switchroom 0.19.3 → 0.19.5

package/telegram-plugin/tests/silent-end-interrupt-stop-scan.test.ts

@@ -184,13 +184,20 @@ describe('scanTurnForFinalReply — final-reply detection', () => {
     expect(r.pendingText).toBe(trailing)
   })
 
-  it('Option A: a SHORT trailing/only fragment does NOT set pendingText (substance floor)', () => {
-    // A genuinely empty-ish turn: a short plain-text closer under the 200-char
-    // floor must not be re-delivered as if it were the answer.
-    const text = jsonl(ENQUEUE, assistantText('ok done, let me know if you need anything else'))
+  it('Option A: a SHORT single trailing fragment (zero-reply) IS persisted for the lowered-floor corner', () => {
+    // Post duplicate-message fix: a single short plain-text block in the
+    // ZERO-reply case is the real short-answer shape, so the scan persists it
+    // as pendingText for the capture-divergence corner (gateway captured empty →
+    // the bridge delivers with a lowered floor). Under the gateway's DEFAULT
+    // 200-char floor it is still NOT delivered, so the substance guard holds at
+    // the delivery layer.
+    const short = 'ok done, let me know if you need anything else'
+    const text = jsonl(ENQUEUE, assistantText(short))
     const r = scanTurnForFinalReply(text)
     expect(r.decided).toBe('block')
-    expect(r.pendingText).toBeUndefined()
+    expect(r.reason).toBe('no-final-reply')
+    expect(r.pendingText).toBe(short)
+    expect(r.hasTrailingProse).toBe(true)
   })
 
   it('notification-bearing reply → allow', () => {
@@ -388,14 +395,19 @@ describe('scanTurnForFinalReply — pendingText is a single substantive block, n
   // "Let me check…" / "Still querying…" narration crossed 200 and was delivered
   // as if it were the answer. Post-fix only a single block that clears the floor
   // ON ITS OWN becomes pendingText.
-  const NARRATION_A = 'Let me check the first data source now — pulling the records and scanning for the relevant rows.' // ~95
-  const NARRATION_B = 'Still querying; the second source is slower than expected, so hang tight while it finishes loading.' // ~98
-  const NARRATION_C = 'Almost there, cross-referencing the last set of figures against the ledger before I summarise it.' // ~96
-
-  it('zero-delivery turn of only short narration blocks → block WITHOUT pendingText (fails on the old joined-floor code)', () => {
-    // Combined length of the three blocks is ≥ 200, so the OLD code would join
-    // them and set pendingText (masquerade). The NEW code sets nothing because
-    // no single block clears the floor.
+  // Genuinely-narration blocks: each matches the opener/trailer heuristic
+  // (`isNarrationBlock`) the flush's `selectFlushDeliveryText` uses, so a pure
+  // run of them is delivered as NOTHING by the flush — and the scan must agree
+  // (no pendingText) so the capture-divergence bridge never masquerades a
+  // narration run as an answer (#3228 Finding 2).
+  const NARRATION_A = 'Let me check the first data source now, pulling the records and scanning the rows…' // opener + …
+  const NARRATION_B = "Now let me query the second source; it is slower than expected, hang tight…" // opener + …
+  const NARRATION_C = "I'll cross-reference the last set of figures against the ledger before I summarise…" // opener + …
+
+  it('zero-delivery turn of only NARRATION blocks → block WITHOUT pendingText (#3228 Finding 2 / flush parity)', () => {
+    // Combined length of the three blocks is ≥ 200, so the OLD joined-floor code
+    // would join them and set pendingText (masquerade). The NEW code mirrors the
+    // flush's narration strip: every block is narration → nothing to deliver.
     expect((NARRATION_A + '\n\n' + NARRATION_B + '\n\n' + NARRATION_C).length)
       .toBeGreaterThanOrEqual(200)
     const text = jsonl(
@@ -413,6 +425,35 @@ describe('scanTurnForFinalReply — pendingText is a single substantive block, n
     expect(r.pendingText).toBeUndefined()
   })
 
+  it('zero-delivery turn of MULTIPLE sub-200 REAL-CONTENT blocks → JOINED pendingText (review item 3 drop fix)', () => {
+    // A real answer split as two ~150-char paragraphs, each individually under
+    // the 200-char substance floor. Pre-fix the scan set NO pendingText — and in
+    // the capture-divergence-empty corner (gateway captured nothing → flush
+    // skips 'empty-text') the bridge then had nothing to deliver and the hook
+    // had already allowed the stop → DROPPED ANSWER. Post-fix the scan mirrors
+    // the flush's join so the bridge delivers the joined prose.
+    const PARA_1 = 'The root cause is a stale cache entry that survives the reload because the invalidation key is derived from the wrong field.' // ~150, real content
+    const PARA_2 = 'The fix is to key invalidation off the canonical id so the entry is dropped on every write; I have verified it against the repro.' // ~150, real content
+    expect(PARA_1.length).toBeLessThan(200)
+    expect(PARA_2.length).toBeLessThan(200)
+    const text = jsonl(ENQUEUE, assistantText(PARA_1), assistantText(PARA_2))
+    const r = scanTurnForFinalReply(text)
+    expect(r.decided).toBe('block')
+    expect(r.reason).toBe('no-final-reply')
+    // Joined prose, mirroring the flush's selectFlushDeliveryText.
+    expect(r.pendingText).toBe(`${PARA_1}\n\n${PARA_2}`)
+    expect(r.hasTrailingProse).toBe(true)
+  })
+
+  it('leading narration + a real sub-200 answer block → only the answer is delivered (narration stripped)', () => {
+    const NARR = 'Let me pull the numbers first…' // narration opener + …
+    const ANSWER = 'Revenue was up 12% quarter-over-quarter, driven mostly by the new enterprise tier.' // ~85, real
+    const text = jsonl(ENQUEUE, assistantText(NARR), assistantText(ANSWER))
+    const r = scanTurnForFinalReply(text)
+    expect(r.decided).toBe('block')
+    expect(r.pendingText).toBe(ANSWER)
+  })
+
   it('trailing narration after a delivered reply, all sub-floor → block only if a real ≥floor block exists; here → allow, no pendingText', () => {
     // Each trailing block is sub-floor, so `sawUndeliveredTextAfterAllow` is
     // false → allow. (The old joined-floor logic never affected the block
@@ -447,9 +488,12 @@ describe('scanTurnForFinalReply — pendingText is a single substantive block, n
       const text = jsonl(ENQUEUE, assistantText('X'.repeat(n)))
       return scanTurnForFinalReply(text)
     }
-    // 199 → under floor, no pendingText (block still fires for the zero-delivery
-    // turn, but there is nothing substantive to deliver).
-    expect(at(199).pendingText).toBeUndefined()
+    // 199 → under the 200-char SUBSTANCE floor, but a SINGLE trailing block is
+    // the real short-answer shape: post duplicate-message fix the scan persists
+    // it as pendingText so the capture-divergence corner can deliver it with a
+    // lowered floor. The gateway's default-floor decide still won't deliver it,
+    // so the #3228 masquerade guard is unchanged at the delivery layer.
+    expect(at(199).pendingText).toBe('X'.repeat(199))
     // 200 → exactly the floor, delivered.
     expect(at(200).pendingText).toBe('X'.repeat(200))
     // 201 → over floor, delivered.

package/telegram-plugin/tests/silent-end-single-writer-election.test.ts

@@ -0,0 +1,193 @@
+/**
+ * Regression tests for the single-writer election (duplicate-message fix).
+ *
+ * RCA: when a turn ends with its final answer as PLAIN TRANSCRIPT TEXT (no
+ * `reply` tool call), two uncoordinated recovery paths both fired — (A) the
+ * gateway turn-end flush (`decideTurnFlush`) delivered the captured prose, and
+ * (B) this Stop hook blocked and re-prompted, regenerating a REWORDED reply
+ * that defeated the exact-match dedup. The user got two near-identical
+ * messages.
+ *
+ * Fix: the Stop hook is the single elector (`decideStopHookDisposition`). On a
+ * would-BLOCK scan it ALLOWS the stop — handing delivery to the gateway's
+ * flush / captured-prose bridge — IFF four never-drop gates all hold; otherwise
+ * it BLOCKS exactly as today. These tests pin the whole verdict matrix and
+ * prove every allow path has a delivery machine and every guard forces BLOCK.
+ */
+
+import { describe, it, expect } from 'vitest'
+import {
+  decideStopHookDisposition,
+  isTurnFlushSafetyEnabledEnv,
+  isCapturedProseDeliveryEnabledEnv,
+  isGatewayHeartbeatFresh,
+  GATEWAY_HEARTBEAT_FRESH_MS,
+} from '../hooks/silent-end-scan.mjs'
+import {
+  mkdtempSync,
+  writeFileSync,
+  utimesSync,
+  rmSync,
+} from 'node:fs'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+
+// Scan fixtures — the shapes `scanTurnForFinalReply` returns on a would-block.
+const ZERO_REPLY_LONG = {
+  decided: 'block' as const,
+  reason: 'no-final-reply',
+  turnKey: 'c:_',
+  hasTrailingProse: true,
+  pendingText: 'A'.repeat(300),
+}
+const ZERO_REPLY_SHORT = {
+  decided: 'block' as const,
+  reason: 'no-final-reply',
+  turnKey: 'c:_',
+  hasTrailingProse: true,
+  pendingText: 'ok done',
+}
+const ZERO_REPLY_NO_PROSE = {
+  decided: 'block' as const,
+  reason: 'no-final-reply',
+  turnKey: 'c:_',
+  // hasTrailingProse absent — tool-calls-only turn, nothing for a machine to send.
+}
+const INTERIM_ACK_LONG = {
+  decided: 'block' as const,
+  reason: 'trailing-text-after-reply',
+  turnKey: 'c:_',
+  hasTrailingProse: true,
+  pendingText: 'B'.repeat(300),
+}
+const INTERIM_ACK_SHORT = {
+  decided: 'block' as const,
+  reason: 'trailing-text-after-reply',
+  turnKey: 'c:_',
+  hasTrailingProse: true,
+  pendingText: 'thanks!',
+}
+
+const ALL_ON = {
+  retryCount: 0,
+  turnFlushSafetyEnabled: true,
+  capturedProseDeliveryEnabled: true,
+  gatewayLive: true,
+}
+
+describe('decideStopHookDisposition — duplicate repro (#1: zero-reply ≥200)', () => {
+  it('zero-reply long answer, flags on, retry 0, live → ALLOW-elected (today it blocks → duplicate)', () => {
+    const d = decideStopHookDisposition({ scan: ZERO_REPLY_LONG, ...ALL_ON })
+    expect(d.action).toBe('allow-elected')
+    expect(d.reason).toBe('flush-will-deliver')
+  })
+})
+
+describe('decideStopHookDisposition — short-answer repro (#2: zero-reply <200)', () => {
+  it('zero-reply SHORT answer, flags on, retry 0, live → ALLOW-elected (flush has no length floor)', () => {
+    // Today this BLOCKS *and* the flush fires → duplicate. Exactly one machine
+    // must win: the flush. The election allows the stop so the hook does not
+    // also re-prompt.
+    const d = decideStopHookDisposition({ scan: ZERO_REPLY_SHORT, ...ALL_ON })
+    expect(d.action).toBe('allow-elected')
+  })
+})
+
+describe('decideStopHookDisposition — never-drop matrix (#3)', () => {
+  it('every ALLOW verdict is backed by a delivery machine', () => {
+    // Zero-reply → the turn-flush delivers (no length floor); interim-ack ≥200 →
+    // the captured-prose bridge delivers. Both are allow.
+    expect(decideStopHookDisposition({ scan: ZERO_REPLY_LONG, ...ALL_ON }).action).toBe('allow-elected')
+    expect(decideStopHookDisposition({ scan: ZERO_REPLY_SHORT, ...ALL_ON }).action).toBe('allow-elected')
+    expect(decideStopHookDisposition({ scan: INTERIM_ACK_LONG, ...ALL_ON }).action).toBe('allow-elected')
+  })
+
+  it('turn-flush flag OFF (zero-reply) → BLOCK (the flush will not fire)', () => {
+    const d = decideStopHookDisposition({ scan: ZERO_REPLY_LONG, ...ALL_ON, turnFlushSafetyEnabled: false })
+    expect(d.action).toBe('block')
+    expect(d.reason).toBe('turn-flush-flag-disabled')
+  })
+
+  it('captured-prose flag OFF (interim-ack) → BLOCK (the bridge will not fire)', () => {
+    const d = decideStopHookDisposition({ scan: INTERIM_ACK_LONG, ...ALL_ON, capturedProseDeliveryEnabled: false })
+    expect(d.action).toBe('block')
+    expect(d.reason).toBe('captured-prose-flag-disabled')
+  })
+
+  it('captured-prose flag OFF (zero-reply) → BLOCK (bridge is the capture-divergence backstop)', () => {
+    const d = decideStopHookDisposition({ scan: ZERO_REPLY_LONG, ...ALL_ON, capturedProseDeliveryEnabled: false })
+    expect(d.action).toBe('block')
+    expect(d.reason).toBe('captured-prose-flag-disabled')
+  })
+
+  it('retryCount > 0 → BLOCK (a prior failed delivery keeps the #3228 recovery net)', () => {
+    const d = decideStopHookDisposition({ scan: ZERO_REPLY_LONG, ...ALL_ON, retryCount: 1 })
+    expect(d.action).toBe('block')
+    expect(d.reason).toBe('retry-ladder-in-flight')
+  })
+
+  it('gateway NOT live → BLOCK (never allow into a possibly-dead gateway)', () => {
+    const d = decideStopHookDisposition({ scan: ZERO_REPLY_LONG, ...ALL_ON, gatewayLive: false })
+    expect(d.action).toBe('block')
+    expect(d.reason).toBe('gateway-liveness-not-fresh')
+  })
+
+  it('interim-ack SHORT (<200) → BLOCK (bridge floor is 200; no duplicate exists today)', () => {
+    const d = decideStopHookDisposition({ scan: INTERIM_ACK_SHORT, ...ALL_ON })
+    expect(d.action).toBe('block')
+    expect(d.reason).toBe('short-trailing-after-reply')
+  })
+
+  it('zero-reply with NO trailing prose (tool-calls only) → BLOCK (nothing to deliver)', () => {
+    const d = decideStopHookDisposition({ scan: ZERO_REPLY_NO_PROSE, ...ALL_ON })
+    expect(d.action).toBe('block')
+    expect(d.reason).toBe('no-trailing-prose')
+  })
+
+  it('a non-block scan (allow/unknown) is passed straight through as allow-scan', () => {
+    expect(decideStopHookDisposition({ scan: { decided: 'allow', reason: 'final-reply' }, ...ALL_ON }).action).toBe('allow-scan')
+    expect(decideStopHookDisposition({ scan: { decided: 'unknown', reason: 'no-turn-start' }, ...ALL_ON }).action).toBe('allow-scan')
+  })
+
+  it('gateway-liveness gate is checked BEFORE the flag/prose gates (dead gateway always blocks)', () => {
+    // Even with an otherwise-perfect zero-reply allow, a dead gateway forces block.
+    const d = decideStopHookDisposition({ scan: ZERO_REPLY_LONG, ...ALL_ON, gatewayLive: false, retryCount: 0 })
+    expect(d.action).toBe('block')
+    expect(d.reason).toBe('gateway-liveness-not-fresh')
+  })
+})
+
+describe('env-flag mirrors stay in sync with the TS source', () => {
+  it('turn-flush-safety: default ON; 0/false/off/no disable', () => {
+    expect(isTurnFlushSafetyEnabledEnv({})).toBe(true)
+    for (const v of ['0', 'false', 'off', 'no', 'FALSE', 'Off']) {
+      expect(isTurnFlushSafetyEnabledEnv({ SWITCHROOM_TG_TURN_FLUSH_SAFETY: v })).toBe(false)
+    }
+    expect(isTurnFlushSafetyEnabledEnv({ SWITCHROOM_TG_TURN_FLUSH_SAFETY: '1' })).toBe(true)
+  })
+  it('captured-prose: default ON; only exact "0" disables', () => {
+    expect(isCapturedProseDeliveryEnabledEnv({})).toBe(true)
+    expect(isCapturedProseDeliveryEnabledEnv({ SWITCHROOM_TG_CAPTURED_PROSE_DELIVERY: '0' })).toBe(false)
+    expect(isCapturedProseDeliveryEnabledEnv({ SWITCHROOM_TG_CAPTURED_PROSE_DELIVERY: '1' })).toBe(true)
+  })
+})
+
+describe('isGatewayHeartbeatFresh — liveness gate IO', () => {
+  it('fresh heartbeat → true; stale → false; missing → false', () => {
+    const dir = mkdtempSync(join(tmpdir(), 'gw-hb-'))
+    try {
+      // Missing file → not fresh.
+      expect(isGatewayHeartbeatFresh(dir)).toBe(false)
+      const path = join(dir, 'gateway-heartbeat')
+      writeFileSync(path, 'x')
+      // Just-written → fresh.
+      expect(isGatewayHeartbeatFresh(dir)).toBe(true)
+      // Age it past the freshness bound → stale.
+      const old = new Date(Date.now() - GATEWAY_HEARTBEAT_FRESH_MS - 10_000)
+      utimesSync(path, old, old)
+      expect(isGatewayHeartbeatFresh(dir)).toBe(false)
+    } finally {
+      rmSync(dir, { recursive: true, force: true })
+    }
+  })
+})

package/telegram-plugin/tests/silent-end.test.ts

@@ -736,10 +736,15 @@ describe('silent-end-interrupt-stop hook — integration (#1775: transcript-scan
       expect(decision.reason).toBe('no-state')
     })
 
-    it('a genuinely empty turn (no substantive prose) → hook blocks WITHOUT pendingText → decide falls through', () => {
-      // Short closer under the substance floor: not a dropped answer. The hook
-      // still blocks (re-prompt), but writes NO pendingText, so the gateway
-      // takes the existing recordUndeliveredTurnEnd / represent path unchanged.
+    it('a short single-block answer → hook persists pendingText but default-floor decide falls through', () => {
+      // Single short trailing block under the 200-char substance floor. Post
+      // duplicate-message fix the hook persists it as pendingText (so the
+      // capture-divergence corner can deliver it with a lowered floor when the
+      // gateway captured nothing), but under the DEFAULT floor the gateway's
+      // decide returns no-substantive-prose — the normal recordUndeliveredTurnEnd
+      // / represent path is unchanged. (No gateway heartbeat file exists in this
+      // test's state dir, so the single-writer election also BLOCKS on the
+      // liveness gate rather than allowing the stop.)
       const transcript = writeTranscript([
         ENQUEUE,
         { type: 'assistant', message: { content: [{ type: 'text', text: 'ok done' }] } },
@@ -747,10 +752,60 @@ describe('silent-end-interrupt-stop hook — integration (#1775: transcript-scan
       const r = runHook({ session_id: 's', transcript_path: transcript, hook_event_name: 'Stop' })
       expect(JSON.parse(r.stdout.trim()).decision).toBe('block')
       const state = readSilentEndState()!
-      expect(state.pendingText).toBeUndefined()
+      expect(state.pendingText).toBe('ok done')
+      // Default floor (200) → short prose is not delivered on the normal path.
       const decision = decideCapturedProseDelivery({ turnKey: 'c:_' })
       expect(decision.deliver).toBe(false)
       expect(decision.reason).toBe('no-substantive-prose')
+      // Lowered floor (capture-divergence corner) → the short answer IS delivered.
+      const lowered = decideCapturedProseDelivery({ turnKey: 'c:_', minChars: 1 })
+      expect(lowered.deliver).toBe(true)
+      expect(lowered.text).toBe('ok done')
+    })
+
+    it('review item 3: multi sub-200 REAL blocks + capture-empty corner → bridge delivers JOINED prose (no drop)', () => {
+      // A real answer split as two ~150-char paragraphs, each under the 200-char
+      // floor. Pre-fix: scan set NO pendingText → in the capture-divergence-empty
+      // corner (gateway captured nothing → flush skips 'empty-text') the bridge
+      // had nothing → hook already allowed the stop → DROPPED ANSWER. Post-fix
+      // the hook persists the JOINED prose so the lowered-floor bridge delivers
+      // exactly one message.
+      // Each block short enough that the JOINED prose is still under the 200-char
+      // default floor — so this also exercises the lowered-floor plumbing.
+      const PARA_1 = 'The root cause is a stale cache entry surviving reload.'
+      const PARA_2 = 'The fix keys invalidation off the canonical id; verified.'
+      const joined = `${PARA_1}\n\n${PARA_2}`
+      expect(joined.length).toBeLessThan(200)
+      const transcript = writeTranscript([
+        ENQUEUE,
+        { type: 'assistant', message: { content: [{ type: 'text', text: PARA_1 }] } },
+        { type: 'assistant', message: { content: [{ type: 'text', text: PARA_2 }] } },
+      ])
+      const r = runHook({ session_id: 's', transcript_path: transcript, hook_event_name: 'Stop' })
+      expect(JSON.parse(r.stdout.trim()).decision).toBe('block')
+      const state = readSilentEndState()!
+      expect(state.pendingText).toBe(joined)
+      // Default floor → not delivered on the normal path (no duplicate risk).
+      expect(decideCapturedProseDelivery({ turnKey: 'c:_' }).deliver).toBe(false)
+      // Capture-divergence corner (gateway captured empty → lowered floor) →
+      // exactly one delivery of the joined answer, instead of a silent drop.
+      const lowered = decideCapturedProseDelivery({ turnKey: 'c:_', minChars: 1 })
+      expect(lowered.deliver).toBe(true)
+      expect(lowered.text).toBe(joined)
+    })
+
+    it('review item 3: NARRATION-only multi-block → still NO pendingText (no masquerade, #3228 Finding 2)', () => {
+      const transcript = writeTranscript([
+        ENQUEUE,
+        { type: 'assistant', message: { content: [{ type: 'text', text: 'Let me check the first source now, scanning the rows…' }] } },
+        { type: 'assistant', message: { content: [{ type: 'text', text: "Now let me query the second source; hang tight…" }] } },
+      ])
+      const r = runHook({ session_id: 's', transcript_path: transcript, hook_event_name: 'Stop' })
+      expect(JSON.parse(r.stdout.trim()).decision).toBe('block')
+      const state = readSilentEndState()!
+      expect(state.pendingText).toBeUndefined()
+      // Even at the lowered floor there is nothing to deliver.
+      expect(decideCapturedProseDelivery({ turnKey: 'c:_', minChars: 1 }).deliver).toBe(false)
     })
 
     it('a stale pendingText for a DIFFERENT turn is never delivered (turnKey guard)', () => {