switchroom 0.18.17 → 0.18.19

package/telegram-plugin/tests/tier-downgrade.test.ts

@@ -0,0 +1,141 @@
+/**
+ * Unit tests for the MODEL-TIER downgrade failover (second recovery tier).
+ *
+ * The pure `decideTierDowngrade` owns the decision the gateway consults inside
+ * the `all-blocked` branch of doFireFleetAutoFallback — i.e. AFTER account-swap
+ * has been tried and found no account still serving the walled premium model.
+ * `planTierDowngrade` then routes that decision + the resume-gate verdict into
+ * what the gateway should DO (downgrade / suppress the give-up / fall through),
+ * and `renderTierDowngradeNotice` owns the exact user-facing wording. All three
+ * are pure so the decision, the concurrent-turn suppression (LOW-9a), and the
+ * honesty of the broadcast (no "revert to the premium model" promise) are pinned
+ * without a process restart.
+ *
+ * Contract (post loop-guard reconciliation, option b — the ceremonial
+ * `.tier-downgrade-attempts` counter was REMOVED):
+ *   - overload + the session is NOT on a premium model (override null, or the
+ *     override resolves to the configured default) → NO downgrade ('skip'); the
+ *     account-swap path already handled it or there is no lower tier to fall to.
+ *     This is also the natural loop bound: after the downgrade boot the override
+ *     is gone, so a re-entry lands on 'on-default' and never re-downgrades.
+ *   - overload + a premium model walled across ALL accounts → 'downgrade' to the
+ *     configured default.
+ *   - a resume restart already armed in this process (gate 'skip-inflight') →
+ *     'suppress': no give-up card, no re-downgrade (the armed restart resumes).
+ *   - the downgrade broadcast states resume-on-default + manual re-issue and
+ *     carries NO promise of an automatic revert to the premium model.
+ */
+
+import { describe, it, expect } from 'vitest'
+import {
+  decideTierDowngrade,
+  planTierDowngrade,
+  renderTierDowngradeNotice,
+} from '../tier-downgrade.js'
+
+// The gateway passes resolveMainModel; here a near-identity resolver (maps the
+// unset/`default` sentinel to the switchroom default, exactly like the real one)
+// is enough to exercise the canonicalization guard.
+const resolve = (t: string): string =>
+  t === '' || t === 'default' ? 'claude-sonnet-5' : t
+
+describe('decideTierDowngrade — precedence + downgrade target', () => {
+  it('NO downgrade when the session is on the configured default (override null)', () => {
+    // Overload + account-swap all-blocked, but nothing premium is active — the
+    // account-swap path owns this and there is no lower tier. => skip.
+    const d = decideTierDowngrade({ sessionOverride: null, configuredDefault: 'opus', resolve })
+    expect(d).toEqual({ action: 'skip', reason: 'on-default' })
+  })
+
+  it('NO downgrade when the override resolves to the configured default (alias vs id)', () => {
+    // A premium-looking override that is actually the default in another spelling
+    // must never read as a premium tier (that would loop). Same resolver both
+    // sides → on-default.
+    const d = decideTierDowngrade({
+      sessionOverride: 'default',
+      configuredDefault: 'claude-sonnet-5',
+      resolve,
+    })
+    expect(d).toEqual({ action: 'skip', reason: 'on-default' })
+  })
+
+  it('NO downgrade (and no blind fall) when the configured default is unreadable', () => {
+    const d = decideTierDowngrade({ sessionOverride: 'fable', configuredDefault: null, resolve })
+    expect(d).toEqual({ action: 'skip', reason: 'unresolved' })
+  })
+
+  it('DOWNGRADES a walled premium model to the configured default', () => {
+    const d = decideTierDowngrade({ sessionOverride: 'fable', configuredDefault: 'opus', resolve })
+    expect(d).toEqual({ action: 'downgrade', toModel: 'opus', fromModel: 'fable' })
+  })
+
+  it('downgrade target is GENERAL — any premium model → the agent default (not hardcoded fable→opus)', () => {
+    const d = decideTierDowngrade({
+      sessionOverride: 'sr-x-ai/grok-4',
+      configuredDefault: 'claude-sonnet-5',
+      resolve,
+    })
+    expect(d).toEqual({ action: 'downgrade', toModel: 'claude-sonnet-5', fromModel: 'sr-x-ai/grok-4' })
+  })
+})
+
+describe('renderTierDowngradeNotice — HONEST wording (no revert-to-premium promise)', () => {
+  const notice = renderTierDowngradeNotice('fable', 'opus', 'klanker')
+
+  it('states the turn resumes on the DEFAULT to keep working', () => {
+    expect(notice).toContain('opus')
+    expect(notice.toLowerCase()).toContain('resuming on the default')
+  })
+
+  it('tells the user to RE-ISSUE the premium /model themselves', () => {
+    expect(notice).toContain('/model fable')
+    expect(notice.toLowerCase()).toContain("won't switch back on its own")
+  })
+
+  it("carries NO promise of an automatic revert to the premium/fable model", () => {
+    // The HIGH finding: the prior wording lied ("It reverts to `fable` on the
+    // next restart"). Assert none of those false promises can creep back.
+    const lower = notice.toLowerCase()
+    expect(lower).not.toMatch(/reverts? to `?fable/)
+    expect(lower).not.toContain('reverts to `fable`')
+    expect(lower).not.toContain('on the next restart')
+    expect(lower).not.toMatch(/revert(s|ing)? to the premium/)
+    expect(lower).not.toMatch(/back to `?fable`? (on|at|after)/)
+  })
+})
+
+describe('planTierDowngrade — routing (downgrade / suppress / skip)', () => {
+  const skipDecision = { action: 'skip', reason: 'on-default' } as const
+  const downgradeDecision = { action: 'downgrade', toModel: 'opus', fromModel: 'fable' } as const
+
+  it("a 'skip' decision routes to 'skip' regardless of the gate verdict", () => {
+    expect(planTierDowngrade(skipDecision, 'resume', 'ag').kind).toBe('skip')
+    expect(planTierDowngrade(skipDecision, 'skip-inflight', 'ag').kind).toBe('skip')
+    expect(planTierDowngrade(skipDecision, 'skip-stale', 'ag').kind).toBe('skip')
+  })
+
+  it("downgrade + gate 'resume' → 'downgrade' with the honest notice", () => {
+    const plan = planTierDowngrade(downgradeDecision, 'resume', 'klanker')
+    expect(plan.kind).toBe('downgrade')
+    if (plan.kind === 'downgrade') {
+      expect(plan.toModel).toBe('opus')
+      expect(plan.fromModel).toBe('fable')
+      // The plan carries EXACTLY the honest renderer output — no revert promise.
+      expect(plan.notice).toBe(renderTierDowngradeNotice('fable', 'opus', 'klanker'))
+      expect(plan.notice.toLowerCase()).not.toContain('on the next restart')
+    }
+  })
+
+  it("LOW-9a: downgrade + gate 'skip-inflight' → 'suppress' (a resume restart is already armed, no give-up card)", () => {
+    // Two turns hit all-blocked in the same pre-restart process. Turn 1 armed a
+    // downgrade (or account-swap) restart. Turn 2 must NOT broadcast a "could
+    // not be recovered" give-up — the armed restart resumes the interrupted turn.
+    const plan = planTierDowngrade(downgradeDecision, 'skip-inflight', 'klanker')
+    expect(plan.kind).toBe('suppress')
+  })
+
+  it("downgrade + gate 'skip-stale' → 'skip' (turn too old to resume; fall through to the all-blocked card)", () => {
+    const plan = planTierDowngrade(downgradeDecision, 'skip-stale', 'klanker')
+    expect(plan.kind).toBe('skip')
+  })
+})

package/telegram-plugin/tests/turn-flush-safety.test.ts

@@ -31,9 +31,7 @@ import {
   normalizeParagraphBreaks,
   normalizePunctuation,
   stripExcessBold,
-  addParagraphSpacers,
   splitMarkdownChunks,
-  PARAGRAPH_SPACER,
   RICH_MESSAGE_MAX_CHARS,
 } from '../format.js'
 
@@ -130,7 +128,9 @@ describe('decideTurnFlush — prose+trailing-sentinel is suppressed, not leaked
 // the real gateway turn-flush render pipeline (post-#2669 rich-markdown path):
 //   decideTurnFlush -> join('\n\n')
 //   -> repairEscapedWhitespace -> normalizeParagraphBreaks
-//   -> addParagraphSpacers -> splitMarkdownChunks -> sendRichMessage
+//   -> splitMarkdownChunks -> sendRichMessage
+// (no paragraph-spacer pass — the NBSP spacer was removed in the #2669
+//  follow-up; gaps are plain `\n\n`, one visible blank line)
 // so it pins the end-to-end fix, not just the pure decision. The corpus is a
 // REAL captured-transcript shape (three separate content[i].text blocks, one
 // stored UNTRIMMED with a trailing '\n' exactly as session-tail.ts pushes
@@ -156,8 +156,7 @@ describe('#2798 turn-flush block separation — real multi-block transcript shap
     const d = decideTurnFlush({ chatId: '12345', replyCalled: false, capturedText: blocks })
     expect(d.kind).toBe('flush')
     const joined = (d as { kind: 'flush'; text: string }).text
-    const normalized = normalizeParagraphBreaks(repairEscapedWhitespace(joined))
-    return addParagraphSpacers(normalized)
+    return normalizeParagraphBreaks(repairEscapedWhitespace(joined))
   }
 
   it('separates whole blocks with a visible paragraph gap, not a wall-of-text', () => {
@@ -167,32 +166,29 @@ describe('#2798 turn-flush block separation — real multi-block transcript shap
     expect(out).toContain('The `auth` handler looks correct')
     expect(out).toContain('Want me to open a PR')
     // The wall-of-text failure mode glues two blocks one '\n' apart. Assert the
-    // boundary carries a real paragraph break with the injected visible spacer
-    // line (#2692 rich-path spacer), and NOT a single-newline join.
-    expect(out).toContain(`\n\n${PARAGRAPH_SPACER}\n\n`)
+    // boundary carries a real paragraph break (plain `\n\n`, one blank line —
+    // no NBSP spacer), and NOT a single-newline join.
+    expect(out).toContain('flagged.\n\nThe `auth`')
     expect(out).not.toContain('flagged.\nThe `auth`')
-    // A spacer sits specifically between block 1 and block 2.
-    const b1 = out.indexOf('flagged.')
-    const b2 = out.indexOf('The `auth` handler')
-    expect(out.slice(b1, b2)).toContain(PARAGRAPH_SPACER)
+    // No U+00A0 anywhere.
+    expect(out).not.toContain(String.fromCharCode(0xa0))
   })
 
   it('collapses the untrimmed-trailing-newline stack — no 3+ newline run reaches the wire', () => {
     const out = renderLikeTurnFlush(realBlocks)
     // Block 2's trailing '\n' + the '\n\n' join = 3 newlines; normalize
-    // collapses 3+ runs to '\n\n' and addParagraphSpacers wedges exactly one
-    // spacer, so no doubled/stacked blank run survives.
+    // collapses 3+ runs to '\n\n', so no doubled/stacked blank run survives.
     expect(out).not.toMatch(/\n{3,}/)
-    // One spacer per block transition: 3 blocks → 2 gaps → 2 spacers.
-    const spacerCount = out.split(PARAGRAPH_SPACER).length - 1
-    expect(spacerCount).toBe(2)
+    // One blank-line gap per block transition: 3 blocks → 2 gaps.
+    const gapCount = (out.match(/\n\n/g) ?? []).length
+    expect(gapCount).toBe(2)
   })
 
   it('the whole separated answer stays in one rich chunk here (well under 32768)', () => {
     const out = renderLikeTurnFlush(realBlocks)
     const chunks = splitMarkdownChunks(out, RICH_MESSAGE_MAX_CHARS)
     expect(chunks.length).toBe(1)
-    expect(chunks[0]).toContain(PARAGRAPH_SPACER)
+    expect(chunks[0]).toContain('\n\n')
   })
 
   it('still SUPPRESSES a real transcript that deliberately terminates with a bare NO_REPLY (#2053 guard intact)', () => {
@@ -228,9 +224,9 @@ describe('#2798 turn-flush block separation — real multi-block transcript shap
 // runs (gateway executeReply):
 //   repairEscapedWhitespace -> normalizeParagraphBreaks -> redactOutboundText
 //   -> stripExcessBold(normalizePunctuation) -> scrubVoice
-//   -> addParagraphSpacers (send side)
+// (no send-side paragraph-spacer pass — removed in the #2669 follow-up).
 // The original #2798 change gave turn-flush the paragraph steps + redact +
-// scrub + spacers but OMITTED `stripExcessBold(normalizePunctuation(...))`.
+// scrub but OMITTED `stripExcessBold(normalizePunctuation(...))`.
 // This suite reconstructs the deterministic format chain of BOTH paths (the
 // runtime-only redact + voice-scrub steps are literally the same calls on both
 // paths and are out of scope here) and pins that turn-flush now matches reply
@@ -312,7 +308,7 @@ describe('#2798 turn-flush punctuation/bold parity with reply', () => {
   function formatChain(text: string): string {
     let t = normalizeParagraphBreaks(repairEscapedWhitespace(text))
     t = stripExcessBold(normalizePunctuation(t))
-    return addParagraphSpacers(t)
+    return t
   }
 
   const input =

package/telegram-plugin/tests/unhandled-rejection-policy.test.ts

@@ -11,7 +11,7 @@
 import { describe, it, expect } from 'bun:test'
 import { GrammyError } from 'grammy'
 import { classifyRejection } from '../gateway/unhandled-rejection-policy.js'
-import { FLOOD_WAIT_ACTIVE } from '../retry-api-call.js'
+import { FLOOD_WAIT_ACTIVE, LOCAL_RESOURCE_EXHAUSTED } from '../retry-api-call.js'
 
 // ── Real GrammyError fixtures ──────────────────────────────────────────────
 
@@ -241,3 +241,29 @@ describe('classifyRejection — FLOOD_WAIT_ACTIVE marker (#3084)', () => {
     expect(classifyRejection(new Error('FLOOD_WAIT_ACTIVE-ish but not it'))).toBe('shutdown')
   })
 })
+
+describe('classifyRejection — LOCAL_RESOURCE_EXHAUSTED marker (#3099)', () => {
+  // retry-api-call throws this plain Error marker (retry-api-call.ts:344) when a
+  // send fails on LOCAL disk/memory exhaustion (ENOSPC/EDQUOT/EIO/ENOMEM) rather
+  // than retrying it (#2923). Like its sibling FLOOD_WAIT_ACTIVE it is a plain
+  // Error, not a GrammyError, so without an explicit entry it fell into the
+  // `!isGrammy → shutdown` branch — crashing the gateway when the box is ALREADY
+  // out of disk, which drives a fresh round of boot-time sends/staging writes at
+  // an exhausted resource (the amplification the #2923 marker exists to avoid).
+  it('returns "log_only" for a leaked LOCAL_RESOURCE_EXHAUSTED marker', () => {
+    // Mirror the real throw shape from retry-api-call.ts:344 —
+    // `Object.assign(new Error(LOCAL_RESOURCE_EXHAUSTED), { original: err })`.
+    const err = Object.assign(new Error(LOCAL_RESOURCE_EXHAUSTED), {
+      original: Object.assign(new Error('ENOSPC: no space left on device'), {
+        code: 'ENOSPC',
+      }),
+    })
+    expect(classifyRejection(err)).toBe('log_only')
+  })
+
+  it('still returns "shutdown" for an unrelated plain Error', () => {
+    expect(
+      classifyRejection(new Error('LOCAL_RESOURCE_EXHAUSTED-ish but not it')),
+    ).toBe('shutdown')
+  })
+})

package/telegram-plugin/tests/worker-activity-feed.test.ts

@@ -533,17 +533,20 @@ describe('createWorkerActivityFeed — log sink', () => {
     const edit = logs.find((l) => l.startsWith('worker-feed: edit'))
     const finish = logs.find((l) => l.startsWith('worker-feed: finish'))
 
+    // The feed message is per-(chat,thread) now (workers coalesce), so the
+    // paint/edit lines are feed-scoped; the terminal `finish` line still names
+    // the finishing worker + its state.
     expect(paint).toBeDefined()
-    expect(paint).toContain('agent=w-research')
     expect(paint).toContain('chat=chat-9')
     expect(paint).toContain('thread=7')
     expect(paint).toMatch(/msgId=\d+/)
     expect(paint).toMatch(/bytes=\d+/)
 
     expect(edit).toBeDefined()
-    expect(edit).toContain('agent=w-research')
+    expect(edit).toContain('chat=chat-9')
 
     expect(finish).toBeDefined()
+    expect(finish).toContain('agent=w-research')
     expect(finish).toContain('state=done')
   })