switchroom 0.18.8 → 0.18.10

package/telegram-plugin/tests/session-model-file.test.ts

@@ -19,9 +19,16 @@ import {
   clearRelaunchModelIntent,
   readConfiguredDefaultModel,
   intentForRestartReason,
+  readRelaunchModelIntent,
+  clearStaleGatewayShutdownIntent,
+  GATEWAY_SHUTDOWN_INTENT_REASON_PREFIX,
   SESSION_MODEL_FILE,
   RELAUNCH_MODEL_INTENT_FILE,
   CONFIGURED_DEFAULT_MODEL_FILE,
+  parseSessionEffort,
+  writeSessionEffortFile,
+  readSessionEffortFile,
+  clearSessionEffortFile,
 } from '../gateway/session-model-file.js'
 
 let dir: string
@@ -108,8 +115,8 @@ describe('intentForRestartReason — the triggerSelfRestart per-reason table (RF
     expect(intentForRestartReason(reason)).toBe('keep')
   })
 
-  it('inline-button-restart (operator-deliberate) → revert', () => {
-    expect(intentForRestartReason('inline-button-restart')).toBe('revert')
+  it('inline-button-restart → keep (#3039: a restart is not "clear my model")', () => {
+    expect(intentForRestartReason('inline-button-restart')).toBe('keep')
   })
 
   it('unknown gateway reasons default to keep (only gateway code calls triggerSelfRestart; crashes never do)', () => {
@@ -117,6 +124,47 @@ describe('intentForRestartReason — the triggerSelfRestart per-reason table (RF
   })
 })
 
+describe('readRelaunchModelIntent', () => {
+  it('round-trips a stamped intent; null when absent / corrupt / malformed', () => {
+    expect(readRelaunchModelIntent(dir)).toBeNull()
+    writeRelaunchModelIntent(dir, 'keep', 'watchdog recovery')
+    const rec = readRelaunchModelIntent(dir)!
+    expect(rec.intent).toBe('keep')
+    expect(rec.reason).toBe('watchdog recovery')
+    expect(Math.abs(Date.now() - rec.ts)).toBeLessThan(5000)
+    writeFileSync(join(dir, RELAUNCH_MODEL_INTENT_FILE), '{broken')
+    expect(readRelaunchModelIntent(dir)).toBeNull()
+    writeFileSync(join(dir, RELAUNCH_MODEL_INTENT_FILE), '{"intent":"maybe","reason":"x","ts":1}\n')
+    expect(readRelaunchModelIntent(dir)).toBeNull()
+  })
+})
+
+describe('clearStaleGatewayShutdownIntent (#3018 finding 4 — a gateway-only bounce must not leave a keep stamp)', () => {
+  it('clears ONLY a gateway-shutdown-stamped intent and reports it', () => {
+    writeRelaunchModelIntent(
+      dir,
+      'keep',
+      `${GATEWAY_SHUTDOWN_INTENT_REASON_PREFIX} graceful SIGTERM shutdown (deploy/rolling restart) — preserving user-chosen session model`,
+    )
+    expect(clearStaleGatewayShutdownIntent(dir)).toBe(true)
+    expect(existsSync(join(dir, RELAUNCH_MODEL_INTENT_FILE))).toBe(false)
+    // Idempotent: a second call finds nothing.
+    expect(clearStaleGatewayShutdownIntent(dir)).toBe(false)
+  })
+
+  it('never touches a triggerSelfRestart / user-slash stamp (un-prefixed reason)', () => {
+    writeRelaunchModelIntent(dir, 'keep', 'sr-to-claude-model-switch')
+    expect(clearStaleGatewayShutdownIntent(dir)).toBe(false)
+    expect(readRelaunchModelIntent(dir)!.reason).toBe('sr-to-claude-model-switch')
+  })
+
+  it('is a safe no-op on an absent or corrupt intent file', () => {
+    expect(clearStaleGatewayShutdownIntent(dir)).toBe(false)
+    writeFileSync(join(dir, RELAUNCH_MODEL_INTENT_FILE), 'not json')
+    expect(clearStaleGatewayShutdownIntent(dir)).toBe(false)
+  })
+})
+
 describe('readConfiguredDefaultModel', () => {
   it('reads the trimmed value; null when absent or empty', () => {
     expect(readConfiguredDefaultModel(dir)).toBeNull()
@@ -130,3 +178,54 @@ describe('readConfiguredDefaultModel', () => {
     expect(() => clearSessionModelFile(dir)).not.toThrow()
   })
 })
+
+// ─── #3039: durable session-effort carrier ───────────────────────────────────
+
+describe('session-effort file helpers (#3039)', () => {
+  let dir: string
+  beforeEach(() => {
+    dir = mkdtempSync(join(tmpdir(), 'sr-session-effort-'))
+  })
+  afterEach(() => {
+    rmSync(dir, { recursive: true, force: true })
+  })
+
+  it('round-trips a valid level with the configured default at write', () => {
+    writeSessionEffortFile(dir, 'xhigh', 'low')
+    const rec = readSessionEffortFile(dir)
+    expect(rec?.level).toBe('xhigh')
+    expect(rec?.configuredDefaultAtWrite).toBe('low')
+    expect(typeof rec?.ts).toBe('number')
+  })
+
+  it('refuses to persist a non-allowlisted level (verbatim --effort surface)', () => {
+    expect(() => writeSessionEffortFile(dir, 'mega; rm -rf /', 'low')).toThrow(/non-allowlisted/)
+    expect(readSessionEffortFile(dir)).toBeNull()
+  })
+
+  it('parseSessionEffort rejects corrupt JSON, bad shape, and bad levels', () => {
+    expect(parseSessionEffort('{broken')).toBeNull()
+    expect(parseSessionEffort('{"level":"turbo","configuredDefaultAtWrite":"low","ts":1}')).toBeNull()
+    expect(parseSessionEffort('{"level":"high","ts":1}')).toBeNull()
+    expect(parseSessionEffort('{"level":"high","configuredDefaultAtWrite":"low","ts":1}')?.level).toBe('high')
+  })
+
+  it('clearSessionEffortFile removes it; read after clear is null', () => {
+    writeSessionEffortFile(dir, 'high', '')
+    clearSessionEffortFile(dir)
+    expect(readSessionEffortFile(dir)).toBeNull()
+  })
+})
+
+describe('intentForRestartReason is keep-for-everything (#3039)', () => {
+  it('every reason keeps — restarts never clear a user model choice', () => {
+    for (const reason of [
+      'inline-button-restart',
+      'user: /restart from chat',
+      'schedule-restart-immediate',
+      'anything-else',
+    ]) {
+      expect(intentForRestartReason(reason)).toBe('keep')
+    }
+  })
+})

package/telegram-plugin/tests/stop-command.test.ts

@@ -0,0 +1,234 @@
+/**
+ * #3020 — Telegram `/stop` command + bare operator "stop" keyword.
+ *
+ * Pure-logic coverage for telegram-plugin/gateway/stop-command.ts (parser +
+ * reply builder), plus structural pins on gateway.ts wiring in the style of
+ * gateway-pending-command-wiring.test.ts — the halt sequence lives in
+ * un-exported inline closures, so we assert on the source structure.
+ * Also pins the /stop → /agentstop rename in the command catalogue.
+ */
+
+import { describe, it, expect } from 'vitest'
+import { readFileSync } from 'node:fs'
+import { fileURLToPath } from 'node:url'
+import { dirname, resolve } from 'node:path'
+import { parseStopKeyword, buildStopReply } from '../gateway/stop-command.js'
+import { switchroomHelpCommandNames, switchroomHelpText } from '../welcome-text.js'
+
+const __dirname = dirname(fileURLToPath(import.meta.url))
+const GATEWAY_SRC = readFileSync(resolve(__dirname, '..', 'gateway', 'gateway.ts'), 'utf8')
+
+describe('parseStopKeyword', () => {
+  it('matches the exact word stop, case-insensitively', () => {
+    for (const t of ['stop', 'Stop', 'STOP', 'sToP']) {
+      expect(parseStopKeyword(t), t).toBe(true)
+    }
+  })
+  it('tolerates surrounding whitespace and a single trailing . or !', () => {
+    for (const t of ['  stop  ', 'stop.', 'stop!', ' STOP! ', '\nstop\n']) {
+      expect(parseStopKeyword(t), JSON.stringify(t)).toBe(true)
+    }
+  })
+  it('does NOT match stop inside normal speech', () => {
+    for (const t of [
+      'stop the build',
+      'please stop',
+      'stop it',
+      'stopping',
+      'nonstop',
+      'stop?',
+      'stop!!',
+      'stop..',
+      '/stop', // the slash command routes via bot.command, not the keyword
+      '! stop',
+      'stop now',
+      '',
+      '   ',
+    ]) {
+      expect(parseStopKeyword(t), JSON.stringify(t)).toBe(false)
+    }
+  })
+})
+
+describe('buildStopReply', () => {
+  it('is honest when nothing is running', () => {
+    const r = buildStopReply(false, [])
+    expect(r.text).toContain('Nothing running')
+    expect(r.text).not.toContain('cancelled')
+  })
+  it('confirms the cancel when a turn was in flight', () => {
+    const r = buildStopReply(true, [])
+    expect(r.text).toContain('Turn cancelled')
+    expect(r.text).not.toContain('Queued')
+  })
+  it('mentions surviving queued session commands (singular)', () => {
+    const r = buildStopReply(true, ['/model fable'])
+    expect(r.text).toContain('Turn cancelled')
+    expect(r.text).toContain('/model fable')
+    expect(r.text).toContain('survives')
+    expect(r.text).toContain('idle')
+  })
+  it('mentions surviving queued session commands (plural)', () => {
+    const r = buildStopReply(true, ['/model fable', '/effort high'])
+    expect(r.text).toContain('/model fable')
+    expect(r.text).toContain('/effort high')
+    expect(r.text).toContain('Queued commands')
+    expect(r.text).toContain('survive')
+  })
+})
+
+describe('gateway wiring — /stop cancels the in-flight turn (#3020)', () => {
+  it('registers /stop gated on isAuthorizedSender, honest-idle via turnInFlightForGate, halting via executeHaltNow', () => {
+    const idx = GATEWAY_SRC.indexOf("bot.command('stop', async ctx => {")
+    expect(idx).toBeGreaterThan(0)
+    const win = GATEWAY_SRC.slice(idx, idx + 900)
+    expect(win).toContain('if (!isAuthorizedSender(ctx)) return')
+    expect(win).toContain('turnInFlightForGate()')
+    expect(win).toContain('buildStopReply(false')
+    expect(win).toContain("executeHaltNow('stop-command')")
+    expect(win).toContain('buildStopReply(true')
+    // Queued /model + /effort survive the halt and are named in the reply.
+    expect(win).toContain('pendingSessionCommand.list()')
+  })
+
+  it('container stop moved to /agentstop and still dispatches hostd agent_stop', () => {
+    const idx = GATEWAY_SRC.indexOf("bot.command('agentstop', async ctx => {")
+    expect(idx).toBeGreaterThan(0)
+    const win = GATEWAY_SRC.slice(idx, idx + 700)
+    expect(win).toContain("op: 'agent_stop'")
+    // The new /stop must NOT dispatch a container stop.
+    const stopIdx = GATEWAY_SRC.indexOf("bot.command('stop', async ctx => {")
+    expect(GATEWAY_SRC.slice(stopIdx, stopIdx + 900)).not.toContain("op: 'agent_stop'")
+  })
+
+  it('executeHaltNow honors the safe-boundary deferral then fires tmux C-c, cancels the obligation, and releases busy state', () => {
+    const fnIdx = GATEWAY_SRC.indexOf('async function executeHaltNow(')
+    expect(fnIdx).toBeGreaterThan(0)
+    const win = GATEWAY_SRC.slice(fnIdx, fnIdx + 5500)
+    const deferIdx = win.indexOf('decideInterruptTiming({')
+    expect(deferIdx).toBeGreaterThan(0)
+    expect(win).toContain('resolveInterruptMaxWaitMs')
+    const waitIdx = win.indexOf('await waitForSafeBoundary(')
+    const sigintIdx = win.indexOf('sendAgentInterrupt({ agentName })')
+    const cancelIdx = win.indexOf('cancelInterruptedObligation()')
+    const stampIdx = win.indexOf("endedVia: 'stop' as const")
+    const endIdx = win.indexOf('endCurrentTurnAtomic(turn)')
+    const releaseIdx = win.indexOf('releaseTurnBufferGate(key, turn)')
+    // Ordered: defer-wait → C-c → obligation cancel → clean registry stamp
+    // (so the cancelled turn can never boot-resume) → deterministic release.
+    expect(waitIdx).toBeGreaterThan(deferIdx)
+    expect(sigintIdx).toBeGreaterThan(waitIdx)
+    expect(cancelIdx).toBeGreaterThan(sigintIdx)
+    expect(stampIdx).toBeGreaterThan(cancelIdx)
+    expect(endIdx).toBeGreaterThan(stampIdx)
+    expect(releaseIdx).toBeGreaterThan(endIdx)
+  })
+
+  it('executeHaltNow guards against the wrong-turn kill race (snapshot at entry, no-op if the turn changed)', () => {
+    const fnIdx = GATEWAY_SRC.indexOf('async function executeHaltNow(')
+    const win = GATEWAY_SRC.slice(fnIdx, fnIdx + 5500)
+    // Identity snapshotted BEFORE the boundary wait…
+    const snapIdx = win.indexOf('const haltTarget = currentTurn')
+    const waitIdx = win.indexOf('await waitForSafeBoundary(')
+    expect(snapIdx).toBeGreaterThan(0)
+    expect(snapIdx).toBeLessThan(waitIdx)
+    // …and re-checked AFTER it, before the C-c: a changed turn no-ops both
+    // the SIGINT and the teardown (the requester's turn already ended).
+    const guardIdx = win.indexOf('currentTurn !== haltTarget')
+    const sigintIdx = win.indexOf('sendAgentInterrupt({ agentName })')
+    expect(guardIdx).toBeGreaterThan(waitIdx)
+    expect(guardIdx).toBeLessThan(sigintIdx)
+    const afterGuard = win.slice(guardIdx)
+    expect(afterGuard).toMatch(/\n\s*return\b/)
+  })
+
+  it('executeHaltNow cancels the halted turn\'s pending permission cards and kicks the session-command drain', () => {
+    const fnIdx = GATEWAY_SRC.indexOf('async function executeHaltNow(')
+    const win = GATEWAY_SRC.slice(fnIdx, fnIdx + 5500)
+    // Item 4: deny + strip pending Approve/Deny cards so the buffer gate
+    // opens and a later tap can't dispatch into an idle session.
+    const permCancelIdx = win.indexOf('cancelPendingPermissionsForHalt(origin)')
+    expect(permCancelIdx).toBeGreaterThan(0)
+    // Item 5: after busy release, drain a queued /model / /effort promptly
+    // instead of waiting for the 60s reaper.
+    const drainIdx = win.indexOf('if (!turnInFlightForGate()) void drainPendingSessionCommand()')
+    const releaseIdx = win.indexOf('releaseTurnBufferGate(key, turn)')
+    expect(drainIdx).toBeGreaterThan(releaseIdx)
+    // The cancel helper itself denies, strips, and forgets each card.
+    const helperIdx = GATEWAY_SRC.indexOf('function cancelPendingPermissionsForHalt(')
+    expect(helperIdx).toBeGreaterThan(0)
+    const helperWin = GATEWAY_SRC.slice(helperIdx, helperIdx + 1200)
+    expect(helperWin).toContain("behavior: 'deny'")
+    expect(helperWin).toContain('stripCancelledPermissionCards(')
+    expect(helperWin).toContain('pendingPermissions.delete(requestId)')
+    expect(helperWin).toContain('permCardStore.remove(requestId)')
+  })
+
+  it('the session-event ingest kicks halt-boundary waiters alongside the deferred-interrupt boundary check', () => {
+    const idx = GATEWAY_SRC.indexOf('toolFlightTracker.onEvent(ev)')
+    expect(idx).toBeGreaterThan(0)
+    const win = GATEWAY_SRC.slice(idx, idx + 600)
+    expect(win).toContain('notifyHaltBoundaryWaiters()')
+  })
+
+  it('bare "stop" bypasses the coalescer and routes into executeHaltNow in handleInbound', () => {
+    // Coalesce bypass sits next to the `!` bypass.
+    const bypassIdx = GATEWAY_SRC.indexOf('parseInterruptMarker(text).isInterrupt')
+    expect(bypassIdx).toBeGreaterThan(0)
+    const bypassWin = GATEWAY_SRC.slice(bypassIdx, bypassIdx + 800)
+    expect(bypassWin).toContain('parseStopKeyword(text)')
+    // handleInbound keyword block: honest idle reply or halt + confirmation.
+    const kwIdx = GATEWAY_SRC.indexOf("executeHaltNow('stop-keyword')")
+    expect(kwIdx).toBeGreaterThan(0)
+    const kwWin = GATEWAY_SRC.slice(kwIdx - 1600, kwIdx + 900)
+    expect(kwWin).toContain('turnInFlightForGate()')
+    expect(kwWin).toContain('buildStopReply(inFlight, queuedLabels)')
+    // Intercepted — never forwarded to the agent as a turn.
+    expect(kwWin).toContain('return')
+  })
+
+  it('the empty-`!` interrupt routes through the same executeHaltNow helper', () => {
+    expect(GATEWAY_SRC).toContain("executeHaltNow('bang-empty')")
+  })
+
+  it('/stop with an argument warns and does NOT halt (old container-stop muscle memory)', () => {
+    const idx = GATEWAY_SRC.indexOf("bot.command('stop', async ctx => {")
+    const win = GATEWAY_SRC.slice(idx, idx + 1600)
+    const argIdx = win.indexOf('const arg = ctx.match?.trim()')
+    const haltIdx = win.indexOf("executeHaltNow('stop-command')")
+    expect(argIdx).toBeGreaterThan(0)
+    // Arg check runs BEFORE the halt and returns without cancelling.
+    expect(argIdx).toBeLessThan(haltIdx)
+    expect(win).toContain('takes no argument')
+    expect(win).toContain('/agentstop')
+    expect(win).toContain('Nothing was stopped')
+  })
+
+  it('a photo/attachment captioned "stop" never trips the halt-and-drop path', () => {
+    // Coalesce bypass: pure text only.
+    const bypassIdx = GATEWAY_SRC.indexOf(
+      'parseStopKeyword(text) && downloadImage == null && attachment == null',
+    )
+    expect(bypassIdx).toBeGreaterThan(0)
+    // handleInbound keyword block: also excludes coalesced extra attachments.
+    const kwIdx = GATEWAY_SRC.indexOf("executeHaltNow('stop-keyword')")
+    const kwWin = GATEWAY_SRC.slice(kwIdx - 2400, kwIdx)
+    expect(kwWin).toContain('downloadImage == null')
+    expect(kwWin).toContain('attachment == null')
+    expect(kwWin).toContain('extraAttachments == null || extraAttachments.length === 0')
+  })
+})
+
+describe('command catalogue — /agentstop rename regression (#3020)', () => {
+  it('help name array carries both stop (turn cancel) and agentstop (container)', () => {
+    expect(switchroomHelpCommandNames as readonly string[]).toContain('stop')
+    expect(switchroomHelpCommandNames as readonly string[]).toContain('agentstop')
+  })
+  it('help text documents /agentstop as the container verb and /stop as the turn cancel', () => {
+    const out = switchroomHelpText('assistant')
+    expect(out).toContain('/agentstop')
+    expect(out).toMatch(/\/stop.*(in-flight|turn)/i)
+    // No stale "/stop [name] — stop an agent" container wording.
+    expect(out).not.toContain('`/stop [name]`')
+  })
+})

package/telegram-plugin/tests/subagent-watcher-env-thresholds.test.ts

@@ -28,6 +28,7 @@ function makeHarness(opts: {
   configStallThresholdMs?: number
   configSilentSynthStallThresholdMs?: number
   configSilentStallTerminalMs?: number
+  configInflightTerminalCapMs?: number
   initialContent?: string
 } = {}) {
   const {
@@ -35,6 +36,7 @@ function makeHarness(opts: {
     configStallThresholdMs,
     configSilentSynthStallThresholdMs,
     configSilentStallTerminalMs,
+    configInflightTerminalCapMs,
     initialContent,
   } = opts
 
@@ -91,6 +93,7 @@ function makeHarness(opts: {
     stallThresholdMs: configStallThresholdMs,
     silentSynthesisStallThresholdMs: configSilentSynthStallThresholdMs ?? configStallThresholdMs,
     silentStallTerminalMs: configSilentStallTerminalMs,
+    inflightTerminalCapMs: configInflightTerminalCapMs,
     rescanMs: 500,
     onStall: (_id, idleMs) => stallCalls.push({ idleMs }),
     onStallTerminal: (id) => stallTerminalCalls.push({ agentId: id }),
@@ -132,6 +135,7 @@ const ENV_KEYS = [
   'SWITCHROOM_SUBAGENT_STALL_MS',
   'SWITCHROOM_SUBAGENT_SILENT_SYNTH_STALL_MS',
   'SWITCHROOM_SUBAGENT_STALL_TERMINAL_MS',
+  'SWITCHROOM_SUBAGENT_INFLIGHT_TERMINAL_CAP_MS',
 ] as const
 
 describe('subagent-watcher env-var threshold overrides', () => {
@@ -219,23 +223,28 @@ describe('subagent-watcher env-var threshold overrides', () => {
     expect(h.stallTerminalCalls).toHaveLength(0)
   })
 
-  it('a Bash-in-flight worker skips the tight stall threshold but still releases the terminal gate', () => {
-    // End-to-end of the long-runner suppression under compressed env-tuned
-    // windows: a worker mid-`Bash` (a) is NOT flagged at the tight active-loop
-    // threshold, (b) IS eventually flagged at the widened silent-synthesis
-    // window, and (c) the pass-2 terminal synthesis STILL fires the fixed
-    // window after that — the load-bearing completion-gate release is intact.
+  it('a Bash-in-flight worker skips the tight stall threshold, DEFERS terminal synthesis while the tool call is in flight, and still releases at the in-flight cap', () => {
+    // Design reconciliation (incident 2026-07-10 vs the #2777/#2782
+    // contract this test used to encode): a worker mid-`Bash` whose
+    // transcript ends in a tool_use with no matching tool_result is NOT
+    // silent — it's inside a legal long tool call — so the pass-2 terminal
+    // synthesis must NOT fire at silentStallTerminalMs (the old contract;
+    // it finalised a live worker's card). But the completion-gate release
+    // from #2777/#2782 is still load-bearing for a worker that DIED
+    // mid-tool, so the deferral is CAPPED at inflightTerminalCapMs of
+    // total idle: deferred while in flight, released at the cap.
     const h = makeHarness({
       agentId: 'env-thresh-bash',
       configStallThresholdMs: 1000, // tight active-loop threshold
       configSilentSynthStallThresholdMs: 10_000, // widened long-runner window
       configSilentStallTerminalMs: 5000, // compressed terminal window
+      configInflightTerminalCapMs: 60_000, // compressed died-mid-tool cap
       initialContent: buildJSONL(
         subAgentUserMsg('bg task'),
         { type: 'assistant', message: { content: [{ type: 'tool_use', id: 'tool-B', name: 'Bash', input: { command: 'npm test' } }] } },
       ),
     })
-    h.advance(500) // register + tail → toolCount=1, lastTool=Bash
+    h.advance(500) // register + tail → toolCount=1, lastTool=Bash, tool-B in flight
     h.unmarkHistorical()
 
     // 5s idle — well past the 1s active-loop threshold, but a Bash worker uses
@@ -248,8 +257,17 @@ describe('subagent-watcher env-var threshold overrides', () => {
     expect(h.stallCalls).toHaveLength(1)
     expect(h.stallTerminalCalls).toHaveLength(0)
 
-    // 5s post-stall → terminal synthesis releases the deferred-completion gate.
-    h.advance(6_000)
+    // 5s+ post-stall — the OLD contract synthesised here. The in-flight
+    // Bash (no tool_result yet) now defers it: a live long-runner must not
+    // have its card finalised under it.
+    h.advance(6_000) // ~17.5s total idle, < 60s cap
+    expect(h.stallTerminalCalls).toHaveLength(0)
+    expect(h.finishCalls).toHaveLength(0)
+
+    // Cross the in-flight cap (total idle ≥ 60s, tool_result still missing)
+    // → died-mid-tool: synthesis proceeds and the completion gate releases.
+    // The #2777/#2782 release guarantee survives, just later.
+    h.advance(50_000)
     expect(h.stallTerminalCalls).toHaveLength(1)
     expect(h.finishCalls).toHaveLength(1)
   })