switchroom 0.18.7 → 0.18.8

package/telegram-plugin/tests/mental-model-name-entity-corruption.test.ts

@@ -0,0 +1,119 @@
+/**
+ * Regression coverage for #2976 — HTML-entity corruption in mental-model
+ * fields, config-write-boundary layer.
+ *
+ * Reachability (stated plainly so these tests don't over-claim):
+ *   - `source_query` decode is the REACHABLE/load-bearing half: a proposal's
+ *     free-form query can carry escaped entities the model copied out of its
+ *     Telegram-HTML context, and undecoded it steers recall on `R&D`
+ *     instead of `R&D`.
+ *   - `name` decode is REDUNDANT with the gateway slug gate
+ *     (/^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/ rejects an entity-bearing name before
+ *     `buildMentalModelAppendDiff` ever runs). It's belt-and-suspenders; the
+ *     name-path tests here exercise the boundary directly (bypassing the gate)
+ *     to prove the normalization, NOT to imply the propose path could carry the
+ *     bug.
+ *   - The observed in-NAME corruption (`Nutrition Protocol & Deficit
+ *     Status`, klanker 2026-07-06) actually arrived via the DIRECT
+ *     `create_mental_model` Hindsight tool, which this PR does not touch — that
+ *     vector is out of scope (steering.ts / Dockerfile.hindsight follow-ups).
+ *
+ * These tests pin the switchroom-owned WRITE-BOUNDARY normalization: name +
+ * source_query are decoded to their literal characters BEFORE synthesis into
+ * the config diff. Each assertion below FAILS against the pre-fix code (which
+ * serialized `spec.name` / `spec.source_query` verbatim) and passes after.
+ */
+
+import { describe, it, expect } from "vitest";
+import { parseDocument } from "yaml";
+import {
+  buildMentalModelAppendDiff,
+  readDeclaredMentalModelNames,
+  decodeCanonicalEntities,
+} from "../gateway/mental-model-propose-diff.js";
+
+const BASE_CONFIG = `agents:
+  klanker:
+    memory:
+      backend: hindsight
+`;
+
+/** Pull the appended model node out of the synthesized `after` config. */
+function appendedModel(after: string, agent = "klanker"): { name?: unknown; source_query?: unknown } {
+  const js = parseDocument(after).toJS() as {
+    agents: Record<string, { memory: { mental_models: Array<Record<string, unknown>> } }>;
+  };
+  const models = js.agents[agent]!.memory.mental_models;
+  return models[models.length - 1]!;
+}
+
+describe("decodeCanonicalEntities — single-pass, canonical six only", () => {
+  it("decodes each canonical entity to its literal character", () => {
+    expect(decodeCanonicalEntities("R&amp;D")).toBe("R&D");
+    expect(decodeCanonicalEntities("a&lt;b&gt;c")).toBe("a<b>c");
+    expect(decodeCanonicalEntities("say &quot;hi&quot;")).toBe('say "hi"');
+    expect(decodeCanonicalEntities("Ken&apos;s")).toBe("Ken's");
+    expect(decodeCanonicalEntities("Ken&#39;s")).toBe("Ken's");
+  });
+
+  it("undoes exactly ONE layer of escaping (double-escaped → single-escaped)", () => {
+    // We only reverse the escaping switchroom applied when rendering the model's
+    // own prior output — never the user's literal intent.
+    expect(decodeCanonicalEntities("R&amp;amp;D")).toBe("R&amp;D");
+    expect(decodeCanonicalEntities("&amp;lt;")).toBe("&lt;");
+  });
+
+  it("leaves entity-free text untouched (idempotent on clean input)", () => {
+    expect(decodeCanonicalEntities("Nutrition Protocol & Deficit")).toBe("Nutrition Protocol & Deficit");
+  });
+});
+
+describe("#2976 — propose write-boundary normalizes the mental-model name", () => {
+  it("stores the LITERAL '&' name, not the escaped '&amp;' the model emitted", () => {
+    const built = buildMentalModelAppendDiff({
+      configText: BASE_CONFIG,
+      agentName: "klanker",
+      spec: { name: "Nutrition Protocol &amp; Deficit Status", source_query: "how is the deficit?" },
+    });
+    expect(built.ok).toBe(true);
+    if (!built.ok) return;
+    expect(appendedModel(built.after).name).toBe("Nutrition Protocol & Deficit Status");
+    // And there is no residual entity anywhere in the persisted config.
+    expect(built.after).not.toContain("&amp;");
+    // Reading the declared names back yields the decoded literal.
+    expect(readDeclaredMentalModelNames(built.after, "klanker")).toContain(
+      "Nutrition Protocol & Deficit Status",
+    );
+  });
+
+  it("normalizes the recall-steering source_query too (not just the name)", () => {
+    const built = buildMentalModelAppendDiff({
+      configText: BASE_CONFIG,
+      agentName: "klanker",
+      spec: { name: "rd-budget", source_query: "what is the user&apos;s R&amp;D budget?" },
+    });
+    expect(built.ok).toBe(true);
+    if (!built.ok) return;
+    expect(appendedModel(built.after).source_query).toBe("what is the user's R&D budget?");
+  });
+
+  it("rejects an entity-escaped re-propose of an already-declared literal name (dup guard on decoded name)", () => {
+    const configWithModel = `agents:
+  klanker:
+    memory:
+      backend: hindsight
+      mental_models:
+        - name: Q3 R&D Plan
+          source_query: what is the plan?
+`;
+    const built = buildMentalModelAppendDiff({
+      configText: configWithModel,
+      agentName: "klanker",
+      // Escaped variant of the same logical name — must collide, not create a twin.
+      spec: { name: "Q3 R&amp;D Plan", source_query: "different query" },
+    });
+    expect(built.ok).toBe(false);
+    if (built.ok) return;
+    expect(built.error).toBe("duplicate");
+  });
+});

package/telegram-plugin/tests/model-command.test.ts

@@ -201,7 +201,7 @@ describe("handleModelCommand — set", () => {
     const reply = await handleModelCommand({ kind: "set", model: "opus" }, deps);
     expect(calls).toEqual([{ agent: "klanker", command: "/model opus" }]);
     expect(reply.text).toContain("<pre>⏺ Set model to sonnet</pre>");
-    expect(reply.text).toContain("Session-only");
+    expect(reply.text).toContain("Sticky across switchroom-managed relaunches");
     expect(reply.html).toBe(true);
     // A verified confirmation records the live model so /status stays honest
     // (bug 1: the typed path never recorded the switch before).
@@ -444,7 +444,7 @@ describe("handleModelCommand — busy gate + honest unverified reporting", () =>
     const reply = await handleModelCommand({ kind: "set", model: "claude-bogus" }, deps);
     expect(reply.text).toContain("did not take");
     expect(reply.text).toContain("Model not found");
-    expect(reply.text).not.toContain("Session-only");
+    expect(reply.text).not.toContain("Sticky across switchroom-managed relaunches");
     expect(reply.selectedModel).toBeUndefined();
   });
 

package/telegram-plugin/tests/model-unavailable.test.ts

@@ -76,6 +76,47 @@ describe('detectModelUnavailable — overload / 429 / 5xx strings', () => {
   })
 })
 
+describe('detectModelUnavailable — transient upstream 429 vs account quota (#2922)', () => {
+  // The load-bearing regression: a server-side transient 429 whose message
+  // explicitly negates the account-quota reading ("not your usage limit")
+  // was misclassified as `quota_exhausted` by the negation-blind "usage limit"
+  // substring, firing a phantom fleet failover + dead turn. It must classify
+  // as `overload` (the calm rate-limit path Claude Code retries internally).
+  it("classifies the live-incident 'not your usage limit' 429 as overload, NOT quota_exhausted", () => {
+    const raw =
+      "API Error: Server is temporarily limiting requests (not your usage limit) · " +
+      'b\'{"type":"error","error":{"type":"rate_limit_error","message":' +
+      '"This request would exceed your account\'s rate limit. Please try again later."}}\''
+    const d = detectModelUnavailable(raw)
+    expect(d?.kind).toBe('overload')
+    expect(d?.kind).not.toBe('quota_exhausted')
+  })
+
+  it("classifies bare 'temporarily limiting requests' as overload", () => {
+    expect(
+      detectModelUnavailable('Server is temporarily limiting requests')?.kind,
+    ).toBe('overload')
+  })
+
+  it("classifies \"would exceed your account's rate limit\" as overload", () => {
+    expect(
+      detectModelUnavailable(
+        "This request would exceed your account's rate limit. Please try again later.",
+      )?.kind,
+    ).toBe('overload')
+  })
+
+  it('still classifies a genuine account usage-limit hit as quota_exhausted', () => {
+    // Guard against over-correction: real quota exhaustion must stay quota.
+    expect(
+      detectModelUnavailable("You've hit your limit · resets 8:50am (Australia/Melbourne)")?.kind,
+    ).toBe('quota_exhausted')
+    expect(detectModelUnavailable('Reached usage limit for the 5h window')?.kind).toBe(
+      'quota_exhausted',
+    )
+  })
+})
+
 describe('detectModelUnavailable — network failures', () => {
   it('classifies ECONNREFUSED', () => {
     expect(detectModelUnavailable('connect ECONNREFUSED 1.2.3.4:443')?.kind).toBe('network')

package/telegram-plugin/tests/pty-partial-handler.test.ts

@@ -9,6 +9,7 @@ import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
 import {
   createPtyPartialHandler,
   handlePtyPartialPure,
+  looksLikeRawApiError,
   type PtyHandlerState,
   type PtyHandlerDeps,
 } from '../pty-partial-handler.js'
@@ -65,6 +66,35 @@ describe('handlePtyPartialPure', () => {
     expect(bot.api.sendMessage).not.toHaveBeenCalled()
   })
 
+  it('suppresses a raw API-error TUI line so it never leaks to chat (#2922 Bug 3)', async () => {
+    const state = makeState({ currentSessionChatId: '1' })
+    const deps = makeDeps(bot)
+    // The exact shape Claude Code's TUI renders on a transient 429.
+    const raw =
+      "API Error: Server is temporarily limiting requests (not your usage limit) · " +
+      "b'{\"type\":\"error\",\"error\":{\"type\":\"rate_limit_error\"}}'"
+    const action = handlePtyPartialPure(raw, state, deps)
+    expect(action).toBe('error-suppressed')
+    await microtaskFlush()
+    // Nothing sent — the operator-event pipeline owns the user-facing card.
+    expect(bot.api.sendMessage).not.toHaveBeenCalled()
+    expect(state.activeDraftStreams.size).toBe(0)
+    // Not recorded as a preview, so it can't poison later dedup either.
+    expect(state.lastPtyPreviewByChat.size).toBe(0)
+  })
+
+  it('does NOT suppress ordinary assistant text that merely mentions errors', async () => {
+    const state = makeState({ currentSessionChatId: '1' })
+    const action = handlePtyPartialPure(
+      "Here's how to handle an error in your retry loop:",
+      state,
+      makeDeps(bot),
+    )
+    expect(action).toBe('update-new')
+    await microtaskFlush()
+    expect(bot.api.sendMessage).toHaveBeenCalledTimes(1)
+  })
+
   it('dedups when same text arrives twice in a row', async () => {
     const state = makeState({ currentSessionChatId: '1' })
     const deps = makeDeps(bot)
@@ -324,3 +354,29 @@ describe('createPtyPartialHandler — session + buffer replay', () => {
     expect(state.activeDraftStreams.size).toBe(0)
   })
 })
+
+describe('looksLikeRawApiError (#2922 Bug 3)', () => {
+  it('flags the CLI "API Error: … · b\'{…}\'" line', () => {
+    expect(
+      looksLikeRawApiError(
+        "API Error: Server is temporarily limiting requests · b'{\"type\":\"error\"}'",
+      ),
+    ).toBe(true)
+  })
+
+  it('flags a bare rate_limit_error JSON body', () => {
+    expect(
+      looksLikeRawApiError('{"type":"error","error":{"type":"rate_limit_error"}}'),
+    ).toBe(true)
+  })
+
+  it('flags overloaded_error and is_error markers', () => {
+    expect(looksLikeRawApiError('{"type":"overloaded_error"}')).toBe(true)
+    expect(looksLikeRawApiError('{"is_error":true,"content":"boom"}')).toBe(true)
+  })
+
+  it('does not flag ordinary prose mentioning "error"', () => {
+    expect(looksLikeRawApiError('I hit an error handling that request')).toBe(false)
+    expect(looksLikeRawApiError('')).toBe(false)
+  })
+})

package/telegram-plugin/tests/render/render-outbound-chunks.test.ts

@@ -0,0 +1,98 @@
+/**
+ * Regression tests for the chunk-boundary cap bug (fix/rich-render-chunk-boundary-cap).
+ *
+ * THE BUG: the outbound safe renderer (`renderSafe`) re-escapes GFM-special
+ * characters, which GROWS a body. A raw chunk sized just under the wire cap can
+ * escape PAST it. `renderSafe`'s only oversize recourse is to degrade the WHOLE
+ * document to `mode:"plain"` (raw source, no rich wrapper) — it never re-splits
+ * a multi-block body. The send path then ships that plain body through the
+ * 4096-char plain `sendMessage` endpoint, so a ~32k plain body is rejected by
+ * Telegram (`message is too long`) and the answer is dropped.
+ *
+ * `renderOutboundChunks` closes the gap: every returned piece fits its own wire
+ * cap (rich `<= maxLen`, plain `<= plainMax`) and is cut only at
+ * `splitMarkdownChunks`' safe boundaries (never bisecting a fence / table row).
+ */
+import { describe, it, expect } from "vitest";
+import { renderOutboundChunks, PLAIN_TEXT_MAX_CHARS } from "../../render/rich-render.js";
+import { RICH_MESSAGE_MAX_CHARS } from "../../format.js";
+
+const ON = { SWITCHROOM_RICH_RENDER: "1" } as NodeJS.ProcessEnv;
+const OFF = {} as NodeJS.ProcessEnv;
+
+/** Count fenced-code delimiter lines (```) in a body. A piece that bisects a
+ *  fenced block has an ODD count. */
+function fenceCount(s: string): number {
+  return (s.match(/^```/gm) ?? []).length;
+}
+
+describe("renderOutboundChunks", () => {
+  it("flag OFF is a single passthrough piece (byte-for-byte)", () => {
+    const raw = "**bold** and _italic_ | a | table |";
+    const pieces = renderOutboundChunks(raw, OFF);
+    expect(pieces).toHaveLength(1);
+    expect(pieces[0].text).toBe(raw);
+    expect(pieces[0].mode).toBe("markdown");
+  });
+
+  it("flag ON, body that fits is a single piece (common case)", () => {
+    const pieces = renderOutboundChunks("just some plain prose", ON);
+    expect(pieces).toHaveLength(1);
+    expect(pieces[0].text.length).toBeLessThanOrEqual(RICH_MESSAGE_MAX_CHARS);
+  });
+
+  it("REGRESSION: a near-cap escapable body splits into cap-respecting pieces", () => {
+    // Prose whose escaping (`_ * |` each gain a leading `\`) grows it past the
+    // cap. Use small caps so the test is fast; the invariant is cap-agnostic.
+    const maxLen = 200;
+    const plainMax = 80;
+    const unit = "a_b*c|d ";
+    const raw = unit.repeat(40); // 320 raw chars, ~1.5x after escaping
+    const pieces = renderOutboundChunks(raw, ON, maxLen, plainMax);
+
+    // The whole body did NOT fit as one message — it was re-split.
+    expect(pieces.length).toBeGreaterThan(1);
+    for (const p of pieces) {
+      if (p.mode === "plain") {
+        // A plain piece rides the plain `sendMessage` endpoint — must fit its cap.
+        expect(p.text.length).toBeLessThanOrEqual(plainMax);
+      } else {
+        expect(p.text.length).toBeLessThanOrEqual(maxLen);
+      }
+    }
+  });
+
+  it("REGRESSION: never bisects a fenced code block when splitting", () => {
+    const maxLen = 300;
+    const plainMax = 250; // >= the fence size, so a fence never needs a hard slice.
+    // A fenced block big enough that a naive length cut would land inside it,
+    // wrapped in prose so the whole document overflows and must be re-split.
+    const fence = "```\n" + "code line here\n".repeat(8) + "```";
+    const prose = "word ".repeat(40);
+    const raw = `${prose}\n\n${fence}\n\n${prose}`;
+    const pieces = renderOutboundChunks(raw, ON, maxLen, plainMax);
+
+    expect(pieces.length).toBeGreaterThan(1);
+    for (const p of pieces) {
+      // Every emitted piece has BALANCED fence delimiters — no piece opens a
+      // fence it doesn't close (which would swallow the next piece's text).
+      expect(fenceCount(p.text) % 2).toBe(0);
+      const cap = p.mode === "plain" ? plainMax : maxLen;
+      expect(p.text.length).toBeLessThanOrEqual(cap);
+    }
+  });
+
+  it("REAL-CAP: a ~32k escapable body never yields an over-4096 plain piece", () => {
+    // The production failure: raw just under RICH_MESSAGE_MAX_CHARS, escaping
+    // pushes the rendered form over it. On the buggy path this became ONE
+    // ~32k plain body sent through the 4096 plain endpoint. Here every plain
+    // piece is <= 4096 and every rich piece <= 32768.
+    const unit = "a_b*c|d ";
+    const raw = unit.repeat(Math.floor((RICH_MESSAGE_MAX_CHARS - 20) / unit.length));
+    const pieces = renderOutboundChunks(raw, ON);
+    for (const p of pieces) {
+      const cap = p.mode === "plain" ? PLAIN_TEXT_MAX_CHARS : RICH_MESSAGE_MAX_CHARS;
+      expect(p.text.length).toBeLessThanOrEqual(cap);
+    }
+  }, 30000);
+});

package/telegram-plugin/tests/retry-api-call.test.ts

@@ -15,6 +15,8 @@ import {
   createSwallowingRetryApiCall,
   retryWithThreadFallback,
   isHtmlParseRejectError,
+  isLocalResourceError,
+  LOCAL_RESOURCE_EXHAUSTED,
   type RetryObserver,
 } from '../retry-api-call.js'
 import { errors, makeGrammyError } from './fake-bot-api.js'
@@ -512,3 +514,60 @@ describe('isHtmlParseRejectError', () => {
     ).toBe(true)
   })
 })
+
+describe('#2923 — LOCAL resource exhaustion is NOT retried (avoids flood ban)', () => {
+  it('classifies ENOSPC / EDQUOT / EIO / ENOMEM by errno code', () => {
+    expect(isLocalResourceError(Object.assign(new Error('x'), { code: 'ENOSPC' }))).toBe(true)
+    expect(isLocalResourceError(Object.assign(new Error('x'), { code: 'EDQUOT' }))).toBe(true)
+    expect(isLocalResourceError(Object.assign(new Error('x'), { code: 'EIO' }))).toBe(true)
+    expect(isLocalResourceError(Object.assign(new Error('x'), { code: 'ENOMEM' }))).toBe(true)
+  })
+
+  it('classifies by message when no code is present (incl. EIO, word-boundaried)', () => {
+    expect(isLocalResourceError(new Error('ENOSPC: no space left on device, write'))).toBe(true)
+    expect(isLocalResourceError(new Error('disk quota exceeded'))).toBe(true)
+    expect(isLocalResourceError(new Error('EIO: i/o error, write'))).toBe(true)
+    // No false match on a substring (e.g. a word containing the letters).
+    expect(isLocalResourceError(new Error('DENOSPCX not a real code'))).toBe(false)
+  })
+
+  it('does NOT classify a remote GrammyError or ordinary error', () => {
+    expect(isLocalResourceError(errors.floodWait(10))).toBe(false)
+    expect(isLocalResourceError(new Error('fetch failed'))).toBe(false)
+  })
+
+  it('throws LOCAL_RESOURCE_EXHAUSTED immediately without retrying', async () => {
+    // Before the fix: an ENOSPC thrown by the send-staging step fell through
+    // to the network-retry branch pattern OR was rethrown but only after the
+    // caller kept re-driving sends — the storm that tripped the flood ban.
+    // Now it must fail FAST on the first attempt with a distinct marker.
+    const sleep = vi.fn(async () => {})
+    let calls = 0
+    const retry = createRetryApiCall({ maxRetries: 3, sleep })
+    await expect(
+      retry(async () => {
+        calls++
+        throw Object.assign(new Error('ENOSPC: no space left on device'), { code: 'ENOSPC' })
+      }),
+    ).rejects.toThrow(LOCAL_RESOURCE_EXHAUSTED)
+    expect(calls).toBe(1) // no retry
+    expect(sleep).not.toHaveBeenCalled() // no backoff-into-flood
+  })
+
+  it('fires onFloodWait with the retry_after when a 429 is seen', async () => {
+    const seen: number[] = []
+    const sleep = vi.fn(async () => {})
+    let n = 0
+    const retry = createRetryApiCall({
+      maxRetries: 3,
+      sleep,
+      onFloodWait: (s) => seen.push(s),
+    })
+    const out = await retry(async () => {
+      if (n++ === 0) throw errors.floodWait(42)
+      return 'ok'
+    })
+    expect(out).toBe('ok')
+    expect(seen).toEqual([42])
+  })
+})

package/telegram-plugin/tests/run-hook-wrapper.test.ts

@@ -0,0 +1,132 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest'
+import { spawnSync } from 'node:child_process'
+import { mkdtempSync, rmSync, writeFileSync, readFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+/**
+ * #2555 — run-hook.sh must tolerate a Node exit-134 (uv_thread_create abort
+ * under memory pressure): retry once, and if it still aborts, skip cleanly
+ * (exit 0) rather than propagating 134. Real non-134 statuses pass through.
+ *
+ * We drive the wrapper with a fake command (a tiny sh script) whose exit code
+ * is scripted via a counter file, so we exercise the exact control flow
+ * without needing a real memory-pressured Node.
+ */
+const wrapper = resolve(
+  fileURLToPath(new URL('../hooks/run-hook.sh', import.meta.url)),
+)
+
+describe('#2555 run-hook.sh exit-134 tolerance', () => {
+  let dir: string
+  let fake: string
+  let counter: string
+
+  beforeEach(() => {
+    dir = mkdtempSync(join(tmpdir(), 'run-hook-'))
+    fake = join(dir, 'fake.sh')
+    counter = join(dir, 'n')
+    writeFileSync(counter, '0')
+  })
+  afterEach(() => rmSync(dir, { recursive: true, force: true }))
+
+  /** Fake command: exits `codes[attemptIndex]`, records each invocation. */
+  function writeFake(codes: number[]): void {
+    writeFileSync(
+      fake,
+      [
+        '#!/bin/sh',
+        `n=$(cat "${counter}")`,
+        `echo "$((n + 1))" > "${counter}"`,
+        'case "$n" in',
+        ...codes.map((c, i) => `  ${i}) exit ${c} ;;`),
+        `  *) exit ${codes[codes.length - 1]} ;;`,
+        'esac',
+      ].join('\n'),
+    )
+  }
+
+  const run = (input = '') =>
+    spawnSync('sh', [wrapper, 'sh', fake], { encoding: 'utf-8', input })
+
+  const attempts = () => Number(readFileSync(counter, 'utf-8').trim())
+
+  it('passes a clean exit 0 through without retrying', () => {
+    writeFake([0])
+    const r = run()
+    expect(r.status).toBe(0)
+    expect(attempts()).toBe(1)
+  })
+
+  it('passes a real non-134 failure through unchanged (no retry, not masked)', () => {
+    writeFake([2])
+    const r = run()
+    expect(r.status).toBe(2)
+    expect(attempts()).toBe(1)
+  })
+
+  it('retries ONCE on a 134 abort and succeeds on the second attempt', () => {
+    writeFake([134, 0])
+    const r = run()
+    expect(r.status).toBe(0)
+    expect(attempts()).toBe(2)
+  })
+
+  it('skips cleanly (exit 0) when it aborts 134 twice — no crash card', () => {
+    writeFake([134, 134])
+    const r = run()
+    expect(r.status).toBe(0) // skipped cleanly, NOT 134
+    expect(attempts()).toBe(2)
+    expect(r.stderr).toMatch(/skipping hook cleanly/)
+  })
+
+  it('exports a shrunk UV_THREADPOOL_SIZE to the child', () => {
+    writeFileSync(fake, `#!/bin/sh\necho "$UV_THREADPOOL_SIZE"\nexit 0\n`)
+    const r = run()
+    expect(r.stdout.trim()).toBe('1')
+  })
+
+  it('replays the SAME stdin payload on the retry (scanner never sees empty input)', () => {
+    // Fake: attempt 0 reads stdin then aborts 134; attempt 1 reads stdin and
+    // records it, then exits 0. If stdin were not preserved, the recorded
+    // payload on the retry would be empty.
+    const seen = join(dir, 'seen-stdin')
+    writeFileSync(
+      fake,
+      [
+        '#!/bin/sh',
+        `n=$(cat "${counter}")`,
+        `echo "$((n + 1))" > "${counter}"`,
+        'data=$(cat)', // drain stdin (the abort-after-read scenario)
+        `echo "$data" > "${seen}.$n"`,
+        '[ "$n" = "0" ] && exit 134',
+        'exit 0',
+      ].join('\n'),
+    )
+    const r = run('SECRET-PAYLOAD-123')
+    expect(r.status).toBe(0)
+    expect(attempts()).toBe(2)
+    // The RETRY (attempt 1) must have received the full payload, not empty.
+    expect(readFileSync(`${seen}.1`, 'utf-8').trim()).toBe('SECRET-PAYLOAD-123')
+  })
+
+  it('FAILS CLOSED (propagates 134) for a security hook that aborts twice', () => {
+    // A genuinely broken secret scanner must NOT silently pass — exit 0 after
+    // two aborts would be a silent security bypass.
+    const secFake = join(dir, 'secret-guard-pretool.mjs')
+    writeFileSync(
+      secFake,
+      [
+        '#!/bin/sh',
+        `n=$(cat "${counter}")`,
+        `echo "$((n + 1))" > "${counter}"`,
+        'exit 134',
+      ].join('\n'),
+    )
+    const r = spawnSync('sh', [wrapper, 'sh', secFake], { encoding: 'utf-8', input: '{}' })
+    expect(r.status).toBe(134) // fail closed — NOT skipped
+    expect(attempts()).toBe(2)
+    expect(r.stderr).toMatch(/FAILING CLOSED/)
+  })
+})