switchroom 0.18.6 → 0.18.8

package/telegram-plugin/tests/session-model-file.test.ts

@@ -0,0 +1,132 @@
+/**
+ * Durable session-model file helpers (session-model-file.ts) — the gateway
+ * side of the stickiness contract (reference/rfcs/session-model-stickiness.md).
+ */
+
+import { describe, it, expect, beforeEach, afterEach } from 'vitest'
+import { mkdtempSync, rmSync, readFileSync, writeFileSync, existsSync } from 'node:fs'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import {
+  serializeSessionModel,
+  parseSessionModel,
+  writeSessionModelFile,
+  readSessionModelFile,
+  readSessionModelFileRaw,
+  restoreSessionModelFileRaw,
+  clearSessionModelFile,
+  writeRelaunchModelIntent,
+  clearRelaunchModelIntent,
+  readConfiguredDefaultModel,
+  intentForRestartReason,
+  SESSION_MODEL_FILE,
+  RELAUNCH_MODEL_INTENT_FILE,
+  CONFIGURED_DEFAULT_MODEL_FILE,
+} from '../gateway/session-model-file.js'
+
+let dir: string
+beforeEach(() => {
+  dir = mkdtempSync(join(tmpdir(), 'switchroom-sm-file-'))
+})
+afterEach(() => {
+  rmSync(dir, { recursive: true, force: true })
+})
+
+describe('serialize/parse round-trip', () => {
+  it('round-trips a record', () => {
+    const rec = { model: 'sr-glm-5', configuredDefaultAtWrite: 'claude-sonnet-5', ts: 1783948123456 }
+    expect(parseSessionModel(serializeSessionModel(rec))).toEqual(rec)
+  })
+
+  it('rejects corrupt JSON, missing fields, and non-canonical model tokens', () => {
+    expect(parseSessionModel('{broken')).toBeNull()
+    expect(parseSessionModel('{"model":"opus"}')).toBeNull()
+    expect(parseSessionModel('{"model":"Opus 4.8","configuredDefaultAtWrite":"x","ts":1}')).toBeNull()
+    expect(parseSessionModel('{"model":42,"configuredDefaultAtWrite":"x","ts":1}')).toBeNull()
+  })
+})
+
+describe('writeSessionModelFile — canonical-token guard (review finding 7)', () => {
+  it('writes a canonical token with the current default + a fresh ts', () => {
+    writeSessionModelFile(dir, 'claude-opus-4-8', 'claude-sonnet-5')
+    const rec = readSessionModelFile(dir)!
+    expect(rec.model).toBe('claude-opus-4-8')
+    expect(rec.configuredDefaultAtWrite).toBe('claude-sonnet-5')
+    expect(Math.abs(Date.now() - rec.ts)).toBeLessThan(5000)
+  })
+
+  it('THROWS on a display label — "Opus 4.5" must never be persisted', () => {
+    expect(() => writeSessionModelFile(dir, 'Opus 4.5', 'claude-sonnet-5')).toThrow(/non-canonical/)
+    expect(existsSync(join(dir, SESSION_MODEL_FILE))).toBe(false)
+  })
+})
+
+describe('rollback snapshot (scheduleModelRelaunch dispatch failure)', () => {
+  it('restores prior content when a file existed', () => {
+    writeSessionModelFile(dir, 'claude-opus-4-8', 'claude-sonnet-5')
+    const snapshot = readSessionModelFileRaw(dir)
+    writeSessionModelFile(dir, 'sr-glm-5', 'claude-sonnet-5')
+    restoreSessionModelFileRaw(dir, snapshot)
+    expect(readSessionModelFile(dir)!.model).toBe('claude-opus-4-8')
+  })
+
+  it('deletes the file when there was none before', () => {
+    const snapshot = readSessionModelFileRaw(dir) // null
+    writeSessionModelFile(dir, 'sr-glm-5', 'claude-sonnet-5')
+    restoreSessionModelFileRaw(dir, snapshot)
+    expect(existsSync(join(dir, SESSION_MODEL_FILE))).toBe(false)
+  })
+})
+
+describe('relaunch intent', () => {
+  it('writes one-line JSON with intent, reason, and embedded ts (the freshness clock)', () => {
+    writeRelaunchModelIntent(dir, 'keep', 'user: /new from chat')
+    const raw = readFileSync(join(dir, RELAUNCH_MODEL_INTENT_FILE), 'utf8')
+    const parsed = JSON.parse(raw)
+    expect(parsed.intent).toBe('keep')
+    expect(parsed.reason).toBe('user: /new from chat')
+    expect(Math.abs(Date.now() - parsed.ts)).toBeLessThan(5000)
+  })
+
+  it('last-writer-wins and clearable', () => {
+    writeRelaunchModelIntent(dir, 'keep', 'a')
+    writeRelaunchModelIntent(dir, 'revert', 'b')
+    expect(JSON.parse(readFileSync(join(dir, RELAUNCH_MODEL_INTENT_FILE), 'utf8')).intent).toBe('revert')
+    clearRelaunchModelIntent(dir)
+    expect(existsSync(join(dir, RELAUNCH_MODEL_INTENT_FILE))).toBe(false)
+  })
+})
+
+describe('intentForRestartReason — the triggerSelfRestart per-reason table (RFC §3)', () => {
+  it.each([
+    'schedule-restart-immediate',
+    'restart-drain-cap-forced',
+    'turn-complete-pending-restart',
+    'fleet-fallback-resume',
+    'sr-to-claude-model-switch',
+  ])('switchroom-managed relaunch %s → keep', (reason) => {
+    expect(intentForRestartReason(reason)).toBe('keep')
+  })
+
+  it('inline-button-restart (operator-deliberate) → revert', () => {
+    expect(intentForRestartReason('inline-button-restart')).toBe('revert')
+  })
+
+  it('unknown gateway reasons default to keep (only gateway code calls triggerSelfRestart; crashes never do)', () => {
+    expect(intentForRestartReason('some-future-recovery-path')).toBe('keep')
+  })
+})
+
+describe('readConfiguredDefaultModel', () => {
+  it('reads the trimmed value; null when absent or empty', () => {
+    expect(readConfiguredDefaultModel(dir)).toBeNull()
+    writeFileSync(join(dir, CONFIGURED_DEFAULT_MODEL_FILE), 'claude-sonnet-5\n')
+    expect(readConfiguredDefaultModel(dir)).toBe('claude-sonnet-5')
+    writeFileSync(join(dir, CONFIGURED_DEFAULT_MODEL_FILE), '\n')
+    expect(readConfiguredDefaultModel(dir)).toBeNull()
+  })
+
+  it('clearSessionModelFile is a safe no-op when absent', () => {
+    expect(() => clearSessionModelFile(dir)).not.toThrow()
+  })
+})

package/telegram-plugin/tests/session-model-source.test.ts

@@ -0,0 +1,67 @@
+/**
+ * Pins the /status session-model freshness contract (#2982 + live-model PR):
+ * the FRESHEST observation wins between the transcript's `message.model` and
+ * the /model override, arbitrated by a shared monotonic sequence. This is the
+ * "model display must never be stale" invariant:
+ *
+ *   - override set AFTER the last transcript observation (idle-time /model
+ *     switch, no assistant line yet) → /status shows the override;
+ *   - a new assistant line after that → the transcript wins again.
+ */
+import { describe, it, expect } from 'vitest'
+import { createSessionModelSource } from '../gateway/session-model-source.js'
+
+describe('createSessionModelSource — freshest observation wins', () => {
+  it('returns null when neither source has reported', () => {
+    const s = createSessionModelSource()
+    expect(s.resolve()).toBeNull()
+    expect(s.getOverride()).toBeNull()
+  })
+
+  it('transcript-only → transcript', () => {
+    const s = createSessionModelSource()
+    s.noteTranscriptModel('claude-opus-4-8')
+    expect(s.resolve()).toEqual({ model: 'claude-opus-4-8', source: 'transcript' })
+  })
+
+  it('override-only → override (fresh boot before the first assistant line)', () => {
+    const s = createSessionModelSource()
+    s.setOverride('sr-glm-5')
+    expect(s.resolve()).toEqual({ model: 'sr-glm-5', source: 'override' })
+  })
+
+  it('idle-after-switch window: an override set AFTER the last transcript line wins', () => {
+    // The #2982 regression this pins: /model switch while idle — the
+    // transcript still holds the OLD model, the override holds the NEW one.
+    const s = createSessionModelSource()
+    s.noteTranscriptModel('claude-opus-4-8') // old model's last assistant line
+    s.setOverride('Sonnet 5') // confirmed switch, no assistant line yet
+    expect(s.resolve()).toEqual({ model: 'Sonnet 5', source: 'override' })
+  })
+
+  it('a NEW assistant line after the switch reclaims the transcript as the source', () => {
+    const s = createSessionModelSource()
+    s.noteTranscriptModel('claude-opus-4-8')
+    s.setOverride('Sonnet 5')
+    s.noteTranscriptModel('claude-sonnet-5') // first line under the new model
+    expect(s.resolve()).toEqual({ model: 'claude-sonnet-5', source: 'transcript' })
+  })
+
+  it('clearing the override (null) falls back to the transcript', () => {
+    const s = createSessionModelSource()
+    s.noteTranscriptModel('claude-opus-4-8')
+    s.setOverride('sr-glm-5')
+    s.setOverride(null)
+    expect(s.getOverride()).toBeNull()
+    expect(s.resolve()).toEqual({ model: 'claude-opus-4-8', source: 'transcript' })
+  })
+
+  it('getOverride reports the override independent of freshness', () => {
+    const s = createSessionModelSource()
+    s.setOverride('sr-glm-5')
+    s.noteTranscriptModel('claude-opus-4-8') // transcript is now fresher
+    expect(s.resolve()?.source).toBe('transcript')
+    // ...but the override record itself is still readable (menu "session" marker).
+    expect(s.getOverride()).toBe('sr-glm-5')
+  })
+})

package/telegram-plugin/tests/session-tail.test.ts

@@ -345,6 +345,42 @@ describe('projectTranscriptLine', () => {
       messageId: '103',
     })
   })
+
+  // ─── Live model capture (message.model) ──────────────────────────────
+  it('emits a model event (first) from message.model on an assistant line', () => {
+    const line = JSON.stringify({
+      type: 'assistant',
+      message: {
+        model: 'claude-opus-4-8',
+        content: [{ type: 'tool_use', name: 'Bash', id: 'toolu_01', input: {} }],
+      },
+    })
+    // Model event is emitted BEFORE the content events so a same-batch render
+    // already reflects the current model.
+    expect(projectTranscriptLine(line)).toEqual([
+      { kind: 'model', model: 'claude-opus-4-8' },
+      { kind: 'tool_use', toolName: 'Bash', toolUseId: 'toolu_01', input: {} },
+    ])
+  })
+
+  it('skips a synthetic model sentinel (keeps no model event)', () => {
+    const line = JSON.stringify({
+      type: 'assistant',
+      message: {
+        model: '<synthetic>',
+        content: [{ type: 'thinking', thinking: '...' }],
+      },
+    })
+    expect(projectTranscriptLine(line)).toEqual([{ kind: 'thinking' }])
+  })
+
+  it('omits the model event when message.model is absent', () => {
+    const line = JSON.stringify({
+      type: 'assistant',
+      message: { content: [{ type: 'thinking', thinking: '...' }] },
+    })
+    expect(projectTranscriptLine(line)).toEqual([{ kind: 'thinking' }])
+  })
 })
 
 // ─── Bug 1 regression: per-file cursor state survives re-attachment ────
@@ -490,6 +526,34 @@ describe('projectSubagentLine', () => {
     ])
   })
 
+  it('emits sub_agent_model (first) from message.model on a sub-agent assistant line', () => {
+    const st = { hasEmittedStart: true }
+    const line = JSON.stringify({
+      type: 'assistant',
+      message: {
+        model: 'sr-glm-5',
+        content: [{ type: 'tool_use', id: 'toolu_a', name: 'Read', input: { file_path: '/a' } }],
+      },
+    })
+    const events = projectSubagentLine(line, 'X', st)
+    expect(events[0]).toEqual({ kind: 'sub_agent_model', agentId: 'X', model: 'sr-glm-5' })
+    expect(events[1].kind).toBe('sub_agent_tool_use')
+  })
+
+  it('skips a synthetic sub-agent model sentinel', () => {
+    const st = { hasEmittedStart: true }
+    const line = JSON.stringify({
+      type: 'assistant',
+      message: {
+        model: '<synthetic>',
+        content: [{ type: 'tool_use', id: 'toolu_a', name: 'Read', input: { file_path: '/a' } }],
+      },
+    })
+    const events = projectSubagentLine(line, 'X', st)
+    expect(events.some((e) => e.kind === 'sub_agent_model')).toBe(false)
+    expect(events[0].kind).toBe('sub_agent_tool_use')
+  })
+
   it('emits sub_agent_tool_use for regular tools; nested Agent fires ONLY nested_spawn', () => {
     const st = { hasEmittedStart: true }
     const line = JSON.stringify({

package/telegram-plugin/tests/silent-end.test.ts

@@ -10,6 +10,7 @@ import {
   recordSilentTurnEnd,
   recordUndeliveredTurnEnd,
   SILENT_END_MAX_RETRIES,
+  SILENT_END_STALE_RECORD_MAX_AGE_MS,
 } from '../silent-end.js'
 import { isFinalAnswerReply } from '../final-answer-detect.js'
 
@@ -206,12 +207,56 @@ describe('recordSilentTurnEnd — #1161 exhaustion detection', () => {
       chatId: 'c', threadId: null, turnKey: 'c:_',
       retryCount: SILENT_END_MAX_RETRIES, timestamp: 0,
     }))
-    const r = recordSilentTurnEnd({ chatId: 'c', threadId: null, turnKey: 'c:_' })
+    // Pin `now` alongside the record's timestamp=0 so this exercises the
+    // genuine same-turn ladder, not fix #8's age-based staleness bound
+    // (which is covered by its own dedicated tests below).
+    const r = recordSilentTurnEnd(
+      { chatId: 'c', threadId: null, turnKey: 'c:_' },
+      { now: () => 0 },
+    )
     expect(r.exhausted).toBe(true)
     // State cleared so the Stop hook on this final turn allows the stop.
     expect(readSilentEndState()).toBeNull()
   })
 
+  it('fix #8: an exhausted record older than the plausible turn lifetime starts a fresh retry budget (no delivery evidence needed)', () => {
+    // A crash/interrupt bypassed the gateway's own exhaust-read-and-clear,
+    // so a spent (retryCount >= MAX) record from an OLD turn survives on
+    // disk. turnKey is the STABLE statusKey(chatId, threadId) — it matches
+    // this brand-new dark turn on the same chat/thread even though it
+    // belongs to a completely different turn instance.
+    const path = join(stateDir, 'silent-end-pending.json')
+    writeFileSync(path, JSON.stringify({
+      chatId: 'c', threadId: null, turnKey: 'c:_',
+      retryCount: SILENT_END_MAX_RETRIES, timestamp: 0,
+    }))
+    const now = SILENT_END_STALE_RECORD_MAX_AGE_MS + 1000 // just past the age bound
+    const r = recordSilentTurnEnd(
+      { chatId: 'c', threadId: null, turnKey: 'c:_' },
+      { now: () => now },
+    )
+    // Must run its OWN re-prompt ladder, not immediately fall back.
+    expect(r.exhausted).toBe(false)
+    expect(readSilentEndState()).toMatchObject({ turnKey: 'c:_', retryCount: 0 })
+  })
+
+  it('fix #8: a genuinely same-turn exhausted record (within the age bound) still reports exhausted — no regression', () => {
+    const path = join(stateDir, 'silent-end-pending.json')
+    const recentTimestamp = 1_000_000
+    writeFileSync(path, JSON.stringify({
+      chatId: 'c', threadId: null, turnKey: 'c:_',
+      retryCount: SILENT_END_MAX_RETRIES, timestamp: recentTimestamp,
+    }))
+    // Well within the plausible single-turn retry-ladder window.
+    const now = recentTimestamp + 5000
+    const r = recordSilentTurnEnd(
+      { chatId: 'c', threadId: null, turnKey: 'c:_' },
+      { now: () => now },
+    )
+    expect(r.exhausted).toBe(true)
+    expect(readSilentEndState()).toBeNull()
+  })
+
   it('treats a capped prior state for a DIFFERENT turn as a fresh silent-end', () => {
     const path = join(stateDir, 'silent-end-pending.json')
     writeFileSync(path, JSON.stringify({

package/telegram-plugin/tests/slot-banner-boot-recovery.test.ts

@@ -170,7 +170,7 @@ describe("slot-banner boot recovery (gateway wiring)", () => {
     const gw2 = makeGateway(fs, tg);
     const res = await gw2.bootCleanup();
 
-    expect(res).toEqual({ cleared: 1, total: 1 });
+    expect(res).toEqual({ cleared: 1, retained: 0, kept: 0, total: 1 });
     expect(tg.pinned.has(`${OWNER}:${msgId}`)).toBe(false); // orphan unpinned
     expect(loadStatusPins(PATH, fs)).toEqual([]); // store emptied
   });
@@ -220,7 +220,7 @@ describe("slot-banner boot recovery (gateway wiring)", () => {
     // Fresh boot recovers it from the pending record.
     const gw2 = makeGateway(fs, tg);
     const res = await gw2.bootCleanup();
-    expect(res).toEqual({ cleared: 1, total: 1 });
+    expect(res).toEqual({ cleared: 1, retained: 0, kept: 0, total: 1 });
     expect(tg.pinned.has(`${OWNER}:${rec[0].messageId}`)).toBe(false);
     expect(loadStatusPins(PATH, fs)).toEqual([]);
   });
@@ -241,6 +241,6 @@ describe("slot-banner boot recovery (gateway wiring)", () => {
     expect(loadStatusPins(PATH, fs)).toEqual([]);
 
     const gw2 = makeGateway(fs, tg);
-    expect(await gw2.bootCleanup()).toEqual({ cleared: 0, total: 0 });
+    expect(await gw2.bootCleanup()).toEqual({ cleared: 0, retained: 0, kept: 0, total: 0 });
   });
 });

package/telegram-plugin/tests/status-pin-boot-recovery.test.ts

@@ -141,7 +141,7 @@ describe("status-pin boot recovery (gateway wiring)", () => {
     const gw2 = makeGateway(fs, tg);
     const res = await gw2.bootCleanup();
 
-    expect(res).toEqual({ cleared: 1, total: 1 });
+    expect(res).toEqual({ cleared: 1, retained: 0, kept: 0, total: 1 });
     expect(tg.pinned.has("-100123:715")).toBe(false); // orphan unpinned
     expect(loadStatusPins(PATH, fs)).toEqual([]); // store emptied
   });
@@ -177,7 +177,7 @@ describe("status-pin boot recovery (gateway wiring)", () => {
     // Fresh boot recovers it from the pending record.
     const gw2 = makeGateway(fs, tg);
     const res = await gw2.bootCleanup();
-    expect(res).toEqual({ cleared: 1, total: 1 });
+    expect(res).toEqual({ cleared: 1, retained: 0, kept: 0, total: 1 });
     expect(tg.pinned.has("-100123:715")).toBe(false);
     expect(loadStatusPins(PATH, fs)).toEqual([]);
   });
@@ -196,7 +196,7 @@ describe("status-pin boot recovery (gateway wiring)", () => {
     expect(loadStatusPins(PATH, fs)).toEqual([]);
 
     const gw2 = makeGateway(fs, tg);
-    expect(await gw2.bootCleanup()).toEqual({ cleared: 0, total: 0 });
+    expect(await gw2.bootCleanup()).toEqual({ cleared: 0, retained: 0, kept: 0, total: 0 });
   });
 });
 

package/telegram-plugin/tests/status-pin-store.test.ts

@@ -1,5 +1,6 @@
 import { describe, it, expect } from "vitest";
 import {
+  BOOT_UNPIN_MAX_ATTEMPTS,
   loadStatusPins,
   mutateStatusPinRow,
   persistStatusPins,
@@ -195,12 +196,12 @@ describe("runStatusPinBootCleanup", () => {
       ["-100123", 715],
       ["-100999", 42],
     ]);
-    expect(res).toEqual({ cleared: 2, total: 2 });
+    expect(res).toEqual({ cleared: 2, retained: 0, kept: 0, total: 2 });
     // Store empty afterwards → no re-attempt next boot.
     expect(loadStatusPins(PATH, fs)).toEqual([]);
   });
 
-  it("a failing unpin is non-fatal and the store is still emptied", async () => {
+  it("retry-safe (#3001): a failing unpin is non-fatal, RETAINS the row with an attempt counter, and drops only the succeeded one", async () => {
     const { fs } = memFs();
     persistStatusPins(PATH, fs, [
       pin({ pinKey: "fg:c:1", chatId: "-100123", messageId: 5 }),
@@ -216,11 +217,66 @@ describe("runStatusPinBootCleanup", () => {
       log: () => {},
     });
 
-    // One failed, one succeeded — still non-fatal, store still emptied.
-    expect(res).toEqual({ cleared: 1, total: 2 });
+    // One failed, one succeeded — the failure is retained for a next-boot
+    // retry instead of forfeiting the orphan (the pre-#3001 behaviour).
+    expect(res).toEqual({ cleared: 1, retained: 1, kept: 0, total: 2 });
+    expect(loadStatusPins(PATH, fs)).toEqual([
+      { pinKey: "fg:c:1", chatId: "-100123", messageId: 5, attempts: 1 },
+    ]);
+  });
+
+  it("retry-safe (#3001): a row is forfeited once its attempts reach BOOT_UNPIN_MAX_ATTEMPTS", async () => {
+    const { fs } = memFs();
+    persistStatusPins(PATH, fs, [
+      pin({
+        pinKey: "fg:c:1",
+        chatId: "-100123",
+        messageId: 5,
+        attempts: BOOT_UNPIN_MAX_ATTEMPTS - 1,
+      }),
+    ]);
+    const res = await runStatusPinBootCleanup({
+      path: PATH,
+      fs,
+      unpin: async () => {
+        throw new Error("chat gone forever");
+      },
+      log: () => {},
+    });
+    // Final attempt failed too — forfeited, not retained: a permanently-
+    // undeliverable unpin must not re-fail on every future boot.
+    expect(res).toEqual({ cleared: 0, retained: 0, kept: 0, total: 1 });
     expect(loadStatusPins(PATH, fs)).toEqual([]);
   });
 
+  it("tool pins (#3001): an UNEXPIRED `tool:` row survives the boot untouched; an EXPIRED one is unpinned and dropped", async () => {
+    const { fs } = memFs();
+    const now = 1_750_000_000_000;
+    persistStatusPins(PATH, fs, [
+      pin({ pinKey: "tool:-100123:70", chatId: "-100123", messageId: 70, expiresAt: now + 1 }),
+      pin({ pinKey: "tool:-100123:71", chatId: "-100123", messageId: 71, expiresAt: now }),
+      pin({ pinKey: "wk:agent-x", chatId: "-100123", messageId: 72 }),
+    ]);
+    const unpinned: number[] = [];
+    const res = await runStatusPinBootCleanup({
+      path: PATH,
+      fs,
+      unpin: async (_c, messageId) => {
+        unpinned.push(messageId);
+      },
+      now,
+      log: () => {},
+    });
+    // The expired tool pin and the work-scoped wk: pin are unpinned; the
+    // unexpired tool pin is kept for a future boot (restart ≠ reset for a
+    // deliberate agent pin with no "work finished" event).
+    expect(unpinned).toEqual([71, 72]);
+    expect(res).toEqual({ cleared: 2, retained: 0, kept: 1, total: 3 });
+    expect(loadStatusPins(PATH, fs)).toEqual([
+      { pinKey: "tool:-100123:70", chatId: "-100123", messageId: 70, expiresAt: now + 1 },
+    ]);
+  });
+
   it("no-op on a fresh boot with no persisted pins (no unpin calls)", async () => {
     const { fs } = memFs();
     let calls = 0;
@@ -232,7 +288,7 @@ describe("runStatusPinBootCleanup", () => {
       },
       log: () => {},
     });
-    expect(res).toEqual({ cleared: 0, total: 0 });
+    expect(res).toEqual({ cleared: 0, retained: 0, kept: 0, total: 0 });
     expect(calls).toBe(0);
   });
 
@@ -254,7 +310,7 @@ describe("runStatusPinBootCleanup", () => {
       log: () => {},
     });
     expect(unpinned).toEqual([["-100777", 314]]);
-    expect(res).toEqual({ cleared: 1, total: 1 });
+    expect(res).toEqual({ cleared: 1, retained: 0, kept: 0, total: 1 });
     expect(loadStatusPins(PATH, fs)).toEqual([]);
   });
 });

package/telegram-plugin/tests/stream-controller-chunk-cap.test.ts

@@ -0,0 +1,122 @@
+/**
+ * Wire-level regression test for the chunk-boundary cap bug
+ * (fix/rich-render-chunk-boundary-cap).
+ *
+ * With `SWITCHROOM_RICH_RENDER` on, a near-cap body full of escapable chars
+ * (`_ * |`) makes `renderSafe` degrade the whole document to plain (its escaped
+ * rich form exceeds RICH_MESSAGE_MAX_CHARS). BEFORE the fix, the stream
+ * controller shipped that ~32k plain body through the plain `sendMessage`
+ * endpoint in ONE call — Telegram's plain endpoint caps at 4096, so the send
+ * is rejected (`message is too long`) and the streamed answer is dropped.
+ *
+ * AFTER the fix, `renderOutboundChunks` re-splits at safe boundaries so every
+ * emitted send fits its own wire cap: rich pieces <= 32768, plain pieces
+ * <= 4096, and no fenced block is bisected.
+ */
+import { describe, it, expect, afterEach } from "vitest";
+import { createStreamController } from "../stream-controller.js";
+import { createFakeBotApi } from "./fake-bot-api.js";
+import { RICH_MESSAGE_MAX_CHARS } from "../format.js";
+
+const PLAIN_CAP = 4096; // Telegram's legacy plain-text sendMessage cap (format.ts:29).
+
+function fenceCount(s: string): number {
+  return (s.match(/^```/gm) ?? []).length;
+}
+
+describe("stream-controller enforces the wire cap on the post-escape body", () => {
+  afterEach(() => {
+    delete process.env.SWITCHROOM_RICH_RENDER;
+  });
+
+  it("REGRESSION: near-cap escapable first send never exceeds the plain wire cap", async () => {
+    process.env.SWITCHROOM_RICH_RENDER = "1";
+    const bot = createFakeBotApi({ startMessageId: 1000 });
+    const unit = "a_b*c|d ";
+    const body = unit.repeat(Math.floor((RICH_MESSAGE_MAX_CHARS - 20) / unit.length));
+
+    const stream = createStreamController({
+      bot: bot as unknown as Parameters<typeof createStreamController>[0]["bot"],
+      chatId: "c1",
+      throttleMs: 0,
+    });
+    await stream.update(body);
+    await stream.finalize();
+
+    expect(bot.state.sent.length).toBeGreaterThan(0);
+    for (const s of bot.state.sent) {
+      // Every send fits the rich cap...
+      expect(s.text.length).toBeLessThanOrEqual(RICH_MESSAGE_MAX_CHARS);
+      // ...and a PLAIN send (rich !== true) additionally fits the 4096 plain
+      // endpoint cap — the invariant HEAD violated (one ~32k plain send).
+      if (!s.rich) expect(s.text.length).toBeLessThanOrEqual(PLAIN_CAP);
+      // No send bisects a fenced block.
+      expect(fenceCount(s.text) % 2).toBe(0);
+    }
+  }, 30000);
+
+  it("BLOCKER: multi-update oversize stream emits tails ONCE, not per edit tick", async () => {
+    // Reproduces the duplicate-flood blocker: an oversize body splits into N
+    // pieces. The FIRST flush (send path) emits the anchor + (N-1) tail
+    // messages. Every SUBSEQUENT throttled flush routes through the EDIT
+    // callback. The pre-fix code re-sent all (N-1) tails as brand-new messages
+    // on each edit tick, so `sent.length` grew by (N-1) every update. After the
+    // fix, tails are parked once and edited in place — `sent.length` is flat.
+    process.env.SWITCHROOM_RICH_RENDER = "1";
+    const bot = createFakeBotApi({ startMessageId: 3000 });
+    const unit = "a_b*c|d ";
+    // Near-cap body that degrades to plain and splits into several pieces.
+    const base = unit.repeat(Math.floor((RICH_MESSAGE_MAX_CHARS - 20) / unit.length));
+    // Distinct short prefix per flush so the HEAD piece actually changes —
+    // an unchanged head yields a not-modified edit, which short-circuits before
+    // the tail loop and would hide the duplicate-resend bug.
+    const bodyFor = (i: number) => `v${i} ${base}`;
+
+    const stream = createStreamController({
+      bot: bot as unknown as Parameters<typeof createStreamController>[0]["bot"],
+      chatId: "c1",
+      throttleMs: 0,
+    });
+
+    // First flush → send path: anchor + tails, emitted exactly once.
+    await stream.update(bodyFor(1));
+    const afterFirst = bot.state.sent.length;
+    expect(afterFirst).toBeGreaterThan(1); // genuinely multi-piece
+
+    // Drive several more oversize updates — each routes through the EDIT
+    // callback. The count must NOT grow: tails are edited in place, not resent.
+    await stream.update(bodyFor(2));
+    expect(bot.state.sent.length).toBe(afterFirst);
+    await stream.update(bodyFor(3));
+    expect(bot.state.sent.length).toBe(afterFirst);
+    await stream.update(bodyFor(4));
+    expect(bot.state.sent.length).toBe(afterFirst);
+    await stream.finalize();
+
+    // Final: exactly the anchor + tail set, no duplicates across the lifetime.
+    expect(bot.state.sent.length).toBe(afterFirst);
+    const ids = bot.state.sent.map((s) => s.message_id);
+    expect(new Set(ids).size).toBe(ids.length); // no duplicate message ids
+
+    // Every currently-visible message fits its wire cap and (for plain) 4096.
+    for (const s of bot.state.sent) {
+      const cur = bot.textOf(s.message_id) ?? "";
+      expect(cur.length).toBeLessThanOrEqual(RICH_MESSAGE_MAX_CHARS);
+      if (!s.rich) expect(cur.length).toBeLessThanOrEqual(PLAIN_CAP);
+    }
+  }, 30000);
+
+  it("flag OFF leaves the single-send path untouched", async () => {
+    const bot = createFakeBotApi({ startMessageId: 2000 });
+    const stream = createStreamController({
+      bot: bot as unknown as Parameters<typeof createStreamController>[0]["bot"],
+      chatId: "c1",
+      throttleMs: 0,
+    });
+    await stream.update("**hi** _there_");
+    await stream.finalize();
+    expect(bot.state.sent).toHaveLength(1);
+    expect(bot.state.sent[0].rich).toBe(true);
+    expect(bot.state.sent[0].text).toBe("**hi** _there_");
+  });
+});

package/telegram-plugin/tests/subagent-tracker-hooks.test.ts

@@ -108,6 +108,45 @@ describe('subagent-tracker-pretool', () => {
     expect(row!.last_activity_at).toBe(row!.started_at)
   })
 
+  it('persists tool_input.model as the first-paint model on the row', () => {
+    const event = {
+      session_id: 'sess-model',
+      tool_name: 'Agent',
+      tool_use_id: 'toolu_model001',
+      tool_input: {
+        subagent_type: 'worker',
+        description: 'Build with a pinned model',
+        run_in_background: true,
+        model: 'claude-opus-4-8',
+      },
+    }
+    const result = runHook(PRETOOL_SCRIPT, event)
+    expect(result.status).toBe(0)
+
+    const db = openDb()
+    const row = db.prepare('SELECT model FROM subagents WHERE id = ?').get('toolu_model001') as
+      | { model: string | null }
+      | undefined
+    expect(row?.model).toBe('claude-opus-4-8')
+  })
+
+  it('leaves model null when the Agent dispatch carries no model', () => {
+    const event = {
+      session_id: 'sess-nomodel',
+      tool_name: 'Agent',
+      tool_use_id: 'toolu_nomodel001',
+      tool_input: { subagent_type: 'worker', description: 'no model', run_in_background: false },
+    }
+    const result = runHook(PRETOOL_SCRIPT, event)
+    expect(result.status).toBe(0)
+
+    const db = openDb()
+    const row = db.prepare('SELECT model FROM subagents WHERE id = ?').get('toolu_nomodel001') as
+      | { model: string | null }
+      | undefined
+    expect(row?.model ?? null).toBeNull()
+  })
+
   it('does not write a row when tool_name is not Agent', () => {
     const event = {
       session_id: 'sess-abc123',