switchroom 0.18.3 → 0.18.6

package/telegram-plugin/pending-work-progress.ts

@@ -419,9 +419,15 @@ function tick(now: number): void {
       newText,
       literalText: s.anchorLiteralText,
     }
-    // Fire-and-forget so a slow edit doesn't block the tick loop.
-    // Errors are logged but never bubble (a 429 / "message not modified"
-    // / chat-deleted is a soft failure).
+    // Fire-and-forget so a slow edit doesn't block the tick loop. The
+    // production `editMessage` dep is `swallowingApiCall`-wrapped, which
+    // catches every transport outcome (not-modified / not-found / 429 /
+    // network) upstream and never rejects — so in production this `.catch`
+    // is a backstop that rarely fires. It is kept as a contract-level guard
+    // (a throwing dep, or a future non-swallowing wiring, must not log a
+    // scary "edit failed" warning for a best-effort liveness surface nor
+    // keep hammering a dead anchor). Only a genuinely unexpected error
+    // reaches the fallthrough; transport classes are silent.
     void Promise.resolve()
       .then(() => activeDeps!.editMessage(editCtx))
       .then(() => {
@@ -432,10 +438,39 @@ function tick(now: number): void {
         })
       })
       .catch((err) => {
-        process.stderr.write(
-          `pending-work-progress: edit failed key=${key} ` +
-            `msg=${editCtx.messageId}: ${(err as Error).message}\n`,
-        )
+        const desc =
+          err instanceof Error ? err.message : err != null && typeof err === 'object' && 'description' in err
+            ? String((err as { description?: unknown }).description)
+            : String(err)
+        const low = desc.toLowerCase()
+        // "message is not modified" — the anchor already shows this suffix.
+        // The card is correct; count it as an edit and move on silently.
+        if (low.includes('not modified')) {
+          activeDeps!.emitMetric?.({
+            kind: 'pending_progress_edited',
+            chatKey: key,
+            elapsedMs: elapsed,
+          })
+          return
+        }
+        // Message / chat gone, or the 48h edit window closed. The anchor
+        // is dead — stop retrying it (clear state) so the tick isn't
+        // hammering a non-existent message every EDIT_INTERVAL_MS. The
+        // next outbound reply re-establishes a fresh anchor. Silent: no
+        // card to update is not a liveness-logic error.
+        if (
+          low.includes('not found') ||
+          low.includes("can't be edited") ||
+          low.includes('cannot be edited') ||
+          low.includes('not enough rights')
+        ) {
+          clearPending(key, 'stale_turn')
+          return
+        }
+        // 429 / transient network blip — leave state intact; the next tick
+        // retries. No stderr: a transport hiccup on a best-effort card is
+        // not a logic error, and the production wiring already applies
+        // retry_after backoff upstream.
       })
   }
 }

package/telegram-plugin/quota-bar-format.ts

@@ -0,0 +1,360 @@
+/**
+ * Quota-bar block — a compact per-account ASCII-bar rendering of the 5-hour
+ * and 7-day utilization windows, for a live-refreshing Telegram card.
+ *
+ * JTBD: "at a glance, how much headroom does each account have, and how far
+ * through its reset window are we" — denser than the `/auth` table (Format 2,
+ * `auth-snapshot-format.ts`), meant for a small always-visible strip rather
+ * than a full snapshot.
+ *
+ * Locked output shape (operator-confirmed via live Telegram iteration —
+ * do not reformat without re-confirming):
+ *
+ * ```
+ * - **you@example.com** (active)
+ * - 🟢 5h `[┃░░░░░░░░░] 0% / 4h20m left`
+ * - 🟡 7d `[████┃█░░░░] 47% / 3d1h left`
+ * - **alice@example.com** (exhausted)
+ * - 🟢 5h `[┃░░░░░░░░░] 0% / resets now`
+ * - 🔴 7d `[██████┃███] 100% / 2d16h left`
+ * ```
+ *
+ * Rules:
+ *   1. GFM `- ` bullet marker on EVERY line, including the account title
+ *      line — a tight one-item-per-line list, no blank lines between rows
+ *      (a no-bullet hard-break variant was tried live and rejected as
+ *      "worse" — bullets are the final mechanism).
+ *   2. Title line: `- **<email>** (<status>)`, status derived from data
+ *      (`active` | `exhausted` | `idle` — see `accountStatus`).
+ *   3. One row per window (5h, 7d): `- <dot> <window> \`[<bar>] <pct>% /
+ *      <time-left>\``.
+ *   4. Bar is 10 cells of `█` (filled, proportional to utilization) /
+ *      `░` (empty), with a single `┃` "pace" tick marking how far through
+ *      the reset window we currently are. The tick ALWAYS renders at its
+ *      computed position, overriding whatever fill character is there —
+ *      even at 100% utilization — since the pace signal must stay visible
+ *      (operator-confirmed; see `buildBar`).
+ */
+
+import type { QuotaUtilization } from './quota-check.js';
+import { refillNormalizedUtils, isProbeThin } from '../src/auth/quota.js';
+import type { AccountState, ListStateData } from '../src/auth/broker/client.js';
+import { reviveLastQuota, recommendation, type AccountSnapshot } from './auth-snapshot-format.js';
+import { escapeMarkdown } from './card-format.js';
+import { maskEmail } from './demo-mask.js';
+
+// ── dot thresholds ───────────────────────────────────────────────────
+
+/**
+ * Per-row status dot, purely a function of THAT window's own utilization
+ * percentage (not the account's overall exhausted flag — an exhausted
+ * account can still show a green 5h row if that window is fresh).
+ *
+ *   - < 50%  → 🟢 healthy
+ *   - 50-89% → 🟡 getting close
+ *   - >= 90% → 🔴 at/near the wall
+ */
+export function pickDot(pct: number): '🟢' | '🟡' | '🔴' {
+  const clamped = Math.max(0, Math.min(100, pct));
+  if (clamped >= 90) return '🔴';
+  if (clamped >= 50) return '🟡';
+  return '🟢';
+}
+
+// ── time-left formatting ─────────────────────────────────────────────
+
+/**
+ * Compact time-left string for the quota-bar row: `4h20m left`,
+ * `3d1h left`, `45m left`, or `resets now` when the reset has already
+ * passed (or is unknown — no reset timestamp to count down to).
+ *
+ * Deliberately more compact than `formatRelative` in
+ * `auth-snapshot-format.ts` (no space between the number and unit) to
+ * keep the fixed-width code-span row from wrapping on a phone screen.
+ */
+export function formatTimeLeft(target: Date | null, now: Date = new Date()): string {
+  if (!target) return 'resets now';
+  const deltaMs = target.getTime() - now.getTime();
+  // A malformed reset timestamp (invalid Date → NaN delta) must not leak a
+  // `"NaNm left"` string; treat a non-finite delta as "resets now".
+  if (!Number.isFinite(deltaMs) || deltaMs <= 0) return 'resets now';
+  const totalMin = Math.round(deltaMs / 60_000);
+  if (totalMin < 60) return `${totalMin}m left`;
+  const totalHours = Math.floor(totalMin / 60);
+  const m = totalMin % 60;
+  if (totalHours < 24) return `${totalHours}h${m}m left`;
+  const d = Math.floor(totalHours / 24);
+  const h = totalHours % 24;
+  return h > 0 ? `${d}d${h}h left` : `${d}d left`;
+}
+
+// ── pace (elapsed-through-window) fraction ───────────────────────────
+
+const FIVE_HOUR_MS = 5 * 60 * 60 * 1000;
+const SEVEN_DAY_MS = 7 * 24 * 60 * 60 * 1000;
+
+/**
+ * How far through the reset window we currently are, as a 0..1 fraction,
+ * derived from the time LEFT to reset and the window's nominal duration
+ * (we're never told the window's start time, only its end/reset — so this
+ * is an approximation, not an exact elapsed-time read).
+ *
+ *   - no reset timestamp, or reset already passed → 0 (treat as a freshly
+ *     started window rather than claiming we're at the very end of one we
+ *     have no data for)
+ *   - otherwise → `1 - timeLeftMs / windowDurationMs`, clamped to [0, 1]
+ */
+export function elapsedFraction(
+  target: Date | null,
+  windowDurationMs: number,
+  now: Date = new Date(),
+): number {
+  if (!target) return 0;
+  const timeLeftMs = target.getTime() - now.getTime();
+  // A malformed reset timestamp (invalid Date → NaN delta) must not corrupt
+  // the tick placement; treat a non-finite delta as a freshly-started window.
+  if (!Number.isFinite(timeLeftMs) || timeLeftMs <= 0) return 0;
+  return Math.max(0, Math.min(1, 1 - timeLeftMs / windowDurationMs));
+}
+
+// ── bar rendering ─────────────────────────────────────────────────────
+
+const BAR_WIDTH = 10;
+
+/**
+ * Build the 10-cell `[█…░…]` bar body (no surrounding brackets — callers
+ * add those) for one window row.
+ *
+ *   - `fillCount = round(pct / 100 * 10)` cells are `█` from the left.
+ *   - a single `┃` pace tick is placed at
+ *     `round(elapsedFrac * (width - 1))`, and ALWAYS overwrites whatever
+ *     cell is there — including a filled `█` cell, even at 100% utilization
+ *     (rule 4 above; the pace signal must always be visible).
+ */
+export function buildBar(pct: number, elapsedFrac: number): string {
+  const clampedPct = Math.max(0, Math.min(100, pct));
+  const fillCount = Math.round((clampedPct / 100) * BAR_WIDTH);
+  const cells: string[] = new Array(BAR_WIDTH).fill('░');
+  for (let i = 0; i < fillCount; i++) cells[i] = '█';
+  const tickIndex = Math.max(
+    0,
+    Math.min(BAR_WIDTH - 1, Math.round(elapsedFrac * (BAR_WIDTH - 1))),
+  );
+  cells[tickIndex] = '┃';
+  return cells.join('');
+}
+
+// ── account status (title-line suffix) ───────────────────────────────
+
+export type QuotaBarAccountStatus = 'active' | 'exhausted' | 'idle';
+
+/**
+ * Title-line status word. `active` wins over `exhausted` (the fleet's
+ * pinned account is reported as active even if the broker also flags it
+ * exhausted — matches the locked example where the operator wants to know
+ * WHICH account is live first, and its health second, from the two window
+ * rows underneath). Otherwise: `exhausted` if the broker's own flag says
+ * so, else `idle` (present, healthy, just not the current pick).
+ */
+export function accountStatus(isActive: boolean, exhausted: boolean): QuotaBarAccountStatus {
+  if (isActive) return 'active';
+  if (exhausted) return 'exhausted';
+  return 'idle';
+}
+
+// ── row / block assembly ─────────────────────────────────────────────
+
+/** One `- <dot> <window> \`[<bar>] <pct>% / <time-left>\`` line. */
+export function formatWindowRow(
+  window: '5h' | '7d',
+  pct: number,
+  resetAt: Date | null,
+  now: Date = new Date(),
+): string {
+  const windowMs = window === '5h' ? FIVE_HOUR_MS : SEVEN_DAY_MS;
+  const dot = pickDot(pct);
+  const bar = buildBar(pct, elapsedFraction(resetAt, windowMs, now));
+  const pctStr = `${Math.round(Math.max(0, Math.min(100, pct)))}%`;
+  const timeLeft = formatTimeLeft(resetAt, now);
+  return `- ${dot} ${window} \`[${bar}] ${pctStr} / ${timeLeft}\``;
+}
+
+/** One account's title line + its two window rows (5h then 7d). */
+export function renderQuotaBarAccount(
+  label: string,
+  isActive: boolean,
+  exhausted: boolean,
+  quota: QuotaUtilization | null,
+  now: Date = new Date(),
+  demo = false,
+): string[] {
+  const status = accountStatus(isActive, exhausted);
+  // Title line wraps `label` in GFM `**bold**`, NOT a code span — so this
+  // needs `escapeMarkdown` (backslash-escapes *, _, [, ], etc.), not
+  // `codeSpanSafe` (which only defuses backticks and is only correct
+  // inside literal `code spans` — see format.ts). Using codeSpanSafe here
+  // was a bug: a label containing e.g. `**` or `[x](url)` would break the
+  // bold run or inject a markdown link into the card.
+  const displayLabel = demo ? maskEmail(label) : label;
+  const lines: string[] = [`- **${escapeMarkdown(displayLabel)}** (${status})`];
+  if (!quota || isProbeThin(quota)) {
+    // Data-quality gap. A failed / thin probe carries NO real utilization
+    // signal, so it must NOT render as a healthy 🟢 0% bar — that's
+    // indistinguishable from a fresh account with full headroom, which was
+    // the #2959 review's blocking bug. Emit a distinct ⚠️ warning row per
+    // window with a "no data" label (thin vs failed) instead of a fake bar,
+    // keeping two rows so the block stays shape-stable.
+    const reason = !quota ? 'no data — probe failed' : 'no data — thin probe';
+    lines.push(`- ⚠️ 5h \`${reason}\``);
+    lines.push(`- ⚠️ 7d \`${reason}\``);
+    return lines;
+  }
+  const norm = refillNormalizedUtils(quota, now);
+  lines.push(formatWindowRow('5h', norm.fiveHourUtilizationPct, quota.fiveHourResetAt, now));
+  lines.push(formatWindowRow('7d', norm.sevenDayUtilizationPct, quota.sevenDayResetAt, now));
+  return lines;
+}
+
+export interface QuotaBarRenderOpts {
+  now?: Date;
+  /** Demo mode (the `/usage demo` suffix) — masks account-email labels. */
+  demo?: boolean;
+}
+
+/**
+ * Relative-age stamp for the freshness footer: "0s ago", "3m ago". Measured
+ * against `now` so tests with an injected clock get deterministic output.
+ * (Mirrors `formatAgeStamp` in auth-snapshot-format.ts, which is not exported.)
+ */
+function formatAgeStamp(atMs: number, now: Date = new Date()): string {
+  const ageSec = Math.max(0, Math.round((now.getTime() - atMs) / 1000));
+  return ageSec < 60 ? `${ageSec}s ago` : `${Math.round(ageSec / 60)}m ago`;
+}
+
+export interface UsageCardRenderOpts extends QuotaBarRenderOpts {
+  /**
+   * The probe-on-open attempted a live refresh but it FAILED (or hit the TTL),
+   * so the card is served off the durable cache. When set, the footer shows an
+   * explicit "⚠ cached Nm ago" warning (age from this `capturedAt`) instead of
+   * a false live stamp. Takes precedence over `liveProbedAtMs`. Restores the
+   * signal `renderAuthSnapshotFormat2` carried before /usage went bar-only.
+   */
+  staleCachedAtMs?: number;
+  /** Timestamp of the most recent live probe; renders "Live · refreshed Nm
+   *  ago" when no stale-cache marker applies. Omit to render a bare "Live".
+   *  Do NOT set this when the probe failed and no live data was obtained —
+   *  set `probeFailed: true` instead so the footer doesn't claim "Live". */
+  liveProbedAtMs?: number;
+  /**
+   * True when the live probe returned no usable data for ANY account (the
+   * probe threw / timed out / returned zero rows, AND nothing was served
+   * from cache either). The footer then renders an explicit `⚠ probe failed
+   * — no live data` instead of a false "Live" stamp. Subscription-honesty:
+   * the /usage card exists to tell the operator the truth about quota state,
+   * so a footer that says "Live" while every row shows "⚠️ no data" is the
+   * exact lie this flag closes. Takes precedence over `liveProbedAtMs`;
+   * `staleCachedAtMs` (cache-served data) still takes precedence over this
+   * because in that case there IS real data, just stale.
+   */
+  probeFailed?: boolean;
+}
+
+/**
+ * Render the full multi-account quota-bar block from `AccountSnapshot[]`
+ * (the same shape `auth-snapshot-format.ts` builds — reuse
+ * `buildSnapshotsFromCachedState` / `buildSnapshotsFromState` /
+ * `quotaBarSnapshotsFromListState` to get one).
+ *
+ * Additionally needs each account's `exhausted` flag (not carried on
+ * `AccountSnapshot`), passed as a parallel lookup keyed by label.
+ */
+export function renderQuotaBarBlock(
+  snapshots: AccountSnapshot[],
+  exhaustedByLabel: ReadonlyMap<string, boolean>,
+  opts: QuotaBarRenderOpts = {},
+): string {
+  const now = opts.now ?? new Date();
+  const demo = opts.demo ?? false;
+  const lines: string[] = [];
+  for (const snap of snapshots) {
+    const exhausted = exhaustedByLabel.get(snap.label) ?? false;
+    lines.push(
+      ...renderQuotaBarAccount(snap.label, snap.isActive, exhausted, snap.quota, now, demo),
+    );
+  }
+  return lines.join('\n');
+}
+
+/**
+ * Convenience one-shot: build the quota-bar block directly from the shape
+ * `switchroom auth list --json` prints (`ListStateData`), using each
+ * account's cached `last_quota` (no live probe — same cache path
+ * `buildSnapshotsFromCachedState` uses). This is what the CLI script
+ * entrypoint (`scripts/print-quota-bar.ts`) calls.
+ */
+export function renderQuotaBarBlockFromListState(
+  state: ListStateData,
+  opts: QuotaBarRenderOpts = {},
+): string {
+  const now = opts.now ?? new Date();
+  const exhaustedByLabel = new Map<string, boolean>(
+    state.accounts.map((a: AccountState) => [a.label, a.exhausted]),
+  );
+  const snapshots: AccountSnapshot[] = state.accounts.map((acc: AccountState) => ({
+    label: acc.label,
+    isActive: acc.label === state.active,
+    quota: reviveLastQuota(acc.last_quota ?? null),
+    quotaError: acc.last_quota ? undefined : 'no cached quota (no probe since broker start)',
+    expiresAtMs: acc.expiresAt,
+    capturedAtMs: acc.last_quota?.capturedAt,
+  }));
+  return renderQuotaBarBlock(snapshots, exhaustedByLabel, { now });
+}
+
+/**
+ * The live `/usage` card — the compact quota-bar block, and ONLY the bar
+ * block. `/usage` used to append the full Format 2 health-grouped table
+ * (`renderAuthSnapshotFormat2`) underneath; the operator asked for the bar
+ * card alone (2026-07-10) since the two views were redundant and the table
+ * doubled the message length. Every field the table carried per-account
+ * (5h/7d utilization + reset) has an equivalent in the bar rows — the `pct%
+ * / <time-left>` segment of each window row is the reset info, just
+ * relative instead of absolute. `opts.now` is shared with the bar block;
+ * `opts.demo` masks account-email labels in the title line the same way the
+ * table used to.
+ *
+ * Footer: after the bar rows, two footer lines are appended —
+ *   1. the synthesized cross-account "switch now" verdict (`recommendation`,
+ *      shared with the /auth snapshot) — the single most actionable line,
+ *      dropped when /usage went bar-only and restored here (#2959 review).
+ *   2. a freshness marker — `⚠ cached Nm ago` when the data was served stale
+ *      from cache (`staleCachedAtMs`), else `Live · refreshed Nm ago` /
+ *      `Live` — so a cache-served card is never mistaken for a live one.
+ */
+export function renderUsageCard(
+  snapshots: AccountSnapshot[],
+  exhaustedByLabel: ReadonlyMap<string, boolean>,
+  opts: UsageCardRenderOpts = {},
+): string {
+  const now = opts.now ?? new Date();
+  const demo = opts.demo ?? false;
+  const bar = renderQuotaBarBlock(snapshots, exhaustedByLabel, { now, demo });
+  const lines = [bar];
+  // Actionable cross-account verdict — restored from renderAuthSnapshotFormat2.
+  lines.push(`_${recommendation(snapshots, now, demo)}_`);
+  // Freshness signal: stale-cache warning takes precedence over a live stamp,
+  // which takes precedence over an explicit probe-failed marker (no live data
+  // AND no cache — the card is showing "⚠️ no data" rows, so "Live" would be
+  // a lie). The probeFailed branch is the honesty backstop: without it, a
+  // total probe failure rendered a bare `_Live_` footer next to no-data rows.
+  if (opts.staleCachedAtMs != null) {
+    lines.push(`_⚠ cached ${formatAgeStamp(opts.staleCachedAtMs, now)}_`);
+  } else if (opts.liveProbedAtMs != null) {
+    lines.push(`_Live · refreshed ${formatAgeStamp(opts.liveProbedAtMs, now)}_`);
+  } else if (opts.probeFailed) {
+    lines.push('_⚠ probe failed — no live data_');
+  } else {
+    lines.push('_Live_');
+  }
+  return lines.join('\n');
+}

package/telegram-plugin/subagent-watcher.ts

@@ -918,8 +918,8 @@ export function readSubTail(
       // (stage-on-text, resolve-on-tool/turn_end) can replay a previously
       // pending block exactly once. `latestSummary` carries the worker's
       // narrative result (entry.lastResultText), never tool labels.
-      const fireNarrativeProgress = (): void => {
-        if (onProgress == null || entry.state !== 'running' || entry.historical) return
+      const fireNarrativeProgress = (): boolean => {
+        if (onProgress == null || entry.state !== 'running' || entry.historical) return false
         try {
           onProgress({
             agentId: entry.agentId,
@@ -933,8 +933,10 @@ export function readSubTail(
             lastTool: entry.lastTool,
             toolCount: entry.toolCount,
           })
+          return true
         } catch (cbErr) {
           log?.(`subagent-watcher: onProgress callback error ${entry.agentId}: ${(cbErr as Error).message}`)
+          return false
         }
       }
       // Resolve a pending sub-agent narrative against a lookahead event.
@@ -952,21 +954,27 @@ export function readSubTail(
       //     compare the trailing block against the worker's last reply text
       //     (`entry.lastReplyText`) and suppress a draft. Background workers
       //     never set lastReplyText, so their trailing narration still SHOWs.
+      // Returns true iff a narrative onProgress cue actually fired this
+      // call — callers use this to skip a redundant/clobbering tool-label
+      // onProgress cue for the SAME tick (see #1042 below: without this,
+      // the tool-description onProgress unconditionally fires right after
+      // and its replace-on-write onProgress always wins, so the narration
+      // shown here is never actually visible on the pinned card).
       const resolvePendingSubNarrative = (
         toolName: string | null,
         toolInput: Record<string, unknown> | undefined,
-      ): void => {
-        if (entry.pendingNarrative == null) return
+      ): boolean => {
+        if (entry.pendingNarrative == null) return false
         const pending = entry.pendingNarrative
         entry.pendingNarrative = null
         if (toolName != null && REPLY_TOOLS.has(toolName)) {
           const replyText = typeof toolInput?.text === 'string' ? (toolInput.text as string) : ''
-          if (isDraftOfReply(pending.text, replyText)) return // draft of the reply → SUPPRESS
+          if (isDraftOfReply(pending.text, replyText)) return false // draft of the reply → SUPPRESS
         } else if (toolName == null && entry.lastReplyText != null && entry.lastReplyText.length > 0) {
           // turn_end path: suppress a trailing draft of the delivered answer.
-          if (isDraftOfReply(pending.text, entry.lastReplyText)) return
+          if (isDraftOfReply(pending.text, entry.lastReplyText)) return false
         }
-        fireNarrativeProgress()
+        return fireNarrativeProgress()
       }
       for (const ev of events) {
         const idleSecBeforeBump = Math.round((now - entry.lastActivityAt) / 1000)
@@ -1012,7 +1020,7 @@ export function readSubTail(
           // this tool is the lookahead that decides it (SHOW unless it drafts
           // a reply tool's text). Runs before the tool's own progress cue so
           // a working preamble surfaces just ahead of its tool step.
-          resolvePendingSubNarrative(ev.toolName, ev.input)
+          const narrativeJustFired = resolvePendingSubNarrative(ev.toolName, ev.input)
           // NIT 3: capture a foreground sub-agent's actual reply text so the
           // turn_end path can suppress a trailing draft of it (see
           // resolvePendingSubNarrative). Only REPLY_TOOLS carry the answer.
@@ -1039,7 +1047,17 @@ export function readSubTail(
           // stays the worker's narrative result (never polluted with tool
           // labels — the handback payload depends on it). Pure jsonl-tail →
           // render, no model call.
-          if (onProgress != null && entry.state === 'running' && !entry.historical) {
+          //
+          // Clobber guard: if a pending narrative just fired an onProgress
+          // cue THIS SAME tick (above), skip this one — replace-on-write
+          // rendering means whichever onProgress call fires last wins, so
+          // firing both back-to-back always threw away the narration in
+          // favour of the generic tool label. Narration already told the
+          // user what's happening for this tick; the label is redundant
+          // here. When nothing preceded this tool call (no pending
+          // narrative), this still fires — that's the named foreground
+          // blindspot fix, unchanged.
+          if (onProgress != null && entry.state === 'running' && !entry.historical && !narrativeJustFired) {
             const toolLine = describeToolUse(ev.toolName, ev.input ?? {})
             if (toolLine != null && toolLine.length > 0) {
               try {

package/telegram-plugin/tests/auth-snapshot-format.test.ts

@@ -431,6 +431,27 @@ describe('renderAuthSnapshotFormat2', () => {
     expect(out).not.toContain('Live · refreshed');
   });
 
+  it('#2959 honesty fix — probeFailed renders an explicit marker instead of a false bare "Live" footer', () => {
+    // Total probe failure: no rows, no cache. The footer must not claim
+    // "Live" next to no-data rows. Pre-fix this rendered a bare `_Live_`.
+    const out = renderAuthSnapshotFormat2(fixtureSnaps.slice(0, 1), {
+      now: NOW,
+      probeFailed: true,
+    });
+    expect(out).toContain('_⚠ probe failed — no live data_');
+    expect(out).not.toContain('_Live_');
+  });
+
+  it('#2959 honesty fix — staleCachedAtMs (real cached data) takes precedence over probeFailed', () => {
+    const out = renderAuthSnapshotFormat2(fixtureSnaps.slice(0, 1), {
+      now: NOW,
+      staleCachedAtMs: NOW.getTime() - 2 * 60_000,
+      probeFailed: true,
+    });
+    expect(out).toContain('⚠ cached 2m ago');
+    expect(out).not.toContain('probe failed');
+  });
+
   // ── demo mode (the `/usage demo` / `/auth demo` suffix) ──────────────
   describe('demo mode masks email labels', () => {
     it('WITHOUT demo, the real account emails still render', () => {

package/telegram-plugin/tests/gateway-boot-marker-clear.test.ts

@@ -43,7 +43,7 @@ describe('gateway boot — clear stale turn-active marker', () => {
     // window to ~5KB so we don't pick up the unrelated
     // `removeTurnActiveMarker` call in the onTurnComplete handler
     // way down at the bottom of the file.
-    const setupWindow = GATEWAY_SRC.slice(setupBlockStart, setupBlockStart + 7000)
+    const setupWindow = GATEWAY_SRC.slice(setupBlockStart, setupBlockStart + 9000)
     const clearMatches = setupWindow.match(/removeTurnActiveMarker\s*\(\s*STATE_DIR\s*\)/g) ?? []
     expect(clearMatches.length).toBe(1)
   })
@@ -53,7 +53,7 @@ describe('gateway boot — clear stale turn-active marker', () => {
     // must not prevent the gateway from coming up. Pin the try-wrapping
     // to make sure a future refactor doesn't drop it.
     const setupBlockStart = GATEWAY_SRC.indexOf('if (!didOneTimeSetup)')
-    const setupWindow = GATEWAY_SRC.slice(setupBlockStart, setupBlockStart + 7000)
+    const setupWindow = GATEWAY_SRC.slice(setupBlockStart, setupBlockStart + 9000)
     expect(setupWindow).toMatch(/try\s*\{\s*removeTurnActiveMarker\(STATE_DIR\)\s*\}\s*catch/)
   })
 
@@ -62,7 +62,7 @@ describe('gateway boot — clear stale turn-active marker', () => {
     // Clearing the marker first means the watchdog sees a clean slate
     // immediately, even if pin sweep takes 30s+ to finish.
     const setupBlockStart = GATEWAY_SRC.indexOf('if (!didOneTimeSetup)')
-    const setupWindow = GATEWAY_SRC.slice(setupBlockStart, setupBlockStart + 7000)
+    const setupWindow = GATEWAY_SRC.slice(setupBlockStart, setupBlockStart + 9000)
     const clearIdx = setupWindow.indexOf('removeTurnActiveMarker(STATE_DIR)')
     const pinSweepIdx = setupWindow.indexOf('Boot-time pin sweep')
     expect(clearIdx).toBeGreaterThan(0)

package/telegram-plugin/tests/operator-events.test.ts

@@ -253,6 +253,21 @@ describe('renderOperatorEvent — unknown-5xx', () => {
   })
 })
 
+describe('renderOperatorEvent — config-warning', () => {
+  it('is framed as non-urgent (dismiss-only, no restart/reauth/logs actions)', () => {
+    const { text, keyboard } = renderOperatorEvent(
+      makeEvent('config-warning', { detail: 'person_id: dropped 1 malformed users: entry at boot — lisa (empty person_id)' }),
+    )
+    expect(text).toContain('Config warning')
+    expect(text).toContain('Non-urgent')
+    const buttons = keyboard.inline_keyboard.flat()
+    expect(buttons.every(b => b.callback_data?.includes('dismiss'))).toBe(true)
+    expect(buttons.some(b => b.callback_data?.includes('restart'))).toBe(false)
+    expect(buttons.some(b => b.callback_data?.includes('reauth'))).toBe(false)
+    expect(buttons.some(b => b.callback_data?.includes('logs'))).toBe(false)
+  })
+})
+
 describe('renderOperatorEvent — markdown escaping (#2669)', () => {
   it('passes < > literally in agent name (markdown, #2669)', () => {
     const { text } = renderOperatorEvent(makeEvent('unknown-4xx', { agent: '<evil>' }))
@@ -276,6 +291,7 @@ describe('renderOperatorEvent — all kinds produce valid keyboard structure', (
     'agent-restarted-unexpectedly',
     'unknown-4xx',
     'unknown-5xx',
+    'config-warning',
   ]
 
   for (const kind of allKinds) {