switchroom 0.19.41 → 0.19.43

package/telegram-plugin/tests/nested-prefix-indent.test.ts

@@ -0,0 +1,115 @@
+import { describe, it, expect } from 'vitest'
+import { renderStatusCard } from '../tool-activity-summary.js'
+import { NESTED_PREFIX } from '../status-no-truncate.js'
+import { COLLAPSE_SAFE_SEPARATOR } from '../card-format.js'
+
+/**
+ * #3668 — the nested (foreground sub-agent) child block must actually LOOK
+ * nested on a phone.
+ *
+ * `NESTED_PREFIX` used to be three ASCII spaces plus `↳ `. Card bodies reach
+ * Telegram as GFM markdown parsed SERVER-SIDE, and that parser left-trims a
+ * leading whitespace run off a content line, so the indent was dropped on the
+ * wire and every child step rendered FLAT against its parent's steps — the
+ * whole nesting cue reduced to one `↳` glyph.
+ *
+ * The replacement is the repo's already-live-verified indent idiom, U+2800
+ * BRAILLE PATTERN BLANK: general category So (Symbol, other), not Zs, so no
+ * whitespace-trimming rule can classify it as whitespace, yet it renders as
+ * blank width. Evidence, in order of strength:
+ *
+ *   1. LIVE: on 2026-07-26 four candidate indents were sent to a real phone in
+ *      one message (recorded at `status-no-truncate.ts`, WORKER_STEP_INDENT) —
+ *      three U+00A0 rendered FLAT, three U+2800 INDENTED CORRECTLY, a leading
+ *      `↳ ` rendered as visible ink, a leading `· ` was promoted by Telegram
+ *      into a real list bullet.
+ *   2. SHIPPED: `WORKER_STEP_INDENT` (the combined worker card) has used U+2800
+ *      since that check and renders indented in production.
+ *   3. CATEGORY: the property below — U+2800 is not `\s`, not `White_Space`,
+ *      not `Zs`.
+ *
+ * Note what is NOT claimed: no character was chosen on inference. #3662 shipped
+ * U+00A0 on exactly that kind of inference, was merged green, and was inert on
+ * a phone — which is why these tests assert the PROPERTY, not just the bytes.
+ */
+
+/** Every rule a server-side trimmer could plausibly use. */
+const isTrimmableWhitespace = (ch: string): boolean =>
+  /\s/u.test(ch) || /\p{White_Space}/u.test(ch) || /\p{Zs}/u.test(ch)
+
+function nestedCard(children: string[]): string {
+  return renderStatusCard({
+    header: { emoji: '🤖', label: 'Agent', elapsedMs: 95_000, toolCount: 12, state: 'running' },
+    steps: ['Reading gateway.ts'],
+    childSteps: children,
+    final: false,
+  })!
+}
+
+/** The card's pre-join lines, hard-break chrome removed. */
+function linesOf(card: string): string[] {
+  return card
+    .split('\n')
+    .map((l) => l.replace(/[ \t]+$/, '').replace(new RegExp(`${COLLAPSE_SAFE_SEPARATOR}$`), ''))
+}
+
+describe('NESTED_PREFIX renders as a real indent (#3668)', () => {
+  it('contains no character any whitespace rule would trim', () => {
+    // The `↳ ` glyph is visible ink and is kept; the run BEFORE it is the
+    // indent, and every char of THAT must survive a left-trim. Pin the width
+    // too — a single blank char reads as near-flat on a phone and would undo
+    // the fix while keeping the character-class assertion green.
+    const indent = [...NESTED_PREFIX.slice(0, NESTED_PREFIX.indexOf('↳'))]
+    expect(indent.length).toBe(3)
+    for (const ch of indent) {
+      const cp = `U+${ch.codePointAt(0)!.toString(16).toUpperCase().padStart(4, '0')}`
+      expect(
+        isTrimmableWhitespace(ch),
+        `NESTED_PREFIX's indent contains ${cp}, which is Unicode whitespace ` +
+          `(\\s / White_Space / Zs). Telegram left-trims a leading whitespace run off a ` +
+          `content line, so this indent renders FLAT on a phone — the #3662/#3668 failure. ` +
+          `Use U+2800 BRAILLE PATTERN BLANK (category So), live-verified 2026-07-26.`,
+      ).toBe(false)
+    }
+  })
+
+  it('leads with exactly three U+2800 and keeps the ↳ glyph', () => {
+    // Byte pin, companion to the property above: that one says "not
+    // whitespace", this one says "the specific glyph we live-tested", in the
+    // order that matters (blanks LEAD, so the glyph is never what gets trimmed).
+    expect(NESTED_PREFIX).toBe('\u2800\u2800\u2800↳ ')
+    // Not a GFM block-structure lead-in: `stackCardLines` promotes every
+    // inter-line break to a hard break *because* card lines are never block
+    // lines, and a live check showed Telegram promotes a leading `·` to a real
+    // list bullet.
+    expect(/^[-*+>|#·]/.test(NESTED_PREFIX)).toBe(false)
+  })
+
+  it('every rendered child line survives a server-side leading-whitespace trim with its indent intact', () => {
+    const card = nestedCard(['Searching memory', 'Running tests'])
+    const childLines = linesOf(card).filter((l) => l.includes('↳'))
+    expect(childLines.length).toBe(2)
+    for (const line of childLines) {
+      // Fail-before assertion: with the old ASCII prefix, `line` started with
+      // `'   '` and this strip removed the whole indent.
+      expect(line.startsWith(NESTED_PREFIX)).toBe(true)
+      expect(line.replace(/^[\s\p{White_Space}]+/u, '').startsWith(NESTED_PREFIX)).toBe(true)
+      // And it leads with neither of the two characters already proven flat.
+      expect(line.startsWith(' ')).toBe(false)
+      expect(line.startsWith('\u00A0')).toBe(false)
+    }
+  })
+
+  it('golden line ordering — parent steps stay flush, child steps sit one level in', () => {
+    // Set-membership assertions alone would pass a render that emitted all the
+    // parents and then all the children. This pins the ORDER, which is the
+    // thing "nested" actually means.
+    const card = nestedCard(['Searching memory', 'Running tests'])
+    const body = linesOf(card).slice(2)
+    expect(body).toEqual([
+      '~~_✓ Reading gateway.ts_~~',
+      `${NESTED_PREFIX}~~_Searching memory_~~`,
+      `${NESTED_PREFIX}**→ Running tests**`,
+    ])
+  })
+})

package/telegram-plugin/tests/no-robust-api-call-factory.test.ts

@@ -0,0 +1,62 @@
+/**
+ * `createRobustApiCall` must stay deleted (#3863).
+ *
+ * It was a second `createRetryApiCall` wiring in `shared/bot-runtime.ts`,
+ * described as "exactly how gateway.ts constructs its robustApiCall". It had
+ * ZERO production callers — and, worse, its flood-breaker hooks were OPTIONAL
+ * (`floodStatePath` defaulted to absent), so the default construction was a
+ * send path blind to the shared flood window: the exact failure
+ * `scripts/check-retry-flood-hooks.mjs` exists to prevent, sitting in the file
+ * a future caller would naturally reach for.
+ *
+ * It was also load-bearing DOCUMENTATION: `flood-circuit-breaker.ts` and
+ * `flood-429-ledger.ts` both cited it as a live wiring, so the breaker's
+ * "every onFloodWait goes through here" completeness argument was partly
+ * anchored to dead code.
+ *
+ * This is a source-level guard on purpose: the defect is the existence of the
+ * identifier, and there is no runtime behaviour to assert.
+ *
+ * The rule is "the name may appear only inside backticks" — i.e. as PROSE in a
+ * docblock explaining why it is gone. Any bare occurrence is code (a
+ * declaration, an import, a call) and fails.
+ */
+import { describe, it, expect } from 'vitest'
+import { readFileSync, readdirSync, statSync } from 'node:fs'
+import { join, extname } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const REPO_ROOT = fileURLToPath(new URL('../../', import.meta.url))
+const SEARCH_ROOTS = ['telegram-plugin', 'src', 'bin', 'scripts', 'docs']
+const SKIP_DIRS = new Set(['node_modules', 'dist', '.git', 'vendor', 'coverage'])
+const SEARCH_EXTS = new Set(['.ts', '.tsx', '.js', '.mjs', '.cjs', '.md'])
+
+function* walk(dir: string): Generator<string> {
+  for (const entry of readdirSync(dir)) {
+    if (SKIP_DIRS.has(entry)) continue
+    const full = join(dir, entry)
+    if (statSync(full).isDirectory()) yield* walk(full)
+    else if (SEARCH_EXTS.has(extname(entry))) yield full
+  }
+}
+
+describe('#3863 — the dead createRobustApiCall factory', () => {
+  it('appears in no source, script or doc file except as backticked prose', () => {
+    const selfPath = fileURLToPath(import.meta.url)
+    const offenders: string[] = []
+    for (const root of SEARCH_ROOTS) {
+      for (const file of walk(join(REPO_ROOT, root))) {
+        if (file === selfPath) continue
+        // Drop the backticked (prose) occurrences; anything left is code.
+        const bare = readFileSync(file, 'utf8').replaceAll('`createRobustApiCall`', '')
+        if (bare.includes('createRobustApiCall')) offenders.push(file.slice(REPO_ROOT.length))
+      }
+    }
+    expect(offenders).toEqual([])
+  })
+
+  it('is not exported by shared/bot-runtime.ts', async () => {
+    const mod = (await import('../shared/bot-runtime.js')) as Record<string, unknown>
+    expect(Object.keys(mod)).not.toContain('createRobustApiCall')
+  })
+})

package/telegram-plugin/tests/obligation-store.test.ts

@@ -2,6 +2,7 @@ import { describe, it, expect } from "vitest";
 import {
   loadObligations,
   persistObligations,
+  removeUnmaintainedSnapshot,
   type ObligationStoreFsSeam,
 } from "../gateway/obligation-store.js";
 import type { Obligation } from "../gateway/obligation-ledger.js";
@@ -33,6 +34,10 @@ function memFs(seed: Record<string, string> = {}) {
     fsyncDirSync: (p) => {
       calls.push(`fsyncDir:${p}`);
     },
+    unlinkSync: (p) => {
+      calls.push(`unlink:${p}`);
+      files.delete(p);
+    },
   };
   return { fs, files, calls };
 }
@@ -240,4 +245,50 @@ describe("obligation-store — power-cut durability (fsync ordering)", () => {
     expect(files.has(PATH)).toBe(true);
     expect(loadObligations(PATH, fs)).toHaveLength(1);
   });
+
+  // ── #4146: a snapshot nobody maintains must not read as "nobody waiting" ──
+
+  it("removeUnmaintainedSnapshot deletes a leftover snapshot and says why", () => {
+    // The exact hazard: the agent once ran with the ledger on, so an EMPTY
+    // open set is on disk. Persistence is now off, so that emptiness is a
+    // leftover — and the W1-d audience classifier would read it as positive
+    // proof that nobody is waiting, and suppress a message owed to a human.
+    const { fs, files } = memFs({ [PATH]: JSON.stringify({ v: 1, obligations: [] }) });
+    const logs: string[] = [];
+    expect(removeUnmaintainedSnapshot(PATH, fs, "static=true enabled=false", (l) => logs.push(l))).toBe(true);
+    expect(files.has(PATH)).toBe(false);
+    // ...and the classifier's precondition now genuinely holds: absent file.
+    expect(fs.existsSync(PATH)).toBe(false);
+    expect(logs.join("")).toContain("static=true enabled=false");
+    expect(logs.join("")).toContain("#4146");
+  });
+
+  it("removeUnmaintainedSnapshot is a no-op when there is nothing to remove", () => {
+    const { fs } = memFs();
+    const logs: string[] = [];
+    expect(removeUnmaintainedSnapshot(PATH, fs, "reason", (l) => logs.push(l))).toBe(false);
+    expect(logs).toEqual([]);
+  });
+
+  it("removeUnmaintainedSnapshot never throws, and reports failure rather than claiming success", () => {
+    // A failure here must degrade to the reader-side ledger-off guard, not
+    // crash gateway boot and not be mistaken for a completed cleanup.
+    const { fs } = memFs({ [PATH]: "{}" });
+    const logs: string[] = [];
+    const failing: ObligationStoreFsSeam = {
+      ...fs,
+      unlinkSync: () => {
+        throw new Error("EACCES: permission denied, unlink");
+      },
+    };
+    expect(removeUnmaintainedSnapshot(PATH, failing, "reason", (l) => logs.push(l))).toBe(false);
+    expect(logs.join("")).toContain("could not remove unmaintained snapshot");
+  });
+
+  it("a seam with no unlinkSync degrades to no cleanup rather than throwing", () => {
+    const { fs, files } = memFs({ [PATH]: "{}" });
+    const { unlinkSync: _dropped, ...legacySeam } = fs;
+    expect(removeUnmaintainedSnapshot(PATH, legacySeam, "reason", () => {})).toBe(false);
+    expect(files.has(PATH)).toBe(true);
+  });
 });