switchroom 0.18.18 → 0.18.19

package/telegram-plugin/llm-error-present.ts

@@ -34,7 +34,6 @@ import {
 } from './model-unavailable.js'
 import { classify429Detail } from './throttle-tier.js'
 import { classifyClaudeError } from './operator-events.js'
-import type { InlineKeyboardMarkup } from './operator-events.js'
 import { stripRawErrorBytes, extractRequestId } from './raw-error-scrub.js'
 import { fmtLocalClock, tzAbbrev } from './shared/local-time.js'
 
@@ -226,7 +225,6 @@ function buildCoreText(kind: LlmErrorKind, source: LlmErrorSource): string {
 
 export interface RenderedLlmError {
   text: string
-  keyboard?: InlineKeyboardMarkup
 }
 
 /**
@@ -257,9 +255,49 @@ function formatRelativeTail(deltaMs: number): string {
 }
 
 /**
- * Render ONE clean card for a parsed LLM error. Action buttons for the
- * actionable kinds (auth → Reauth, quota_wall → Wait/switch). `agent` is used
- * in the callback_data (URL-encoded) and the headline; `tz` localizes the reset.
+ * A short local-tz clock+abbrev for a reset instant (`4:52pm AEST`), or '' when
+ * there is no finite reset to name. Used to embed the reset in the recommendation
+ * line. Shares the same tz-formatting primitives as {@link formatResetLocal}, so
+ * an invalid IANA tz throws here too (guarded by {@link renderLlmErrorSafe}).
+ */
+function formatResetClock(resetAt: Date | undefined, tz: string): string {
+  if (resetAt == null) return ''
+  const ms = resetAt.getTime()
+  if (!Number.isFinite(ms)) return ''
+  return `${fmtLocalClock(ms, tz)} ${tzAbbrev(ms, tz)}`
+}
+
+/**
+ * The plain-text "what to DO" line for the actionable error classes. Replaces
+ * the former dead action buttons (auth → Reauth, quota_wall → Wait): those
+ * inline_keyboard callbacks were only ever exercised in tests — the gateway
+ * wiring routes renderLlmError solely for the transient rate_limit/overload_529
+ * kinds, so the auth/quota buttons were unreachable in production (Ken, CPO,
+ * 2026-07: drop the buttons, recommend in text). Transient kinds return undefined
+ * — their coreText already says "retrying automatically", no operator action.
+ */
+function buildRecommendation(parsed: ParsedLlmError, tz: string): string | undefined {
+  switch (parsed.kind) {
+    case 'auth':
+      return '→ Re-authenticate this account to continue.'
+    case 'quota_wall': {
+      const reset = formatResetClock(parsed.resetAt, tz)
+      return reset
+        ? `→ Switch to another account, or wait for the quota to reset at ${reset}.`
+        : '→ Switch to another account, or wait for the quota to reset.'
+    }
+    default:
+      return undefined
+  }
+}
+
+/**
+ * Render ONE clean card for a parsed LLM error. No action buttons — the
+ * actionable kinds (auth, quota_wall) carry a plain-text recommendation line
+ * instead (see {@link buildRecommendation}). `agent` is the headline label; `tz`
+ * localizes the reset. Throws if `tz` is an invalid IANA zone AND a reset is
+ * present (Intl.DateTimeFormat rejects the zone at construction) — call
+ * {@link renderLlmErrorSafe} from any crash-sensitive surface.
  */
 export function renderLlmError(
   parsed: ParsedLlmError,
@@ -276,32 +314,32 @@ export function renderLlmError(
 
   if (parsed.model) lines.push(`_model: ${escapeAgent(parsed.model)}_`)
 
-  const text = lines.join('\n')
+  const recommendation = buildRecommendation(parsed, tz)
+  if (recommendation) lines.push(recommendation)
 
-  switch (parsed.kind) {
-    case 'auth':
-      return {
-        text,
-        keyboard: {
-          inline_keyboard: [
-            [
-              { text: '🔐 Reauth now', callback_data: `op:reauth:${encodeURIComponent(agent)}` },
-              { text: '❌ Dismiss', callback_data: `op:dismiss:${encodeURIComponent(agent)}` },
-            ],
-          ],
-        },
-      }
-    case 'quota_wall':
-      return {
-        text,
-        keyboard: {
-          inline_keyboard: [
-            [{ text: '⏳ Wait', callback_data: `op:dismiss:${encodeURIComponent(agent)}` }],
-          ],
-        },
-      }
-    default:
-      return { text }
+  return { text: lines.join('\n') }
+}
+
+/**
+ * Crash-guarded wrapper around {@link renderLlmError}. An invalid IANA timezone
+ * makes Intl.DateTimeFormat throw a RangeError at construction time — the
+ * local-time.ts "never throws" contract does NOT cover construction-time zone
+ * validation, so a bad `SWITCHROOM_TIMEZONE`/`TZ` would otherwise crash the
+ * operator-event turn. On ANY formatting failure, degrade to a minimal, tz-free
+ * safe line built only from the JSON-stripped coreText + agent. Total — never
+ * throws.
+ */
+export function renderLlmErrorSafe(
+  parsed: ParsedLlmError,
+  agent: string,
+  tz: string,
+  now: Date = new Date(),
+): RenderedLlmError {
+  try {
+    return renderLlmError(parsed, agent, tz, now)
+  } catch {
+    const safeAgent = escapeAgent(agent)
+    return { text: `${kindEmoji(parsed.kind)} ${parsed.coreText} (**${safeAgent}**)` }
   }
 }
 

package/telegram-plugin/stream-reply-handler.ts

@@ -171,14 +171,6 @@ export interface StreamReplyDeps {
    * after normalizePunctuation. Optional for backward compat.
    */
   stripExcessBold?: (text: string) => string
-  /**
-   * Insert a visible blank-line spacer into each prose `\n\n` gap so the rich
-   * GFM renderer shows a real empty line between paragraphs (the rich engine
-   * otherwise renders `\n\n` tight — the post-#2669 paragraph-spacing
-   * regression). Applied only on the rich path (never on `format:'text'`).
-   * Optional for backward compat; omitted → no spacers added.
-   */
-  addParagraphSpacers?: (text: string) => string
   /** Validates the chat id against the access list. Throws on deny. */
   assertAllowedChat: (chatId: string) => void
   /** Resolves the effective thread id (explicit, last-inbound, or undefined). */
@@ -362,12 +354,11 @@ export async function handleStreamReply(
   // markdown→HTML / MarkdownV2 rendering happens here anymore — the raw
   // text IS the wire payload.
   const literalText = format === 'text'
-  // Paragraph-spacing fix (rich-message regression after #2669): inject a
-  // visible blank-line spacer into prose `\n\n` gaps on the rich path so
-  // multi-paragraph answers don't render jammed together. The literal
-  // (`format:'text'`) path must stay byte-exact, so it is left untouched.
-  let effectiveText: string =
-    !literalText && deps.addParagraphSpacers ? deps.addParagraphSpacers(rawText) : rawText
+  // No paragraph-spacer pass: the NBSP spacer (#2669) was removed in the
+  // follow-up because the Bot API 10.1 rich GFM renderer already shows a `\n\n`
+  // gap as one blank line — the spacer double-gapped every paragraph. The raw
+  // text (already normalized upstream) is the effective text on both paths.
+  let effectiveText: string = rawText
 
   // Inline status-accent header (issue #320 fallback). Prepended so it
   // leads the body. Since stream_reply callers pass the full text snapshot

package/telegram-plugin/tests/format-consistency.test.ts

@@ -1,27 +1,25 @@
 /**
  * Tests for the fleet-wide consistent-formatting bundle:
  *
- *   1. addParagraphSpacers extension — a visible U+00A0 spacer line at EVERY
- *      block transition (paragraph→list, list→paragraph, heading→anything,
- *      blockquote/table boundaries), never inside a list/table interior.
+ *   1. paragraph gap spacing — a plain `\n\n` (one blank line) at EVERY block
+ *      transition (paragraph→list, list→paragraph, heading→anything,
+ *      blockquote/table boundaries), never a double blank line and never an
+ *      NBSP spacer (the old spacer pass was removed in the #2669 follow-up).
  *   2. normalizePunctuation — em/en dashes → comma/hyphen, leading `•`/`·`
- *      list markers → `- `, on code-masked text, idempotent.
+ *      list markers → `- `, on code-masked text, idempotent; link hrefs are
+ *      protected from dash rewriting.
  *   3. stripExcessBold — over-bold tripwire: >30% bold or fully-bolded
  *      paragraphs/lists lose their bold markers; short messages exempt.
  */
 import { describe, test, expect } from 'vitest'
 import {
-  addParagraphSpacers,
   normalizeParagraphBreaks,
   normalizePunctuation,
   stripExcessBold,
   splitMarkdownChunks,
   hardenCardBreaks,
-  PARAGRAPH_SPACER,
 } from '../format.js'
 
-const SP = PARAGRAPH_SPACER // U+00A0
-
 describe('hardenCardBreaks — deterministic card line-break hardener', () => {
   test('promotes lone field breaks to GFM hard breaks (the blob fix)', () => {
     const out = hardenCardBreaks('Agent: assistant\nAuth: Max\nStatus: running')
@@ -100,74 +98,60 @@ describe('hardenCardBreaks — deterministic card line-break hardener', () => {
   })
 })
 
-describe('addParagraphSpacers — uniform block spacing', () => {
-  test('still spaces prose→prose (existing behaviour)', () => {
-    const out = addParagraphSpacers('Alpha.\n\nBravo.')
-    expect(out).toBe(`Alpha.\n\n${SP}\n\nBravo.`)
-  })
+describe('paragraph gap spacing — plain single blank line, no NBSP', () => {
+  const NBSP = String.fromCharCode(0xa0)
 
-  test('spaces paragraph→list transition', () => {
-    const out = addParagraphSpacers('Intro.\n\n- one\n- two')
-    expect(out).toBe(`Intro.\n\n${SP}\n\n- one\n- two`)
+  test('prose→prose gap is one blank line, no NBSP', () => {
+    const out = normalizeParagraphBreaks('Alpha.\n\nBravo.')
+    expect(out).toBe('Alpha.\n\nBravo.')
+    expect(out).not.toContain(NBSP)
   })
 
-  test('spaces list→paragraph transition', () => {
-    const out = addParagraphSpacers('- one\n- two\n\nOutro.')
-    expect(out).toBe(`- one\n- two\n\n${SP}\n\nOutro.`)
+  test('paragraph→list transition is a single `\\n\\n` boundary', () => {
+    expect(normalizeParagraphBreaks('Intro.\n\n- one\n- two')).toBe('Intro.\n\n- one\n- two')
   })
 
-  test('spaces heading→anything', () => {
-    expect(addParagraphSpacers('# Title\n\nBody.')).toBe(`# Title\n\n${SP}\n\nBody.`)
-    expect(addParagraphSpacers('# Title\n\n- a\n- b')).toBe(`# Title\n\n${SP}\n\n- a\n- b`)
-  })
-
-  test('spaces blockquote and table boundaries', () => {
-    expect(addParagraphSpacers('> quoted\n\nProse.')).toBe(`> quoted\n\n${SP}\n\nProse.`)
-    const table = '| a | b |\n| --- | --- |\n| 1 | 2 |'
-    expect(addParagraphSpacers(`Prose.\n\n${table}`)).toBe(`Prose.\n\n${SP}\n\n${table}`)
-    expect(addParagraphSpacers(`${table}\n\nProse.`)).toBe(`${table}\n\n${SP}\n\nProse.`)
+  test('list→paragraph transition is a single `\\n\\n` boundary', () => {
+    expect(normalizeParagraphBreaks('- one\n- two\n\nOutro.')).toBe('- one\n- two\n\nOutro.')
   })
 
-  test('does NOT space between items of the same loose list', () => {
-    const input = '- one\n\n- two\n\n- three'
-    expect(addParagraphSpacers(input)).toBe(input)
+  test('heading→anything is a single `\\n\\n` boundary', () => {
+    expect(normalizeParagraphBreaks('# Title\n\nBody.')).toBe('# Title\n\nBody.')
+    expect(normalizeParagraphBreaks('# Title\n\n- a\n- b')).toBe('# Title\n\n- a\n- b')
   })
 
-  test('does NOT space inside a tight list or table interior (single \\n)', () => {
-    const list = 'Intro.\n\n- a\n- b\n- c'
-    expect(addParagraphSpacers(list)).toBe(`Intro.\n\n${SP}\n\n- a\n- b\n- c`)
-    const table = '| a |\n| --- |\n| 1 |\n| 2 |'
-    expect(addParagraphSpacers(table)).toBe(table)
-  })
-
-  test('idempotent across every transition kind', () => {
-    const input = '# H\n\nProse one.\n\n- a\n- b\n\nProse two.\n\n> quote'
-    const once = addParagraphSpacers(input)
-    expect(addParagraphSpacers(once)).toBe(once)
+  test('blockquote and table boundaries are single `\\n\\n`', () => {
+    expect(normalizeParagraphBreaks('> quoted\n\nProse.')).toBe('> quoted\n\nProse.')
+    const table = '| a | b |\n| --- | --- |\n| 1 | 2 |'
+    expect(normalizeParagraphBreaks(`Prose.\n\n${table}`)).toBe(`Prose.\n\n${table}`)
+    expect(normalizeParagraphBreaks(`${table}\n\nProse.`)).toBe(`${table}\n\nProse.`)
   })
 
   test('never touches code fences', () => {
     const input = '```\nA\n\nB\n```\n\n```\nC\n```'
-    expect(addParagraphSpacers(input)).toBe(input)
+    expect(normalizeParagraphBreaks(input)).toBe(input)
   })
 
-  test('full pipeline: mixed prose+list+heading message gets uniform gaps', () => {
-    const raw = 'Summary line.\n- item one\n- item two\nClosing prose.'
-    const out = addParagraphSpacers(normalizeParagraphBreaks(raw))
-    // Every block transition carries exactly one visible spacer line.
-    expect(out).toBe(
-      `Summary line.\n\n${SP}\n\n- item one\n- item two\n\n${SP}\n\nClosing prose.`,
-    )
+  test('full pipeline: mixed prose+list message gets single-blank-line gaps, no NBSP, no double gap', () => {
+    const raw = 'Summary line.\n\n- item one\n- item two\n\nClosing prose.'
+    const out = normalizeParagraphBreaks(raw)
+    expect(out).toBe('Summary line.\n\n- item one\n- item two\n\nClosing prose.')
+    expect(out).not.toContain(NBSP)
+    expect(out).not.toMatch(/\n\n\n/)
   })
 
-  test('chunk-boundary interaction: a cut in a spacer gap strips the spacer', () => {
+  test('chunk-boundary interaction: a cut in a `\\n\\n` gap leaves clean chunks (no stray blank lines)', () => {
     const a = 'A'.repeat(60)
     const b = 'B'.repeat(60)
-    const text = `${a}\n\n${SP}\n\n${b}`
+    const text = `${a}\n\n${b}`
     const chunks = splitMarkdownChunks(text, 80)
     expect(chunks.length).toBe(2)
     expect(chunks[0]).toBe(a)
     expect(chunks[1]).toBe(b)
+    // Neither chunk opens or ends with a stray blank line.
+    for (const c of chunks) {
+      expect(c).toBe(c.replace(/^\n+|\n+$/g, ''))
+    }
   })
 })
 
@@ -210,6 +194,37 @@ describe('normalizePunctuation', () => {
     expect(normalizePunctuation(input)).toBe(input)
   })
 
+  test('does NOT rewrite a dash inside a markdown link href (#finding-2)', () => {
+    // An en-dash in a URL path must survive verbatim — rewriting it to `-`
+    // silently points at a different URL.
+    expect(normalizePunctuation('[a](https://x.com/foo–bar)')).toBe(
+      '[a](https://x.com/foo–bar)',
+    )
+    // An em-dash in a URL must NOT become `, ` — the injected space would
+    // TERMINATE the markdown link and leak the trailing text as prose.
+    expect(normalizePunctuation('[a](https://x.com/foo—bar)')).toBe(
+      '[a](https://x.com/foo—bar)',
+    )
+    // The visible LABEL still normalizes (dashes in label text are prose).
+    expect(normalizePunctuation('[foo—bar](https://x.com/path)')).toBe(
+      '[foo, bar](https://x.com/path)',
+    )
+  })
+
+  test('does NOT rewrite a dash inside a `<scheme:…>` autolink (#finding-2 sibling)', () => {
+    // An en-dash in an angle-bracket autolink URL must survive verbatim.
+    expect(normalizePunctuation('<https://x.com/foo–bar>')).toBe('<https://x.com/foo–bar>')
+    // An em-dash in an autolink must NOT become `, `.
+    expect(normalizePunctuation('<https://x.com/foo—bar>')).toBe('<https://x.com/foo—bar>')
+    // Autolink mid-prose: the surrounding prose still normalizes, the URL does not.
+    expect(normalizePunctuation('see <https://x.com/a–b> now — go')).toBe(
+      'see <https://x.com/a–b> now, go',
+    )
+    // Arbitrary `<…>` prose (no scheme) is NOT treated as an autolink: a dash
+    // inside it still normalizes like ordinary text.
+    expect(normalizePunctuation('<not—a—url>')).toBe('<not, a, url>')
+  })
+
   test('idempotent', () => {
     const once = normalizePunctuation('a — b\n• c\nd—e\n1–2')
     expect(normalizePunctuation(once)).toBe(once)

package/telegram-plugin/tests/formatting-parse-regression.test.ts

@@ -17,9 +17,10 @@
  *       fixture intended (bold/italic/code/pre/link at the right inner text).
  *
  * The pipeline mirrors `telegram-plugin/gateway/gateway.ts`:
- *   repairEscapedWhitespace -> normalizeParagraphBreaks -> addParagraphSpacers
- *   -> splitMarkdownChunks. (Card-surface fixtures also apply `normalizeDashes`
- *   first — that is where F1's voice scrub lives.)
+ *   repairEscapedWhitespace -> normalizeParagraphBreaks -> splitMarkdownChunks.
+ *   (No paragraph-spacer pass — the NBSP spacer was removed in the #2669
+ *   follow-up; gaps are plain `\n\n`. Card-surface fixtures also apply
+ *   `normalizeDashes` first — that is where F1's voice scrub lives.)
  *
  * This suite is TEST-ONLY. It changes no production formatting behaviour. If a
  * fixture ever fails signal (a), it means the formatter emits markdown Telegram
@@ -30,7 +31,6 @@ import { describe, test, expect } from 'vitest'
 import {
   repairEscapedWhitespace,
   normalizeParagraphBreaks,
-  addParagraphSpacers,
   splitMarkdownChunks,
   RICH_MESSAGE_MAX_CHARS,
 } from '../format.js'
@@ -57,8 +57,7 @@ function transform(input: string, opts: { cardSurfaceScrub?: boolean; cap?: numb
 } {
   let text = input
   if (opts.cardSurfaceScrub) text = normalizeDashes(text)
-  text = normalizeParagraphBreaks(repairEscapedWhitespace(text))
-  const body = addParagraphSpacers(text)
+  const body = normalizeParagraphBreaks(repairEscapedWhitespace(text))
   const chunks = splitMarkdownChunks(body, opts.cap ?? RICH_MESSAGE_MAX_CHARS)
   return { chunks, body }
 }

package/telegram-plugin/tests/formatting-torture-set.ts

@@ -7,7 +7,7 @@
  * The `input` is the raw text as a model/card surface would author it — the
  * regression test runs it through the SAME outbound transform pipeline the
  * gateway uses (repairEscapedWhitespace -> normalizeParagraphBreaks ->
- * addParagraphSpacers -> splitMarkdownChunks) and then asserts:
+ * splitMarkdownChunks) and then asserts:
  *
  *   (a) every emitted chunk is parse-accept valid (no rich-path 400), and
  *   (b) the concatenated output parses into `expect` (entity structure).

package/telegram-plugin/tests/gateway-outbound-redact.test.ts

@@ -134,6 +134,32 @@ describe('gateway outbound secret-scrub — structural wiring', () => {
     expect(streamIdx).toBeGreaterThan(redactIdx) // mask BEFORE the stream
   })
 
+  it('operator_event: scrubs event.detail at the top of emitGatewayOperatorEvent, BEFORE render/send', () => {
+    // #llm-error-surfacing FIX 2 — operator-event cards are sent via a raw
+    // bot.api.sendRichMessage that BYPASSES the normal outbound chokepoint, so a
+    // secret in an error `detail` (credentials-expired / credit-exhausted /
+    // unknown-4xx) could reach the card verbatim. The detail is redacted ONCE at
+    // the top of the function, through the shared redactOutboundText, and MUST
+    // run before the renderers escapeMarkdown it (redacting the already-escaped
+    // text lets url-query-param secrets slip past url-redact) and before the
+    // send. This is the sole regression guard for that wiring line — deleting it
+    // must turn this red.
+    const start = src.indexOf('function emitGatewayOperatorEvent(')
+    const redactIdx = src.indexOf(
+      `event = { ...event, detail: redactOutboundText(event.detail, 'operator_event') }`,
+      start,
+    )
+    // The two render surfaces + the wire send this must precede.
+    const renderOpIdx = src.indexOf('renderOperatorEvent(event)', start)
+    const renderLlmIdx = src.indexOf('renderLlmErrorSafe(parsed', start)
+    const sendIdx = src.indexOf('bot.api.sendRichMessage(chat_id, richMessage(renderedText)', start)
+    expect(start).toBeGreaterThan(0)
+    expect(redactIdx).toBeGreaterThan(start)
+    expect(renderOpIdx).toBeGreaterThan(redactIdx) // mask BEFORE the escapeMarkdown render
+    expect(renderLlmIdx).toBeGreaterThan(redactIdx) // mask BEFORE the humanized render
+    expect(sendIdx).toBeGreaterThan(redactIdx) // mask BEFORE the card hits the wire
+  })
+
   it('does not log the secret value when a mask fires', () => {
     const idx = src.indexOf('function redactOutboundText(')
     const body = src.slice(idx, idx + 400)

package/telegram-plugin/tests/llm-error-present.test.ts

@@ -14,6 +14,7 @@ import { describe, it, expect, beforeEach } from 'vitest'
 import {
   parseLlmError,
   renderLlmError,
+  renderLlmErrorSafe,
   stripRawErrorBytes,
   extractRequestId,
   formatResetLocal,
@@ -27,6 +28,7 @@ import {
 import { truncateDetailPreservingRequestId } from '../raw-error-scrub.js'
 import { projectTranscriptLine, detectErrorInTranscriptLine } from '../session-tail.js'
 import { renderOperatorEvent, type OperatorEvent } from '../operator-events.js'
+import { redact } from '../secret-detect/redact.js'
 
 // A raw byte-blob every surface must scrub.
 const RAW_BYTES = `b'{"type":"error","error":{"type":"rate_limit_error","message":"rate limit"},"request_id":"req_abc123"}'`
@@ -161,16 +163,115 @@ describe('renderLlmError / formatResetLocal — local-time rendering', () => {
     expect(text).toContain('AEST')
   })
 
-  it('auth + quota_wall cards carry action buttons', () => {
+  // FIX 1 (Ken, CPO, 2026-07): the dead auth/quota action buttons are GONE —
+  // renderLlmError never returns an inline_keyboard; the actionable classes
+  // carry a plain-text recommendation line instead.
+  it('auth card recommends re-authentication in text, with NO action buttons', () => {
     const auth = renderLlmError(parseLlmError('authentication_error: token expired'), 'a', tz, now)
-    expect(auth.keyboard?.inline_keyboard.flat().some((b) => b.callback_data?.includes('reauth'))).toBe(true)
-    const quota = renderLlmError(
-      parseLlmError("You've hit your limit · resets 5pm"),
-      'a',
-      tz,
-      now,
-    )
-    expect(quota.keyboard?.inline_keyboard.flat().length).toBeGreaterThan(0)
+    expect((auth as { keyboard?: unknown }).keyboard).toBeUndefined()
+    expect(auth.text.toLowerCase()).toContain('re-authenticate')
+  })
+
+  it('quota_wall card recommends switch/wait in text (naming the reset), NO buttons', () => {
+    const quota = renderLlmError(parseLlmError("You've hit your limit · resets 5pm"), 'a', tz, now)
+    expect((quota as { keyboard?: unknown }).keyboard).toBeUndefined()
+    const lower = quota.text.toLowerCase()
+    expect(lower).toContain('switch to another account')
+    expect(lower).toContain('wait for the quota to reset')
+    // The reset instant is named in the recommendation line.
+    expect(quota.text).toContain('AEST')
+  })
+
+  it('transient (rate_limit) card has neither buttons nor an action recommendation', () => {
+    const rl = renderLlmError(parseLlmError('rate_limit_error: slow down'), 'a', tz, now)
+    expect((rl as { keyboard?: unknown }).keyboard).toBeUndefined()
+    expect(rl.text.toLowerCase()).not.toContain('re-authenticate')
+    expect(rl.text).not.toContain('→')
+  })
+
+  // FIX 3 (crash guard): an invalid IANA timezone throws a RangeError out of the
+  // raw renderer (local-time.ts's "never throws" claim is false for tz
+  // construction). renderLlmErrorSafe MUST swallow it and degrade — asserting the
+  // OUTCOME (no throw + a usable message), not just that the branch ran.
+  it('renderLlmError DOES throw on an invalid tz with a reset present (documents the hazard)', () => {
+    const parsed = parseLlmError("You've hit your limit · resets 5pm")
+    expect(parsed.resetAt).toBeDefined()
+    expect(() => renderLlmError(parsed, 'gymbro', 'Not/AZone', now)).toThrow()
+  })
+
+  it('renderLlmErrorSafe does NOT throw on an invalid tz and returns a usable line', () => {
+    const parsed = parseLlmError("You've hit your limit · resets 5pm")
+    let out: { text: string } | undefined
+    expect(() => {
+      out = renderLlmErrorSafe(parsed, 'gymbro', 'Not/AZone', now)
+    }).not.toThrow()
+    expect(out?.text).toContain('gymbro')
+    assertNoRawBytes(out!.text)
+  })
+})
+
+// ─── FIX 2: operator-card text is scrubbed by the REAL redactor ───────────────
+//
+// The gateway sends operator-event cards via a raw bot.api call that bypasses
+// the normal outbound redact chokepoint; it now routes the rendered text through
+// the same redact() the reply path uses. These tests assert the OUTCOME: a
+// synthetic bearer token / sk- key / url-embedded credential planted in an error
+// detail does NOT survive into the redacted card text. stripRawErrorBytes alone
+// (a JSON-shape scrub) does NOT catch these — redact() is required.
+describe('operator-card secret redaction (FIX 2)', () => {
+  const now = new Date('2026-07-13T06:14:00Z')
+  // Runtime-assembled so no contiguous Anthropic-token literal lands in source
+  // (check-no-pii-secrets discipline). Resolves to a real sk-ant-shaped key that
+  // redact()'s anthropic_api_key pattern masks.
+  const BEARER = ['sk', 'ant', 'api03-ABCDEF1234567890abcdefGHIJKLMN'].join('-')
+  const URL_SECRET = 'https://user:hunter2pass@api.anthropic.com/v1/x?api_key=abc123secretval456'
+
+  const mkEvent = (kind: OperatorEvent['kind'], detail: string): OperatorEvent => ({
+    agent: 'gymbro',
+    kind,
+    detail,
+    suggestedActions: [],
+    firstSeenAt: now,
+  })
+
+  // Mirrors emitGatewayOperatorEvent's transform: redact the DETAIL first (via
+  // the real redact()), THEN render — so the scrub happens BEFORE the renderer's
+  // escapeMarkdown, exactly as production now does. Redacting the already-escaped
+  // final text would let url-query-param secrets (`api_key=…`) slip past.
+  const renderCardAsSent = (ev: OperatorEvent): string =>
+    renderOperatorEvent({ ...ev, detail: redact(ev.detail) }).text
+
+  it('stripRawErrorBytes alone LEAKS a bearer/api-key (proves redact is needed)', () => {
+    // Guard test: the shape-scrub inside the renderer is JSON-shape-only. If this
+    // ever stops leaking, the shape-scrub grew secret awareness.
+    expect(stripRawErrorBytes(`auth failed: Bearer ${BEARER}`)).toContain(BEARER)
+  })
+
+  it('pre-fix render (no redact) LEAKS the bearer; the production transform scrubs it', () => {
+    const ev = mkEvent('credentials-expired', `token rejected: Bearer ${BEARER}`)
+    // Renderer alone (pre-fix path): secret survives.
+    expect(renderOperatorEvent(ev).text).toContain(BEARER)
+    // Production transform (redact detail → render): secret is gone.
+    expect(renderCardAsSent(ev)).not.toContain(BEARER)
+  })
+
+  it('masks a url-embedded credential in a credit-exhausted card', () => {
+    const ev = mkEvent('credit-exhausted', `billing check: ${URL_SECRET}`)
+    const sent = renderCardAsSent(ev)
+    expect(sent).not.toContain('hunter2pass')
+    expect(sent).not.toContain('abc123secretval456')
+  })
+
+  it('masks a bearer key in an unknown-4xx card', () => {
+    const ev = mkEvent('unknown-4xx', `API Error: 400 · x-api-key ${BEARER}`)
+    expect(renderCardAsSent(ev)).not.toContain(BEARER)
+  })
+
+  it('the humanized (renderLlmError) card never relays raw detail — no secret to leak', () => {
+    // The humanized card's coreText is a per-kind TEMPLATE, never the raw detail,
+    // so a secret in the detail cannot reach it even before redaction.
+    const parsed = parseLlmError(`rate_limit_error · Bearer ${BEARER}`)
+    expect(renderLlmError(parsed, 'gymbro', 'Australia/Melbourne', now).text).not.toContain(BEARER)
   })
 })
 

package/telegram-plugin/tests/outbound-send-path.test.ts

@@ -4,7 +4,6 @@ import {
   normalizeParagraphBreaks,
   normalizePunctuation,
   stripExcessBold,
-  addParagraphSpacers,
   splitMarkdownChunks,
   hardSliceToCap,
   RICH_MESSAGE_MAX_CHARS,
@@ -55,8 +54,10 @@ function referenceNormalize(rawText: string): { text: string; voiceReplaced: num
   return { text, voiceReplaced }
 }
 
-function referenceEffectiveText(text: string, literalText: boolean): string {
-  return literalText ? text : addParagraphSpacers(text)
+function referenceEffectiveText(text: string, _literalText: boolean): string {
+  // The NBSP paragraph-spacer pass was removed in the #2669 follow-up; both
+  // paths now pass the normalized text through unchanged.
+  return text
 }
 
 function referenceChunks(