switchroom 0.18.8 → 0.18.10

package/telegram-plugin/tests/vault-approval-posture.test.ts

@@ -41,10 +41,14 @@ import { readFileSync } from 'node:fs'
 import { resolve } from 'node:path'
 import { resolveVaultApprovalPosture } from '../vault-approval-posture.js'
 
-const gatewaySrc = readFileSync(
-  resolve(__dirname, '..', 'gateway', 'gateway.ts'),
-  'utf-8',
-)
+// #2996 Phase 5: the callback-query handler families moved verbatim to
+// gateway/callback-query-handlers.ts; these pins read the gateway source
+// COMBINED with that module so the wiring assertions keep covering the
+// same runtime source text.
+const gatewaySrc =
+  readFileSync(resolve(__dirname, '..', 'gateway', 'gateway.ts'), 'utf-8') +
+  '\n' +
+  readFileSync(resolve(__dirname, '..', 'gateway', 'callback-query-handlers.ts'), 'utf-8')
 
 function sliceAccessApproveBlock(): string {
   const fn =
@@ -73,7 +77,10 @@ describe('vault grant approval posture — module-level wiring', () => {
 describe('handleVaultRequestAccessCallback — posture branch', () => {
   it('mints via posture attestation (NOT in-memory passphrase) when posture is telegram-id', () => {
     const approveBlock = sliceAccessApproveBlock()
-    expect(approveBlock).toMatch(/VAULT_APPROVAL_AUTH_MODE === ['"]telegram-id['"]/)
+    // #2996 Phase 5: inside the extracted handler module the mutable gateway
+    // `let` is read via the injected getter (gateway wires it as
+    // `getVaultApprovalAuthMode: () => VAULT_APPROVAL_AUTH_MODE`).
+    expect(approveBlock).toMatch(/getVaultApprovalAuthMode\(\) === ['"]telegram-id['"]/)
     // Pinned: the call shape MUST be `{ kind: 'posture' }`. If the
     // gateway ever reverts to passing a real passphrase here, the
     // bypass surface returns.
@@ -138,7 +145,8 @@ describe('handleVaultRequestSaveCallback — posture-attested broker put (#1115
     // calls `defaultVaultWritePosture` (posture-attested broker put,
     // no passphrase). Under passphrase mode it keeps the legacy
     // cached-passphrase + shell-out path.
-    expect(fnBlock).toMatch(/VAULT_APPROVAL_AUTH_MODE === 'telegram-id'/)
+    // #2996 Phase 5: getter read of the gateway's mutable posture `let`.
+    expect(fnBlock).toMatch(/getVaultApprovalAuthMode\(\) === 'telegram-id'/)
     expect(fnBlock).toMatch(/defaultVaultWritePosture\(/)
     // Passphrase-mode branch still present.
     expect(fnBlock).toMatch(/vaultPassphraseCache\.get\(pending\.chat_id\)/)
@@ -203,7 +211,7 @@ describe('allowlist is the first gate in every vault callback handler', () => {
         'mintGrantViaBroker',
         'performVaultAccessApproval',
         'pendingVaultOps.set',
-        "VAULT_APPROVAL_AUTH_MODE === 'telegram-id'",
+        "getVaultApprovalAuthMode() === 'telegram-id'",
         'attest_via_posture',
       ]) {
         expect(

package/telegram-plugin/tests/vault-grant-auto-resume.test.ts

@@ -23,10 +23,14 @@ import { describe, it, expect } from "vitest";
 import { readFileSync } from "node:fs";
 import { resolve } from "node:path";
 
-const gatewaySrc = readFileSync(
-  resolve(__dirname, "..", "gateway", "gateway.ts"),
-  "utf-8",
-);
+// #2996 Phase 5: the callback-query handler families moved verbatim to
+// gateway/callback-query-handlers.ts; these pins read the gateway source
+// COMBINED with that module so the wiring assertions keep covering the
+// same runtime source text.
+const gatewaySrc =
+  readFileSync(resolve(__dirname, "..", "gateway", "gateway.ts"), "utf-8") +
+  "\n" +
+  readFileSync(resolve(__dirname, "..", "gateway", "callback-query-handlers.ts"), "utf-8");
 
 function extractPerformBlock(): string {
   const start = gatewaySrc.indexOf("async function performVaultAccessApproval");

package/telegram-plugin/tests/vault-grant-union.test.ts

@@ -22,10 +22,14 @@ import { describe, it, expect } from "vitest";
 import { readFileSync } from "node:fs";
 import { resolve } from "node:path";
 
-const gatewaySrc = readFileSync(
-  resolve(__dirname, "..", "gateway", "gateway.ts"),
-  "utf-8",
-);
+// #2996 Phase 5: the callback-query handler families moved verbatim to
+// gateway/callback-query-handlers.ts; these pins read the gateway source
+// COMBINED with that module so the wiring assertions keep covering the
+// same runtime source text.
+const gatewaySrc =
+  readFileSync(resolve(__dirname, "..", "gateway", "gateway.ts"), "utf-8") +
+  "\n" +
+  readFileSync(resolve(__dirname, "..", "gateway", "callback-query-handlers.ts"), "utf-8");
 
 function extractPerformBlock(): string {
   const start = gatewaySrc.indexOf("async function performVaultAccessApproval");

package/telegram-plugin/tests/vault-grant-wizard.test.ts

@@ -40,7 +40,14 @@ function readSrc(rel: string): string {
 // `telegram-plugin/docs/gateway-server-split.md` for the F4 cleanup notes.
 
 describe('/vault grant inline-keyboard wizard — gateway (#227, #262, #265)', () => {
-  const gatewaySrc = readSrc('telegram-plugin/gateway/gateway.ts')
+  // #2996 Phase 5: the callback-query handler families moved verbatim to
+  // gateway/callback-query-handlers.ts; these pins read the gateway source
+  // COMBINED with that module so the wiring assertions keep covering the
+  // same runtime source text.
+  const gatewaySrc =
+    readSrc('telegram-plugin/gateway/gateway.ts') +
+    '\n' +
+    readSrc('telegram-plugin/gateway/callback-query-handlers.ts')
 
   it('gateway.ts: dispatches /vault grant to the wizard entry', () => {
     expect(gatewaySrc).toMatch(/\/vault grant/i)

package/telegram-plugin/tests/vault-grants-revoke.test.ts

@@ -33,7 +33,14 @@ import { join, dirname } from 'node:path'
 const __dir = dirname(fileURLToPath(import.meta.url))
 const pluginDir = join(__dir, '..')
 
-const gatewaySrc = readFileSync(join(pluginDir, 'gateway', 'gateway.ts'), 'utf8')
+// #2996 Phase 5: the callback-query handler families moved verbatim to
+// gateway/callback-query-handlers.ts; these pins read the gateway source
+// COMBINED with that module so the wiring assertions keep covering the
+// same runtime source text.
+const gatewaySrc =
+  readFileSync(join(pluginDir, 'gateway', 'gateway.ts'), 'utf8') +
+  '\n' +
+  readFileSync(join(pluginDir, 'gateway', 'callback-query-handlers.ts'), 'utf8')
 
 // ─── helpers ─────────────────────────────────────────────────────────────────
 

package/telegram-plugin/tests/vault-key-regex-allows-slash.test.ts

@@ -27,10 +27,14 @@ import { describe, it, expect } from "vitest";
 import { readFileSync } from "node:fs";
 import { resolve } from "node:path";
 
-const gatewaySrc = readFileSync(
-  resolve(__dirname, "..", "gateway", "gateway.ts"),
-  "utf-8",
-);
+// #2996 Phase 5: the callback-query handler families moved verbatim to
+// gateway/callback-query-handlers.ts; these pins read the gateway source
+// COMBINED with that module so the wiring assertions keep covering the
+// same runtime source text.
+const gatewaySrc =
+  readFileSync(resolve(__dirname, "..", "gateway", "gateway.ts"), "utf-8") +
+  "\n" +
+  readFileSync(resolve(__dirname, "..", "gateway", "callback-query-handlers.ts"), "utf-8");
 
 /** The exported regex literal — what the gateway actually validates against. */
 function extractVaultKeyRegex(): RegExp {

package/telegram-plugin/tests/vault-request-access-tool.test.ts

@@ -23,10 +23,14 @@ const bridgeSrc = readFileSync(
   resolve(__dirname, '..', 'bridge', 'bridge.ts'),
   'utf-8',
 )
-const gatewaySrc = readFileSync(
-  resolve(__dirname, '..', 'gateway', 'gateway.ts'),
-  'utf-8',
-)
+// #2996 Phase 5: the callback-query handler families moved verbatim to
+// gateway/callback-query-handlers.ts; these pins read the gateway source
+// COMBINED with that module so the wiring assertions keep covering the
+// same runtime source text.
+const gatewaySrc =
+  readFileSync(resolve(__dirname, '..', 'gateway', 'gateway.ts'), 'utf-8') +
+  '\n' +
+  readFileSync(resolve(__dirname, '..', 'gateway', 'callback-query-handlers.ts'), 'utf-8')
 
 describe('vault_request_access (#1012)', () => {
   it('bridge advertises the tool to MCP clients', () => {

package/telegram-plugin/tests/vault-request-access-unlock-resume.test.ts

@@ -22,10 +22,14 @@ import { describe, it, expect } from 'vitest'
 import { readFileSync } from 'node:fs'
 import { resolve } from 'node:path'
 
-const gatewaySrc = readFileSync(
-  resolve(__dirname, '..', 'gateway', 'gateway.ts'),
-  'utf-8',
-)
+// #2996 Phase 5: the callback-query handler families moved verbatim to
+// gateway/callback-query-handlers.ts; these pins read the gateway source
+// COMBINED with that module so the wiring assertions keep covering the
+// same runtime source text.
+const gatewaySrc =
+  readFileSync(resolve(__dirname, '..', 'gateway', 'gateway.ts'), 'utf-8') +
+  '\n' +
+  readFileSync(resolve(__dirname, '..', 'gateway', 'callback-query-handlers.ts'), 'utf-8')
 
 describe('vault_request_access — tap-to-unlock-and-approve UX', () => {
   it('declares the passphrase-for-access-approve PendingVaultOp variant', () => {

package/telegram-plugin/tests/worker-activity-feed.test.ts

@@ -986,6 +986,43 @@ describe('createWorkerActivityFeed — resurrection guard + deferred finalize',
     expect(feed.size).toBe(0)
   })
 
+  it('#3023: resurrect() reopens the paint path after a FALSE finish so a fresh cue repaints', async () => {
+    const bot = makeFakeBot()
+    let clock = 10_000
+    const feed = createWorkerActivityFeed({ bot, now: () => clock, minEditIntervalMs: 0 })
+    await feed.update('w1', 'chat', view({ toolCount: 1, latestSummary: 'step one' }))
+    expect(bot.sent).toHaveLength(1)
+
+    // The card is FALSELY finalized (silent-stall synthesis fired while the
+    // worker was actually still alive).
+    await feed.finish('w1', view({ state: 'done', toolCount: 1, latestSummary: 'premature done' }))
+    expect(feed.has('w1')).toBe(false)
+
+    // Without resurrect(), the finalized gate would swallow any further cue
+    // (the #3 case above). Prove that first: a plain late tick is a no-op.
+    clock = 12_000
+    await feed.update('w1', 'chat', view({ toolCount: 2, latestSummary: 'still going' }))
+    expect(bot.sent).toHaveLength(1)
+
+    // The watcher detected the false finish and resurrected the worker.
+    feed.resurrect('w1')
+
+    // Now a running cue repaints a live card — active work is visible again.
+    clock = 13_000
+    await feed.update('w1', 'chat', view({ toolCount: 3, latestSummary: 'back to work' }))
+    expect(bot.sent).toHaveLength(2) // a fresh card was painted
+    expect(feed.has('w1')).toBe(true)
+    expect(bot.sent[1].text).toContain('back to work')
+  })
+
+  it('#3023: resurrect() on a never-finalized worker is a harmless no-op', () => {
+    const bot = makeFakeBot()
+    const feed = createWorkerActivityFeed({ bot, now: () => 10_000 })
+    // No throw, nothing painted.
+    feed.resurrect('never-seen')
+    expect(bot.sent).toHaveLength(0)
+  })
+
   it('#2: a 429 on the finish edit stages pendingFinish; the heartbeat re-drives it after cooldown', async () => {
     const bot = makeFakeBot()
     let clock = 10_000

package/telegram-plugin/tests/worker-visibility-prose-silent-harness.test.ts

@@ -158,6 +158,7 @@ function makeHarness() {
     stallThresholdMs: 60_000, // tight active-loop threshold
     silentSynthesisStallThresholdMs: 300_000, // widened window (also long-runner window)
     silentStallTerminalMs: 300_000, // post-stall terminal-synthesis window (unchanged)
+    inflightTerminalCapMs: 900_000, // died-mid-tool cap (15 min, compressed from the 45-min default)
     rescanMs: 500,
     now: () => currentTime,
     setInterval: sharedSetInterval,
@@ -278,10 +279,23 @@ describe('prose-silent background worker — end-to-end visibility harness (PR 2
     expect(h.stallCalls[0].agentId).toBe(h.agentId)
     expect(h.stallTerminalCalls).toHaveLength(0)
 
-    // (d) TERMINAL GATE RELEASE: 300s past the stall, the silent-stall terminal
-    // synthesis fires — onStallTerminal + onFinish — and the feed finalizes.
-    // This is the untouched, load-bearing completion path.
-    h.advance(310_000)
+    // (d) IN-FLIGHT DEFERRAL: 300s past the stall the OLD contract
+    // (#2777/#2782) synthesised terminal here. But this worker's transcript
+    // ends in a Bash tool_use with NO tool_result — it may still be inside
+    // the tool call (incident 2026-07-10: exactly this shape finalised a
+    // LIVE worker's card mid-Bash). Synthesis is now deferred while the
+    // tool call is in flight...
+    h.advance(310_000) // total idle ~672s — past silentStallTerminalMs, under the 900s cap
+    await h.flush()
+    expect(h.stallTerminalCalls).toHaveLength(0)
+    expect(h.finishCalls).toHaveLength(0)
+
+    // (e) TERMINAL GATE RELEASE AT THE CAP: ...but not forever. A worker
+    // that died mid-tool (JSONL frozen, tool_result never coming) must not
+    // wedge — past inflightTerminalCapMs of total idle the synthesis
+    // proceeds and the completion gate releases. The load-bearing release
+    // from #2777/#2782 survives, bounded instead of at the raw synth window.
+    h.advance(300_000) // total idle ~972s ≥ 900s cap
     await h.flush()
     expect(h.stallTerminalCalls).toHaveLength(1)
     expect(h.finishCalls).toHaveLength(1)

package/telegram-plugin/welcome-text.ts

@@ -279,9 +279,9 @@ export function statusUnpairedText(): string {
  */
 export const switchroomHelpCommandNames = [
   // Session & approvals
-  "new", "compact", "clear", "approve", "deny", "pending", "interrupt",
+  "new", "compact", "clear", "approve", "deny", "pending", "interrupt", "stop",
   // Agents
-  "agents", "agentstart", "stop", "restart", "logs", "memory",
+  "agents", "agentstart", "agentstop", "restart", "logs", "memory",
   // Auth & config — consolidated onto the `/auth` dashboard.
   "auth", "model",
   "topics", "update", "version", "whoami",
@@ -380,11 +380,12 @@ export function switchroomHelpText(agentName: string): string {
     `\`/deny [id]\` — deny pending tool permission`,
     `\`/pending\` — list pending permission prompts`,
     `\`/interrupt [name]\` — interrupt an agent turn`,
+    `\`/stop\` — cancel my in-flight turn (bare "stop" works too)`,
     ``,
     `**Agents**`,
     `\`/agents\` — list all agents`,
     `\`/agentstart [name]\` — start an agent`,
-    `\`/stop [name]\` — stop an agent`,
+    `\`/agentstop [name]\` — stop an agent's container`,
     `\`/logs [name] [lines]\` — show agent logs`,
     `\`/memory <query>\` — search agent memory`,
     ``,

package/telegram-plugin/worker-activity-feed.ts

@@ -342,6 +342,16 @@ export interface WorkerActivityFeed {
   finish(agentId: string, view: WorkerActivityView): Promise<void>
   /** Forget a worker's state without editing (e.g. error path). */
   drop(agentId: string): void
+  /**
+   * Issue #3023 (card resurrection). Undo a finalization: clear the durable
+   * `finalized` gate (and any lingering per-handle `finished` latch) so a
+   * worker whose card was FALSELY finalized can be painted/edited again. The
+   * watcher calls this (via the gateway's `onResurrect` wiring) when a
+   * falsely-finalized worker's JSONL resumes growing. A fresh `running` cue
+   * after this repaints a live card — the operator invariant that active work
+   * stays visible. Idempotent; a no-op if the worker was never finalized.
+   */
+  resurrect(agentId: string): void
   /** Clear the heartbeat interval (gateway shutdown). Idempotent. */
   stop(): void
   /** Manually fire one heartbeat tick (test hook). */
@@ -777,6 +787,23 @@ export function createWorkerActivityFeed(opts: WorkerActivityFeedOpts): WorkerAc
       markFinalized(agentId)
       handles.delete(agentId)
     },
+    resurrect(agentId) {
+      // Issue #3023: the worker's card was falsely finalized and its JSONL has
+      // resumed. Re-open the paint path: drop the durable finalized gate so a
+      // fresh `running` cue creates a new handle and first-paints a live card
+      // again, and un-latch any surviving handle (finish deleted it in the
+      // common case, but a staged pendingFinish could keep it alive). The next
+      // `update` tick from the watcher's replayed progress does the repaint.
+      const wasFinalized = finalized.delete(agentId)
+      const h = handles.get(agentId)
+      if (h != null) {
+        h.finished = false
+        h.pendingFinish = null
+      }
+      if (wasFinalized || h != null) {
+        log(`worker-feed: resurrect agent=${agentId} — cleared finalized gate; card will repaint on next running cue`)
+      }
+    },
     heartbeatTick,
     stop() {
       if (heartbeatTimer != null) {