switchroom 0.18.28 → 0.18.29

package/telegram-plugin/tests/gateway-session-model-relaunch.test.ts

@@ -1,10 +1,11 @@
 /**
- * Structural pins for the session-scoped /model wiring in gateway.ts
- * (reference/rfcs/session-model-stickiness.md §0.1, rev 4 — consume-once).
+ * Structural pins for the DETERMINISTIC /model wiring in gateway.ts
+ * (reference/rfcs/session-model-stickiness.md §0.05, rev 5 — every switch
+ * relaunches through the consume-once carrier; the inject/scrape path retired).
  *
  * The behaviour lives in un-exported inline closures (buildModelDeps's
- * scheduleModelRelaunch/scheduleRestart, the typed/menu recorders, and the
- * boot re-hydration block inside the startup IIFE), so — mirroring the other
+ * scheduleModelRelaunch / scheduleModelDefaultRelaunch / scheduleRestart, and
+ * the boot re-hydration block inside the startup IIFE), so — mirroring the other
  * gateway-*.test.ts source-pins — we assert on the source structure. The
  * end-to-end boot behaviour is exercised in tests/scaffold.session-model.test.ts
  * (rendered start.sh), the file helpers in session-model-file.test.ts, and the
@@ -42,7 +43,7 @@ describe('gateway: scheduleModelRelaunch dep (consume-once .session-model carrie
   it('writes the carrier via writeSessionModelFile before dispatching the restart', () => {
     const idx = GATEWAY_SRC.indexOf('scheduleModelRelaunch: async')
     expect(idx).toBeGreaterThan(0)
-    const win = GATEWAY_SRC.slice(idx, idx + 1800)
+    const win = GATEWAY_SRC.slice(idx, idx + 2600)
     const writeIdx = win.indexOf('writeSessionModelFile(')
     const restartIdx = win.indexOf('deps.scheduleRestart(reason)')
     expect(writeIdx).toBeGreaterThan(0)
@@ -51,7 +52,7 @@ describe('gateway: scheduleModelRelaunch dep (consume-once .session-model carrie
 
   it('sets the in-memory session-model override before dispatching the restart', () => {
     const idx = GATEWAY_SRC.indexOf('scheduleModelRelaunch: async')
-    const win = GATEWAY_SRC.slice(idx, idx + 1800)
+    const win = GATEWAY_SRC.slice(idx, idx + 2600)
     const setIdx = win.indexOf('sessionModelSource.setOverride(model)')
     const restartIdx = win.indexOf('deps.scheduleRestart(reason)')
     expect(setIdx).toBeGreaterThan(0)
@@ -60,7 +61,7 @@ describe('gateway: scheduleModelRelaunch dep (consume-once .session-model carrie
 
   it('rolls back the prior carrier content (not just deletion) on a non-in-flight dispatch failure', () => {
     const idx = GATEWAY_SRC.indexOf('scheduleModelRelaunch: async')
-    const win = GATEWAY_SRC.slice(idx, idx + 1800)
+    const win = GATEWAY_SRC.slice(idx, idx + 2600)
     expect(win).toContain('const prevFileRaw = readSessionModelFileRaw(agentDir)')
     expect(win).toContain('restoreSessionModelFileRaw(agentDir, prevFileRaw)')
     expect(win).toContain("!== 'restart_in_flight'")
@@ -68,82 +69,108 @@ describe('gateway: scheduleModelRelaunch dep (consume-once .session-model carrie
 
   it('reuses the same scheduleRestart dispatch (not a bespoke restart path)', () => {
     const idx = GATEWAY_SRC.indexOf('scheduleModelRelaunch: async')
-    const win = GATEWAY_SRC.slice(idx, idx + 1800)
+    const win = GATEWAY_SRC.slice(idx, idx + 2600)
     expect(win).toContain('await deps.scheduleRestart(reason)')
   })
 })
 
-describe('gateway: menu callback carrier handling (session-scoped)', () => {
-  it('a live Claude selection records the in-memory override but writes NO carrier', () => {
-    const idx = GATEWAY_SRC.indexOf('function recordModelMenuSideEffects')
-    expect(idx).toBeGreaterThan(0)
-    const win = GATEWAY_SRC.slice(idx, idx + 900)
-    // The first (live-switch) block sets the override but no longer persists.
-    expect(win).toContain('sessionModelSource.setOverride(outcome.selectedModel)')
-    const overrideIdx = win.indexOf('sessionModelSource.setOverride(outcome.selectedModel)')
-    const nextClearIdx = win.indexOf('outcome.clearedDefault')
-    const writeBetween = win.slice(overrideIdx, nextClearIdx)
-    expect(writeBetween).not.toContain('writeSessionModelFile(')
+describe('gateway: the retired scrape-recorders are GONE (rev 5 inversion)', () => {
+  it('recordTypedModelSwitch and recordModelMenuSideEffects no longer exist', () => {
+    // INVERTED from rev 4: these helpers recorded a scrape-derived selectedModel
+    // and drove the sr-to-claude special case. Every switch now relaunches, so
+    // they are deleted — their presence would mean the retired path survived.
+    expect(GATEWAY_SRC).not.toContain('function recordTypedModelSwitch')
+    expect(GATEWAY_SRC).not.toContain('function recordModelMenuSideEffects')
   })
 
-  it('a confirmed "Default" selection CLEARS the carrier', () => {
-    const idx = GATEWAY_SRC.indexOf('function recordModelMenuSideEffects')
-    const win = GATEWAY_SRC.slice(idx, idx + 2400)
-    expect(win).toContain('outcome.clearedDefault')
-    expect(win).toContain('clearSessionModelFile(smDir)')
+  it('no isSrToClaudeTransition wiring (every switch relaunches — no distinct transition)', () => {
+    expect(GATEWAY_SRC).not.toContain('isSrToClaudeTransition')
   })
 
-  it('the sr-* callback branch calls scheduleModelRelaunch, not inject', () => {
-    const idx = GATEWAY_SRC.indexOf('const srLabel = escapeHtmlForTg(srFriendlyLabel(srName))')
+  it('buildModelDeps wires neither the inject nor the select terminal-driver dep', () => {
+    const idx = GATEWAY_SRC.indexOf('function buildModelDeps')
     expect(idx).toBeGreaterThan(0)
-    const win = GATEWAY_SRC.slice(idx, idx + 1400)
-    expect(win).toContain('modelDeps.scheduleModelRelaunch(srName')
-    expect(win).toMatch(/scheduleModelRelaunch[\s\S]*?\n\s*return\n/)
+    const win = GATEWAY_SRC.slice(idx, idx + 4000)
+    expect(win).not.toContain('inject: injectSlashCommandImpl')
+    expect(win).not.toContain('select: (a, label) => selectModel')
   })
+})
 
-  it('the sr-to-claude transition (a relaunch) writes the carrier, and clears it on a Default tap', () => {
-    const idx = GATEWAY_SRC.indexOf('isSrToClaudeTransition(prevSessionModel, outcome.selectedModel)')
+describe('gateway: scheduleModelDefaultRelaunch (G1 — clear + revert relaunch)', () => {
+  it('clears the carrier + override and mirrors scheduleModelRelaunch rollback', () => {
+    const idx = GATEWAY_SRC.indexOf('scheduleModelDefaultRelaunch: async')
     expect(idx).toBeGreaterThan(0)
-    const win = GATEWAY_SRC.slice(idx, idx + 3600)
-    expect(win).toMatch(/writeSessionModelFile\(\s*agentDir,\s*token/)
-    expect(win).toContain('clearSessionModelFile(agentDir)')
-    expect(win).toContain("triggerSelfRestart(agentName, 'sr-to-claude-model-switch'")
+    const win = GATEWAY_SRC.slice(idx, idx + 900)
+    const clearIdx = win.indexOf('clearSessionModelFile(agentDir)')
+    const overrideIdx = win.indexOf('sessionModelSource.setOverride(null)')
+    const restartIdx = win.indexOf('deps.scheduleRestart(reason)')
+    expect(clearIdx).toBeGreaterThan(0)
+    expect(overrideIdx).toBeGreaterThan(clearIdx)
+    expect(restartIdx).toBeGreaterThan(overrideIdx)
+    // G1 rollback on a non-in-flight dispatch failure.
+    expect(win).toContain('restoreSessionModelFileRaw(agentDir, prevFileRaw)')
+    expect(win).toContain("!== 'restart_in_flight'")
   })
 })
 
-describe('gateway: typed /model is session-scoped (live Claude switch writes no carrier)', () => {
-  it('the Claude path sets the in-memory override but never persists a carrier', () => {
-    const idx = GATEWAY_SRC.indexOf('function recordTypedModelSwitch')
+describe('gateway: the live callback dispatcher routes every switch tap to the handler', () => {
+  it('calls handleModelMenuCallback and no longer post-processes a scrape outcome', () => {
+    const idx = GATEWAY_SRC.indexOf('const outcome = await handleModelMenuCallback(data, modelDeps)')
     expect(idx).toBeGreaterThan(0)
-    const win = GATEWAY_SRC.slice(idx, idx + 1400)
-    expect(win).toContain('sessionModelSource.setOverride(reply.selectedModel)')
-    // No durable carrier write on the live-switch path.
-    expect(win).not.toContain('writeSessionModelFile(')
-  })
-
-  it('`/model default` clears the carrier + in-memory override (silent-switch path must not resurrect)', () => {
-    const idx = GATEWAY_SRC.indexOf('function recordTypedModelSwitch')
-    const win = GATEWAY_SRC.slice(idx, idx + 1400)
-    expect(win).toContain("requested?.toLowerCase() === 'default'")
-    expect(win).toContain('clearSessionModelFile(smDir)')
-    expect(win).toContain('sessionModelSource.setOverride(null)')
-    // The file-clear is not gated on a positive confirmation.
-    const clearIdx = win.indexOf('if (smDir) clearSessionModelFile(smDir)')
-    const gatedOverrideIdx = win.indexOf('if (reply.selectedModel) sessionModelSource.setOverride(null)')
-    expect(clearIdx).toBeGreaterThan(0)
-    expect(gatedOverrideIdx).toBeGreaterThan(clearIdx)
+    const win = GATEWAY_SRC.slice(idx, idx + 600)
+    expect(win).not.toContain('recordModelMenuSideEffects')
+  })
+
+  it('the typed dispatcher relays the handler reply directly (no recordTypedModelSwitch)', () => {
+    const idx = GATEWAY_SRC.indexOf('const reply = await handleModelCommand(parsed, deps)')
+    expect(idx).toBeGreaterThan(0)
+    const win = GATEWAY_SRC.slice(idx, idx + 400)
+    expect(win).not.toContain('recordTypedModelSwitch')
+    expect(win).toContain('switchroomReply(ctx, reply.text')
   })
 })
 
-describe('gateway boot: session-model re-hydration + alert relay', () => {
-  it('re-hydrates the override from .active-session-model', () => {
+describe('gateway boot: session-model re-hydration + confirmation + alert relay', () => {
+  it('re-hydrates the override from .active-session-model (launched !== configured)', () => {
     const idx = GATEWAY_SRC.indexOf("join(smAgentDir, '.active-session-model')")
     expect(idx).toBeGreaterThan(0)
-    const win = GATEWAY_SRC.slice(idx - 200, idx + 1400)
-    expect(win).toMatch(/launched\.length > 0 && launched !== configured \? launched : null/)
+    const win = GATEWAY_SRC.slice(idx - 200, idx + 3200)
+    // F1: `launched !== configured` is the deterministic apply-boot signal.
+    expect(win).toContain('const isApplyBoot = launched.length > 0 && launched !== configured')
+    expect(win).toContain('sessionModelSource.setOverride(isApplyBoot ? launched : null)')
     expect(win).toContain('resolveMainModel(raw ?? undefined)')
   })
 
+  it('logs the applied model for diagnosability (F1)', () => {
+    expect(GATEWAY_SRC).toContain('gw /model relaunch applied agent=')
+    expect(GATEWAY_SRC).toContain('gw /model relaunch scheduled agent=')
+  })
+
+  it('sends ONE switch-confirmation from the ACTUAL launched model, keyed on the /model reason (F1/N4)', () => {
+    const idx = GATEWAY_SRC.indexOf('const isApplyBoot = launched.length > 0')
+    expect(idx).toBeGreaterThan(0)
+    const win = GATEWAY_SRC.slice(idx, idx + 3400)
+    // Keyed on the deterministic /model switch reason, so it also fires on a
+    // launched===configured apply-boot (/model default) — N4. Never optimistic.
+    expect(win).toContain('if (modelSwitchReason != null && modelSwitchMarkerChat)')
+    expect(win).toContain('✅ Now running')
+    // N4: the launched===configured branch still confirms.
+    expect(win).toContain('(the configured default)')
+  })
+
+  it('N4/reason: the /model switch reason is captured from the clean-shutdown marker', () => {
+    expect(GATEWAY_SRC).toContain("cleanMarker.reason.startsWith('user: /model')")
+    expect(GATEWAY_SRC).toContain('let modelSwitchReason: string | null = null')
+  })
+
+  it('N3: the generic boot card is suppressed on a /model apply-boot (one card per switch)', () => {
+    const idx = GATEWAY_SRC.indexOf('const suppressBootCardForModelSwitch')
+    expect(idx).toBeGreaterThan(0)
+    const win = GATEWAY_SRC.slice(idx, idx + 800)
+    expect(win).toContain('modelSwitchReason != null && modelSwitchMarkerChat != null')
+    expect(win).toContain('else if (target)')
+  })
+
   it('consumes the .session-model-alert sentinel, notifies ALL operators, and deletes it', () => {
     const idx = GATEWAY_SRC.indexOf("join(smAgentDir, '.session-model-alert')")
     expect(idx).toBeGreaterThan(0)

package/telegram-plugin/tests/history.test.ts

@@ -16,6 +16,7 @@ import {
   hasOutboundDeliveredSince,
   hasOutboundWithText,
   normalizeDeliveryText,
+  verifyHistoryWritable,
   _resetForTests,
 } from '../history.js'
 
@@ -963,3 +964,90 @@ describe('hasOutboundWithText (durable text-identity oracle)', () => {
     expect(hasOutboundWithText('1', 'repeated answer', null, 250_000)).toBe(true)
   })
 })
+
+// ── 2026-07-16 incident hardening: writer durability across restart + surfacing
+//    swallowed insert failures. Root cause: turn-flush deliveries (18944/18958)
+//    reached Telegram but were absent from history.db, blinding
+//    getRecentOutboundCount / hasOutboundDeliveredSince. The gateway had already
+//    logged "history capture enabled" on both restarts, so DB-open success was
+//    NOT proof the row-insert path worked. These tests pin the durable fix.
+describe('history writer durability (2026-07-16 incident)', () => {
+  it('verifyHistoryWritable proves the INSERT path works on a live DB', () => {
+    initHistory(stateDir, 30)
+    const res = verifyHistoryWritable()
+    expect(res.ok).toBe(true)
+    // The self-check must leave NO sentinel residue behind.
+    expect(getRecentOutboundCount('__history_selfcheck__', 86_400)).toBe(0)
+  })
+
+  it('verifyHistoryWritable reports not-ok before init (no silent success)', () => {
+    // No initHistory() this test — the writer is uninitialised.
+    const res = verifyHistoryWritable()
+    expect(res.ok).toBe(false)
+    expect(res.error).toMatch(/initHistory/)
+  })
+
+  // The core recovery contract: recording must survive a shutdown + reinit
+  // (a gateway restart, which nulls the module singleton and re-opens the same
+  // file). Rows written before AND after the boundary must all be queryable.
+  it('recording continues across a simulated restart (reinit of the same DB)', () => {
+    const nowSec = Math.floor(Date.now() / 1000)
+    initHistory(stateDir, 30)
+    recordOutbound({ chat_id: '9', thread_id: null, message_ids: [100], texts: ['before restart'], ts: nowSec - 60 })
+    // Simulate a gateway restart: close + forget the singleton, then reinit
+    // against the SAME stateDir (fresh process, db=null → re-open).
+    _resetForTests()
+    initHistory(stateDir, 30)
+    // Boot self-check must still pass against the existing, populated file.
+    expect(verifyHistoryWritable().ok).toBe(true)
+    recordOutbound({ chat_id: '9', thread_id: null, message_ids: [101], texts: ['after restart'], ts: nowSec })
+    const rows = query({ chat_id: '9' })
+    expect(rows.map((r) => r.message_id)).toEqual([100, 101])
+    // The backstop suppression counter (the surface blinded by the incident)
+    // must see BOTH the pre- and post-restart outbounds.
+    expect(getRecentOutboundCount('9', 10_000_000_000)).toBe(2)
+  })
+
+  // The exact incident shape: a malformed send result yields an invalid
+  // message_id. OLD behaviour: the NOT NULL PRIMARY KEY throws inside the tx and
+  // the caller's `catch {}` swallows it — the row is lost AND invisible. NEW
+  // behaviour: the invalid chunk is filtered + logged, valid chunks still land,
+  // and no throw escapes to be swallowed.
+  it('drops an invalid message_id chunk loudly but records the valid ones (no silent total loss)', () => {
+    initHistory(stateDir, 30)
+    const errs: string[] = []
+    const orig = process.stderr.write.bind(process.stderr)
+    // @ts-expect-error narrow test shim over the write overloads
+    process.stderr.write = (chunk: string) => { errs.push(String(chunk)); return true }
+    try {
+      recordOutbound({
+        chat_id: '9',
+        thread_id: null,
+        // chunk 0 is a malformed (undefined) id; chunk 1 is real.
+        message_ids: [undefined as unknown as number, 200],
+        texts: ['lost chunk', 'kept chunk'],
+        ts: 3000,
+      })
+    } finally {
+      process.stderr.write = orig
+    }
+    // The valid chunk is recorded (delivery accounting is NOT silently zeroed).
+    const rows = query({ chat_id: '9' })
+    expect(rows.map((r) => r.message_id)).toEqual([200])
+    // The drop was surfaced loudly, not swallowed.
+    expect(errs.join('')).toMatch(/invalid message_id/)
+  })
+
+  it('recordOutbound with an all-invalid id set no-ops without throwing', () => {
+    initHistory(stateDir, 30)
+    expect(() =>
+      recordOutbound({
+        chat_id: '9',
+        thread_id: null,
+        message_ids: [NaN, null as unknown as number],
+        texts: ['a', 'b'],
+      }),
+    ).not.toThrow()
+    expect(getRecentOutboundCount('9', 10_000_000_000)).toBe(0)
+  })
+})

package/telegram-plugin/tests/local-time.test.ts

@@ -0,0 +1,68 @@
+/**
+ * Unit tests for the model-facing local-time primitives in
+ * telegram-plugin/shared/local-time.ts.
+ *
+ * switchroom #tz-fix: `fmtLocalStamp` + `resolveEnvTimezone` are the single
+ * source of truth for the LOCAL am/pm timestamps the model now sees on inbound
+ * `<channel ts="…">` tags, `forwarded_date`, and the get_recent_messages
+ * buffer — replacing the UTC ISO strings that competed with the local-time
+ * hint. These pin the deterministic outcome: local am/pm, NEVER a UTC string.
+ */
+
+import { describe, expect, it } from 'vitest'
+import { fmtLocalStamp, resolveEnvTimezone } from '../shared/local-time.js'
+
+// 2025-06-15T14:26:40Z — a fixed instant so the local rendering is deterministic.
+const MS = 1750000000 * 1000
+
+describe('resolveEnvTimezone', () => {
+  it('follows the SWITCHROOM_TIMEZONE → TZ → UTC cascade', () => {
+    expect(resolveEnvTimezone({ SWITCHROOM_TIMEZONE: 'Australia/Melbourne', TZ: 'America/New_York' })).toBe(
+      'Australia/Melbourne',
+    )
+    expect(resolveEnvTimezone({ TZ: 'America/New_York' })).toBe('America/New_York')
+    expect(resolveEnvTimezone({})).toBe('UTC')
+  })
+})
+
+describe('fmtLocalStamp', () => {
+  it('renders LOCAL am/pm with weekday, ISO date, and zone abbrev — no UTC', () => {
+    const out = fmtLocalStamp(MS, 'Australia/Melbourne')
+    // e.g. "Sunday 2025-06-16 12:26 AM AEST"
+    expect(out).toMatch(/^[A-Za-z]+ \d{4}-\d{2}-\d{2} \d{2}:\d{2} (?:AM|PM) [A-Za-z]{2,5}$/)
+    expect(out).not.toContain('UTC')
+    expect(out.endsWith('Z')).toBe(false)
+  })
+
+  it('reflects the requested zone (different wall clock for a different tz)', () => {
+    const melbourne = fmtLocalStamp(MS, 'Australia/Melbourne')
+    const newYork = fmtLocalStamp(MS, 'America/New_York')
+    expect(melbourne).not.toBe(newYork)
+    expect(newYork).toMatch(/ (?:AM|PM) [A-Za-z]{2,5}$/)
+  })
+
+  it('is total — an invalid IANA zone degrades to am/pm, never throws', () => {
+    // Must not throw out of the inbound path on a misconfigured agent.
+    const out = fmtLocalStamp(MS, 'Not/ARealZone')
+    expect(typeof out).toBe('string')
+    expect(out.length).toBeGreaterThan(0)
+  })
+
+  it('UTC zone still renders am/pm (24h/"UTC-suffix" form is gone)', () => {
+    const out = fmtLocalStamp(MS, 'UTC')
+    expect(out).toMatch(/ (?:AM|PM) /)
+  })
+
+  it('tracks DST — Australia/Melbourne is AEDT in Jan (summer) and AEST in Jul (winter)', () => {
+    // Southern-hemisphere DST: daylight time is the Dec–Mar summer.
+    const summer = fmtLocalStamp(Date.UTC(2026, 0, 15, 3, 0, 0), 'Australia/Melbourne') // 15 Jan
+    const winter = fmtLocalStamp(Date.UTC(2026, 6, 15, 3, 0, 0), 'Australia/Melbourne') // 15 Jul
+    expect(summer).toContain('AEDT')
+    expect(winter).toContain('AEST')
+    // Both stay am/pm and UTC-free across the transition.
+    for (const s of [summer, winter]) {
+      expect(s).toMatch(/ (?:AM|PM) /)
+      expect(s).not.toContain('UTC')
+    }
+  })
+})