switchroom 0.19.18 → 0.19.22

package/telegram-plugin/tests/tool-activity-summary.test.ts

@@ -15,14 +15,26 @@ import {
   type SessionActivityHeader,
 } from "../tool-activity-summary.js";
 import { STATUS_ROLLING_LINES, STATUS_LINE_MAX } from "../status-no-truncate.js";
+import { COLLAPSE_SAFE_SEPARATOR } from "../card-format.js";
+
+/** The pinned-card collapse separator (#3666) every status-card line now
+ *  carries before its hard break. Aliased for readable goldens. */
+const NB = COLLAPSE_SAFE_SEPARATOR;
 
 describe("describeToolUse — friendly per-tool rendering (draft-mirror)", () => {
   it("Bash uses the model-authored description verbatim, never the command", () => {
     expect(
       describeToolUse("Bash", { command: "ls -la /tmp", description: "List workspace" }),
     ).toBe("List workspace");
-    // No description → safe generic, still never the raw command.
-    expect(describeToolUse("Bash", { command: "grep -r foo ." })).toBe("Running a command");
+    // No description → sanitised PROGRAM-ONLY derivation, never the raw
+    // command (its args routinely carry tokens and private paths). The old
+    // behavior was a constant "Running a command" for every Bash call, which
+    // froze the sub-agent step feed on one line for a whole job.
+    expect(describeToolUse("Bash", { command: "grep -r foo ." })).toBe("Running grep");
+    // Nothing safe to derive → the generic label is still the floor.
+    expect(describeToolUse("Bash", { command: "$(cat /run/secrets/token) --x" })).toBe(
+      "Running a command",
+    );
   });
 
   it("Read/Edit/Write render the file basename, not the full path", () => {
@@ -88,10 +100,10 @@ describe("appendActivityLine + renderActivityFeed — accumulating activity feed
       "**→ Reading gateway.ts**",
     );
     expect(appendActivityLine(lines, "mcp__hindsight__reflect", { query: "x" })).toBe(
-      "~~_✓ Reading gateway.ts_~~  \n**→ Searching memory**",
+      `~~_✓ Reading gateway.ts_~~${NB}  \n**→ Searching memory**`,
     );
     expect(appendActivityLine(lines, "Bash", { command: "ls", description: "List workspace" })).toBe(
-      "~~_✓ Reading gateway.ts_~~  \n~~_✓ Searching memory_~~  \n**→ List workspace**",
+      `~~_✓ Reading gateway.ts_~~${NB}  \n~~_✓ Searching memory_~~${NB}  \n**→ List workspace**`,
     );
   });
 
@@ -114,7 +126,7 @@ describe("appendActivityLine + renderActivityFeed — accumulating activity feed
     const lines = Array.from({ length: total }, (_, i) => `Action ${i + 1}`);
     const out = renderActivityFeed(lines)!;
     const hidden = total - STATUS_ROLLING_LINES;
-    expect(out.startsWith(`_✓ +${hidden} earlier…_  \n`)).toBe(true);
+    expect(out.startsWith(`_✓ +${hidden} earlier…_${NB}  \n`)).toBe(true);
     // Only the last STATUS_ROLLING_LINES actions are shown; older ones collapsed.
     const firstVisible = total - STATUS_ROLLING_LINES + 1;
     expect(out).toContain(`~~_✓ Action ${firstVisible}_~~`);
@@ -149,7 +161,7 @@ describe("appendActivityLine + renderActivityFeed — accumulating activity feed
     const lines = ["Reading a.ts", "Searching memory", "Running a command"];
     const out = renderActivityFeed(lines, true)!;
     expect(out).toBe(
-      "~~_✓ Reading a.ts_~~  \n~~_✓ Searching memory_~~  \n~~_✓ Running a command_~~",
+      `~~_✓ Reading a.ts_~~${NB}  \n~~_✓ Searching memory_~~${NB}  \n~~_✓ Running a command_~~`,
     );
     expect(out).not.toContain("→"); // no in-progress arrow anywhere
   });
@@ -188,7 +200,7 @@ describe("appendActivityLine + renderActivityFeed — accumulating activity feed
   describe("liveSuffix (heartbeat)", () => {
     it("appends the suffix to the newest in-progress line only", () => {
       expect(renderActivityFeed(["Reading a.ts", "Running a command"], false, " · 18s")).toBe(
-        "~~_✓ Reading a.ts_~~  \n**→ Running a command · 18s**",
+        `~~_✓ Reading a.ts_~~${NB}  \n**→ Running a command · 18s**`,
       );
     });
     it("single live line gets the suffix", () => {
@@ -200,7 +212,7 @@ describe("appendActivityLine + renderActivityFeed — accumulating activity feed
       const out = renderActivityFeed(["Reading a.ts", "Running a command"], true, " · 18s")!;
       expect(out).not.toContain("·");
       expect(out).not.toContain("→");
-      expect(out).toBe("~~_✓ Reading a.ts_~~  \n~~_✓ Running a command_~~");
+      expect(out).toBe(`~~_✓ Reading a.ts_~~${NB}  \n~~_✓ Running a command_~~`);
     });
     it("default empty suffix is byte-identical to no suffix", () => {
       expect(renderActivityFeed(["Reading a.ts"], false, "")).toBe(
@@ -215,7 +227,7 @@ describe("appendActivityLabel — precomputed label feed (tool_label path)", ()
     const lines: string[] = [];
     expect(appendActivityLabel(lines, "Searching memory")).toBe("**→ Searching memory**");
     expect(appendActivityLabel(lines, "List workspace")).toBe(
-      "~~_✓ Searching memory_~~  \n**→ List workspace**",
+      `~~_✓ Searching memory_~~${NB}  \n**→ List workspace**`,
     );
     // consecutive dup collapses
     appendActivityLabel(lines, "List workspace");
@@ -410,7 +422,7 @@ describe("renderActivityFeedWithNested — foreground sub-agent nesting (Model A
   it("stepCount footer appears on final=true with no children (delegates to flat render)", () => {
     const out = renderActivityFeedWithNested(["Reading a.ts"], [], true, "", 3)!;
     expect(out).toContain("_✓ 3 steps_");
-    expect(out).toBe("~~_✓ Reading a.ts_~~  \n_✓ 3 steps_");
+    expect(out).toBe(`~~_✓ Reading a.ts_~~${NB}  \n_✓ 3 steps_`);
   });
 
   // Liveness-driven feed open (dark-turn fix): a turn that emits no tool_label
@@ -1045,7 +1057,11 @@ describe("status-card body stacks like a reply (#2669 rich-message renderer)", (
   it("multiple step bullets stack on their own lines (no soft-break collapse)", () => {
     const out = renderActivityFeed(["Reading a.ts", "Searching memory", "Running tests"], true)!;
     const lines = out.split("  \n");
-    expect(lines).toEqual(["~~_✓ Reading a.ts_~~", "~~_✓ Searching memory_~~", "~~_✓ Running tests_~~"]);
+    expect(lines).toEqual([
+      `~~_✓ Reading a.ts_~~${NB}`,
+      `~~_✓ Searching memory_~~${NB}`,
+      "~~_✓ Running tests_~~",
+    ]);
     // Not a single lone `\n` survives to collapse two bullets.
     expect(out).not.toMatch(/(?<! {2})\n/);
   });
@@ -1069,6 +1085,6 @@ describe("status-card body stacks like a reply (#2669 rich-message renderer)", (
     // prose by escapeStepLine; the inline-markup-survives case is covered by
     // the stackCardLines unit test, which operates on pre-rendered lines.)
     const out = renderActivityFeed(["Reading a.ts", "Running tests"], false)!;
-    expect(out).toBe("~~_✓ Reading a.ts_~~  \n**→ Running tests**");
+    expect(out).toBe(`~~_✓ Reading a.ts_~~${NB}  \n**→ Running tests**`);
   });
 });

package/telegram-plugin/tests/tool-label-pretool.test.ts

@@ -68,3 +68,97 @@ describe('computeLabel — surface-tool suppression is key-agnostic', () => {
     expect(computeLabel('mcp__clerk-telegram__get_recent_messages', {})).toBe('Reading chat history')
   })
 })
+
+// ─── Bash label without a model-authored description ─────────────────────
+//
+// `description` is OPTIONAL, so a sub-agent that never writes one used to
+// produce the constant "Running a command" for every Bash call — the worker
+// feed then deduped every repeat away and the card froze on one line for the
+// whole job. The fallback derives a label from the command, but ONLY through
+// an allowlist: program basename, plus one bare subcommand for known
+// multiplexers. Command lines carry tokens, passwords, credential URLs and
+// private paths, and this string is rendered into a Telegram message.
+describe('computeLabel — Bash fallback when description is omitted', () => {
+  it('prefers the model-authored description when present', () => {
+    expect(computeLabel('Bash', { command: 'git push origin main', description: 'Push branch' }))
+      .toBe('Push branch')
+  })
+
+  it('derives the program name when description is missing', () => {
+    expect(computeLabel('Bash', { command: 'grep -r foo .' })).toBe('Running grep')
+    expect(computeLabel('Bash', { command: 'ls -la /var/log' })).toBe('Running ls')
+  })
+
+  it('adds a bare subcommand for known multiplexers', () => {
+    expect(computeLabel('Bash', { command: 'git status --short' })).toBe('Running git status')
+    expect(computeLabel('Bash', { command: 'docker ps -a' })).toBe('Running docker ps')
+    expect(computeLabel('Bash', { command: 'npm run lint' })).toBe('Running npm run')
+  })
+
+  it('produces DISTINCT labels for distinct commands (the frozen-card fix)', () => {
+    const labels = [
+      'git status', 'npm test', 'ls /tmp', 'grep -n x y', 'docker logs c',
+    ].map((c) => computeLabel('Bash', { command: c }))
+    expect(new Set(labels).size).toBe(labels.length)
+  })
+
+  it('skips navigation prefixes and wrappers to the real program', () => {
+    expect(computeLabel('Bash', { command: 'cd /srv/app && git pull' })).toBe('Running git pull')
+    expect(computeLabel('Bash', { command: 'sudo systemctl restart nginx' }))
+      .toBe('Running systemctl restart')
+    expect(computeLabel('Bash', { command: 'FOO=bar deploy.sh' })).toBe('Running deploy.sh')
+  })
+
+  it('NEVER echoes arguments, flag values, URLs, or env assignments', () => {
+    // Token-shaped literals are assembled at runtime: GitHub Push Protection
+    // and check-no-pii-secrets both reject contiguous ones, fake or not
+    // (pattern from secret-detect-secretlint.test.ts).
+    const fakeAnthropic = 'sk-' + 'ant-oat01-FAKEVALUE'
+    const cases = [
+      'curl -H "Authorization: Bearer ' + 'sk-' + 'live-abcdef123456" https://api.example.com/v1/x',
+      'psql postgres://user:hunter2@db.internal:5432/prod -c "select 1"',
+      'aws s3 cp s3://private-bucket/key.pem . --profile prod',
+      'export TOKEN=ghp_AAAABBBBCCCCDDDD && ./run',
+      `echo "${fakeAnthropic}" > /root/.creds`,
+      'ssh deploy@10.0.0.7 -i /root/.ssh/id_ed25519',
+      'git clone https://x-access-token:ghs_SECRET@github.com/o/r.git',
+    ]
+    const forbidden = /sk-|ghp_|ghs_|hunter2|Bearer|SECRET|10\.0\.0\.7|@|:\/\/|=/
+    for (const command of cases) {
+      const label = computeLabel('Bash', { command })
+      expect(label).not.toBeNull()
+      expect(label).not.toMatch(forbidden)
+      // Whatever it says, it must be short and made of the allowlisted shape.
+      expect(label).toMatch(/^Running (a command|[A-Za-z][A-Za-z0-9._+-]{0,19}( [a-z][a-z-]{1,15})?)$/)
+    }
+  })
+
+  it('never inspects a heredoc / multiline body', () => {
+    const label = computeLabel('Bash', {
+      command: 'cat <<EOF > /tmp/x\nAPI_KEY=sk-live-shouldnotleak\nEOF',
+    })
+    expect(label).toBe('Running cat')
+  })
+
+  it('falls back to the generic label when nothing safe can be derived', () => {
+    expect(computeLabel('Bash', { command: '$(cat /run/secrets/token) --x' })).toBe('Running a command')
+    expect(computeLabel('Bash', {})).toBe('Running a command')
+    expect(computeLabel('Bash', { command: '   ' })).toBe('Running a command')
+  })
+})
+
+describe('computeLabel — Bash subcommand is never a flag value', () => {
+  it('only accepts the token IMMEDIATELY after a multiplexer', () => {
+    // A flag value (a private context/host/profile name) must never surface.
+    expect(computeLabel('Bash', { command: 'docker --context prod-internal ps' }))
+      .toBe('Running docker')
+    expect(computeLabel('Bash', { command: 'git -C /srv/private-app status' }))
+      .toBe('Running git')
+    expect(computeLabel('Bash', { command: 'aws --profile customer-acme s3 ls' }))
+      .toBe('Running aws')
+  })
+
+  it('still reads the plain subcommand form', () => {
+    expect(computeLabel('Bash', { command: 'git commit -m "wip"' })).toBe('Running git commit')
+  })
+})

package/telegram-plugin/tests/vault-approval-posture.test.ts

@@ -101,7 +101,12 @@ describe('handleVaultRequestAccessCallback — posture branch', () => {
   it('passphrase-mode branch unchanged: cache lookup + prompt still present', () => {
     const approveBlock = sliceAccessApproveBlock()
     expect(approveBlock).toMatch(/vaultPassphraseCache\.get\(pending\.chat_id\)/)
-    expect(approveBlock).toMatch(/Reply with your passphrase/i)
+    // #3627: the prompt COPY moved into the shared
+    // `buildAccessPassphrasePromptText` builder (so the first prompt and the
+    // wrong-passphrase re-prompt can't drift). The passphrase-mode branch
+    // must still route into it.
+    expect(approveBlock).toMatch(/sendAccessPassphrasePrompt\(/)
+    expect(gatewaySrc).toMatch(/Reply with your passphrase/i)
     expect(approveBlock).toMatch(/passphrase-for-access-approve/)
     // Pinned: the queued-drain path passes the typed passphrase via
     // the new attestation shape `{ kind: 'passphrase', passphrase }`.