switchroom 0.19.35 → 0.19.37

package/telegram-plugin/secret-detect/inert-values.ts

@@ -0,0 +1,147 @@
+/**
+ * Inert VALUES — placeholders, variable references and already-masked
+ * text that occupy a credential-shaped slot without being a credential.
+ *
+ * Masking one of these buys nothing and costs real information:
+ *
+ *   - `POSTGRES_PASSWORD: vault:pg/password` — the vault KEY NAME is
+ *     precisely what an agent is supposed to remember. Redacting it
+ *     deletes the pointer and keeps nothing.
+ *   - `JWT_SECRET=<generate-with-openssl-rand>` — an instruction.
+ *   - `const API_KEY = process.env.ANTHROPIC_API_KEY` — a reference.
+ *
+ * Before #3982's review this list existed only inside the new
+ * `memorable_password` rule, so letter case decided the outcome:
+ * `password: ${DB_PASSWORD}` survived while `PASSWORD: ${DB_PASSWORD}`
+ * (matched by the ALL-CAPS `env_key_value` rule) was destroyed. Every
+ * rule whose capture is a LABELLED slot now shares the list —
+ * `env_key_value`, `json_secret_field`, `cli_flag` and
+ * `memorable_password`.
+ *
+ * Mirrored in `vendor/hindsight-memory/scripts/lib/secret_redact.py`
+ * (`_INERT_VALUE_RES` / `_INERT_GATED_RULES`) and pinned across both
+ * engines by `secret_redaction_vectors.json`.
+ */
+
+export const INERT_VALUE_RE = [
+  // Our own marker (idempotence). `maskToken` only ever emits
+  // `[REDACTED]` or `[REDACTED:<rule_id>]`, so the closing bracket is
+  // part of the shape.
+  /^\[REDACTED(?::[A-Za-z0-9_]+)?\]$/i,
+  /^\$\{?[A-Za-z_][A-Za-z0-9_]*\}?$/, // $PASSWORD, ${DB_PASSWORD}
+  // `.` is spelled out: JS `.` and Python `.` exclude different line
+  // terminators, and the two engines must agree byte for byte.
+  /^\{\{[^\n\r\u2028\u2029]*\}\}$/, // {{ handlebars }}
+  /^<[^<>\n\r\u2028\u2029]*>$/, // <your-password-here>
+  /^%[A-Za-z_][A-Za-z0-9_]*%$/, // %PASSWORD% (Windows)
+  /^vault:[A-Za-z0-9_./-]*$/i, // switchroom vault reference
+  /^[*x•.]+$/i, // ***, xxxx, ••••
+  // Code reference — `process.env.FOO`, `import.meta.env.VITE_X`,
+  // `os.environ["FOO"]`. The member path is PART OF THE SHAPE: a bare
+  // prefix followed by anything else is not a reference.
+  /^(?:process\.env|import\.meta\.env|os\.environ)(?:\.[A-Za-z_$][A-Za-z0-9_$]*|\[["']?[A-Za-z_$][A-Za-z0-9_$]*["']?\])*$/,
+  // Well-known "fill this in" values. A live credential never begins
+  // with the word telling you to replace it.
+  /^(?:changeme|change-me|replaceme|replace-me|placeholder|todo|tbd|yourkey|your-key|yourpassword|your-password|yoursecret|your-secret|yourtoken|your-token)(?:[-_][A-Za-z0-9-]+)?$/i,
+  // A lowercase English phrase — a help string or a JSON doc value such
+  // as `{"token": "the bearer token to use"}`, never a credential.
+  /^[a-z]+(?: [a-z]+){2,}$/,
+]
+
+/**
+ * An unbroken run of `[A-Za-z0-9]` long enough to BE a credential.
+ *
+ * Placeholder text is words joined by separators (`your-password-here`,
+ * `generate-with-openssl-rand`, `pg/password`, `ANTHROPIC_API_KEY`) — the
+ * longest alphanumeric run across every value this list protects is 10
+ * (`production`). A credential is the opposite shape: one dense run.
+ */
+const CREDENTIAL_RUN_RE = /[A-Za-z0-9]{12,}/g
+
+/**
+ * Mixed-class floor — `ENV_KV_MIN_LEN`, the length below which the env
+ * scanner already declines to call something a secret. Must not exceed
+ * `CREDENTIAL_RUN_RE`'s own floor.
+ */
+const MIXED_CLASS_RUN_MIN = 12
+
+/**
+ * Single-class floor. A run of only letters or only digits is far more
+ * likely to be an English word than a credential (`authentication`,
+ * `configuration`), so it gets more rope — but not unlimited rope:
+ * `abcdefghijklmnop` and a 40-`x` filler are values `main` masked, and no
+ * word in the protected corpus reaches 16.
+ */
+const SINGLE_CLASS_RUN_MIN = 16
+
+function runIsCredentialShaped(run: string): boolean {
+  // Classes present among {lower, upper, digit}. Hex, base62 and
+  // CamelCase-with-digits tokens are two or three; `yourtokenhere` and
+  // the segments of `YOUR_TOKEN_HERE` are one.
+  let classes = 0
+  if (/[a-z]/.test(run)) classes++
+  if (/[A-Z]/.test(run)) classes++
+  if (/[0-9]/.test(run)) classes++
+  return (
+    run.length >= (classes >= 2 ? MIXED_CLASS_RUN_MIN : SINGLE_CLASS_RUN_MIN)
+  )
+}
+
+/**
+ * True when `value` carries a credential-shaped run anywhere inside it.
+ *
+ * #3982 review, MAJOR 7. The inert SHAPES above are necessary but not
+ * sufficient: `<a8f3…40 hex…>` and `{{tok_…}}` are legal instances of the
+ * `<…>` / `{{…}}` shapes, and a wrapper left behind after someone filled
+ * the value in (`vault:pg/password<secret>`, `[REDACTED]<secret>`,
+ * `changeme-<secret>`) turned a false-positive fix into a bypass of
+ * already-shipped coverage. "Inert shape AND carries no credential" is
+ * the property actually wanted; end-anchoring alone is not enough,
+ * because `<secret>` is a well-formed instance of the shape.
+ */
+export function hasCredentialShapedRun(value: string): boolean {
+  for (const run of value.match(CREDENTIAL_RUN_RE) ?? []) {
+    if (runIsCredentialShaped(run)) return true
+  }
+  return false
+}
+
+/** True when `value` is a placeholder / reference rather than a secret. */
+export function isInertValue(value: string): boolean {
+  if (!INERT_VALUE_RE.some((re) => re.test(value))) return false
+  return !hasCredentialShapedRun(value)
+}
+
+/**
+ * Rule ids whose captured value is a labelled slot, and which therefore
+ * honour `isInertValue`. Keep in sync with `_INERT_GATED_RULES` in
+ * `secret_redact.py`.
+ */
+export const INERT_GATED_RULES = new Set([
+  'env_key_value',
+  'json_secret_field',
+  'cli_flag',
+])
+
+/**
+ * The heuristic KEY=VALUE scanner honours the same list — it is the rule
+ * that ate `ANTHROPIC_API_KEY: vault:anthropic/api_key` and
+ * `const API_KEY = process.env.ANTHROPIC_API_KEY`. Kept as its own
+ * export because `scanKeyValue` applies it directly rather than through
+ * the `ALL_PATTERNS` loop.
+ */
+export const KV_ENTROPY_RULE_ID = 'kv_entropy'
+
+/**
+ * Trailing punctuation an English sentence puts AFTER a value. The value
+ * character classes are `[^\s"']`-shaped, so a sentence-final `.` or a
+ * list comma is swallowed INTO the value — and a `.` alone supplies a
+ * second character class, which is what made
+ * "The password is required." redact as a credential (#3982 review,
+ * BLOCKER 2).
+ */
+const TRAILING_PUNCT_RE = /[.,;:!?)\]}]+$/
+
+export function stripTrailingPunctuation(value: string): string {
+  return value.replace(TRAILING_PUNCT_RE, '')
+}

package/telegram-plugin/secret-detect/kv-scanner.ts

@@ -13,6 +13,7 @@
  * `key=value` match), so the rewriter can preserve the `key=` prefix.
  */
 import { shannonEntropy } from './entropy.js'
+import { isInertValue, stripTrailingPunctuation } from './inert-values.js'
 
 export interface RawHit {
   rule_id: string
@@ -31,6 +32,107 @@ const KV_RE = /\b([A-Za-z_][A-Za-z0-9_-]*(?:password|passwd|token|secret|key|api
 
 export const KV_ENTROPY_THRESHOLD = 4.0
 
+// ─── Human-memorable passwords ────────────────────────────────────────
+//
+// Gap closed (2026-07 hindsight write-path audit): a password a human can
+// remember — family names + a year, a two-word phrase with a digit — has
+// Shannon entropy well under KV_ENTROPY_THRESHOLD, so `scanKeyValue` above
+// skips it and it was stored in agent memory verbatim.
+//
+// Lowering KV_ENTROPY_THRESHOLD is NOT the fix: that threshold guards a
+// wide LHS set (`key`, `token`, `secret`, `api_key`, and any identifier
+// ending in them), where dropping the entropy floor would mask ordinary
+// prose and config chatter wholesale.
+//
+// Instead this is a SEPARATE, much narrower rule:
+//
+//   * the LHS must be the password family specifically — `password`,
+//     `passwd`, `passphrase`, `pwd` (optionally prefixed, e.g.
+//     `db_password`). Not `key`/`token`/`secret`.
+//   * the connector is `:`/`=` or the literal word `is` (so "the wifi
+//     password is <value>" is covered, which is how a human actually
+//     writes one down).
+//   * the value must LOOK like a chosen credential rather than a word:
+//     8..64 bytes, no whitespace, and at least two distinct character
+//     classes of {lower, upper, digit, symbol}.
+//
+// The two-class gate is what keeps ordinary prose out — but ONLY once
+// trailing punctuation has been stripped off the candidate value.
+//
+// #3982 review, BLOCKER 2: the value class is `[^\s"']`, so a sentence
+// swallows its own terminator into the match. "The password is
+// required." captured `required.` — lowercase letters PLUS a `.`, which
+// is two character classes — and redacted as a credential. Same for
+// `incorrect.`, `unchanged.`, and for a list comma in
+// "password: required, minimum twelve characters". Sentence-final is the
+// single most common position for those words, so the original comment
+// here ("single-class lowercase and never match") was not just wrong, it
+// was wrong about the common case: "Ken confirmed the password is
+// unchanged." stored as "…the password is [REDACTED:memorable_password]",
+// which INVERTS the meaning of the sentence it corrupts.
+//
+// `looksLikeMemorablePassword` therefore runs its length / distinct-char
+// / character-class gates against the punctuation-stripped core, while
+// the MASK still covers the whole captured value (a trailing `!` is more
+// likely the last byte of the password than the end of a sentence).
+//
+// The deliberate trade that remains: a single-class credential such as an
+// all-lowercase passphrase still slips through. That is the conservative
+// side of the line — over-redacting prose corrupts stored conversation and
+// is unrecoverable, whereas this rule's misses are the pre-existing
+// behaviour, not a regression.
+const MEMORABLE_PW_RE =
+  /\b([A-Za-z0-9_-]*(?:password|passwd|passphrase|pwd))\b\s*(?:[:=]\s*|\s+is\s+)(["']?)([^\s"']{8,64})\2/gi
+
+export const MEMORABLE_PW_RULE_ID = 'memorable_password'
+
+/** Minimum distinct character classes for a value to look chosen-by-a-human. */
+export const MEMORABLE_PW_MIN_CLASSES = 2
+
+function charClassCount(value: string): number {
+  let n = 0
+  if (/[a-z]/.test(value)) n++
+  if (/[A-Z]/.test(value)) n++
+  if (/[0-9]/.test(value)) n++
+  if (/[^A-Za-z0-9]/.test(value)) n++
+  return n
+}
+
+/** True when `value` looks like a human-chosen password, not prose. */
+export function looksLikeMemorablePassword(value: string): boolean {
+  if (isInertValue(value)) return false
+  // Gate on the value WITHOUT the sentence punctuation it swallowed.
+  const core = stripTrailingPunctuation(value)
+  if (core.length < 8 || core.length > 64) return false
+  if (isInertValue(core)) return false
+  // A single repeated character is a mask, not a password.
+  if (new Set(core).size < 4) return false
+  return charClassCount(core) >= MEMORABLE_PW_MIN_CLASSES
+}
+
+export function scanMemorablePasswords(text: string): RawHit[] {
+  const hits: RawHit[] = []
+  MEMORABLE_PW_RE.lastIndex = 0
+  let m: RegExpExecArray | null
+  while ((m = MEMORABLE_PW_RE.exec(text)) !== null) {
+    const keyName = m[1]!
+    const value = m[3]
+    if (!value || !looksLikeMemorablePassword(value)) continue
+    const valueOffsetInMatch = m[0].indexOf(value, keyName.length)
+    if (valueOffsetInMatch < 0) continue
+    const start = m.index + valueOffsetInMatch
+    hits.push({
+      rule_id: MEMORABLE_PW_RULE_ID,
+      start,
+      end: start + value.length,
+      matched_text: value,
+      key_name: keyName,
+      confidence: 'ambiguous',
+    })
+  }
+  return hits
+}
+
 export function scanKeyValue(text: string): RawHit[] {
   const hits: RawHit[] = []
   KV_RE.lastIndex = 0
@@ -38,6 +140,12 @@ export function scanKeyValue(text: string): RawHit[] {
   while ((m = KV_RE.exec(text)) !== null) {
     const [, keyName, value] = m
     if (!value) continue
+    // Placeholders / references are not credentials — see inert-values.ts.
+    // `ANTHROPIC_API_KEY: vault:anthropic/api_key` and
+    // `const API_KEY = process.env.ANTHROPIC_API_KEY` both land HERE, not
+    // on the ALL_CAPS `env_key_value` pattern, and both were being
+    // destroyed (#3982 review, MAJOR 5).
+    if (isInertValue(value)) continue
     // Shannon entropy gate — only flag values that actually look random.
     const h = shannonEntropy(value)
     if (h < KV_ENTROPY_THRESHOLD) continue

package/telegram-plugin/secret-detect/patterns.ts

@@ -94,20 +94,40 @@ export const STRUCTURED_PATTERNS: PatternDef[] = [
     captureIndex: 2,
     slugHint: 'cli_flag',
   },
-  // Authorization: Bearer token (form 1 — explicit Authorization header)
+  // Authorization: Bearer token (form 1 — explicit Authorization header).
+  //
+  // CASE-INSENSITIVE since #3982's review: HTTP/2 and HTTP/3 lowercase
+  // every header name on the wire, so `authorization: bearer <token>` is
+  // what an agent actually pastes out of a curl trace or a proxy log —
+  // and it sailed through both engines unmasked. RFC 9110 makes the
+  // header name case-insensitive and the auth SCHEME token
+  // case-insensitive too, so matching case-sensitively was simply wrong.
   {
     rule_id: 'bearer_auth_header',
-    regex: /Authorization\s*[:=]\s*Bearer\s+([A-Za-z0-9._\-+=]+)/g,
+    regex: /Authorization\s*[:=]\s*Bearer\s+([A-Za-z0-9._\-+=]+)/gi,
     captureIndex: 1,
     slugHint: 'bearer_token',
   },
-  // Bare "Bearer XYZ" (length-gated to cut false positives on the word "Bearer")
+  // Bare "Bearer XYZ" (length-gated to cut false positives on the word
+  // "Bearer"). The 18-char floor is what keeps the now case-insensitive
+  // match off prose like "the bearer token to use".
   {
     rule_id: 'bearer_loose',
-    regex: /\bBearer\s+([A-Za-z0-9._\-+=]{18,})\b/g,
+    regex: /\bBearer\s+([A-Za-z0-9._\-+=]{18,})\b/gi,
     captureIndex: 1,
     slugHint: 'bearer_token',
   },
+  // Authorization: Basic <base64(user:password)>. Base64 is an encoding,
+  // not a cipher — a Basic header is a plaintext credential with extra
+  // steps, and it reached agent memory unmasked (#3982 review, MAJOR 6).
+  // Anchored on the header + scheme, so a bare base64 blob elsewhere in
+  // the text is untouched (that stays a documented gap).
+  {
+    rule_id: 'basic_auth_header',
+    regex: /Authorization\s*[:=]\s*Basic\s+([A-Za-z0-9+/=]{8,})/gi,
+    captureIndex: 1,
+    slugHint: 'basic_auth',
+  },
   // PEM private key block — single greedy capture, non-overlapping.
   {
     rule_id: 'pem_private_key',

package/telegram-plugin/tests/format-consistency.test.ts

@@ -245,6 +245,24 @@ describe('normalizePunctuation', () => {
     expect(normalizePunctuation('<not—a—url>')).toBe('<not, a, url>')
   })
 
+  test('does NOT rewrite a dash inside a `>` blockquote (verbatim quote)', () => {
+    // `>` blockquotes hold quoted text the author is reproducing verbatim;
+    // rewriting their em-dash to `, ` corrupts the quotation.
+    expect(normalizePunctuation('> she said — plainly — no')).toBe(
+      '> she said — plainly — no',
+    )
+    // Indented blockquote line is still a blockquote.
+    expect(normalizePunctuation('  > quoted — text')).toBe('  > quoted — text')
+    // The expandable-blockquote opener `**>` is a blockquote line too.
+    expect(normalizePunctuation('**> first — line\n> continues — here')).toBe(
+      '**> first — line\n> continues — here',
+    )
+    // Prose OUTSIDE the quote still normalizes; only the quoted line is spared.
+    expect(normalizePunctuation('intro — here\n> quote — verbatim\nafter — end')).toBe(
+      'intro, here\n> quote — verbatim\nafter, end',
+    )
+  })
+
   test('idempotent', () => {
     const once = normalizePunctuation('a — b\n• c\nd—e\n1–2')
     expect(normalizePunctuation(once)).toBe(once)
@@ -334,4 +352,97 @@ describe('stripExcessBold', () => {
     const once = stripExcessBold(input)
     expect(stripExcessBold(once)).toBe(once)
   })
+
+  // ── Heading exemption in the GLOBAL (>30%) rule ──────────────────────────
+  // A bold-dense digest tripped the global ratio and lost EVERY bold marker,
+  // including its section headings, with no signal. Short standalone
+  // pseudo-heading blocks must now survive the global strip.
+
+  const boldDenseBody =
+    '**alpha** **bravo** **charlie** **delta** **echo** **foxtrot** **golf** ' +
+    '**hotel** **india** **juliet** **kilo** **lima** plus a short plain tail here.'
+
+  test('global strip keeps a short standalone bold heading, strips the rest', () => {
+    const input = `**Section One**\n\n${boldDenseBody}`
+    const out = stripExcessBold(input)
+    // Heading survives.
+    expect(out).toContain('**Section One**')
+    // Non-heading inline bold is flattened.
+    expect(out).toContain('alpha')
+    expect(out).not.toContain('**alpha**')
+    expect(out).not.toContain('**golf**')
+  })
+
+  test('global strip preserves EVERY heading in a multi-section digest', () => {
+    const input =
+      `**Overview**\n\n${boldDenseBody}\n\n` +
+      `**Next steps:**\n\n**one** **two** **three** **four** **five** **six** ` +
+      'plus a plain closing clause long enough to matter here.'
+    const out = stripExcessBold(input)
+    expect(out).toContain('**Overview**')
+    expect(out).toContain('**Next steps:**')
+    expect(out).not.toContain('**one**')
+    expect(out).not.toContain('**six**')
+  })
+
+  test('regression: global strip with NO headings still fully strips', () => {
+    const input = `${boldDenseBody}`
+    const out = stripExcessBold(input)
+    expect(out).not.toContain('**')
+    expect(out).toContain('alpha')
+  })
+
+  test('regression: under-threshold message keeps all bold (incl. headings)', () => {
+    const input = `**Summary**\n\n${filler} The key fact is **42**.`
+    expect(stripExcessBold(input)).toBe(input)
+  })
+
+  test('48/49-char pseudo-heading boundary honoured under global strip', () => {
+    // Heading length is measured WITH the `**` markers. 44 inner chars → 48
+    // total (exempt); 45 inner chars → 49 total (stripped).
+    const heading48 = '**' + 'H'.repeat(44) + '**' // length 48
+    const heading49 = '**' + 'H'.repeat(45) + '**' // length 49
+    expect(heading48.length).toBe(48)
+    expect(heading49.length).toBe(49)
+
+    const out48 = stripExcessBold(`${heading48}\n\n${boldDenseBody}`)
+    expect(out48).toContain(heading48)
+
+    const out49 = stripExcessBold(`${heading49}\n\n${boldDenseBody}`)
+    expect(out49).not.toContain(heading49)
+    expect(out49).toContain('H'.repeat(45))
+  })
+
+  test('multi-line fully-bolded block is NOT mislabelled a heading (global)', () => {
+    // Two bolded lines in one block must be flattened, not exempted — the
+    // heading exemption is single-line only.
+    const input = `**First bold line here**\n**Second bold line here**\n\n${boldDenseBody}`
+    const out = stripExcessBold(input)
+    expect(out).not.toContain('**First bold line here**')
+    expect(out).toContain('First bold line here')
+  })
+
+  // ── Observability ────────────────────────────────────────────────────────
+  test('onStrip fires with rule=global + ratio when global rule strips', () => {
+    const calls: Array<{ rule: string; ratio: number }> = []
+    stripExcessBold(`**Section One**\n\n${boldDenseBody}`, (d) => calls.push(d))
+    expect(calls).toHaveLength(1)
+    expect(calls[0].rule).toBe('global')
+    expect(calls[0].ratio).toBeGreaterThan(0.3)
+  })
+
+  test('onStrip fires with rule=per-block when only a block is flattened', () => {
+    const calls: Array<{ rule: string; ratio: number }> = []
+    const input = `${filler}\n\n**This whole paragraph is bold.**\n**Every single line of it.**`
+    stripExcessBold(input, (d) => calls.push(d))
+    expect(calls).toHaveLength(1)
+    expect(calls[0].rule).toBe('per-block')
+    expect(calls[0].ratio).toBeLessThanOrEqual(0.3)
+  })
+
+  test('onStrip does NOT fire when nothing is stripped', () => {
+    const calls: Array<{ rule: string; ratio: number }> = []
+    stripExcessBold(`**Summary**\n\n${filler} The key fact is **42**.`, (d) => calls.push(d))
+    expect(calls).toHaveLength(0)
+  })
 })

package/telegram-plugin/tests/gateway-session-model-relaunch.test.ts

@@ -21,6 +21,8 @@ import {
   classifyModelSwitchConfirmation,
   formatModelRelaunchDiagLog,
   resolveModelSwitchBootNotice,
+  resolveSessionModelResolutionTimeoutMs,
+  waitForSessionModelResolution,
 } from '../gateway/model-command.js'
 
 const __dirname = dirname(fileURLToPath(import.meta.url))
@@ -147,6 +149,39 @@ describe('gateway: the live callback dispatcher routes every switch tap to the h
 })
 
 describe('gateway boot: session-model re-hydration + confirmation + alert relay', () => {
+  it('does not classify stale previous-boot state before the resolution barrier', async () => {
+    const staleLaunched = 'claude-opus-4-8'
+    const configured = 'claude-opus-4-8'
+    const reason = 'user: /model fable (session-only relaunch, menu)'
+    const resolved = await waitForSessionModelResolution({
+      barrierExists: () => false,
+      timeoutMs: 0,
+    })
+    const confirmation = resolved
+      ? classifyModelSwitchConfirmation({ reason, launched: staleLaunched, configured })
+      : null
+    expect(resolved).toBe(false)
+    expect(confirmation).toBeNull()
+  })
+
+  it('waits asynchronously until the resolution barrier appears', async () => {
+    let checks = 0
+    const resolved = await waitForSessionModelResolution({
+      barrierExists: () => ++checks >= 2,
+      timeoutMs: 1_000,
+      sleep: async () => {},
+    })
+    expect(resolved).toBe(true)
+    expect(checks).toBe(2)
+  })
+
+  it('uses a safe default for absent or invalid barrier timeout overrides', () => {
+    expect(resolveSessionModelResolutionTimeoutMs(undefined)).toBe(180_000)
+    expect(resolveSessionModelResolutionTimeoutMs('not-a-number')).toBe(180_000)
+    expect(resolveSessionModelResolutionTimeoutMs('-1')).toBe(180_000)
+    expect(resolveSessionModelResolutionTimeoutMs('2500')).toBe(2_500)
+  })
+
   it('re-hydrates the override from .active-session-model (launched !== configured)', () => {
     const idx = GATEWAY_SRC.indexOf("join(smAgentDir, '.active-session-model')")
     expect(idx).toBeGreaterThan(0)
@@ -295,9 +330,12 @@ describe('gateway boot: session-model re-hydration + confirmation + alert relay'
   })
 
   it('wires the pipeline into the boot rehydration (gateway calls classify → diag log → notice)', () => {
-    const idx = GATEWAY_SRC.indexOf('const isApplyBoot = launched.length > 0')
+    const idx = GATEWAY_SRC.indexOf('const resolutionTimeoutMs = resolveSessionModelResolutionTimeoutMs(')
     expect(idx).toBeGreaterThan(0)
-    const win = GATEWAY_SRC.slice(idx, idx + 4200)
+    const win = GATEWAY_SRC.slice(idx, idx + 7000)
+    expect(win).toContain('waitForSessionModelResolution({')
+    expect(win).toContain('if (!resolved) {')
+    expect(win).toContain('gw /model relaunch UNRESOLVED')
     expect(win).toContain('classifyModelSwitchConfirmation({')
     expect(win).toContain('formatModelRelaunchDiagLog')
     expect(win).toContain('if (confirmation != null)')

package/telegram-plugin/tests/ipc-server-validate-operator.test.ts

@@ -13,18 +13,13 @@
 
 import { describe, it, expect } from 'vitest'
 import { validateClientMessage } from '../gateway/ipc-server.js'
+import { OPERATOR_EVENT_KINDS } from '../operator-events.js'
 
-const VALID_KINDS = [
-  'credentials-expired',
-  'credentials-invalid',
-  'credit-exhausted',
-  'quota-exhausted',
-  'rate-limited',
-  'agent-crashed',
-  'agent-restarted-unexpectedly',
-  'unknown-4xx',
-  'unknown-5xx',
-]
+// Drift-proof: iterate the CANONICAL taxonomy the validator now derives its
+// allowlist from, not a hand-copied literal. A kind added to
+// OPERATOR_EVENT_KINDS is automatically covered here; a validator that fails
+// to accept any canonical kind fails this test.
+const VALID_KINDS = OPERATOR_EVENT_KINDS
 
 function base() {
   return {
@@ -43,6 +38,20 @@ describe('validateClientMessage — operator_event', () => {
     }
   })
 
+  // Regression for the 2026-07-30 silent-out-of-credits incident: these three
+  // kinds were added to the OperatorEventKind union but NOT to the gateway IPC
+  // validator's hand-maintained allowlist. The bridge forwarded a
+  // `provider-credit-exhausted` operator_event; the validator rejected it as an
+  // "invalid IPC message shape" and dropped it, so an OpenRouter/LiteLLM 402
+  // credit wall produced NO loud Telegram card. Named explicitly (not just via
+  // the canonical-list loop above) so the failure message points straight at
+  // the incident if the allowlist ever regresses to a hand-maintained literal.
+  it('accepts the operator-actionable kinds forwarded by the bridge over IPC', () => {
+    for (const kind of ['provider-credit-exhausted', 'mcp-dependency-blocked', 'proxy-misconfig']) {
+      expect(validateClientMessage({ ...base(), kind }), kind).toBe(true)
+    }
+  })
+
   it('rejects unknown kinds', () => {
     expect(validateClientMessage({ ...base(), kind: 'something-else' })).toBe(false)
     expect(validateClientMessage({ ...base(), kind: '' })).toBe(false)

package/telegram-plugin/tests/mcp-instructions-budget.test.ts

@@ -162,8 +162,15 @@ describe("moved instruction content landed in tool descriptions", () => {
 
   it("format modes landed in the reply description", () => {
     expect(bridgeCode).toContain("FORMAT:");
-    expect(bridgeCode).toMatch(/default format is "html"/);
+    // The description must describe the ONE real render path (rich GFM), and
+    // still name the legacy aliases so the enum values stay documented. It must
+    // NOT resurrect the deleted-engine claims (html→HTML conversion, MarkdownV2
+    // auto-escaping) — those are false at HEAD (single GFM path, no escaping).
+    expect(bridgeCode).toMatch(/rich GFM markdown/);
     expect(bridgeCode).toContain("markdownv2");
+    expect(bridgeCode).not.toMatch(/default format is "html"/);
+    expect(bridgeCode).not.toMatch(/auto-converted to Telegram HTML/);
+    expect(bridgeCode).not.toMatch(/MarkdownV2 with auto-escaping/);
   });
 
   it("history-buffer rationale landed in get_recent_messages", () => {

package/telegram-plugin/tests/outbound-send-path.test.ts

@@ -379,7 +379,7 @@ describe('outbound-send-path — temporal pass wiring (#3501)', () => {
   it('temporal runs AFTER punctuation/bold and BEFORE scrubVoice (structural pin)', () => {
     const src = readFileSync(new URL('../gateway/outbound-send-path.ts', import.meta.url), 'utf8')
     const start = src.indexOf('export function normalizeOutboundBody(')
-    const boldIdx = src.indexOf('stripExcessBold(normalizePunctuation(text))', start)
+    const boldIdx = src.indexOf('stripExcessBold(normalizePunctuation(text),', start)
     const temporalIdx = src.indexOf('normalizeTemporal(text, tz, nowMs)', start)
     const scrubIdx = src.indexOf('scrubVoice(text)', start)
     expect(boldIdx).toBeGreaterThan(start)

package/telegram-plugin/tests/render/unsupported-token-guard.test.ts

@@ -71,15 +71,46 @@ describe("guardUnsupportedTokens — deterministic send-time repair", () => {
     expect(guardUnsupportedTokens("x^2^ metres")).toBe("x2 metres");
   });
 
-  it("leaves in-prose bracket literals intact, repairs real numeric footnotes", () => {
-    // `array[^index]` is a negated-char-class / index literal, not a footnote.
-    expect(guardUnsupportedTokens("array[^index] lookup")).toBe(
-      "array[^index] lookup",
+  it("repairs alphanumeric footnote markers, not just numeric", () => {
+    // POLISH-4: widened from digits-only so `[^note]`/`[^ref]` no longer ship
+    // as literal bracket noise. Each would survive UNTOUCHED on origin/main.
+    expect(guardUnsupportedTokens("see the note[^note] here")).toBe(
+      "see the note here",
+    );
+    expect(guardUnsupportedTokens("as shown[^ref] above")).toBe(
+      "as shown above",
+    );
+    expect(guardUnsupportedTokens("point[^fn1] made")).toBe("point made");
+    // A single-letter id is a footnote too.
+    expect(guardUnsupportedTokens("claim[^a] holds")).toBe("claim holds");
+    // Definition lines with an alphanumeric id are still left intact (`(?!:)`).
+    expect(guardUnsupportedTokens("[^note]: the definition")).toBe(
+      "[^note]: the definition",
     );
+  });
+
+  it("leaves regex-literal negated char classes intact", () => {
+    // Real negated char classes contain punctuation / ranges / escapes, so the
+    // alphanumeric-only id requirement excludes them — these stay verbatim.
     expect(guardUnsupportedTokens("use [^/] to match")).toBe(
       "use [^/] to match",
     );
-    // A real numeric footnote marker is still stripped.
+    expect(guardUnsupportedTokens("strip [^a-z] chars")).toBe(
+      "strip [^a-z] chars",
+    );
+    expect(guardUnsupportedTokens('match [^"] here')).toBe('match [^"] here');
+    // Accepted tradeoff (task POLISH-4): a PURE-alphanumeric negated class in
+    // BARE prose like `array[^index]` is now treated as a footnote and stripped.
+    // This is rare — regex/index literals in real prose live in code spans,
+    // which splitProtectedSegments masks (see code-span test below).
+    expect(guardUnsupportedTokens("array[^index] lookup")).toBe("array lookup");
+    // …but inside a code span the same literal is untouched.
+    expect(guardUnsupportedTokens("`array[^index]` lookup")).toBe(
+      "`array[^index]` lookup",
+    );
+  });
+
+  it("repairs a real numeric footnote marker", () => {
     expect(guardUnsupportedTokens("see the note[^1] here")).toBe(
       "see the note here",
     );