switchroom 0.18.8 → 0.18.9

package/telegram-plugin/tests/pending-state-stores.test.ts

@@ -0,0 +1,235 @@
+/**
+ * Contract + race/ordering pins for the long-tail pending-state stores
+ * (gateway/pending-state-stores.ts), extracted in #2996 Phase 3 step 2.
+ *
+ * Written BEFORE the long-tail Maps moved behind the store module. They lock:
+ *
+ *   1. Each family's EXACT `isExpired` comparison direction survives verbatim —
+ *      TTL directions differ across families (`now - staged_at > TTL`,
+ *      `now - startedAt > TTL`, `now - createdAt > TTL`, `now - armed_at > TTL`,
+ *      and the absolute `now > expiresAt`), and a store must delete exactly the
+ *      entries the old open-coded loop deleted, not one tick early or late.
+ *   2. `sweep` is delete-during-iteration safe (JS Map iterators tolerate
+ *      deleting the current key — the raw reaper loops relied on this).
+ *   3. The gateway-visible EAGER-SWEEP-AT-ADD pattern (the sweep called right
+ *      after a `.set` at a staging site, e.g. `sweepSecretRequests()` after the
+ *      `pendingSecretRequests.set` in executeRequestSecret) is single-shot: an
+ *      add followed by an eager sweep expires only entries already past TTL and
+ *      leaves the just-added fresh entry intact.
+ *   4. Map-surface parity for every operation the call sites use, including the
+ *      LRU eviction pattern `agentButtonMeta` uses (`keys().next().value`) and
+ *      the live `size` getter.
+ */
+
+import { describe, it, expect } from 'vitest'
+import {
+  createSweepableStore,
+  createPlainStore,
+} from '../gateway/pending-state-stores.js'
+
+// TTL constants mirror the gateway family values so the direction pins are
+// meaningful (values themselves are not the contract — the direction is).
+const VAULT_INPUT_TTL_MS = 5 * 60 * 1000
+const VAULT_PASSPHRASE_TTL_MS = 30 * 60 * 1000
+const DEFERRED_SECRET_TTL_MS = 5 * 60 * 1000
+const ARMED_SECRET_CAPTURE_TTL_MS = 10 * 60_000
+const ALWAYS_ALLOW_CORRELATION_TTL_MS = 30_000
+const MENTAL_MODEL_CORRELATION_TTL_MS = 720_000
+const REAUTH_INTERCEPT_TTL_MS = 10 * 60_000
+
+describe('pending-state-stores: per-family isExpired direction (byte-identical)', () => {
+  it('pendingVaultOps — now - startedAt > VAULT_INPUT_TTL_MS', () => {
+    const store = createSweepableStore<{ startedAt: number }>(
+      (v, now) => now - v.startedAt > VAULT_INPUT_TTL_MS,
+    )
+    const now = 10_000_000
+    store.set('fresh', { startedAt: now - VAULT_INPUT_TTL_MS }) // exactly TTL old: NOT expired (> is strict)
+    store.set('stale', { startedAt: now - VAULT_INPUT_TTL_MS - 1 })
+    store.sweep(now)
+    expect(store.has('fresh')).toBe(true)
+    expect(store.has('stale')).toBe(false)
+  })
+
+  it('vaultPassphraseCache — absolute now > expiresAt', () => {
+    const store = createSweepableStore<{ expiresAt: number }>(
+      (v, now) => now > v.expiresAt,
+    )
+    const now = 10_000_000
+    store.set('atExpiry', { expiresAt: now }) // now > now is false → NOT expired
+    store.set('past', { expiresAt: now - 1 })
+    store.sweep(now)
+    expect(store.has('atExpiry')).toBe(true)
+    expect(store.has('past')).toBe(false)
+    void VAULT_PASSPHRASE_TTL_MS
+  })
+
+  it('deferredSecrets — now - staged_at > DEFERRED_SECRET_TTL_MS', () => {
+    const store = createSweepableStore<{ staged_at: number }>(
+      (v, now) => now - v.staged_at > DEFERRED_SECRET_TTL_MS,
+    )
+    const now = 10_000_000
+    store.set('fresh', { staged_at: now - DEFERRED_SECRET_TTL_MS })
+    store.set('stale', { staged_at: now - DEFERRED_SECRET_TTL_MS - 1 })
+    store.sweep(now)
+    expect(store.has('fresh')).toBe(true)
+    expect(store.has('stale')).toBe(false)
+  })
+
+  it('armedSecretCaptures — now - armed_at > ARMED_SECRET_CAPTURE_TTL_MS', () => {
+    const store = createSweepableStore<{ armed_at: number }>(
+      (v, now) => now - v.armed_at > ARMED_SECRET_CAPTURE_TTL_MS,
+    )
+    const now = 10_000_000
+    store.set('fresh', { armed_at: now - ARMED_SECRET_CAPTURE_TTL_MS })
+    store.set('stale', { armed_at: now - ARMED_SECRET_CAPTURE_TTL_MS - 1 })
+    store.sweep(now)
+    expect(store.has('fresh')).toBe(true)
+    expect(store.has('stale')).toBe(false)
+  })
+
+  it('pendingAlwaysAllowCorrelations — 30s now - createdAt > TTL', () => {
+    const store = createSweepableStore<{ createdAt: number }>(
+      (v, now) => now - v.createdAt > ALWAYS_ALLOW_CORRELATION_TTL_MS,
+    )
+    const now = 10_000_000
+    store.set('fresh', { createdAt: now - ALWAYS_ALLOW_CORRELATION_TTL_MS })
+    store.set('stale', { createdAt: now - ALWAYS_ALLOW_CORRELATION_TTL_MS - 1 })
+    store.sweep(now)
+    expect(store.has('fresh')).toBe(true)
+    expect(store.has('stale')).toBe(false)
+  })
+
+  it('pendingMentalModelCorrelations — 720s now - createdAt > TTL (outlives the 30s window)', () => {
+    const store = createSweepableStore<{ createdAt: number }>(
+      (v, now) => now - v.createdAt > MENTAL_MODEL_CORRELATION_TTL_MS,
+    )
+    const now = 10_000_000
+    // A slow-but-valid tap 10 min in must NOT be swept (the whole point of the
+    // dedicated 720s TTL vs the 30s always-allow window).
+    store.set('slowTap', { createdAt: now - 10 * 60_000 })
+    store.set('stale', { createdAt: now - MENTAL_MODEL_CORRELATION_TTL_MS - 1 })
+    store.sweep(now)
+    expect(store.has('slowTap')).toBe(true)
+    expect(store.has('stale')).toBe(false)
+  })
+
+  it('pendingReauthFlows — now - startedAt > REAUTH_INTERCEPT_TTL_MS', () => {
+    const store = createSweepableStore<{ startedAt: number }>(
+      (v, now) => now - v.startedAt > REAUTH_INTERCEPT_TTL_MS,
+    )
+    const now = 10_000_000
+    store.set('fresh', { startedAt: now - REAUTH_INTERCEPT_TTL_MS })
+    store.set('stale', { startedAt: now - REAUTH_INTERCEPT_TTL_MS - 1 })
+    store.sweep(now)
+    expect(store.has('fresh')).toBe(true)
+    expect(store.has('stale')).toBe(false)
+  })
+})
+
+describe('pending-state-stores: sweep safety', () => {
+  it('deletes every past-TTL entry across a multi-entry map (delete-during-iteration safe)', () => {
+    const store = createSweepableStore<{ staged_at: number }>(
+      (v, now) => now - v.staged_at > 1000,
+    )
+    for (let i = 0; i < 10; i++) store.set(`e${i}`, { staged_at: i % 2 === 0 ? 0 : 9_999_999 })
+    store.sweep(1_000_000) // even entries stale, odd entries fresh
+    for (let i = 0; i < 10; i++) {
+      expect(store.has(`e${i}`)).toBe(i % 2 === 1)
+    }
+  })
+
+  it('is single-shot across two sweep ticks', () => {
+    const store = createSweepableStore<{ staged_at: number }>(
+      (v, now) => now - v.staged_at > 1000,
+    )
+    store.set('one', { staged_at: 0 })
+    store.sweep(1_000_000)
+    expect(store.size).toBe(0)
+    expect(() => store.sweep(1_000_000)).not.toThrow() // second tick — nothing left
+    expect(store.size).toBe(0)
+  })
+})
+
+describe('pending-state-stores: eager-sweep-at-add pattern (gateway-visible)', () => {
+  // Mirrors executeRequestSecret: dedupe-drop prior stage for the same target,
+  // .set the new one, then eagerly sweep. The just-added fresh entry survives;
+  // a stale sibling is reaped in the same eager pass.
+  it('add + eager sweep expires only stale siblings, keeps the fresh add', () => {
+    const TTL = 30 * 60_000
+    const store = createSweepableStore<{ chat_id: string; key: string; staged_at: number }>(
+      (v, now) => now - v.staged_at > TTL,
+    )
+    const now = 100_000_000
+    store.set('old', { chat_id: 'c', key: 'k1', staged_at: now - TTL - 1 }) // stale
+    // Dedupe pass (same target) would delete a live dup; here targets differ.
+    const fresh = { chat_id: 'c', key: 'k2', staged_at: now }
+    store.set('new', fresh)
+    store.sweep(now) // eager sweep at the add site
+    expect(store.has('new')).toBe(true) // fresh add never self-expires
+    expect(store.get('new')).toBe(fresh)
+    expect(store.has('old')).toBe(false) // stale sibling reaped in the eager pass
+  })
+
+  it('dedupe-then-add-then-sweep leaves exactly the new entry', () => {
+    const TTL = 30 * 60_000
+    const store = createSweepableStore<{ chat_id: string; key: string; staged_at: number }>(
+      (v, now) => now - v.staged_at > TTL,
+    )
+    const now = 100_000_000
+    store.set('dup', { chat_id: 'c', key: 'k', staged_at: now - 1000 })
+    // dedupe: drop prior stage for the same (chat, key)
+    for (const [sid, p] of store) {
+      if (p.chat_id === 'c' && p.key === 'k') store.delete(sid)
+    }
+    store.set('fresh', { chat_id: 'c', key: 'k', staged_at: now })
+    store.sweep(now)
+    expect([...store.keys()]).toEqual(['fresh'])
+  })
+})
+
+describe('pending-state-stores: plain store (no sweep)', () => {
+  it('has no sweep method and preserves Map surface', () => {
+    const store = createPlainStore<{ n: number }>()
+    expect((store as { sweep?: unknown }).sweep).toBeUndefined()
+    store.set('a', { n: 1 })
+    store.set('b', { n: 2 })
+    expect(store.size).toBe(2)
+    expect(store.get('a')?.n).toBe(1)
+    expect(store.has('b')).toBe(true)
+    expect(store.delete('a')).toBe(true)
+    expect(store.has('a')).toBe(false)
+  })
+
+  it('agentButtonMeta LRU eviction — keys().next().value is the oldest insertion', () => {
+    const AGENT_BUTTON_META_MAX = 3
+    const store = createPlainStore<Map<string, { ack: string }>>()
+    const remember = (key: string) => {
+      store.set(key, new Map([['cb', { ack: key }]]))
+      while (store.size > AGENT_BUTTON_META_MAX) {
+        const oldest = store.keys().next().value
+        if (oldest === undefined) break
+        store.delete(oldest)
+      }
+    }
+    remember('m1')
+    remember('m2')
+    remember('m3')
+    remember('m4') // evicts m1 (oldest insertion)
+    expect(store.has('m1')).toBe(false)
+    expect([...store.keys()]).toEqual(['m2', 'm3', 'm4'])
+    expect(store.get('m4')?.get('cb')?.ack).toBe('m4')
+  })
+
+  it('pendingAskUser surface — values()/entries()/get/delete used by call sites', () => {
+    const store = createPlainStore<{ chatId: string; messageId: number | null }>()
+    store.set('ask1', { chatId: 'c1', messageId: 10 })
+    store.set('ask2', { chatId: 'c2', messageId: null })
+    expect([...store.values()].map((v) => v.chatId).sort()).toEqual(['c1', 'c2'])
+    const collected: string[] = []
+    for (const [askId] of store.entries()) collected.push(askId)
+    expect(collected.sort()).toEqual(['ask1', 'ask2'])
+    expect(store.get('ask1')?.messageId).toBe(10)
+    store.delete('ask1')
+    expect(store.size).toBe(1)
+  })
+})

package/telegram-plugin/tests/turn-flush-safety.test.ts

@@ -261,10 +261,24 @@ describe('#2798 turn-flush punctuation/bold parity with reply', () => {
   )
 
   it('reply path: normalizes AFTER redact and BEFORE the voice scrub', () => {
-    const start = gatewaySrc.indexOf('async function executeReply(')
-    const redactIdx = gatewaySrc.indexOf(`redactOutboundText(text, 'reply')`, start)
-    const normIdx = gatewaySrc.indexOf('stripExcessBold(normalizePunctuation(text))', start)
-    const scrubIdx = gatewaySrc.indexOf('scrubVoice(text)', start)
+    // #2996: the reply-path entry pipeline moved into outbound-send-path.ts
+    // (`normalizeOutboundBody`). The reply path delegates to it via
+    // `normalizeOutboundBody(rawText, 'reply', redactOutboundText)`; the
+    // redact→normalize→scrub ordering is now pinned in the module source.
+    const replyDelegates = gatewaySrc.indexOf(
+      `normalizeOutboundBody(rawText, 'reply', redactOutboundText)`,
+      gatewaySrc.indexOf('async function executeReply('),
+    )
+    expect(replyDelegates).toBeGreaterThan(0)
+
+    const moduleSrc = readFileSync(
+      new URL('../gateway/outbound-send-path.ts', import.meta.url),
+      'utf8',
+    )
+    const start = moduleSrc.indexOf('export function normalizeOutboundBody(')
+    const redactIdx = moduleSrc.indexOf('redact(text, site)', start)
+    const normIdx = moduleSrc.indexOf('stripExcessBold(normalizePunctuation(text))', start)
+    const scrubIdx = moduleSrc.indexOf('scrubVoice(text)', start)
     expect(start).toBeGreaterThan(0)
     expect(redactIdx).toBeGreaterThan(start)
     expect(normIdx).toBeGreaterThan(redactIdx) // normalize AFTER the reply redact

package/telegram-plugin/tests/vault-approval-posture.test.ts

@@ -41,10 +41,14 @@ import { readFileSync } from 'node:fs'
 import { resolve } from 'node:path'
 import { resolveVaultApprovalPosture } from '../vault-approval-posture.js'
 
-const gatewaySrc = readFileSync(
-  resolve(__dirname, '..', 'gateway', 'gateway.ts'),
-  'utf-8',
-)
+// #2996 Phase 5: the callback-query handler families moved verbatim to
+// gateway/callback-query-handlers.ts; these pins read the gateway source
+// COMBINED with that module so the wiring assertions keep covering the
+// same runtime source text.
+const gatewaySrc =
+  readFileSync(resolve(__dirname, '..', 'gateway', 'gateway.ts'), 'utf-8') +
+  '\n' +
+  readFileSync(resolve(__dirname, '..', 'gateway', 'callback-query-handlers.ts'), 'utf-8')
 
 function sliceAccessApproveBlock(): string {
   const fn =
@@ -73,7 +77,10 @@ describe('vault grant approval posture — module-level wiring', () => {
 describe('handleVaultRequestAccessCallback — posture branch', () => {
   it('mints via posture attestation (NOT in-memory passphrase) when posture is telegram-id', () => {
     const approveBlock = sliceAccessApproveBlock()
-    expect(approveBlock).toMatch(/VAULT_APPROVAL_AUTH_MODE === ['"]telegram-id['"]/)
+    // #2996 Phase 5: inside the extracted handler module the mutable gateway
+    // `let` is read via the injected getter (gateway wires it as
+    // `getVaultApprovalAuthMode: () => VAULT_APPROVAL_AUTH_MODE`).
+    expect(approveBlock).toMatch(/getVaultApprovalAuthMode\(\) === ['"]telegram-id['"]/)
     // Pinned: the call shape MUST be `{ kind: 'posture' }`. If the
     // gateway ever reverts to passing a real passphrase here, the
     // bypass surface returns.
@@ -138,7 +145,8 @@ describe('handleVaultRequestSaveCallback — posture-attested broker put (#1115
     // calls `defaultVaultWritePosture` (posture-attested broker put,
     // no passphrase). Under passphrase mode it keeps the legacy
     // cached-passphrase + shell-out path.
-    expect(fnBlock).toMatch(/VAULT_APPROVAL_AUTH_MODE === 'telegram-id'/)
+    // #2996 Phase 5: getter read of the gateway's mutable posture `let`.
+    expect(fnBlock).toMatch(/getVaultApprovalAuthMode\(\) === 'telegram-id'/)
     expect(fnBlock).toMatch(/defaultVaultWritePosture\(/)
     // Passphrase-mode branch still present.
     expect(fnBlock).toMatch(/vaultPassphraseCache\.get\(pending\.chat_id\)/)
@@ -203,7 +211,7 @@ describe('allowlist is the first gate in every vault callback handler', () => {
         'mintGrantViaBroker',
         'performVaultAccessApproval',
         'pendingVaultOps.set',
-        "VAULT_APPROVAL_AUTH_MODE === 'telegram-id'",
+        "getVaultApprovalAuthMode() === 'telegram-id'",
         'attest_via_posture',
       ]) {
         expect(

package/telegram-plugin/tests/vault-grant-auto-resume.test.ts

@@ -23,10 +23,14 @@ import { describe, it, expect } from "vitest";
 import { readFileSync } from "node:fs";
 import { resolve } from "node:path";
 
-const gatewaySrc = readFileSync(
-  resolve(__dirname, "..", "gateway", "gateway.ts"),
-  "utf-8",
-);
+// #2996 Phase 5: the callback-query handler families moved verbatim to
+// gateway/callback-query-handlers.ts; these pins read the gateway source
+// COMBINED with that module so the wiring assertions keep covering the
+// same runtime source text.
+const gatewaySrc =
+  readFileSync(resolve(__dirname, "..", "gateway", "gateway.ts"), "utf-8") +
+  "\n" +
+  readFileSync(resolve(__dirname, "..", "gateway", "callback-query-handlers.ts"), "utf-8");
 
 function extractPerformBlock(): string {
   const start = gatewaySrc.indexOf("async function performVaultAccessApproval");

package/telegram-plugin/tests/vault-grant-union.test.ts

@@ -22,10 +22,14 @@ import { describe, it, expect } from "vitest";
 import { readFileSync } from "node:fs";
 import { resolve } from "node:path";
 
-const gatewaySrc = readFileSync(
-  resolve(__dirname, "..", "gateway", "gateway.ts"),
-  "utf-8",
-);
+// #2996 Phase 5: the callback-query handler families moved verbatim to
+// gateway/callback-query-handlers.ts; these pins read the gateway source
+// COMBINED with that module so the wiring assertions keep covering the
+// same runtime source text.
+const gatewaySrc =
+  readFileSync(resolve(__dirname, "..", "gateway", "gateway.ts"), "utf-8") +
+  "\n" +
+  readFileSync(resolve(__dirname, "..", "gateway", "callback-query-handlers.ts"), "utf-8");
 
 function extractPerformBlock(): string {
   const start = gatewaySrc.indexOf("async function performVaultAccessApproval");

package/telegram-plugin/tests/vault-grant-wizard.test.ts

@@ -40,7 +40,14 @@ function readSrc(rel: string): string {
 // `telegram-plugin/docs/gateway-server-split.md` for the F4 cleanup notes.
 
 describe('/vault grant inline-keyboard wizard — gateway (#227, #262, #265)', () => {
-  const gatewaySrc = readSrc('telegram-plugin/gateway/gateway.ts')
+  // #2996 Phase 5: the callback-query handler families moved verbatim to
+  // gateway/callback-query-handlers.ts; these pins read the gateway source
+  // COMBINED with that module so the wiring assertions keep covering the
+  // same runtime source text.
+  const gatewaySrc =
+    readSrc('telegram-plugin/gateway/gateway.ts') +
+    '\n' +
+    readSrc('telegram-plugin/gateway/callback-query-handlers.ts')
 
   it('gateway.ts: dispatches /vault grant to the wizard entry', () => {
     expect(gatewaySrc).toMatch(/\/vault grant/i)

package/telegram-plugin/tests/vault-grants-revoke.test.ts

@@ -33,7 +33,14 @@ import { join, dirname } from 'node:path'
 const __dir = dirname(fileURLToPath(import.meta.url))
 const pluginDir = join(__dir, '..')
 
-const gatewaySrc = readFileSync(join(pluginDir, 'gateway', 'gateway.ts'), 'utf8')
+// #2996 Phase 5: the callback-query handler families moved verbatim to
+// gateway/callback-query-handlers.ts; these pins read the gateway source
+// COMBINED with that module so the wiring assertions keep covering the
+// same runtime source text.
+const gatewaySrc =
+  readFileSync(join(pluginDir, 'gateway', 'gateway.ts'), 'utf8') +
+  '\n' +
+  readFileSync(join(pluginDir, 'gateway', 'callback-query-handlers.ts'), 'utf8')
 
 // ─── helpers ─────────────────────────────────────────────────────────────────
 

package/telegram-plugin/tests/vault-key-regex-allows-slash.test.ts

@@ -27,10 +27,14 @@ import { describe, it, expect } from "vitest";
 import { readFileSync } from "node:fs";
 import { resolve } from "node:path";
 
-const gatewaySrc = readFileSync(
-  resolve(__dirname, "..", "gateway", "gateway.ts"),
-  "utf-8",
-);
+// #2996 Phase 5: the callback-query handler families moved verbatim to
+// gateway/callback-query-handlers.ts; these pins read the gateway source
+// COMBINED with that module so the wiring assertions keep covering the
+// same runtime source text.
+const gatewaySrc =
+  readFileSync(resolve(__dirname, "..", "gateway", "gateway.ts"), "utf-8") +
+  "\n" +
+  readFileSync(resolve(__dirname, "..", "gateway", "callback-query-handlers.ts"), "utf-8");
 
 /** The exported regex literal — what the gateway actually validates against. */
 function extractVaultKeyRegex(): RegExp {

package/telegram-plugin/tests/vault-request-access-tool.test.ts

@@ -23,10 +23,14 @@ const bridgeSrc = readFileSync(
   resolve(__dirname, '..', 'bridge', 'bridge.ts'),
   'utf-8',
 )
-const gatewaySrc = readFileSync(
-  resolve(__dirname, '..', 'gateway', 'gateway.ts'),
-  'utf-8',
-)
+// #2996 Phase 5: the callback-query handler families moved verbatim to
+// gateway/callback-query-handlers.ts; these pins read the gateway source
+// COMBINED with that module so the wiring assertions keep covering the
+// same runtime source text.
+const gatewaySrc =
+  readFileSync(resolve(__dirname, '..', 'gateway', 'gateway.ts'), 'utf-8') +
+  '\n' +
+  readFileSync(resolve(__dirname, '..', 'gateway', 'callback-query-handlers.ts'), 'utf-8')
 
 describe('vault_request_access (#1012)', () => {
   it('bridge advertises the tool to MCP clients', () => {

package/telegram-plugin/tests/vault-request-access-unlock-resume.test.ts

@@ -22,10 +22,14 @@ import { describe, it, expect } from 'vitest'
 import { readFileSync } from 'node:fs'
 import { resolve } from 'node:path'
 
-const gatewaySrc = readFileSync(
-  resolve(__dirname, '..', 'gateway', 'gateway.ts'),
-  'utf-8',
-)
+// #2996 Phase 5: the callback-query handler families moved verbatim to
+// gateway/callback-query-handlers.ts; these pins read the gateway source
+// COMBINED with that module so the wiring assertions keep covering the
+// same runtime source text.
+const gatewaySrc =
+  readFileSync(resolve(__dirname, '..', 'gateway', 'gateway.ts'), 'utf-8') +
+  '\n' +
+  readFileSync(resolve(__dirname, '..', 'gateway', 'callback-query-handlers.ts'), 'utf-8')
 
 describe('vault_request_access — tap-to-unlock-and-approve UX', () => {
   it('declares the passphrase-for-access-approve PendingVaultOp variant', () => {