switchroom 0.18.17 → 0.18.18

package/telegram-plugin/tests/tier-downgrade-wiring.test.ts

@@ -0,0 +1,165 @@
+/**
+ * Integration test for the tier-downgrade GLUE (`runTierDowngrade`,
+ * tier-downgrade-wiring.ts) — the gateway orchestration the pure
+ * `decideTierDowngrade` / `renderTierDowngradeNotice` tests do NOT cover.
+ *
+ * This is the test the @overlord review asked for (the MEDIUM "reverts to
+ * fable" misinform slipped through precisely because the glue that emits the
+ * BROADCAST notice text had no test — only the pure renderer did). It drives
+ * the real runner with injected seams and PINS the broadcast notice:
+ *   - asserts the resume-on-DEFAULT wording + the manual re-issue instruction;
+ *   - FAILS on any revert-to-premium phrasing (the exact regression).
+ * It also covers the resume-gate suppression path and the carrier-before-arm
+ * ordering invariant.
+ */
+
+import { describe, it, expect } from 'vitest'
+import {
+  runTierDowngrade,
+  type TierDowngradeRunnerDeps,
+  type TierDowngradeOutcome,
+} from '../gateway/tier-downgrade-wiring.js'
+
+interface Recorder {
+  carrier: Array<{ dir: string; toModel: string; cfg: string }>
+  arms: number
+  markers: Array<{ dir: string; premiumModel: string }>
+  notices: string[]
+  restarts: string[]
+  logs: string[]
+}
+
+function makeDeps(
+  over: Partial<TierDowngradeRunnerDeps> & {
+    sessionOverride?: string | null
+    configuredDefault?: string | null
+    gateVerdict?: 'resume' | 'skip-inflight' | 'skip-stale'
+    carrierThrows?: boolean
+    markerThrows?: boolean
+    agentDir?: string | null
+  } = {},
+): { deps: TierDowngradeRunnerDeps; rec: Recorder } {
+  const rec: Recorder = { carrier: [], arms: 0, markers: [], notices: [], restarts: [], logs: [] }
+  // A near-identity resolver like the real resolveMainModel: the unset/`default`
+  // sentinel maps to the switchroom default, everything else is itself.
+  const resolve = (t: string): string => (t === '' || t === 'default' ? 'claude-opus-4-8' : t)
+  const deps: TierDowngradeRunnerDeps = {
+    getAgentDir: () => (over.agentDir === undefined ? '/tmp/agent' : over.agentDir),
+    getConfiguredDefault: () => (over.configuredDefault === undefined ? 'opus' : over.configuredDefault),
+    getSessionOverride: () => (over.sessionOverride === undefined ? 'fable' : over.sessionOverride),
+    resolve,
+    peekResumeGate: () => over.gateVerdict ?? 'resume',
+    writeCarrier: (dir, toModel, cfg) => {
+      if (over.carrierThrows) throw new Error('disk full')
+      rec.carrier.push({ dir, toModel, cfg })
+    },
+    armResumeGate: () => {
+      rec.arms += 1
+    },
+    writeRecoveryMarker: (dir, premiumModel) => {
+      if (over.markerThrows) throw new Error('marker write failed')
+      rec.markers.push({ dir, premiumModel })
+    },
+    broadcastNotice: (md) => rec.notices.push(md),
+    selfRestart: (agent) => rec.restarts.push(agent),
+    selfAgent: (t) => `self-${t}`,
+    log: (msg) => rec.logs.push(msg),
+    ...over,
+  }
+  return { deps, rec }
+}
+
+describe('runTierDowngrade — broadcast notice honesty (the pinned regression)', () => {
+  it('downgrade path broadcasts EXACTLY ONE notice with resume-on-default wording', () => {
+    const { deps, rec } = makeDeps({ sessionOverride: 'fable', configuredDefault: 'opus' })
+    const outcome: TierDowngradeOutcome = runTierDowngrade('klanker', deps)
+    expect(outcome).toBe('downgraded')
+    expect(rec.notices).toHaveLength(1)
+    const notice = rec.notices[0]
+    // Resume-on-DEFAULT + the manual re-issue instruction.
+    expect(notice).toContain('`opus`')
+    expect(notice).toContain('/model fable')
+    expect(notice.toLowerCase()).toContain("won't switch back on its own")
+  })
+
+  it('the notice NEVER promises a revert to the premium model (the MEDIUM regression)', () => {
+    const { deps, rec } = makeDeps({ sessionOverride: 'fable', configuredDefault: 'opus' })
+    runTierDowngrade('klanker', deps)
+    const notice = rec.notices[0].toLowerCase()
+    // The exact false phrasing from the pre-5d9bbf44 revision, and its kin.
+    expect(notice).not.toContain('reverts to `fable`')
+    expect(notice).not.toContain('revert to `fable`')
+    expect(notice).not.toMatch(/reverts? to fable/)
+    expect(notice).not.toMatch(/switch(es)? back.*on (the )?next restart/)
+    expect(notice).not.toMatch(/automatically.*(fable|premium)/)
+  })
+})
+
+describe('runTierDowngrade — side-effect ordering + outcomes', () => {
+  it('downgrade: carrier written BEFORE the arm, marker + notice + restart all fire', () => {
+    const { deps, rec } = makeDeps({ sessionOverride: 'fable', configuredDefault: 'opus' })
+    const outcome = runTierDowngrade('klanker', deps)
+    expect(outcome).toBe('downgraded')
+    expect(rec.carrier).toEqual([{ dir: '/tmp/agent', toModel: 'opus', cfg: 'opus' }])
+    expect(rec.arms).toBe(1)
+    expect(rec.markers).toEqual([{ dir: '/tmp/agent', premiumModel: 'fable' }])
+    expect(rec.restarts).toEqual(['self-klanker'])
+  })
+
+  it('carrier write THROWS → abort: NO arm, NO marker, NO notice, NO restart (skip)', () => {
+    const { deps, rec } = makeDeps({ carrierThrows: true })
+    const outcome = runTierDowngrade('klanker', deps)
+    expect(outcome).toBe('skip')
+    expect(rec.arms).toBe(0)
+    expect(rec.markers).toHaveLength(0)
+    expect(rec.notices).toHaveLength(0)
+    expect(rec.restarts).toHaveLength(0)
+  })
+
+  it('marker write THROWS → downgrade still completes (marker is best-effort)', () => {
+    const { deps, rec } = makeDeps({ markerThrows: true })
+    const outcome = runTierDowngrade('klanker', deps)
+    expect(outcome).toBe('downgraded')
+    expect(rec.arms).toBe(1)
+    expect(rec.notices).toHaveLength(1)
+    expect(rec.restarts).toEqual(['self-klanker'])
+    expect(rec.markers).toHaveLength(0)
+  })
+
+  it('resume-gate skip-inflight → restart-pending, NO notice, NO restart, NO carrier', () => {
+    const { deps, rec } = makeDeps({ gateVerdict: 'skip-inflight' })
+    const outcome = runTierDowngrade('klanker', deps)
+    expect(outcome).toBe('restart-pending')
+    expect(rec.carrier).toHaveLength(0)
+    expect(rec.arms).toBe(0)
+    expect(rec.notices).toHaveLength(0)
+    expect(rec.restarts).toHaveLength(0)
+  })
+
+  it('resume-gate skip-stale → skip (give up), NO notice/restart', () => {
+    const { deps, rec } = makeDeps({ gateVerdict: 'skip-stale' })
+    const outcome = runTierDowngrade('klanker', deps)
+    expect(outcome).toBe('skip')
+    expect(rec.notices).toHaveLength(0)
+    expect(rec.restarts).toHaveLength(0)
+  })
+
+  it('session on the configured default (override null) → skip, no downgrade', () => {
+    const { deps, rec } = makeDeps({ sessionOverride: null })
+    const outcome = runTierDowngrade('klanker', deps)
+    expect(outcome).toBe('skip')
+    expect(rec.notices).toHaveLength(0)
+  })
+
+  it('unresolved configured default → skip (never downgrade blind)', () => {
+    const { deps, rec } = makeDeps({ configuredDefault: '' })
+    const outcome = runTierDowngrade('klanker', deps)
+    expect(outcome).toBe('skip')
+    expect(rec.carrier).toHaveLength(0)
+  })
+
+  it('no agent dir → skip immediately', () => {
+    const { deps } = makeDeps({ agentDir: null })
+    expect(runTierDowngrade('klanker', deps)).toBe('skip')
+  })
+})

package/telegram-plugin/tests/tier-downgrade.test.ts

@@ -0,0 +1,141 @@
+/**
+ * Unit tests for the MODEL-TIER downgrade failover (second recovery tier).
+ *
+ * The pure `decideTierDowngrade` owns the decision the gateway consults inside
+ * the `all-blocked` branch of doFireFleetAutoFallback — i.e. AFTER account-swap
+ * has been tried and found no account still serving the walled premium model.
+ * `planTierDowngrade` then routes that decision + the resume-gate verdict into
+ * what the gateway should DO (downgrade / suppress the give-up / fall through),
+ * and `renderTierDowngradeNotice` owns the exact user-facing wording. All three
+ * are pure so the decision, the concurrent-turn suppression (LOW-9a), and the
+ * honesty of the broadcast (no "revert to the premium model" promise) are pinned
+ * without a process restart.
+ *
+ * Contract (post loop-guard reconciliation, option b — the ceremonial
+ * `.tier-downgrade-attempts` counter was REMOVED):
+ *   - overload + the session is NOT on a premium model (override null, or the
+ *     override resolves to the configured default) → NO downgrade ('skip'); the
+ *     account-swap path already handled it or there is no lower tier to fall to.
+ *     This is also the natural loop bound: after the downgrade boot the override
+ *     is gone, so a re-entry lands on 'on-default' and never re-downgrades.
+ *   - overload + a premium model walled across ALL accounts → 'downgrade' to the
+ *     configured default.
+ *   - a resume restart already armed in this process (gate 'skip-inflight') →
+ *     'suppress': no give-up card, no re-downgrade (the armed restart resumes).
+ *   - the downgrade broadcast states resume-on-default + manual re-issue and
+ *     carries NO promise of an automatic revert to the premium model.
+ */
+
+import { describe, it, expect } from 'vitest'
+import {
+  decideTierDowngrade,
+  planTierDowngrade,
+  renderTierDowngradeNotice,
+} from '../tier-downgrade.js'
+
+// The gateway passes resolveMainModel; here a near-identity resolver (maps the
+// unset/`default` sentinel to the switchroom default, exactly like the real one)
+// is enough to exercise the canonicalization guard.
+const resolve = (t: string): string =>
+  t === '' || t === 'default' ? 'claude-sonnet-5' : t
+
+describe('decideTierDowngrade — precedence + downgrade target', () => {
+  it('NO downgrade when the session is on the configured default (override null)', () => {
+    // Overload + account-swap all-blocked, but nothing premium is active — the
+    // account-swap path owns this and there is no lower tier. => skip.
+    const d = decideTierDowngrade({ sessionOverride: null, configuredDefault: 'opus', resolve })
+    expect(d).toEqual({ action: 'skip', reason: 'on-default' })
+  })
+
+  it('NO downgrade when the override resolves to the configured default (alias vs id)', () => {
+    // A premium-looking override that is actually the default in another spelling
+    // must never read as a premium tier (that would loop). Same resolver both
+    // sides → on-default.
+    const d = decideTierDowngrade({
+      sessionOverride: 'default',
+      configuredDefault: 'claude-sonnet-5',
+      resolve,
+    })
+    expect(d).toEqual({ action: 'skip', reason: 'on-default' })
+  })
+
+  it('NO downgrade (and no blind fall) when the configured default is unreadable', () => {
+    const d = decideTierDowngrade({ sessionOverride: 'fable', configuredDefault: null, resolve })
+    expect(d).toEqual({ action: 'skip', reason: 'unresolved' })
+  })
+
+  it('DOWNGRADES a walled premium model to the configured default', () => {
+    const d = decideTierDowngrade({ sessionOverride: 'fable', configuredDefault: 'opus', resolve })
+    expect(d).toEqual({ action: 'downgrade', toModel: 'opus', fromModel: 'fable' })
+  })
+
+  it('downgrade target is GENERAL — any premium model → the agent default (not hardcoded fable→opus)', () => {
+    const d = decideTierDowngrade({
+      sessionOverride: 'sr-x-ai/grok-4',
+      configuredDefault: 'claude-sonnet-5',
+      resolve,
+    })
+    expect(d).toEqual({ action: 'downgrade', toModel: 'claude-sonnet-5', fromModel: 'sr-x-ai/grok-4' })
+  })
+})
+
+describe('renderTierDowngradeNotice — HONEST wording (no revert-to-premium promise)', () => {
+  const notice = renderTierDowngradeNotice('fable', 'opus', 'klanker')
+
+  it('states the turn resumes on the DEFAULT to keep working', () => {
+    expect(notice).toContain('opus')
+    expect(notice.toLowerCase()).toContain('resuming on the default')
+  })
+
+  it('tells the user to RE-ISSUE the premium /model themselves', () => {
+    expect(notice).toContain('/model fable')
+    expect(notice.toLowerCase()).toContain("won't switch back on its own")
+  })
+
+  it("carries NO promise of an automatic revert to the premium/fable model", () => {
+    // The HIGH finding: the prior wording lied ("It reverts to `fable` on the
+    // next restart"). Assert none of those false promises can creep back.
+    const lower = notice.toLowerCase()
+    expect(lower).not.toMatch(/reverts? to `?fable/)
+    expect(lower).not.toContain('reverts to `fable`')
+    expect(lower).not.toContain('on the next restart')
+    expect(lower).not.toMatch(/revert(s|ing)? to the premium/)
+    expect(lower).not.toMatch(/back to `?fable`? (on|at|after)/)
+  })
+})
+
+describe('planTierDowngrade — routing (downgrade / suppress / skip)', () => {
+  const skipDecision = { action: 'skip', reason: 'on-default' } as const
+  const downgradeDecision = { action: 'downgrade', toModel: 'opus', fromModel: 'fable' } as const
+
+  it("a 'skip' decision routes to 'skip' regardless of the gate verdict", () => {
+    expect(planTierDowngrade(skipDecision, 'resume', 'ag').kind).toBe('skip')
+    expect(planTierDowngrade(skipDecision, 'skip-inflight', 'ag').kind).toBe('skip')
+    expect(planTierDowngrade(skipDecision, 'skip-stale', 'ag').kind).toBe('skip')
+  })
+
+  it("downgrade + gate 'resume' → 'downgrade' with the honest notice", () => {
+    const plan = planTierDowngrade(downgradeDecision, 'resume', 'klanker')
+    expect(plan.kind).toBe('downgrade')
+    if (plan.kind === 'downgrade') {
+      expect(plan.toModel).toBe('opus')
+      expect(plan.fromModel).toBe('fable')
+      // The plan carries EXACTLY the honest renderer output — no revert promise.
+      expect(plan.notice).toBe(renderTierDowngradeNotice('fable', 'opus', 'klanker'))
+      expect(plan.notice.toLowerCase()).not.toContain('on the next restart')
+    }
+  })
+
+  it("LOW-9a: downgrade + gate 'skip-inflight' → 'suppress' (a resume restart is already armed, no give-up card)", () => {
+    // Two turns hit all-blocked in the same pre-restart process. Turn 1 armed a
+    // downgrade (or account-swap) restart. Turn 2 must NOT broadcast a "could
+    // not be recovered" give-up — the armed restart resumes the interrupted turn.
+    const plan = planTierDowngrade(downgradeDecision, 'skip-inflight', 'klanker')
+    expect(plan.kind).toBe('suppress')
+  })
+
+  it("downgrade + gate 'skip-stale' → 'skip' (turn too old to resume; fall through to the all-blocked card)", () => {
+    const plan = planTierDowngrade(downgradeDecision, 'skip-stale', 'klanker')
+    expect(plan.kind).toBe('skip')
+  })
+})

package/telegram-plugin/tests/unhandled-rejection-policy.test.ts

@@ -11,7 +11,7 @@
 import { describe, it, expect } from 'bun:test'
 import { GrammyError } from 'grammy'
 import { classifyRejection } from '../gateway/unhandled-rejection-policy.js'
-import { FLOOD_WAIT_ACTIVE } from '../retry-api-call.js'
+import { FLOOD_WAIT_ACTIVE, LOCAL_RESOURCE_EXHAUSTED } from '../retry-api-call.js'
 
 // ── Real GrammyError fixtures ──────────────────────────────────────────────
 
@@ -241,3 +241,29 @@ describe('classifyRejection — FLOOD_WAIT_ACTIVE marker (#3084)', () => {
     expect(classifyRejection(new Error('FLOOD_WAIT_ACTIVE-ish but not it'))).toBe('shutdown')
   })
 })
+
+describe('classifyRejection — LOCAL_RESOURCE_EXHAUSTED marker (#3099)', () => {
+  // retry-api-call throws this plain Error marker (retry-api-call.ts:344) when a
+  // send fails on LOCAL disk/memory exhaustion (ENOSPC/EDQUOT/EIO/ENOMEM) rather
+  // than retrying it (#2923). Like its sibling FLOOD_WAIT_ACTIVE it is a plain
+  // Error, not a GrammyError, so without an explicit entry it fell into the
+  // `!isGrammy → shutdown` branch — crashing the gateway when the box is ALREADY
+  // out of disk, which drives a fresh round of boot-time sends/staging writes at
+  // an exhausted resource (the amplification the #2923 marker exists to avoid).
+  it('returns "log_only" for a leaked LOCAL_RESOURCE_EXHAUSTED marker', () => {
+    // Mirror the real throw shape from retry-api-call.ts:344 —
+    // `Object.assign(new Error(LOCAL_RESOURCE_EXHAUSTED), { original: err })`.
+    const err = Object.assign(new Error(LOCAL_RESOURCE_EXHAUSTED), {
+      original: Object.assign(new Error('ENOSPC: no space left on device'), {
+        code: 'ENOSPC',
+      }),
+    })
+    expect(classifyRejection(err)).toBe('log_only')
+  })
+
+  it('still returns "shutdown" for an unrelated plain Error', () => {
+    expect(
+      classifyRejection(new Error('LOCAL_RESOURCE_EXHAUSTED-ish but not it')),
+    ).toBe('shutdown')
+  })
+})

package/telegram-plugin/tests/worker-activity-feed.test.ts

@@ -533,17 +533,20 @@ describe('createWorkerActivityFeed — log sink', () => {
     const edit = logs.find((l) => l.startsWith('worker-feed: edit'))
     const finish = logs.find((l) => l.startsWith('worker-feed: finish'))
 
+    // The feed message is per-(chat,thread) now (workers coalesce), so the
+    // paint/edit lines are feed-scoped; the terminal `finish` line still names
+    // the finishing worker + its state.
     expect(paint).toBeDefined()
-    expect(paint).toContain('agent=w-research')
     expect(paint).toContain('chat=chat-9')
     expect(paint).toContain('thread=7')
     expect(paint).toMatch(/msgId=\d+/)
     expect(paint).toMatch(/bytes=\d+/)
 
     expect(edit).toBeDefined()
-    expect(edit).toContain('agent=w-research')
+    expect(edit).toContain('chat=chat-9')
 
     expect(finish).toBeDefined()
+    expect(finish).toContain('agent=w-research')
     expect(finish).toContain('state=done')
   })