switchroom 0.18.25 → 0.18.26

package/telegram-plugin/rich-send.ts

@@ -18,15 +18,61 @@
  */
 
 import { GrammyError } from 'grammy'
+import { guardDollarMath } from './render/dollar-math-guard.js'
+import { guardAccidentalEmphasis } from './render/emphasis-guard.js'
+import { guardAccidentalBlockConstructs } from './render/line-start-guard.js'
+import { guardAccidentalInlinePairs } from './render/inline-pairs-guard.js'
 
 /** The `InputRichMessage` shape grammy 1.44 accepts on send AND edit. */
 export interface InputRichMessageMarkdown {
   markdown: string
 }
 
-/** Wrap raw GFM markdown into the rich-message input object. */
+/**
+ * Neutralise ALL accidental Telegram markdown typesetting in one composed pass
+ * (#3252). Each sub-guard targets a DISJOINT set of trigger characters, skips
+ * code spans / fenced blocks verbatim (shared `splitCodeSegments`), is a strict
+ * no-op absent a real signal, and is idempotent — so the composition is itself
+ * idempotent and safe to apply once per send.
+ *
+ * ── Ordering (deliberate, not arbitrary) ──────────────────────────────────
+ * `guardDollarMath` runs LAST. It backslash-escapes `$` → `\$`, and the
+ * inline-pairs guard's approximation-tilde signal is `~(?=\$?\.?\d)` — a `~`
+ * glued to a `$digit`. If the dollar guard ran first, a body like
+ * `~$5M and ~$10M` would become `~\$5M …`, and the interposed `\` would hide
+ * the digit-adjacent tildes from `guardAccidentalInlinePairs`, leaving the
+ * accidental `~…~` strikethrough pair un-neutralised (a false negative /
+ * residual bug). Running inline-pairs FIRST escapes the tildes (`\~$5M`), then
+ * the dollar guard escapes the `$` — both spans are killed. Every other pair of
+ * guards is disjoint in the characters it inspects AND the characters it
+ * inserts (`\_ \* \> \. \~ \=\= \|\|` vs `\$`), so no other insertion can
+ * create or destroy a signal for a sibling. Verified by composition tests.
+ */
+export function guardAccidentalFormatting(markdown: string): string {
+  let out = markdown
+  out = guardAccidentalEmphasis(out)
+  out = guardAccidentalBlockConstructs(out)
+  out = guardAccidentalInlinePairs(out)
+  out = guardDollarMath(out)
+  return out
+}
+
+/**
+ * Wrap raw GFM markdown into the rich-message input object.
+ *
+ * This is the ONE adapter every `{ markdown }` wire send funnels through
+ * (`sendRichMessage` / `editMessageText({ markdown })`) — the reply-tool final
+ * answer, draft-stream previews, cards, approvals, banners. It is therefore the
+ * single deterministic seam for the #3252 accidental-formatting guards (F1):
+ * applying `guardAccidentalFormatting` here guards EVERY markdown-parsed
+ * outbound exactly once, without touching `plain`-mode degradations (which
+ * bypass this wrapper and go straight to `sendMessage`, where no markdown
+ * parsing happens). The composed guard is a strict no-op for any body without
+ * an accidental-formatting signal and is idempotent, so callers that already
+ * ran it (or the streaming path that renders then re-wraps) stay byte-identical.
+ */
 export function richMessage(markdown: string): InputRichMessageMarkdown {
-  return { markdown }
+  return { markdown: guardAccidentalFormatting(markdown) }
 }
 
 /**

package/telegram-plugin/tests/render/dollar-math-guard.test.ts

@@ -0,0 +1,162 @@
+import { describe, it, expect } from "vitest";
+import { guardDollarMath } from "../../render/dollar-math-guard.js";
+import { richMessage } from "../../rich-send.js";
+import { computeReplyChunks } from "../../gateway/outbound-send-path.js";
+import { RICH_MESSAGE_MAX_CHARS } from "../../format.js";
+
+// Any U+1D400–U+1D7FF codepoint = a mathematical-alphanumeric (math-italic /
+// math-bold) glyph — what a math renderer produces from a `$…$` span.
+const MATH_GLYPH = /[\u{1D400}-\u{1D7FF}]/u;
+
+/** Strip zero-width chars + defusing backslashes so we can assert the amount
+ *  the reader copies is byte-identical to the original ASCII currency token.
+ *  The wire body now flows through the composed richMessage guard, so besides
+ *  the dollar defuser (`\$`) it may also carry the inline-pairs defuser (`\~`)
+ *  for approximation tildes (`~$0.5M`) — strip both so the round-trip holds. */
+function copyText(s: string): string {
+  return s.replace(/[​⁠]/g, "").replace(/\\([$~])/g, "$1");
+}
+
+describe("guardDollarMath (#3252)", () => {
+  const OFFENDING =
+    "acquisition ceiling is ~$0.5-0.9M but nearly all in small dealers ... is ~$150-450k";
+
+  it("neutralises the two-dollar-amount currency string so no `$…$` span can form", () => {
+    const out = guardDollarMath(OFFENDING);
+    // Both currency dollars are backslash-escaped → no unescaped `$` remains to
+    // open/close a math span.
+    expect(out).not.toMatch(/(?<!\\)\$/);
+    expect(out).toContain("\\$0.5-0.9M");
+    expect(out).toContain("\\$150-450k");
+  });
+
+  it("carries no math-italic glyphs (switchroom never emits U+1D400-range)", () => {
+    expect(guardDollarMath(OFFENDING)).not.toMatch(MATH_GLYPH);
+    // …nor does the raw source; the guard is what keeps the WIRE bytes clean.
+    expect(OFFENDING).not.toMatch(MATH_GLYPH);
+  });
+
+  it("preserves the visible amounts: stripping the defuser yields the original", () => {
+    expect(copyText(guardDollarMath(OFFENDING))).toBe(OFFENDING);
+  });
+
+  it("is a strict no-op for a single `$digit` prose token", () => {
+    const s = "grab a $5 coffee on the way";
+    expect(guardDollarMath(s)).toBe(s);
+  });
+
+  it("is a strict no-op when there is no `$digit` at all", () => {
+    const s = "the cost is unknown but the $ sign appears twice: $ and $";
+    expect(guardDollarMath(s)).toBe(s);
+  });
+
+  it("never touches `$` inside a code span", () => {
+    const s = "shell math `$x = $y` is fine and `$z = $w` too";
+    // Two code spans, each with 2 `$digit`? No — non-digit. Use digits to prove
+    // code is skipped even when it WOULD otherwise trigger.
+    const withDigits = "compute `$1 + $2` and also `$3 + $4` inline";
+    expect(guardDollarMath(s)).toBe(s);
+    expect(guardDollarMath(withDigits)).toBe(withDigits);
+  });
+
+  it("escapes prose dollars but leaves an adjacent code span verbatim", () => {
+    const s = "prices $10 and $20 — the var is `$PRICE = $10`";
+    const out = guardDollarMath(s);
+    // Prose amounts escaped:
+    expect(out).toContain("\\$10 and \\$20");
+    // Code span verbatim (its `$10` NOT escaped):
+    expect(out).toContain("`$PRICE = $10`");
+  });
+
+  // ── F3: widened detection (trailing `$`, `$.50`, `$ ` with a bare gap) ────
+  it("escapes a mix of leading- and trailing-`$` amounts (`$50 or 50$`)", () => {
+    const out = guardDollarMath("It costs $50 or 50$ depending on the vendor");
+    // Both dollars gone from the unescaped set → no `$…$` pair can form.
+    expect(out).not.toMatch(/(?<!\\)\$/);
+    expect(out).toContain("\\$50 or 50\\$");
+  });
+
+  it("escapes when one dollar is bare (`$10 today (down from $ yesterday)`)", () => {
+    const out = guardDollarMath("$10 today (down from $ yesterday)");
+    expect(out).not.toMatch(/(?<!\\)\$/);
+  });
+
+  it("escapes a `$.50` amount whose `$` is not digit-adjacent by one char", () => {
+    const out = guardDollarMath("$.50 here and $5 there");
+    expect(out).not.toMatch(/(?<!\\)\$/);
+    expect(out).toContain("\\$.50 here and \\$5 there");
+  });
+
+  it("leaves two non-currency `$` (shell-var prose) untouched — no false positive", () => {
+    const s = "use $foo and $bar as the two variables";
+    expect(guardDollarMath(s)).toBe(s);
+  });
+
+  // ── F5: idempotent — running the guard twice never doubles the backslash ──
+  it("is idempotent: guarding already-guarded text is a strict no-op", () => {
+    const once = guardDollarMath(OFFENDING);
+    expect(guardDollarMath(once)).toBe(once);
+    expect(once).not.toContain("\\\\$"); // never a doubled `\\$`
+  });
+});
+
+// F1/F2 regression: exercise the ACTUAL reply pipe. The `reply` tool's final
+// answer flows executeReply → computeReplyChunks → sendReplyChunks →
+// richMessage(chunk). `richMessage` is the single wire seam the guard now lives
+// in; these assertions FAIL against the pre-fix code (bare `{ markdown }` wrap,
+// no guard) and pass after. We drive the real `computeReplyChunks` output
+// through the real `richMessage`, not `guardDollarMath` in isolation.
+describe("reply-path integration (#3252 F1/F2)", () => {
+  const OFFENDING =
+    "acquisition ceiling is ~$0.5-0.9M but nearly all in small dealers ... is ~$150-450k";
+
+  it("richMessage() escapes the `$…$` pair on the markdown wire body", () => {
+    const wire = richMessage(OFFENDING);
+    // The bytes handed to sendRichMessage/editMessageText carry no unescaped `$`.
+    expect(wire.markdown).not.toMatch(/(?<!\\)\$/);
+    expect(wire.markdown).not.toMatch(MATH_GLYPH);
+    // Reader-visible amounts intact once the defuser is stripped.
+    expect(copyText(wire.markdown)).toBe(OFFENDING);
+  });
+
+  it("the full computeReplyChunks → richMessage reply pipe emits no unescaped `$`", () => {
+    // Exactly what executeReply feeds sendReplyChunks for a non-literal reply.
+    const chunks = computeReplyChunks({
+      effectiveText: OFFENDING,
+      literalText: false,
+      limit: RICH_MESSAGE_MAX_CHARS,
+      chunkMode: "newline",
+    });
+    expect(chunks.length).toBeGreaterThan(0);
+    for (const chunk of chunks) {
+      const wire = richMessage(chunk); // sendReplyChunks wraps each chunk this way
+      expect(wire.markdown).not.toMatch(/(?<!\\)\$/);
+      expect(wire.markdown).not.toMatch(MATH_GLYPH);
+    }
+  });
+
+  it("a single-amount reply is left with its dollar untouched on the wire", () => {
+    const wire = richMessage("the retainer is $2500 per month");
+    expect(wire.markdown).toContain("$2500");
+    expect(wire.markdown).not.toContain("\\$2500");
+  });
+});
+
+describe("guardDollarMath — link / table awareness (findings 1 & 3)", () => {
+  it("does NOT escape a `$` inside a markdown link destination", () => {
+    // Two dollars + a digit-adjacent one would normally arm the guard, but both
+    // live in URL query strings → structural → left verbatim.
+    const s = "buy [x](https://x.io?price=$5) or [y](https://y.io?price=$9)";
+    expect(guardDollarMath(s)).toBe(s);
+  });
+
+  it("does NOT escape `$` inside a real table's cells", () => {
+    const s = ["| Item | Cost |", "| --- | --- |", "| a | $5 |", "| b | $9 |"].join("\n");
+    expect(guardDollarMath(s)).toBe(s);
+  });
+
+  it("STILL escapes two currency dollars in ordinary prose", () => {
+    const out = guardDollarMath("spend was $5 today and $9 tomorrow");
+    expect(out).not.toMatch(/(?<!\\)\$/);
+  });
+});

package/telegram-plugin/tests/render/emphasis-guard.test.ts

@@ -0,0 +1,205 @@
+import { describe, it, expect } from "vitest";
+import { guardAccidentalEmphasis } from "../../render/emphasis-guard.js";
+
+// Any U+1D400–U+1D7FF codepoint would be a mathematical-alphanumeric glyph; the
+// source never emits them — kept as a canary that the guard adds none.
+const MATH_GLYPH = /[\u{1D400}-\u{1D7FF}]/u;
+
+/** Strip defusing backslashes so we can assert the reader-visible/copy text is
+ *  byte-identical to the original prose. */
+function copyText(s: string): string {
+  return s.replace(/\\([_*])/g, "$1");
+}
+
+describe("guardAccidentalEmphasis (#3252) — accidental emphasis IS neutralised", () => {
+  it("escapes intra-word underscores in a snake_case identifier", () => {
+    const out = guardAccidentalEmphasis("the var is file_name_here in scope");
+    // No unescaped intra-word `_` remains to pair into an italic span.
+    expect(out).toContain("file\\_name\\_here");
+    expect(copyText(out)).toBe("the var is file_name_here in scope");
+  });
+
+  it("escapes intra-word asterisks in inline multiplication `a*b*c`", () => {
+    const out = guardAccidentalEmphasis("compute a*b*c for the product");
+    expect(out).toContain("a\\*b\\*c");
+    expect(copyText(out)).toBe("compute a*b*c for the product");
+  });
+
+  it("escapes digit-flanked `2*3*4` multiplication (2+ asterisks can pair)", () => {
+    const out = guardAccidentalEmphasis("the area is 2*3*4 units");
+    expect(out).toContain("2\\*3\\*4");
+  });
+
+  it("escapes a mixed digit/letter intra-word underscore run `v2_final_rc`", () => {
+    const out = guardAccidentalEmphasis("ship v2_final_rc today");
+    expect(out).toContain("v2\\_final\\_rc");
+  });
+
+  it("adds no math-italic glyphs", () => {
+    expect(guardAccidentalEmphasis("file_name_here and a*b")).not.toMatch(MATH_GLYPH);
+  });
+});
+
+describe("guardAccidentalEmphasis (#3252) — intended emphasis is LEFT UNTOUCHED (the critical no-false-positive cases)", () => {
+  it("leaves `**bold**` verbatim", () => {
+    const s = "this is **bold** text";
+    expect(guardAccidentalEmphasis(s)).toBe(s);
+  });
+
+  it("leaves `*italic*` verbatim", () => {
+    const s = "this is *italic* text";
+    expect(guardAccidentalEmphasis(s)).toBe(s);
+  });
+
+  it("leaves `_italic_` verbatim", () => {
+    const s = "this is _italic_ text";
+    expect(guardAccidentalEmphasis(s)).toBe(s);
+  });
+
+  it("leaves a multi-word `*italic phrase*` verbatim (boundary-flanked delimiters)", () => {
+    const s = "please read *the whole thing* carefully";
+    expect(guardAccidentalEmphasis(s)).toBe(s);
+  });
+
+  it("leaves `**bold**` and `_italic_` mixed in one line verbatim", () => {
+    const s = "**Header** then _emphasis_ and more **bold**";
+    expect(guardAccidentalEmphasis(s)).toBe(s);
+  });
+
+  it("leaves an intended italic that WRAPS a glob (`*.ts is a glob*`) verbatim", () => {
+    // The opening `*` is boundary-flanked (space before, `.` after) → not
+    // intra-word → deliberately left alone so the intended italic survives.
+    const s = "note: *.ts is a glob* pattern";
+    expect(guardAccidentalEmphasis(s)).toBe(s);
+  });
+
+  it("leaves a leading-underscore identifier `_private` verbatim (indistinguishable from italic)", () => {
+    const s = "the _private field and _internal state";
+    expect(guardAccidentalEmphasis(s)).toBe(s);
+  });
+
+  it("leaves space-flanked operators (`3 * 4`) verbatim — GFM cannot emphasise them", () => {
+    const s = "the product 3 * 4 equals 12";
+    expect(guardAccidentalEmphasis(s)).toBe(s);
+  });
+
+  it("leaves a bare trailing glob (`rm *`) verbatim", () => {
+    const s = "run rm * to clear the dir";
+    expect(guardAccidentalEmphasis(s)).toBe(s);
+  });
+
+  it("leaves a lone glob (`*.ts`) verbatim", () => {
+    const s = "match *.ts files only";
+    expect(guardAccidentalEmphasis(s)).toBe(s);
+  });
+});
+
+describe("guardAccidentalEmphasis (#3252) — pair threshold (finding 4)", () => {
+  // A single delimiter in the whole message can NEVER form an emphasis pair, so
+  // a lone intra-word `_`/`*` is provably inert and is left byte-identical.
+  it("leaves a LONE intra-word underscore `file_name` verbatim (can't pair)", () => {
+    const s = "the var is file_name in scope";
+    expect(guardAccidentalEmphasis(s)).toBe(s);
+  });
+
+  it("leaves a LONE intra-word asterisk `2*3` verbatim (can't pair)", () => {
+    const s = "the area is 2*3 units";
+    expect(guardAccidentalEmphasis(s)).toBe(s);
+  });
+
+  it("STILL escapes a lone intra-word `_` when a later `_italic_` gives it a pair", () => {
+    // Three underscores total (one intra-word + an intended `_italic_`); Telegram
+    // could mis-pair them, so the intra-word `_` MUST be escaped even though it is
+    // the only intra-word one. Threshold 2 (total count) catches this correctly.
+    const out = guardAccidentalEmphasis("the file_name and _italic_ here");
+    expect(out).toContain("file\\_name");
+    // The intended italic delimiters (boundary-flanked) are left untouched.
+    expect(out).toContain("_italic_");
+  });
+});
+
+describe("guardAccidentalEmphasis (#3252) — link / autolink awareness (finding 1)", () => {
+  it("does NOT escape intra-word `_` inside a markdown link destination", () => {
+    const s = "see [docs](https://x.io/a_b_c_d) for more";
+    // URL underscores are structural → passed through UNMODIFIED.
+    expect(guardAccidentalEmphasis(s)).toBe(s);
+  });
+
+  it("does NOT escape `_` inside a bare autolinked URL", () => {
+    const s = "read https://x.io/foo_bar_baz now";
+    expect(guardAccidentalEmphasis(s)).toBe(s);
+  });
+
+  it("STILL guards the link LABEL prose while protecting the URL", () => {
+    const out = guardAccidentalEmphasis("[file_name_here](https://x.io/a_b_c)");
+    // Label (rendered prose) is escaped; the `(url)` destination is verbatim.
+    expect(out).toContain("[file\\_name\\_here]");
+    expect(out).toContain("(https://x.io/a_b_c)");
+  });
+
+  it("protects a link destination WITH a title", () => {
+    const s = 'see [docs](https://x.io/a_b_c "the_title") now';
+    expect(guardAccidentalEmphasis(s)).toBe(s);
+  });
+});
+
+describe("guardAccidentalEmphasis (#3252) — trailing-alnum emphasis closer (finding 5)", () => {
+  // `*cat*s` / `_cat_s`: the closing delimiter is intra-word (t*s / t_s). Under
+  // strict CommonMark it cannot close emphasis, but Telegram may be more liberal
+  // (UAT-gated). Documented current behaviour: the intra-word closer is escaped
+  // (2 asterisks/underscores total → armed). Copy-round-trips to the original.
+  it("escapes the intra-word closer of `*cat*s`", () => {
+    const out = guardAccidentalEmphasis("a *cat*s tail");
+    expect(out).toContain("*cat\\*s");
+    expect(copyText(out)).toBe("a *cat*s tail");
+  });
+
+  it("escapes the intra-word closer of `_cat_s`", () => {
+    const out = guardAccidentalEmphasis("a _cat_s tail");
+    expect(out).toContain("_cat\\_s");
+    expect(copyText(out)).toBe("a _cat_s tail");
+  });
+});
+
+describe("guardAccidentalEmphasis (#3252) — code-span awareness", () => {
+  it("never touches intra-word `_`/`*` inside a code span", () => {
+    const s = "the identifier `file_name_here` and math `a*b*c` are code";
+    expect(guardAccidentalEmphasis(s)).toBe(s);
+  });
+
+  it("escapes prose but leaves an adjacent code span verbatim", () => {
+    // Two intra-word underscores in prose (`file_name_here`) → armed; the code
+    // span's `file_name` is verbatim and does NOT count toward the threshold.
+    const out = guardAccidentalEmphasis("prose file_name_here but code `file_name`");
+    expect(out).toContain("file\\_name\\_here but code `file_name`");
+  });
+
+  it("never touches intra-word delimiters inside a fenced code block", () => {
+    const s = "```\nfoo_bar = a*b*c\n```\ntail";
+    expect(guardAccidentalEmphasis(s)).toBe(s);
+  });
+});
+
+describe("guardAccidentalEmphasis (#3252) — no-op & idempotency", () => {
+  it("is a strict no-op when there is no `_` or `*` at all", () => {
+    const s = "a plain sentence with no delimiters at all";
+    expect(guardAccidentalEmphasis(s)).toBe(s);
+  });
+
+  it("is a strict no-op when the only `_`/`*` are intended emphasis", () => {
+    const s = "**bold** and _italic_ only";
+    expect(guardAccidentalEmphasis(s)).toBe(s);
+  });
+
+  it("is idempotent: guarding already-guarded text is a strict no-op", () => {
+    const once = guardAccidentalEmphasis("file_name_here and a*b");
+    expect(guardAccidentalEmphasis(once)).toBe(once);
+    expect(once).not.toContain("\\\\_"); // never a doubled backslash
+    expect(once).not.toContain("\\\\*");
+  });
+
+  it("does not double-escape a pre-escaped `\\_` intra-word delimiter", () => {
+    const s = "file\\_name here";
+    expect(guardAccidentalEmphasis(s)).toBe(s);
+  });
+});

package/telegram-plugin/tests/render/guard-composition.test.ts

@@ -0,0 +1,138 @@
+import { describe, it, expect } from "vitest";
+import { guardAccidentalFormatting, richMessage } from "../../rich-send.js";
+
+// Any U+1D400–U+1D7FF codepoint = a mathematical-alphanumeric glyph (what a
+// `$…$` math span typesets to on the reader's screen).
+const MATH_GLYPH = /[\u{1D400}-\u{1D7FF}]/u;
+
+/** Strip the defusing backslashes so we can assert the reader-visible / copied
+ *  text is byte-identical to the original ASCII. */
+function copyText(s: string): string {
+  return s.replace(/\\([$_*>.~=|])/g, "$1");
+}
+
+// The composed seam guard (#3252): guardAccidentalEmphasis →
+// guardAccidentalBlockConstructs → guardAccidentalInlinePairs → guardDollarMath.
+// These tests prove the guards COMPOSE without one guard's inserted backslash
+// creating or destroying a signal for another — the interference question.
+describe("guardAccidentalFormatting composition (#3252)", () => {
+  it("neutralises a message that trips emphasis + dollar + tilde at once", () => {
+    // `file_name_here` (2 intra-word `_` → can pair), `~$5M … ~$10M`
+    // (digit-adjacent tildes AND a two-dollar currency span) — three guards fire.
+    const src = "the file_name_here budget trims ~$5M, down from ~$10M last year";
+    const out = guardAccidentalFormatting(src);
+    // Emphasis: the intra-word underscores are escaped (no `_…_` pair).
+    expect(out).toContain("file\\_name\\_here");
+    // Dollar: no unescaped `$` remains to open a math span.
+    expect(out).not.toMatch(/(?<!\\)\$/);
+    // Tilde: BOTH approximation tildes escaped so no `~…~` strikethrough forms.
+    // This is the interference case — dollar runs last so its `\$` never hides
+    // the digit-adjacent tildes from the inline-pairs guard.
+    expect(out).not.toMatch(/(?<!\\)~/);
+    expect(out).toContain("\\~\\$5M");
+    expect(out).toContain("\\~\\$10M");
+    // No math glyphs, and stripping the defusers yields the original prose.
+    expect(out).not.toMatch(MATH_GLYPH);
+    expect(copyText(out)).toBe(src);
+  });
+
+  it("handles a line-start blockquote + operator-mark + dollar body", () => {
+    const src = ">2x growth means x==y and a==b while spend hit $40 and $80";
+    const out = guardAccidentalFormatting(src);
+    // Line-start `>2x` blockquote-promotion escaped.
+    expect(out).toContain("\\>2x");
+    // Both `==` operators neutralised (word-flanked → not intended ==mark==).
+    expect(out).toContain("x\\=\\=y");
+    expect(out).toContain("a\\=\\=b");
+    // Dollars escaped.
+    expect(out).not.toMatch(/(?<!\\)\$/);
+    expect(copyText(out)).toBe(src);
+  });
+
+  it("leaves a 4-digit-year accidental ordered-list alone except the dot", () => {
+    const src = "2026. was the year the file_name_here convention changed";
+    const out = guardAccidentalFormatting(src);
+    expect(out).toContain("2026\\. was");
+    expect(out).toContain("file\\_name\\_here");
+  });
+
+  it("never touches DELIBERATE formatting: bold, italic, strike, code, blockquote", () => {
+    const src =
+      "**bold** and *italic* and _under_ and ~~strike~~ and `a_b*c` and\n> real quote";
+    // No accidental signal anywhere → strict no-op.
+    expect(guardAccidentalFormatting(src)).toBe(src);
+  });
+
+  it("never touches content inside code spans / fenced blocks", () => {
+    const src =
+      "prose $10 and $20 but the snippet `x==y && file_name ~5` stays verbatim";
+    const out = guardAccidentalFormatting(src);
+    expect(out).toContain("`x==y && file_name ~5`");
+    // Prose dollars still escaped outside the code span.
+    expect(out).not.toMatch(/(?<!\\)\$(?=\d)/);
+  });
+
+  it("is idempotent: composing already-composed text is a strict no-op", () => {
+    const src = "file_name_here ~$5M and ~$10M with x==y and a==b, >2x, 2026. done";
+    const once = guardAccidentalFormatting(src);
+    expect(guardAccidentalFormatting(once)).toBe(once);
+    // No doubled backslashes anywhere.
+    expect(once).not.toMatch(/\\\\/);
+  });
+
+  it("passes a markdown link with a `_`/`~`/`==`-laden URL through UNMODIFIED (finding 1)", () => {
+    const src = "see [docs](https://x.io/a_b_c?p==1&q~2) and [more](https://y.io/foo_bar)";
+    // Every trigger char in the URL is structural → the whole body is verbatim.
+    expect(guardAccidentalFormatting(src)).toBe(src);
+  });
+
+  it("passes a bare autolinked URL through UNMODIFIED (finding 1)", () => {
+    const src = "read https://en.wikipedia.org/wiki/Foo_Bar_Baz today";
+    expect(guardAccidentalFormatting(src)).toBe(src);
+  });
+
+  it("guards the link LABEL but protects the destination (finding 1)", () => {
+    const out = guardAccidentalFormatting("[a_b_c](https://x.io/p_q_r) spent $5 and $9");
+    // Label prose escaped; URL verbatim; prose dollars still escaped.
+    expect(out).toContain("[a\\_b\\_c]");
+    expect(out).toContain("(https://x.io/p_q_r)");
+    expect(out).not.toMatch(/(?<!\\)\$/);
+  });
+
+  it("passes a GFM table with empty cells through UNMODIFIED (finding 3)", () => {
+    // A real table (has a delimiter row) — its structural pipes/empty cells and
+    // any `_`/`$` inside cells must survive. `|a||b|` = a real empty cell.
+    const src = ["| A | B | C |", "| --- | --- | --- |", "|a||b||c|", "| x_y | $5 | ~3 |"].join("\n");
+    expect(guardAccidentalFormatting(src)).toBe(src);
+  });
+
+  it("STILL guards a genuine accidental `a||b` in prose (not a table)", () => {
+    // Two word-flanked `||` in PROSE (no delimiter row) → armed spoiler guard.
+    const out = guardAccidentalFormatting("logic is a||b and c||d here");
+    expect(out).toContain("a\\|\\|b");
+    expect(out).toContain("c\\|\\|d");
+  });
+
+  // FINDING 2 (documented non-issue): switchroom's IR renderer emits code
+  // blocks ONLY as backtick FENCES (render.ts renderCodeBlock), never as
+  // 4-space-indented CommonMark code. So renderer output reaching richMessage()
+  // never contains an indented code block. The emphasis/inline-pairs/dollar
+  // guards therefore do NOT special-case a 4-space indent (only line-start does,
+  // for its own blockquote/list heuristics). This test PINS that current
+  // behaviour: a 4-space-indented prose line is treated as ordinary prose and
+  // its currency `$` is guarded like any other. (If a future change ever routes
+  // raw indented code blocks to the wire, revisit — see guards-integration-note.)
+  it("treats a 4-space-indented line as prose (finding 2 — renderer emits fences, not indented code)", () => {
+    const out = guardAccidentalFormatting("    spend was $5 and $10 total");
+    expect(out).toContain("\\$5");
+    expect(out).toContain("\\$10");
+  });
+
+  it("richMessage() applies the composed guard on the wire body exactly once", () => {
+    const src = "file_name spend ~$5M vs ~$10M, x==y";
+    const wire = richMessage(src);
+    expect(wire.markdown).toBe(guardAccidentalFormatting(src));
+    // And re-wrapping (streaming re-render) is byte-stable.
+    expect(richMessage(wire.markdown).markdown).toBe(wire.markdown);
+  });
+});