switchroom 0.18.15 → 0.18.17

package/telegram-plugin/draft-stream.ts

@@ -26,6 +26,40 @@
 
 const TELEGRAM_MAX_CHARS = 32768
 
+/**
+ * Error a transport layer (stream-controller.ts) throws from its edit
+ * callback when the send gate SHED the edit — it did NOT land, and the
+ * stream must not record the snapshot as on-screen (#3110). Marked with a
+ * property (not a message pattern) so the classification is exact.
+ *
+ * `flush()` recognizes this and PRESERVES the snapshot in `shedText` so a
+ * later `finalize()` — including the argument-less finalize the gateway's
+ * cleanup paths use — re-flushes it as the stream's final state instead of
+ * silently losing the content (review F2). It deliberately does NOT restore
+ * `pendingText`: `flushLoop` drains while `pendingText != null`, and a
+ * restore there would busy-spin the loop against an open flood window.
+ */
+export interface DraftEditShedError extends Error {
+  draftEditShed: true
+}
+
+/** Build the marker error a transport throws for a gate-shed edit. */
+export function makeDraftEditShedError(messageId: number | null): DraftEditShedError {
+  return Object.assign(
+    new Error(
+      `draft edit shed by send gate (id=${messageId ?? 'unknown'}); snapshot preserved for re-flush`,
+    ),
+    { draftEditShed: true as const },
+  )
+}
+
+/** True when `err` is the shed marker thrown by a stream transport. */
+export function isDraftEditShedError(err: unknown): err is DraftEditShedError {
+  return (
+    err instanceof Error && (err as Partial<DraftEditShedError>).draftEditShed === true
+  )
+}
+
 // Throttle defaults for the in-place engine.
 //   DM chats: 400 ms — slightly more responsive than groups while staying
 //     well under Telegram's practical ~1 edit/sec/message ceiling. This
@@ -116,8 +150,17 @@ export interface DraftStreamHandle {
    * Mark the stream as final. Flushes any pending text and rejects all
    * future update() calls. Returns a promise that resolves once the final
    * edit has landed (or the initial send if no edits ever fired).
+   *
+   * When `finalText` is provided, it becomes the pending snapshot for the
+   * final flush (superseding any older pending draft — last-write-wins).
+   * Callers that know a text is the LAST one (e.g. `stream_reply`
+   * `done=true`) MUST pass it here instead of `update(text)` +
+   * `finalize()`: the flush then runs with the stream already final, so
+   * the transport layer (stream-controller) classifies the edit that
+   * renders the completed answer as `critical` for the send gate — never
+   * shed as a cosmetic draft under flood pressure (#3110).
    */
-  finalize(): Promise<void>
+  finalize(finalText?: string): Promise<void>
 
   /** Returns the captured Telegram message_id, or null if nothing has sent yet. */
   getMessageId(): number | null
@@ -163,6 +206,14 @@ export function createDraftStream(
   let messageId: number | null = config.initialMessageId ?? null
   let pendingText: string | null = null
   let lastSentText: string | null = null
+  /**
+   * Snapshot of the newest text the transport reported as SHED (thrown
+   * `DraftEditShedError`) — content that never landed. Cleared on any
+   * successful flush (a newer snapshot superseded it) and consumed by
+   * `finalize()` so the stream's last state is re-delivered once the
+   * pressure clears instead of being lost (review F2).
+   */
+  let shedText: string | null = null
   let lastSentAt = 0
   let inFlight: Promise<void> | null = null
   // Observability — per-stream fire counters for the stream-end trace.
@@ -216,11 +267,21 @@ export function createDraftStream(
       await sendViaMessage(textToSend)
       lastSentText = textToSend
       lastSentAt = Date.now()
+      shedText = null // a newer snapshot landed — drop any older shed one
     } catch (err) {
       const msg = (err as Error).message ?? String(err)
-      if (/\bmessage is not modified\b/i.test(msg)) {
+      if (isDraftEditShedError(err)) {
+        // #3110 review F2: the send gate shed this edit — it did NOT land.
+        // Preserve the snapshot for finalize()'s re-flush (as the stream's
+        // final state, sent critical) instead of silently losing it. Do NOT
+        // restore pendingText: flushLoop drains while pendingText != null
+        // and would busy-spin against an open flood window.
+        shedText = textToSend
+        log?.(`stream → shed by send gate (id: ${messageId}); snapshot preserved for re-flush`)
+      } else if (/\bmessage is not modified\b/i.test(msg)) {
         lastSentText = textToSend
         lastSentAt = Date.now()
+        shedText = null // on-screen text == this snapshot; nothing to recover
         log?.(`stream → not modified (id: ${messageId})`)
       } else if (
         /\bmessage to edit not found\b/i.test(msg)
@@ -327,9 +388,14 @@ export function createDraftStream(
       return waitPromise
     },
 
-    async finalize(): Promise<void> {
+    async finalize(finalText?: string): Promise<void> {
       if (final) return
       final = true
+      // A caller-supplied final snapshot supersedes any pending draft
+      // (last-write-wins) and is flushed below with `final` already set,
+      // so the transport classifies this edit as the answer's final
+      // render, not a sheddable draft (#3110).
+      if (finalText != null && !stopped) pendingText = finalText
       // Drain any pending updates
       if (scheduledTimer != null) {
         clearTimeout(scheduledTimer)
@@ -338,6 +404,15 @@ export function createDraftStream(
       if (inFlight) {
         await inFlight
       }
+      // #3110 review F2: if the newest snapshot was SHED by the send gate
+      // (never landed) and nothing newer is pending, re-flush it as the
+      // stream's final state. Checked AFTER awaiting inFlight so a flush
+      // that sheds mid-finalize is recovered too. A provided finalText and
+      // any pending draft both outrank the shed snapshot (they are newer).
+      if (pendingText == null && shedText != null && !stopped) {
+        pendingText = shedText
+      }
+      shedText = null
       if (pendingText != null && !stopped) {
         await flush()
       }

package/telegram-plugin/gateway/bridge-dead-watchdog.ts

@@ -60,10 +60,9 @@ import { readFileSync, writeFileSync, renameSync, unlinkSync } from 'node:fs'
 import { isCronIdentity } from './cron-session.js'
 import type { InboundMessage } from './ipc-protocol.js'
 
-/** The distinct triggerSelfRestart reason for this escalation. Classified
- *  as intent 'keep' by intentForRestartReason (recovery bounce — session
- *  model stickiness preserved), like every other switchroom-managed
- *  relaunch. */
+/** The distinct triggerSelfRestart reason for this escalation. Like every
+ *  other switchroom-managed relaunch it reverts any session `/model` override
+ *  to the configured default (session-scoped, rev 4). */
 export const BRIDGE_DEAD_RESTART_REASON = 'bridge-dead-resume'
 
 /** Default grace window before a missing bridge is treated as dead.

package/telegram-plugin/gateway/effort-command.ts

@@ -65,8 +65,9 @@ export function parseEffortCommand(text: string): ParsedEffortCommand | null {
   }
   const arg = parts[0]
   if (arg.toLowerCase() === 'help') return { kind: 'help' }
-  // `/effort default` — explicit user action that clears the durable
-  // `.session-effort` override and restores the configured default (#3039).
+  // `/effort default` — explicit user action that clears the session
+  // override (in-memory + any leftover queued-command carrier) and restores
+  // the configured default (#3186, session-scoped).
   if (arg.toLowerCase() === 'default') return { kind: 'default' }
   if (!isValidEffortArg(arg)) {
     return { kind: 'help', reason: `not a valid effort level: ${arg}` }
@@ -91,14 +92,15 @@ export interface EffortCommandDeps {
    */
   getConfiguredEffort: () => string | null
   /**
-   * Delete the durable `.session-effort` override (#3039). Optional so
+   * Clear the session effort override (#3186: the in-memory live level plus
+   * any leftover queued-command `.session-effort` carrier). Optional so
    * gateway-agnostic tests can omit it; the gateway always wires it.
    */
   clearSessionEffort?: () => void
   /**
-   * The active durable `.session-effort` override level, or null when none
-   * (#3039). Optional; used to mark the LIVE level in the menu and the show
-   * text honestly after a restart re-applied the override.
+   * The active session effort override level, or null when none (#3186:
+   * in-memory, session-scoped — reverts on restart). Optional; used to mark
+   * the LIVE level in the menu and the show text honestly.
    */
   getSessionEffort?: () => string | null
   escapeHtml: (s: string) => string
@@ -110,7 +112,7 @@ export interface EffortCommandReply {
 }
 
 const PERSIST_NOTE =
-  '_Sticky — persists across restarts and deploys until \`/effort default\` clears it. To change the configured default, set \`thinking_effort:\` in switchroom.yaml._'
+  '_Session-only — this override lasts until the agent’s next restart, then reverts to the configured \`thinking_effort:\`. \`/effort default\` clears it now. To change the default permanently, set \`thinking_effort:\` in switchroom.yaml._'
 
 const LEVELS_INLINE = EFFORT_LEVELS.map(l => `\`${l}\``).join(' · ')