switchroom 0.18.32 → 0.19.0

package/telegram-plugin/uat/restart-capability.ts

@@ -0,0 +1,76 @@
+/**
+ * Shared restart-capability probe + loud-skip announcer for the
+ * restart/resume UAT scenarios.
+ *
+ * These scenarios (`jtbd-deliberate-restart-resumes-dm`,
+ * `jtbd-interrupted-turn-resumes-dm`, `jtbd-always-on-after-restart-dm`)
+ * can only exercise a REAL restart when the runner has NOPASSWD `sudo` and
+ * the `switchroom` CLI on PATH. On a sandboxed runner that lacks those,
+ * `vitest`'s `describe.skip` marks them skipped — but a bare skip reads as
+ * a plain green in a summarised board, which is exactly how the v0.18.32
+ * UAT canary over-claimed "#3315 restart/resume validated" when in fact
+ * these three self-skipped (#3334 item d).
+ *
+ * The durable fix has two parts. Part 2 (a runner that can actually
+ * restart) is infrastructure and is tracked separately. Part 1 — this file
+ * — makes the skip LOUD and unmistakable: a single-source-of-truth probe
+ * plus a banner printed to stderr at collection time, so a green that is
+ * really a skip can never be silently indistinguishable from a green that
+ * ran live.
+ */
+
+import { execSync } from "node:child_process";
+
+/**
+ * True only when the runner can drive a real agent restart: NOPASSWD
+ * `sudo` is available (the scenarios shell out to
+ * `sudo -n switchroom agent restart …`). A sandboxed CI runner returns
+ * false, which routes the scenario to `describe.skip`.
+ */
+export function canShellSudo(): boolean {
+  try {
+    execSync("sudo -n true", { stdio: "ignore", timeout: 2_000 });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Print a loud, unmissable banner to stderr when a restart/resume scenario
+ * is about to self-skip because the runner cannot exercise a real restart.
+ * Call this at module-collection time (top level of the scenario file) so
+ * the banner lands in CI stdout/stderr regardless of the reporter's
+ * skip-count rendering.
+ *
+ * The banner deliberately spells out that a GREEN here is a SKIP, not live
+ * proof — the exact confusion #3334 item d flags as "the dangerous one".
+ */
+export function announceRestartSkip(scenarioTitle: string): void {
+  console.warn(
+    "\n" +
+      "════════════════════════════════════════════════════════════════════\n" +
+      "  ⚠️  UAT SKIPPED — NOT LIVE-VALIDATED (restart capability absent)\n" +
+      `      scenario: ${scenarioTitle}\n` +
+      "      reason:   this runner has no NOPASSWD sudo + switchroom CLI, so\n" +
+      "                it cannot exercise a real agent restart. The scenario\n" +
+      "                self-skips. Its GREEN is a SKIP, not live proof.\n" +
+      "      see:      #3334 item (d) / #3315 — restart/resume assurance from\n" +
+      "                this run rests on the unit/vitest layer, not this UAT.\n" +
+      "════════════════════════════════════════════════════════════════════\n",
+  );
+}
+
+/**
+ * Convenience: probe capability once and, when absent, emit the loud-skip
+ * banner. Returns the capability boolean so the caller can gate
+ * `describe` vs `describe.skip`:
+ *
+ *   const sudoOk = restartCapableOrAnnounceSkip(TITLE);
+ *   (sudoOk ? describe : describe.skip)(TITLE, () => { … });
+ */
+export function restartCapableOrAnnounceSkip(scenarioTitle: string): boolean {
+  const ok = canShellSudo();
+  if (!ok) announceRestartSkip(scenarioTitle);
+  return ok;
+}

package/telegram-plugin/uat/scenarios/bg-sub-agent-dispatch-dm.test.ts

@@ -89,7 +89,17 @@ const BG_DISPATCH_PROMPT =
   `brief reply saying you've kicked off the background worker so I can ` +
   `watch the progress feed.`;
 
-const WORKER_RUNNING_RE = /running\s*·/i;
+// Single-worker RUNNING headers show NO literal "running" — they render
+// `<elapsed> · <n> tools[ · <tok> tok][ · <model>]`
+// (`tool-activity-summary.ts` renderActivityHeader, running branch); the
+// word "running" only appears on the MULTI-worker combined header
+// (`🛠 Workers · N running`). The old `/running\s*·/i` oracle matched only
+// by accident when the multi-worker header happened to render (failed live
+// 2026-07-18, ci-uat run 29634400115, against a healthy in-flight card).
+// In-flight signal = either header shape's live metric, paired with the
+// `not.toMatch(WORKER_DONE_RE)` terminal exclusion below — a skeleton that
+// paints only `🛠 Worker · <name>` with no metric line still fails.
+const WORKER_RUNNING_RE = /\brunning\b|·\s*\d+\s+tools?\b/i;
 const WORKER_DONE_RE = /finished\s*·\s*(completed|failed)/i;
 
 describe("uat: background sub-agent visibility (#709/#776/#782/#788)", () => {
@@ -117,9 +127,9 @@ describe("uat: background sub-agent visibility (#709/#776/#782/#788)", () => {
         expect(feed.messageId).toBeGreaterThan(0);
         expect(feed.text).toMatch(WORKER_FEED_RE);
 
-        // AC-2 step 1: feed body MUST show "running ·" (the in-flight
-        // status), NOT the terminal "finished ·" — the worker hasn't
-        // completed yet.
+        // AC-2 step 1: feed body MUST show an in-flight signal (live
+        // metric line, or multi-worker "N running"), NOT the terminal
+        // "finished ·" — the worker hasn't completed yet.
         expect(feed.text).toMatch(WORKER_RUNNING_RE);
         expect(feed.text).not.toMatch(WORKER_DONE_RE);
 

package/telegram-plugin/uat/scenarios/bridge-flap-resilience-dm.test.ts

@@ -123,8 +123,18 @@ describe("uat: bridge-flap resilience — agent stays responsive, gateway does n
             `overall deadline hit before DM ${i} — earlier turns were too slow`,
           ).toBeGreaterThan(0);
 
+          // Skip empty-text observations: the Bot API cannot send an
+          // empty text message (Telegram rejects it), so an empty-text
+          // fromBot observation is by construction a SERVICE message —
+          // e.g. the `[pinned_message]` event from the progress-card pin.
+          // One of those latched here as "the reply" on 2026-07-18
+          // (ci-uat run 29634400115: pinChatMessage 06:54:36.420Z → rx
+          // [pinned_message] 06:54:37.012Z, exactly at the DM-2 failure).
+          // A genuinely eaten turn_end still fails loudly: no non-empty
+          // reply arrives and this expectMessage times out.
           const reply = await sc.expectMessage(
-            (m: ObservedMessage) => m.fromBot && !m.edited,
+            (m: ObservedMessage) =>
+              m.fromBot && !m.edited && m.text.length > 0,
             { from: "bot", timeout: remaining },
           );
           expect(

package/telegram-plugin/uat/scenarios/cross-turn-pending-progress-dm.test.ts

@@ -81,8 +81,16 @@ interface TrailEntry {
   text: string;
 }
 
+// Mirrors the production matcher (`pending-work-progress.ts` SUFFIX_RE):
+// the CURRENT emit is the italic rich-markdown form
+// `\n\n_still working (Nm) · message me anytime, I'll keep you posted_`
+// (#2669) — mtcute's parsed `Message.text` strips the italic markers, so
+// the observed text is `\n\nstill working (Nm) · …`. The legacy em-dash
+// prefix (`— still working`) and a literal-underscore render are also
+// tolerated. The old mandatory-em-dash regex could not match ANY current
+// production edit (stale oracle, diagnosed 2026-07-18).
 const SUFFIX_RE =
-  /\n\n— still working \(\d+m\)( · message me anytime, I'll keep you posted)?$/;
+  /\n\n(?:— |_)?still working \(\d+m\)( · message me anytime, I'll keep you posted)?_?$/;
 
 function pad(s: string, n: number): string {
   return s.length >= n ? s : s + " ".repeat(n - s.length);
@@ -139,11 +147,20 @@ describe("uat: cross-turn pending-async ambient progress (#1445)", () => {
             if (firstAnchorMsgId == null && entry.kind === "fresh") {
               firstAnchorMsgId = entry.messageId;
             }
+            // EXACT match only. The prompt demands the completion signal be
+            // the single word "done" and nothing else; the loose `/\bdone\b/`
+            // fallback false-positived on the model's beat-1 ACK ("…I'll
+            // reply \"done\" when it finishes"), tripping a 10s wind-down that
+            // quit the test ~22s BEFORE the turn even ended — so the ambient
+            // edit mechanism was never observable (#3334 item b, observed UAT
+            // v0.18.32 r2). Requiring `trim() === "done"` makes the terminal
+            // signal deterministic and un-spoofable by an ack that merely
+            // mentions the word.
             const trimmedFinal = entry.text.trim().toLowerCase();
             const looksLikeDone =
               entry.kind === "fresh" &&
               entry.messageId !== firstAnchorMsgId &&
-              (trimmedFinal === "done" || /\bdone\b/.test(trimmedFinal));
+              trimmedFinal === "done";
             if (looksLikeDone) {
               sawDone = true;
               quiescenceDeadline = Date.now() + 10_000;

package/telegram-plugin/uat/scenarios/jtbd-always-on-after-restart-dm.test.ts

@@ -55,8 +55,10 @@
 import { describe, it, expect, beforeAll } from "vitest";
 import { execSync } from "node:child_process";
 import { spinUp } from "../harness.js";
+import { restartCapableOrAnnounceSkip } from "../restart-capability.js";
 
 const AGENT = "test-harness";
+const SCENARIO_TITLE = "uat: always-on after restart";
 
 // Budget for the marker-safe restart itself (per
 // feedback_agent_restart_needs_sudo_when_running.md, restart blocks
@@ -74,15 +76,6 @@ const HARD_REPLY_BUDGET_MS = 120_000;
 // contract but worth logging for forensic visibility.
 const VISION_REPLY_BUDGET_MS = 30_000;
 
-function canShellSudo(): boolean {
-  try {
-    execSync("sudo -n true", { stdio: "ignore", timeout: 2_000 });
-    return true;
-  } catch {
-    return false;
-  }
-}
-
 function restartAgent(name: string): void {
   // Marker-safe restart per memory feedback_compose_rollout.md +
   // feedback_agent_restart_needs_sudo_when_running.md. Apply step
@@ -96,11 +89,12 @@ function restartAgent(name: string): void {
 }
 
 // This scenario requires NOPASSWD sudo + the switchroom CLI on PATH on
-// the harness host. Skip on CI runners that don't expose those.
-const sudoOk = canShellSudo();
+// the harness host. Skip on CI runners that don't expose those — and when
+// we skip, announce it LOUDLY so a green isn't mistaken for live proof.
+const sudoOk = restartCapableOrAnnounceSkip(SCENARIO_TITLE);
 
 (sudoOk ? describe : describe.skip)(
-  "uat: always-on after restart",
+  SCENARIO_TITLE,
   () => {
     beforeAll(() => {
       restartAgent(AGENT);

package/telegram-plugin/uat/scenarios/jtbd-deliberate-restart-resumes-dm.test.ts

@@ -21,10 +21,13 @@
  */
 
 import { describe, it, expect } from "vitest";
-import { execSync, spawn } from "node:child_process";
+import { spawn } from "node:child_process";
 import { spinUp } from "../harness.js";
+import { restartCapableOrAnnounceSkip } from "../restart-capability.js";
 
 const AGENT = "test-harness";
+const SCENARIO_TITLE =
+  "uat: deliberate restart mid-turn resumes exactly once (DM, #2988)";
 const MID_TURN_MS = 10_000;        // let the turn get in-flight before the bounce
 const RESUME_BUDGET_MS = 180_000;  // boot + resume + reply
 const QUIET_WINDOW_MS = 90_000;    // after the resume completes, no second resume may fire
@@ -36,15 +39,6 @@ const SAME_TURN_GRACE_MS = 20_000;
 
 const RESUME_FRAMING = /resum|picking .*back|interrupted|cut off|just restarted/i;
 
-function canShellSudo(): boolean {
-  try {
-    execSync("sudo -n true", { stdio: "ignore", timeout: 2_000 });
-    return true;
-  } catch {
-    return false;
-  }
-}
-
 function kickRestartDetached(name: string): void {
   // A deliberate operator restart: clean SIGTERM path, clean-shutdown marker
   // written — the exact class #2988 makes resume in-flight work through.
@@ -57,10 +51,10 @@ function kickRestartDetached(name: string): void {
   child.unref();
 }
 
-const sudoOk = canShellSudo();
+const sudoOk = restartCapableOrAnnounceSkip(SCENARIO_TITLE);
 
 (sudoOk ? describe : describe.skip)(
-  "uat: deliberate restart mid-turn resumes exactly once (DM, #2988)",
+  SCENARIO_TITLE,
   () => {
     it(
       "an operator restart mid-turn resumes the work once, and never a second time",

package/telegram-plugin/uat/scenarios/jtbd-interrupted-turn-resumes-dm.test.ts

@@ -23,26 +23,20 @@
  */
 
 import { describe, it, expect } from "vitest";
-import { execSync, spawn } from "node:child_process";
+import { spawn } from "node:child_process";
 import { spinUp } from "../harness.js";
+import { restartCapableOrAnnounceSkip } from "../restart-capability.js";
 
 const AGENT = "test-harness";
 const MID_TURN_MS = 10_000;        // let the turn enqueue (become a recorded interrupted turn)
 const RESUME_BUDGET_MS = 180_000;  // boot + resume + reply
 
+const SCENARIO_TITLE = "uat: interrupted turn resumes after restart (DM)";
+
 // The resume builder tells the model to "briefly let the user know you're
 // resuming what was interrupted" — so the reply always opens with this framing.
 const RESUME_FRAMING = /resum|picking .*back|interrupted|cut off|just restarted/i;
 
-function canShellSudo(): boolean {
-  try {
-    execSync("sudo -n true", { stdio: "ignore", timeout: 2_000 });
-    return true;
-  } catch {
-    return false;
-  }
-}
-
 function kickRestartDetached(name: string): void {
   // --force WITHOUT --wait → recreate now, interrupting the in-flight turn.
   const child = spawn(
@@ -54,9 +48,9 @@ function kickRestartDetached(name: string): void {
   child.unref();
 }
 
-const sudoOk = canShellSudo();
+const sudoOk = restartCapableOrAnnounceSkip(SCENARIO_TITLE);
 
-(sudoOk ? describe : describe.skip)("uat: interrupted turn resumes after restart (DM)", () => {
+(sudoOk ? describe : describe.skip)(SCENARIO_TITLE, () => {
   it(
     "a turn interrupted by a restart is resumed and the resume turn completes",
     async () => {

package/telegram-plugin/uat/scenarios/jtbd-multipart-render-dm.test.ts

@@ -70,23 +70,47 @@ const TAIL = "MULTITAIL9";
 
 // We need the composed reply to exceed the 32768-char cap so the gateway
 // chunks it. Asking a model to emit ~40k literal chars is flaky (it'll
-// summarize or truncate). Instead we ask it to REPEAT a fixed, cheap-to-
-// generate padding block a deterministic number of times — a task an agent
-// reliably obeys because it's mechanical, not generative.
-const PAD_LINE = "The quick brown fox jumps over the lazy dog. ";
-// Overshoot the cap by a comfortable margin so a slightly-short reply still
-// splits: (cap / line) rounded up, times a 1.3 safety factor.
-const REPEATS = Math.ceil((RICH_MESSAGE_MAX_CHARS / PAD_LINE.length) * 1.3);
+// summarize or truncate). We keep the task MECHANICAL (cycle a fixed
+// sentence list, prefix each line with its index) so an agent reliably
+// obeys — but every emitted line is UNIQUE. Verbatim repetition of one
+// sentence 900+ times reads as degenerate output to Anthropic's content
+// filter and 4xx-kills the turn before any reply exists to send (observed
+// live 2026-07-18, ci-uat run 29634400115: four "unknown-4xx / Output
+// blocked by content filtering policy" events, gateway-supervisor.log
+// 06:43–06:53Z — the reply never reached the send path).
+const PAD_SENTENCES = [
+  "The quick brown fox jumps over the lazy dog.",
+  "Pack my box with five dozen liquor jugs.",
+  "How vexingly quick daft zebras jump.",
+  "Sphinx of black quartz, judge my vow.",
+  "The five boxing wizards jump quickly.",
+  "Jackdaws love my big sphinx of quartz.",
+  "Waltz, bad nymph, for quick jigs vex.",
+  "Glib jocks quiz nymph to vex dwarf.",
+  "Bright vixens jump; dozy fowl quack.",
+  "Quick zephyrs blow, vexing daft Jim.",
+];
+// Conservative per-line floor: the SHORTEST pad sentence plus the numeric
+// prefix. Overshoot the cap by a 1.3 safety factor so a slightly-short
+// reply still splits.
+const PER_LINE_MIN =
+  Math.min(...PAD_SENTENCES.map((s) => s.length)) + "Line 1: ".length;
+const LINE_COUNT = Math.ceil((RICH_MESSAGE_MAX_CHARS / PER_LINE_MIN) * 1.3);
 
 const PROMPT = [
   `I need a LONG reply to test message chunking. Do EXACTLY this, nothing else:`,
   ``,
   `1. Start your reply with: ${HEAD}: **head bold marker**`,
-  `2. Then output this exact sentence ${REPEATS} times, each on its own line:`,
-  `   "${PAD_LINE.trim()}"`,
+  `2. Then output ${LINE_COUNT} numbered lines. Line i (1-based) must be:`,
+  `   "Line i: " followed by sentence number (i mod 10) from this list`,
+  `   (list index 0-9):`,
+  ...PAD_SENTENCES.map((s, idx) => `     ${idx}: "${s}"`),
+  `   So line 1 is "Line 1: ${PAD_SENTENCES[1]}", line 2 is`,
+  `   "Line 2: ${PAD_SENTENCES[2]}", and so on, wrapping the list.`,
   `3. End your reply with: ${TAIL}: **tail bold marker**`,
   ``,
-  `Do not summarize or shorten. Emit all ${REPEATS} repetitions verbatim.`,
+  `Every line is unique because of its number. Do not summarize, do not`,
+  `stop early — emit all ${LINE_COUNT} lines.`,
 ].join("\n");
 
 function kinds(msg: ObservedMessage): Set<string> {
@@ -104,9 +128,17 @@ function kinds(msg: ObservedMessage): Set<string> {
           await sc.sendDM(PROMPT);
 
           // Chunk 1: the part carrying the HEAD marker.
+          //
+          // Budget: 240s, not 120s. When the model stages the long output
+          // via a file Write+Read (a 900+-line, ~90k-token turn), the
+          // inbound→chunks wall time runs ~3m49s (observed UAT v0.18.32 r2:
+          // test gave up at 120s / 08:42:13; the correctly-chunked reply
+          // actually landed 08:44:02 — a timing-budget oracle defect, not a
+          // delivery failure, since both ordered chunks delivered with zero
+          // 4xx). 240s clears that staging path with headroom (#3334 item a).
           const first = await sc.expectMessage(
             (m: ObservedMessage) => m.text.includes(HEAD) || m.text === "\x01",
-            { from: "bot", timeout: 120_000 },
+            { from: "bot", timeout: 240_000 },
           );
           // Chunk 2 (final): the part carrying the TAIL marker. This is a
           // DIFFERENT message than `first` — if the reply hadn't chunked,
@@ -116,7 +148,7 @@ function kinds(msg: ObservedMessage): Set<string> {
             (m: ObservedMessage) =>
               (m.text.includes(TAIL) || m.text === "\x01") &&
               m.messageId !== first.messageId,
-            { from: "bot", timeout: 120_000 },
+            { from: "bot", timeout: 240_000 },
           );
 
           // (4) Neither part is the unsupported-media sentinel.
@@ -163,7 +195,9 @@ function kinds(msg: ObservedMessage): Set<string> {
           await sc.tearDown();
         }
       },
-      180_000,
+      // Outer budget must exceed the two sequential 240s expectMessage
+      // windows (chunk 1, then chunk 2) plus spinUp settle + slack.
+      540_000,
     );
   },
 );

package/telegram-plugin/worker-activity-feed.ts

@@ -54,11 +54,12 @@ import {
   stripMarkdown,
   truncate,
 } from './card-format.js'
-import { STATUS_ROLLING_LINES } from './status-no-truncate.js'
+import { WORKER_HISTORY_MAX } from './status-no-truncate.js'
 import {
   renderStatusCard,
   formatStepSuffix,
   renderCombinedWorkerFeed,
+  workerHistoryDepth,
   type CombinedWorkerRow,
 } from './tool-activity-summary.js'
 import { isSendGateShed } from './send-gate.js'
@@ -213,6 +214,9 @@ export function renderWorkerActivity(v: WorkerActivityView, liveSuffix = ''): st
     final: finished,
     liveSuffix: finished ? '' : liveSuffix,
     result,
+    // Lone-worker card: window to the w=1 point of Ken's curve (6) so it shows
+    // the full recent trail, not the 5-line agent-card default (#3349).
+    historyWindow: workerHistoryDepth(1),
   })
   if (card == null) {
     // Unreachable (header always present) — defensive.
@@ -420,7 +424,7 @@ interface WorkerRow {
   agentId: string
   /**
    * Accumulated narrative lines (oldest→newest), deduped within the whole
-   * rolling window. Rolling-window capped to STATUS_ROLLING_LINES. Grows the
+   * rolling window. Rolling-window capped to WORKER_HISTORY_MAX. Grows the
    * live render so the feed reads like the main agent's answer.
    */
   narrative: string[]
@@ -797,8 +801,10 @@ export function createWorkerActivityFeed(opts: WorkerActivityFeedOpts): WorkerAc
     row.narrative.push(line)
     // The `→` current-step line just CHANGED — reset the per-step timer.
     row.stepStartedAtMs = nowFn()
-    if (row.narrative.length > STATUS_ROLLING_LINES) {
-      row.narrative.splice(0, row.narrative.length - STATUS_ROLLING_LINES)
+    // Retain up to WORKER_HISTORY_MAX (6) — the lone-worker card's deepest
+    // window (#3349). STATUS_ROLLING_LINES (5) governs the agent card, not this.
+    if (row.narrative.length > WORKER_HISTORY_MAX) {
+      row.narrative.splice(0, row.narrative.length - WORKER_HISTORY_MAX)
     }
   }