switchroom 0.19.30 → 0.19.32

package/telegram-plugin/tests/turn-supersede-finalizes-prior-card.test.ts

@@ -0,0 +1,124 @@
+/**
+ * #3927 FIX B — a superseded turn must never be left holding an orphaned card.
+ *
+ * The turn-supersession teardown in `stream-render.ts` tore down the prior
+ * turn's `answerStream`, its orphaned-reply fuse and its `narrativeGate`, but
+ * NEVER called `clearActivitySummary(prior)`. So a clobbered turn's activity
+ * card was never finalized, never unpinned (`fg:<statusKey>` stayed claimed
+ * forever), froze on its last landed edit, and left NO `turn-lifecycle clear`
+ * line to explain it. Proof from the field: carrie's turn
+ * `-1004223464247:_#1078` has a `turn-lifecycle set reason=enqueue` at
+ * 2026-07-28T18:13:37.554Z and no `clear` anywhere in the log; its stale pinned
+ * card was still on screen in the operator's screenshot.
+ *
+ * ── Which path still supersedes, after FIX A ──────────────────────────────
+ * FIX A parks EVERY mid-turn enqueue, synthetic ones included — that is not a
+ * policy choice, it is what the claude CLI does (carrie's `obligation_represent`
+ * enqueue at 18:19:07.032Z was terminated by a `remove` at 18:19:59.794Z, i.e.
+ * folded into the running turn as a `queued_command` attachment, never by a
+ * `dequeue`). So an enqueue no longer preempts, and the case below asserts that
+ * explicitly.
+ *
+ * Supersession is still REACHABLE, though: a turn whose `turn_end` the gateway
+ * never observed (bridge death, transcript gap, unclean restart) leaves a
+ * live-looking atom in the slot, and the next genuine dequeue-driven turn start
+ * mints straight on top of it. That is the exact orphan carrie hit, and it is
+ * what FIX B finalizes.
+ */
+import { describe, it, expect, beforeEach } from 'vitest'
+import {
+  handleSessionEvent,
+  __resetParkedTurnStartsForTest,
+  __parkedTurnStartCountForTest,
+} from '../gateway/stream-render.js'
+import { enqueue, makeHarness } from './turn-mint-harness.js'
+
+/** A cron / handback / wake enqueue: no `message_id`, so `deriveTurnId` falls
+ *  back to `…#synthetic-<startedAt>`. */
+function syntheticEnqueue(chatId: string, text: string) {
+  return {
+    kind: 'enqueue' as const,
+    chatId,
+    messageId: null,
+    threadId: null,
+    rawContent: `<channel source="switchroom-telegram" source="cron">${text}</channel>`,
+  }
+}
+
+beforeEach(() => {
+  __resetParkedTurnStartsForTest()
+})
+
+describe('#3927 FIX B — superseding a live turn finalizes its card', () => {
+  it('a dequeue-driven mint on top of a never-ended turn calls clearActivitySummary ' +
+    'for the PRIOR turn, and does so BEFORE the successor opens its card', () => {
+    const h = makeHarness()
+
+    // Turn A starts and opens a card with real work on it.
+    handleSessionEvent(h.deps, enqueue('1078'))
+    const turnA = h.current()!
+    handleSessionEvent(h.deps, { kind: 'tool_label', toolName: 'Read', label: 'Reading the log' })
+    expect(turnA.labeledToolCount).toBe(1)
+    expect(h.finalized).toHaveLength(0)
+
+    // A's `turn_end` is NEVER observed — `endedAt` stays null and the atom
+    // stays in the slot (exactly carrie's `#1078`).
+    expect(turnA.endedAt).toBeNull()
+
+    // A later message is queued and the CLI drains it into a new turn.
+    handleSessionEvent(h.deps, enqueue('1086'))
+    expect(__parkedTurnStartCountForTest()).toBe(1)
+    handleSessionEvent(h.deps, { kind: 'dequeue' })
+
+    const turnB = h.current()!
+    expect(turnB).not.toBe(turnA)
+
+    // FIX B: the orphan was finalized — pre-fix there was NO call at all.
+    expect(h.finalized).toHaveLength(1)
+    expect(h.finalized[0]).toBe(turnA)
+
+    // …and it happened BEFORE the successor's card opened, so the old card is
+    // finalized/unpinned rather than left frozen above a fresh one.
+    expect(h.seq).toEqual([
+      `open:${turnA.turnId}`,
+      `finalize:${turnA.turnId}`,
+      `open:${turnB.turnId}`,
+    ])
+  })
+
+  it('a turn that ENDED normally is not re-finalized when its successor mints', () => {
+    const h = makeHarness()
+    handleSessionEvent(h.deps, enqueue('1090'))
+    const turnA = h.current()!
+    // turn-end.ts stamps `endedAt` and runs its own clearActivitySummary.
+    turnA.endedAt = Date.now()
+
+    handleSessionEvent(h.deps, enqueue('1091'))
+    // Idle by `endedAt`, so this mints straight away — and must NOT double-
+    // finalize A's already-closed card.
+    expect(h.current()).not.toBe(turnA)
+    expect(h.finalized).toHaveLength(0)
+  })
+
+  it('FIX A is uniform across sources: a SYNTHETIC (cron/handback) enqueue parks ' +
+    'behind a live turn instead of preempting it', () => {
+    const h = makeHarness()
+    handleSessionEvent(h.deps, enqueue('1100'))
+    const turnA = h.current()!
+
+    handleSessionEvent(h.deps, syntheticEnqueue('1001', 'time for the daily digest'))
+
+    // No preemption: no new card, no slot steal, no orphaned finalize.
+    expect(h.current()).toBe(turnA)
+    expect(h.cardsOpened).toHaveLength(1)
+    expect(h.finalized).toHaveLength(0)
+    expect(__parkedTurnStartCountForTest()).toBe(1)
+
+    // It mints on the CLI's own turn-start signal, like every other source.
+    turnA.endedAt = Date.now()
+    handleSessionEvent(h.deps, { kind: 'dequeue' })
+    expect(h.current()).not.toBe(turnA)
+    expect(h.current()!.turnId).toContain('#synthetic-')
+    expect(h.cardsOpened).toHaveLength(2)
+  })
+})

package/telegram-plugin/tests/worker-feed-pin-persistence.test.ts

@@ -217,6 +217,36 @@ function makePersistingPinHarness(path: string) {
 describe('worker-feed pin persistence — durable status-pins.json survives steady-state edits (F1)', () => {
   const PATH = '/state/agent/telegram/status-pins.json'
 
+  it('writes an UNAMBIGUOUS (chat, thread) pin key — no trailing-space topic slot', async () => {
+    // The key is persisted verbatim into status-pins.json. It used to be
+    // `${chatId} ${threadId ?? ''}`, so a topic-less group wrote
+    // `"pinKey": "wk:group:-100123 "` — trailing whitespace that survives a
+    // JSON round-trip and is invisible in every log and grep.
+    const bot = makeFakeBot()
+    const pin = makePersistingPinHarness(PATH)
+    let clock = 0
+    const feed = createWorkerActivityFeed({
+      bot,
+      now: () => clock,
+      firstPaintMinMs: 0,
+      minEditIntervalMs: 0,
+      reconcilePin: pin.reconcilePinFn,
+    })
+
+    clock = 1000
+    await feed.update('w-topicless', '-100123', view({ elapsedMs: 1000, toolCount: 1 }))
+    await flush()
+    clock = 2000
+    await feed.update('w-topic', '-100123', view({ elapsedMs: 1000, toolCount: 1 }), 7)
+    await flush()
+
+    const keys = pin.rows().map((r) => r.pinKey).sort()
+    expect(keys).toEqual(['wk:group:-100123:-', 'wk:group:-100123:7'])
+    // Same chat, different topic ⇒ genuinely different rows, and no key can be
+    // mistaken for another by an operator or a tool reconciling by chat.
+    for (const k of keys) expect(k).toBe(k.trim())
+  })
+
   it('preserves the wk:group row across many steady-state edits (noop-clear must NOT delete it)', async () => {
     const bot = makeFakeBot()
     const pin = makePersistingPinHarness(PATH)

package/telegram-plugin/tool-activity-summary.ts

@@ -91,7 +91,8 @@ import {
   NESTED_PREFIX,
   WORKER_STEP_INDENT,
 } from './status-no-truncate.js'
-import { escapeMarkdown, truncate } from './card-format.js'
+import { cleanWorkerResultParagraph, escapeMarkdown, truncate } from './card-format.js'
+import { redact } from './secret-detect/redact.js'
 import { isTelegramSurfaceTool } from './tool-names.js'
 // The card layout core. Header composition (`metricsRun` /
 // `renderActivityHeader`), the per-line escape pipeline (`escapeStepLine`), the
@@ -158,6 +159,15 @@ export interface SessionActivityHeader {
    *  line via `tokenSegment`. Omitted (0/undefined) → no token segment, same
    *  clean-omit behavior as the worker feed. */
   totalTokens?: number
+  /**
+   * RAW final-summary text for the terminal `✅ <summary>` footer — the agent
+   * card's analogue of the worker card's `latestSummary` (the gateway passes
+   * the turn's delivered answer, `turn.lastReplyText`). Rendered ONLY on a
+   * final render, through the SHARED `deriveCardResult` the worker card uses,
+   * so both surfaces clean/cap/emoji it identically. Absent or empty → no
+   * footer block (the worker card's own fallback), never a fabricated line.
+   */
+  resultText?: string
 }
 
 /**
@@ -456,32 +466,71 @@ const WORKER_RESULT_RULE = '─────'
 const WORKER_RESULT_MAX = 320
 
 /**
- * Render the accumulated feed as ready Telegram HTML — one action per line,
- * newest last. The current (newest) step is bold with a `→`; finished steps
- * are italic with a `✓`. Capped to the last STATUS_ROLLING_LINES with a dim
- * `✓ +N earlier…` header when the turn ran longer. Returns null when empty.
- * Callers send the result verbatim — do NOT re-escape or re-wrap it.
+ * The ONE derivation of a card's terminal `✅/⚠️ <summary>` footer block, shared
+ * by the 🤖 agent card and the 🛠 worker card (#3844 unified the card BODY; the
+ * footer stayed forked until this landed — the agent card silently had no
+ * result block at all, so it ended on `✓ N steps` while the worker card ended
+ * on the green tick + summary sentence).
  *
- * Thin adapter over `renderStatusCard` (emoji 🤖, label 'Agent').
+ * Contract (the worker card's long-standing behaviour, now the spec for both):
+ *   - `running`     → no block. The card is not finished.
+ *   - `incomplete`  → NEVER a block, whatever `summary` carries. Truthful-no-
+ *                     result invariant: a reaped/abandoned unit produced no
+ *                     result, so it must not render a `⚠️`-prefixed paragraph
+ *                     out of stray summary text. Enforced HERE (deterministic
+ *                     mechanism) rather than left to caller discipline.
+ *   - `done`        → `✅` + the cleaned paragraph.
+ *   - `failed`      → `⚠️` + the cleaned paragraph.
+ *   - empty/absent summary, or one that cleans to nothing → no block. Omitting
+ *     is the fallback; the card never fabricates a sentence.
  *
- * `stepCount` (optional): when `final=true` and `stepCount > 0`, appends a
- * `✓ N steps` footer line.
+ * `summary` is RAW model-authored text (markdown, multi-line). It is scrubbed
+ * with `redact()` and cleaned with `cleanWorkerResultParagraph`;
+ * `renderStatusCard` does the final truncate + escape when it emits the block.
  *
- * `header` (optional): when provided, the two-line activity header carries
- * elapsed + tool count.
+ * The `redact()` is load-bearing, not belt-and-braces: status cards are sent
+ * via `sendRichMessage` and BYPASS the outbound redact chokepoint
+ * (`normalizeOutboundBody` → `redact`, outbound-send-path.ts:192) that scrubs
+ * every ordinary reply — the same gap `emitGatewayOperatorEvent` closes in
+ * gateway.ts. The agent card's summary is the turn's delivered answer text
+ * taken PRE-redaction, so scrubbing here is what keeps a token smuggled into a
+ * summary from reaching Telegram verbatim. It runs BEFORE markdown stripping /
+ * escaping, which is the order the outbound pipeline requires (redacting
+ * already-escaped text lets url-query-param secrets slip past url-redact).
  */
-export function renderActivityFeed(
+export function deriveCardResult(
+  state: CardState,
+  summary: string | undefined,
+): { emoji: string; text: string } | undefined {
+  if (state !== 'done' && state !== 'failed') return undefined
+  const text = cleanWorkerResultParagraph(redact(summary ?? ''))
+  if (text.length === 0) return undefined
+  return { emoji: state === 'done' ? '✅' : '⚠️', text }
+}
+
+/** Leading emoji for the main-session (🤖 Agent) card. */
+const AGENT_CARD_EMOJI = '🤖'
+
+/**
+ * The single 🤖-agent-card configuration of `renderStatusCard`. Both public
+ * agent-card entrypoints (`renderActivityFeed`, `renderActivityFeedWithNested`)
+ * funnel through this so the header mapping, the empty-guard, and the terminal
+ * result footer cannot drift between the flat and nested renders — they used
+ * to be two byte-copies of the same object literal.
+ */
+function renderAgentCard(
   lines: string[],
-  final = false,
-  liveSuffix = "",
-  stepCount?: number,
-  header?: SessionActivityHeader,
+  children: string[],
+  final: boolean,
+  liveSuffix: string,
+  stepCount: number | undefined,
+  header: SessionActivityHeader | undefined,
 ): string | null {
-  if (lines.length === 0 && header == null) return null;
+  if (lines.length === 0 && children.length === 0 && header == null) return null
   return renderStatusCard({
     header: header != null
       ? {
-          emoji: '🤖',
+          emoji: AGENT_CARD_EMOJI,
           label: header.label,
           elapsedMs: header.elapsedMs,
           toolCount: header.toolCount,
@@ -491,12 +540,46 @@ export function renderActivityFeed(
         }
       : undefined,
     steps: lines,
+    ...(children.length > 0 ? { childSteps: children } : {}),
     final,
     liveSuffix,
     stepCount,
+    // Same footer derivation the 🛠 worker card uses — one code path, so the
+    // two surfaces cannot drift apart again. Only a FINAL render can carry a
+    // result; a live render passes 'running' through and gets undefined.
+    result: final && header != null
+      ? deriveCardResult(header.state, header.resultText)
+      : undefined,
   })
 }
 
+/**
+ * Render the accumulated feed as ready Telegram HTML — one action per line,
+ * newest last. The current (newest) step is bold with a `→`; finished steps
+ * are italic with a `✓`. Capped to the last STATUS_ROLLING_LINES with a dim
+ * `✓ +N earlier…` header when the turn ran longer. Returns null when empty.
+ * Callers send the result verbatim — do NOT re-escape or re-wrap it.
+ *
+ * Thin adapter over `renderStatusCard` (emoji 🤖, label 'Agent') via the shared
+ * `renderAgentCard` configuration.
+ *
+ * `stepCount` (optional): when `final=true` and `stepCount > 0`, appends a
+ * `✓ N steps` footer line.
+ *
+ * `header` (optional): when provided, the two-line activity header carries
+ * elapsed + tool count — and, on a final render, `header.resultText` supplies
+ * the terminal `✅ <summary>` footer (identical derivation to the worker card).
+ */
+export function renderActivityFeed(
+  lines: string[],
+  final = false,
+  liveSuffix = "",
+  stepCount?: number,
+  header?: SessionActivityHeader,
+): string | null {
+  return renderAgentCard(lines, [], final, liveSuffix, stepCount, header)
+}
+
 // ─── Foreground sub-agent nesting (Model A) ─────────────────────────────────
 //
 // A foreground sub-agent (Task/Agent with no `run_in_background`) runs INSIDE
@@ -519,7 +602,8 @@ export const NESTED_MAX_LINES = 4;
  * a `↳ +N earlier…` header when it overflows. Returns ready Telegram HTML
  * (callers must NOT re-escape) or null when there is nothing to show.
  *
- * Thin adapter over `renderStatusCard` (emoji 🤖, label 'Agent', childSteps).
+ * Thin adapter over `renderStatusCard` (emoji 🤖, label 'Agent', childSteps) via
+ * the shared `renderAgentCard` configuration.
  */
 export function renderActivityFeedWithNested(
   lines: string[],
@@ -530,25 +614,7 @@ export function renderActivityFeedWithNested(
   header?: SessionActivityHeader,
 ): string | null {
   const children = childLines.map((s) => s.trim()).filter((s) => s.length > 0);
-  if (children.length === 0) return renderActivityFeed(lines, final, liveSuffix, stepCount, header);
-  return renderStatusCard({
-    header: header != null
-      ? {
-          emoji: '🤖',
-          label: header.label,
-          elapsedMs: header.elapsedMs,
-          toolCount: header.toolCount,
-          state: header.state,
-          model: header.model,
-          totalTokens: header.totalTokens,
-        }
-      : undefined,
-    steps: lines,
-    childSteps: children,
-    final,
-    liveSuffix,
-    stepCount,
-  })
+  return renderAgentCard(lines, children, final, liveSuffix, stepCount, header)
 }
 
 // ─── Combined multi-worker feed (coalesced one-message-per-chat) ────────────

package/telegram-plugin/worker-activity-feed.ts

@@ -50,13 +50,13 @@
  */
 
 import {
-  cleanWorkerResultParagraph,
   stripMarkdown,
   truncate,
 } from './card-format.js'
 import { WORKER_HISTORY_MAX } from './status-no-truncate.js'
 import { renderCardTitleLine } from './card-layout.js'
 import {
+  deriveCardResult,
   renderStatusCard,
   formatStepSuffix,
   renderCombinedWorkerFeed,
@@ -274,17 +274,12 @@ export function renderWorkerActivity(v: WorkerActivityView, liveSuffix = ''): st
   // Terminal: latestSummary carries the worker's final result text (gateway
   // onFinish), distinct from the running narrative steps. Pass it as `result`.
   //
-  // Truthful-no-result invariant (deterministic control, not caller-discipline):
-  // an `incomplete` worker produced NO result, so it must NEVER render a result
-  // block regardless of whatever `latestSummary` happens to carry. The current
-  // call site (terminateWorker) always sets latestSummary:'' for incomplete, but
-  // enforce the invariant HERE so any future/direct caller can't fabricate a
-  // `⚠️`-prefixed result paragraph out of stray summary text.
-  let result: { emoji: string; text: string } | undefined
-  if (finished && v.state !== 'incomplete') {
-    const text = cleanWorkerResultParagraph(v.latestSummary)
-    if (text.length > 0) result = { emoji: v.state === 'done' ? '✅' : '⚠️', text }
-  }
+  // The whole derivation — state gating, the truthful-no-result invariant for
+  // `incomplete`, ✅/⚠️ selection, and omission on an empty summary — lives ONCE
+  // in `deriveCardResult` and is SHARED with the 🤖 agent card. It used to be
+  // inline here, which is precisely why the agent card had no result footer at
+  // all: the logic was unreachable from the other surface.
+  const result = deriveCardResult(v.state, v.latestSummary)
 
   const card = renderStatusCard({
     header,
@@ -581,7 +576,7 @@ interface WorkerRow {
  * a 2+ worker group renders the combined `renderCombinedWorkerFeed` body.
  */
 interface FeedGroup {
-  /** Stable key `${chatId} ${threadId ?? ''}`. */
+  /** Stable `(chat, thread)` key — see `feedKeyOf`: `<chatId>:<threadId|->`. */
   feedKey: string
   chatId: string
   threadId?: number
@@ -735,7 +730,7 @@ export interface WorkerActivityFeed {
    *  re-post). Lets the gateway pin the EXISTING `🛠 Worker` message. Note:
    *  siblings sharing the chat/thread return the SAME id (one message). */
   messageIdOf(agentId: string): number | null
-  /** True while the feed group `feedKey` (`${chatId} ${threadId ?? ''}`) still
+  /** True while the feed group `feedKey` (see `feedKeyOf` — `<chatId>:<threadId|->`) still
    *  tracks live work — used by the gateway's `wk:group:` pin reaper to exempt
    *  a live group's pin from the stale-TTL sweep (#3207). */
   hasRunningInFeed(feedKey: string): boolean
@@ -822,7 +817,7 @@ export function createWorkerActivityFeed(opts: WorkerActivityFeedOpts): WorkerAc
     })
   const clearIntervalFn = opts.clearInterval ?? ((handle: unknown) => clearInterval(handle as ReturnType<typeof setInterval>))
 
-  /** Feed groups keyed by `${chatId} ${threadId ?? ''}`. */
+  /** Feed groups keyed by `feedKeyOf(chatId, threadId)` — `<chatId>:<threadId|->`. */
   const groups = new Map<string, FeedGroup>()
   /** Reverse index agentId → feedKey, so the agentId-keyed public API resolves
    *  its group in O(1). Cleared when a worker's row is removed. */
@@ -849,8 +844,30 @@ export function createWorkerActivityFeed(opts: WorkerActivityFeedOpts): WorkerAc
   }
   let heartbeatTimer: unknown = null
 
+  /**
+   * The `(chat, thread)` identity of a feed group — and, prefixed with
+   * `wk:group:`, the pin key that gets PERSISTED into status-pins.json.
+   *
+   * The separator and the topic-less sentinel are both load-bearing. This used
+   * to be `` `${chatId} ${threadId ?? ''}` ``, which for a topic-less group
+   * rendered as `-1004223464247 ` — a key ending in a bare space. On disk that
+   * became `"pinKey": "wk:group:-1004223464247 "`: trailing whitespace that
+   * survives JSON round-trips, is invisible in every log line and grep, and
+   * cannot be distinguished by eye from the same chat WITH a topic. Any operator
+   * or tool reconciling rows by chat would silently treat the two as one.
+   *
+   * `<chatId>:<threadId|->` is unambiguous in both directions: the topic-less
+   * case is spelled explicitly (`-`), and a topic key can never be confused with
+   * a topic-less one. Note chat ids are negative, so the `-` sentinel and the
+   * sign of the id never occupy the same position.
+   *
+   * The value is opaque to every consumer (it round-trips through the pin key
+   * and back into `hasRunningInFeed`), so the format may change; a key written
+   * by an older build is work-scoped and is unpinned unconditionally by the next
+   * boot's cleanup, so there is nothing to migrate.
+   */
   function feedKeyOf(chatId: string, threadId?: number): string {
-    return `${chatId} ${threadId ?? ''}`
+    return `${chatId}:${threadId ?? '-'}`
   }
   function groupOfAgent(agentId: string): FeedGroup | undefined {
     const key = agentIndex.get(agentId)