switchroom 0.18.7 → 0.18.8

package/telegram-plugin/tests/session-model-file.test.ts

@@ -0,0 +1,132 @@
+/**
+ * Durable session-model file helpers (session-model-file.ts) — the gateway
+ * side of the stickiness contract (reference/rfcs/session-model-stickiness.md).
+ */
+
+import { describe, it, expect, beforeEach, afterEach } from 'vitest'
+import { mkdtempSync, rmSync, readFileSync, writeFileSync, existsSync } from 'node:fs'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import {
+  serializeSessionModel,
+  parseSessionModel,
+  writeSessionModelFile,
+  readSessionModelFile,
+  readSessionModelFileRaw,
+  restoreSessionModelFileRaw,
+  clearSessionModelFile,
+  writeRelaunchModelIntent,
+  clearRelaunchModelIntent,
+  readConfiguredDefaultModel,
+  intentForRestartReason,
+  SESSION_MODEL_FILE,
+  RELAUNCH_MODEL_INTENT_FILE,
+  CONFIGURED_DEFAULT_MODEL_FILE,
+} from '../gateway/session-model-file.js'
+
+let dir: string
+beforeEach(() => {
+  dir = mkdtempSync(join(tmpdir(), 'switchroom-sm-file-'))
+})
+afterEach(() => {
+  rmSync(dir, { recursive: true, force: true })
+})
+
+describe('serialize/parse round-trip', () => {
+  it('round-trips a record', () => {
+    const rec = { model: 'sr-glm-5', configuredDefaultAtWrite: 'claude-sonnet-5', ts: 1783948123456 }
+    expect(parseSessionModel(serializeSessionModel(rec))).toEqual(rec)
+  })
+
+  it('rejects corrupt JSON, missing fields, and non-canonical model tokens', () => {
+    expect(parseSessionModel('{broken')).toBeNull()
+    expect(parseSessionModel('{"model":"opus"}')).toBeNull()
+    expect(parseSessionModel('{"model":"Opus 4.8","configuredDefaultAtWrite":"x","ts":1}')).toBeNull()
+    expect(parseSessionModel('{"model":42,"configuredDefaultAtWrite":"x","ts":1}')).toBeNull()
+  })
+})
+
+describe('writeSessionModelFile — canonical-token guard (review finding 7)', () => {
+  it('writes a canonical token with the current default + a fresh ts', () => {
+    writeSessionModelFile(dir, 'claude-opus-4-8', 'claude-sonnet-5')
+    const rec = readSessionModelFile(dir)!
+    expect(rec.model).toBe('claude-opus-4-8')
+    expect(rec.configuredDefaultAtWrite).toBe('claude-sonnet-5')
+    expect(Math.abs(Date.now() - rec.ts)).toBeLessThan(5000)
+  })
+
+  it('THROWS on a display label — "Opus 4.5" must never be persisted', () => {
+    expect(() => writeSessionModelFile(dir, 'Opus 4.5', 'claude-sonnet-5')).toThrow(/non-canonical/)
+    expect(existsSync(join(dir, SESSION_MODEL_FILE))).toBe(false)
+  })
+})
+
+describe('rollback snapshot (scheduleModelRelaunch dispatch failure)', () => {
+  it('restores prior content when a file existed', () => {
+    writeSessionModelFile(dir, 'claude-opus-4-8', 'claude-sonnet-5')
+    const snapshot = readSessionModelFileRaw(dir)
+    writeSessionModelFile(dir, 'sr-glm-5', 'claude-sonnet-5')
+    restoreSessionModelFileRaw(dir, snapshot)
+    expect(readSessionModelFile(dir)!.model).toBe('claude-opus-4-8')
+  })
+
+  it('deletes the file when there was none before', () => {
+    const snapshot = readSessionModelFileRaw(dir) // null
+    writeSessionModelFile(dir, 'sr-glm-5', 'claude-sonnet-5')
+    restoreSessionModelFileRaw(dir, snapshot)
+    expect(existsSync(join(dir, SESSION_MODEL_FILE))).toBe(false)
+  })
+})
+
+describe('relaunch intent', () => {
+  it('writes one-line JSON with intent, reason, and embedded ts (the freshness clock)', () => {
+    writeRelaunchModelIntent(dir, 'keep', 'user: /new from chat')
+    const raw = readFileSync(join(dir, RELAUNCH_MODEL_INTENT_FILE), 'utf8')
+    const parsed = JSON.parse(raw)
+    expect(parsed.intent).toBe('keep')
+    expect(parsed.reason).toBe('user: /new from chat')
+    expect(Math.abs(Date.now() - parsed.ts)).toBeLessThan(5000)
+  })
+
+  it('last-writer-wins and clearable', () => {
+    writeRelaunchModelIntent(dir, 'keep', 'a')
+    writeRelaunchModelIntent(dir, 'revert', 'b')
+    expect(JSON.parse(readFileSync(join(dir, RELAUNCH_MODEL_INTENT_FILE), 'utf8')).intent).toBe('revert')
+    clearRelaunchModelIntent(dir)
+    expect(existsSync(join(dir, RELAUNCH_MODEL_INTENT_FILE))).toBe(false)
+  })
+})
+
+describe('intentForRestartReason — the triggerSelfRestart per-reason table (RFC §3)', () => {
+  it.each([
+    'schedule-restart-immediate',
+    'restart-drain-cap-forced',
+    'turn-complete-pending-restart',
+    'fleet-fallback-resume',
+    'sr-to-claude-model-switch',
+  ])('switchroom-managed relaunch %s → keep', (reason) => {
+    expect(intentForRestartReason(reason)).toBe('keep')
+  })
+
+  it('inline-button-restart (operator-deliberate) → revert', () => {
+    expect(intentForRestartReason('inline-button-restart')).toBe('revert')
+  })
+
+  it('unknown gateway reasons default to keep (only gateway code calls triggerSelfRestart; crashes never do)', () => {
+    expect(intentForRestartReason('some-future-recovery-path')).toBe('keep')
+  })
+})
+
+describe('readConfiguredDefaultModel', () => {
+  it('reads the trimmed value; null when absent or empty', () => {
+    expect(readConfiguredDefaultModel(dir)).toBeNull()
+    writeFileSync(join(dir, CONFIGURED_DEFAULT_MODEL_FILE), 'claude-sonnet-5\n')
+    expect(readConfiguredDefaultModel(dir)).toBe('claude-sonnet-5')
+    writeFileSync(join(dir, CONFIGURED_DEFAULT_MODEL_FILE), '\n')
+    expect(readConfiguredDefaultModel(dir)).toBeNull()
+  })
+
+  it('clearSessionModelFile is a safe no-op when absent', () => {
+    expect(() => clearSessionModelFile(dir)).not.toThrow()
+  })
+})

package/telegram-plugin/tests/slot-banner-boot-recovery.test.ts

@@ -170,7 +170,7 @@ describe("slot-banner boot recovery (gateway wiring)", () => {
     const gw2 = makeGateway(fs, tg);
     const res = await gw2.bootCleanup();
 
-    expect(res).toEqual({ cleared: 1, total: 1 });
+    expect(res).toEqual({ cleared: 1, retained: 0, kept: 0, total: 1 });
     expect(tg.pinned.has(`${OWNER}:${msgId}`)).toBe(false); // orphan unpinned
     expect(loadStatusPins(PATH, fs)).toEqual([]); // store emptied
   });
@@ -220,7 +220,7 @@ describe("slot-banner boot recovery (gateway wiring)", () => {
     // Fresh boot recovers it from the pending record.
     const gw2 = makeGateway(fs, tg);
     const res = await gw2.bootCleanup();
-    expect(res).toEqual({ cleared: 1, total: 1 });
+    expect(res).toEqual({ cleared: 1, retained: 0, kept: 0, total: 1 });
     expect(tg.pinned.has(`${OWNER}:${rec[0].messageId}`)).toBe(false);
     expect(loadStatusPins(PATH, fs)).toEqual([]);
   });
@@ -241,6 +241,6 @@ describe("slot-banner boot recovery (gateway wiring)", () => {
     expect(loadStatusPins(PATH, fs)).toEqual([]);
 
     const gw2 = makeGateway(fs, tg);
-    expect(await gw2.bootCleanup()).toEqual({ cleared: 0, total: 0 });
+    expect(await gw2.bootCleanup()).toEqual({ cleared: 0, retained: 0, kept: 0, total: 0 });
   });
 });

package/telegram-plugin/tests/status-pin-boot-recovery.test.ts

@@ -141,7 +141,7 @@ describe("status-pin boot recovery (gateway wiring)", () => {
     const gw2 = makeGateway(fs, tg);
     const res = await gw2.bootCleanup();
 
-    expect(res).toEqual({ cleared: 1, total: 1 });
+    expect(res).toEqual({ cleared: 1, retained: 0, kept: 0, total: 1 });
     expect(tg.pinned.has("-100123:715")).toBe(false); // orphan unpinned
     expect(loadStatusPins(PATH, fs)).toEqual([]); // store emptied
   });
@@ -177,7 +177,7 @@ describe("status-pin boot recovery (gateway wiring)", () => {
     // Fresh boot recovers it from the pending record.
     const gw2 = makeGateway(fs, tg);
     const res = await gw2.bootCleanup();
-    expect(res).toEqual({ cleared: 1, total: 1 });
+    expect(res).toEqual({ cleared: 1, retained: 0, kept: 0, total: 1 });
     expect(tg.pinned.has("-100123:715")).toBe(false);
     expect(loadStatusPins(PATH, fs)).toEqual([]);
   });
@@ -196,7 +196,7 @@ describe("status-pin boot recovery (gateway wiring)", () => {
     expect(loadStatusPins(PATH, fs)).toEqual([]);
 
     const gw2 = makeGateway(fs, tg);
-    expect(await gw2.bootCleanup()).toEqual({ cleared: 0, total: 0 });
+    expect(await gw2.bootCleanup()).toEqual({ cleared: 0, retained: 0, kept: 0, total: 0 });
   });
 });
 

package/telegram-plugin/tests/status-pin-store.test.ts

@@ -1,5 +1,6 @@
 import { describe, it, expect } from "vitest";
 import {
+  BOOT_UNPIN_MAX_ATTEMPTS,
   loadStatusPins,
   mutateStatusPinRow,
   persistStatusPins,
@@ -195,12 +196,12 @@ describe("runStatusPinBootCleanup", () => {
       ["-100123", 715],
       ["-100999", 42],
     ]);
-    expect(res).toEqual({ cleared: 2, total: 2 });
+    expect(res).toEqual({ cleared: 2, retained: 0, kept: 0, total: 2 });
     // Store empty afterwards → no re-attempt next boot.
     expect(loadStatusPins(PATH, fs)).toEqual([]);
   });
 
-  it("a failing unpin is non-fatal and the store is still emptied", async () => {
+  it("retry-safe (#3001): a failing unpin is non-fatal, RETAINS the row with an attempt counter, and drops only the succeeded one", async () => {
     const { fs } = memFs();
     persistStatusPins(PATH, fs, [
       pin({ pinKey: "fg:c:1", chatId: "-100123", messageId: 5 }),
@@ -216,11 +217,66 @@ describe("runStatusPinBootCleanup", () => {
       log: () => {},
     });
 
-    // One failed, one succeeded — still non-fatal, store still emptied.
-    expect(res).toEqual({ cleared: 1, total: 2 });
+    // One failed, one succeeded — the failure is retained for a next-boot
+    // retry instead of forfeiting the orphan (the pre-#3001 behaviour).
+    expect(res).toEqual({ cleared: 1, retained: 1, kept: 0, total: 2 });
+    expect(loadStatusPins(PATH, fs)).toEqual([
+      { pinKey: "fg:c:1", chatId: "-100123", messageId: 5, attempts: 1 },
+    ]);
+  });
+
+  it("retry-safe (#3001): a row is forfeited once its attempts reach BOOT_UNPIN_MAX_ATTEMPTS", async () => {
+    const { fs } = memFs();
+    persistStatusPins(PATH, fs, [
+      pin({
+        pinKey: "fg:c:1",
+        chatId: "-100123",
+        messageId: 5,
+        attempts: BOOT_UNPIN_MAX_ATTEMPTS - 1,
+      }),
+    ]);
+    const res = await runStatusPinBootCleanup({
+      path: PATH,
+      fs,
+      unpin: async () => {
+        throw new Error("chat gone forever");
+      },
+      log: () => {},
+    });
+    // Final attempt failed too — forfeited, not retained: a permanently-
+    // undeliverable unpin must not re-fail on every future boot.
+    expect(res).toEqual({ cleared: 0, retained: 0, kept: 0, total: 1 });
     expect(loadStatusPins(PATH, fs)).toEqual([]);
   });
 
+  it("tool pins (#3001): an UNEXPIRED `tool:` row survives the boot untouched; an EXPIRED one is unpinned and dropped", async () => {
+    const { fs } = memFs();
+    const now = 1_750_000_000_000;
+    persistStatusPins(PATH, fs, [
+      pin({ pinKey: "tool:-100123:70", chatId: "-100123", messageId: 70, expiresAt: now + 1 }),
+      pin({ pinKey: "tool:-100123:71", chatId: "-100123", messageId: 71, expiresAt: now }),
+      pin({ pinKey: "wk:agent-x", chatId: "-100123", messageId: 72 }),
+    ]);
+    const unpinned: number[] = [];
+    const res = await runStatusPinBootCleanup({
+      path: PATH,
+      fs,
+      unpin: async (_c, messageId) => {
+        unpinned.push(messageId);
+      },
+      now,
+      log: () => {},
+    });
+    // The expired tool pin and the work-scoped wk: pin are unpinned; the
+    // unexpired tool pin is kept for a future boot (restart ≠ reset for a
+    // deliberate agent pin with no "work finished" event).
+    expect(unpinned).toEqual([71, 72]);
+    expect(res).toEqual({ cleared: 2, retained: 0, kept: 1, total: 3 });
+    expect(loadStatusPins(PATH, fs)).toEqual([
+      { pinKey: "tool:-100123:70", chatId: "-100123", messageId: 70, expiresAt: now + 1 },
+    ]);
+  });
+
   it("no-op on a fresh boot with no persisted pins (no unpin calls)", async () => {
     const { fs } = memFs();
     let calls = 0;
@@ -232,7 +288,7 @@ describe("runStatusPinBootCleanup", () => {
       },
       log: () => {},
     });
-    expect(res).toEqual({ cleared: 0, total: 0 });
+    expect(res).toEqual({ cleared: 0, retained: 0, kept: 0, total: 0 });
     expect(calls).toBe(0);
   });
 
@@ -254,7 +310,7 @@ describe("runStatusPinBootCleanup", () => {
       log: () => {},
     });
     expect(unpinned).toEqual([["-100777", 314]]);
-    expect(res).toEqual({ cleared: 1, total: 1 });
+    expect(res).toEqual({ cleared: 1, retained: 0, kept: 0, total: 1 });
     expect(loadStatusPins(PATH, fs)).toEqual([]);
   });
 });

package/telegram-plugin/tests/stream-controller-chunk-cap.test.ts

@@ -0,0 +1,122 @@
+/**
+ * Wire-level regression test for the chunk-boundary cap bug
+ * (fix/rich-render-chunk-boundary-cap).
+ *
+ * With `SWITCHROOM_RICH_RENDER` on, a near-cap body full of escapable chars
+ * (`_ * |`) makes `renderSafe` degrade the whole document to plain (its escaped
+ * rich form exceeds RICH_MESSAGE_MAX_CHARS). BEFORE the fix, the stream
+ * controller shipped that ~32k plain body through the plain `sendMessage`
+ * endpoint in ONE call — Telegram's plain endpoint caps at 4096, so the send
+ * is rejected (`message is too long`) and the streamed answer is dropped.
+ *
+ * AFTER the fix, `renderOutboundChunks` re-splits at safe boundaries so every
+ * emitted send fits its own wire cap: rich pieces <= 32768, plain pieces
+ * <= 4096, and no fenced block is bisected.
+ */
+import { describe, it, expect, afterEach } from "vitest";
+import { createStreamController } from "../stream-controller.js";
+import { createFakeBotApi } from "./fake-bot-api.js";
+import { RICH_MESSAGE_MAX_CHARS } from "../format.js";
+
+const PLAIN_CAP = 4096; // Telegram's legacy plain-text sendMessage cap (format.ts:29).
+
+function fenceCount(s: string): number {
+  return (s.match(/^```/gm) ?? []).length;
+}
+
+describe("stream-controller enforces the wire cap on the post-escape body", () => {
+  afterEach(() => {
+    delete process.env.SWITCHROOM_RICH_RENDER;
+  });
+
+  it("REGRESSION: near-cap escapable first send never exceeds the plain wire cap", async () => {
+    process.env.SWITCHROOM_RICH_RENDER = "1";
+    const bot = createFakeBotApi({ startMessageId: 1000 });
+    const unit = "a_b*c|d ";
+    const body = unit.repeat(Math.floor((RICH_MESSAGE_MAX_CHARS - 20) / unit.length));
+
+    const stream = createStreamController({
+      bot: bot as unknown as Parameters<typeof createStreamController>[0]["bot"],
+      chatId: "c1",
+      throttleMs: 0,
+    });
+    await stream.update(body);
+    await stream.finalize();
+
+    expect(bot.state.sent.length).toBeGreaterThan(0);
+    for (const s of bot.state.sent) {
+      // Every send fits the rich cap...
+      expect(s.text.length).toBeLessThanOrEqual(RICH_MESSAGE_MAX_CHARS);
+      // ...and a PLAIN send (rich !== true) additionally fits the 4096 plain
+      // endpoint cap — the invariant HEAD violated (one ~32k plain send).
+      if (!s.rich) expect(s.text.length).toBeLessThanOrEqual(PLAIN_CAP);
+      // No send bisects a fenced block.
+      expect(fenceCount(s.text) % 2).toBe(0);
+    }
+  }, 30000);
+
+  it("BLOCKER: multi-update oversize stream emits tails ONCE, not per edit tick", async () => {
+    // Reproduces the duplicate-flood blocker: an oversize body splits into N
+    // pieces. The FIRST flush (send path) emits the anchor + (N-1) tail
+    // messages. Every SUBSEQUENT throttled flush routes through the EDIT
+    // callback. The pre-fix code re-sent all (N-1) tails as brand-new messages
+    // on each edit tick, so `sent.length` grew by (N-1) every update. After the
+    // fix, tails are parked once and edited in place — `sent.length` is flat.
+    process.env.SWITCHROOM_RICH_RENDER = "1";
+    const bot = createFakeBotApi({ startMessageId: 3000 });
+    const unit = "a_b*c|d ";
+    // Near-cap body that degrades to plain and splits into several pieces.
+    const base = unit.repeat(Math.floor((RICH_MESSAGE_MAX_CHARS - 20) / unit.length));
+    // Distinct short prefix per flush so the HEAD piece actually changes —
+    // an unchanged head yields a not-modified edit, which short-circuits before
+    // the tail loop and would hide the duplicate-resend bug.
+    const bodyFor = (i: number) => `v${i} ${base}`;
+
+    const stream = createStreamController({
+      bot: bot as unknown as Parameters<typeof createStreamController>[0]["bot"],
+      chatId: "c1",
+      throttleMs: 0,
+    });
+
+    // First flush → send path: anchor + tails, emitted exactly once.
+    await stream.update(bodyFor(1));
+    const afterFirst = bot.state.sent.length;
+    expect(afterFirst).toBeGreaterThan(1); // genuinely multi-piece
+
+    // Drive several more oversize updates — each routes through the EDIT
+    // callback. The count must NOT grow: tails are edited in place, not resent.
+    await stream.update(bodyFor(2));
+    expect(bot.state.sent.length).toBe(afterFirst);
+    await stream.update(bodyFor(3));
+    expect(bot.state.sent.length).toBe(afterFirst);
+    await stream.update(bodyFor(4));
+    expect(bot.state.sent.length).toBe(afterFirst);
+    await stream.finalize();
+
+    // Final: exactly the anchor + tail set, no duplicates across the lifetime.
+    expect(bot.state.sent.length).toBe(afterFirst);
+    const ids = bot.state.sent.map((s) => s.message_id);
+    expect(new Set(ids).size).toBe(ids.length); // no duplicate message ids
+
+    // Every currently-visible message fits its wire cap and (for plain) 4096.
+    for (const s of bot.state.sent) {
+      const cur = bot.textOf(s.message_id) ?? "";
+      expect(cur.length).toBeLessThanOrEqual(RICH_MESSAGE_MAX_CHARS);
+      if (!s.rich) expect(cur.length).toBeLessThanOrEqual(PLAIN_CAP);
+    }
+  }, 30000);
+
+  it("flag OFF leaves the single-send path untouched", async () => {
+    const bot = createFakeBotApi({ startMessageId: 2000 });
+    const stream = createStreamController({
+      bot: bot as unknown as Parameters<typeof createStreamController>[0]["bot"],
+      chatId: "c1",
+      throttleMs: 0,
+    });
+    await stream.update("**hi** _there_");
+    await stream.finalize();
+    expect(bot.state.sent).toHaveLength(1);
+    expect(bot.state.sent[0].rich).toBe(true);
+    expect(bot.state.sent[0].text).toBe("**hi** _there_");
+  });
+});