switchroom 0.18.3 → 0.18.6

package/telegram-plugin/tests/resolve-person.test.ts

@@ -0,0 +1,290 @@
+import { describe, it, expect, vi } from 'vitest'
+import {
+  buildPersonDirectory,
+  resolvePersonName,
+  runPersonDirectoryBootCheck,
+  safeResolvePersonName,
+  type PersonDirectory,
+  type RawPersonEntry,
+} from '../gateway/resolve-person.js'
+
+/**
+ * Telegram person_id name resolution (docs/configuration.md).
+ *
+ * Covers the requirements from the converged design:
+ *   - happy-path resolution
+ *   - unresolved-id fallback (fail-open)
+ *   - a malformed single entry is dropped WITHOUT affecting others
+ *   - chat-scoping: a name is shown only in a chat/group the person is a
+ *     member of (per that chat's allowFrom), never broadcast into every
+ *     chat
+ *   - boot-time validation alert firing on bad config
+ *   - validation-step-crash alert firing (dead-man's-switch)
+ */
+
+const LISA: RawPersonEntry = { key: 'lisa', person_id: 'Lisa', telegram_ids: ['8201250670'] }
+const KEN: RawPersonEntry = { key: 'ken', person_id: 'Ken', telegram_ids: ['mekenthompson', '111'] }
+
+describe('buildPersonDirectory — happy path', () => {
+  it('resolves a single well-formed entry', () => {
+    const { directory, dropped } = buildPersonDirectory([LISA])
+    expect(dropped).toEqual([])
+    expect(directory.byTelegramKey['8201250670']?.personId).toBe('Lisa')
+  })
+
+  it('resolves multiple entries, multiple telegram_ids each, case/@-insensitive', () => {
+    const { directory, dropped } = buildPersonDirectory([LISA, KEN])
+    expect(dropped).toEqual([])
+    expect(directory.byTelegramKey['8201250670']?.personId).toBe('Lisa')
+    expect(directory.byTelegramKey['mekenthompson']?.personId).toBe('Ken')
+    expect(directory.byTelegramKey['111']?.personId).toBe('Ken')
+    // username lookups are normalized: leading "@" stripped, lowercased
+    expect(directory.byTelegramKey['@MeKenThompson'.trim().replace(/^@/, '').toLowerCase()]?.personId).toBe('Ken')
+  })
+
+  it('no entries → empty directory (fleet behaves as today)', () => {
+    const { directory, dropped } = buildPersonDirectory([])
+    expect(directory.byTelegramKey).toEqual({})
+    expect(dropped).toEqual([])
+  })
+})
+
+describe('buildPersonDirectory — per-entry validation drops only the bad entry', () => {
+  it('drops an entry with an empty person_id, keeps the other entry intact', () => {
+    const bad: RawPersonEntry = { key: 'ghost', person_id: '', telegram_ids: ['999'] }
+    const { directory, dropped } = buildPersonDirectory([LISA, bad])
+    expect(directory.byTelegramKey['8201250670']?.personId).toBe('Lisa')
+    expect(directory.byTelegramKey['999']).toBeUndefined()
+    expect(dropped).toHaveLength(1)
+    expect(dropped[0]?.key).toBe('ghost')
+    expect(dropped[0]?.reason).toMatch(/person_id/)
+  })
+
+  it('drops an entry with no telegram_ids, keeps the other entry intact', () => {
+    const bad: RawPersonEntry = { key: 'ghost', person_id: 'Ghost', telegram_ids: [] }
+    const { directory, dropped } = buildPersonDirectory([LISA, bad])
+    expect(directory.byTelegramKey['8201250670']?.personId).toBe('Lisa')
+    expect(dropped).toHaveLength(1)
+    expect(dropped[0]?.key).toBe('ghost')
+    expect(dropped[0]?.reason).toMatch(/telegram_ids/)
+  })
+
+  it('drops a duplicate person_id (later entry loses), keeps the first entry intact', () => {
+    const dupe: RawPersonEntry = { key: 'lisa2', person_id: 'Lisa', telegram_ids: ['555'] }
+    const { directory, dropped } = buildPersonDirectory([LISA, dupe])
+    expect(directory.byTelegramKey['8201250670']?.personId).toBe('Lisa')
+    expect(directory.byTelegramKey['555']).toBeUndefined()
+    expect(dropped).toHaveLength(1)
+    expect(dropped[0]?.key).toBe('lisa2')
+    expect(dropped[0]?.reason).toMatch(/duplicate person_id/)
+  })
+
+  it('drops a duplicate telegram_id claimed by a different person_id (later entry loses), keeps the first entry intact — no silent last-write-wins', () => {
+    const dupe: RawPersonEntry = { key: 'imposter', person_id: 'Imposter', telegram_ids: ['8201250670'] }
+    const { directory, dropped } = buildPersonDirectory([LISA, dupe])
+    expect(directory.byTelegramKey['8201250670']?.personId).toBe('Lisa')
+    expect(dropped).toHaveLength(1)
+    expect(dropped[0]?.key).toBe('imposter')
+    expect(dropped[0]?.reason).toMatch(/duplicate telegram_id/)
+  })
+
+  it('telegram_id collision on boot check fires the config-warning alert path, does not blank the whole directory', () => {
+    const dupe: RawPersonEntry = { key: 'imposter', person_id: 'Imposter', telegram_ids: ['8201250670'] }
+    const result = runPersonDirectoryBootCheck(() => [LISA, KEN, dupe])
+    expect(result.alertDetail).not.toBeNull()
+    expect(result.alertDetail).toContain('imposter')
+    expect(result.directory.byTelegramKey['8201250670']?.personId).toBe('Lisa')
+    expect(result.directory.byTelegramKey['mekenthompson']?.personId).toBe('Ken')
+  })
+
+  // ── #2957 honesty fix: broadcast alertDetail must not surface the
+  //    person_id human-name value (the display path chat-scopes names;
+  //    the config-warning card fans out to EVERY allowFrom chat, incl.
+  //    groups where the named person may not be a member). The verbose
+  //    reason stays in the private logLine. ─────────────────────────
+  it('duplicate person_id: alertDetail scrubs the person_id value (keeps key + class); logLine keeps it', () => {
+    const dupe: RawPersonEntry = { key: 'lisa2', person_id: 'Lisa', telegram_ids: ['555'] }
+    const result = runPersonDirectoryBootCheck(() => [LISA, dupe])
+    expect(result.alertDetail).not.toBeNull()
+    // Broadcast-safe: names the losing config key + the collision class,
+    // but NOT the human-name "Lisa" value nor which name it collided with.
+    expect(result.alertDetail).toContain('lisa2')
+    expect(result.alertDetail).toContain('duplicate person_id already claimed')
+    expect(result.alertDetail).not.toContain('"Lisa"')
+    // Private stderr log keeps the verbose detail.
+    expect(result.logLine).toContain('"Lisa"')
+  })
+
+  it('duplicate telegram_id: alertDetail scrubs the colliding id; logLine keeps it', () => {
+    const dupe: RawPersonEntry = { key: 'imposter', person_id: 'Imposter', telegram_ids: ['8201250670'] }
+    const result = runPersonDirectoryBootCheck(() => [LISA, dupe])
+    expect(result.alertDetail).not.toBeNull()
+    expect(result.alertDetail).toContain('imposter')
+    expect(result.alertDetail).toContain('duplicate telegram_id already claimed')
+    // The colliding telegram id value is scrubbed from the broadcast.
+    expect(result.alertDetail).not.toContain('8201250670')
+    expect(result.logLine).toContain('8201250670')
+  })
+
+  it('drops an entry with a missing users: map key', () => {
+    const bad: RawPersonEntry = { key: '', person_id: 'Nobody', telegram_ids: ['1'] }
+    const { directory, dropped } = buildPersonDirectory([LISA, bad])
+    expect(directory.byTelegramKey['8201250670']?.personId).toBe('Lisa')
+    expect(dropped).toHaveLength(1)
+    expect(dropped[0]?.reason).toMatch(/users: map key/)
+  })
+
+  it('multiple malformed entries each get their own drop reason, valid entries unaffected', () => {
+    const bad1: RawPersonEntry = { key: 'a', person_id: '', telegram_ids: ['1'] }
+    const bad2: RawPersonEntry = { key: 'b', person_id: 'B', telegram_ids: [] }
+    const { directory, dropped } = buildPersonDirectory([LISA, bad1, KEN, bad2])
+    expect(dropped).toHaveLength(2)
+    expect(directory.byTelegramKey['8201250670']?.personId).toBe('Lisa')
+    expect(directory.byTelegramKey['mekenthompson']?.personId).toBe('Ken')
+  })
+})
+
+describe('resolvePersonName — unresolved id falls back (fail-open)', () => {
+  it('returns undefined for an id not in the directory', () => {
+    const { directory } = buildPersonDirectory([LISA])
+    const name = resolvePersonName(directory, { telegramId: '000', isDm: true })
+    expect(name).toBeUndefined()
+  })
+
+  it('returns undefined for an empty directory', () => {
+    const { directory } = buildPersonDirectory([])
+    const name = resolvePersonName(directory, { telegramId: '8201250670', isDm: true })
+    expect(name).toBeUndefined()
+  })
+})
+
+describe('resolvePersonName — chat scoping', () => {
+  const { directory } = buildPersonDirectory([LISA])
+
+  it('DM: always resolves (the chat IS the sender)', () => {
+    const name = resolvePersonName(directory, { telegramId: '8201250670', isDm: true })
+    expect(name).toBe('Lisa')
+  })
+
+  it('group: resolves when the sender is present in that chat\'s allowFrom', () => {
+    const name = resolvePersonName(directory, {
+      telegramId: '8201250670',
+      isDm: false,
+      groupAllowFrom: ['8201250670', '111'],
+    })
+    expect(name).toBe('Lisa')
+  })
+
+  it('group: does NOT resolve when allowFrom is empty/unset (can\'t confirm membership)', () => {
+    expect(resolvePersonName(directory, { telegramId: '8201250670', isDm: false })).toBeUndefined()
+    expect(resolvePersonName(directory, { telegramId: '8201250670', isDm: false, groupAllowFrom: [] })).toBeUndefined()
+  })
+
+  it('group: does NOT resolve when the sender is absent from that group\'s allowFrom (a name safe in a DM is not broadcast elsewhere)', () => {
+    const name = resolvePersonName(directory, {
+      telegramId: '8201250670',
+      isDm: false,
+      groupAllowFrom: ['111'], // some other member, not lisa
+    })
+    expect(name).toBeUndefined()
+  })
+
+  it('group: resolves via username when username (not id) is in allowFrom', () => {
+    const { directory: dir2 } = buildPersonDirectory([KEN])
+    const name = resolvePersonName(dir2, {
+      telegramId: '999999',
+      username: 'mekenthompson',
+      isDm: false,
+      groupAllowFrom: ['mekenthompson'],
+    })
+    expect(name).toBe('Ken')
+  })
+})
+
+describe('safeResolvePersonName — fail-open call-site wrapper used by handleInbound', () => {
+  it('happy path: resolves same as resolvePersonName when nothing throws', () => {
+    const { directory } = buildPersonDirectory([LISA])
+    const name = safeResolvePersonName(directory, { telegramId: '8201250670', isDm: true }, 'raw-fallback')
+    expect(name).toBe('Lisa')
+  })
+
+  it('unresolved id: falls back to the raw id/username, same as today\'s behavior', () => {
+    const { directory } = buildPersonDirectory([LISA])
+    const name = safeResolvePersonName(directory, { telegramId: '000', isDm: true }, 'raw-fallback')
+    expect(name).toBe('raw-fallback')
+  })
+
+  it('resolution throwing (e.g. a malformed opts shape at the call site) is swallowed — falls back to the raw id/username instead of propagating and aborting handleInbound', () => {
+    const { directory } = buildPersonDirectory([LISA])
+    // Force resolvePersonName's internal normalizeTelegramKey to throw by
+    // passing a non-string telegramId past the type system, simulating an
+    // unexpected runtime shape from the Telegram payload.
+    const name = safeResolvePersonName(
+      directory,
+      { telegramId: undefined as unknown as string, isDm: true },
+      'raw-fallback',
+    )
+    expect(name).toBe('raw-fallback')
+  })
+
+  it('a directory whose lookup throws is also swallowed, not propagated', () => {
+    const throwingDirectory: PersonDirectory = {
+      byTelegramKey: new Proxy(
+        {},
+        {
+          get() {
+            throw new Error('boom: directory lookup exploded')
+          },
+        },
+      ),
+    }
+    const spy = vi.fn()
+    try {
+      const name = safeResolvePersonName(throwingDirectory, { telegramId: '8201250670', isDm: true }, 'raw-fallback')
+      expect(name).toBe('raw-fallback')
+    } catch (err) {
+      spy(err)
+    }
+    expect(spy).not.toHaveBeenCalled()
+  })
+})
+
+describe('runPersonDirectoryBootCheck — one-time boot validation + alerting', () => {
+  it('happy path: no alert, directory populated', () => {
+    const result = runPersonDirectoryBootCheck(() => [LISA, KEN])
+    expect(result.alertDetail).toBeNull()
+    expect(result.directory.byTelegramKey['8201250670']?.personId).toBe('Lisa')
+    expect(result.logLine).toMatch(/boot validation ok/)
+  })
+
+  it('no entries configured: no alert (this is not an error)', () => {
+    const result = runPersonDirectoryBootCheck(() => [])
+    expect(result.alertDetail).toBeNull()
+    expect(result.directory.byTelegramKey).toEqual({})
+  })
+
+  it('dropped entry at boot fires an alert (routes through the caller\'s fleet-alert path) and still resolves the good entries', () => {
+    const bad: RawPersonEntry = { key: 'ghost', person_id: '', telegram_ids: ['1'] }
+    const result = runPersonDirectoryBootCheck(() => [LISA, bad])
+    expect(result.alertDetail).not.toBeNull()
+    expect(result.alertDetail).toContain('dropped 1')
+    expect(result.alertDetail).toContain('ghost')
+    expect(result.directory.byTelegramKey['8201250670']?.personId).toBe('Lisa')
+  })
+
+  it('dead-man\'s-switch: readEntries throwing is caught, reported via alertDetail, and PERSON_DIRECTORY falls back to empty (fail-open)', () => {
+    const result = runPersonDirectoryBootCheck(() => {
+      throw new Error('disk read exploded')
+    })
+    expect(result.alertDetail).not.toBeNull()
+    expect(result.alertDetail).toContain('crashed')
+    // alertDetail is broadcast to every allowFrom chat (incl. groups), so
+    // the raw error message — which may carry a host path or other detail
+    // — is scrubbed from it. The full message stays in the private logLine.
+    expect(result.alertDetail).not.toContain('disk read exploded')
+    expect(result.alertDetail).toContain('see gateway stderr for detail')
+    expect(result.directory.byTelegramKey).toEqual({})
+    expect(result.logLine).toContain('CRASHED')
+    expect(result.logLine).toContain('disk read exploded')
+  })
+})

package/telegram-plugin/tests/silent-end-interrupt-stop-integration.test.ts

@@ -190,6 +190,59 @@ describe('silent-end-interrupt-stop.mjs — integration', () => {
     expect(state.retryCount).toBe(SILENT_END_MAX_RETRIES)
   })
 
+  it('blocks + writes retryCount=1 when an early qualifying reply is followed by an undelivered verdict (trailing-content bug repro)', () => {
+    // Confirmed-incident shape: (1) a background-task notification
+    // arrives, (2) the agent calls reply ONCE early with a stale,
+    // notification-bearing ack ("running now" — disable_notification
+    // unset, so it satisfies isFinalAnswerReply regardless of length),
+    // (3) the agent then does more work and writes a large substantive
+    // verdict as plain assistant text with NO second reply call. Pre-fix,
+    // the hook's "reply called at least once this turn" check allowed
+    // this to slip through silently — the trailing verdict never reached
+    // the user. Post-fix the hook must block on this shape exactly like
+    // the zero-reply case.
+    const transcript = writeTranscript(tmp, [
+      ENQUEUE,
+      reply('running now'),
+      { type: 'assistant', message: { content: [{ type: 'tool_use', name: 'Bash', input: { command: 'ls' } }] } },
+      { type: 'assistant', message: { content: [{ type: 'tool_use', name: 'Read', input: { file_path: '/tmp/x' } }] } },
+      {
+        type: 'assistant',
+        message: { content: [{ type: 'text', text: 'Here is the actual verdict: ' + 'X'.repeat(300) }] },
+      },
+    ])
+    const r = runHook({
+      event: { session_id: 's1', transcript_path: transcript },
+      stateDir,
+    })
+    expect(r.status).toBe(0)
+    const out = JSON.parse(r.stdout)
+    expect(out.decision).toBe('block')
+    expect(out.reason).toMatch(/Send your final answer/)
+    const statePath = join(stateDir, 'silent-end-pending.json')
+    expect(existsSync(statePath)).toBe(true)
+    const state = JSON.parse(readFileSync(statePath, 'utf8'))
+    expect(state.retryCount).toBe(1)
+    expect(state.chatId).toBe('111')
+    expect(state.turnKey).toBe('111:_')
+  })
+
+  it('does NOT false-positive on a normal single-reply turn ending on the reply tool_use', () => {
+    const transcript = writeTranscript(tmp, [
+      ENQUEUE,
+      { type: 'assistant', message: { content: [{ type: 'text', text: 'Let me check.' }] } },
+      { type: 'assistant', message: { content: [{ type: 'tool_use', name: 'Bash', input: { command: 'ls' } }] } },
+      reply('Here is your answer.', { disable_notification: false }),
+    ])
+    const r = runHook({
+      event: { session_id: 's1', transcript_path: transcript },
+      stateDir,
+    })
+    expect(r.status).toBe(0)
+    expect(r.stdout.trim()).toBe('')
+    expect(existsSync(join(stateDir, 'silent-end-pending.json'))).toBe(false)
+  })
+
   it('NO_REPLY in transcript → allow stop, no state file written', () => {
     const transcript = writeTranscript(tmp, [
       ENQUEUE,

package/telegram-plugin/tests/silent-end-interrupt-stop-scan.test.ts

@@ -184,6 +184,144 @@ describe('scanTurnForFinalReply — final-reply detection', () => {
   })
 })
 
+// ── "at least once" bug regression — trailing content after an early
+//    qualifying reply must still block ────────────────────────────────
+
+describe('scanTurnForFinalReply — trailing undelivered content after an early qualifying reply (bug repro)', () => {
+  it('early notification-bearing ack + later substantive plain text → block (not "reply called once" amnesty)', () => {
+    // Repro of the confirmed incident: the agent (1) got a background-task
+    // notification, (2) called reply ONCE early with a short, stale ack —
+    // notification-bearing (disable_notification unset/false), which
+    // ALWAYS qualifies as "final" under isFinalAnswerReply regardless of
+    // text length — then (3) wrote a large substantive verdict as plain
+    // assistant text with NO second reply call. The pre-fix scan returned
+    // 'allow' on the first qualifying block and never looked further; the
+    // fix must walk the whole turn and catch the undelivered trailing text.
+    const text = jsonl(
+      ENQUEUE,
+      assistantToolUse('mcp__switchroom-telegram__reply', { text: 'running now' }),
+      assistantToolUse('Bash', { command: 'ls' }),
+      assistantToolUse('Read', { file_path: '/tmp/x' }),
+      assistantText('Here is the actual verdict after investigation: ' + 'X'.repeat(300)),
+    )
+    const r = scanTurnForFinalReply(text)
+    expect(r.decided).toBe('block')
+    expect(r.reason).toBe('trailing-text-after-reply')
+    // turnKey/chatId must still be populated so the gateway's retry
+    // bookkeeping works exactly as it does for the zero-reply block path.
+    expect(r.chatId).toBe('111')
+    expect(r.turnKey).toBe('111:_')
+  })
+
+  it('early qualifying reply + trailing SHORT pleasantry → allow (#2956 review: substance floor, no-spam)', () => {
+    // A short trailing text after a delivered reply (a closer like "let me
+    // know if you need anything else.") is NOT a dropped answer — it's a
+    // pleasantry the persona prompts discourage but which must not burn
+    // retry budget or force a redundant second reply. Only SUBSTANTIVE
+    // trailing text (≥ FINAL_ANSWER_MIN_CHARS) blocks. Pre-fix this
+    // false-positive blocked and re-prompted a healthy turn.
+    const text = jsonl(
+      ENQUEUE,
+      assistantToolUse('mcp__switchroom-telegram__reply', { text: 'ok', disable_notification: false }),
+      assistantText('actually, one more thing you should know'),
+    )
+    const r = scanTurnForFinalReply(text)
+    expect(r.decided).toBe('allow')
+  })
+
+it('early qualifying reply + trailing SUBSTANTIVE undelivered text (≥ floor) → block (at-least-once holds)', () => {
+    // The substance floor must NOT weaken the at-least-once guarantee for
+    // a real dropped answer: a long trailing verdict the model forgot to
+    // send still blocks. The trailing text here clears FINAL_ANSWER_MIN_CHARS.
+    const text = jsonl(
+      ENQUEUE,
+      assistantToolUse('mcp__switchroom-telegram__reply', { text: 'ok', disable_notification: false }),
+      assistantText('Here is the actual verdict after investigation: ' + 'X'.repeat(200)),
+    )
+    const r = scanTurnForFinalReply(text)
+    expect(r.decided).toBe('block')
+    expect(r.reason).toBe('trailing-text-after-reply')
+  })
+
+  it('final qualifying reply is the LAST content block → allow (healthy shape, no false positive)', () => {
+    const text = jsonl(
+      ENQUEUE,
+      assistantText('Let me check that.'),
+      assistantToolUse('Bash', { command: 'ls' }),
+      assistantToolUse('mcp__switchroom-telegram__reply', {
+        text: 'Here is your answer.',
+        disable_notification: false,
+      }),
+    )
+    const r = scanTurnForFinalReply(text)
+    expect(r.decided).toBe('allow')
+    expect(r.reason).toBe('final-reply')
+  })
+
+  it('turn ends on a tool_result with no trailing text at all → allow (not a normal-turn false positive)', () => {
+    // A turn whose very last assistant content is the delivering
+    // reply tool_use, followed only by a (user-role) tool_result line —
+    // never any further assistant text. Must not be flagged.
+    const text = jsonl(
+      ENQUEUE,
+      assistantToolUse('mcp__switchroom-telegram__reply', {
+        text: 'Done — here is the summary.',
+        disable_notification: false,
+      }),
+      JSON.stringify({ type: 'user', message: { content: [{ type: 'tool_result', content: 'ok' }] } }),
+    )
+    const r = scanTurnForFinalReply(text)
+    expect(r.decided).toBe('allow')
+    expect(r.reason).toBe('final-reply')
+  })
+
+  it('undelivered text sandwiched between two qualifying replies is superseded by the LATER reply → allow', () => {
+    const text = jsonl(
+      ENQUEUE,
+      assistantToolUse('mcp__switchroom-telegram__reply', { text: 'first answer', disable_notification: false }),
+      assistantText('actually let me reconsider that'),
+      assistantToolUse('mcp__switchroom-telegram__reply', { text: 'corrected final answer', disable_notification: false }),
+    )
+    const r = scanTurnForFinalReply(text)
+    expect(r.decided).toBe('allow')
+    expect(r.reason).toBe('final-reply')
+  })
+
+  it('explicit trailing NO_REPLY after an earlier qualifying reply overrides → allow (intentional final silence)', () => {
+    const text = jsonl(
+      ENQUEUE,
+      assistantToolUse('mcp__switchroom-telegram__reply', { text: 'draft answer', disable_notification: false }),
+      assistantText('actually, scrap that, nothing more to add\nNO_REPLY'),
+    )
+    const r = scanTurnForFinalReply(text)
+    expect(r.decided).toBe('allow')
+    expect(r.reason).toBe('silent-marker-text')
+  })
+
+  it('reverse case: an EARLIER NO_REPLY silence marker followed by later undelivered prose → block', () => {
+    // Mirror image of the "trailing NO_REPLY overrides" allow-case above.
+    // Here the model signals silence FIRST — as plain transcript text,
+    // not through the reply tool — and then keeps going, writing a real
+    // substantive answer afterward that it never sent through `reply` or
+    // `stream_reply`. The NO_REPLY marker is a "deliver" event (silence is
+    // a valid outcome), but it must not amnesty content written AFTER it,
+    // same failure shape as the original "at least once" bug: a naive scan
+    // that stops at the FIRST qualifying delivery/silence event would
+    // return 'allow' here and the trailing answer would be silently
+    // dropped. The fix's "last delivery event, then check for trailing
+    // text" walk must still catch this.
+    const text = jsonl(
+      ENQUEUE,
+      assistantText('Nothing to report right now.\nNO_REPLY'),
+      assistantToolUse('Bash', { command: 'ls' }),
+      assistantText('Wait, actually I found something you need to know: ' + 'Y'.repeat(300)),
+    )
+    const r = scanTurnForFinalReply(text)
+    expect(r.decided).toBe('block')
+    expect(r.reason).toBe('trailing-text-after-reply')
+  })
+})
+
 describe('scanTurnForFinalReply — silent-marker carve-out', () => {
   it('NO_REPLY → allow', () => {
     const text = jsonl(

package/telegram-plugin/tests/subagent-watcher.test.ts

@@ -575,6 +575,67 @@ describe('startSubagentWatcher', () => {
       expect(narrativeCues[0]).toContain('find the repo')
     })
 
+    it('narration-clobber regression: a narration cue immediately followed by its resolving tool_use in the same poll does NOT get overwritten by the tool-label cue', () => {
+      // Reproduces the bug: sub_agent_text ("On it...") + sub_agent_tool_use
+      // (Bash) land in the SAME jsonl-tail read, so both the narrative
+      // resolution (fireNarrativeProgress) and the tool-description
+      // onProgress fire within one loop iteration over `events`. Since the
+      // card renders replace-on-write, the tool-label call previously always
+      // clobbered the narration call that fired moments earlier — narration
+      // was staged and "SHOWN" per the dedup gate, but never actually
+      // visible on the pinned card. Assert only ONE onProgress cue fires for
+      // this tick, and it's the narration (progressLine == null), not the
+      // tool label.
+      const allCues: Array<{ progressLine?: string; latestSummary: string }> = []
+      const agentDir = join(tmpRoot, 'agent')
+      const subagentsDir = join(agentDir, '.claude', 'projects', 'p1', 'session-abc', 'subagents')
+      mkdirSync(subagentsDir, { recursive: true })
+      const jsonlPath = join(subagentsDir, 'agent-deadbeef.jsonl')
+      const h = startWatcherSync({
+        agentDir,
+        onProgress: ({ progressLine, latestSummary }) => {
+          allCues.push({ progressLine, latestSummary })
+        },
+      })
+      writeFileSync(jsonlPath, buildJSONL(subAgentUserMsg('Find the repo')))
+      h.poll()
+      // Narration text + its resolving tool_use appended and tailed together
+      // in a single poll — this is the "same tick" race.
+      appendFileSync(
+        jsonlPath,
+        buildJSONL(subAgentAssistantText('On it. Let me find the repo.'), subAgentToolUse('Bash', 'b1')),
+      )
+      h.poll()
+      expect(allCues.length).toBe(1)
+      expect(allCues[0].progressLine).toBeUndefined()
+      expect(allCues[0].latestSummary).toContain('find the repo')
+    })
+
+    it('unregressed: two sub_agent_tool_use events with no narration between them both still show tool labels (named foreground blindspot)', () => {
+      // Guards against the clobber-guard fix over-suppressing: narrativeJustFired
+      // must be false for a tool_use that has no preceding pending narrative,
+      // so back-to-back tool calls (a researcher reading files with no prose)
+      // must both still surface a progressLine.
+      const toolCues: Array<string | undefined> = []
+      const agentDir = join(tmpRoot, 'agent')
+      const subagentsDir = join(agentDir, '.claude', 'projects', 'p1', 'session-abc', 'subagents')
+      mkdirSync(subagentsDir, { recursive: true })
+      const jsonlPath = join(subagentsDir, 'agent-deadbeef.jsonl')
+      const h = startWatcherSync({
+        agentDir,
+        onProgress: ({ progressLine }) => {
+          if (progressLine != null) toolCues.push(progressLine)
+        },
+      })
+      writeFileSync(jsonlPath, buildJSONL(subAgentUserMsg('Find the repo')))
+      h.poll()
+      appendFileSync(jsonlPath, buildJSONL(subAgentToolUse('Bash', 'b1')))
+      h.poll()
+      appendFileSync(jsonlPath, buildJSONL(subAgentToolUse('Bash', 'b2')))
+      h.poll()
+      expect(toolCues.length).toBe(2)
+    })
+
     it('narrative gate: trailing narration at turn_end is SHOWN', () => {
       const narrativeCues: string[] = []
       const agentDir = join(tmpRoot, 'agent')

package/telegram-plugin/tests/unhandled-rejection-policy.test.ts

@@ -96,6 +96,25 @@ describe('classifyRejection — benign Telegram 400s', () => {
     )
     expect(classifyRejection(err)).toBe('log_only')
   })
+  it('returns "log_only" for "group chat was upgraded to a supergroup chat" (marko 2026-07-09, recurring 2026-06-07/2026-06-09)', () => {
+    // A send targeted a basic-group chat_id that Telegram had since
+    // migrated to a supergroup (new -100xxxxxxxxxx id). This crashed the
+    // ENTIRE gateway process (every agent/chat) over a single stale
+    // cached chat_id — the same root cause recurred three times across a
+    // month because the crash-on-leak behavior masked the underlying
+    // stale-id bug instead of just logging it. A migrated/invalid
+    // destination chat must never take down the whole gateway.
+    const err = grammyError(
+      400,
+      'Bad Request: group chat was upgraded to a supergroup chat',
+    )
+    expect(classifyRejection(err)).toBe('log_only')
+  })
+
+  it('returns "log_only" for "group chat was deactivated"', () => {
+    const err = grammyError(400, 'Bad Request: group chat was deactivated')
+    expect(classifyRejection(err)).toBe('log_only')
+  })
 })
 
 describe('classifyRejection — genuine errors still crash', () => {