switchroom 0.18.6 → 0.18.8

package/telegram-plugin/dist/server.js

@@ -17160,6 +17160,21 @@ function createToolLabelSidecar(opts) {
 }
 var init_tool_label_sidecar = () => {};
 
+// model-label.ts
+function isModelSentinel(model) {
+  if (typeof model !== "string")
+    return true;
+  const m = model.trim();
+  if (m.length === 0)
+    return true;
+  if (m.startsWith("<"))
+    return true;
+  if (!/^[A-Za-z0-9][A-Za-z0-9._/-]*$/.test(m))
+    return true;
+  return false;
+}
+var init_model_label = () => {};
+
 // session-tail.ts
 import {
   closeSync,
@@ -17300,6 +17315,10 @@ function projectTranscriptLine(line) {
     if (!Array.isArray(content))
       return [];
     const events = [];
+    const mainModel = message?.model;
+    if (typeof mainModel === "string" && !isModelSentinel(mainModel)) {
+      events.push({ kind: "model", model: mainModel });
+    }
     const textEvents = projectAssistantTextBlocks(content, (text, blockIndex, lastInMessage) => ({ kind: "text", text, blockIndex, lastInMessage }));
     content.forEach((c, i) => {
       const ct = c.type;
@@ -17402,6 +17421,10 @@ function projectSubagentLine(line, agentId, state) {
     if (!Array.isArray(content))
       return [];
     const events = [];
+    const subModel = message?.model;
+    if (typeof subModel === "string" && !isModelSentinel(subModel)) {
+      events.push({ kind: "sub_agent_model", agentId, model: subModel });
+    }
     const textEvents = projectAssistantTextBlocks(content, (text, blockIndex, lastInMessage) => ({
       kind: "sub_agent_text",
       agentId,
@@ -17903,6 +17926,7 @@ var MAX_JSONL_LINE_BYTES, MAX_ERROR_TEXT_CHARS = 500;
 var init_session_tail = __esm(() => {
   init_operator_events();
   init_tool_label_sidecar();
+  init_model_label();
   MAX_JSONL_LINE_BYTES = 2 * 1024 * 1024;
 });
 

package/telegram-plugin/flood-circuit-breaker.ts

@@ -0,0 +1,123 @@
+/**
+ * Telegram per-bot flood-wait circuit breaker (issue #2923).
+ *
+ * When a burst of outbound sends trips Telegram's per-bot-token flood limit,
+ * the API returns `429 { retry_after: N }` — a SERVER-SIDE ban on the bot
+ * token that no client-side lever clears early (observed retry_after ~4116s,
+ * ~68 min). The failure is misleading: the container is `Up`, the gateway is
+ * polling, inbound works — but every outbound send is rejected. Worse, each
+ * `docker restart` posts a fresh boot/config card = another send INTO the
+ * open window, which can reset/extend the flood counter. A local, recoverable
+ * disk-full problem thereby amplifies into a remote, unrecoverable ban.
+ *
+ * This breaker persists the flood-wait window to disk so that:
+ *   - `retryApiCall`'s `onFloodWait` hook records it the moment a 429 is seen;
+ *   - a restart-time NON-ESSENTIAL send (boot card, config summary) consults
+ *     `isFloodWaitActive` and SKIPS while the ban is open, so a restart during
+ *     a flood-wait doesn't feed the counter and prolong the ban.
+ *
+ * The state file is tiny JSON under the agent's telegram state dir. All the
+ * logic is pure + injectable so it unit tests without a real clock or bot.
+ */
+
+import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+
+export interface FloodWaitState {
+  /** Epoch ms at which the flood-wait window expires. */
+  untilTs: number
+  /** The retry_after (seconds) Telegram reported, for diagnostics. */
+  retryAfterSec: number
+  /** Epoch ms the window was (re)recorded. */
+  recordedTs: number
+}
+
+/** Default marker filename inside the telegram state dir. */
+export const FLOOD_STATE_FILE = 'flood-wait.json'
+
+/**
+ * Resolve the flood-wait marker path from a telegram state dir. Kept as a
+ * helper so callers share one location.
+ */
+export function floodStatePath(stateDir: string): string {
+  return join(stateDir, FLOOD_STATE_FILE)
+}
+
+/**
+ * Compute the flood-wait state for an observed `retry_after`. Extends (never
+ * shrinks) an existing window: if a fresh 429 reports a shorter remaining ban
+ * than we already recorded, we keep the longer expiry — the server is the
+ * authority and being conservative avoids sending back into an open window.
+ */
+export function computeFloodWait(
+  prior: FloodWaitState | null,
+  retryAfterSec: number,
+  now: number,
+): FloodWaitState {
+  const candidate = now + Math.max(0, retryAfterSec) * 1000
+  const untilTs = prior && prior.untilTs > candidate ? prior.untilTs : candidate
+  return { untilTs, retryAfterSec, recordedTs: now }
+}
+
+/** Remaining ban time in ms (0 when no active window). */
+export function floodWaitRemainingMs(state: FloodWaitState | null, now: number): number {
+  if (!state) return 0
+  return Math.max(0, state.untilTs - now)
+}
+
+/** True while the flood-wait ban is still open. */
+export function isFloodWaitActive(state: FloodWaitState | null, now: number): boolean {
+  return floodWaitRemainingMs(state, now) > 0
+}
+
+/** Read persisted flood state; null on absence / parse failure. */
+export function readFloodState(path: string): FloodWaitState | null {
+  try {
+    if (!existsSync(path)) return null
+    const raw = JSON.parse(readFileSync(path, 'utf-8')) as Partial<FloodWaitState>
+    if (typeof raw.untilTs !== 'number') return null
+    return {
+      untilTs: raw.untilTs,
+      retryAfterSec: typeof raw.retryAfterSec === 'number' ? raw.retryAfterSec : 0,
+      recordedTs: typeof raw.recordedTs === 'number' ? raw.recordedTs : 0,
+    }
+  } catch {
+    return null
+  }
+}
+
+/** Persist flood state (best-effort — a write failure must not crash the send path). */
+export function writeFloodState(path: string, state: FloodWaitState): void {
+  try {
+    mkdirSync(dirname(path), { recursive: true })
+    writeFileSync(path, JSON.stringify(state), { mode: 0o600 })
+  } catch {
+    /* best-effort */
+  }
+}
+
+/**
+ * Build the `onFloodWait` callback for `createRetryApiCall`, wired to persist
+ * (and extend) the window at `path`. Reads current state, merges the new
+ * retry_after, writes it back.
+ */
+export function makeFloodWaitRecorder(
+  path: string,
+  now: () => number = Date.now,
+): (retryAfterSec: number) => void {
+  return (retryAfterSec: number) => {
+    const t = now()
+    const next = computeFloodWait(readFloodState(path), retryAfterSec, t)
+    writeFloodState(path, next)
+  }
+}
+
+/**
+ * Decide whether a NON-ESSENTIAL restart-time send (boot card, config
+ * summary) should be suppressed because a flood-wait is active. Returns the
+ * remaining ms when suppressed (>0), or 0 to proceed. Reads state fresh so a
+ * concurrently-updated window is honoured.
+ */
+export function suppressNonEssentialSendMs(path: string, now: number): number {
+  return floodWaitRemainingMs(readFloodState(path), now)
+}

package/telegram-plugin/gateway/activity-card-store.ts

@@ -43,6 +43,11 @@
  * failure than one frozen orphan. A benign-400 (message already
  * deleted/vanished, or "not modified") is NOT counted as a finalize — nothing
  * was delivered — see the `vanished` tally in `runActivityCardBootReaper`.
+ *
+ * The UNPIN half is different (#3001): unpinning is idempotent, so it gets
+ * AT-LEAST-ONCE (capped) semantics — a failed unpin re-persists the record
+ * with `finalizeAttempted: true` + an `unpinAttempts` counter so the next boot
+ * retries ONLY the unpin (never the edit), up to BOOT_UNPIN_MAX_ATTEMPTS.
  */
 
 export interface ActivityCardStoreFsSeam {
@@ -73,8 +78,21 @@ export interface ActivityCardRecord {
    *  forever). Optional so a v1-shape record (pre-unpin-tracking) still
    *  loads and degrades to "don't attempt an unpin", never a crash. */
   pinned?: boolean
+  /** Set when the boot reaper retains a record ONLY to retry its failed
+   *  unpin (#3001). The finalizing edit stays AT-MOST-ONCE: a retained
+   *  record's edit was already attempted, so the next boot skips the edit
+   *  and only retries the (idempotent) unpin. */
+  finalizeAttempted?: boolean
+  /** Boot-reaper unpin retry counter (#3001); the record is forfeited at
+   *  BOOT_UNPIN_MAX_ATTEMPTS. Absent = 0. */
+  unpinAttempts?: number
 }
 
+/** Cap on cross-boot unpin retries — same rationale as the status-pin
+ *  store's BOOT_UNPIN_MAX_ATTEMPTS (bound a permanently-undeliverable
+ *  unpin; unpins themselves are idempotent so retrying is safe). */
+export const BOOT_UNPIN_MAX_ATTEMPTS = 5
+
 interface SnapshotEnvelope {
   v: 1
   cards: ActivityCardRecord[]
@@ -91,7 +109,9 @@ function isCardRow(x: unknown): x is ActivityCardRecord {
     (o.threadId === null || typeof o.threadId === 'number') &&
     typeof o.activityMessageId === 'number' &&
     typeof o.startedAt === 'number' &&
-    (o.pinned === undefined || typeof o.pinned === 'boolean')
+    (o.pinned === undefined || typeof o.pinned === 'boolean') &&
+    (o.finalizeAttempted === undefined || typeof o.finalizeAttempted === 'boolean') &&
+    (o.unpinAttempts === undefined || typeof o.unpinAttempts === 'number')
   )
 }
 
@@ -245,32 +265,57 @@ export async function runActivityCardBootReaper(args: {
     // turn that upserted a fresh card under the same turnKey mid-reap keeps
     // its own (different-id) record.
     clearActivityCardRecord(args.path, args.fs, record.turnKey, record.activityMessageId, log)
-    try {
-      // Count a finalize ONLY when the edit actually landed. robustApiCall
-      // resolves to undefined on a benign-400 (the card was already deleted or
-      // the chat is gone) — that delivered nothing, so it is a `vanished`
-      // orphan, not a `finalized` one. Counting it as finalized (the pre-fix
-      // behaviour) over-reported the guarantee in the boot log.
-      const res = await args.finalizeCard(record)
-      if (res != null) finalized++
-      else vanished++
-    } catch (err) {
-      log(
-        `activity-card-store: boot reaper finalize failed ` +
-          `(chat=${record.chatId} msg=${record.activityMessageId}): ` +
-          `${(err as Error).message}\n`,
-      )
+    // The finalizing EDIT stays at-most-once: skip it for a record retained by
+    // a prior boot purely to retry its failed unpin (finalizeAttempted).
+    if (!record.finalizeAttempted) {
+      try {
+        // Count a finalize ONLY when the edit actually landed. robustApiCall
+        // resolves to undefined on a benign-400 (the card was already deleted or
+        // the chat is gone) — that delivered nothing, so it is a `vanished`
+        // orphan, not a `finalized` one. Counting it as finalized (the pre-fix
+        // behaviour) over-reported the guarantee in the boot log.
+        const res = await args.finalizeCard(record)
+        if (res != null) finalized++
+        else vanished++
+      } catch (err) {
+        log(
+          `activity-card-store: boot reaper finalize failed ` +
+            `(chat=${record.chatId} msg=${record.activityMessageId}): ` +
+            `${(err as Error).message}\n`,
+        )
+      }
     }
     if (record.pinned) {
       try {
         await args.unpinCard(record)
         unpinned++
       } catch (err) {
+        // Retry-safe unpin (#3001): unlike the edit (at-most-once by design),
+        // an unpin is idempotent — so a failed one is RE-PERSISTED with an
+        // attempt counter and retried on the next boot, up to the cap, instead
+        // of being forfeited. `finalizeAttempted` guarantees the retained
+        // record can never re-run its edit.
+        const attempts = (record.unpinAttempts ?? 0) + 1
         log(
           `activity-card-store: boot reaper unpin failed ` +
-            `(chat=${record.chatId} msg=${record.activityMessageId}): ` +
-            `${(err as Error).message}\n`,
+            `(chat=${record.chatId} msg=${record.activityMessageId} ` +
+            `attempt=${attempts}): ${(err as Error).message}\n`,
         )
+        if (attempts < BOOT_UNPIN_MAX_ATTEMPTS) {
+          writeActivityCardRecord(
+            args.path,
+            args.fs,
+            { ...record, finalizeAttempted: true, unpinAttempts: attempts },
+            log,
+          )
+        } else {
+          log(
+            `activity-card-store: boot reaper FORFEITING card unpin after ` +
+              `${attempts} failed attempts ` +
+              `(chat=${record.chatId} msg=${record.activityMessageId}) — ` +
+              `will not retry again\n`,
+          )
+        }
       }
     }
   }