switchroom 0.18.17 → 0.18.18

package/telegram-plugin/dist/server.js

@@ -16994,6 +16994,27 @@ var init_plugin_logger = __esm(() => {
   DEFAULT_LOG_PATH2 = join2(homedir2(), ".switchroom", "logs", "telegram-plugin.log");
   ROTATE_AT_BYTES2 = 50 * 1024 * 1024;
 });
+// raw-error-scrub.ts
+function extractRequestId(raw) {
+  if (typeof raw !== "string" || raw.length === 0)
+    return;
+  const m = raw.match(/["']request[_-]?id["']\s*:\s*["']([A-Za-z0-9._-]+)["']/i) ?? raw.match(/\brequest[_-]?id[=:]\s*([A-Za-z0-9._-]+)/i);
+  return m ? m[1] : undefined;
+}
+function truncateDetailPreservingRequestId(detail, max) {
+  if (typeof detail !== "string")
+    return "";
+  if (detail.length <= max)
+    return detail;
+  const rid = extractRequestId(detail);
+  const head = detail.slice(0, max);
+  if (rid == null || head.includes(rid))
+    return head;
+  const suffix = ` request_id=${rid}`;
+  const headBudget = Math.max(0, max - suffix.length);
+  return `${detail.slice(0, headBudget)}${suffix}`;
+}
+
 // operator-events.ts
 function classifyClaudeError(raw) {
   try {
@@ -17376,6 +17397,10 @@ function projectTranscriptLine(line) {
     const content = message?.content;
     if (!Array.isArray(content))
       return [];
+    if (obj.isApiErrorMessage === true) {
+      const mainModel2 = message?.model;
+      return typeof mainModel2 === "string" && !isModelSentinel(mainModel2) ? [{ kind: "model", model: mainModel2 }] : [];
+    }
     const events = [];
     const mainModel = message?.model;
     if (typeof mainModel === "string" && !isModelSentinel(mainModel)) {
@@ -25140,7 +25165,7 @@ var init_bridge = __esm(async () => {
               type: "operator_event",
               kind: ev.kind,
               agent: AGENT_NAME,
-              detail: ev.detail.slice(0, 1000),
+              detail: truncateDetailPreservingRequestId(ev.detail, 1000),
               chatId: ""
             });
           } catch (err) {

package/telegram-plugin/fleet-fallback-resume.ts

@@ -81,12 +81,24 @@ export interface FleetFallbackResumeGate {
   /**
    * Decide whether to resume the dead turn after a successful swap. Call ONLY
    * when the swap outcome was `'switched'`. Records the arm time on a 'resume'
-   * verdict so a follow-on swap within `singleFlightMs` is suppressed.
+   * verdict so a follow-on swap within `singleFlightMs` is suppressed. Equivalent
+   * to `peek()` followed by `arm()` on a 'resume' verdict.
    *
    * @param failedTurnStartedAtMs epoch-ms the failed turn began, or null when
    *        unknown (then the staleness guard is deferred to the boot path).
    */
   decide(failedTurnStartedAtMs: number | null): ResumeDecision;
+  /**
+   * Evaluate the resume verdict WITHOUT arming the single-flight latch. Use when
+   * the caller must perform fallible work (e.g. write a consume-once carrier)
+   * BEFORE committing to a restart: peek → do the writes → `arm()` only on
+   * success, so a throwing write can never leave an armed latch with no pending
+   * restart (which would suppress a legitimate later resume for `singleFlightMs`).
+   */
+  peek(failedTurnStartedAtMs: number | null): ResumeDecision;
+  /** Commit the single-flight arm (records "now" as the arm time). Pair with a
+   *  prior `peek()` that returned 'resume'. */
+  arm(): void;
   /** Test seam — reset to fresh state. Production code should not call this. */
   reset(): void;
   /** Test/debug — current internal state. */
@@ -105,7 +117,7 @@ export function createFleetFallbackResumeGate(
   // -Infinity = never resumed. A concrete value arms the single-flight window.
   let lastResumedAtMs = Number.NEGATIVE_INFINITY;
 
-  function decide(failedTurnStartedAtMs: number | null): ResumeDecision {
+  function peek(failedTurnStartedAtMs: number | null): ResumeDecision {
     const now = nowFn();
     // Guard 2 — single-flight. A second swap within the window does not
     // re-arm; the in-flight restart owns the resume.
@@ -115,12 +127,23 @@ export function createFleetFallbackResumeGate(
     if (failedTurnStartedAtMs != null && now - failedTurnStartedAtMs > maxAgeMs) {
       return 'skip-stale';
     }
-    lastResumedAtMs = now;
     return 'resume';
   }
 
+  function arm(): void {
+    lastResumedAtMs = nowFn();
+  }
+
+  function decide(failedTurnStartedAtMs: number | null): ResumeDecision {
+    const verdict = peek(failedTurnStartedAtMs);
+    if (verdict === 'resume') arm();
+    return verdict;
+  }
+
   return {
     decide,
+    peek,
+    arm,
     reset() {
       lastResumedAtMs = Number.NEGATIVE_INFINITY;
     },

package/telegram-plugin/gateway/approval-hold.ts

@@ -516,6 +516,55 @@ export function isHeldUndeliverable(
   return pend.undeliverable != null
 }
 
+/** The fields the on-delivery reset reads and mutates. */
+export interface DeliveredPermissionEntry {
+  undeliverable?: UndeliverableMark | null
+  redeliveryFailures?: number
+  /** When the operator's decision window began — the TTL is measured from here. */
+  startedAt: number
+}
+
+/**
+ * A HELD card just LANDED — the operator can finally see and tap it. Clear the
+ * hold marks and RESTART the TTL clock, as ONE shared decision used by BOTH
+ * gateway.ts and the outcome test's harness.
+ *
+ * WHY THIS IS SHARED CODE AND NOT AN INLINE BLOCK (#3128):
+ *
+ * The harness used to carry a PRIVATE copy of this reset (its own
+ * `live.startedAt = clock.now()`), so the behavioural test that proves the
+ * operator gets a FULL window after re-delivery drove the double, not the real
+ * gateway. Deleting `startedAt = Date.now()` from gateway.ts would have left that
+ * test GREEN — only a source-text grep noticed, and greps drift. Same placebo-pin
+ * class as the leash (#3123) and the never-auto-approve pin (#3126). Now the reset
+ * lives here, in one importable place, and both callers drive it: delete
+ * `entry.startedAt = now` below and the `(d2)` outcome test goes RED, because there
+ * is only one implementation to delete.
+ *
+ * RESET THE TTL CLOCK is load-bearing, not cosmetic. `startedAt` is when the
+ * agent asked; the TTL measures how long the operator had to answer. Until the
+ * card lands they have NOTHING to answer — it did not exist in any chat. Without
+ * the reset, a card held through a 4.6h ban lands already-expired against a 60-min
+ * TTL and the very next reaper tick auto-denies it: the silent denial would be
+ * MOVED, not removed.
+ *
+ * Returns true when this was a HELD-card recovery — the caller should reconcile
+ * the off-Telegram surface and log the re-delivery. Returns false for a normal
+ * first delivery (the entry was never held), where there is nothing to reset.
+ *
+ * @see reference/invariants.md § no-self-escalation, § on-leash
+ */
+export function applyDeliveredHoldReset(
+  entry: DeliveredPermissionEntry,
+  now: number,
+): boolean {
+  if (entry.undeliverable == null) return false
+  entry.undeliverable = null
+  entry.redeliveryFailures = 0
+  entry.startedAt = now
+  return true
+}
+
 /**
  * Per-tick re-delivery cap (PR 2).
  *

package/telegram-plugin/gateway/bridge-dead-watchdog.ts

@@ -32,11 +32,15 @@
  *     claude itself down — where a bounce is either premature or
  *     futile); the timer re-arms so a slow-booting claude gets the full
  *     grace window again once it appears;
- *   - cron-session bridges (`<agent>-cron`) and anonymous IPC clients
- *     (recall.py one-shots, pre-handshake connects) neither satisfy nor
- *     re-arm the watchdog — the gating lives INSIDE noteBridge* so a
- *     gateway handler refactor can't silently reintroduce the
- *     bounce-after-cron-fire false positive;
+ *   - cron-session bridges (`<agent>-cron`), anonymous IPC clients
+ *     (recall.py one-shots, pre-handshake connects), AND secondary/relay
+ *     clients that register a DIFFERENT agent name than this gateway serves
+ *     (e.g. an `overlord-relay` connecting into another agent's gateway
+ *     socket — #3086) neither satisfy nor re-arm the watchdog: only the
+ *     gateway's OWN primary bridge (agentName === $SWITCHROOM_AGENT_NAME)
+ *     counts. The gating lives INSIDE noteBridge* so a gateway handler
+ *     refactor can't silently reintroduce the bounce-after-cron-fire or the
+ *     bounce-after-relay-disconnect false positive;
  *   - loud, structured escalation log line including a fresh
  *     bridge-crash.log tail (PR #3037 breadcrumbs) so the operator sees
  *     WHY from the supervisor log alone.
@@ -352,6 +356,16 @@ export interface BridgeDeadWatchdogOpts {
    *  unref (the watchdog must never keep the gateway process alive). */
   setTimer?: (fn: () => void, ms: number) => unknown
   clearTimer?: (handle: unknown) => void
+  /** The agent identity THIS gateway serves ($SWITCHROOM_AGENT_NAME).
+   *  Only a bridge client registering under this exact name is the
+   *  primary bridge whose presence/absence drives the watchdog. Secondary
+   *  or relay clients (a different named identity connecting into this
+   *  gateway's socket — e.g. `overlord-relay`, #3086) are ignored on both
+   *  the register and disconnect paths. When unset/empty (a misconfigured
+   *  gateway with no agent name), the watchdog falls back to the pre-#3086
+   *  test — any named non-cron client counts — so a genuine bridge death is
+   *  still caught rather than silently un-guarded. */
+  selfAgentName?: string
   /** Injectable clock (marker ts + crash-log freshness). */
   nowMs?: () => number
   /** Injectable marker writer (tests avoid real fs). */
@@ -365,15 +379,18 @@ export interface BridgeDeadWatchdog {
    *  when the cross-boot streak cap is already reached (stands down with
    *  an audit line instead). */
   arm: () => void
-  /** A bridge client registered. Only a REAL bridge (named, non-cron)
-   *  satisfies the watchdog — cron sessions (`<agent>-cron`) and
-   *  anonymous clients (agentName null) are ignored HERE so a gateway
-   *  handler refactor can't reorder the gating away (review finding 5). */
+  /** A bridge client registered. Only THIS gateway's OWN primary bridge
+   *  (agentName === selfAgentName, named, non-cron) satisfies the watchdog
+   *  — cron sessions (`<agent>-cron`), anonymous clients (agentName null),
+   *  and secondary/relay clients registering a different name (#3086) are
+   *  ignored HERE so a gateway handler refactor can't reorder the gating
+   *  away (review finding 5). */
   noteBridgeRegistered: (agentName: string | null | undefined) => void
-  /** A bridge client disconnected. Re-arms the grace window only for the
-   *  real bridge (same internal gating), so a bridge that dies AFTER boot
-   *  and never reconnects also escalates. Still capped by the
-   *  once-per-boot fuse. */
+  /** A bridge client disconnected. Re-arms the grace window only for THIS
+   *  gateway's own primary bridge (same internal gating), so a bridge that
+   *  dies AFTER boot and never reconnects also escalates — while a
+   *  transient relay/secondary client's disconnect (#3086) is a no-op.
+   *  Still capped by the once-per-boot fuse. */
   noteBridgeDisconnected: (agentName: string | null | undefined) => void
   /** Evaluate now (the timer body — exposed for tests). Returns the
    *  decision taken. */
@@ -384,9 +401,34 @@ export interface BridgeDeadWatchdog {
   hasEscalated: () => boolean
 }
 
-/** Is this client identity the REAL main-agent bridge (named, non-cron)? */
-function isRealBridgeIdentity(agentName: string | null | undefined): boolean {
-  return agentName != null && agentName.length > 0 && !isCronIdentity(agentName)
+/**
+ * Is this client identity THIS gateway's OWN primary main-agent bridge?
+ *
+ * A named, non-cron client whose name matches the gateway's own agent
+ * identity (`selfAgentName` = $SWITCHROOM_AGENT_NAME). A switchroom gateway
+ * serves exactly one agent, and its real bridge registers under exactly that
+ * name (see bridge/bridge.ts — `agentName: AGENT_NAME`). Secondary or relay
+ * clients (e.g. an `overlord-relay` that connects into another agent's
+ * gateway socket, #3086) register a DIFFERENT name; they are named and
+ * non-cron but are NOT this gateway's primary bridge, so their register /
+ * disconnect must neither satisfy nor re-arm the watchdog — otherwise a
+ * transient relay disconnect marks the (still-alive) primary bridge dead and
+ * bounces a healthy container.
+ *
+ * When `selfAgentName` is unset/empty (misconfigured gateway) we cannot
+ * identity-match, so fall back to the pre-#3086 test — any named non-cron
+ * client counts — keeping the watchdog protective rather than un-guarded.
+ */
+function isRealBridgeIdentity(
+  agentName: string | null | undefined,
+  selfAgentName: string | null | undefined,
+): boolean {
+  if (agentName == null || agentName.length === 0) return false
+  if (isCronIdentity(agentName)) return false
+  if (selfAgentName != null && selfAgentName.length > 0) {
+    return agentName === selfAgentName
+  }
+  return true
 }
 
 export function createBridgeDeadWatchdog(opts: BridgeDeadWatchdogOpts): BridgeDeadWatchdog {
@@ -404,6 +446,7 @@ export function createBridgeDeadWatchdog(opts: BridgeDeadWatchdogOpts): BridgeDe
     opts.readCrashTail ?? ((p: string, t: number) => readFreshCrashLogTail(p, { nowMs: t }))
   const priorStreak = opts.priorStreak ?? 0
   const maxConsecutive = opts.maxConsecutive ?? MAX_CONSECUTIVE_ESCALATIONS
+  const selfAgentName = opts.selfAgentName
 
   let timer: unknown = null
   let bridgeRegistered = false
@@ -528,13 +571,13 @@ export function createBridgeDeadWatchdog(opts: BridgeDeadWatchdogOpts): BridgeDe
   return {
     arm: armInternal,
     noteBridgeRegistered: (agentName) => {
-      if (!isRealBridgeIdentity(agentName)) return
+      if (!isRealBridgeIdentity(agentName, selfAgentName)) return
       bridgeRegistered = true
       bridgeEverRegistered = true
       cancel()
     },
     noteBridgeDisconnected: (agentName) => {
-      if (!isRealBridgeIdentity(agentName)) return
+      if (!isRealBridgeIdentity(agentName, selfAgentName)) return
       bridgeRegistered = false
       armInternal()
     },