switchroom 0.18.6 → 0.18.8

package/telegram-plugin/gateway/inbound-spool.ts

@@ -88,7 +88,8 @@ export function spoolId(msg: InboundMessage): string {
   // given turn can only be one or the other.
   if (
     (msg.meta?.source === 'resume_interrupted' ||
-      msg.meta?.source === 'resume_watchdog_timeout') &&
+      msg.meta?.source === 'resume_watchdog_timeout' ||
+      msg.meta?.source === 'resume_deferred') &&
     typeof msg.meta?.resume_turn_key === 'string' &&
     msg.meta.resume_turn_key.length > 0
   ) {

package/telegram-plugin/gateway/inject-handler.test.ts

@@ -104,6 +104,25 @@ describe('handleInjectCommand — guards', () => {
     expect(replies[0].text).toContain('Usage')
     expect(replies[0].text).toContain('/cost')
   })
+
+  it('refuses `/inject /model <name>` and points at the real /model driver', async () => {
+    // Bug 7c: /inject /model <arg> bypasses the whole /model driver (no busy
+    // gate, no sr-* carrier/base-URL repoint, no session-override recording).
+    const inject = vi.fn()
+    const { deps, replies } = makeDeps({ getArgs: () => '/model sonnet', inject })
+    await handleInjectCommand(fakeCtx(), deps)
+    expect(inject).not.toHaveBeenCalled()
+    expect(replies).toHaveLength(1)
+    expect(replies[0].text).toContain('/model sonnet')
+    expect(replies[0].text).toContain('own driver')
+  })
+
+  it('still allows bare `/inject /model` (read-only picker) through', async () => {
+    const inject = vi.fn().mockResolvedValue(okResult('/model', 'picker output'))
+    const { deps } = makeDeps({ getArgs: () => '/model', inject })
+    await handleInjectCommand(fakeCtx(), deps)
+    expect(inject).toHaveBeenCalledWith('gymbro', '/model')
+  })
 })
 
 describe('handleInjectCommand — outcome=ok', () => {

package/telegram-plugin/gateway/inject-handler.ts

@@ -146,6 +146,23 @@ export async function handleInjectCommand(ctx: Context, deps: InjectDeps): Promi
     return
   }
   const slashCommand = arg.startsWith('/') ? arg : `/${arg}`
+
+  // `/inject /model <name>` would type `/model <name>` straight into the pane,
+  // bypassing the entire /model driver — no busy gate, no sr-* carrier/base-URL
+  // repoint, no session-override recording. That path silently fails for sr-*
+  // ids and leaves /status stale for Claude ones. Route the operator to the real
+  // command. Bare `/inject /model` (no arg) still opens claude's read-only picker.
+  const injectTokens = slashCommand.split(/\s+/)
+  if (injectTokens[0]?.toLowerCase() === '/model' && injectTokens.length > 1) {
+    const modelArg = injectTokens.slice(1).join(' ')
+    await deps.reply(
+      ctx,
+      `\`/model\` has its own driver — use \`/model ${deps.escapeHtml(modelArg)}\` directly (not via \`/inject\`) so the switch is gated, recorded, and \`/status\` stays honest.`,
+      { html: true },
+    )
+    return
+  }
+
   const agentName = deps.getAgentName()
 
   let result: InjectResult

package/telegram-plugin/gateway/ipc-protocol.ts

@@ -134,6 +134,25 @@ export interface ConfigApprovalResolvedEvent {
   denySource?: "operator" | "dispatch_failure";
 }
 
+/**
+ * Issue #2971 — the wedge-watchdog's permission branch answer to
+ * `query_pending_permission`. Read-only reply sourced from the gateway's
+ * `pendingPermissions` map: `pending: true` means a live Telegram approval
+ * card (and the #2724 TTL reaper) is already racing the TUI prompt for this
+ * agent, so the watchdog must NOT Esc — the reaper's channel-delivered deny
+ * dismisses the TUI cleanly at TTL. `pending: false` means no card exists
+ * (bridge down, a `requiresUserInteraction` tool, or genuinely no live
+ * request) — the watchdog's Esc fallback is safe and expected.
+ */
+export interface PendingPermissionStatusEvent {
+  type: "pending_permission_status";
+  /** Echoes the correlationId from the originating query. */
+  correlationId: string;
+  pending: boolean;
+  /** The live `pendingPermissions` key, when `pending: true`. */
+  requestId?: string;
+}
+
 export type GatewayToClient =
   | InboundMessage
   | PermissionEvent
@@ -143,7 +162,8 @@ export type GatewayToClient =
   | DriveApprovalPostedEvent
   | Ms365ApprovalPostedEvent
   | ConfigApprovalResolvedEvent
-  | RolloutStatusPostedEvent;
+  | RolloutStatusPostedEvent
+  | PendingPermissionStatusEvent;
 
 // === Bridge (Client) -> Gateway messages ===
 
@@ -555,6 +575,27 @@ export interface RolloutStatusPostedEvent {
   reason?: string;
 }
 
+/**
+ * Issue #2971 — sent by the wedge-watchdog (autoaccept-poll sidecar) over
+ * the gateway UDS, BEFORE it would otherwise Esc a shape-persistent
+ * per-tool permission prompt. Read-only: asks whether a live Telegram
+ * approval card (`pendingPermissions`) already exists for this agent's
+ * in-flight permission request, so the watchdog can defer to the card /
+ * the #2724 TTL reaper instead of racing it with a keystroke.
+ *
+ * Trust model: same as quota_wall_detected — the socket is per-agent
+ * inside the container; `agentName` is validated server-side (and, in the
+ * gateway handler, checked against the gateway's own SWITCHROOM_AGENT_NAME)
+ * but this message can never mutate state — it only reads
+ * `pendingPermissions.size`/entries.
+ */
+export interface QueryPendingPermissionMessage {
+  type: "query_pending_permission";
+  agentName: string;
+  /** Caller-generated correlation id, echoed in the reply. */
+  correlationId: string;
+}
+
 export type ClientToGateway =
   | RegisterMessage
   | ToolCallMessage
@@ -574,4 +615,5 @@ export type ClientToGateway =
   | SendOutboundMessage
   | PostSkillProposalMessage
   | RolloutStatusPostMessage
-  | RolloutStatusEditMessage;
+  | RolloutStatusEditMessage
+  | QueryPendingPermissionMessage;

package/telegram-plugin/gateway/ipc-server.ts

@@ -6,6 +6,7 @@ import type {
   InjectInboundMessage,
   SendOutboundMessage,
   QuotaWallDetectedMessage,
+  QueryPendingPermissionMessage,
   PostSkillProposalMessage,
   OperatorEventForward,
   PermissionRequestForward,
@@ -67,6 +68,18 @@ export interface IpcServerOptions {
    * don't run failover simply ignore it.
    */
   onQuotaWallDetected?: (client: IpcClient, msg: QuotaWallDetectedMessage) => void;
+  /**
+   * Issue #2971 — read-only wedge-watchdog query: is there a live pending
+   * permission request (Telegram approval card) for this agent right now?
+   * The handler MUST reply on the same connection with a
+   * `pending_permission_status` event (matching `correlationId`) sourced
+   * from the gateway's `pendingPermissions` map. Optional: when no handler
+   * is wired (older gateway build, or a test fixture that doesn't need it),
+   * the server replies `pending: false` immediately — the watchdog's
+   * existing Esc fallback then behaves exactly as it did before this
+   * feature (mixed-version safety).
+   */
+  onQueryPendingPermission?: (client: IpcClient, msg: QueryPendingPermissionMessage) => void;
   /**
    * #2670 one-tap self-improvement — persist a skill-improvement proposal
    * and post its Approve/Dismiss card. Handler persists the draft bundle to
@@ -330,6 +343,15 @@ export function validateClientMessage(msg: unknown): msg is ClientToGateway {
         && (typeof m.resetAt !== "number" || !Number.isFinite(m.resetAt as number))) return false;
       return true;
     }
+    case "query_pending_permission": {
+      // Issue #2971 — read-only wedge-watchdog probe. Wire shape only.
+      if (typeof m.agentName !== "string"
+        || !AGENT_NAME_RE.test(m.agentName as string)) return false;
+      if (typeof m.correlationId !== "string"
+        || (m.correlationId as string).length === 0
+        || (m.correlationId as string).length > 64) return false;
+      return true;
+    }
     case "request_config_approval": {
       // #1623 — hostd-initiated config-edit approval card. Wire shape
       // only; the handler module validates the diff content.
@@ -449,6 +471,7 @@ export function createIpcServer(options: IpcServerOptions): IpcServer {
     onInjectInbound,
     onSendOutbound,
     onQuotaWallDetected,
+    onQueryPendingPermission,
     onPostSkillProposal,
     onRequestDriveApproval,
     onRequestMs365Approval,
@@ -569,6 +592,23 @@ export function createIpcServer(options: IpcServerOptions): IpcServer {
       case "quota_wall_detected":
         if (onQuotaWallDetected) onQuotaWallDetected(client, msg as QuotaWallDetectedMessage);
         break;
+      case "query_pending_permission":
+        if (onQueryPendingPermission) {
+          onQueryPendingPermission(client, msg as QueryPendingPermissionMessage);
+        } else {
+          // No handler wired — fail closed to "not pending" so the caller's
+          // Esc fallback fires (byte-identical to pre-#2971 behaviour).
+          try {
+            client.send({
+              type: "pending_permission_status",
+              correlationId: (msg as QueryPendingPermissionMessage).correlationId,
+              pending: false,
+            });
+          } catch {
+            /* best effort */
+          }
+        }
+        break;
       case "request_drive_approval":
         if (onRequestDriveApproval) {
           // Handler is async — fire-and-forget here; the handler

package/telegram-plugin/gateway/mental-model-propose-diff.ts

@@ -27,6 +27,49 @@
 import { parseDocument } from "yaml";
 import { generateUnifiedDiff } from "../../src/web/config-diff.js";
 
+/**
+ * Decode the canonical six HTML/XML entities to their literal characters — the
+ * config-write-boundary layer of the #2976 defense-in-depth.
+ *
+ * SCOPE / reachability (be honest about which half is load-bearing):
+ *   - `source_query` decode is the REACHABLE half. A model can copy escaped
+ *     entities out of its Telegram-HTML-rendered context into a proposal's
+ *     free-form `source_query`, and undecoded it would steer recall on `R&D`
+ *     instead of `R&D` — a durable, silent corruption of a memory-integrity
+ *     field. Normalizing here means an escaped query can never LAND in
+ *     `memory.mental_models[]`.
+ *   - `name` decode is REDUNDANT belt-and-suspenders. The `mental_model_propose`
+ *     gateway tool already slug-validates `name` against
+ *     /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/ BEFORE this runs, so an entity-bearing
+ *     name is rejected upstream and can't reach here. It's kept only so this
+ *     write boundary is self-contained if that gate ever moves.
+ *   - The observed in-NAME corruption (`Nutrition Protocol & Deficit Status`,
+ *     klanker 2026-07-06) actually arrived via the DIRECT `create_mental_model`
+ *     Hindsight tool (`ensureMentalModel`, undecoded), NOT this propose path.
+ *     That vector is OUT OF SCOPE here — covered by the steering.ts context-
+ *     hygiene + in-service `Dockerfile.hindsight` normalization follow-ups.
+ *
+ * SINGLE PASS by design (matches issue #2976's success criteria): a
+ * double-escaped `R&D` decodes ONE layer to `R&D`, not all the way
+ * to `R&D` — we only undo the escaping switchroom itself applied when it
+ * rendered the model's prior output, never the user's literal intent. `&`
+ * is decoded LAST so `&amp;lt;` collapses to `&lt;` (one layer), not `<`.
+ *
+ * Accepted tradeoff: a `source_query` a human genuinely intended to contain a
+ * literal `&amp;` / `&lt;` / etc. (rare — a reflection question, not markup)
+ * will have that one layer decoded. Steering queries reading as escaped HTML is
+ * the far more common and more harmful case, so we optimize for it.
+ */
+export function decodeCanonicalEntities(s: string): string {
+  return s
+    .replace(/&lt;/g, "<")
+    .replace(/&gt;/g, ">")
+    .replace(/&quot;/g, '"')
+    .replace(/&apos;/g, "'")
+    .replace(/&#39;/g, "'")
+    .replace(/&amp;/g, "&");
+}
+
 /**
  * A proposed mental model, in the same snake_case shape the
  * `memory.mental_models[]` schema (#2874) accepts. `name` + `source_query`
@@ -125,20 +168,33 @@ export function buildMentalModelAppendDiff(args: {
   }
 
   // Duplicate-name guard (defense-in-depth; the executor also checks up front
-  // so it never even posts a card for a dupe).
+  // so it never even posts a card for a dupe). Compare on the DECODED name so a
+  // re-propose of an entity-escaped variant collides with the already-stored
+  // literal (#2976) rather than sneaking in a corrupted twin.
+  const decodedName = decodeCanonicalEntities(spec.name);
   const existing = readDeclaredMentalModelNames(configText, agentName);
-  if (existing.includes(spec.name)) {
+  if (existing.includes(decodedName)) {
     return {
       ok: false,
       error: "duplicate",
-      detail: `mental model "${spec.name}" is already declared for ${agentName}`,
+      detail: `mental model "${decodedName}" is already declared for ${agentName}`,
     };
   }
 
+  // #2976 write-boundary normalization: decode any HTML/XML entities the model
+  // may have copied out of its own escaped context so the LITERAL characters
+  // land in config — never `&amp;` / `&lt;` etc. The load-bearing target is the
+  // free-form `source_query`; the `name` decode is redundant with the gateway
+  // slug gate (an entity-bearing name is rejected upstream) and kept only so
+  // this boundary is self-contained. Duplicate-name guard runs on the decoded
+  // name above.
+  const name = decodedName;
+  const source_query = decodeCanonicalEntities(spec.source_query);
+
   // Assemble the minimal, schema-clean declaration node.
   const item: Record<string, unknown> = {
-    name: spec.name,
-    source_query: spec.source_query,
+    name,
+    source_query,
   };
   if (spec.refresh_after_consolidation !== undefined) {
     item.refresh_after_consolidation = spec.refresh_after_consolidation;