switchroom 0.18.15 → 0.18.18

package/telegram-plugin/dist/server.js

@@ -16994,6 +16994,27 @@ var init_plugin_logger = __esm(() => {
   DEFAULT_LOG_PATH2 = join2(homedir2(), ".switchroom", "logs", "telegram-plugin.log");
   ROTATE_AT_BYTES2 = 50 * 1024 * 1024;
 });
+// raw-error-scrub.ts
+function extractRequestId(raw) {
+  if (typeof raw !== "string" || raw.length === 0)
+    return;
+  const m = raw.match(/["']request[_-]?id["']\s*:\s*["']([A-Za-z0-9._-]+)["']/i) ?? raw.match(/\brequest[_-]?id[=:]\s*([A-Za-z0-9._-]+)/i);
+  return m ? m[1] : undefined;
+}
+function truncateDetailPreservingRequestId(detail, max) {
+  if (typeof detail !== "string")
+    return "";
+  if (detail.length <= max)
+    return detail;
+  const rid = extractRequestId(detail);
+  const head = detail.slice(0, max);
+  if (rid == null || head.includes(rid))
+    return head;
+  const suffix = ` request_id=${rid}`;
+  const headBudget = Math.max(0, max - suffix.length);
+  return `${detail.slice(0, headBudget)}${suffix}`;
+}
+
 // operator-events.ts
 function classifyClaudeError(raw) {
   try {
@@ -17376,6 +17397,10 @@ function projectTranscriptLine(line) {
     const content = message?.content;
     if (!Array.isArray(content))
       return [];
+    if (obj.isApiErrorMessage === true) {
+      const mainModel2 = message?.model;
+      return typeof mainModel2 === "string" && !isModelSentinel(mainModel2) ? [{ kind: "model", model: mainModel2 }] : [];
+    }
     const events = [];
     const mainModel = message?.model;
     if (typeof mainModel === "string" && !isModelSentinel(mainModel)) {
@@ -25140,7 +25165,7 @@ var init_bridge = __esm(async () => {
               type: "operator_event",
               kind: ev.kind,
               agent: AGENT_NAME,
-              detail: ev.detail.slice(0, 1000),
+              detail: truncateDetailPreservingRequestId(ev.detail, 1000),
               chatId: ""
             });
           } catch (err) {

package/telegram-plugin/draft-stream.ts

@@ -26,6 +26,40 @@
 
 const TELEGRAM_MAX_CHARS = 32768
 
+/**
+ * Error a transport layer (stream-controller.ts) throws from its edit
+ * callback when the send gate SHED the edit — it did NOT land, and the
+ * stream must not record the snapshot as on-screen (#3110). Marked with a
+ * property (not a message pattern) so the classification is exact.
+ *
+ * `flush()` recognizes this and PRESERVES the snapshot in `shedText` so a
+ * later `finalize()` — including the argument-less finalize the gateway's
+ * cleanup paths use — re-flushes it as the stream's final state instead of
+ * silently losing the content (review F2). It deliberately does NOT restore
+ * `pendingText`: `flushLoop` drains while `pendingText != null`, and a
+ * restore there would busy-spin the loop against an open flood window.
+ */
+export interface DraftEditShedError extends Error {
+  draftEditShed: true
+}
+
+/** Build the marker error a transport throws for a gate-shed edit. */
+export function makeDraftEditShedError(messageId: number | null): DraftEditShedError {
+  return Object.assign(
+    new Error(
+      `draft edit shed by send gate (id=${messageId ?? 'unknown'}); snapshot preserved for re-flush`,
+    ),
+    { draftEditShed: true as const },
+  )
+}
+
+/** True when `err` is the shed marker thrown by a stream transport. */
+export function isDraftEditShedError(err: unknown): err is DraftEditShedError {
+  return (
+    err instanceof Error && (err as Partial<DraftEditShedError>).draftEditShed === true
+  )
+}
+
 // Throttle defaults for the in-place engine.
 //   DM chats: 400 ms — slightly more responsive than groups while staying
 //     well under Telegram's practical ~1 edit/sec/message ceiling. This
@@ -116,8 +150,17 @@ export interface DraftStreamHandle {
    * Mark the stream as final. Flushes any pending text and rejects all
    * future update() calls. Returns a promise that resolves once the final
    * edit has landed (or the initial send if no edits ever fired).
+   *
+   * When `finalText` is provided, it becomes the pending snapshot for the
+   * final flush (superseding any older pending draft — last-write-wins).
+   * Callers that know a text is the LAST one (e.g. `stream_reply`
+   * `done=true`) MUST pass it here instead of `update(text)` +
+   * `finalize()`: the flush then runs with the stream already final, so
+   * the transport layer (stream-controller) classifies the edit that
+   * renders the completed answer as `critical` for the send gate — never
+   * shed as a cosmetic draft under flood pressure (#3110).
    */
-  finalize(): Promise<void>
+  finalize(finalText?: string): Promise<void>
 
   /** Returns the captured Telegram message_id, or null if nothing has sent yet. */
   getMessageId(): number | null
@@ -163,6 +206,14 @@ export function createDraftStream(
   let messageId: number | null = config.initialMessageId ?? null
   let pendingText: string | null = null
   let lastSentText: string | null = null
+  /**
+   * Snapshot of the newest text the transport reported as SHED (thrown
+   * `DraftEditShedError`) — content that never landed. Cleared on any
+   * successful flush (a newer snapshot superseded it) and consumed by
+   * `finalize()` so the stream's last state is re-delivered once the
+   * pressure clears instead of being lost (review F2).
+   */
+  let shedText: string | null = null
   let lastSentAt = 0
   let inFlight: Promise<void> | null = null
   // Observability — per-stream fire counters for the stream-end trace.
@@ -216,11 +267,21 @@ export function createDraftStream(
       await sendViaMessage(textToSend)
       lastSentText = textToSend
       lastSentAt = Date.now()
+      shedText = null // a newer snapshot landed — drop any older shed one
     } catch (err) {
       const msg = (err as Error).message ?? String(err)
-      if (/\bmessage is not modified\b/i.test(msg)) {
+      if (isDraftEditShedError(err)) {
+        // #3110 review F2: the send gate shed this edit — it did NOT land.
+        // Preserve the snapshot for finalize()'s re-flush (as the stream's
+        // final state, sent critical) instead of silently losing it. Do NOT
+        // restore pendingText: flushLoop drains while pendingText != null
+        // and would busy-spin against an open flood window.
+        shedText = textToSend
+        log?.(`stream → shed by send gate (id: ${messageId}); snapshot preserved for re-flush`)
+      } else if (/\bmessage is not modified\b/i.test(msg)) {
         lastSentText = textToSend
         lastSentAt = Date.now()
+        shedText = null // on-screen text == this snapshot; nothing to recover
         log?.(`stream → not modified (id: ${messageId})`)
       } else if (
         /\bmessage to edit not found\b/i.test(msg)
@@ -327,9 +388,14 @@ export function createDraftStream(
       return waitPromise
     },
 
-    async finalize(): Promise<void> {
+    async finalize(finalText?: string): Promise<void> {
       if (final) return
       final = true
+      // A caller-supplied final snapshot supersedes any pending draft
+      // (last-write-wins) and is flushed below with `final` already set,
+      // so the transport classifies this edit as the answer's final
+      // render, not a sheddable draft (#3110).
+      if (finalText != null && !stopped) pendingText = finalText
       // Drain any pending updates
       if (scheduledTimer != null) {
         clearTimeout(scheduledTimer)
@@ -338,6 +404,15 @@ export function createDraftStream(
       if (inFlight) {
         await inFlight
       }
+      // #3110 review F2: if the newest snapshot was SHED by the send gate
+      // (never landed) and nothing newer is pending, re-flush it as the
+      // stream's final state. Checked AFTER awaiting inFlight so a flush
+      // that sheds mid-finalize is recovered too. A provided finalText and
+      // any pending draft both outrank the shed snapshot (they are newer).
+      if (pendingText == null && shedText != null && !stopped) {
+        pendingText = shedText
+      }
+      shedText = null
       if (pendingText != null && !stopped) {
         await flush()
       }

package/telegram-plugin/fleet-fallback-resume.ts

@@ -81,12 +81,24 @@ export interface FleetFallbackResumeGate {
   /**
    * Decide whether to resume the dead turn after a successful swap. Call ONLY
    * when the swap outcome was `'switched'`. Records the arm time on a 'resume'
-   * verdict so a follow-on swap within `singleFlightMs` is suppressed.
+   * verdict so a follow-on swap within `singleFlightMs` is suppressed. Equivalent
+   * to `peek()` followed by `arm()` on a 'resume' verdict.
    *
    * @param failedTurnStartedAtMs epoch-ms the failed turn began, or null when
    *        unknown (then the staleness guard is deferred to the boot path).
    */
   decide(failedTurnStartedAtMs: number | null): ResumeDecision;
+  /**
+   * Evaluate the resume verdict WITHOUT arming the single-flight latch. Use when
+   * the caller must perform fallible work (e.g. write a consume-once carrier)
+   * BEFORE committing to a restart: peek → do the writes → `arm()` only on
+   * success, so a throwing write can never leave an armed latch with no pending
+   * restart (which would suppress a legitimate later resume for `singleFlightMs`).
+   */
+  peek(failedTurnStartedAtMs: number | null): ResumeDecision;
+  /** Commit the single-flight arm (records "now" as the arm time). Pair with a
+   *  prior `peek()` that returned 'resume'. */
+  arm(): void;
   /** Test seam — reset to fresh state. Production code should not call this. */
   reset(): void;
   /** Test/debug — current internal state. */
@@ -105,7 +117,7 @@ export function createFleetFallbackResumeGate(
   // -Infinity = never resumed. A concrete value arms the single-flight window.
   let lastResumedAtMs = Number.NEGATIVE_INFINITY;
 
-  function decide(failedTurnStartedAtMs: number | null): ResumeDecision {
+  function peek(failedTurnStartedAtMs: number | null): ResumeDecision {
     const now = nowFn();
     // Guard 2 — single-flight. A second swap within the window does not
     // re-arm; the in-flight restart owns the resume.
@@ -115,12 +127,23 @@ export function createFleetFallbackResumeGate(
     if (failedTurnStartedAtMs != null && now - failedTurnStartedAtMs > maxAgeMs) {
       return 'skip-stale';
     }
-    lastResumedAtMs = now;
     return 'resume';
   }
 
+  function arm(): void {
+    lastResumedAtMs = nowFn();
+  }
+
+  function decide(failedTurnStartedAtMs: number | null): ResumeDecision {
+    const verdict = peek(failedTurnStartedAtMs);
+    if (verdict === 'resume') arm();
+    return verdict;
+  }
+
   return {
     decide,
+    peek,
+    arm,
     reset() {
       lastResumedAtMs = Number.NEGATIVE_INFINITY;
     },

package/telegram-plugin/gateway/approval-hold.ts

@@ -516,6 +516,55 @@ export function isHeldUndeliverable(
   return pend.undeliverable != null
 }
 
+/** The fields the on-delivery reset reads and mutates. */
+export interface DeliveredPermissionEntry {
+  undeliverable?: UndeliverableMark | null
+  redeliveryFailures?: number
+  /** When the operator's decision window began — the TTL is measured from here. */
+  startedAt: number
+}
+
+/**
+ * A HELD card just LANDED — the operator can finally see and tap it. Clear the
+ * hold marks and RESTART the TTL clock, as ONE shared decision used by BOTH
+ * gateway.ts and the outcome test's harness.
+ *
+ * WHY THIS IS SHARED CODE AND NOT AN INLINE BLOCK (#3128):
+ *
+ * The harness used to carry a PRIVATE copy of this reset (its own
+ * `live.startedAt = clock.now()`), so the behavioural test that proves the
+ * operator gets a FULL window after re-delivery drove the double, not the real
+ * gateway. Deleting `startedAt = Date.now()` from gateway.ts would have left that
+ * test GREEN — only a source-text grep noticed, and greps drift. Same placebo-pin
+ * class as the leash (#3123) and the never-auto-approve pin (#3126). Now the reset
+ * lives here, in one importable place, and both callers drive it: delete
+ * `entry.startedAt = now` below and the `(d2)` outcome test goes RED, because there
+ * is only one implementation to delete.
+ *
+ * RESET THE TTL CLOCK is load-bearing, not cosmetic. `startedAt` is when the
+ * agent asked; the TTL measures how long the operator had to answer. Until the
+ * card lands they have NOTHING to answer — it did not exist in any chat. Without
+ * the reset, a card held through a 4.6h ban lands already-expired against a 60-min
+ * TTL and the very next reaper tick auto-denies it: the silent denial would be
+ * MOVED, not removed.
+ *
+ * Returns true when this was a HELD-card recovery — the caller should reconcile
+ * the off-Telegram surface and log the re-delivery. Returns false for a normal
+ * first delivery (the entry was never held), where there is nothing to reset.
+ *
+ * @see reference/invariants.md § no-self-escalation, § on-leash
+ */
+export function applyDeliveredHoldReset(
+  entry: DeliveredPermissionEntry,
+  now: number,
+): boolean {
+  if (entry.undeliverable == null) return false
+  entry.undeliverable = null
+  entry.redeliveryFailures = 0
+  entry.startedAt = now
+  return true
+}
+
 /**
  * Per-tick re-delivery cap (PR 2).
  *

package/telegram-plugin/gateway/bridge-dead-watchdog.ts

@@ -32,11 +32,15 @@
  *     claude itself down — where a bounce is either premature or
  *     futile); the timer re-arms so a slow-booting claude gets the full
  *     grace window again once it appears;
- *   - cron-session bridges (`<agent>-cron`) and anonymous IPC clients
- *     (recall.py one-shots, pre-handshake connects) neither satisfy nor
- *     re-arm the watchdog — the gating lives INSIDE noteBridge* so a
- *     gateway handler refactor can't silently reintroduce the
- *     bounce-after-cron-fire false positive;
+ *   - cron-session bridges (`<agent>-cron`), anonymous IPC clients
+ *     (recall.py one-shots, pre-handshake connects), AND secondary/relay
+ *     clients that register a DIFFERENT agent name than this gateway serves
+ *     (e.g. an `overlord-relay` connecting into another agent's gateway
+ *     socket — #3086) neither satisfy nor re-arm the watchdog: only the
+ *     gateway's OWN primary bridge (agentName === $SWITCHROOM_AGENT_NAME)
+ *     counts. The gating lives INSIDE noteBridge* so a gateway handler
+ *     refactor can't silently reintroduce the bounce-after-cron-fire or the
+ *     bounce-after-relay-disconnect false positive;
  *   - loud, structured escalation log line including a fresh
  *     bridge-crash.log tail (PR #3037 breadcrumbs) so the operator sees
  *     WHY from the supervisor log alone.
@@ -60,10 +64,9 @@ import { readFileSync, writeFileSync, renameSync, unlinkSync } from 'node:fs'
 import { isCronIdentity } from './cron-session.js'
 import type { InboundMessage } from './ipc-protocol.js'
 
-/** The distinct triggerSelfRestart reason for this escalation. Classified
- *  as intent 'keep' by intentForRestartReason (recovery bounce — session
- *  model stickiness preserved), like every other switchroom-managed
- *  relaunch. */
+/** The distinct triggerSelfRestart reason for this escalation. Like every
+ *  other switchroom-managed relaunch it reverts any session `/model` override
+ *  to the configured default (session-scoped, rev 4). */
 export const BRIDGE_DEAD_RESTART_REASON = 'bridge-dead-resume'
 
 /** Default grace window before a missing bridge is treated as dead.
@@ -353,6 +356,16 @@ export interface BridgeDeadWatchdogOpts {
    *  unref (the watchdog must never keep the gateway process alive). */
   setTimer?: (fn: () => void, ms: number) => unknown
   clearTimer?: (handle: unknown) => void
+  /** The agent identity THIS gateway serves ($SWITCHROOM_AGENT_NAME).
+   *  Only a bridge client registering under this exact name is the
+   *  primary bridge whose presence/absence drives the watchdog. Secondary
+   *  or relay clients (a different named identity connecting into this
+   *  gateway's socket — e.g. `overlord-relay`, #3086) are ignored on both
+   *  the register and disconnect paths. When unset/empty (a misconfigured
+   *  gateway with no agent name), the watchdog falls back to the pre-#3086
+   *  test — any named non-cron client counts — so a genuine bridge death is
+   *  still caught rather than silently un-guarded. */
+  selfAgentName?: string
   /** Injectable clock (marker ts + crash-log freshness). */
   nowMs?: () => number
   /** Injectable marker writer (tests avoid real fs). */
@@ -366,15 +379,18 @@ export interface BridgeDeadWatchdog {
    *  when the cross-boot streak cap is already reached (stands down with
    *  an audit line instead). */
   arm: () => void
-  /** A bridge client registered. Only a REAL bridge (named, non-cron)
-   *  satisfies the watchdog — cron sessions (`<agent>-cron`) and
-   *  anonymous clients (agentName null) are ignored HERE so a gateway
-   *  handler refactor can't reorder the gating away (review finding 5). */
+  /** A bridge client registered. Only THIS gateway's OWN primary bridge
+   *  (agentName === selfAgentName, named, non-cron) satisfies the watchdog
+   *  — cron sessions (`<agent>-cron`), anonymous clients (agentName null),
+   *  and secondary/relay clients registering a different name (#3086) are
+   *  ignored HERE so a gateway handler refactor can't reorder the gating
+   *  away (review finding 5). */
   noteBridgeRegistered: (agentName: string | null | undefined) => void
-  /** A bridge client disconnected. Re-arms the grace window only for the
-   *  real bridge (same internal gating), so a bridge that dies AFTER boot
-   *  and never reconnects also escalates. Still capped by the
-   *  once-per-boot fuse. */
+  /** A bridge client disconnected. Re-arms the grace window only for THIS
+   *  gateway's own primary bridge (same internal gating), so a bridge that
+   *  dies AFTER boot and never reconnects also escalates — while a
+   *  transient relay/secondary client's disconnect (#3086) is a no-op.
+   *  Still capped by the once-per-boot fuse. */
   noteBridgeDisconnected: (agentName: string | null | undefined) => void
   /** Evaluate now (the timer body — exposed for tests). Returns the
    *  decision taken. */
@@ -385,9 +401,34 @@ export interface BridgeDeadWatchdog {
   hasEscalated: () => boolean
 }
 
-/** Is this client identity the REAL main-agent bridge (named, non-cron)? */
-function isRealBridgeIdentity(agentName: string | null | undefined): boolean {
-  return agentName != null && agentName.length > 0 && !isCronIdentity(agentName)
+/**
+ * Is this client identity THIS gateway's OWN primary main-agent bridge?
+ *
+ * A named, non-cron client whose name matches the gateway's own agent
+ * identity (`selfAgentName` = $SWITCHROOM_AGENT_NAME). A switchroom gateway
+ * serves exactly one agent, and its real bridge registers under exactly that
+ * name (see bridge/bridge.ts — `agentName: AGENT_NAME`). Secondary or relay
+ * clients (e.g. an `overlord-relay` that connects into another agent's
+ * gateway socket, #3086) register a DIFFERENT name; they are named and
+ * non-cron but are NOT this gateway's primary bridge, so their register /
+ * disconnect must neither satisfy nor re-arm the watchdog — otherwise a
+ * transient relay disconnect marks the (still-alive) primary bridge dead and
+ * bounces a healthy container.
+ *
+ * When `selfAgentName` is unset/empty (misconfigured gateway) we cannot
+ * identity-match, so fall back to the pre-#3086 test — any named non-cron
+ * client counts — keeping the watchdog protective rather than un-guarded.
+ */
+function isRealBridgeIdentity(
+  agentName: string | null | undefined,
+  selfAgentName: string | null | undefined,
+): boolean {
+  if (agentName == null || agentName.length === 0) return false
+  if (isCronIdentity(agentName)) return false
+  if (selfAgentName != null && selfAgentName.length > 0) {
+    return agentName === selfAgentName
+  }
+  return true
 }
 
 export function createBridgeDeadWatchdog(opts: BridgeDeadWatchdogOpts): BridgeDeadWatchdog {
@@ -405,6 +446,7 @@ export function createBridgeDeadWatchdog(opts: BridgeDeadWatchdogOpts): BridgeDe
     opts.readCrashTail ?? ((p: string, t: number) => readFreshCrashLogTail(p, { nowMs: t }))
   const priorStreak = opts.priorStreak ?? 0
   const maxConsecutive = opts.maxConsecutive ?? MAX_CONSECUTIVE_ESCALATIONS
+  const selfAgentName = opts.selfAgentName
 
   let timer: unknown = null
   let bridgeRegistered = false
@@ -529,13 +571,13 @@ export function createBridgeDeadWatchdog(opts: BridgeDeadWatchdogOpts): BridgeDe
   return {
     arm: armInternal,
     noteBridgeRegistered: (agentName) => {
-      if (!isRealBridgeIdentity(agentName)) return
+      if (!isRealBridgeIdentity(agentName, selfAgentName)) return
       bridgeRegistered = true
       bridgeEverRegistered = true
       cancel()
     },
     noteBridgeDisconnected: (agentName) => {
-      if (!isRealBridgeIdentity(agentName)) return
+      if (!isRealBridgeIdentity(agentName, selfAgentName)) return
       bridgeRegistered = false
       armInternal()
     },

package/telegram-plugin/gateway/effort-command.ts

@@ -65,8 +65,9 @@ export function parseEffortCommand(text: string): ParsedEffortCommand | null {
   }
   const arg = parts[0]
   if (arg.toLowerCase() === 'help') return { kind: 'help' }
-  // `/effort default` — explicit user action that clears the durable
-  // `.session-effort` override and restores the configured default (#3039).
+  // `/effort default` — explicit user action that clears the session
+  // override (in-memory + any leftover queued-command carrier) and restores
+  // the configured default (#3186, session-scoped).
   if (arg.toLowerCase() === 'default') return { kind: 'default' }
   if (!isValidEffortArg(arg)) {
     return { kind: 'help', reason: `not a valid effort level: ${arg}` }
@@ -91,14 +92,15 @@ export interface EffortCommandDeps {
    */
   getConfiguredEffort: () => string | null
   /**
-   * Delete the durable `.session-effort` override (#3039). Optional so
+   * Clear the session effort override (#3186: the in-memory live level plus
+   * any leftover queued-command `.session-effort` carrier). Optional so
    * gateway-agnostic tests can omit it; the gateway always wires it.
    */
   clearSessionEffort?: () => void
   /**
-   * The active durable `.session-effort` override level, or null when none
-   * (#3039). Optional; used to mark the LIVE level in the menu and the show
-   * text honestly after a restart re-applied the override.
+   * The active session effort override level, or null when none (#3186:
+   * in-memory, session-scoped — reverts on restart). Optional; used to mark
+   * the LIVE level in the menu and the show text honestly.
    */
   getSessionEffort?: () => string | null
   escapeHtml: (s: string) => string
@@ -110,7 +112,7 @@ export interface EffortCommandReply {
 }
 
 const PERSIST_NOTE =
-  '_Sticky — persists across restarts and deploys until \`/effort default\` clears it. To change the configured default, set \`thinking_effort:\` in switchroom.yaml._'
+  '_Session-only — this override lasts until the agent’s next restart, then reverts to the configured \`thinking_effort:\`. \`/effort default\` clears it now. To change the default permanently, set \`thinking_effort:\` in switchroom.yaml._'
 
 const LEVELS_INLINE = EFFORT_LEVELS.map(l => `\`${l}\``).join(' · ')