switchroom 0.18.12 → 0.18.14

package/telegram-plugin/dist/server.js

@@ -17062,6 +17062,48 @@ var init_operator_events = __esm(() => {
   cooldownMap = new Map;
 });
 
+// quota-check.ts
+var init_quota_check = () => {};
+
+// text-voice-scrub.ts
+var NULL = "\x00", FENCE_PH, INLINE_PH, HTML_CODE_PH, HTML_PRE_PH, URL_PH;
+var init_text_voice_scrub = __esm(() => {
+  FENCE_PH = `${NULL}VS_FENCE`;
+  INLINE_PH = `${NULL}VS_INLINE`;
+  HTML_CODE_PH = `${NULL}VS_HTMLCODE`;
+  HTML_PRE_PH = `${NULL}VS_HTMLPRE`;
+  URL_PH = `${NULL}VS_URL`;
+});
+
+// card-format.ts
+var init_card_format = __esm(() => {
+  init_text_voice_scrub();
+});
+
+// model-unavailable.ts
+function isTransientUpstreamSignal(text) {
+  if (typeof text !== "string" || text.length === 0)
+    return false;
+  const sample = text.length > 16384 ? text.slice(0, 16384) : text;
+  const lower = sample.toLowerCase();
+  return transientUpstreamSignals.some((s) => lower.includes(s));
+}
+var transientUpstreamSignals;
+var init_model_unavailable = __esm(() => {
+  init_quota_check();
+  init_card_format();
+  transientUpstreamSignals = [
+    "not your usage limit",
+    "not your account",
+    "not your account's",
+    "temporarily limiting requests",
+    "temporarily rate",
+    "server is temporarily",
+    "would exceed your account\u2019s rate limit",
+    "would exceed your account's rate limit"
+  ];
+});
+
 // tool-label-sidecar.ts
 import { existsSync as existsSync3, readFileSync as readFileSync2, statSync as statSync3 } from "node:fs";
 import { join as join3 } from "node:path";
@@ -17491,7 +17533,8 @@ function detectErrorInTranscriptLine(line) {
     const status = typeof obj.apiErrorStatus === "number" ? obj.apiErrorStatus : null;
     const errStr = typeof obj.error === "string" ? obj.error : "";
     const text = extractAssistantText(obj);
-    const kind2 = status === 429 ? "quota-exhausted" : classifyClaudeError({ type: errStr, status, message: text });
+    const kind2 = status === 429 ? isTransientUpstreamSignal(`${text}
+${errStr}`) ? "rate-limited" : "quota-exhausted" : classifyClaudeError({ type: errStr, status, message: text });
     return {
       kind: kind2,
       raw: obj,
@@ -17585,6 +17628,7 @@ function startSessionTail(config2) {
   const onOperatorEvent = config2.onOperatorEvent;
   log?.(`session-tail: projectsDir=${projectsDir}`);
   const sidecars = new Map;
+  const createSidecar = config2.createSidecar ?? createToolLabelSidecar;
   const stateDirForSidecar = process.env.TELEGRAM_STATE_DIR ?? null;
   function sessionIdForFile(file) {
     if (!file)
@@ -17599,7 +17643,7 @@ function startSessionTail(config2) {
     if (existing)
       return existing;
     try {
-      const s = createToolLabelSidecar({ stateDir: stateDirForSidecar, sessionId });
+      const s = createSidecar({ stateDir: stateDirForSidecar, sessionId });
       sidecars.set(sessionId, s);
       s.onLabel((toolUseId, label, toolName) => {
         rawOnEvent({ kind: "tool_label", toolUseId, label, toolName });
@@ -17610,6 +17654,17 @@ function startSessionTail(config2) {
       return null;
     }
   }
+  function stopSidecar(sessionId) {
+    if (!sessionId)
+      return;
+    const s = sidecars.get(sessionId);
+    if (!s)
+      return;
+    try {
+      s.stop();
+    } catch {}
+    sidecars.delete(sessionId);
+  }
   function decorate(ev, sessionId) {
     if (!sessionId)
       return ev;
@@ -17702,6 +17757,11 @@ function startSessionTail(config2) {
       } catch {}
       watcher = null;
     }
+    const rotatedAwaySid = sessionIdForFile(currentFile);
+    const nextSid = sessionIdForFile(file);
+    if (rotatedAwaySid != null && rotatedAwaySid !== nextSid) {
+      stopSidecar(rotatedAwaySid);
+    }
     currentFile = file;
     const prior = fileCursors.get(file);
     if (prior != null) {
@@ -17734,7 +17794,7 @@ function startSessionTail(config2) {
   const multiAgent = isMultiAgentEnabled();
   const CAP_TOOL_USE_THRESHOLD = 30;
   const subTails = new Map;
-  const IDLE_FSWATCH_TTL_MS = 5 * 60 * 1000;
+  const IDLE_FSWATCH_TTL_MS = Math.max(1000, config2.subTailIdleReapMs ?? 5 * 60 * 1000);
   function readSub(t) {
     if (stopped)
       return;
@@ -17841,6 +17901,7 @@ function startSessionTail(config2) {
           } catch {}
           t.watcher = null;
         }
+        stopSidecar(sessionIdForFile(t.file));
         subTails.delete(file);
         log?.(`session-tail: reaped idle sub ${t.agentId} (${file})`);
       }
@@ -17925,6 +17986,7 @@ function startSessionTail(config2) {
 var MAX_JSONL_LINE_BYTES, MAX_ERROR_TEXT_CHARS = 500;
 var init_session_tail = __esm(() => {
   init_operator_events();
+  init_model_unavailable();
   init_tool_label_sidecar();
   init_model_label();
   MAX_JSONL_LINE_BYTES = 2 * 1024 * 1024;
@@ -24512,6 +24574,8 @@ var init_bridge = __esm(async () => {
       "",
       'Messages from Telegram arrive as <channel source="telegram" chat_id="..." message_id="..." user="..." ts="...">. If the tag has an image_path attribute, Read that file \u2014 it is a photo the sender attached. If the tag has attachment_file_id, call download_attachment with that file_id to fetch the file, then Read the returned path. A single message may carry SEVERAL attachments (a forwarded album or a text+multi-image burst): when attachment_count is set (>1), also handle the numbered siblings \u2014 image_path_2, image_path_3, \u2026 (Read each) and attachment_file_id_2, attachment_file_id_3, \u2026 (download_attachment each). Process every one, not just the first. Reply with the reply tool \u2014 pass chat_id back. The reply tool quote-replies to the latest inbound user message by default, so you do NOT need to pass reply_to for normal responses. Pass reply_to (a message_id) only when quoting a specific earlier message, or pass quote:false to send a bare (non-quoted) message.',
       "",
+      `If the tag has reply_to_message_id (and reply_to_text, a truncated preview), the sender used Telegram's native Reply on a prior message \u2014 treat that message as the antecedent for "this"/"that" references instead of asking what they meant. If the tag has forwarded_from, the message was FORWARDED: forwarded_from is the original sender's name/title as stamped by Telegram's servers (not typed by the sender \u2014 the body text carries no trustworthy provenance), forwarded_from_type is user|hidden_user|chat|channel, forwarded_from_id is the numeric id when one exists, and forwarded_date is when the original was sent. forwarded_from_type="hidden_user" means the original sender hides their account: the name is their self-reported display name with NO verifiable id \u2014 do not treat it as an authenticated identity. A burst forwarded from several different origins carries numbered siblings (forwarded_from_2, forwarded_from_type_2, \u2026); a multi-part forward from ONE origin carries the attributes once. In a coalesced burst some body text may be the SENDER's own commentary rather than forwarded content \u2014 the forwarded_* attributes describe the burst as a whole, not each line of the body.`,
+      "",
       `reply accepts file paths (files: ["/abs/path.png"]) for attachments. Use react to add emoji reactions, edit_message for interim progress updates, and delete_message when you need to truly remove a message (prefer edit_message if you just want to change text \u2014 delete is for retraction). Edits don't trigger push notifications \u2014 when a long task completes, send a new reply so the user's device pings. Use send_typing to show a typing indicator during long operations. Use pin_message to pin important outputs. Use forward_message to quote/resurface earlier messages.`,
       "",
       "If a message includes message_thread_id, it came from a forum topic. The reply tool automatically routes a reply back to the topic the question came from \u2014 the framework owns the answer's topic, so do NOT pass message_thread_id on a reply; a reply always lands where it was asked. Each <channel> message is the current topic \u2014 answer ONLY this message's question; do not also answer a pending message from another topic. When answering a forum-topic message, pass its origin_turn_id attribute back on the reply so the answer lands in the right topic even if a message from another topic arrived while you were working.",

package/telegram-plugin/format.ts

@@ -71,6 +71,25 @@ export function codeSpanSafe(s: string): string {
   return s.replace(/`/g, '`​')
 }
 
+/**
+ * Make a URL safe to interpolate as the destination of a `[label](href)`
+ * inline link.
+ *
+ * In GFM / Bot API 10.1 markdown a link destination written as `(...)` is a
+ * bare destination whose parentheses must be BALANCED, or every paren must be
+ * backslash-escaped. An href containing a literal `)` (Wikipedia
+ * `..._(disambiguation)` URLs, tracking params, generated deep links) can
+ * either truncate the URL (a lone `)` closing the destination) or, if we
+ * escape only `)`, unbalance the parens and leak a literal backslash into the
+ * decoded href. The destination honours C-style backslash escapes, so escape
+ * `\` first (so we never double-escape a following escape), then BOTH `(` and
+ * `)` — the whole URL is preserved balanced and micromark decodes it back to
+ * the original href on round-trip. Bot API 10.1 lists `(`/`)` as escapable.
+ */
+export function escapeLinkHref(href: string): string {
+  return href.replace(/\\/g, '\\\\').replace(/\(/g, '\\(').replace(/\)/g, '\\)')
+}
+
 /**
  * Repair LLM-side JSON escape bungles.
  *

package/telegram-plugin/gateway/approval-hold.ts

@@ -268,12 +268,31 @@ export function createBlockedApprovalStore(
    *
    * This exists so the feature cannot silently no-op. If the shared bind is
    * missing (a container predating the volume), or auto-created root-owned, the
-   * record still lands somewhere the operator and switchroom-web can read —
-   * web mounts all of `~/.switchroom`, so both locations are reachable.
+   * record still lands somewhere the operator and switchroom-web can read.
+   *
+   * **Reachable by mount is not the same as readable, and neither is the same as
+   * READ.** That elision is a bug this comment used to paper over: it claimed
+   * "web mounts all of ~/.switchroom, so both locations are reachable" — true,
+   * and irrelevant, because the reader only ever scanned the shared dir. The
+   * fallback was written to a file nobody read (#3109). Two things must hold, and
+   * both are load-bearing: if either regresses, the record exists, the agent is
+   * held, and the dashboard still prints "No agent is blocked".
+   *
+   *   1. **Mode.** The record is written 0644 into the 0775 agent dir. Verified
+   *      live: `docker exec switchroom-web` reads a 0644 file under
+   *      `~/.switchroom/agents/<agent>/` fine and gets EACCES only on the 0600
+   *      files beside it. The FILE's mode locks web out, never the directory.
+   *   2. **The reader must LOOK here.** It now does —
+   *      `src/web/blocked-approvals-read.ts` scans the shared dir AND
+   *      `agents/<agent>/blocked-approval.json` (its `FALLBACK_RECORD_NAME`,
+   *      which must stay in sync with the filename below).
    */
   fallbackDir?: string,
 ): BlockedApprovalStore {
   const primary = join(dir, `${agent}.json`)
+  // Keep in sync with FALLBACK_RECORD_NAME in src/web/blocked-approvals-read.ts —
+  // the reader matches this filename exactly. Pinned by the fallback-contract
+  // tests in src/web/blocked-approvals.test.ts.
   const fallback = fallbackDir != null ? join(fallbackDir, 'blocked-approval.json') : null
 
   /** Where the last successful write landed — `read`/`clear` must agree with it. */

package/telegram-plugin/gateway/auth-broker-client.ts

@@ -28,6 +28,7 @@ export function createAuthBrokerClient(): {
     listState: () => broker.listState(),
     setActive: (label: string) => broker.setActive(label),
     markExhausted: (until?: number) => broker.markExhausted(until),
+    markThrottled: (until: number) => broker.markThrottled(until),
     rmAccount: (label: string) => broker.rmAccount(label),
     refreshAccount: (label: string) => broker.refreshAccount(label),
     setOverride: (agent: string, account: string | null) =>

package/telegram-plugin/gateway/auth-command.ts

@@ -301,6 +301,20 @@ export interface AuthBrokerClient {
    * identity — so auto-fallback works from any agent.
    */
   markExhausted(until?: number): Promise<{ account: string; rolled: string[]; rolledTo?: string | null }>
+  /**
+   * 429 throttle tier (broker `mark-throttled`). Records a transient
+   * per-account rate limit on the CALLER's own account — `throttled_until`
+   * in the quota ledger — WITHOUT rolling the fleet and WITHOUT touching
+   * eligibility. `escalated` is true when the broker's escalation guard
+   * (repeated hits corroborated by a live probe) converted it into the
+   * standard mark-exhausted + roll; `rolledTo` names the roll target then.
+   */
+  markThrottled(until: number): Promise<{
+    account: string
+    throttled_until: number
+    escalated: boolean
+    rolledTo?: string | null
+  }>
   rmAccount(label: string): Promise<{ label: string }>
   refreshAccount(label: string): Promise<{ account: string; expiresAt?: number }>
   setOverride(

package/telegram-plugin/gateway/callback-query-handlers.ts

@@ -2534,6 +2534,18 @@ async function handleOperatorEventCallback(ctx: Context, data: string): Promise<
 // stub so any stale pinned message that fires an `auth:*` tap is
 // silently dismissed instead of crashing the gateway.
 async function handleAuthDashboardCallback(ctx: Context): Promise<void> {
+  // Strict allowFrom gate, identical to every other mutating handler in
+  // this file (handleOperatorEventCallback, the vra:/vrs:/vd:/vg: families).
+  // Its absence was a security hole: `auth:use:<label>` drives
+  // `client.setActive(label)` — a fleet-wide OAuth account swap — so an
+  // ungated handler let any tapper (e.g. a member of an admin forum/
+  // supergroup with an empty group allowFrom) swap the active account.
+  const senderId = String(ctx.from?.id ?? '')
+  const access = loadAccess()
+  if (!access.allowFrom.includes(senderId)) {
+    await ctx.answerCallbackQuery({ text: 'Not authorized.' }).catch(() => {})
+    return
+  }
   const data = ctx.callbackQuery?.data ?? ''
   const currentAgent = getMyAgentName()
 

package/telegram-plugin/gateway/forward-origin.ts

@@ -0,0 +1,235 @@
+/**
+ * Pure helpers for forwarded-message origin metadata — kept out of
+ * `gateway.ts` (same pattern as `coalesce-attachments.ts`) so the parsing,
+ * escaping, and numbered-sibling logic can be unit-tested without the
+ * gateway's `loadAccess()` / IPC machinery.
+ *
+ * When a user forwards a message to the bot, Telegram stamps
+ * `message.forward_origin` SERVER-side (Bot API 7.0+). Unlike the message
+ * body — which the forwarding user fully controls — the origin record
+ * cannot be forged by typing, so it is the trusted lane for "who
+ * originally sent this". The gateway surfaces it to the agent as
+ * `forwarded_*` channel-meta ATTRIBUTES only; origin info is never
+ * injected into the body text, keeping the attacker-influenceable body
+ * and the server-stamped provenance on separate lanes.
+ *
+ * Caveat surfaced via `forwarded_from_type="hidden_user"`: a sender who
+ * enabled forward privacy yields only a self-reported display name with
+ * NO verifiable id — agents can see the name but must not treat it as an
+ * authenticated identity.
+ */
+
+import type { MessageOrigin } from 'grammy/types'
+import { escapeXmlAttribute } from '../steering.js'
+
+/**
+ * Cap on the human-readable origin name/title. Names and titles are
+ * attacker-controlled (a hostile account can set a 4KB display name);
+ * mirror the REPLY_TO_TEXT_MAX truncate-then-escape pattern with a cap
+ * sized for names rather than message previews.
+ */
+export const FORWARDED_FROM_NAME_MAX = 100
+
+export type ForwardOriginType = 'user' | 'hidden_user' | 'chat' | 'channel'
+
+/**
+ * Normalized origin record. `name` is RAW (truncated but unescaped) so it
+ * can be persisted verbatim to the SQLite history buffer — the XML
+ * escaping happens at the channel-meta boundary in
+ * `buildForwardOriginMeta`, same split as `replyToText` /
+ * `replyToTextEscaped` in the gateway inbound handler.
+ */
+export interface ForwardOriginInfo {
+  /** Human-readable name/title of the original sender (raw, truncated). */
+  name: string
+  type: ForwardOriginType
+  /** Numeric id when the origin shape exposes one (user id / chat id). */
+  id?: number
+  /** Unix seconds of the original message (`forward_origin.date`). */
+  date?: number
+  /** Channel origins only: the message id inside the origin channel. */
+  messageId?: number
+}
+
+function truncateName(name: string): string {
+  return name.length > FORWARDED_FROM_NAME_MAX
+    ? name.slice(0, FORWARDED_FROM_NAME_MAX - 1) + '…'
+    : name
+}
+
+/** Join first/last name plus a trailing `(@username)` when present. */
+function personName(parts: {
+  first_name?: string
+  last_name?: string
+  username?: string
+}): string {
+  const name = [parts.first_name, parts.last_name]
+    .filter((p): p is string => typeof p === 'string' && p.length > 0)
+    .join(' ')
+  const handle = parts.username ? `(@${parts.username})` : ''
+  return [name, handle].filter((p) => p.length > 0).join(' ')
+}
+
+/** Chat/channel title plus a trailing `(@username)` when present. */
+function chatTitle(chat: {
+  title?: string
+  username?: string
+  first_name?: string
+  last_name?: string
+}): string {
+  // Defensive: `Chat` is a union — groups/channels carry `title`, a
+  // private chat carries first/last name instead. Fall through so a
+  // malformed/unexpected shape still yields whatever name exists.
+  if (chat.title && chat.title.length > 0) {
+    const handle = chat.username ? `(@${chat.username})` : ''
+    return [chat.title, handle].filter((p) => p.length > 0).join(' ')
+  }
+  return personName(chat)
+}
+
+/**
+ * Parse Telegram's `message.forward_origin` into a normalized record.
+ * Returns `undefined` for non-forwarded messages, unknown origin types,
+ * and records so malformed that no human-readable name can be recovered
+ * (the attrs are context, not a gate — degrading to "no origin metadata"
+ * is safe; inventing a name is not).
+ *
+ * Accepts `unknown`-ish input defensively: the origin arrives from the
+ * Telegram wire and future Bot API versions may add origin types this
+ * build doesn't know.
+ */
+export function parseForwardOrigin(
+  origin: MessageOrigin | undefined,
+): ForwardOriginInfo | undefined {
+  if (origin == null || typeof origin !== 'object') return undefined
+  const date = typeof origin.date === 'number' ? origin.date : undefined
+  switch (origin.type) {
+    case 'user': {
+      const u = origin.sender_user
+      if (u == null || typeof u !== 'object') return undefined
+      const name = personName(u)
+      if (name.length === 0) {
+        // No printable name at all — fall back to the (unforgeable) id.
+        if (typeof u.id !== 'number') return undefined
+        return { name: String(u.id), type: 'user', id: u.id, date }
+      }
+      return {
+        name: truncateName(name),
+        type: 'user',
+        ...(typeof u.id === 'number' ? { id: u.id } : {}),
+        date,
+      }
+    }
+    case 'hidden_user': {
+      // Forward-privacy senders: `sender_user_name` is a SELF-REPORTED
+      // display name with no verifiable id. The `hidden_user` type marker
+      // is the agent's signal to treat the name as unauthenticated.
+      const name = typeof origin.sender_user_name === 'string'
+        ? origin.sender_user_name
+        : ''
+      if (name.length === 0) return undefined
+      return { name: truncateName(name), type: 'hidden_user', date }
+    }
+    case 'chat': {
+      const c = origin.sender_chat
+      if (c == null || typeof c !== 'object') return undefined
+      const name = chatTitle(c)
+      if (name.length === 0) {
+        if (typeof c.id !== 'number') return undefined
+        return { name: String(c.id), type: 'chat', id: c.id, date }
+      }
+      return {
+        name: truncateName(name),
+        type: 'chat',
+        ...(typeof c.id === 'number' ? { id: c.id } : {}),
+        date,
+      }
+    }
+    case 'channel': {
+      const c = origin.chat
+      if (c == null || typeof c !== 'object') return undefined
+      const name = chatTitle(c)
+      const messageId = typeof origin.message_id === 'number' ? origin.message_id : undefined
+      if (name.length === 0) {
+        if (typeof c.id !== 'number') return undefined
+        return { name: String(c.id), type: 'channel', id: c.id, date, messageId }
+      }
+      return {
+        name: truncateName(name),
+        type: 'channel',
+        ...(typeof c.id === 'number' ? { id: c.id } : {}),
+        date,
+        messageId,
+      }
+    }
+    default:
+      // Unknown future origin type — no metadata beats wrong metadata.
+      return undefined
+  }
+}
+
+/**
+ * Identity key for burst dedup: same-typed origins with the same id are
+ * one origin; id-less shapes (hidden_user) fall back to the name.
+ */
+export function forwardOriginKey(o: ForwardOriginInfo): string {
+  return o.id != null ? `${o.type}:${o.id}` : `${o.type}:${o.name}`
+}
+
+/**
+ * Collapse the per-message origins of a coalesced burst into the DISTINCT
+ * origins in arrival order. A 10-part album forwarded from one channel
+ * yields ONE origin (attrs emitted once); a burst mixing forwards from two
+ * different senders yields two (the second gets `forwarded_from_2` etc.).
+ * Non-forwarded entries (`undefined`) are skipped. First occurrence wins,
+ * so the emitted `forwarded_date` is the first message's origin date.
+ */
+export function dedupeForwardOrigins(
+  origins: Array<ForwardOriginInfo | undefined>,
+): ForwardOriginInfo[] {
+  const seen = new Set<string>()
+  const out: ForwardOriginInfo[] = []
+  for (const o of origins) {
+    if (o == null) continue
+    const key = forwardOriginKey(o)
+    if (seen.has(key)) continue
+    seen.add(key)
+    out.push(o)
+  }
+  return out
+}
+
+/**
+ * Build the `forwarded_*` channel-meta fields. Fixed per-origin attribute
+ * order (documented here, tested in forward-origin.test.ts):
+ *   forwarded_from, forwarded_from_type, forwarded_from_id, forwarded_date
+ * The primary field is the human-readable NAME; the numeric id is
+ * supplementary and follows it. The first origin gets the bare keys;
+ * subsequent distinct origins get `_2`, `_3`, … suffixes — the same
+ * numbered-sibling convention as `image_path_2` / `attachment_file_id_2`.
+ *
+ * Names/titles are attacker-controlled, so every value that can carry
+ * user text goes through `escapeXmlAttribute` (the same escaper
+ * `formatReplyToText` uses) before landing in the channel tag.
+ */
+export function buildForwardOriginMeta(
+  origins: ForwardOriginInfo[],
+): Record<string, string> {
+  const out: Record<string, string> = {}
+  origins.forEach((o, i) => {
+    const suffix = i === 0 ? '' : `_${i + 1}`
+    out[`forwarded_from${suffix}`] = escapeXmlAttribute(truncateName(o.name))
+    out[`forwarded_from_type${suffix}`] = o.type
+    if (o.id != null) out[`forwarded_from_id${suffix}`] = String(o.id)
+    if (o.date != null) {
+      out[`forwarded_date${suffix}`] = new Date(o.date * 1000).toISOString()
+    }
+  })
+  return out
+}
+
+/** ISO form of an origin date for the SQLite history record. */
+export function forwardOriginDateIso(o: ForwardOriginInfo | undefined): string | null {
+  if (o?.date == null) return null
+  return new Date(o.date * 1000).toISOString()
+}