switchroom 0.18.9 → 0.18.10

package/telegram-plugin/dist/server.js

@@ -24286,6 +24286,25 @@ function createOutstandingPermissionLedger() {
   };
 }
 
+// bridge/crash-breadcrumb.ts
+import { appendFileSync as appendFileSync3, statSync as statSync6, renameSync as renameSync4 } from "node:fs";
+function appendCrashBreadcrumb(logPath, kind, err, now = new Date) {
+  try {
+    try {
+      if (statSync6(logPath).size > MAX_LOG_BYTES)
+        renameSync4(logPath, `${logPath}.1`);
+    } catch {}
+    const detail = err instanceof Error ? err.stack ?? err.message : String(err);
+    const folded = detail.replace(/\s*\n\s*/g, " | ").slice(0, 4000);
+    appendFileSync3(logPath, `${now.toISOString()} ${kind} pid=${process.pid} ${folded}
+`);
+  } catch {}
+}
+var MAX_LOG_BYTES;
+var init_crash_breadcrumb = __esm(() => {
+  MAX_LOG_BYTES = 1024 * 1024;
+});
+
 // bridge/bridge.ts
 var exports_bridge = {};
 import { dirname as dirname3, join as join5 } from "path";
@@ -24394,7 +24413,7 @@ async function main() {
   }
   await mcp.connect(new StdioServerTransport);
 }
-var STATE_DIR, SOCKET_PATH, TOPIC_ID, AGENT_NAME, mcp, TOOL_SCHEMAS, EFFECTIVE_TOOL_SCHEMAS, sessionAllowRules, outstandingPermissions, permissionRearmEnabled, ipc = null, sessionTailEnabled, sessionTailHandle = null, ptyTailEnabled, ptyTailHandle = null;
+var STATE_DIR, SOCKET_PATH, TOPIC_ID, AGENT_NAME, mcp, TOOL_SCHEMAS, EFFECTIVE_TOOL_SCHEMAS, sessionAllowRules, outstandingPermissions, permissionRearmEnabled, ipc = null, sessionTailEnabled, sessionTailHandle = null, ptyTailEnabled, ptyTailHandle = null, CRASH_LOG_PATH;
 var init_bridge = __esm(async () => {
   init_server2();
   init_stdio2();
@@ -24406,6 +24425,7 @@ var init_bridge = __esm(async () => {
   init_ipc_client();
   init_tool_filter();
   init_permission_rule();
+  init_crash_breadcrumb();
   installPluginLogger2();
   STATE_DIR = process.env.TELEGRAM_STATE_DIR ?? join5(homedir4(), ".claude", "channels", "telegram");
   SOCKET_PATH = process.env.SWITCHROOM_GATEWAY_SOCKET ?? join5(STATE_DIR, "gateway.sock");
@@ -24454,7 +24474,7 @@ var init_bridge = __esm(async () => {
           quote: { type: "boolean", description: "Opt out of the default quote-reply behavior. Default: true. Pass false to send a bare message with no quote reference. Ignored when reply_to is explicitly set." },
           message_thread_id: { type: "string", description: "Forum topic thread ID. Auto-applied from the last inbound message in the same chat if not specified." },
           origin_turn_id: { type: "string", description: "In a forum supergroup, pass back the origin_turn_id attribute from the <channel> message you are answering. It pins the reply to that message's topic even if another topic's turn started meanwhile. Omit in DMs / single-topic chats." },
-          files: { type: "array", items: { type: "string" }, description: "Absolute file paths to attach. Images send as photos; other types as documents. Max 50MB each." },
+          files: { type: "array", items: { type: "string" }, description: "Absolute file paths to attach. Images send as photos; other types as documents. Max 50MB each. Telegram rejects photos with extreme dimensions (aspect ratio over ~10:1, width+height over 10000px, or over 10MB) \u2014 very tall images like full-page screenshots are auto-rerouted as documents; crop or split them first if the user should see them inline as photos." },
           format: { type: "string", enum: ["html", "markdownv2", "text"], description: "Rendering mode. 'html' (default) converts markdown to Telegram HTML." },
           disable_web_page_preview: { type: "boolean", description: "Disable link preview thumbnails. Default: true." },
           protect_content: { type: "boolean", description: "When true, Telegram prevents the message from being forwarded or saved." },
@@ -25019,9 +25039,16 @@ var init_bridge = __esm(async () => {
     cleanup();
     setTimeout(() => process.exit(0), 500);
   });
+  CRASH_LOG_PATH = join5(STATE_DIR, "bridge-crash.log");
   process.on("unhandledRejection", (err) => {
     process.stderr.write(`telegram bridge: unhandled rejection: ${err}
 `);
+    appendCrashBreadcrumb(CRASH_LOG_PATH, "unhandledRejection", err);
+  });
+  process.on("uncaughtException", (err) => {
+    process.stderr.write(`telegram bridge: uncaught exception (continuing): ${err?.stack ?? err}
+`);
+    appendCrashBreadcrumb(CRASH_LOG_PATH, "uncaughtException", err);
   });
   await main().catch((err) => {
     process.stderr.write(`telegram bridge: fatal: ${err}

package/telegram-plugin/fallback-card-collapse.ts

@@ -0,0 +1,131 @@
+/**
+ * Reactive-path message collapse (#3031 PR 3).
+ *
+ * Pre-fix, a mid-turn 429 emitted up to three separate operator messages:
+ *   1. the ⚠️ model-unavailable card (sent BEFORE the fallback outcome is
+ *      known — deliberate, see the promise-honesty note below),
+ *   2. the fleet-fallback success announcement ("Switched to <account> …"),
+ *   3. the resume/boot notice.
+ *
+ * This module owns the SAFE part of collapsing that flow: when the swap
+ * SUCCEEDS, the announcement is folded into an EDIT of the just-sent
+ * model-unavailable card (one evolving card) instead of a second message.
+ *
+ * CRITICAL constraint (2026-06-06→07 incident): the card is deliberately
+ * sent before the outcome is known, and a FAILURE notice must arrive as its
+ * own message on EVERY error path — the card promised an announcement, and
+ * an edit that never happens (or a swallowed failure) breaks that promise.
+ * Therefore:
+ *   - `decideAnnouncementDelivery` returns 'edit' ONLY for a successful
+ *     'switched' outcome with a fresh, fallback-promising card on record.
+ *     Every other outcome kind ('all-blocked', 'no-old-active',
+ *     'no-eligible-target', errors) is 'send' — a separate message, exactly
+ *     the pre-fix behaviour.
+ *   - The gateway falls back to a plain send when the edit itself throws.
+ *
+ * Pure module (injected clock, no Telegram/bot imports) so the decision
+ * logic is unit-testable at the seam.
+ */
+
+/** One recorded model-unavailable card, per chat. */
+export interface ModelUnavailableCardRecord {
+  /** Telegram message id of the sent card (null until the send resolves —
+   *  callers should record only after the send succeeds). */
+  messageId: number;
+  /** The rendered card text as sent, so the edit can append to it. */
+  text: string;
+  /** Unix ms the card send resolved. */
+  atMs: number;
+  /** Did the card promise an in-flight auto-failover? Only such cards may
+   *  absorb the announcement — a manual-hint card never promised one. */
+  promisedFallback: boolean;
+}
+
+/**
+ * Freshness ceiling for folding into a card. The fallback dispatcher runs
+ * seconds after the card in the normal case; a card older than this belongs
+ * to a previous incident and must not absorb an unrelated announcement.
+ *
+ * Known accepted race (#3035 review, finding 4): the record lands only
+ * AFTER the card send resolves, and stays editable for this whole window —
+ * so a LATER 'switched' outcome (a second dispatch inside the window) can
+ * edit a card whose incident was already answered. Bounded by this 5-min
+ * ceiling plus the one-shot `take` semantics (a card absorbs at most one
+ * announcement); worst case is one announcement folded into a slightly
+ * older card instead of arriving as a separate message — never a lost
+ * announcement.
+ */
+export const CARD_COLLAPSE_MAX_AGE_MS = 5 * 60_000;
+
+export interface ModelUnavailableCardRegistry {
+  /** Record the card most recently sent to `chatId` (replaces any prior). */
+  record(chatId: string, rec: ModelUnavailableCardRecord): void;
+  /**
+   * One-shot take: return the fresh, fallback-promising card for `chatId`
+   * and remove it (a card absorbs at most one announcement). Returns null —
+   * and clears the entry — when the record is stale or never promised a
+   * fallback.
+   */
+  take(chatId: string, now: number): ModelUnavailableCardRecord | null;
+  /** Number of chats with a recorded card (test/introspection helper). */
+  size(): number;
+}
+
+export function createModelUnavailableCardRegistry(
+  maxAgeMs: number = CARD_COLLAPSE_MAX_AGE_MS,
+): ModelUnavailableCardRegistry {
+  const cards = new Map<string, ModelUnavailableCardRecord>();
+  return {
+    record(chatId, rec) {
+      cards.set(chatId, rec);
+    },
+    take(chatId, now) {
+      const rec = cards.get(chatId);
+      if (!rec) return null;
+      cards.delete(chatId);
+      if (!rec.promisedFallback) return null;
+      if (now - rec.atMs > maxAgeMs) return null;
+      return rec;
+    },
+    size() {
+      return cards.size;
+    },
+  };
+}
+
+/**
+ * The outcome kinds `runFleetAutoFallback` can produce, plus 'error' for
+ * the dispatcher-threw path (broker unreachable, listState/markExhausted
+ * throw). Kept as a plain string union so this module stays import-free.
+ */
+export type FallbackDeliveryOutcomeKind =
+  | 'switched'
+  | 'all-blocked'
+  | 'no-old-active'
+  | 'no-eligible-target'
+  | 'error';
+
+/**
+ * Should the announcement for `outcomeKind` be delivered by EDITING the
+ * recorded model-unavailable card, or by SENDING a separate message?
+ *
+ * 'edit' is returned ONLY when the swap succeeded AND a fresh
+ * fallback-promising card exists for the chat. Every failure / no-op
+ * outcome is 'send' — the promise-honesty contract: a failure notice must
+ * arrive as its own message on every error path.
+ */
+export function decideAnnouncementDelivery(
+  outcomeKind: FallbackDeliveryOutcomeKind,
+  card: ModelUnavailableCardRecord | null,
+): 'edit' | 'send' {
+  if (outcomeKind !== 'switched') return 'send';
+  return card !== null ? 'edit' : 'send';
+}
+
+/**
+ * The single evolving card: original card text plus the announcement,
+ * separated by a rule so the "before/after" reads as one incident timeline.
+ */
+export function foldAnnouncementIntoCard(cardText: string, announcement: string): string {
+  return `${cardText}\n\n${announcement}`;
+}