switchroom 0.18.20 → 0.18.22

package/telegram-plugin/tests/worker-activity-feed.test.ts

@@ -1513,7 +1513,7 @@ describe('worker-feed send-gate shed contract', () => {
     expect(bot.edits[0].text).toContain('2 tools')
   })
 
-  it('does not falsely finalize on a shed terminal edit — re-drives the finalize once the gate clears', async () => {
+  it('a shed terminal edit drops the finished row immediately but stages the recap for a heartbeat re-drive (#3207)', async () => {
     let clock = 10_000
     const bot = makeGateBot(() => 0)
     const feed = createWorkerActivityFeed({
@@ -1522,25 +1522,30 @@ describe('worker-feed send-gate shed contract', () => {
       firstPaintMinMs: 0,
       minEditIntervalMs: 0,
       floodWaitRemainingMs: () => 0,
+      setInterval: () => 1,
+      clearInterval: () => {},
     })
 
     await feed.update('w1', 'chat', view({ toolCount: 1 }))
     expect(bot.sent).toHaveLength(1)
 
-    // Gate sheds the terminal edit (undefined).
+    // Gate sheds the terminal edit (SEND_GATE_SHED sentinel).
     clock = 20_000
     bot.shedNextEdit = true
     await feed.finish('w1', view({ state: 'done', toolCount: 5 }))
     expect(bot.editCalls).toBe(1)
     expect(bot.edits).toHaveLength(0)
-    // NOT finalized: the handle survives (pendingFinish staged) rather than
-    // being torn down with the card frozen on its last running render.
-    expect(feed.has('w1')).toBe(true)
+    // #3207: the finished row is dropped RIGHT AWAY — it is NOT kept alive to
+    // leak the group/pin when the terminal edit fails. The recap is staged for
+    // the heartbeat re-drive instead (a second finish() would be a no-op: the
+    // agent is already finalized + removed).
+    expect(feed.has('w1')).toBe(false)
+    expect(feed.size).toBe(0)
 
-    // Re-drive with the gate clear: the terminal recap lands and the handle
-    // finalizes.
+    // A heartbeat with the gate clear re-drives the staged recap → it lands.
     clock = 30_000
-    await feed.finish('w1', view({ state: 'done', toolCount: 5 }))
+    feed.heartbeatTick()
+    await new Promise((r) => setTimeout(r, 0))
     expect(bot.edits).toHaveLength(1)
     expect(bot.edits[0].text).toContain('_done · 5 tools')
     expect(feed.has('w1')).toBe(false)

package/telegram-plugin/tests/worker-feed-coalesce.test.ts

@@ -443,6 +443,202 @@ describe('coalesced worker feed — GROUP-level pin lifecycle (#3207 review)', (
   })
 })
 
+// ─── #3207 leaked-finished-row fix ────────────────────────────────────────────
+//
+// Root cause of the "progress card never unpins; later workers append to a
+// stale pinned message" incident (a card observed pinned + edited for 2h12m):
+// a finished worker row whose terminal edit hit a 429/flood window was left in
+// `g.workers`, so the group never emptied → never deleted → never unpinned, and
+// a later worker inherited the stale message. These outcome tests pin the fix:
+// group emptiness / deletion / unpin are decoupled from terminal-edit success,
+// the finalize staging is per-agent (no single-slot overwrite), and a later
+// worker never reuses a terminated group's message.
+
+describe('coalesced worker feed — leaked finished-row fix (#3207)', () => {
+  interface PinCall {
+    feedKey: string
+    chatId: string
+    messageId: number | null
+  }
+  function leakHarness(opts: { failEdits?: () => unknown } = {}) {
+    const pins: PinCall[] = []
+    const sent: { chatId: string; text: string; messageId: number }[] = []
+    const edits: { messageId: number; text: string }[] = []
+    let seq = 700
+    let clock = 0
+    const bot: BotApiForWorkerFeed = {
+      sendMessage: async (chatId, text) => {
+        const messageId = seq++
+        sent.push({ chatId, text, messageId })
+        return { message_id: messageId }
+      },
+      editMessageText: async (_chatId, messageId, text) => {
+        const err = opts.failEdits?.()
+        if (err != null) throw err
+        edits.push({ messageId, text })
+        return true
+      },
+    }
+    const feed = createWorkerActivityFeed({
+      bot,
+      now: () => clock,
+      minEditIntervalMs: 0,
+      firstPaintMinMs: 0,
+      heartbeatTickMs: 6000,
+      setInterval: () => 0,
+      clearInterval: () => {},
+      reconcilePin: ({ feedKey, chatId, messageId }) => pins.push({ feedKey, chatId, messageId }),
+    })
+    return { feed, pins, sent, edits, setClock: (t: number) => (clock = t) }
+  }
+  const done = (desc: string, elapsedMs: number): WorkerActivityView => ({
+    description: desc,
+    lastTool: null,
+    toolCount: 3,
+    latestSummary: `${desc} result`,
+    elapsedMs,
+    state: 'done',
+  })
+  const drain = () => new Promise((r) => setTimeout(r, 0))
+
+  it('drops the finished row + requests unpin even when the last terminal edit floods (429)', async () => {
+    let flooding = true
+    const { feed, pins, sent, edits, setClock } = leakHarness({
+      failEdits: () => (flooding ? { error_code: 429, parameters: { retry_after: 2 } } : null),
+    })
+    setClock(1000)
+    await feed.update('w1', 'chat', view('task 1', 'doing', 1000))
+    expect(sent).toHaveLength(1)
+    const feedKey = pins[pins.length - 1].feedKey
+
+    // The LAST worker finishes but the terminal recap edit 429s.
+    setClock(2000)
+    await feed.finish('w1', done('task 1', 2000))
+    await drain()
+
+    // Outcome: the finished row is gone and the pin is RELEASED immediately —
+    // neither is blocked by the failed terminal edit.
+    expect(feed.has('w1')).toBe(false)
+    expect(feed.size).toBe(0)
+    // Pin-reaper backstop: no running rows remain → the group is not "running".
+    expect(feed.hasRunningInFeed(feedKey)).toBe(false)
+    expect(pins[pins.length - 1].messageId).toBeNull()
+    // The terminal recap has NOT landed yet (still flooding) — proves the unpin
+    // did not wait on it.
+    expect(edits.some((e) => e.text.includes('_done ·'))).toBe(false)
+
+    // Flood clears; a heartbeat past the cooldown re-drives the staged recap.
+    flooding = false
+    setClock(5000)
+    feed.heartbeatTick()
+    await drain()
+    expect(edits.some((e) => e.text.includes('_done ·'))).toBe(true)
+
+    // The group is fully reaped: a later worker in the SAME chat paints a FRESH
+    // message — it does NOT reuse/edit the terminated group's message id.
+    setClock(6000)
+    await feed.update('w2', 'chat', view('task 2', 'doing2', 6000))
+    await drain()
+    expect(sent).toHaveLength(2)
+    expect(feed.messageIdOf('w2')).toBe(sent[1].messageId)
+    expect(feed.messageIdOf('w2')).not.toBe(sent[0].messageId)
+  })
+
+  it('TWO workers finishing in the same flood window are BOTH reaped (no single-slot overwrite)', async () => {
+    let flooding = true
+    const { feed, pins, sent, edits, setClock } = leakHarness({
+      failEdits: () => (flooding ? { error_code: 429, parameters: { retry_after: 2 } } : null),
+    })
+    setClock(1000)
+    await feed.update('a', 'chat', view('task A', 'a-doing', 1000))
+    await feed.update('b', 'chat', view('task B', 'b-doing', 1000))
+    expect(feed.size).toBe(2)
+    const feedKey = pins[pins.length - 1].feedKey
+
+    // Both finish before either finalize chain drains, so both latch terminal in
+    // the SAME cooldown window. The old single `pendingFinalize` slot dropped all
+    // but one → the other row leaked forever. The per-agent map keeps both.
+    setClock(2000)
+    const f1 = feed.finish('a', done('task A', 2000))
+    const f2 = feed.finish('b', done('task B', 2000))
+    await Promise.all([f1, f2])
+    await drain()
+
+    // NEITHER finished row leaks — the group is empty and unpinned.
+    expect(feed.size).toBe(0)
+    expect(feed.hasRunningInFeed(feedKey)).toBe(false)
+    expect(pins[pins.length - 1].messageId).toBeNull()
+
+    // Flood clears; one heartbeat drains ALL staged recaps and reaps the group.
+    flooding = false
+    setClock(5000)
+    feed.heartbeatTick()
+    await drain()
+
+    // BOTH staged terminal recaps must actually repaint — not just one. This is
+    // the contract the per-agent `pendingFinalize` map exists to hold: a single-
+    // slot `pendingFinalize` would have let worker B's stage overwrite worker A's,
+    // so only ONE recap edit would land and this assertion would FAIL. The
+    // decoupled row-removal (fix 1) alone would pass size===0 + unpin above WITHOUT
+    // repainting either recap, so those assertions do not pin this contract — these
+    // do. Each recap carries its own worker's description ('task A' / 'task B').
+    const doneEdits = edits.filter((e) => e.text.includes('_done ·'))
+    expect(doneEdits.some((e) => e.text.includes('task A'))).toBe(true)
+    expect(doneEdits.some((e) => e.text.includes('task B'))).toBe(true)
+
+    // The group is gone: a later worker paints a FRESH message, never editing a
+    // terminated sibling's message.
+    setClock(6000)
+    await feed.update('c', 'chat', view('task C', 'c-doing', 6000))
+    await drain()
+    const firstMsgId = sent[0].messageId
+    expect(feed.messageIdOf('c')).toBe(sent[sent.length - 1].messageId)
+    expect(feed.messageIdOf('c')).not.toBe(firstMsgId)
+  })
+
+  it('a later worker after all prior workers finished does NOT reuse the prior message id', async () => {
+    const { feed, sent, setClock } = leakHarness()
+    setClock(1000)
+    await feed.update('w1', 'chat', view('task 1', 'doing', 1000))
+    setClock(2000)
+    await feed.finish('w1', done('task 1', 2000))
+    await drain()
+    expect(feed.size).toBe(0)
+
+    // A brand-new worker in the same chat gets its OWN fresh message.
+    setClock(3000)
+    await feed.update('w2', 'chat', view('task 2', 'doing2', 3000))
+    await drain()
+    expect(sent).toHaveLength(2)
+    expect(feed.messageIdOf('w2')).toBe(sent[1].messageId)
+    expect(feed.messageIdOf('w2')).not.toBe(sent[0].messageId)
+  })
+
+  it('hasRunningInFeed is false once only finished rows remain (pin-reaper backstop fires)', async () => {
+    // A sibling keeps the group running; when the LAST running worker finishes,
+    // no running row remains → hasRunningInFeed flips to false so the gateway's
+    // wk:group: reaper is free to unpin (finished rows never count as running).
+    const { feed, pins, setClock } = leakHarness()
+    setClock(1000)
+    await feed.update('a', 'chat', view('task A', 'a-doing', 1000))
+    await feed.update('b', 'chat', view('task B', 'b-doing', 1000))
+    const feedKey = pins[pins.length - 1].feedKey
+    expect(feed.hasRunningInFeed(feedKey)).toBe(true)
+
+    setClock(2000)
+    await feed.finish('a', done('task A', 2000))
+    await drain()
+    // One still runs → still counts.
+    expect(feed.hasRunningInFeed(feedKey)).toBe(true)
+
+    setClock(3000)
+    await feed.finish('b', done('task B', 3000))
+    await drain()
+    // Only finished work remains → NOT running.
+    expect(feed.hasRunningInFeed(feedKey)).toBe(false)
+  })
+})
+
 describe('renderCombinedWorkerFeed (pure)', () => {
   const row = (i: number, step: string) => ({
     description: `task number ${i}`,

package/telegram-plugin/tests/worker-feed-terminal-state-truthful.test.ts

@@ -87,6 +87,46 @@ describe('worker terminal state is truthful for reaped workers (Residual B)', ()
     expect(last).not.toContain('incomplete')
   })
 
+  // #3233 terminal-window race: the skeleton first-paint cue fires on EVERY
+  // no-growth poll, so one can land on a row that `finish()` just finalized
+  // (watcher poll cadence ≈ seconds). The `finalized` latch must absorb it —
+  // a late skeleton `update()` must NOT resurrect a fresh `running` card on an
+  // already-done worker. This exercises that path with a skeleton-shaped cue
+  // (empty step line, running state) arriving after finish.
+  it('a late skeleton update() after finish() is absorbed by the finalized latch (no resurrection)', async () => {
+    let clock = 1000
+    const { feed, edits } = makeFeed(() => clock)
+    await feed.update('w', 'chat', runningView('background job', 'doing work', 1000))
+    await drain()
+    clock = 2000
+    await feed.finish('w', {
+      description: 'background job',
+      lastTool: null,
+      toolCount: 5,
+      latestSummary: 'the delivered result paragraph',
+      elapsedMs: 2000,
+      state: 'done',
+    })
+    await drain()
+    const editsAfterFinish = edits.length
+    // Late skeleton cue (empty latestSummary, running state) — the shape the
+    // watcher emits on a no-growth poll — lands AFTER finalization.
+    clock = 2500
+    await feed.update('w', 'chat', {
+      description: 'background job',
+      lastTool: null,
+      toolCount: 5,
+      latestSummary: '',
+      elapsedMs: 2500,
+      state: 'running',
+    })
+    await drain()
+    // No further edit, no resurrection: the terminal card stays `done`.
+    expect(edits.length).toBe(editsAfterFinish)
+    expect(edits[edits.length - 1].text).toContain('done')
+    expect(feed.has('w')).toBe(false)
+  })
+
   it('renderWorkerActivity renders the `incomplete` state as a finished card without a fabricated result', () => {
     const card = renderWorkerActivity({
       description: 'background job',

package/telegram-plugin/turn-flush-safety.ts

@@ -128,6 +128,75 @@ export function endsWithSilentMarker(text: string | undefined): boolean {
   return isSilentFlushMarker(lines[lines.length - 1])
 }
 
+/**
+ * Substantive-answer floor (chars, trimmed). Mirrors
+ * `final-answer-detect.ts` `FINAL_ANSWER_MIN_CHARS` and
+ * `hooks/silent-end-scan.mjs` — the same bar the codebase uses everywhere to
+ * recognise "this text block is a real answer, not a short narration/closer".
+ */
+export const FLUSH_SUBSTANTIVE_MIN_CHARS = 200
+
+/**
+ * Pick the text a turn-flush should actually DELIVER from the captured
+ * assistant blocks.
+ *
+ * The duplicate-reply bug (2026-07) had the answer-ready flush fire while the
+ * model was still composing its `reply` tool call: `capturedText` at that
+ * moment holds intent-narration blocks ("Let me check X", "I'll now …") FOLLOWED
+ * by the composed answer block. Flushing `capturedText.join('\n\n')` dumped the
+ * whole narration+answer blob into chat — which then never matched the clean
+ * answer-only `reply` on the outbound dedup (containment, not equality), so the
+ * user got a narration-laden duplicate.
+ *
+ * The answer is the TERMINAL block — the last thing the model wrote is what it
+ * settled on, REGARDLESS of length. A real dropped answer is often short
+ * (a one-line confirmation, a two-sentence reply), so gating delivery on the
+ * 200-char substantive floor was wrong: with blocks
+ * `[verboseNarration(250), realAnswer(150)]` a reversed length scan returns the
+ * 250-char narration and DROPS the 150-char real answer. Instead we take the
+ * last non-empty block as the answer and strip only the EARLIER blocks — and
+ * only when they look like intent-narration (short, or the classic "Let me…" /
+ * "I'll…" openers). If the earlier blocks are themselves substantial (a genuine
+ * multi-paragraph answer written as several blocks) we keep the whole thing
+ * joined, so we never truncate a real long answer down to its last paragraph.
+ *
+ * `blocks` are already trimmed/non-empty candidates (silent markers removed by
+ * the caller's guards). Returns the chosen delivery text.
+ */
+export function selectFlushDeliveryText(blocks: string[]): string {
+  const candidates = blocks
+    .map(b => b.trim())
+    .filter(b => b.length > 0)
+  if (candidates.length === 0) return ''
+  if (candidates.length === 1) return candidates[0]
+  const answer = candidates[candidates.length - 1]
+  const preceding = candidates.slice(0, -1)
+  // Deliver only the terminal answer when every earlier block is
+  // intent-narration (a short block, or a "Let me…/I'll…/I'm going to…" opener).
+  // Otherwise the earlier blocks carry real content — keep the full joined text
+  // so a legitimate multi-block answer is never truncated to its last paragraph.
+  const allNarration = preceding.every(isNarrationBlock)
+  return allNarration ? answer : candidates.join('\n\n')
+}
+
+/**
+ * Narration heuristic: a block that opens with a first-person "about to do X"
+ * phrase the model emits BEFORE composing its real answer ("Let me check…",
+ * "I'll look it up…", "Now let me…"). Deliberately NOT length-based — the
+ * narration that shadowed the real answer in the observed bug was a LONG
+ * (≥200-char) "Let me pull the numbers…" block, and short blocks are frequently
+ * legitimate multi-paragraph answer content — so gating on length either drops a
+ * short real answer or keeps a long narration. When earlier blocks don't match
+ * this opener we keep the full joined text (never drop content we can't
+ * confidently attribute to narration).
+ */
+const NARRATION_OPENER =
+  /^(let me\b|lemme\b|i'?ll\b|i will\b|i am going to\b|i'?m going to\b|i'?m about to\b|going to\b|first,?\s+(?:let me|i'?ll|i will)\b|now,?\s+(?:let me|i'?ll|i will)\b|next,?\s+(?:let me|i'?ll|i will)\b|let'?s\b)/i
+
+function isNarrationBlock(block: string): boolean {
+  return NARRATION_OPENER.test(block.trimStart())
+}
+
 export type FlushDecision =
   | { kind: 'flush'; text: string }
   | { kind: 'skip'; reason: FlushSkipReason }
@@ -219,7 +288,11 @@ export function decideTurnFlush(input: FlushDecisionInput): FlushDecision {
   // sentinel — treat the whole turn as intentionally silent rather than
   // flush the prose with the sentinel glued on.
   if (endsWithSilentMarker(joined)) return { kind: 'skip', reason: 'silent-marker' }
-  return { kind: 'flush', text: joined }
+  // Deliver only the substantive answer block, never the whole narration+answer
+  // blob (see `selectFlushDeliveryText`). The silent-marker / empty guards above
+  // still run on the full `joined` string so a partly-silent turn is classified
+  // correctly; only the DELIVERED text is narrowed to the answer.
+  return { kind: 'flush', text: selectFlushDeliveryText(input.capturedText) }
 }
 
 /**