switchroom 0.18.30 → 0.18.32

package/telegram-plugin/tests/fixtures/cutover-killswitch-probe.ts

@@ -1,75 +0,0 @@
-/**
- * Subprocess probe for the SWITCHROOM_DELIVERY_MACHINE_CUTOVER kill switch.
- *
- * The cutover env var is read at MODULE LOAD in both
- * `inbound-delivery-machine-dispatch.ts` and
- * `inbound-delivery-machine-shadow.ts`, so an in-process test can't flip it
- * after import (and bun's `vi` shim has no resetModules/stubEnv). The
- * cutover-flip test spawns this script under `bun` with the env it wants
- * and asserts the JSON verdict printed on stdout.
- *
- * Output: one JSON line —
- *   {
- *     dispatchEnabled, cutoverEnabled, shadowEnabled,
- *     sendCalls, buffered, setTurnStartedCalls, deliverResults
- *   }
- * after driving a fresh-turn inbound effect set through dispatchEffects
- * against a recording fake ctx.
- */
-
-import { dispatchEffects, isDispatchEnabled } from '../../gateway/inbound-delivery-machine-dispatch'
-import {
-  isDeliveryCutoverEnabled,
-  __shadowEnabledForTests,
-} from '../../gateway/inbound-delivery-machine-shadow'
-import { createPendingInboundBuffer } from '../../gateway/pending-inbound-buffer'
-import { createPendingPermissionBuffer } from '../../gateway/pending-permission-decisions'
-import { initialState, transition, type ChatKey } from '../../gateway/inbound-delivery-machine'
-
-const KEY = '111:_' as ChatKey
-const msg = { type: 'inbound', chatId: '111', messageId: 42, text: 'hello' }
-
-const alive = transition(initialState(), { kind: 'bridgeUp', at: 1000 }).state
-const { effects } = transition(alive, {
-  kind: 'inbound',
-  key: KEY,
-  msg: { msgId: 42, isSteering: false, payload: msg },
-  at: 2000,
-})
-
-let sendCalls = 0
-const buffer = createPendingInboundBuffer()
-let setTurnStartedCalls = 0
-const deliverResults: boolean[] = []
-
-dispatchEffects(effects, {
-  selfAgent: 'probe-agent',
-  ipcServer: {
-    sendToAgent: () => {
-      sendCalls++
-      return true
-    },
-  } as never,
-  pendingInboundBuffer: buffer,
-  inboundSpool: null,
-  pendingPermissionBuffer: createPendingPermissionBuffer(),
-  log: () => {},
-  onSetTurnStarted: () => {
-    setTurnStartedCalls++
-  },
-  onDeliverResult: (_k, ok) => {
-    deliverResults.push(ok)
-  },
-})
-
-process.stdout.write(
-  JSON.stringify({
-    dispatchEnabled: isDispatchEnabled(),
-    cutoverEnabled: isDeliveryCutoverEnabled(),
-    shadowEnabled: __shadowEnabledForTests(),
-    sendCalls,
-    buffered: buffer.drain('probe-agent').length,
-    setTurnStartedCalls,
-    deliverResults,
-  }) + '\n',
-)

package/telegram-plugin/tests/gate-parity-probe.test.ts

@@ -1,171 +0,0 @@
-/**
- * Drift-catching scaffolding for the inbound-delivery state-machine
- * cutover (#2794). The turn-in-flight gate is now machine-authoritative
- * (`isMachineInTurn`), but the legacy imperative `claudeBusyKeys` set is
- * still maintained in parallel. These tests assert the two AGREE on every
- * well-formed turn schedule, and pin the ONE intended divergence (the
- * orphan-dangle the machine self-heals) so future edits can't silently
- * introduce a dangerous `machine_over_holds` drift without turning a test
- * red.
- *
- * This is the "assertion that machine and shadow agree" from the #2794
- * time-box plan: it turns the standing triple-maintenance drift risk into
- * a CI gate.
- */
-
-import { describe, expect, it, beforeEach } from 'vitest'
-import {
-  shadowEmit,
-  isMachineInTurn,
-  __shadowResetForTests,
-} from '../gateway/inbound-delivery-machine-shadow.js'
-import { TURN_TTL_MS, type ChatKey } from '../gateway/inbound-delivery-machine.js'
-import {
-  gateParityDivergence,
-  isDangerousGateDivergence,
-  probeGateParity,
-} from '../gateway/gate-parity-probe.js'
-
-const KEY_A = '111:_' as ChatKey
-const KEY_B = '222:_' as ChatKey
-
-/**
- * Reference model of the imperative `claudeBusyKeys` set — a per-delivery
- * Set stamped on a fresh-turn delivery and deleted on the matching
- * turnEnd. This mirrors gateway.ts's markBusyKeyLockstep / claudeBusyKeys.delete
- * lifecycle closely enough to detect real drift in the gate view.
- */
-class BusyKeysModel {
-  private readonly keys = new Set<string>()
-  stampFreshTurn(key: string) {
-    this.keys.add(key)
-  }
-  endTurn(key: string) {
-    this.keys.delete(key)
-  }
-  get size() {
-    return this.keys.size
-  }
-}
-
-describe('gateParityDivergence classifier', () => {
-  it('agree → none (both idle, both busy)', () => {
-    expect(gateParityDivergence(false, 0)).toBe('none')
-    expect(gateParityDivergence(true, 1)).toBe('none')
-    expect(gateParityDivergence(true, 3)).toBe('none')
-  })
-
-  it('machine idle, busyKeys held → busykeys_dangle (benign self-heal)', () => {
-    expect(gateParityDivergence(false, 1)).toBe('busykeys_dangle')
-    expect(isDangerousGateDivergence('busykeys_dangle')).toBe(false)
-  })
-
-  it('machine in-flight, busyKeys empty → machine_over_holds (dangerous)', () => {
-    expect(gateParityDivergence(true, 0)).toBe('machine_over_holds')
-    expect(isDangerousGateDivergence('machine_over_holds')).toBe(true)
-  })
-
-  it('probeGateParity returns the machine value unchanged (no behaviour change)', () => {
-    const lines: string[] = []
-    const log = (l: string) => lines.push(l)
-    expect(probeGateParity(true, 1, log)).toBe(true)
-    expect(probeGateParity(false, 0, log)).toBe(false)
-    expect(probeGateParity(false, 1, log)).toBe(false)
-    expect(probeGateParity(true, 0, log)).toBe(true)
-    // Only the dangerous over-hold emits a drift line.
-    expect(lines).toHaveLength(1)
-    expect(lines[0]).toContain('gw-trace gate-drift kind=machine_over_holds')
-  })
-})
-
-describe('machine ↔ claudeBusyKeys parity on well-formed schedules', () => {
-  beforeEach(() => __shadowResetForTests())
-
-  it('single turn: agree at every step', () => {
-    const busy = new BusyKeysModel()
-    shadowEmit({ kind: 'bridgeUp', at: 1000 })
-    expect(gateParityDivergence(isMachineInTurn(), busy.size)).toBe('none')
-
-    // Fresh inbound → machine goes in_turn; imperative stamps the key.
-    shadowEmit({ kind: 'inbound', key: KEY_A, msg: { msgId: 1, isSteering: false, payload: null }, at: 2000 })
-    busy.stampFreshTurn(KEY_A)
-    expect(gateParityDivergence(isMachineInTurn(), busy.size)).toBe('none')
-    expect(isMachineInTurn()).toBe(true)
-
-    // turnEnd → both reopen.
-    shadowEmit({ kind: 'turnEnd', key: KEY_A, at: 3000, outboundEmitted: true })
-    busy.endTurn(KEY_A)
-    expect(gateParityDivergence(isMachineInTurn(), busy.size)).toBe('none')
-    expect(isMachineInTurn()).toBe(false)
-  })
-
-  it('sequential turns across two chats: no drift', () => {
-    const busy = new BusyKeysModel()
-    shadowEmit({ kind: 'bridgeUp', at: 1000 })
-
-    const schedule: Array<[ChatKey, number]> = [
-      [KEY_A, 2000],
-      [KEY_B, 4000],
-      [KEY_A, 6000],
-    ]
-    let t = 2000
-    for (const [key, start] of schedule) {
-      shadowEmit({ kind: 'inbound', key, msg: { msgId: t, isSteering: false, payload: null }, at: start })
-      busy.stampFreshTurn(key)
-      expect(gateParityDivergence(isMachineInTurn(), busy.size)).toBe('none')
-      shadowEmit({ kind: 'turnEnd', key, at: start + 500, outboundEmitted: true })
-      busy.endTurn(key)
-      expect(gateParityDivergence(isMachineInTurn(), busy.size)).toBe('none')
-      t = start + 500
-    }
-  })
-
-  it('mid-turn sibling inbound is buffered, not a new turn: parity holds', () => {
-    const busy = new BusyKeysModel()
-    shadowEmit({ kind: 'bridgeUp', at: 1000 })
-
-    shadowEmit({ kind: 'inbound', key: KEY_A, msg: { msgId: 1, isSteering: false, payload: null }, at: 2000 })
-    busy.stampFreshTurn(KEY_A)
-    // Sibling arrives mid-turn: machine buffers (no new activeTurn); the
-    // imperative gate is already busy so it does NOT stamp a fresh key.
-    shadowEmit({ kind: 'inbound', key: KEY_B, msg: { msgId: 2, isSteering: false, payload: null }, at: 2500 })
-    expect(gateParityDivergence(isMachineInTurn(), busy.size)).toBe('none')
-
-    shadowEmit({ kind: 'turnEnd', key: KEY_A, at: 3000, outboundEmitted: true })
-    busy.endTurn(KEY_A)
-    expect(gateParityDivergence(isMachineInTurn(), busy.size)).toBe('none')
-  })
-})
-
-describe('the ONE intended divergence: orphaned turnStart', () => {
-  beforeEach(() => __shadowResetForTests())
-
-  it('machine self-heals the dangle; imperative set holds the orphan (busykeys_dangle, benign)', () => {
-    const busy = new BusyKeysModel()
-    shadowEmit({ kind: 'bridgeUp', at: 1000 })
-
-    // Turn A opens; turn B opens before A's turnEnd ever lands. The
-    // imperative set stamps BOTH; only B's turnEnd arrives, leaving A as
-    // an orphan key — the gymbro/clerk 5-min dangle.
-    shadowEmit({ kind: 'turnStart', key: KEY_A, at: 2000 })
-    busy.stampFreshTurn(KEY_A)
-    shadowEmit({ kind: 'turnStart', key: KEY_B, at: 3000 })
-    busy.stampFreshTurn(KEY_B)
-    shadowEmit({ kind: 'turnEnd', key: KEY_B, at: 4000, outboundEmitted: true })
-    busy.endTurn(KEY_B)
-
-    // Machine still holds activeTurn=A (single-activeTurn); imperative
-    // holds A too → they agree here.
-    expect(gateParityDivergence(isMachineInTurn(), busy.size)).toBe('none')
-
-    // TTL tick past A's start: the machine self-heals to idle, but the
-    // imperative set NEVER gets A's turnEnd → orphan dangles forever.
-    shadowEmit({ kind: 'tick', now: 2000 + TURN_TTL_MS + 1 })
-    expect(isMachineInTurn()).toBe(false)
-    const d = gateParityDivergence(isMachineInTurn(), busy.size)
-    expect(d).toBe('busykeys_dangle')
-    // Benign: this is exactly the wedge the machine was made authoritative
-    // to kill — it must NOT trip the drift alarm.
-    expect(isDangerousGateDivergence(d)).toBe(false)
-  })
-})

package/telegram-plugin/tests/parallel-turns-deadlock-fix.test.ts

@@ -1,217 +0,0 @@
-import { describe, expect, it } from 'vitest'
-
-/**
- * PR3b regression pin: supergroup-mode parallel-turns deadlock fix.
- *
- * The bug. Pre-fix, the gateway used ONE map `activeTurnStartedAt`
- * for two distinct concerns:
- *   (a) "user-visible turn started" — set eagerly in the fresh-turn
- *       branch on inbound RECEIPT, used by per-key reads (status-query
- *       metric, wedge detection, progress timeout, etc.) that want a
- *       receipt-side timestamp.
- *   (b) "claude is currently busy on this turn" — the fleet-wide gate
- *       at purgeReactionTracking / releaseTurnBufferGate /
- *       idle-drain / inbound buffer-or-deliver, where `.size === 0`
- *       means "claude is idle, safe to flush buffered inbound."
- *
- * Under fleet-shared / DM topology the two concerns coincide — every
- * received inbound is delivered to claude — so the singleton worked.
- *
- * Under SUPERGROUP-OWNED topology (one agent owns the whole
- * supergroup, multiple topics share the gateway process), they
- * diverge:
- *
- *   1. Topic A delivers + processes — keyA in activeTurnStartedAt
- *      (set on receipt) AND claudeBusyKeys (set on delivery).
- *   2. Topic B inbound arrives → fresh-turn branch eagerly sets
- *      keyB in activeTurnStartedAt, displays 👀 / starts typing.
- *   3. `decideInboundDelivery` reads `turnInFlight = .size > 0` →
- *      TRUE (keyA present) → B is buffered, NOT delivered to claude.
- *   4. A's turn_end → purgeReactionTracking deletes keyA →
- *      `.size === 0` check fires the held-inbound flush. BUT under
- *      old (singleton) semantics, keyB is STILL in
- *      activeTurnStartedAt (set in step 2, never cleared because B
- *      never started in claude so no turn_end ever fires for B).
- *   5. `.size > 0` (keyB lingers) → flush never runs → B's buffered
- *      msg never delivered → B's user sees 👀 forever.
- *
- *   DEADLOCK.
- *
- * The fix splits concerns. `activeTurnStartedAt` keeps semantic (a)
- * — set on receipt, all per-key reads use it. `claudeBusyKeys` (new)
- * carries semantic (b) — set ONLY on successful sendToAgent
- * (delivery), cleared on turn_end / disconnect / buffer-gate-release.
- * Fleet gates switch to claudeBusyKeys. The deadlock breaks because
- * step 5's gate now reads `claudeBusyKeys.size` which only ever held
- * keyA (delivered) → after step 4's delete, size === 0 → flush →
- * B's buffered msg delivered → claudeBusyKeys.add(keyB) → ... →
- * B's eventual turn_end clears keyB.
- *
- * This test pins the load-bearing invariants. The actual wiring
- * lives in `gateway.ts` and `disconnect-flush.ts`; this file is the
- * structural-contract regression guard so a future "let's simplify
- * the gates back to one map" refactor fails loudly here.
- */
-
-describe('PR3b parallel-turns deadlock fix: claudeBusyKeys decoupled from activeTurnStartedAt', () => {
-  function makeState() {
-    const activeTurnStartedAt = new Map<string, number>()
-    const claudeBusyKeys = new Set<string>()
-    return { activeTurnStartedAt, claudeBusyKeys }
-  }
-
-  // Mirror the gateway's fresh-turn-on-receipt path (the part that
-  // updates the two maps). Stripped to ONLY the state mutations we
-  // care about for this invariant.
-  function receiveInbound(state: ReturnType<typeof makeState>, key: string, at: number): void {
-    state.activeTurnStartedAt.set(key, at)
-    // CRITICAL: claudeBusyKeys is NOT touched here. The whole point
-    // of the split is that receipt ≠ delivery.
-  }
-
-  function deliverToClaude(state: ReturnType<typeof makeState>, key: string): void {
-    // Mirror of markClaudeBusyForInbound at every successful
-    // sendToAgent callsite in gateway.ts.
-    state.claudeBusyKeys.add(key)
-  }
-
-  function turnEnd(state: ReturnType<typeof makeState>, key: string): void {
-    // Mirror of purgeReactionTracking + releaseTurnBufferGate —
-    // both maps cleared together at turn_end.
-    state.activeTurnStartedAt.delete(key)
-    state.claudeBusyKeys.delete(key)
-  }
-
-  function fleetGateOpen(state: ReturnType<typeof makeState>): boolean {
-    // Mirror of the four fleet-wide gates:
-    //   purgeReactionTracking line 1393:  if (claudeBusyKeys.size === 0)
-    //   releaseTurnBufferGate line 1484:  if (claudeBusyKeys.size === 0)
-    //   onScheduleRestart line 4020:      turnInFlight = .size > 0
-    //   idle-drain tick line 4343:        if (.size > 0) return false
-    //   handleInbound line 8087:          turnInFlightAtReceipt = .size > 0
-    return state.claudeBusyKeys.size === 0
-  }
-
-  it('pre-fix scenario: singleton map deadlocks supergroup-mode parallel turns', () => {
-    // Simulate the BROKEN behavior — one map serving both concerns
-    // (i.e. what would happen if claudeBusyKeys did NOT exist and
-    // the gates read activeTurnStartedAt.size). This is the
-    // *opposite* of the test below; documents what we're fixing.
-    const legacyState = new Map<string, number>()
-    const legacyFleetGate = () => legacyState.size === 0
-
-    // Step 1: A delivered (eager set on receipt)
-    legacyState.set('keyA', 100)
-    // Step 2: B received but buffered (eager set fires regardless)
-    legacyState.set('keyB', 200)
-    expect(legacyFleetGate()).toBe(false)
-
-    // Step 4: A's turn_end clears keyA
-    legacyState.delete('keyA')
-    // DEADLOCK — keyB lingers forever because B never started
-    // in claude so no turn_end ever fires for B.
-    expect(legacyFleetGate()).toBe(false)
-    expect(legacyState.has('keyB')).toBe(true)
-  })
-
-  it('post-fix scenario: split maps let A.turn_end unblock B', () => {
-    const state = makeState()
-
-    // Step 1: A's inbound received AND delivered to claude.
-    receiveInbound(state, 'keyA', 100)
-    deliverToClaude(state, 'keyA')
-    expect(state.activeTurnStartedAt.has('keyA')).toBe(true)
-    expect(state.claudeBusyKeys.has('keyA')).toBe(true)
-
-    // Step 2: B's inbound received, but `decideInboundDelivery`
-    // returned buffer-until-idle (turnInFlightAtReceipt was true
-    // because keyA is in claudeBusyKeys). B's fresh-turn branch
-    // STILL fired — eager activeTurnStartedAt[keyB] set —
-    // for the user-visible 👀 / typing indicator.
-    receiveInbound(state, 'keyB', 200)
-    // CRITICAL: claudeBusyKeys does NOT contain keyB because B was
-    // buffered, not delivered. The split semantics is the entire
-    // PR3b contract.
-    expect(state.activeTurnStartedAt.has('keyB')).toBe(true)
-    expect(state.claudeBusyKeys.has('keyB')).toBe(false)
-    expect(state.claudeBusyKeys.size).toBe(1)
-    expect(fleetGateOpen(state)).toBe(false)
-
-    // Step 4: A's turn_end clears keyA from BOTH maps.
-    turnEnd(state, 'keyA')
-
-    // Step 5 (the deadlock fix): fleet gate now OPENS because
-    // claudeBusyKeys is empty, even though activeTurnStartedAt
-    // still has keyB (which is fine — that's the user-visible
-    // receipt timestamp, not the claude-busy flag).
-    expect(state.claudeBusyKeys.size).toBe(0)
-    expect(state.activeTurnStartedAt.has('keyB')).toBe(true)
-    expect(fleetGateOpen(state)).toBe(true)
-
-    // The flush triggers → B's buffered msg gets sent →
-    // deliverToClaude fires for keyB → busy gate closes again.
-    deliverToClaude(state, 'keyB')
-    expect(fleetGateOpen(state)).toBe(false)
-
-    // B's turn_end completes the cycle.
-    turnEnd(state, 'keyB')
-    expect(state.activeTurnStartedAt.size).toBe(0)
-    expect(state.claudeBusyKeys.size).toBe(0)
-    expect(fleetGateOpen(state)).toBe(true)
-  })
-
-  it('per-key reads (priorTurnStartedAt timing, status-query metric) keep working on activeTurnStartedAt', () => {
-    // The split must not regress per-key timestamp reads. These all
-    // want the RECEIPT timestamp (the user's send-time, not when
-    // claude finally got to it), so they correctly read
-    // activeTurnStartedAt — preserved across the buffer window.
-    const state = makeState()
-    receiveInbound(state, 'keyA', 100)
-    deliverToClaude(state, 'keyA')
-    receiveInbound(state, 'keyB', 200) // buffered, no deliverToClaude
-
-    // A second message on keyB arriving during the buffer window —
-    // mid-turn classification reads activeTurnStartedAt.get(keyB)
-    // for `priorTurnStartedAt`, which must still be 200 (the
-    // original receipt time, even though B never reached claude).
-    expect(state.activeTurnStartedAt.get('keyB')).toBe(200)
-    // And keyA's receipt timestamp is preserved too — A's
-    // follow-ups during its own processing window get accurate
-    // secondsSinceTurnStart metric.
-    expect(state.activeTurnStartedAt.get('keyA')).toBe(100)
-  })
-
-  it('disconnect-flush sweeps both maps together (the bridge died, all in-flight turns are dead)', () => {
-    // Mirror of the disconnect-flush sweep loop in disconnect-flush.ts —
-    // a registered-agent disconnect clears both maps because every
-    // turn it was processing is dead by definition.
-    const state = makeState()
-    receiveInbound(state, 'keyA', 100)
-    deliverToClaude(state, 'keyA')
-    receiveInbound(state, 'keyB', 200) // buffered
-
-    // Bridge dies (claude crashed mid-A). Sweep both maps.
-    for (const k of [...state.activeTurnStartedAt.keys()]) {
-      state.activeTurnStartedAt.delete(k)
-      state.claudeBusyKeys.delete(k)
-    }
-
-    expect(state.activeTurnStartedAt.size).toBe(0)
-    expect(state.claudeBusyKeys.size).toBe(0)
-    expect(fleetGateOpen(state)).toBe(true)
-  })
-
-  it('idempotent: multiple inbounds for the same key (e.g. A user spamming) are a single entry', () => {
-    // Set semantics — A's 5 follow-up messages while A is processing
-    // collapse to a single claudeBusyKeys entry. Turn_end clears
-    // once; size accounting stays correct.
-    const state = makeState()
-    receiveInbound(state, 'keyA', 100)
-    deliverToClaude(state, 'keyA')
-    deliverToClaude(state, 'keyA')
-    deliverToClaude(state, 'keyA')
-    expect(state.claudeBusyKeys.size).toBe(1)
-    turnEnd(state, 'keyA')
-    expect(state.claudeBusyKeys.size).toBe(0)
-  })
-})