switchroom 0.18.6 → 0.18.8

package/telegram-plugin/tests/pty-partial-handler.test.ts

@@ -9,6 +9,7 @@ import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
 import {
   createPtyPartialHandler,
   handlePtyPartialPure,
+  looksLikeRawApiError,
   type PtyHandlerState,
   type PtyHandlerDeps,
 } from '../pty-partial-handler.js'
@@ -65,6 +66,35 @@ describe('handlePtyPartialPure', () => {
     expect(bot.api.sendMessage).not.toHaveBeenCalled()
   })
 
+  it('suppresses a raw API-error TUI line so it never leaks to chat (#2922 Bug 3)', async () => {
+    const state = makeState({ currentSessionChatId: '1' })
+    const deps = makeDeps(bot)
+    // The exact shape Claude Code's TUI renders on a transient 429.
+    const raw =
+      "API Error: Server is temporarily limiting requests (not your usage limit) · " +
+      "b'{\"type\":\"error\",\"error\":{\"type\":\"rate_limit_error\"}}'"
+    const action = handlePtyPartialPure(raw, state, deps)
+    expect(action).toBe('error-suppressed')
+    await microtaskFlush()
+    // Nothing sent — the operator-event pipeline owns the user-facing card.
+    expect(bot.api.sendMessage).not.toHaveBeenCalled()
+    expect(state.activeDraftStreams.size).toBe(0)
+    // Not recorded as a preview, so it can't poison later dedup either.
+    expect(state.lastPtyPreviewByChat.size).toBe(0)
+  })
+
+  it('does NOT suppress ordinary assistant text that merely mentions errors', async () => {
+    const state = makeState({ currentSessionChatId: '1' })
+    const action = handlePtyPartialPure(
+      "Here's how to handle an error in your retry loop:",
+      state,
+      makeDeps(bot),
+    )
+    expect(action).toBe('update-new')
+    await microtaskFlush()
+    expect(bot.api.sendMessage).toHaveBeenCalledTimes(1)
+  })
+
   it('dedups when same text arrives twice in a row', async () => {
     const state = makeState({ currentSessionChatId: '1' })
     const deps = makeDeps(bot)
@@ -324,3 +354,29 @@ describe('createPtyPartialHandler — session + buffer replay', () => {
     expect(state.activeDraftStreams.size).toBe(0)
   })
 })
+
+describe('looksLikeRawApiError (#2922 Bug 3)', () => {
+  it('flags the CLI "API Error: … · b\'{…}\'" line', () => {
+    expect(
+      looksLikeRawApiError(
+        "API Error: Server is temporarily limiting requests · b'{\"type\":\"error\"}'",
+      ),
+    ).toBe(true)
+  })
+
+  it('flags a bare rate_limit_error JSON body', () => {
+    expect(
+      looksLikeRawApiError('{"type":"error","error":{"type":"rate_limit_error"}}'),
+    ).toBe(true)
+  })
+
+  it('flags overloaded_error and is_error markers', () => {
+    expect(looksLikeRawApiError('{"type":"overloaded_error"}')).toBe(true)
+    expect(looksLikeRawApiError('{"is_error":true,"content":"boom"}')).toBe(true)
+  })
+
+  it('does not flag ordinary prose mentioning "error"', () => {
+    expect(looksLikeRawApiError('I hit an error handling that request')).toBe(false)
+    expect(looksLikeRawApiError('')).toBe(false)
+  })
+})

package/telegram-plugin/tests/render/render-outbound-chunks.test.ts

@@ -0,0 +1,98 @@
+/**
+ * Regression tests for the chunk-boundary cap bug (fix/rich-render-chunk-boundary-cap).
+ *
+ * THE BUG: the outbound safe renderer (`renderSafe`) re-escapes GFM-special
+ * characters, which GROWS a body. A raw chunk sized just under the wire cap can
+ * escape PAST it. `renderSafe`'s only oversize recourse is to degrade the WHOLE
+ * document to `mode:"plain"` (raw source, no rich wrapper) — it never re-splits
+ * a multi-block body. The send path then ships that plain body through the
+ * 4096-char plain `sendMessage` endpoint, so a ~32k plain body is rejected by
+ * Telegram (`message is too long`) and the answer is dropped.
+ *
+ * `renderOutboundChunks` closes the gap: every returned piece fits its own wire
+ * cap (rich `<= maxLen`, plain `<= plainMax`) and is cut only at
+ * `splitMarkdownChunks`' safe boundaries (never bisecting a fence / table row).
+ */
+import { describe, it, expect } from "vitest";
+import { renderOutboundChunks, PLAIN_TEXT_MAX_CHARS } from "../../render/rich-render.js";
+import { RICH_MESSAGE_MAX_CHARS } from "../../format.js";
+
+const ON = { SWITCHROOM_RICH_RENDER: "1" } as NodeJS.ProcessEnv;
+const OFF = {} as NodeJS.ProcessEnv;
+
+/** Count fenced-code delimiter lines (```) in a body. A piece that bisects a
+ *  fenced block has an ODD count. */
+function fenceCount(s: string): number {
+  return (s.match(/^```/gm) ?? []).length;
+}
+
+describe("renderOutboundChunks", () => {
+  it("flag OFF is a single passthrough piece (byte-for-byte)", () => {
+    const raw = "**bold** and _italic_ | a | table |";
+    const pieces = renderOutboundChunks(raw, OFF);
+    expect(pieces).toHaveLength(1);
+    expect(pieces[0].text).toBe(raw);
+    expect(pieces[0].mode).toBe("markdown");
+  });
+
+  it("flag ON, body that fits is a single piece (common case)", () => {
+    const pieces = renderOutboundChunks("just some plain prose", ON);
+    expect(pieces).toHaveLength(1);
+    expect(pieces[0].text.length).toBeLessThanOrEqual(RICH_MESSAGE_MAX_CHARS);
+  });
+
+  it("REGRESSION: a near-cap escapable body splits into cap-respecting pieces", () => {
+    // Prose whose escaping (`_ * |` each gain a leading `\`) grows it past the
+    // cap. Use small caps so the test is fast; the invariant is cap-agnostic.
+    const maxLen = 200;
+    const plainMax = 80;
+    const unit = "a_b*c|d ";
+    const raw = unit.repeat(40); // 320 raw chars, ~1.5x after escaping
+    const pieces = renderOutboundChunks(raw, ON, maxLen, plainMax);
+
+    // The whole body did NOT fit as one message — it was re-split.
+    expect(pieces.length).toBeGreaterThan(1);
+    for (const p of pieces) {
+      if (p.mode === "plain") {
+        // A plain piece rides the plain `sendMessage` endpoint — must fit its cap.
+        expect(p.text.length).toBeLessThanOrEqual(plainMax);
+      } else {
+        expect(p.text.length).toBeLessThanOrEqual(maxLen);
+      }
+    }
+  });
+
+  it("REGRESSION: never bisects a fenced code block when splitting", () => {
+    const maxLen = 300;
+    const plainMax = 250; // >= the fence size, so a fence never needs a hard slice.
+    // A fenced block big enough that a naive length cut would land inside it,
+    // wrapped in prose so the whole document overflows and must be re-split.
+    const fence = "```\n" + "code line here\n".repeat(8) + "```";
+    const prose = "word ".repeat(40);
+    const raw = `${prose}\n\n${fence}\n\n${prose}`;
+    const pieces = renderOutboundChunks(raw, ON, maxLen, plainMax);
+
+    expect(pieces.length).toBeGreaterThan(1);
+    for (const p of pieces) {
+      // Every emitted piece has BALANCED fence delimiters — no piece opens a
+      // fence it doesn't close (which would swallow the next piece's text).
+      expect(fenceCount(p.text) % 2).toBe(0);
+      const cap = p.mode === "plain" ? plainMax : maxLen;
+      expect(p.text.length).toBeLessThanOrEqual(cap);
+    }
+  });
+
+  it("REAL-CAP: a ~32k escapable body never yields an over-4096 plain piece", () => {
+    // The production failure: raw just under RICH_MESSAGE_MAX_CHARS, escaping
+    // pushes the rendered form over it. On the buggy path this became ONE
+    // ~32k plain body sent through the 4096 plain endpoint. Here every plain
+    // piece is <= 4096 and every rich piece <= 32768.
+    const unit = "a_b*c|d ";
+    const raw = unit.repeat(Math.floor((RICH_MESSAGE_MAX_CHARS - 20) / unit.length));
+    const pieces = renderOutboundChunks(raw, ON);
+    for (const p of pieces) {
+      const cap = p.mode === "plain" ? PLAIN_TEXT_MAX_CHARS : RICH_MESSAGE_MAX_CHARS;
+      expect(p.text.length).toBeLessThanOrEqual(cap);
+    }
+  }, 30000);
+});

package/telegram-plugin/tests/resume-inbound-builder.test.ts

@@ -18,7 +18,13 @@ import {
   humanizeElapsed,
   buildResumeInterruptedInbound,
   buildResumeWatchdogReportInbound,
+  buildResumeDeferredReportInbound,
+  isResumeSyntheticTurn,
   selectResumeBuilder,
+  decideBootResumeKind,
+  RESUME_SYNTHETIC_PROMPT_PREFIX,
+  renderInterruptedSubagentsBlock,
+  type InterruptedSubagent,
 } from '../gateway/resume-inbound-builder.js'
 import type { Turn, TurnEndedVia } from '../registry/turns-schema.js'
 
@@ -158,6 +164,155 @@ describe('buildResumeInterruptedInbound', () => {
   })
 })
 
+describe('interrupted sub-agent block', () => {
+  const twoRunning: InterruptedSubagent[] = [
+    { agentType: 'worker', description: 'refactor the auth module and add tests', status: 'running' },
+    { agentType: 'researcher', description: 'survey the pricing pages of 5 competitors', status: 'running' },
+  ]
+
+  it('renderInterruptedSubagentsBlock lists each worker with type + prompt', () => {
+    const block = renderInterruptedSubagentsBlock(twoRunning)
+    expect(block).toContain('2 sub-agents were still')
+    expect(block).toContain('did NOT complete')
+    expect(block).toContain('[worker]')
+    expect(block).toContain('refactor the auth module and add tests')
+    expect(block).toContain('[researcher]')
+    expect(block).toContain('survey the pricing pages of 5 competitors')
+    expect(block).toContain('Re-dispatch the ones still needed')
+  })
+
+  it('returns empty string when there are no in-flight sub-agents', () => {
+    expect(renderInterruptedSubagentsBlock(undefined)).toBe('')
+    expect(renderInterruptedSubagentsBlock([])).toBe('')
+  })
+
+  it('interrupted-turn inbound contains BOTH running sub-agents', () => {
+    const msg = buildResumeInterruptedInbound({ turn: makeTurn(), subagents: twoRunning })
+    expect(msg.text).toContain('refactor the auth module and add tests')
+    expect(msg.text).toContain('survey the pricing pages of 5 competitors')
+    expect(msg.text).toContain('did NOT complete')
+    expect(msg.text).toContain('Re-dispatch the ones still needed')
+  })
+
+  it('interrupted-turn inbound is UNCHANGED when no sub-agents were running', () => {
+    const withNone = buildResumeInterruptedInbound({ turn: makeTurn(), subagents: [] })
+    const bare = buildResumeInterruptedInbound({ turn: makeTurn() })
+    expect(withNone.text).toBe(bare.text)
+    expect(withNone.text).not.toContain('did NOT complete')
+  })
+
+  it('truncates each dispatch prompt to ~200 chars', () => {
+    const long = 'x'.repeat(400)
+    const block = renderInterruptedSubagentsBlock([{ agentType: 'worker', description: long }])
+    // The 400-char prompt must not survive in full; the entry line is capped.
+    expect(block).not.toContain(long)
+    expect(block).toContain('…')
+    // 200-char cap → the truncated slice (199 chars + ellipsis) is present.
+    expect(block).toContain('x'.repeat(199))
+    expect(block).not.toContain('x'.repeat(201))
+  })
+
+  it('caps the list at 10 and summarises the remainder', () => {
+    const many: InterruptedSubagent[] = Array.from({ length: 14 }, (_, i) => ({
+      agentType: 'worker',
+      description: `task number ${i + 1}`,
+    }))
+    const block = renderInterruptedSubagentsBlock(many)
+    expect(block).toContain('14 sub-agents were still')
+    expect(block).toContain('task number 10')
+    expect(block).not.toContain('task number 11')
+    expect(block).toContain('…and 4 more.')
+    // Exactly 10 numbered entries rendered.
+    const numbered = block.match(/^\s+\d+\. \[/gm) ?? []
+    expect(numbered.length).toBe(10)
+  })
+
+  it('falls back to a generic label + placeholder when type/prompt are missing', () => {
+    const block = renderInterruptedSubagentsBlock([{ agentType: null, description: null }])
+    expect(block).toContain('[sub-agent]')
+    expect(block).toContain('(no task description recorded)')
+  })
+
+  it('singularises a single killed sub-agent', () => {
+    const block = renderInterruptedSubagentsBlock([{ agentType: 'worker', description: 'do X' }])
+    expect(block).toContain('1 sub-agent was still')
+    expect(block).not.toContain('1 sub-agents')
+  })
+
+  it('codepoint-safe truncation never splits a surrogate pair', () => {
+    // 199 ASCII chars, then an astral-plane emoji (2 UTF-16 code units)
+    // straddling the cap. A code-unit slice would cut the pair in half and
+    // leave a lone surrogate; the codepoint-safe slice must not.
+    const desc = 'a'.repeat(199) + '🚀' + 'b'.repeat(50)
+    const block = renderInterruptedSubagentsBlock([{ agentType: 'worker', description: desc }])
+    expect(block).toContain('…')
+    // No lone surrogates anywhere in the rendered block.
+    expect(/[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/.test(block)).toBe(false)
+    expect(block).toBe(block.normalize('NFC')) // sanity: still a well-formed string
+  })
+
+  it('the watchdog report inbound carries the block in DEFERRED form (ask-first contract)', () => {
+    const msg = buildResumeWatchdogReportInbound({
+      turn: makeTurn({ ended_via: 'timeout' }),
+      idleMs: 300_000,
+      subagents: twoRunning,
+    })
+    expect(msg.text).toContain('did NOT complete')
+    expect(msg.text).toContain('refactor the auth module and add tests')
+    // Deferred wording: re-dispatch is conditional on the user asking to retry…
+    expect(msg.text).toContain("If the user asks you to retry, they'll need re-dispatching")
+    expect(msg.text).toContain("don't assume their work landed")
+    // …and the resume-path imperative must NOT appear — it would contradict
+    // the watchdog inbound's "Do NOT silently resume … ask" hang-safety gate.
+    expect(msg.text).not.toContain('Re-dispatch the ones still needed')
+    expect(msg.text).not.toContain('before declaring the task done')
+  })
+
+  it('the resume-path inbound keeps the assertive imperative (and not the deferred form)', () => {
+    const msg = buildResumeInterruptedInbound({ turn: makeTurn(), subagents: twoRunning })
+    expect(msg.text).toContain('Re-dispatch the ones still needed before declaring the task done')
+    expect(msg.text).not.toContain('If the user asks you to retry')
+  })
+
+  for (const reason of ['loop-guard', 'clean-restart-suppressed'] as const) {
+    it(`the deferred report (${reason}) carries the block in DEFERRED form — suppressed resumes still name worker deaths`, () => {
+      const msg = buildResumeDeferredReportInbound({
+        turn: makeTurn(),
+        reason,
+        subagents: twoRunning,
+      })
+      expect(msg.text).toContain('did NOT complete')
+      expect(msg.text).toContain('refactor the auth module and add tests')
+      expect(msg.text).toContain('survey the pricing pages of 5 competitors')
+      // Deferred wording only — never the resume-path imperative, which would
+      // contradict this inbound's "Do NOT silently resume … ask" contract.
+      expect(msg.text).toContain("If the user asks you to retry, they'll need re-dispatching")
+      expect(msg.text).not.toContain('Re-dispatch the ones still needed')
+      expect(msg.text).not.toContain('before declaring the task done')
+      // Appending the block must not disturb the loop-guard anchor at pos 0.
+      expect(msg.text.startsWith(RESUME_SYNTHETIC_PROMPT_PREFIX)).toBe(true)
+    })
+  }
+
+  it('deferred report without subagents is unchanged (no block)', () => {
+    const withNone = buildResumeDeferredReportInbound({ turn: makeTurn(), reason: 'loop-guard', subagents: [] })
+    const bare = buildResumeDeferredReportInbound({ turn: makeTurn(), reason: 'loop-guard' })
+    expect(withNone.text).toBe(bare.text)
+    expect(withNone.text).not.toContain('did NOT complete')
+  })
+
+  it('appending the block preserves the RESUME_SYNTHETIC_PROMPT_PREFIX anchor on resume + watchdog inbounds too', () => {
+    const resume = buildResumeInterruptedInbound({ turn: makeTurn(), subagents: twoRunning })
+    expect(resume.text.startsWith(RESUME_SYNTHETIC_PROMPT_PREFIX)).toBe(true)
+    const report = buildResumeWatchdogReportInbound({
+      turn: makeTurn({ ended_via: 'timeout' }),
+      idleMs: 300_000,
+      subagents: twoRunning,
+    })
+    expect(report.text.startsWith(RESUME_SYNTHETIC_PROMPT_PREFIX)).toBe(true)
+  })
+})
+
 describe('buildResumeWatchdogReportInbound', () => {
   it('sets the resume_watchdog_timeout source and idle_ms passthrough', () => {
     const turn = makeTurn({ ended_via: 'timeout' })
@@ -243,3 +398,134 @@ describe('selectResumeBuilder', () => {
     expect(selectResumeBuilder('restart', { ageMs: MAX + 1 })).toBe('resume') // needs BOTH to cap
   })
 })
+
+// ---------------------------------------------------------------------------
+// Loop-guard: RESUME_SYNTHETIC_PROMPT_PREFIX / isResumeSyntheticTurn
+// ---------------------------------------------------------------------------
+
+describe('resume synthetic-turn detection (loop-guard anchor)', () => {
+  it('EVERY synthetic boot inbound text starts with the machine-stable prefix', () => {
+    // The loop-guard keys on this prefix landing in user_prompt_preview, so if
+    // a prose edit drops it the chain-cap silently breaks. Pin it here.
+    const turn = makeTurn({ user_prompt_preview: 'do the thing' })
+    expect(buildResumeInterruptedInbound({ turn }).text.startsWith(RESUME_SYNTHETIC_PROMPT_PREFIX)).toBe(true)
+    expect(
+      buildResumeWatchdogReportInbound({ turn: makeTurn({ ended_via: 'timeout' }), idleMs: 1000 }).text.startsWith(
+        RESUME_SYNTHETIC_PROMPT_PREFIX,
+      ),
+    ).toBe(true)
+    expect(
+      buildResumeDeferredReportInbound({ turn, reason: 'loop-guard' }).text.startsWith(
+        RESUME_SYNTHETIC_PROMPT_PREFIX,
+      ),
+    ).toBe(true)
+    expect(
+      buildResumeDeferredReportInbound({ turn, reason: 'clean-restart-suppressed' }).text.startsWith(
+        RESUME_SYNTHETIC_PROMPT_PREFIX,
+      ),
+    ).toBe(true)
+  })
+
+  it('isResumeSyntheticTurn is true for a turn whose preview is a synthetic prompt', () => {
+    const synthetic = buildResumeInterruptedInbound({ turn: makeTurn() })
+    // A resume turn stores the first ~200 chars of the synthetic text as its
+    // preview (channel wrapper stripped) — simulate that.
+    const resumeTurn = makeTurn({ user_prompt_preview: synthetic.text.slice(0, 200) })
+    expect(isResumeSyntheticTurn(resumeTurn)).toBe(true)
+  })
+
+  it('isResumeSyntheticTurn is false for real user work and for null preview', () => {
+    expect(isResumeSyntheticTurn(makeTurn({ user_prompt_preview: 'refactor the auth module' }))).toBe(false)
+    expect(isResumeSyntheticTurn(makeTurn({ user_prompt_preview: null }))).toBe(false)
+  })
+})
+
+// ---------------------------------------------------------------------------
+// buildResumeDeferredReportInbound
+// ---------------------------------------------------------------------------
+
+describe('buildResumeDeferredReportInbound', () => {
+  it('emits source=resume_deferred and carries the dedup anchor + reason', () => {
+    const turn = makeTurn({ turn_key: 'zz:3' })
+    const msg = buildResumeDeferredReportInbound({ turn, reason: 'loop-guard' })
+    expect(msg.meta.source).toBe('resume_deferred')
+    expect(msg.meta.resume_turn_key).toBe('zz:3')
+    expect(msg.meta.defer_reason).toBe('loop-guard')
+  })
+
+  it('loop-guard framing tells the model the chain was capped, not to resume', () => {
+    const msg = buildResumeDeferredReportInbound({ turn: makeTurn(), reason: 'loop-guard' })
+    expect(msg.text.toLowerCase()).toContain('resume of earlier interrupted work')
+    expect(msg.text).toContain('Do NOT silently resume')
+  })
+
+  it('clean-restart-suppressed framing cites boot_resume: never', () => {
+    const msg = buildResumeDeferredReportInbound({ turn: makeTurn(), reason: 'clean-restart-suppressed' })
+    expect(msg.text).toContain('boot_resume: never')
+    expect(msg.text).toContain('Do NOT silently resume')
+  })
+
+  it('routes to the origin thread when the turn carried one', () => {
+    const turn = makeTurn({ chat_id: '-100999', thread_id: '77' })
+    const msg = buildResumeDeferredReportInbound({ turn, reason: 'loop-guard' })
+    expect(msg.chatId).toBe('-100999')
+    expect(msg.threadId).toBe(77)
+    expect(msg.meta.message_thread_id).toBe('77')
+  })
+})
+
+// ---------------------------------------------------------------------------
+// decideBootResumeKind — boot-resume precedence + bounded resume chain
+// ---------------------------------------------------------------------------
+
+describe('decideBootResumeKind', () => {
+  const MAX = 10_800_000 // 3h
+
+  it('resumes genuinely in-flight work after a deliberate restart (not suppressed)', () => {
+    // The core product fix: clean restart mid-turn → resume, not silence.
+    const pending = makeTurn({ ended_via: 'restart', user_prompt_preview: 'ship the release' })
+    expect(decideBootResumeKind({ pending, suppressed: false, ageMs: 1000, maxAgeMs: MAX })).toBe('resume')
+  })
+
+  it("boot_resume:never (suppressed) → 'defer-suppressed' passive report, never silence", () => {
+    const pending = makeTurn({ ended_via: 'restart', user_prompt_preview: 'ship the release' })
+    expect(decideBootResumeKind({ pending, suppressed: true, ageMs: 1000, maxAgeMs: MAX })).toBe('defer-suppressed')
+  })
+
+  it('watchdog timeout still reports even when not suppressed', () => {
+    const pending = makeTurn({ ended_via: 'timeout', user_prompt_preview: 'ship the release' })
+    expect(decideBootResumeKind({ pending, suppressed: false, ageMs: 1000, maxAgeMs: MAX })).toBe('report')
+  })
+
+  it('BOUNDED CHAIN: a restart DURING a resume turn does NOT re-resume — loop-guard fires', () => {
+    // Simulate the chain the coordinator flagged:
+    //   A: real work, interrupted → resume R1 (turn B created from R1's text)
+    //   restart lands during B → pending is B, whose preview IS the synthetic
+    //   resume prompt. We must NOT mint a second resume (endless loop risk).
+    const r1 = buildResumeInterruptedInbound({ turn: makeTurn({ user_prompt_preview: 'real work' }) })
+    const turnB = makeTurn({ ended_via: 'restart', user_prompt_preview: r1.text.slice(0, 200) })
+    // Even though NOT suppressed (would normally resume), the loop-guard wins:
+    expect(decideBootResumeKind({ pending: turnB, suppressed: false, ageMs: 1000, maxAgeMs: MAX })).toBe('defer-loop')
+  })
+
+  it('BOUNDED CHAIN: a restart during a deferred-report turn stays capped (still defer-loop, never resume)', () => {
+    // Depth does not grow: a report-of-report is still a passive report, never
+    // a resume — so no unbounded restart→resume→restart chain can form.
+    const deferred = buildResumeDeferredReportInbound({ turn: makeTurn(), reason: 'loop-guard' })
+    const turnC = makeTurn({ ended_via: 'restart', user_prompt_preview: deferred.text.slice(0, 200) })
+    const kind = decideBootResumeKind({ pending: turnC, suppressed: false, ageMs: 1000, maxAgeMs: MAX })
+    expect(kind).toBe('defer-loop')
+    expect(kind).not.toBe('resume')
+  })
+
+  it('loop-guard takes precedence over suppression too (synthetic turn never resumes or double-reports as resume)', () => {
+    const r1 = buildResumeInterruptedInbound({ turn: makeTurn() })
+    const turnB = makeTurn({ ended_via: 'restart', user_prompt_preview: r1.text.slice(0, 200) })
+    expect(decideBootResumeKind({ pending: turnB, suppressed: true, ageMs: 1000, maxAgeMs: MAX })).toBe('defer-loop')
+  })
+
+  it('stale in-flight work downgrades to report when older than maxAgeMs', () => {
+    const pending = makeTurn({ ended_via: 'restart', user_prompt_preview: 'stale work' })
+    expect(decideBootResumeKind({ pending, suppressed: false, ageMs: MAX + 1, maxAgeMs: MAX })).toBe('report')
+  })
+})

package/telegram-plugin/tests/retry-api-call.test.ts

@@ -15,6 +15,8 @@ import {
   createSwallowingRetryApiCall,
   retryWithThreadFallback,
   isHtmlParseRejectError,
+  isLocalResourceError,
+  LOCAL_RESOURCE_EXHAUSTED,
   type RetryObserver,
 } from '../retry-api-call.js'
 import { errors, makeGrammyError } from './fake-bot-api.js'
@@ -512,3 +514,60 @@ describe('isHtmlParseRejectError', () => {
     ).toBe(true)
   })
 })
+
+describe('#2923 — LOCAL resource exhaustion is NOT retried (avoids flood ban)', () => {
+  it('classifies ENOSPC / EDQUOT / EIO / ENOMEM by errno code', () => {
+    expect(isLocalResourceError(Object.assign(new Error('x'), { code: 'ENOSPC' }))).toBe(true)
+    expect(isLocalResourceError(Object.assign(new Error('x'), { code: 'EDQUOT' }))).toBe(true)
+    expect(isLocalResourceError(Object.assign(new Error('x'), { code: 'EIO' }))).toBe(true)
+    expect(isLocalResourceError(Object.assign(new Error('x'), { code: 'ENOMEM' }))).toBe(true)
+  })
+
+  it('classifies by message when no code is present (incl. EIO, word-boundaried)', () => {
+    expect(isLocalResourceError(new Error('ENOSPC: no space left on device, write'))).toBe(true)
+    expect(isLocalResourceError(new Error('disk quota exceeded'))).toBe(true)
+    expect(isLocalResourceError(new Error('EIO: i/o error, write'))).toBe(true)
+    // No false match on a substring (e.g. a word containing the letters).
+    expect(isLocalResourceError(new Error('DENOSPCX not a real code'))).toBe(false)
+  })
+
+  it('does NOT classify a remote GrammyError or ordinary error', () => {
+    expect(isLocalResourceError(errors.floodWait(10))).toBe(false)
+    expect(isLocalResourceError(new Error('fetch failed'))).toBe(false)
+  })
+
+  it('throws LOCAL_RESOURCE_EXHAUSTED immediately without retrying', async () => {
+    // Before the fix: an ENOSPC thrown by the send-staging step fell through
+    // to the network-retry branch pattern OR was rethrown but only after the
+    // caller kept re-driving sends — the storm that tripped the flood ban.
+    // Now it must fail FAST on the first attempt with a distinct marker.
+    const sleep = vi.fn(async () => {})
+    let calls = 0
+    const retry = createRetryApiCall({ maxRetries: 3, sleep })
+    await expect(
+      retry(async () => {
+        calls++
+        throw Object.assign(new Error('ENOSPC: no space left on device'), { code: 'ENOSPC' })
+      }),
+    ).rejects.toThrow(LOCAL_RESOURCE_EXHAUSTED)
+    expect(calls).toBe(1) // no retry
+    expect(sleep).not.toHaveBeenCalled() // no backoff-into-flood
+  })
+
+  it('fires onFloodWait with the retry_after when a 429 is seen', async () => {
+    const seen: number[] = []
+    const sleep = vi.fn(async () => {})
+    let n = 0
+    const retry = createRetryApiCall({
+      maxRetries: 3,
+      sleep,
+      onFloodWait: (s) => seen.push(s),
+    })
+    const out = await retry(async () => {
+      if (n++ === 0) throw errors.floodWait(42)
+      return 'ok'
+    })
+    expect(out).toBe('ok')
+    expect(seen).toEqual([42])
+  })
+})

package/telegram-plugin/tests/run-hook-wrapper.test.ts

@@ -0,0 +1,132 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest'
+import { spawnSync } from 'node:child_process'
+import { mkdtempSync, rmSync, writeFileSync, readFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+/**
+ * #2555 — run-hook.sh must tolerate a Node exit-134 (uv_thread_create abort
+ * under memory pressure): retry once, and if it still aborts, skip cleanly
+ * (exit 0) rather than propagating 134. Real non-134 statuses pass through.
+ *
+ * We drive the wrapper with a fake command (a tiny sh script) whose exit code
+ * is scripted via a counter file, so we exercise the exact control flow
+ * without needing a real memory-pressured Node.
+ */
+const wrapper = resolve(
+  fileURLToPath(new URL('../hooks/run-hook.sh', import.meta.url)),
+)
+
+describe('#2555 run-hook.sh exit-134 tolerance', () => {
+  let dir: string
+  let fake: string
+  let counter: string
+
+  beforeEach(() => {
+    dir = mkdtempSync(join(tmpdir(), 'run-hook-'))
+    fake = join(dir, 'fake.sh')
+    counter = join(dir, 'n')
+    writeFileSync(counter, '0')
+  })
+  afterEach(() => rmSync(dir, { recursive: true, force: true }))
+
+  /** Fake command: exits `codes[attemptIndex]`, records each invocation. */
+  function writeFake(codes: number[]): void {
+    writeFileSync(
+      fake,
+      [
+        '#!/bin/sh',
+        `n=$(cat "${counter}")`,
+        `echo "$((n + 1))" > "${counter}"`,
+        'case "$n" in',
+        ...codes.map((c, i) => `  ${i}) exit ${c} ;;`),
+        `  *) exit ${codes[codes.length - 1]} ;;`,
+        'esac',
+      ].join('\n'),
+    )
+  }
+
+  const run = (input = '') =>
+    spawnSync('sh', [wrapper, 'sh', fake], { encoding: 'utf-8', input })
+
+  const attempts = () => Number(readFileSync(counter, 'utf-8').trim())
+
+  it('passes a clean exit 0 through without retrying', () => {
+    writeFake([0])
+    const r = run()
+    expect(r.status).toBe(0)
+    expect(attempts()).toBe(1)
+  })
+
+  it('passes a real non-134 failure through unchanged (no retry, not masked)', () => {
+    writeFake([2])
+    const r = run()
+    expect(r.status).toBe(2)
+    expect(attempts()).toBe(1)
+  })
+
+  it('retries ONCE on a 134 abort and succeeds on the second attempt', () => {
+    writeFake([134, 0])
+    const r = run()
+    expect(r.status).toBe(0)
+    expect(attempts()).toBe(2)
+  })
+
+  it('skips cleanly (exit 0) when it aborts 134 twice — no crash card', () => {
+    writeFake([134, 134])
+    const r = run()
+    expect(r.status).toBe(0) // skipped cleanly, NOT 134
+    expect(attempts()).toBe(2)
+    expect(r.stderr).toMatch(/skipping hook cleanly/)
+  })
+
+  it('exports a shrunk UV_THREADPOOL_SIZE to the child', () => {
+    writeFileSync(fake, `#!/bin/sh\necho "$UV_THREADPOOL_SIZE"\nexit 0\n`)
+    const r = run()
+    expect(r.stdout.trim()).toBe('1')
+  })
+
+  it('replays the SAME stdin payload on the retry (scanner never sees empty input)', () => {
+    // Fake: attempt 0 reads stdin then aborts 134; attempt 1 reads stdin and
+    // records it, then exits 0. If stdin were not preserved, the recorded
+    // payload on the retry would be empty.
+    const seen = join(dir, 'seen-stdin')
+    writeFileSync(
+      fake,
+      [
+        '#!/bin/sh',
+        `n=$(cat "${counter}")`,
+        `echo "$((n + 1))" > "${counter}"`,
+        'data=$(cat)', // drain stdin (the abort-after-read scenario)
+        `echo "$data" > "${seen}.$n"`,
+        '[ "$n" = "0" ] && exit 134',
+        'exit 0',
+      ].join('\n'),
+    )
+    const r = run('SECRET-PAYLOAD-123')
+    expect(r.status).toBe(0)
+    expect(attempts()).toBe(2)
+    // The RETRY (attempt 1) must have received the full payload, not empty.
+    expect(readFileSync(`${seen}.1`, 'utf-8').trim()).toBe('SECRET-PAYLOAD-123')
+  })
+
+  it('FAILS CLOSED (propagates 134) for a security hook that aborts twice', () => {
+    // A genuinely broken secret scanner must NOT silently pass — exit 0 after
+    // two aborts would be a silent security bypass.
+    const secFake = join(dir, 'secret-guard-pretool.mjs')
+    writeFileSync(
+      secFake,
+      [
+        '#!/bin/sh',
+        `n=$(cat "${counter}")`,
+        `echo "$((n + 1))" > "${counter}"`,
+        'exit 134',
+      ].join('\n'),
+    )
+    const r = spawnSync('sh', [wrapper, 'sh', secFake], { encoding: 'utf-8', input: '{}' })
+    expect(r.status).toBe(134) // fail closed — NOT skipped
+    expect(attempts()).toBe(2)
+    expect(r.stderr).toMatch(/FAILING CLOSED/)
+  })
+})