switchroom 0.19.34 → 0.19.36

package/telegram-plugin/format.ts

@@ -761,6 +761,35 @@ function isFullyBolded(fragment: string): boolean {
   return /^\*\*[^*]+\*\*[.,:;!?]?$/.test(fragment.trim())
 }
 
+/**
+ * Max length (markers included) of a standalone fully-bolded line that is
+ * treated as a legitimate pseudo-heading (`**Section**`) rather than an
+ * over-bolded paragraph. Single source of truth for BOTH the per-block rule
+ * and the global-ratio heading exemption.
+ */
+const PSEUDO_HEADING_MAX_CHARS = 48
+
+/**
+ * True when a blank-line-delimited block is a single-line pseudo-heading: one
+ * non-empty line that is a single fully-bolded span of ≤PSEUDO_HEADING_MAX_CHARS
+ * characters (`**Summary**`, `**Next steps:**`). Multi-line blocks are never
+ * headings, so this can never mislabel a bolded paragraph as exempt.
+ */
+function isPseudoHeadingBlock(block: string): boolean {
+  const lines = block.split('\n').filter((l) => l.trim() !== '')
+  if (lines.length !== 1) return false
+  const t = lines[0].trim()
+  return t.length <= PSEUDO_HEADING_MAX_CHARS && isFullyBolded(t)
+}
+
+/** Diagnostic emitted when the over-bold tripwire actually removes bold. */
+export interface ExcessBoldStripDiagnostic {
+  /** Which rule fired: the whole-message ratio, or per-block flattening. */
+  rule: 'global' | 'per-block'
+  /** Measured bold ratio: bold chars / visible (non-code) chars. */
+  ratio: number
+}
+
 /** Strip `**bold**` markers from a fragment, keeping the text. */
 function unbold(fragment: string): string {
   return fragment.replace(/\*\*([^*]+)\*\*/g, '$1')
@@ -778,16 +807,24 @@ function unbold(fragment: string): string {
  * Deliberately conservative:
  *   - Messages under 100 non-code characters are exempt (a short reply whose
  *     one key fact is bolded is exactly the house style).
- *   - A single-line fully-bolded paragraph of ≤48 chars is treated as a
- *     pseudo-heading (the "**Section**" label the fleet style encourages) and
- *     is NOT stripped by the per-block rule (it still counts toward the
- *     global ratio).
+ *   - A single-line fully-bolded paragraph of ≤PSEUDO_HEADING_MAX_CHARS chars
+ *     is treated as a pseudo-heading (the "**Section**" label the fleet style
+ *     encourages) and is NOT stripped — neither by the per-block rule NOR by
+ *     the global-ratio rule (it still counts toward the global ratio, so a
+ *     genuinely over-bolded message still trips, but its section headings
+ *     survive instead of the whole reply going plain).
  *   - A list with any non-fully-bolded item is left alone.
  *
  * Code spans/fences are masked (maskCodeRegions) and never counted or
  * modified. Idempotent: stripped output has no `**` spans left to trip on.
+ *
+ * `onStrip` is an optional diagnostic sink invoked exactly once, only when
+ * bold is actually removed, carrying which rule fired and the measured ratio.
  */
-export function stripExcessBold(text: string): string {
+export function stripExcessBold(
+  text: string,
+  onStrip?: (d: ExcessBoldStripDiagnostic) => void,
+): string {
   if (!text.includes('**')) return text
 
   const nonce = Math.random().toString(36).slice(2)
@@ -800,14 +837,24 @@ export function stripExcessBold(text: string): string {
 
   let boldChars = 0
   for (const m of visible.matchAll(/\*\*([^*]+)\*\*/g)) boldChars += m[1].length
+  const ratio = boldChars / visible.length
+
+  // Blank-line-delimited blocks of the masked text (shared by both rules).
+  const blocks = masked.split(/\n{2,}/)
 
-  if (boldChars / visible.length > 0.3) {
-    // Clearly over-bolded — strip every bold span, keep the text.
-    return restore(unbold(masked))
+  if (ratio > 0.3) {
+    // Clearly over-bolded — strip every bold span, keeping the text, EXCEPT
+    // standalone short pseudo-heading blocks (`**Section**`), which stay bold
+    // so a bold-dense digest keeps its section headings.
+    const rebuilt = blocks.map((block) =>
+      isPseudoHeadingBlock(block) ? block : unbold(block),
+    )
+    const out = rejoinBlocks(masked, rebuilt)
+    if (out !== masked) onStrip?.({ rule: 'global', ratio })
+    return restore(out)
   }
 
-  // Per-block check on blank-line-delimited blocks of the masked text.
-  const blocks = masked.split(/\n{2,}/)
+  // Per-block check on the same blocks.
   const rebuilt = blocks.map((block) => {
     const lines = block.split('\n').filter((l) => l.trim() !== '')
     if (lines.length === 0 || !block.includes('**')) return block
@@ -824,17 +871,25 @@ export function stripExcessBold(text: string): string {
     const isProseBlock = lines.every((l) => !isMarkerLine(l, placeholder))
     if (!isProseBlock) return block
     if (!lines.every((l) => isFullyBolded(l))) return block
-    if (lines.length === 1 && lines[0].trim().length <= 48) return block
+    if (isPseudoHeadingBlock(block)) return block
     return unbold(block)
   })
 
-  // Rejoin with the original gap shapes: split() lost them, so re-split the
-  // masked text capturing the separators and interleave.
+  const out = rejoinBlocks(masked, rebuilt)
+  if (out !== masked) onStrip?.({ rule: 'per-block', ratio })
+  return restore(out)
+}
+
+/**
+ * Rejoin blocks produced by `masked.split(/\n{2,}/)` after per-block mapping,
+ * restoring the ORIGINAL blank-gap shapes (split() drops the separators, so
+ * re-capture them from the masked source and interleave).
+ */
+function rejoinBlocks(masked: string, rebuilt: string[]): string {
   const seps = masked.match(/\n{2,}/g) ?? []
   let out = rebuilt[0] ?? ''
   for (let i = 1; i < rebuilt.length; i++) out += (seps[i - 1] ?? '\n\n') + rebuilt[i]
-
-  return restore(out)
+  return out
 }
 
 // ---------------------------------------------------------------------------

package/telegram-plugin/gateway/gateway.ts

@@ -550,6 +550,9 @@ import {
   handleModelCommand,
   classifyModelSwitchConfirmation,
   formatModelRelaunchDiagLog,
+  parseModelSwitchTarget,
+  resolveSessionModelResolutionTimeoutMs,
+  waitForSessionModelResolution,
   servedModelMatchesRequested,
   buildServedModelDivergenceHandler,
   deliverModelSwitchBootNotice,
@@ -564,7 +567,7 @@ import {
   MODEL_CALLBACK_PAGE_EXTERNAL,
   MODEL_CALLBACK_PAGE_MAIN,
   srFriendlyLabel,
-  expandSrAlias,
+  expandModelAlias,
   isSrModel,
   isBusyRefusalText,
   isOfflineTrustedModelToken,
@@ -16961,6 +16964,9 @@ function buildModelDeps(restartCtx?: ModelDepsRestartContext): ModelMenuDeps & M
       const data = switchroomExecJson<AgentListResp>(['agent', 'list'])
       return data?.agents?.find(a => a.name === getMyAgentName())?.model ?? null
     },
+    // Feeds the switch-time #1978 assessment (thinkingEffortCaveat); see the
+    // ModelCommandDeps.getConfiguredEffort doc for why doctor can't make it.
+    getConfiguredEffort: () => getConfiguredEffortForPersist(),
     escapeHtml: escapeHtmlForTg,
     preBlock,
     /**
@@ -17259,7 +17265,7 @@ function persistQueuedCommandForRestart(action: ShutdownResolutionAction): strin
         const configured =
           readConfiguredDefaultModel(agentDir) ?? resolveMainModel(undefined)
         // Consume-once carrier: applied by the next boot, then reverts.
-        writeSessionModelFile(agentDir, expandSrAlias(action.arg), configured)
+        writeSessionModelFile(agentDir, expandModelAlias(action.arg), configured)
         break
       }
       case 'clear-model':
@@ -23662,23 +23668,26 @@ async function startGateway(): Promise<void> {  // #2996 P0c: the boot IIFE, now
           }
         } catch {}
 
-        // ─── Session-model re-hydration + LiteLLM-down alert (session relaunch) ───
-        //
-        // start.sh writes the EFFECTIVE launched model to `.active-session-model`
-        // on every boot (the model actually passed to `claude --model`). Re-hydrate
-        // the in-memory session-model override from it so `/status` and the welcome
-        // card stay honest after a session-relaunch restart. Only treat it as an
-        // override when it differs from the configured/default model — a plain boot
-        // on the configured model leaves the override null.
-        //
-        // Also consume the `.session-model-alert` sentinel: start.sh drops it when
-        // it had to DROP an sr-* override because LiteLLM was unreachable at boot
-        // (booting on the configured default instead of 4xx-ing against Anthropic).
-        // We turn it into a loud Telegram message to the operator, then delete it.
+        // Rehydrate only after start.sh publishes this boot's resolved outputs.
         try {
           const smAgentDir = resolveAgentDirFromEnv()
           if (smAgentDir) {
-            const activePath = join(smAgentDir, '.active-session-model')
+            const resolutionTimeoutMs = resolveSessionModelResolutionTimeoutMs(
+              process.env.SWITCHROOM_SESSION_MODEL_RESOLUTION_TIMEOUT_MS,
+            )
+            const resolved = await waitForSessionModelResolution({
+              barrierExists: () => existsSync(join(smAgentDir, '.session-model-resolved')),
+              timeoutMs: resolutionTimeoutMs,
+            })
+            if (!resolved) {
+              const target = modelSwitchReason == null
+                ? '(none)'
+                : (parseModelSwitchTarget(modelSwitchReason) ?? '(unknown)')
+              process.stderr.write(
+                `telegram gateway: gw /model relaunch UNRESOLVED agent=${getMyAgentName()} target=${target} (barrier timeout after ${resolutionTimeoutMs}ms)\n`,
+              )
+            } else {
+              const activePath = join(smAgentDir, '.active-session-model')
             if (existsSync(activePath)) {
               try {
                 const launched = readFileSync(activePath, 'utf8').trim()
@@ -23694,21 +23703,9 @@ async function startGateway(): Promise<void> {  // #2996 P0c: the boot IIFE, now
                   // a phantom session override.
                   return resolveMainModel(raw ?? undefined)
                 })()
-                // `launched !== configured` is the DETERMINISTIC "a model switch
-                // landed" signal (F1): the carrier is consume-once, so a launched
-                // model that differs from the configured default only ever
-                // happens on a genuine apply-boot. Seed the in-memory override
-                // from it — this is the ONLY success reporting, sourced from the
-                // real post-boot signal (`.active-session-model`), never from a
-                // scraped pane or an optimistic record.
+                // A launched model differing from configured is a genuine apply boot.
                 const isApplyBoot = launched.length > 0 && launched !== configured
-                // { verify: true } (#3427 item 4 / H1): ONLY this site arms the
-                // requested-vs-served tripwire — `launched` IS the token of the
-                // session now serving. Command-time setOverride never arms.
                 sessionModelSource.setOverride(isApplyBoot ? launched : null, { verify: true })
-                // Boot /model cards (#3427): the divergence tripwire warn and
-                // the switch confirmation share one deps surface; the card
-                // logic lives in model-command.ts (#2996 ratchet).
                 const modelBootCardDeps: ModelBootCardDeps = {
                   agent: getMyAgentName(),
                   chat: modelSwitchMarkerChat,
@@ -23719,8 +23716,6 @@ async function startGateway(): Promise<void> {  // #2996 P0c: the boot IIFE, now
                 if (isApplyBoot) {
                   sessionModelSource.setDivergenceHandler(buildServedModelDivergenceHandler(modelBootCardDeps))
                 }
-                // F1/N4: classify + log + one confirmation card. Formatters live
-                // in model-command.ts so this file does not inflate (#2996 ratchet).
                 const confirmation = modelSwitchReason != null
                   ? classifyModelSwitchConfirmation({
                       reason: modelSwitchReason,
@@ -23790,6 +23785,7 @@ async function startGateway(): Promise<void> {  // #2996 P0c: the boot IIFE, now
                 process.stderr.write(`telegram gateway: session-model: LiteLLM-down override drop — ${alertText}\n`)
               }
             }
+            }
           }
         } catch (err) {
           process.stderr.write(`telegram gateway: session-model re-hydration failed: ${(err as Error)?.message ?? String(err)}\n`)

package/telegram-plugin/gateway/ipc-server.ts

@@ -25,6 +25,7 @@ import type {
   ToolCallResult,
 } from "./ipc-protocol.js";
 import { RICH_MESSAGE_MAX_CHARS } from "../format.js";
+import { OPERATOR_EVENT_KINDS } from "../operator-events.js";
 
 export interface IpcServerOptions {
   socketPath: string;
@@ -196,21 +197,23 @@ type SocketData = { clientId: string; buffer: string };
  *  data without newline delimiters, which would cause unbounded memory growth. */
 const MAX_BUFFER_SIZE = 1024 * 1024;
 
-/** Allowlist of OperatorEventKind values that can arrive over IPC. Mirrors
- *  the union in `telegram-plugin/operator-events.ts` — kept as a literal Set
- *  here so the validator has zero cross-package type dependencies. If the
- *  taxonomy grows, update both places. */
-const VALID_OPERATOR_KINDS = new Set([
-  "credentials-expired",
-  "credentials-invalid",
-  "credit-exhausted",
-  "quota-exhausted",
-  "rate-limited",
-  "agent-crashed",
-  "agent-restarted-unexpectedly",
-  "unknown-4xx",
-  "unknown-5xx",
-]);
+/** Allowlist of OperatorEventKind values that can arrive over IPC. DERIVED
+ *  from the canonical `OPERATOR_EVENT_KINDS` array in
+ *  `telegram-plugin/operator-events.ts` — the single source of truth for the
+ *  taxonomy — so the validator can NEVER drift out of sync with it again.
+ *
+ *  History: this used to be a hand-maintained literal Set that missed the
+ *  `provider-credit-exhausted` / `mcp-dependency-blocked` / `proxy-misconfig`
+ *  kinds after they were added to the union. The bridge forwarded a
+ *  `provider-credit-exhausted` operator_event; this validator rejected it as an
+ *  "invalid IPC message shape" and dropped it, so an OpenRouter/LiteLLM 402
+ *  credit wall produced NO loud Telegram card (the 2026-07-30 incident).
+ *  Deriving from the canonical array closes that drift class structurally.
+ *
+ *  `operator-events.ts` is a pure module (its only imports are the pure
+ *  `format` / `raw-error-scrub` / `model-unavailable` / `provider-credit`
+ *  leaves), so importing it here introduces no cycle back into the gateway. */
+const VALID_OPERATOR_KINDS = new Set<string>(OPERATOR_EVENT_KINDS);
 
 /** Same regex as `assertSafeAgentName` and the op:* callback handler in
  *  gateway.ts — keeps every entry-point that touches an agent name on the