switchroom 0.18.17 → 0.18.18

package/telegram-plugin/tests/fleet-fallback-resume.test.ts

@@ -122,6 +122,45 @@ describe('createFleetFallbackResumeGate — staleness guard', () => {
   })
 })
 
+describe('createFleetFallbackResumeGate — peek / arm seams (tier-downgrade LOW-3 + LOW-9a)', () => {
+  it('peek() evaluates the verdict WITHOUT arming the single-flight latch', () => {
+    const clk = fakeClock()
+    const gate = createFleetFallbackResumeGate({ nowFn: clk.now })
+    // Peeking 'resume' must not record an arm time — a following peek/decide is
+    // still 'resume'. This is what lets the gateway do a fallible carrier write
+    // between the peek and the arm without leaving a phantom armed latch (LOW-3).
+    expect(gate.peek(clk.now())).toBe('resume')
+    expect(gate.inspect().lastResumedAtMs).toBe(Number.NEGATIVE_INFINITY)
+    expect(gate.peek(clk.now())).toBe('resume')
+    // The real restart never fires (write threw) → nothing armed → a genuine
+    // later swap still resumes.
+    expect(gate.decide(clk.now())).toBe('resume')
+  })
+
+  it('arm() commits the single-flight window so a later peek reports skip-inflight (LOW-9a)', () => {
+    const clk = fakeClock()
+    const gate = createFleetFallbackResumeGate({ nowFn: clk.now, singleFlightMs: 60_000 })
+    // Turn 1: peek 'resume' → do the write → arm.
+    expect(gate.peek(clk.now())).toBe('resume')
+    gate.arm()
+    // Turn 2 (concurrent, same process, 1s later): a resume restart is already
+    // armed, so peek reports skip-inflight → the gateway suppresses the give-up.
+    clk.advance(1_000)
+    expect(gate.peek(clk.now())).toBe('skip-inflight')
+  })
+
+  it('peek(skip-inflight/skip-stale) never arms; only arm() records the window', () => {
+    const clk = fakeClock()
+    const gate = createFleetFallbackResumeGate({ nowFn: clk.now })
+    // A stale peek must not arm (mirrors decide()'s stale behaviour).
+    expect(gate.peek(clk.now() - (DEFAULT_RESUME_MAX_AGE_MS + 1))).toBe('skip-stale')
+    expect(gate.inspect().lastResumedAtMs).toBe(Number.NEGATIVE_INFINITY)
+    // decide() remains equivalent to peek+arm-on-resume.
+    expect(gate.decide(clk.now())).toBe('resume')
+    expect(gate.peek(clk.now())).toBe('skip-inflight')
+  })
+})
+
 describe('createFleetFallbackResumeGate — reset / inspect seams', () => {
   it('reset() clears the single-flight arm', () => {
     const clk = fakeClock()

package/telegram-plugin/tests/flood-windows-persistence.test.ts

@@ -103,9 +103,10 @@ describe('#3084 scoped flood-window persistence', () => {
       ),
     ).rejects.toBe(floodErr)
 
-    // The window is on disk.
+    // The window is on disk. #3111: a chat-bound 429 persists ONLY the chat
+    // scope — no coincident `global` window that would suppress unrelated chats.
     const persisted = readFloodWindows(winPath, 0)
-    expect(persisted.map((w) => w.scopeKey).sort()).toEqual(['chat:7', 'global'])
+    expect(persisted.map((w) => w.scopeKey).sort()).toEqual(['chat:7'])
 
     // Gate 2 (simulated restart): built BEFORE any outbound call from the
     // persisted windows. A cosmetic send on chat:7 must still shed.

package/telegram-plugin/tests/linear-create-issue.test.ts

@@ -155,9 +155,14 @@ describe('createLinearIssue — behaviour (#2312)', () => {
     expect(r.content[0].text).toMatch(/default_team_id/)
   })
 
-  it('short-circuits to "Already filed" on a dedup hit', async () => {
+  it('short-circuits to "Already filed" only on an EXACT marker match, skipping unrelated top hits', async () => {
     const { fetchImpl, calls } = routingFetch({
-      searchIssues: () => ({ searchIssues: { nodes: [{ id: 'old', url: 'https://linear.app/acme/issue/ENG-7', title: 'prior' }] } }),
+      searchIssues: () => ({ searchIssues: { nodes: [
+        // relevance-ranked top hit that merely shares tokens — must be ignored.
+        { id: 'noise', url: 'https://linear.app/acme/issue/ENG-99', title: 'unrelated', description: 'no capture marker here' },
+        // the real prior capture, carrying the exact marker for this key.
+        { id: 'old', url: 'https://linear.app/acme/issue/ENG-7', title: 'prior', description: `Y${captureDedupMarker('chat:99')}` },
+      ] } }),
       teams: oneTeam,
       issueCreate: issueOk,
     })
@@ -165,12 +170,35 @@ describe('createLinearIssue — behaviour (#2312)', () => {
       { title: 'X', body: 'Y', dedup_key: 'chat:99' },
       { resolveToken: okToken('t'), fetchImpl, log: () => {} },
     )
+    // matched the marker-bearing node, not the higher-ranked noise node.
     expect(r.content[0].text).toBe('Already filed: https://linear.app/acme/issue/ENG-7')
     // only the search ran — no team resolve, no create.
     expect(calls).toHaveLength(1)
     expect(calls[0].query).toMatch(/searchIssues/)
   })
 
+  it('does NOT dedup when the search returns only unrelated hits (fuzzy false-positive regression)', async () => {
+    // Regression for the searchIssues fuzzy-match bug: a novel dedup_key
+    // returned an unrelated relevance-ranked hit and wrongly suppressed
+    // creation. No node carries this key's marker, so the tool must create.
+    const { fetchImpl, calls } = routingFetch({
+      searchIssues: () => ({ searchIssues: { nodes: [
+        { id: 'x', url: 'https://linear.app/acme/issue/ENG-56', title: 'ProductOS Job Spec', description: 'shares tokens, but no capture marker' },
+      ] } }),
+      teams: oneTeam,
+      issueCreate: issueOk,
+    })
+    const r = await createLinearIssue(
+      { title: 'Series QA tracker', body: 'Y', dedup_key: 'productos-qa-2026-07-13' },
+      { resolveToken: okToken('t'), fetchImpl, log: () => {} },
+    )
+    expect(r.content[0].text).toMatch(/Filed:/)
+    // fell through past the search to team resolve + create, embedding the marker.
+    const create = calls.find((c) => c.query.includes('issueCreate'))!
+    expect(create).toBeTruthy()
+    expect((create.variables.input as Record<string, unknown>).description).toContain(captureDedupMarker('productos-qa-2026-07-13'))
+  })
+
   it('falls through to create when the dedup search misses, and embeds the marker', async () => {
     const { fetchImpl, calls } = routingFetch({
       searchIssues: () => ({ searchIssues: { nodes: [] } }),

package/telegram-plugin/tests/llm-error-present.test.ts

@@ -0,0 +1,380 @@
+/**
+ * llm-error-present.test.ts — outcome-asserting tests for the humanized,
+ * cross-surface-deduped LLM-error surfacing (no raw JSON passthrough).
+ *
+ * Each block is written to FAIL against pre-fix behaviour:
+ *   - golden fan-out: pre-fix, the raw synthetic-error text fanned out to the
+ *     reply + done-card surfaces (≥2 messages, raw bytes) — this asserts EXACTLY
+ *     ONE JSON-free message across all three.
+ *   - operator-card sanitize: pre-fix, renderOperatorEvent embedded the raw
+ *     detail verbatim — this asserts the bytes are gone.
+ */
+
+import { describe, it, expect, beforeEach } from 'vitest'
+import {
+  parseLlmError,
+  renderLlmError,
+  stripRawErrorBytes,
+  extractRequestId,
+  formatResetLocal,
+  decideErrorSurface,
+  isActionableKind,
+  ErrorPresenceGate,
+  errorPresenceGate,
+  ERROR_COLLAPSE_WINDOW_MS,
+  type LlmErrorRetryState,
+} from '../llm-error-present.js'
+import { truncateDetailPreservingRequestId } from '../raw-error-scrub.js'
+import { projectTranscriptLine, detectErrorInTranscriptLine } from '../session-tail.js'
+import { renderOperatorEvent, type OperatorEvent } from '../operator-events.js'
+
+// A raw byte-blob every surface must scrub.
+const RAW_BYTES = `b'{"type":"error","error":{"type":"rate_limit_error","message":"rate limit"},"request_id":"req_abc123"}'`
+
+function assertNoRawBytes(text: string): void {
+  expect(text).not.toContain("b'{")
+  expect(text).not.toContain('{"type":"error"')
+  expect(text.toLowerCase()).not.toContain('api error:')
+}
+
+// ─── stripRawErrorBytes ──────────────────────────────────────────────────────
+
+describe('stripRawErrorBytes', () => {
+  it('removes the Python byte-blob, JSON error object, and API Error prefix', () => {
+    const raw = `API Error: 429 Server is temporarily limiting requests · ${RAW_BYTES}`
+    const out = stripRawErrorBytes(raw)
+    assertNoRawBytes(out)
+    expect(out).toContain('Server is temporarily limiting requests')
+  })
+
+  it('passes a clean human string through unchanged (modulo whitespace)', () => {
+    expect(stripRawErrorBytes('Invalid API key')).toBe('Invalid API key')
+    expect(stripRawErrorBytes('Rate limit exceeded')).toBe('Rate limit exceeded')
+    expect(stripRawErrorBytes('')).toBe('')
+  })
+
+  it('strips a bare JSON blob down to empty', () => {
+    expect(stripRawErrorBytes('{"type":"error","error":{"type":"overloaded_error"}}')).toBe('')
+  })
+})
+
+// ─── extractRequestId ────────────────────────────────────────────────────────
+
+describe('extractRequestId', () => {
+  it('pulls an Anthropic request_id from a raw JSON string', () => {
+    expect(extractRequestId(RAW_BYTES)).toBe('req_abc123')
+    expect(extractRequestId('no id here')).toBeUndefined()
+  })
+})
+
+// ─── parser table ────────────────────────────────────────────────────────────
+
+describe('parseLlmError — classification table', () => {
+  it('rate_limit (Anthropic account throttle)', () => {
+    const p = parseLlmError(
+      "This request would exceed your account's rate limit. Please try again later.",
+    )
+    expect(p.kind).toBe('rate_limit')
+    expect(p.source).toBe('anthropic')
+    assertNoRawBytes(p.coreText)
+  })
+
+  it('overload_529', () => {
+    const p = parseLlmError('overloaded_error: Anthropic 529 overloaded')
+    expect(p.kind).toBe('overload_529')
+    expect(p.source).toBe('anthropic')
+    assertNoRawBytes(p.coreText)
+  })
+
+  it('quota_wall with a parsed reset', () => {
+    const p = parseLlmError("You've hit your limit · resets 8:50am (Australia/Melbourne)")
+    expect(p.kind).toBe('quota_wall')
+    expect(p.source).toBe('anthropic')
+    expect(p.resetAt).toBeInstanceOf(Date)
+    expect(p.terminal).toBe(true)
+    assertNoRawBytes(p.coreText)
+  })
+
+  it('litellm-local proxy 429', () => {
+    const p = parseLlmError(
+      'litellm.RateLimitError: Deployment over user-defined ratelimit. tpm limit=8000. current usage=8241',
+    )
+    expect(p.kind).toBe('rate_limit')
+    expect(p.source).toBe('litellm-local')
+    assertNoRawBytes(p.coreText)
+  })
+
+  it('auth (credentials expired)', () => {
+    const p = parseLlmError('authentication_error: OAuth token expired, please refresh')
+    expect(p.kind).toBe('auth')
+    expect(p.source).toBe('anthropic')
+    expect(p.terminal).toBe(true)
+    expect(p.autoRetrying).toBe(false)
+  })
+
+  it('network', () => {
+    const p = parseLlmError('fetch failed: ECONNREFUSED getaddrinfo ENOTFOUND api.anthropic.com')
+    expect(p.kind).toBe('transient')
+    expect(p.source).toBe('network')
+    assertNoRawBytes(p.coreText)
+  })
+
+  it('unknown falls through cleanly', () => {
+    const p = parseLlmError('something entirely unrecognizable happened')
+    expect(p.kind).toBe('unknown')
+    assertNoRawBytes(p.coreText)
+  })
+
+  it('extracts model + requestId, and coreText is JSON-free even from a raw line', () => {
+    const raw = `Server is temporarily limiting requests · model=claude-opus-4-8 · ${RAW_BYTES}`
+    const p = parseLlmError(raw)
+    expect(p.kind).toBe('rate_limit')
+    expect(p.model).toBe('claude-opus-4-8')
+    expect(p.requestId).toBe('req_abc123')
+    assertNoRawBytes(p.coreText)
+  })
+})
+
+// ─── local-time render ───────────────────────────────────────────────────────
+
+describe('renderLlmError / formatResetLocal — local-time rendering', () => {
+  const tz = 'Australia/Melbourne'
+  // Pin now to a fixed instant. 2026-07-13T06:14:00Z = 4:14pm AEST (winter, +10).
+  const now = new Date('2026-07-13T06:14:00Z')
+
+  it('renders the reset in local wall-clock + relative tail, DST-correct', () => {
+    // resetAt = 2026-07-13T06:52:00Z = 4:52pm AEST, ~38m out.
+    const reset = new Date('2026-07-13T06:52:00Z')
+    const line = formatResetLocal(reset, tz, now)
+    expect(line).toContain('4:52pm')
+    expect(line).toContain('AEST')
+    expect(line).toContain('~in 38m')
+  })
+
+  it('renderLlmError produces a JSON-free card with the local reset', () => {
+    const parsed = parseLlmError(
+      `Server is temporarily limiting requests · resets 4:52pm (Australia/Melbourne) · ${RAW_BYTES}`,
+    )
+    const { text } = renderLlmError(parsed, 'gymbro', tz, now)
+    assertNoRawBytes(text)
+    expect(text).toContain('gymbro')
+    expect(text).toContain('AEST')
+  })
+
+  it('auth + quota_wall cards carry action buttons', () => {
+    const auth = renderLlmError(parseLlmError('authentication_error: token expired'), 'a', tz, now)
+    expect(auth.keyboard?.inline_keyboard.flat().some((b) => b.callback_data?.includes('reauth'))).toBe(true)
+    const quota = renderLlmError(
+      parseLlmError("You've hit your limit · resets 5pm"),
+      'a',
+      tz,
+      now,
+    )
+    expect(quota.keyboard?.inline_keyboard.flat().length).toBeGreaterThan(0)
+  })
+})
+
+// ─── dedup key ───────────────────────────────────────────────────────────────
+
+describe('ErrorPresenceGate — dedup key semantics', () => {
+  let gate: ErrorPresenceGate
+  beforeEach(() => {
+    gate = new ErrorPresenceGate()
+  })
+
+  it('same requestId → collapses to 1', () => {
+    const p = { kind: 'rate_limit' as const, requestId: 'req_x' }
+    const now = 1_000_000
+    const k = gate.keyFor(p, 'agent', now)
+    expect(gate.claim(k, now)).toBe(true)
+    expect(gate.claim(gate.keyFor(p, 'agent', now + 5_000), now + 5_000)).toBe(false)
+  })
+
+  it('different requestId, same kind → 2 distinct claims', () => {
+    const now = 1_000_000
+    expect(gate.claim(gate.keyFor({ kind: 'rate_limit', requestId: 'a' }, 'g', now), now)).toBe(true)
+    expect(gate.claim(gate.keyFor({ kind: 'rate_limit', requestId: 'b' }, 'g', now), now)).toBe(true)
+  })
+
+  it('no requestId, same kind: <window → 1, >window → 2', () => {
+    const now = 5 * ERROR_COLLAPSE_WINDOW_MS
+    const p = { kind: 'rate_limit' as const }
+    expect(gate.claim(gate.keyFor(p, 'g', now), now)).toBe(true)
+    // Within window (same bucket) → suppressed.
+    const within = now + ERROR_COLLAPSE_WINDOW_MS - 1
+    expect(gate.claim(gate.keyFor(p, 'g', within), within)).toBe(false)
+    // Past window (next bucket) → new claim.
+    const past = now + ERROR_COLLAPSE_WINDOW_MS + 1
+    expect(gate.claim(gate.keyFor(p, 'g', past), past)).toBe(true)
+  })
+})
+
+// ─── auto-retry silence ──────────────────────────────────────────────────────
+//
+// UNIT test of the module's own auto-retry-silence CONTRACT: given a retryState
+// with attempt<max, a transient error is suppressed. This is NOT exercised by
+// the production gateway wiring (it calls `parseLlmError(detail)` without a
+// retryState, and session-tail already drops in-flight transients upstream — see
+// the note in decideErrorSurface). These cases pin the module guarantee for any
+// caller that DOES thread retryState; they do not imply the gateway does.
+
+describe('decideErrorSurface — auto-retry silence (module contract, retryState-driven)', () => {
+  beforeEach(() => errorPresenceGate.reset())
+
+  it('a transient 529 mid-retry (attempt<max) is silenced on all surfaces', () => {
+    const retry: LlmErrorRetryState = { retryAttempt: 1, maxRetries: 5 }
+    const p = parseLlmError('overloaded_error 529 overloaded', retry)
+    expect(p.autoRetrying).toBe(true)
+    expect(p.terminal).toBe(false)
+    expect(decideErrorSurface(p, 'g', { claim: true })).toBe('suppress')
+  })
+
+  it('the same 529 at attempt>=max renders exactly one card', () => {
+    const retry: LlmErrorRetryState = { retryAttempt: 5, maxRetries: 5 }
+    const p = parseLlmError('overloaded_error 529 overloaded', retry)
+    expect(p.autoRetrying).toBe(false)
+    expect(p.terminal).toBe(true)
+    expect(decideErrorSurface(p, 'g', { claim: true })).toBe('render')
+    // A second surface for the same terminal error collapses.
+    expect(decideErrorSurface(p, 'g', { claim: true })).toBe('suppress')
+  })
+})
+
+// ─── actionable never suppressed ─────────────────────────────────────────────
+
+describe('decideErrorSurface — actionable kinds never suppressed', () => {
+  beforeEach(() => errorPresenceGate.reset())
+
+  it('auth + quota_wall always render even inside an active collapse window', () => {
+    const auth = parseLlmError('authentication_error: credentials expired')
+    const quota = parseLlmError("You've hit your limit · resets 5pm")
+    expect(isActionableKind(auth.kind)).toBe(true)
+    expect(isActionableKind(quota.kind)).toBe(true)
+    // Pre-claim the same-kind window key to simulate a busy collapse window.
+    const now = 2_000_000
+    errorPresenceGate.claim(errorPresenceGate.keyFor(auth, 'g', now), now)
+    errorPresenceGate.claim(errorPresenceGate.keyFor(quota, 'g', now), now)
+    expect(decideErrorSurface(auth, 'g', { claim: true, now })).toBe('render')
+    expect(decideErrorSurface(quota, 'g', { claim: true, now })).toBe('render')
+  })
+})
+
+// ─── golden fan-out ──────────────────────────────────────────────────────────
+
+describe('golden fan-out — one 429 line → exactly one JSON-free user message', () => {
+  beforeEach(() => errorPresenceGate.reset())
+
+  // The v2.1.x synthetic-assistant usage/rate-limit shape: the raw error text
+  // lives inside message.content[].text, with the byte-blob attached.
+  const line = JSON.stringify({
+    type: 'assistant',
+    message: {
+      role: 'assistant',
+      content: [
+        {
+          type: 'text',
+          text: `Server is temporarily limiting requests (not your usage limit) · resets 4:52pm (Australia/Melbourne) · ${RAW_BYTES}`,
+        },
+      ],
+    },
+    error: 'rate_limit',
+    isApiErrorMessage: true,
+    apiErrorStatus: 429,
+  })
+
+  it('starves the reply + done-card surfaces and renders one operator card', () => {
+    const userMessages: string[] = []
+
+    // Surfaces #1 (done-card recap) and #3 (reply passthrough) both derive from
+    // the projected transcript `text` events. Post-fix: NO text/thinking event
+    // is projected for an isApiErrorMessage line, so neither surface can relay
+    // the raw bytes as the turn's answer.
+    const projected = projectTranscriptLine(line)
+    for (const ev of projected) {
+      if (ev.kind === 'text') userMessages.push(`reply:${ev.text}`)
+    }
+    expect(projected.some((e) => e.kind === 'text')).toBe(false)
+
+    // Surface #2 (operator card): the SAME line is independently classified and
+    // rendered as the ONE humanized card. This mirrors the production gateway
+    // call exactly — `parseLlmError(detail)` with NO retryState (session-tail
+    // has already dropped any in-flight transient before forwarding, so the
+    // event that reaches the gateway is terminal by construction).
+    const detected = detectErrorInTranscriptLine(line)
+    expect(detected).not.toBeNull()
+    expect(detected!.terminal).toBe(true)
+    const parsed = parseLlmError(detected!.detail)
+    if (decideErrorSurface(parsed, 'gymbro', { claim: true }) === 'render') {
+      userMessages.push(renderLlmError(parsed, 'gymbro', 'Australia/Melbourne').text)
+    }
+
+    // EXACTLY ONE user-facing message, and it carries no raw bytes.
+    expect(userMessages).toHaveLength(1)
+    assertNoRawBytes(userMessages[0])
+  })
+})
+
+// ─── operator-card sanitize (surface #2 regression) ──────────────────────────
+
+describe('renderOperatorEvent — never relays raw error bytes', () => {
+  function ev(kind: OperatorEvent['kind'], detail: string): OperatorEvent {
+    return { kind, agent: 'g', detail, suggestedActions: [], firstSeenAt: new Date() }
+  }
+
+  it('strips raw bytes from a rate-limited detail', () => {
+    const { text } = renderOperatorEvent(ev('rate-limited', `Rate limited · ${RAW_BYTES}`))
+    assertNoRawBytes(text)
+    expect(text).toContain('Rate limited')
+  })
+
+  it('strips raw bytes from an unknown-4xx detail', () => {
+    const { text } = renderOperatorEvent(ev('unknown-4xx', `API Error: 400 bad · ${RAW_BYTES}`))
+    assertNoRawBytes(text)
+  })
+
+  it('leaves a clean detail intact', () => {
+    const { text } = renderOperatorEvent(ev('credentials-expired', 'token expired 2026-04-01'))
+    expect(text).toContain('token expired 2026-04-01')
+  })
+})
+
+// ─── request_id survives the 1000-char bridge truncation (MEDIUM) ─────────────
+
+describe('truncateDetailPreservingRequestId — exact dedup key survives truncation', () => {
+  beforeEach(() => errorPresenceGate.reset())
+
+  // A realistic long Anthropic rate-limit body whose request_id sits PAST char
+  // 1000 (the bridge's OPERATOR_EVENT_DETAIL_MAX). `filler` pads the human part.
+  function longRateLimitLine(requestId: string): string {
+    const filler = 'Server is temporarily limiting requests (not your usage limit). '.repeat(30)
+    return `${filler} b'{"type":"error","error":{"type":"rate_limit_error","message":"rate limited"},"request_id":"${requestId}"}'`
+  }
+
+  it('preserves the request_id that a naive slice(0,1000) would drop', () => {
+    const line = longRateLimitLine('req_deadbeef01')
+    expect(line.length).toBeGreaterThan(1000)
+    // A naive slice loses the trailing id...
+    expect(extractRequestId(line.slice(0, 1000))).toBeUndefined()
+    // ...but the preserving truncation keeps it, within budget.
+    const truncated = truncateDetailPreservingRequestId(line, 1000)
+    expect(truncated.length).toBeLessThanOrEqual(1000)
+    expect(extractRequestId(truncated)).toBe('req_deadbeef01')
+  })
+
+  it('two DISTINCT request_ids past char 1000 render TWO messages (exact key still fires)', () => {
+    const now = 9_000_000
+    const messages: string[] = []
+    for (const rid of ['req_aaaaaaaa', 'req_bbbbbbbb']) {
+      // Simulate the bridge hop: truncate-preserving, THEN parse gateway-side.
+      const detail = truncateDetailPreservingRequestId(longRateLimitLine(rid), 1000)
+      const parsed = parseLlmError(detail)
+      expect(parsed.requestId).toBe(rid) // exact key preserved, not coarse fallback
+      if (decideErrorSurface(parsed, 'gymbro', { claim: true, now }) === 'render') {
+        messages.push(renderLlmError(parsed, 'gymbro', 'UTC', new Date(now)).text)
+      }
+    }
+    // Pre-fix (id truncated away) both fall to the SAME `${kind}:${agent}:${bucket}`
+    // key and collapse to ONE. With the id preserved, the exact keys differ → TWO.
+    expect(messages).toHaveLength(2)
+  })
+})