switchroom 0.18.15 → 0.18.18

package/telegram-plugin/tests/llm-error-present.test.ts

@@ -0,0 +1,380 @@
+/**
+ * llm-error-present.test.ts — outcome-asserting tests for the humanized,
+ * cross-surface-deduped LLM-error surfacing (no raw JSON passthrough).
+ *
+ * Each block is written to FAIL against pre-fix behaviour:
+ *   - golden fan-out: pre-fix, the raw synthetic-error text fanned out to the
+ *     reply + done-card surfaces (≥2 messages, raw bytes) — this asserts EXACTLY
+ *     ONE JSON-free message across all three.
+ *   - operator-card sanitize: pre-fix, renderOperatorEvent embedded the raw
+ *     detail verbatim — this asserts the bytes are gone.
+ */
+
+import { describe, it, expect, beforeEach } from 'vitest'
+import {
+  parseLlmError,
+  renderLlmError,
+  stripRawErrorBytes,
+  extractRequestId,
+  formatResetLocal,
+  decideErrorSurface,
+  isActionableKind,
+  ErrorPresenceGate,
+  errorPresenceGate,
+  ERROR_COLLAPSE_WINDOW_MS,
+  type LlmErrorRetryState,
+} from '../llm-error-present.js'
+import { truncateDetailPreservingRequestId } from '../raw-error-scrub.js'
+import { projectTranscriptLine, detectErrorInTranscriptLine } from '../session-tail.js'
+import { renderOperatorEvent, type OperatorEvent } from '../operator-events.js'
+
+// A raw byte-blob every surface must scrub.
+const RAW_BYTES = `b'{"type":"error","error":{"type":"rate_limit_error","message":"rate limit"},"request_id":"req_abc123"}'`
+
+function assertNoRawBytes(text: string): void {
+  expect(text).not.toContain("b'{")
+  expect(text).not.toContain('{"type":"error"')
+  expect(text.toLowerCase()).not.toContain('api error:')
+}
+
+// ─── stripRawErrorBytes ──────────────────────────────────────────────────────
+
+describe('stripRawErrorBytes', () => {
+  it('removes the Python byte-blob, JSON error object, and API Error prefix', () => {
+    const raw = `API Error: 429 Server is temporarily limiting requests · ${RAW_BYTES}`
+    const out = stripRawErrorBytes(raw)
+    assertNoRawBytes(out)
+    expect(out).toContain('Server is temporarily limiting requests')
+  })
+
+  it('passes a clean human string through unchanged (modulo whitespace)', () => {
+    expect(stripRawErrorBytes('Invalid API key')).toBe('Invalid API key')
+    expect(stripRawErrorBytes('Rate limit exceeded')).toBe('Rate limit exceeded')
+    expect(stripRawErrorBytes('')).toBe('')
+  })
+
+  it('strips a bare JSON blob down to empty', () => {
+    expect(stripRawErrorBytes('{"type":"error","error":{"type":"overloaded_error"}}')).toBe('')
+  })
+})
+
+// ─── extractRequestId ────────────────────────────────────────────────────────
+
+describe('extractRequestId', () => {
+  it('pulls an Anthropic request_id from a raw JSON string', () => {
+    expect(extractRequestId(RAW_BYTES)).toBe('req_abc123')
+    expect(extractRequestId('no id here')).toBeUndefined()
+  })
+})
+
+// ─── parser table ────────────────────────────────────────────────────────────
+
+describe('parseLlmError — classification table', () => {
+  it('rate_limit (Anthropic account throttle)', () => {
+    const p = parseLlmError(
+      "This request would exceed your account's rate limit. Please try again later.",
+    )
+    expect(p.kind).toBe('rate_limit')
+    expect(p.source).toBe('anthropic')
+    assertNoRawBytes(p.coreText)
+  })
+
+  it('overload_529', () => {
+    const p = parseLlmError('overloaded_error: Anthropic 529 overloaded')
+    expect(p.kind).toBe('overload_529')
+    expect(p.source).toBe('anthropic')
+    assertNoRawBytes(p.coreText)
+  })
+
+  it('quota_wall with a parsed reset', () => {
+    const p = parseLlmError("You've hit your limit · resets 8:50am (Australia/Melbourne)")
+    expect(p.kind).toBe('quota_wall')
+    expect(p.source).toBe('anthropic')
+    expect(p.resetAt).toBeInstanceOf(Date)
+    expect(p.terminal).toBe(true)
+    assertNoRawBytes(p.coreText)
+  })
+
+  it('litellm-local proxy 429', () => {
+    const p = parseLlmError(
+      'litellm.RateLimitError: Deployment over user-defined ratelimit. tpm limit=8000. current usage=8241',
+    )
+    expect(p.kind).toBe('rate_limit')
+    expect(p.source).toBe('litellm-local')
+    assertNoRawBytes(p.coreText)
+  })
+
+  it('auth (credentials expired)', () => {
+    const p = parseLlmError('authentication_error: OAuth token expired, please refresh')
+    expect(p.kind).toBe('auth')
+    expect(p.source).toBe('anthropic')
+    expect(p.terminal).toBe(true)
+    expect(p.autoRetrying).toBe(false)
+  })
+
+  it('network', () => {
+    const p = parseLlmError('fetch failed: ECONNREFUSED getaddrinfo ENOTFOUND api.anthropic.com')
+    expect(p.kind).toBe('transient')
+    expect(p.source).toBe('network')
+    assertNoRawBytes(p.coreText)
+  })
+
+  it('unknown falls through cleanly', () => {
+    const p = parseLlmError('something entirely unrecognizable happened')
+    expect(p.kind).toBe('unknown')
+    assertNoRawBytes(p.coreText)
+  })
+
+  it('extracts model + requestId, and coreText is JSON-free even from a raw line', () => {
+    const raw = `Server is temporarily limiting requests · model=claude-opus-4-8 · ${RAW_BYTES}`
+    const p = parseLlmError(raw)
+    expect(p.kind).toBe('rate_limit')
+    expect(p.model).toBe('claude-opus-4-8')
+    expect(p.requestId).toBe('req_abc123')
+    assertNoRawBytes(p.coreText)
+  })
+})
+
+// ─── local-time render ───────────────────────────────────────────────────────
+
+describe('renderLlmError / formatResetLocal — local-time rendering', () => {
+  const tz = 'Australia/Melbourne'
+  // Pin now to a fixed instant. 2026-07-13T06:14:00Z = 4:14pm AEST (winter, +10).
+  const now = new Date('2026-07-13T06:14:00Z')
+
+  it('renders the reset in local wall-clock + relative tail, DST-correct', () => {
+    // resetAt = 2026-07-13T06:52:00Z = 4:52pm AEST, ~38m out.
+    const reset = new Date('2026-07-13T06:52:00Z')
+    const line = formatResetLocal(reset, tz, now)
+    expect(line).toContain('4:52pm')
+    expect(line).toContain('AEST')
+    expect(line).toContain('~in 38m')
+  })
+
+  it('renderLlmError produces a JSON-free card with the local reset', () => {
+    const parsed = parseLlmError(
+      `Server is temporarily limiting requests · resets 4:52pm (Australia/Melbourne) · ${RAW_BYTES}`,
+    )
+    const { text } = renderLlmError(parsed, 'gymbro', tz, now)
+    assertNoRawBytes(text)
+    expect(text).toContain('gymbro')
+    expect(text).toContain('AEST')
+  })
+
+  it('auth + quota_wall cards carry action buttons', () => {
+    const auth = renderLlmError(parseLlmError('authentication_error: token expired'), 'a', tz, now)
+    expect(auth.keyboard?.inline_keyboard.flat().some((b) => b.callback_data?.includes('reauth'))).toBe(true)
+    const quota = renderLlmError(
+      parseLlmError("You've hit your limit · resets 5pm"),
+      'a',
+      tz,
+      now,
+    )
+    expect(quota.keyboard?.inline_keyboard.flat().length).toBeGreaterThan(0)
+  })
+})
+
+// ─── dedup key ───────────────────────────────────────────────────────────────
+
+describe('ErrorPresenceGate — dedup key semantics', () => {
+  let gate: ErrorPresenceGate
+  beforeEach(() => {
+    gate = new ErrorPresenceGate()
+  })
+
+  it('same requestId → collapses to 1', () => {
+    const p = { kind: 'rate_limit' as const, requestId: 'req_x' }
+    const now = 1_000_000
+    const k = gate.keyFor(p, 'agent', now)
+    expect(gate.claim(k, now)).toBe(true)
+    expect(gate.claim(gate.keyFor(p, 'agent', now + 5_000), now + 5_000)).toBe(false)
+  })
+
+  it('different requestId, same kind → 2 distinct claims', () => {
+    const now = 1_000_000
+    expect(gate.claim(gate.keyFor({ kind: 'rate_limit', requestId: 'a' }, 'g', now), now)).toBe(true)
+    expect(gate.claim(gate.keyFor({ kind: 'rate_limit', requestId: 'b' }, 'g', now), now)).toBe(true)
+  })
+
+  it('no requestId, same kind: <window → 1, >window → 2', () => {
+    const now = 5 * ERROR_COLLAPSE_WINDOW_MS
+    const p = { kind: 'rate_limit' as const }
+    expect(gate.claim(gate.keyFor(p, 'g', now), now)).toBe(true)
+    // Within window (same bucket) → suppressed.
+    const within = now + ERROR_COLLAPSE_WINDOW_MS - 1
+    expect(gate.claim(gate.keyFor(p, 'g', within), within)).toBe(false)
+    // Past window (next bucket) → new claim.
+    const past = now + ERROR_COLLAPSE_WINDOW_MS + 1
+    expect(gate.claim(gate.keyFor(p, 'g', past), past)).toBe(true)
+  })
+})
+
+// ─── auto-retry silence ──────────────────────────────────────────────────────
+//
+// UNIT test of the module's own auto-retry-silence CONTRACT: given a retryState
+// with attempt<max, a transient error is suppressed. This is NOT exercised by
+// the production gateway wiring (it calls `parseLlmError(detail)` without a
+// retryState, and session-tail already drops in-flight transients upstream — see
+// the note in decideErrorSurface). These cases pin the module guarantee for any
+// caller that DOES thread retryState; they do not imply the gateway does.
+
+describe('decideErrorSurface — auto-retry silence (module contract, retryState-driven)', () => {
+  beforeEach(() => errorPresenceGate.reset())
+
+  it('a transient 529 mid-retry (attempt<max) is silenced on all surfaces', () => {
+    const retry: LlmErrorRetryState = { retryAttempt: 1, maxRetries: 5 }
+    const p = parseLlmError('overloaded_error 529 overloaded', retry)
+    expect(p.autoRetrying).toBe(true)
+    expect(p.terminal).toBe(false)
+    expect(decideErrorSurface(p, 'g', { claim: true })).toBe('suppress')
+  })
+
+  it('the same 529 at attempt>=max renders exactly one card', () => {
+    const retry: LlmErrorRetryState = { retryAttempt: 5, maxRetries: 5 }
+    const p = parseLlmError('overloaded_error 529 overloaded', retry)
+    expect(p.autoRetrying).toBe(false)
+    expect(p.terminal).toBe(true)
+    expect(decideErrorSurface(p, 'g', { claim: true })).toBe('render')
+    // A second surface for the same terminal error collapses.
+    expect(decideErrorSurface(p, 'g', { claim: true })).toBe('suppress')
+  })
+})
+
+// ─── actionable never suppressed ─────────────────────────────────────────────
+
+describe('decideErrorSurface — actionable kinds never suppressed', () => {
+  beforeEach(() => errorPresenceGate.reset())
+
+  it('auth + quota_wall always render even inside an active collapse window', () => {
+    const auth = parseLlmError('authentication_error: credentials expired')
+    const quota = parseLlmError("You've hit your limit · resets 5pm")
+    expect(isActionableKind(auth.kind)).toBe(true)
+    expect(isActionableKind(quota.kind)).toBe(true)
+    // Pre-claim the same-kind window key to simulate a busy collapse window.
+    const now = 2_000_000
+    errorPresenceGate.claim(errorPresenceGate.keyFor(auth, 'g', now), now)
+    errorPresenceGate.claim(errorPresenceGate.keyFor(quota, 'g', now), now)
+    expect(decideErrorSurface(auth, 'g', { claim: true, now })).toBe('render')
+    expect(decideErrorSurface(quota, 'g', { claim: true, now })).toBe('render')
+  })
+})
+
+// ─── golden fan-out ──────────────────────────────────────────────────────────
+
+describe('golden fan-out — one 429 line → exactly one JSON-free user message', () => {
+  beforeEach(() => errorPresenceGate.reset())
+
+  // The v2.1.x synthetic-assistant usage/rate-limit shape: the raw error text
+  // lives inside message.content[].text, with the byte-blob attached.
+  const line = JSON.stringify({
+    type: 'assistant',
+    message: {
+      role: 'assistant',
+      content: [
+        {
+          type: 'text',
+          text: `Server is temporarily limiting requests (not your usage limit) · resets 4:52pm (Australia/Melbourne) · ${RAW_BYTES}`,
+        },
+      ],
+    },
+    error: 'rate_limit',
+    isApiErrorMessage: true,
+    apiErrorStatus: 429,
+  })
+
+  it('starves the reply + done-card surfaces and renders one operator card', () => {
+    const userMessages: string[] = []
+
+    // Surfaces #1 (done-card recap) and #3 (reply passthrough) both derive from
+    // the projected transcript `text` events. Post-fix: NO text/thinking event
+    // is projected for an isApiErrorMessage line, so neither surface can relay
+    // the raw bytes as the turn's answer.
+    const projected = projectTranscriptLine(line)
+    for (const ev of projected) {
+      if (ev.kind === 'text') userMessages.push(`reply:${ev.text}`)
+    }
+    expect(projected.some((e) => e.kind === 'text')).toBe(false)
+
+    // Surface #2 (operator card): the SAME line is independently classified and
+    // rendered as the ONE humanized card. This mirrors the production gateway
+    // call exactly — `parseLlmError(detail)` with NO retryState (session-tail
+    // has already dropped any in-flight transient before forwarding, so the
+    // event that reaches the gateway is terminal by construction).
+    const detected = detectErrorInTranscriptLine(line)
+    expect(detected).not.toBeNull()
+    expect(detected!.terminal).toBe(true)
+    const parsed = parseLlmError(detected!.detail)
+    if (decideErrorSurface(parsed, 'gymbro', { claim: true }) === 'render') {
+      userMessages.push(renderLlmError(parsed, 'gymbro', 'Australia/Melbourne').text)
+    }
+
+    // EXACTLY ONE user-facing message, and it carries no raw bytes.
+    expect(userMessages).toHaveLength(1)
+    assertNoRawBytes(userMessages[0])
+  })
+})
+
+// ─── operator-card sanitize (surface #2 regression) ──────────────────────────
+
+describe('renderOperatorEvent — never relays raw error bytes', () => {
+  function ev(kind: OperatorEvent['kind'], detail: string): OperatorEvent {
+    return { kind, agent: 'g', detail, suggestedActions: [], firstSeenAt: new Date() }
+  }
+
+  it('strips raw bytes from a rate-limited detail', () => {
+    const { text } = renderOperatorEvent(ev('rate-limited', `Rate limited · ${RAW_BYTES}`))
+    assertNoRawBytes(text)
+    expect(text).toContain('Rate limited')
+  })
+
+  it('strips raw bytes from an unknown-4xx detail', () => {
+    const { text } = renderOperatorEvent(ev('unknown-4xx', `API Error: 400 bad · ${RAW_BYTES}`))
+    assertNoRawBytes(text)
+  })
+
+  it('leaves a clean detail intact', () => {
+    const { text } = renderOperatorEvent(ev('credentials-expired', 'token expired 2026-04-01'))
+    expect(text).toContain('token expired 2026-04-01')
+  })
+})
+
+// ─── request_id survives the 1000-char bridge truncation (MEDIUM) ─────────────
+
+describe('truncateDetailPreservingRequestId — exact dedup key survives truncation', () => {
+  beforeEach(() => errorPresenceGate.reset())
+
+  // A realistic long Anthropic rate-limit body whose request_id sits PAST char
+  // 1000 (the bridge's OPERATOR_EVENT_DETAIL_MAX). `filler` pads the human part.
+  function longRateLimitLine(requestId: string): string {
+    const filler = 'Server is temporarily limiting requests (not your usage limit). '.repeat(30)
+    return `${filler} b'{"type":"error","error":{"type":"rate_limit_error","message":"rate limited"},"request_id":"${requestId}"}'`
+  }
+
+  it('preserves the request_id that a naive slice(0,1000) would drop', () => {
+    const line = longRateLimitLine('req_deadbeef01')
+    expect(line.length).toBeGreaterThan(1000)
+    // A naive slice loses the trailing id...
+    expect(extractRequestId(line.slice(0, 1000))).toBeUndefined()
+    // ...but the preserving truncation keeps it, within budget.
+    const truncated = truncateDetailPreservingRequestId(line, 1000)
+    expect(truncated.length).toBeLessThanOrEqual(1000)
+    expect(extractRequestId(truncated)).toBe('req_deadbeef01')
+  })
+
+  it('two DISTINCT request_ids past char 1000 render TWO messages (exact key still fires)', () => {
+    const now = 9_000_000
+    const messages: string[] = []
+    for (const rid of ['req_aaaaaaaa', 'req_bbbbbbbb']) {
+      // Simulate the bridge hop: truncate-preserving, THEN parse gateway-side.
+      const detail = truncateDetailPreservingRequestId(longRateLimitLine(rid), 1000)
+      const parsed = parseLlmError(detail)
+      expect(parsed.requestId).toBe(rid) // exact key preserved, not coarse fallback
+      if (decideErrorSurface(parsed, 'gymbro', { claim: true, now }) === 'render') {
+        messages.push(renderLlmError(parsed, 'gymbro', 'UTC', new Date(now)).text)
+      }
+    }
+    // Pre-fix (id truncated away) both fall to the SAME `${kind}:${agent}:${bucket}`
+    // key and collapse to ONE. With the id preserved, the exact keys differ → TWO.
+    expect(messages).toHaveLength(2)
+  })
+})

package/telegram-plugin/tests/model-command.test.ts

@@ -16,6 +16,9 @@
 import { describe, it, expect, beforeAll } from "vitest";
 import {
   parseModelCommand,
+  planModelCommand,
+  isModelCommandBusy,
+  modelCommandReceiptLine,
   handleModelCommand,
   isValidModelArg,
   isSrModel,
@@ -203,7 +206,7 @@ describe("handleModelCommand — set", () => {
     const reply = await handleModelCommand({ kind: "set", model: "opus" }, deps);
     expect(calls).toEqual([{ agent: "klanker", command: "/model opus" }]);
     expect(reply.text).toContain("<pre>⏺ Set model to sonnet</pre>");
-    expect(reply.text).toContain("persists across restarts, deploys, and crashes");
+    expect(reply.text).toContain("lasts until the agent’s next restart");
     expect(reply.html).toBe(true);
     // A verified confirmation records the live model so /status stays honest
     // (bug 1: the typed path never recorded the switch before).
@@ -1374,3 +1377,83 @@ describe("isOfflineTrustedModelToken (#3042 blocker 2a)", () => {
     expect(isOfflineTrustedModelToken(alias.toUpperCase())).toBe(true);
   });
 });
+
+// ---------------------------------------------------------------------------
+// #3177 — a typed /model must NEVER be swallowed without trace when sent
+// mid-turn. The routing decision folds BOTH busy signals, and every parsed
+// shape maps to a visible action (menu / queue / apply — never "do nothing").
+// ---------------------------------------------------------------------------
+describe("#3177 typed /model never silently swallowed mid-turn", () => {
+  describe("isModelCommandBusy folds both busy signals", () => {
+    it("is busy when the turn atom is set", () => {
+      expect(isModelCommandBusy({ currentTurnActive: true, turnInFlight: false })).toBe(true);
+    });
+
+    it("is busy when only the authoritative delivery-machine/approval gate is set", () => {
+      // THE SWALLOW REGRESSION: the pre-fix handler gated on `currentTurn !==
+      // null` ALONE. A session busy by the delivery-machine / pending-approval
+      // gate while the turn atom is cleared (the recovered-late / premature-
+      // turn-end window) read as idle, so the switch injected into a busy pane
+      // and was swallowed as literal text. Folding turnInFlight closes it.
+      expect(isModelCommandBusy({ currentTurnActive: false, turnInFlight: true })).toBe(true);
+    });
+
+    it("is idle only when BOTH signals are clear", () => {
+      expect(isModelCommandBusy({ currentTurnActive: false, turnInFlight: false })).toBe(false);
+    });
+  });
+
+  describe("planModelCommand routes every shape to a visible action", () => {
+    const busyByAtom = { currentTurnActive: true, turnInFlight: false, menuEnabled: true };
+    const busyByGate = { currentTurnActive: false, turnInFlight: true, menuEnabled: true };
+    const idle = { currentTurnActive: false, turnInFlight: false, menuEnabled: true };
+
+    it("QUEUES a set while busy by the turn atom (ack, not silent inject)", () => {
+      const d = planModelCommand({ kind: "set", model: "opus" }, busyByAtom);
+      expect(d).toEqual({ kind: "queue", target: "opus" });
+    });
+
+    it("QUEUES a set while busy by the delivery-machine/approval gate ONLY — the swallow case", () => {
+      // Sabotage-verify: revert the fix (gate on currentTurnActive alone) and
+      // this flips to { kind: 'apply' } → the direct-inject swallow returns.
+      const d = planModelCommand({ kind: "set", model: "opus" }, busyByGate);
+      expect(d).toEqual({ kind: "queue", target: "opus" });
+    });
+
+    it("expands sr-* aliases into the queued target token", () => {
+      const d = planModelCommand({ kind: "set", model: "flash" }, busyByAtom);
+      expect(d).toEqual({ kind: "queue", target: "sr-gemini-2.5-flash" });
+    });
+
+    it("APPLIES a set immediately when idle by both signals", () => {
+      const d = planModelCommand({ kind: "set", model: "opus" }, idle);
+      expect(d).toEqual({ kind: "apply", parsed: { kind: "set", model: "opus" } });
+    });
+
+    it("renders the MENU for bare /model when the picker is enabled (even mid-turn)", () => {
+      expect(planModelCommand({ kind: "show" }, busyByGate)).toEqual({ kind: "menu" });
+    });
+
+    it("APPLIES the text show path when the picker is disabled", () => {
+      const d = planModelCommand({ kind: "show" }, { ...idle, menuEnabled: false });
+      expect(d).toEqual({ kind: "apply", parsed: { kind: "show" } });
+    });
+
+    it("APPLIES help so a bad arg still gets an explicit reply", () => {
+      const parsed = { kind: "help", reason: "not a valid model name: !!" } as const;
+      expect(planModelCommand(parsed, busyByGate)).toEqual({ kind: "apply", parsed });
+    });
+  });
+
+  describe("modelCommandReceiptLine — the durable, greppable entry trace", () => {
+    it("stamps agent, kind, arg, and busy for a typed set", () => {
+      const line = modelCommandReceiptLine("finn", { kind: "set", model: "opus" }, true);
+      expect(line).toBe("telegram gateway: gw /model received agent=finn kind=set arg=opus busy=true");
+    });
+
+    it("marks the show + help forms with placeholder args", () => {
+      expect(modelCommandReceiptLine("finn", { kind: "show" }, false)).toContain("kind=show arg=(show)");
+      expect(modelCommandReceiptLine("finn", { kind: "help" }, false)).toContain("kind=help arg=(help)");
+    });
+  });
+});

package/telegram-plugin/tests/permission-title.test.ts

@@ -156,25 +156,188 @@ describe('formatPermissionCardBody', () => {
     expect(body).toContain('why: _listing temp files_')
   })
 
-  test('shows "not provided" when no caller reason is present (never the description)', () => {
+  // #3167: no caller reason → an honest synthesized `context:` line built
+  // from the tool's salient input, NEVER a bare "why: not provided" and never
+  // the static schema description. The distinct `context:` label keeps the
+  // agent's omission of a rationale visible.
+  test('synthesizes a context line when no caller reason is present (never "not provided" / the description)', () => {
     const body = formatPermissionCardBody({
       toolName: 'Bash',
       inputPreview: JSON.stringify({ command: 'ls /tmp' }),
       description: 'Run a shell command on the host.',
       agentName: 'gymbro',
     })
-    expect(body).toContain('why: _not provided_')
+    expect(body).not.toContain('not provided')
     expect(body).not.toContain('Run a shell command')
+    expect(body).toContain('context: _command: ls /tmp_')
   })
 
-  test('shows "not provided" when caller reason is whitespace only', () => {
+  test('synthesizes context when the caller reason is whitespace only', () => {
     const body = formatPermissionCardBody({
       toolName: 'Bash',
       inputPreview: JSON.stringify({ command: 'ls /tmp', reason: '   \n ' }),
       description: 'Run a shell command.',
       agentName: 'gymbro',
     })
-    expect(body).toContain('why: _not provided_')
+    expect(body).not.toContain('not provided')
+    expect(body).toContain('context: _command: ls /tmp_')
+  })
+
+  // #3167 root case: the `reply` tool (and react/edit_message/…) carries NO
+  // `reason` argument, so its cards used to render a contentless
+  // "🔐 Clerk wants to reply / why: not provided". Now the reply text is
+  // synthesized onto a `context:` line so the operator has something to judge.
+  test('reply (no reason arg) synthesizes the reply text as context, not "not provided"', () => {
+    const body = formatPermissionCardBody({
+      toolName: 'mcp__switchroom-telegram__reply',
+      inputPreview: JSON.stringify({
+        chat_id: '12345',
+        text: "On it — pulling yesterday's GitHub activity now.",
+        format: 'html',
+        disable_notification: true,
+      }),
+      description: 'Reply on Telegram.',
+      agentName: 'clerk',
+    })
+    const lines = body.split('\n')
+    expect(lines[0]).toBe('🔐 **Clerk** wants to reply')
+    expect(body).not.toContain('not provided')
+    // Salient field surfaced (truncated); id/routing/formatting noise stripped.
+    expect(body).toContain('context: _text: On it — pulling')
+    expect(body).toMatch(/context: _text: On it — pulling[^_]*…_/)
+    expect(body).not.toContain('chat_id')
+    expect(body).not.toContain('disable_notification')
+    expect(body).not.toContain('format')
+  })
+
+  test('a reason ON a reply card still renders as why:, not context: (#3167)', () => {
+    const body = formatPermissionCardBody({
+      toolName: 'mcp__switchroom-telegram__reply',
+      inputPreview: JSON.stringify({
+        chat_id: '12345',
+        text: 'done',
+        reason: 'answering the operator’s status question',
+      }),
+      description: 'Reply on Telegram.',
+      agentName: 'clerk',
+    })
+    expect(body).toContain('why: _answering the operator’s status question_')
+    expect(body).not.toContain('context:')
+  })
+
+  test('synthesized context redacts secrets in the salient input (#3167)', () => {
+    const fakeToken = 'sk-ant-' + 'api03-' + 'B'.repeat(48)
+    const body = formatPermissionCardBody({
+      toolName: 'mcp__switchroom-telegram__reply',
+      inputPreview: JSON.stringify({ chat_id: '1', text: `here is the key: ${fakeToken}` }),
+      description: 'Reply on Telegram.',
+      agentName: 'clerk',
+    })
+    expect(body).toContain('context:')
+    expect(body).not.toContain(fakeToken)
+  })
+
+  test('falls back to the natural action when the input exposes nothing salient (#3167)', () => {
+    const body = formatPermissionCardBody({
+      toolName: 'ExitPlanMode',
+      inputPreview: undefined,
+      description: 'Exit plan mode.',
+      agentName: 'clerk',
+    })
+    expect(body).not.toContain('not provided')
+    expect(body).toContain('context: _exit plan mode_')
+  })
+
+  // #3167 review (HIGH/MEDIUM): the salient-value redactor must catch secrets
+  // the bare-value path missed. redact() excludes generic_high_entropy and the
+  // contextual kv detectors need a `key=value` shape — so a prefixless token
+  // under a credential-shaped key leaked verbatim. These FAIL pre-fix.
+  test('hard-masks a prefixless high-entropy value under a `token` key (#3167)', () => {
+    // No sk-/ghp-/JWT prefix — shape detection alone cannot catch it; only the
+    // key-name signal ("token") does.
+    const bare = 'Zx8Kq2Lm9Rn4Tv6Wb1Yc3Hd5Jf7Ug0Pe'
+    const body = formatPermissionCardBody({
+      toolName: 'mcp__acme__do',
+      inputPreview: JSON.stringify({ token: bare, note: 'ping' }),
+      description: 'do a thing',
+      agentName: 'clerk',
+    })
+    expect(body).not.toContain(bare)
+    // `token` value is hard-masked; the benign `note` still surfaces.
+    expect(body).toContain('token:')
+    expect(body).toContain('REDACTED')
+    expect(body).toContain('note: ping')
+  })
+
+  test('hard-masks a 40-hex secret under a `secret`-shaped key (#3167)', () => {
+    const hex = 'a3f1'.repeat(10) // 40 hex chars, no prefix
+    const body = formatPermissionCardBody({
+      toolName: 'mcp__acme__do',
+      inputPreview: JSON.stringify({ webhook_secret: hex }),
+      description: 'do a thing',
+      agentName: 'clerk',
+    })
+    expect(body).not.toContain(hex)
+    expect(body).toContain('REDACTED')
+  })
+
+  test('masks a non-http DSN credential embedded in free text (redactUrls misses it) (#3167)', () => {
+    // Under a benign key (`text`) so the hard-mask key path does NOT fire —
+    // this exercises the NON_HTTP_DSN_RE scheme coverage specifically.
+    const dsn = 'postgres://user:S3cretPass99@db.host:5432/app'
+    const body = formatPermissionCardBody({
+      toolName: 'mcp__switchroom-telegram__reply',
+      inputPreview: JSON.stringify({ chat_id: '1', text: `connect via ${dsn} then run` }),
+      description: 'Reply on Telegram.',
+      agentName: 'clerk',
+    })
+    expect(body).not.toContain('S3cretPass99')
+    expect(body).not.toContain(dsn)
+    expect(body).toContain('REDACTED')
+  })
+
+  test('hard-masks a DATABASE_URL under a url-shaped key (#3167)', () => {
+    const dsn = 'postgres://admin:hunter2pass@10.0.0.5/prod'
+    const body = formatPermissionCardBody({
+      toolName: 'mcp__acme__migrate',
+      inputPreview: JSON.stringify({ database_url: dsn }),
+      description: 'run a migration',
+      agentName: 'clerk',
+    })
+    expect(body).not.toContain('hunter2pass')
+    expect(body).not.toContain(dsn)
+    expect(body).toContain('REDACTED')
+  })
+
+  // #3167 review (LOW-2): acceptance asks for "tool + summarized input +
+  // originating turn" — surface a compact origin-turn reference when present.
+  test('appends a compact originating-turn reference when origin_turn_id is present (#3167)', () => {
+    const body = formatPermissionCardBody({
+      toolName: 'mcp__switchroom-telegram__reply',
+      inputPreview: JSON.stringify({ chat_id: '1', text: 'hi', origin_turn_id: 'turn-abcdef123456' }),
+      description: 'Reply on Telegram.',
+      agentName: 'clerk',
+    })
+    expect(body).toContain('· turn …ef123456')
+    // The raw routing id is NOT dumped as its own kv pair.
+    expect(body).not.toContain('origin_turn_id:')
+  })
+
+  // #3167 review (LOW-3): raw commands/text now reach the context line, so a
+  // markdown metachar in the value must be escaped or it can spoof/break the
+  // card's own `_italic_` / `code` formatting.
+  test('escapes markdown metachars in the synthesized context value (#3167)', () => {
+    const body = formatPermissionCardBody({
+      toolName: 'Bash',
+      inputPreview: JSON.stringify({ command: 'echo _a_ *b* `c`' }),
+      description: 'run a shell command',
+      agentName: 'clerk',
+    })
+    // The metachars are backslash-escaped so they can't open emphasis/code.
+    expect(body).toContain('\\_a\\_')
+    expect(body).toContain('\\*b\\*')
+    expect(body).toContain('\\`c\\`')
+    expect(body).not.toContain('echo _a_ *b* `c`')
   })
 
   test('drops the agent prefix when agentName is null (early-boot edge)', () => {