
+      ts: 1000,
+      text: 'fwd',
+      forwarded_from: `Bob ${GH_PAT}`,
+      forwarded_from_type: 'user',
+      forwarded_from_id: '42',
+    })
+    const stored = query({ chat_id: '-100' })[0]!.forwarded_from as string
+    expect(stored).not.toContain(GH_PAT)
+    expect(stored).toContain('[REDACTED')
+    expect(stored).toContain('Bob') // surrounding name preserved
+  })
+})

package/telegram-plugin/tests/inbound-message-types.test.ts

@@ -206,7 +206,11 @@ describe('inbound message-type helpers: handleAckOnly + handleRefusal', () => {
     const fnStart = SRC.indexOf('async function handleAckOnly(')
     const fnSlice = SRC.slice(fnStart, fnStart + 2000)
     expect(fnSlice).toContain('gate(ctx)')
-    expect(fnSlice).toContain('setMessageReaction')
+    // #3155: the reaction now routes through the gated `sendReaction` helper
+    // (send gate + flood breaker, cosmetic) instead of a raw
+    // `bot.api.setMessageReaction`. The invariant is unchanged: it gates, THEN
+    // reacts.
+    expect(fnSlice).toContain('sendReaction(')
   })
 
   it('handleAckOnly drops non-allowlisted senders silently', () => {