switchroom 0.18.12 → 0.18.14

package/telegram-plugin/tests/inline-keyboard-callbacks.test.ts

@@ -14,6 +14,7 @@ import {
   AGENT_CALLBACK_PREFIX,
   AGENT_CALLBACK_DATA_MAX,
   wrapAgentCallbacks,
+  redactAgentKeyboard,
   parseAgentCallback,
   validateAndWrapAgentKeyboard,
   extractAgentButtonMeta,
@@ -22,6 +23,7 @@ import {
   escapeHtmlEntities,
   applyTapAnnotationEdit,
 } from '../inline-keyboard-callbacks.js'
+import { redact } from '../secret-detect/redact.js'
 
 describe('inline-keyboard-callbacks (#271)', () => {
   describe('AGENT_CALLBACK_DATA_MAX', () => {
@@ -431,4 +433,166 @@ describe('inline-keyboard-callbacks (#271)', () => {
       expect(outcome).toBe('failed')
     })
   })
+
+  // ─── #3148 fast-follow: agent-authored keyboard secret scrub ──────────────
+  //
+  // wrapAgentCallbacks rewrites ONLY callback_data; the visible `text` label,
+  // the `ack_text` toast, and any `copy_text.text` clipboard payload passed
+  // through VERBATIM before this fix — so a secret an agent placed in any of
+  // them transmitted to Telegram unmasked and resurfaced on tap (echo, toast,
+  // "✅ You chose" annotation). redactAgentKeyboard masks those three fields at
+  // the outbound boundary using the SAME redact() the reply body uses, while
+  // leaving the routing key (callback_data) exact.
+  describe('redactAgentKeyboard (#3148 fast-follow)', () => {
+    // Assemble the fixture at runtime so this source file never carries a
+    // contiguous token that trips push-protection / secretlint (CLAUDE.md).
+    const GITHUB_PAT = 'ghp' + '_' + '16C7e42F292c6912E7710c838347Ae178B4a'
+
+    it('masks a secret in a button `text` label in the sent payload (real redact)', () => {
+      const raw = [
+        [{ text: `Use ${GITHUB_PAT}`, callback_data: 'use_token' }],
+      ]
+      // Mirror the gateway pipeline: redact BEFORE wrap.
+      const wrapped = wrapAgentCallbacks(redactAgentKeyboard(raw, redact))
+      const btn = wrapped[0]![0]!
+      // OUTCOME: the label bytes actually shipped to Telegram carry no secret.
+      expect(btn.text as string).not.toContain(GITHUB_PAT)
+      expect(btn.text as string).toContain('[REDACTED')
+      expect((btn.text as string).length).toBeGreaterThan(0)
+      // Routing key untouched (only the agent: namespace prefix was added).
+      expect(btn.callback_data).toBe(`${AGENT_CALLBACK_PREFIX}use_token`)
+    })
+
+    it('masks a secret in `ack_text` in the extracted per-button meta (real redact)', () => {
+      const raw = [
+        [{ text: 'Deploy', callback_data: 'deploy', ack_text: `token ${GITHUB_PAT}` }],
+      ]
+      // Mirror the gateway: extract meta from the REDACTED keyboard so the
+      // stashed toast (shown via answerCallbackQuery on tap) is masked.
+      const meta = extractAgentButtonMeta(redactAgentKeyboard(raw, redact))
+      const ack = meta.get('deploy')!.ack_text!
+      expect(ack).not.toContain(GITHUB_PAT)
+      expect(ack).toContain('[REDACTED')
+    })
+
+    it('masks a secret in `copy_text.text` clipboard payload (real redact)', () => {
+      const raw = [
+        [{ text: 'Copy token', callback_data: 'copy', copy_text: { text: GITHUB_PAT } }],
+      ]
+      const [[btn]] = redactAgentKeyboard(raw, redact)
+      const ct = (btn as { copy_text: { text: string } }).copy_text.text
+      expect(ct).not.toContain(GITHUB_PAT)
+      expect(ct).toContain('[REDACTED')
+    })
+
+    it('never empties a label that is ENTIRELY a secret (non-empty invariant)', () => {
+      const raw = [[{ text: GITHUB_PAT, callback_data: 'x' }]]
+      const [[btn]] = redactAgentKeyboard(raw, redact)
+      expect((btn.text as string).length).toBeGreaterThan(0)
+      expect(btn.text as string).not.toContain(GITHUB_PAT)
+    })
+
+    it('leaves a legit (secret-free) label unchanged', () => {
+      const raw = [
+        [{ text: 'Approve PR #547', callback_data: 'approve', ack_text: 'Approved ✓' }],
+        [{ text: 'Hold', callback_data: 'hold' }],
+      ]
+      const out = redactAgentKeyboard(raw, redact)
+      expect(out[0]![0]!.text).toBe('Approve PR #547')
+      expect(out[0]![0]!.ack_text).toBe('Approved ✓')
+      expect(out[1]![0]!.text).toBe('Hold')
+    })
+
+    it('NEVER passes callback_data through the redactor (routing key stays exact)', () => {
+      // A fake redactor that mangles everything it sees; anything the routing
+      // key touched would be corrupted. Proves copy_text/url/callback_data are
+      // handled correctly by field, not blanket-scrubbed.
+      const seen: string[] = []
+      const mangle = (s: string) => {
+        seen.push(s)
+        return `X${s}X`
+      }
+      const raw = [
+        [
+          { text: 'Label', callback_data: 'route_key_do_not_touch', ack_text: 'toast' },
+          { text: 'Link', url: 'https://example.com/keep' },
+          { text: 'Clip', callback_data: 'c2', copy_text: { text: 'secret-clip' } },
+        ],
+      ]
+      const out = redactAgentKeyboard(raw, mangle)
+      // callback_data + url are byte-exact.
+      expect(out[0]![0]!.callback_data).toBe('route_key_do_not_touch')
+      expect(out[0]![1]!.url).toBe('https://example.com/keep')
+      expect(out[0]![2]!.callback_data).toBe('c2')
+      // Only free-text fields were routed through the redactor.
+      expect(out[0]![0]!.text).toBe('XLabelX')
+      expect(out[0]![0]!.ack_text).toBe('XtoastX')
+      expect((out[0]![2]! as { copy_text: { text: string } }).copy_text.text).toBe('Xsecret-clipX')
+      expect(seen).toEqual(['Label', 'toast', 'Link', 'Clip', 'secret-clip'])
+      expect(seen).not.toContain('route_key_do_not_touch')
+      expect(seen).not.toContain('https://example.com/keep')
+      expect(seen).not.toContain('c2')
+    })
+
+    it('masks a secret in switch_inline_query* (pasted into the chat input on tap)', () => {
+      const raw = [
+        [{ text: 'Share', callback_data: 's', switch_inline_query: `key ${GITHUB_PAT}` }],
+        [{
+          text: 'Fill here',
+          callback_data: 'f',
+          switch_inline_query_current_chat: `key ${GITHUB_PAT}`,
+        }],
+      ]
+      const out = redactAgentKeyboard(raw, redact)
+      const siq = (out[0]![0]! as { switch_inline_query: string }).switch_inline_query
+      const siqc = (out[1]![0]! as { switch_inline_query_current_chat: string })
+        .switch_inline_query_current_chat
+      expect(siq).not.toContain(GITHUB_PAT)
+      expect(siq).toContain('[REDACTED')
+      expect(siqc).not.toContain(GITHUB_PAT)
+      expect(siqc).toContain('[REDACTED')
+    })
+
+    it('masks a secret in switch_inline_query_chosen_chat.query', () => {
+      const raw = [[{
+        text: 'Share to…',
+        callback_data: 'cc',
+        switch_inline_query_chosen_chat: { query: `key ${GITHUB_PAT}`, allow_user_chats: true },
+      }]]
+      const [[btn]] = redactAgentKeyboard(raw, redact)
+      const cc = (btn as { switch_inline_query_chosen_chat: { query: string; allow_user_chats?: boolean } })
+        .switch_inline_query_chosen_chat
+      expect(cc.query).not.toContain(GITHUB_PAT)
+      expect(cc.query).toContain('[REDACTED')
+      // sibling sub-fields are preserved
+      expect(cc.allow_user_chats).toBe(true)
+    })
+
+    it('clamps a masked field that the marker pushed over the Telegram cap (reply not dropped)', () => {
+      // A 60-char label (< 64 cap) whose short secret expands under the marker
+      // would exceed 64 and 400-drop the whole reply; the clamp keeps it ≤ cap.
+      const shortSecret = 'AKIAIOSFODNN7EXAMPLE' // 20 chars, AWS-key shaped
+      const label = `${shortSecret} ${'x'.repeat(43)}` // 64 chars total, at the cap
+      const raw = [[{ text: label, callback_data: 'x' }]]
+      const [[btn]] = redactAgentKeyboard(raw, redact)
+      const text = btn.text as string
+      expect(text.length).toBeLessThanOrEqual(64)
+      expect(text).not.toContain(shortSecret)
+    })
+
+    it('preserves keyboard structure, row/column order, and does not mutate input', () => {
+      const raw = [
+        [{ text: 'A', callback_data: 'a' }, { text: 'B', callback_data: 'b' }],
+        [{ text: 'C', callback_data: 'c' }],
+      ]
+      const out = redactAgentKeyboard(raw, (s) => s)
+      expect(out.map((r) => r.map((b) => b.callback_data))).toEqual([
+        ['a', 'b'],
+        ['c'],
+      ])
+      // Fresh objects — input untouched.
+      expect(out[0]![0]).not.toBe(raw[0]![0])
+      expect(raw[0]![0]!.text).toBe('A')
+    })
+  })
 })

package/telegram-plugin/tests/operator-events-session-tail.test.ts

@@ -9,6 +9,7 @@ import { tmpdir } from 'os'
 import { join } from 'path'
 import { detectErrorInTranscriptLine, startSessionTail } from '../session-tail.js'
 import { resetAllCooldowns } from '../operator-events.js'
+import { resolveModelUnavailableFromOperatorEvent } from '../model-unavailable.js'
 
 // ─── detectErrorInTranscriptLine unit tests ───────────────────────────────────
 
@@ -155,6 +156,79 @@ describe('detectErrorInTranscriptLine — error detection', () => {
     expect(result!.detail).toContain('hit your limit')
   })
 
+  // Regression — the carrie incident (2026-07-12). Anthropic also emits a
+  // 429 for a TRANSIENT per-account burst / RPM throttle whose wording
+  // explicitly negates the account-quota reading ("would exceed your
+  // account's rate limit … not your usage limit"). That is a self-healing
+  // few-second throttle Claude Code retries internally — it must NOT be
+  // labeled quota-exhausted (which always shows the scary "model
+  // unavailable" card + drives failover). It must take the calm
+  // rate-limited path.
+  it('classifies a TRANSIENT burst 429 (explicit negation) as rate-limited, NOT quota-exhausted', () => {
+    const line = JSON.stringify({
+      type: 'assistant',
+      message: {
+        role: 'assistant',
+        model: '<synthetic>',
+        content: [
+          {
+            type: 'text',
+            text:
+              'API Error: 429 rate_limit_error This request would exceed ' +
+              "your account's rate limit. Please try again later. This is a " +
+              'short-term burst limit, not your usage limit.',
+          },
+        ],
+      },
+      error: 'rate_limit',
+      isApiErrorMessage: true,
+      apiErrorStatus: 429,
+    })
+    const result = detectErrorInTranscriptLine(line)
+    expect(result).not.toBeNull()
+    // Wording-based classification: explicit transient negation → calm path.
+    expect(result!.kind).toBe('rate-limited')
+    expect(result!.transient).toBe(true)
+    // End-to-end: the resolver must NOT produce a model-unavailable card for
+    // this kind (the calm rate-limited branch returns null on a bare burst).
+    const detection = resolveModelUnavailableFromOperatorEvent({
+      kind: result!.kind,
+      detail: result!.detail,
+    })
+    expect(detection).toBeNull()
+  })
+
+  // Guard against over-correcting: a GENUINE quota wall (no transient marker)
+  // must STILL be quota-exhausted AND still resolve to a card.
+  it('a genuine quota-wall 429 still produces the quota-exhausted card', () => {
+    const line = JSON.stringify({
+      type: 'assistant',
+      message: {
+        role: 'assistant',
+        model: '<synthetic>',
+        content: [
+          {
+            type: 'text',
+            text: "You've hit your limit · resets 8:50am (Australia/Melbourne)",
+          },
+        ],
+      },
+      error: 'rate_limit',
+      isApiErrorMessage: true,
+      apiErrorStatus: 429,
+    })
+    const result = detectErrorInTranscriptLine(line)
+    expect(result).not.toBeNull()
+    expect(result!.kind).toBe('quota-exhausted')
+    // The quota-exhausted branch ALWAYS returns a detection (the card).
+    const detection = resolveModelUnavailableFromOperatorEvent({
+      kind: result!.kind,
+      detail: result!.detail,
+    })
+    expect(detection).not.toBeNull()
+    expect(detection!.kind).toBe('quota_exhausted')
+  })
+
   it('still returns null for a normal (non-error) assistant message', () => {
     // No isApiErrorMessage flag → must NOT be treated as an error.
     const line = JSON.stringify({

package/telegram-plugin/tests/outbound-field-redact.test.ts

@@ -0,0 +1,107 @@
+import { describe, it, expect } from 'vitest'
+import {
+  redactAskUserFields,
+  redactChecklistFields,
+} from '../outbound-field-redact.js'
+import { redact } from '../secret-detect/redact.js'
+
+/**
+ * OUTCOME tests for the #2044 structured-payload outbound scrub (F1/F2).
+ *
+ * These exercise the exact helpers the gateway calls (redactAskUserFields
+ * for ask_user, redactChecklistFields for send_checklist / update_checklist),
+ * injecting the SAME real `redact()` the gateway's redactOutboundText wraps.
+ * The assertion is on the SENT PAYLOAD the helper returns — a secret echoed
+ * into a question, an option/button label, a checklist title, or a task's
+ * text must be masked (marker present, raw token absent) — not merely that a
+ * redactor was invoked.
+ *
+ * Secrets are assembled at runtime (per CLAUDE.md "Secrets in tests") so the
+ * source file never contains a contiguous token that trips push-protection.
+ */
+
+// A realistic GitHub classic PAT shape (ghp_ + 36 chars) — high-confidence,
+// masked by redact() to a [REDACTED:github_pat_classic] marker.
+const SECRET = 'ghp' + '_' + 'AbCdEfGhIj0123456789KlMnOpQrStUvWxYz'
+
+describe('redactAskUserFields — ask_user outbound scrub (F1)', () => {
+  it('masks a secret echoed into the QUESTION text', () => {
+    const out = redactAskUserFields(
+      `Deploy with token ${SECRET}?`,
+      ['Yes', 'No'],
+      redact,
+    )
+    expect(out.question).not.toContain(SECRET)
+    expect(out.question).toContain('[REDACTED')
+    // Non-secret prose is preserved.
+    expect(out.question).toContain('Deploy with token')
+  })
+
+  it('masks a secret echoed into an OPTION / button label', () => {
+    const out = redactAskUserFields(
+      'Which key?',
+      ['Cancel', `Use ${SECRET}`],
+      redact,
+    )
+    expect(out.options[0]).toBe('Cancel')
+    expect(out.options[1]).not.toContain(SECRET)
+    expect(out.options[1]).toContain('[REDACTED')
+  })
+
+  it('leaves clean question + options untouched', () => {
+    const out = redactAskUserFields('Proceed?', ['Yes', 'No'], redact)
+    expect(out.question).toBe('Proceed?')
+    expect(out.options).toEqual(['Yes', 'No'])
+  })
+
+  it('does not mutate the caller-supplied options array', () => {
+    const options = ['Cancel', `Use ${SECRET}`]
+    redactAskUserFields('q', options, redact)
+    expect(options[1]).toBe(`Use ${SECRET}`) // original array untouched
+  })
+})
+
+describe('redactChecklistFields — checklist outbound scrub (F2)', () => {
+  it('masks a secret in the checklist TITLE', () => {
+    const out = redactChecklistFields(
+      `Rotate ${SECRET}`,
+      [{ text: 'step one' }],
+      redact,
+    )
+    expect(out.title).not.toContain(SECRET)
+    expect(out.title).toContain('[REDACTED')
+  })
+
+  it('masks a secret in a TASK text and preserves other task fields', () => {
+    const out = redactChecklistFields(
+      'Onboarding',
+      [
+        { text: 'read the docs', done: true },
+        { text: `save ${SECRET} to vault`, id: '7' },
+      ],
+      redact,
+    )
+    expect(out.tasks![0]).toEqual({ text: 'read the docs', done: true })
+    expect(out.tasks![1]!.text).not.toContain(SECRET)
+    expect(out.tasks![1]!.text).toContain('[REDACTED')
+    // Sibling fields on the redacted task are carried through untouched.
+    expect(out.tasks![1]!.id).toBe('7')
+  })
+
+  it('passes undefined title / tasks through (update_checklist partial patch)', () => {
+    const out = redactChecklistFields(undefined, undefined, redact)
+    expect(out.title).toBeUndefined()
+    expect(out.tasks).toBeUndefined()
+  })
+
+  it('leaves an id-only task (no text) untouched', () => {
+    const out = redactChecklistFields(undefined, [{ id: '3', done: true }], redact)
+    expect(out.tasks![0]).toEqual({ id: '3', done: true })
+  })
+
+  it('does not mutate the caller-supplied task objects', () => {
+    const tasks = [{ text: `save ${SECRET}` }]
+    redactChecklistFields('t', tasks, redact)
+    expect(tasks[0]!.text).toBe(`save ${SECRET}`) // original untouched
+  })
+})

package/telegram-plugin/tests/reaction-gate-routing.test.ts

@@ -0,0 +1,173 @@
+/**
+ * #3155 — `setMessageReaction` must route through the send gate + flood breaker.
+ *
+ * Before this change ~13 raw `bot.api.setMessageReaction(...)` /
+ * `lockedBot.api.setMessageReaction(...)` call sites (early-ack 👀, status
+ * reactions, stop/interrupt ⚡, permission verdict ✅/❌, refusal 🚫, ack-only,
+ * the MCP `react` tool, the crash-recovery sweeps, the auth-code 🔑 redact)
+ * fired reactions OUTSIDE both:
+ *
+ *   (a) the send gate — so reaction churn was never paced/shed under flood
+ *       pressure even with the gate ON; and
+ *   (b) the flood circuit breaker — a 429 from a reaction never reached the
+ *       retry module's `onFloodWait` hook, so the ban went unrecorded.
+ *
+ * Reactions were therefore a residual flood vector even when the gate is on.
+ * The gateway now funnels every reaction through ONE seam,
+ * `robustApiCall(() => lockedBot.api.setMessageReaction(...), { priorityClass:
+ * 'cosmetic', verb: 'set-message-reaction' })`.
+ *
+ * Two levels of coverage:
+ *   1. BEHAVIOURAL — compose the real `send-gate` + `retry-api-call` modules the
+ *      same way `gateway.ts` wires `robustApiCall`, and prove a cosmetic
+ *      reaction is (a) shed when a flood window is open and (b) visible to
+ *      `onFloodWait` on a 429.
+ *   2. LOAD-BEARING SOURCE SCAN — assert the gateway has exactly ONE runtime
+ *      `setMessageReaction` call and that it is the cosmetic seam. This FAILS if
+ *      any future change re-introduces a raw (ungated, breaker-blind) reaction.
+ */
+import { describe, it, expect, vi } from 'vitest'
+import { readFileSync } from 'node:fs'
+import { fileURLToPath } from 'node:url'
+import { createSendGate, type Clock } from '../send-gate.js'
+import { createRetryApiCall } from '../retry-api-call.js'
+import { errors } from './fake-bot-api.js'
+
+const GATEWAY_SRC = fileURLToPath(new URL('../gateway/gateway.ts', import.meta.url))
+
+/** Fixed-time clock; `sleep` is a no-op so nothing actually waits under test. */
+function fixedClock(now: number): Clock {
+  return { now: () => now, sleep: () => Promise.resolve() }
+}
+
+/**
+ * Reconstruct the gateway's outbound wiring for reactions: `robustApiCall =
+ * gate(rawRetry)`, and a `sendReaction` closure that tags the call `cosmetic`
+ * exactly like `gatedSetMessageReaction` in gateway.ts.
+ */
+function wireReactionPath(opts: {
+  clock: Clock
+  enabled: boolean
+  windowUntilTs?: number
+  onFloodWait?: (retryAfterSec: number) => void
+}) {
+  const setMessageReaction = vi.fn(async () => true as const)
+  const sendGate = createSendGate({
+    enabled: opts.enabled,
+    clock: opts.clock,
+    ...(opts.windowUntilTs != null
+      ? { initialWindows: [{ scopeKey: 'global', untilTs: opts.windowUntilTs }] }
+      : {}),
+  })
+  const rawRetry = createRetryApiCall({
+    maxRetries: 2,
+    sleep: async () => {},
+    ...(opts.onFloodWait ? { onFloodWait: opts.onFloodWait } : {}),
+  })
+  const robustApiCall = <T>(
+    fn: () => Promise<T>,
+    o?: Parameters<typeof rawRetry<T>>[1],
+  ): Promise<T> => sendGate.gate(() => rawRetry(fn, o), o)
+
+  // Mirrors gateway.ts `gatedSetMessageReaction` / `sendReaction`.
+  const sendReaction = (chatId: string, messageId: number, emoji: string): Promise<unknown> =>
+    robustApiCall(() => setMessageReaction(chatId, messageId, [{ type: 'emoji', emoji }]), {
+      chat_id: chatId,
+      verb: 'set-message-reaction',
+      priorityClass: 'cosmetic',
+    })
+
+  return { sendReaction, setMessageReaction, sendGate }
+}
+
+describe('#3155 reactions route through the send gate (cosmetic)', () => {
+  it('SHEDS a reaction while a flood window is open (paced/shed by the gate)', async () => {
+    const now = 1_000_000
+    const { sendReaction, setMessageReaction, sendGate } = wireReactionPath({
+      clock: fixedClock(now),
+      enabled: true,
+      windowUntilTs: now + 60_000, // an open global ban window
+    })
+
+    const result = await sendReaction('chatA', 42, '👀')
+
+    // Cosmetic + a covering window ⇒ shed: the API is NEVER hit, the promise
+    // resolves undefined (fire-and-forget callers .catch nothing), and the gate
+    // counts the shed.
+    expect(setMessageReaction).not.toHaveBeenCalled()
+    expect(result).toBeUndefined()
+    expect(sendGate.stats().global.shed).toBe(1)
+  })
+
+  it('does NOT shed when the gate is OFF (proves the gate is what sheds)', async () => {
+    const now = 1_000_000
+    const { sendReaction, setMessageReaction } = wireReactionPath({
+      clock: fixedClock(now),
+      enabled: false, // gate disabled ⇒ pure passthrough
+      windowUntilTs: now + 60_000,
+    })
+
+    await sendReaction('chatA', 42, '👀')
+
+    // Flag OFF ⇒ the reaction still fires (the window only bites when enabled).
+    expect(setMessageReaction).toHaveBeenCalledTimes(1)
+  })
+
+  it('records a 429 on a reaction to the flood breaker via onFloodWait', async () => {
+    const now = 1_000_000
+    const onFloodWait = vi.fn()
+    const { sendReaction, setMessageReaction } = wireReactionPath({
+      clock: fixedClock(now),
+      enabled: true, // gate on, no open window ⇒ the cosmetic call is admitted
+      onFloodWait,
+    })
+    // The reaction send hits a Telegram 429 flood-wait.
+    setMessageReaction.mockRejectedValue(errors.floodWait(7, 'setMessageReaction'))
+
+    // Fire-and-forget semantics: callers swallow. The point is the SIDE EFFECT.
+    await sendReaction('chatA', 42, '🤝').catch(() => {})
+
+    // The reaction actually reached the API (was admitted, not shed)...
+    expect(setMessageReaction).toHaveBeenCalled()
+    // ...and its 429 was recorded by the breaker — the whole gap this closes.
+    expect(onFloodWait).toHaveBeenCalledWith(7)
+  })
+})
+
+describe('#3155 load-bearing: gateway.ts sends no reaction raw', () => {
+  const src = readFileSync(GATEWAY_SRC, 'utf-8')
+  const lines = src.split('\n')
+
+  /** Non-comment source lines that call `(bot|lockedBot).api.setMessageReaction`. */
+  const rawReactionLines = lines
+    .map((text, i) => ({ text, n: i + 1 }))
+    .filter(({ text }) => {
+      const t = text.trim()
+      if (t.startsWith('*') || t.startsWith('//') || t.startsWith('/*')) return false
+      return /\b(bot|lockedBot)\.api\.setMessageReaction\b/.test(text)
+    })
+
+  it('has EXACTLY ONE runtime setMessageReaction callsite (the shared seam)', () => {
+    // If this fails with >1, a raw reaction was re-introduced somewhere —
+    // ungated and invisible to the flood breaker. Route it through
+    // `sendReaction` / `gatedSetMessageReaction` instead.
+    expect(rawReactionLines).toHaveLength(1)
+  })
+
+  it('the sole seam is tagged cosmetic and routed through robustApiCall', () => {
+    const seamLine = rawReactionLines[0]!.n
+    // Look at the seam line + a small window for its opts object.
+    const window = lines.slice(seamLine - 2, seamLine + 6).join('\n')
+    expect(window).toContain('robustApiCall(')
+    expect(window).toContain("priorityClass: 'cosmetic'")
+    expect(window).toContain("verb: 'set-message-reaction'")
+  })
+
+  it('no reaction is fired as a raw fire-and-forget bot.api call', () => {
+    // Belt-and-braces: the old `bot.api.setMessageReaction(...).catch(() => {})`
+    // shape must be gone entirely.
+    expect(src).not.toMatch(/bot\.api\.setMessageReaction\([^)]*\)\s*\.catch/)
+    // And the fire-and-forget callers now go through the helper.
+    expect(src).toContain('void sendReaction(')
+  })
+})

package/telegram-plugin/tests/render/render-outbound-chunks.test.ts

@@ -17,8 +17,10 @@ import { describe, it, expect } from "vitest";
 import { renderOutboundChunks, PLAIN_TEXT_MAX_CHARS } from "../../render/rich-render.js";
 import { RICH_MESSAGE_MAX_CHARS } from "../../format.js";
 
-const ON = { SWITCHROOM_RICH_RENDER: "1" } as NodeJS.ProcessEnv;
-const OFF = {} as NodeJS.ProcessEnv;
+// Rendering is ON BY DEFAULT (escape hatch, not opt-in — mirrors the send
+// gate): an empty env exercises the real default; "0" is the kill-switch.
+const ON = {} as NodeJS.ProcessEnv;
+const OFF = { SWITCHROOM_RICH_RENDER: "0" } as NodeJS.ProcessEnv;
 
 /** Count fenced-code delimiter lines (```) in a body. A piece that bisects a
  *  fenced block has an ODD count. */
@@ -27,7 +29,7 @@ function fenceCount(s: string): number {
 }
 
 describe("renderOutboundChunks", () => {
-  it("flag OFF is a single passthrough piece (byte-for-byte)", () => {
+  it("disabled (=0) is a single passthrough piece (byte-for-byte)", () => {
     const raw = "**bold** and _italic_ | a | table |";
     const pieces = renderOutboundChunks(raw, OFF);
     expect(pieces).toHaveLength(1);
@@ -35,7 +37,7 @@ describe("renderOutboundChunks", () => {
     expect(pieces[0].mode).toBe("markdown");
   });
 
-  it("flag ON, body that fits is a single piece (common case)", () => {
+  it("default (env unset), body that fits is a single piece (common case)", () => {
     const pieces = renderOutboundChunks("just some plain prose", ON);
     expect(pieces).toHaveLength(1);
     expect(pieces[0].text.length).toBeLessThanOrEqual(RICH_MESSAGE_MAX_CHARS);