switchroom 0.19.42 → 0.19.44

package/telegram-plugin/gateway/outbound-send-path.ts

@@ -29,6 +29,7 @@ import {
   stripExcessBold,
   addParagraphSpacers,
   splitMarkdownChunks,
+  splitPlainTextToCap,
   hardSliceToCap,
   RICH_MESSAGE_MAX_CHARS,
 } from '../format.js'
@@ -36,6 +37,12 @@ import { scrubVoice } from '../text-voice-scrub.js'
 import { normalizeTemporal } from '../temporal-normalize.js'
 import { resolveEnvTimezone } from '../shared/local-time.js'
 import { isMessageTooLongError, isHtmlParseRejectError } from '../retry-api-call.js'
+import {
+  buildReplyParameters,
+  dropQuoteFromSendOpts,
+  isQuoteRejectionError,
+  sendOptsHaveQuote,
+} from '../reply-quote.js'
 
 // ── send-orchestration façade imports (#2996 P2) ──
 // Pure/deterministic helpers are imported; stateful or side-effecting gateway
@@ -52,6 +59,14 @@ import {
 } from '../format.js'
 import { richMessage } from '../rich-send.js'
 import { journalExternalDelivery } from './outbox-sweep.js'
+import { sha256Hex } from '../outbox.js'
+// #4141: the ONE shared framing implementation, also used by the outbox sweep
+// and (for the classifier half) the unbundled Stop hooks.
+import {
+  applyReplyThrowFraming,
+  formatReplyThrowFraming,
+  shouldFrameReplyThrow,
+} from '../hooks/audience-classify.mjs'
 import { queueFloodBlockedReply } from './flood-reply-queue.js'
 import { resolveChatIdFallback } from './chat-id-fallback.js'
 import { isFinalAnswerReply, isSubstantiveFinalReply, shouldJournalReplySiteDelivery } from '../final-answer-detect.js'
@@ -416,16 +431,58 @@ export async function sendReplyChunks(
     // rejects our markdown — better an unformatted answer than a
     // vanished one. The raw markdown source is itself readable prose, so
     // we send it verbatim rather than strip anything.
+    //
+    // #4043: chunks were split for the RICH cap (up to RICH_MESSAGE_MAX_CHARS =
+    // 32768), but this fallback ships them through the PLAIN `sendMessage`
+    // endpoint, which caps at 4096. Without a re-cap, the rescue send itself
+    // 400s with `message is too long` and the answer vanishes — the exact
+    // failure the fallback exists to prevent. Re-cap at safe boundaries first.
+    //
+    // Per-piece trailers: `opts` was built for ONE message, so shipping it
+    // verbatim to every piece duplicates the MESSAGE-scoped params.
+    //   - `reply_markup` (an inline keyboard) would render a LIVE button on
+    //     every piece. `single_use` only strips the keyboard from the message
+    //     that was tapped, so the user can fire the same action N times. It
+    //     rides the FINAL piece only — the same treatment the sweep's own
+    //     fallback applies (`outbox-sweep.ts` `sendChunkRich`/`withoutMarkup`),
+    //     and the same message the caller attached it to (the last chunk).
+    //   - `reply_parameters` would quote-reply from every piece. Only the
+    //     FIRST piece quotes, matching the caller's `replyMode !== 'all'`
+    //     rule that quotes chunk 0 only.
+    // Thread / link-preview / protect_content / disable_notification are
+    // per-message policy and correctly ride every piece, unchanged.
     const sendChunkPlainText = async (opts: Record<string, unknown>): Promise<void> => {
       const plain =
         chunks[i].length > 0
           ? chunks[i]
           : '⚠️ (a fragment could not be rendered for Telegram)'
-      const sent = await deps.sendLiteralRaw(opts, plain)
-      sentIds.push(sent.message_id)
-      deps.logOutbound('reply', chatId, sent.message_id, plain.length, `chunk=${i + 1}/${chunks.length} plaintext-fallback`)
+      const pieces = splitPlainTextToCap(plain)
+      const pieceOpts = (p: number): Record<string, unknown> => {
+        // Single piece ⇒ it is both first and final; pass `opts` through
+        // byte-identically so the non-split path stays exactly as it was.
+        if (pieces.length === 1) return opts
+        const o = { ...opts }
+        if (p !== pieces.length - 1) delete o.reply_markup
+        if (p !== 0) delete o.reply_parameters
+        return o
+      }
+      for (let p = 0; p < pieces.length; p++) {
+        const sent = await deps.sendLiteralRaw(pieceOpts(p), pieces[p])
+        sentIds.push(sent.message_id)
+        deps.logOutbound(
+          'reply',
+          chatId,
+          sent.message_id,
+          pieces[p].length,
+          pieces.length > 1
+            ? `chunk=${i + 1}/${chunks.length} plaintext-fallback piece=${p + 1}/${pieces.length}`
+            : `chunk=${i + 1}/${chunks.length} plaintext-fallback`,
+        )
+      }
       deps.stderr(
-        `telegram gateway: markdown parse-reject — resent chunk ${i + 1}/${chunks.length} as plain text\n`,
+        `telegram gateway: markdown parse-reject — resent chunk ${i + 1}/${chunks.length} as plain text` +
+          (pieces.length > 1 ? ` in ${pieces.length} piece(s) (4096-char plain cap)` : '') +
+          `\n`,
       )
     }
 
@@ -499,6 +556,20 @@ export async function sendReplyChunks(
           else if (isHtmlParseRejectError(retryErr)) await sendChunkPlainText(retryOpts)
           else throw retryErr
         }
+      } else if (isQuoteRejectionError(err) && sendOptsHaveQuote(sendOpts)) {
+        // Surgical-quote rejection: the quote must be an EXACT substring of the
+        // message being replied to, and Telegram 400s when it isn't found (a
+        // model paraphrase, a re-rendered fragment, an emoji/entity mismatch).
+        // That is a failure of the HIGHLIGHT, not of the answer — so drop the
+        // quote and land the reply as an ordinary reply to the same message,
+        // rather than throwing the composed answer away.
+        const retryOpts = dropQuoteFromSendOpts(sendOpts)
+        const sent = await sendChunk(retryOpts, false)
+        sentIds.push(sent.message_id)
+        deps.logOutbound('reply', chatId, sent.message_id, chunks[i].length, `chunk=${i + 1}/${chunks.length} quote-dropped`)
+        deps.stderr(
+          `telegram gateway: quote not found in the replied-to message — resent chunk ${i + 1}/${chunks.length} without the quote\n`,
+        )
       } else if (isMessageTooLongError(err)) {
         await sendChunkResplit(sendOpts)
       } else if (isHtmlParseRejectError(err)) {
@@ -1949,10 +2020,10 @@ export async function sendReply(
         return {
           ...(shouldReplyTo
             ? {
-                reply_parameters: {
-                  message_id: reply_to,
-                  ...(quoteText != null ? { quote: { text: quoteText, position: 0 } } : {}),
-                },
+                // `quote` is a Bot API String and `quote_position` a separate
+                // sibling Integer — see reply-quote.ts. Emitting an object here
+                // 400'd every quoted reply the fleet ever sent.
+                reply_parameters: buildReplyParameters(reply_to!, quoteText),
               }
             : {}),
           ...(tid != null ? { message_thread_id: tid } : {}),
@@ -2514,6 +2585,15 @@ export async function deliverCapturedProse(
   text: string
   /** Turn elapsed for the honest "(waited Ns)" apology clause; optional. */
   turnDurationMs?: number
+  /**
+   * #4141 — this turn's reply tool threw, so `text` is prose the model wrote
+   * AFTER its delivery attempt failed, not text it chose to send as the answer.
+   * When `true` the send is prefixed with a one-line provenance banner. This is
+   * the ELECTED-path counterpart of the outbox sweep's framing: on this path
+   * the Stop hook defers to the single-writer election and writes NO outbox
+   * record, so the sweep's framing can never reach the message.
+   */
+  replyToolThrewThisTurn?: boolean
   },
 ): Promise<void> {
   const {
@@ -2523,6 +2603,18 @@ export async function deliverCapturedProse(
   } = deps
   const { chatId, threadId, statusKeyStr, registryKey, originTurnId, text, turnDurationMs } = args
   const now = Date.now()
+  // #4141 — framing is a rendering concern, decided ONCE here and applied only
+  // to the bytes handed to Telegram. Everything keyed on identity (the dedup
+  // check + record below, and the journal's `textSha256`) deliberately keeps
+  // using the RAW `text`, so the label cannot change what counts as "the same
+  // answer" — a later reply-tool retry of the same prose still dedups, and the
+  // exactly-once-among-backstops journal key is unchanged. Same
+  // additive-by-construction property the sweep path has, re-established here
+  // because this path has its own send ladder and its own dedup.
+  const framed = shouldFrameReplyThrow(
+    { replyToolThrewThisTurn: args.replyToolThrewThisTurn },
+    { frameEnabled: process.env.SWITCHROOM_TG_OUTBOX_PROVENANCE_FRAMING !== '0' },
+  )
   // #3228 Finding 1 — the three settlement points (sent / skipped-dedup /
   // failed) all funnel through the pure `settleCapturedProseDelivery` core so
   // the failure posture is deterministic and unit-tested. `outcome` is set on
@@ -2530,7 +2622,7 @@ export async function deliverCapturedProse(
   let outcome: CapturedProseSendOutcome
   const already = outboundDedup.check(chatId, threadId, text, now, registryKey)
   if (already == null) {
-    let out = normalizeParagraphBreaks(repairEscapedWhitespace(text))
+    let out = normalizeParagraphBreaks(repairEscapedWhitespace(framed ? applyReplyThrowFraming(text) : text))
     out = redactOutboundText(out, 'captured_prose')
     const chunks = splitMarkdownChunks(out, RICH_MESSAGE_MAX_CHARS)
     const sentIds: number[] = []
@@ -2577,11 +2669,31 @@ export async function deliverCapturedProse(
       // journal line from this site following a reply-tool line under the same
       // nonce (replyAlreadyDeliveredThisTurn:true) is direct, journal-only
       // proof of a bridge double-send.
-      journalExternalDelivery({ turnNonce: originTurnId, text, tgMessageId: sentIds[sentIds.length - 1], replyAlreadyDeliveredThisTurn: false })
+      journalExternalDelivery({
+        turnNonce: originTurnId,
+        text,
+        tgMessageId: sentIds[sentIds.length - 1],
+        replyAlreadyDeliveredThisTurn: false,
+        // #4141 durable terminal stamp — parity with the sweep's
+        // `DeliveredEntry.framedProvenance`, so "was this labelled?" is
+        // answerable from the journal alone, hours later.
+        ...(framed ? { framedProvenance: 'reply-throw' as const } : {}),
+      })
       process.stderr.write(
         `telegram gateway: captured-prose delivery — sent ${out.length} chars recovered from ` +
           `transcript scan (chat=${chatId} origin=${originTurnId})\n`,
       )
+      if (framed) {
+        process.stderr.write(
+          formatReplyThrowFraming({
+            turnNonce: originTurnId,
+            turnId: originTurnId,
+            chatId,
+            textSha256: sha256Hex(text),
+            source: 'captured-prose-bridge',
+          }),
+        )
+      }
       outcome = 'sent'
     } catch (err) {
       // #3228 Finding 1 — the send threw, so the answer did NOT reach the user.
@@ -2660,7 +2772,11 @@ export async function deliverCapturedProse(
         `(chat=${chatId} origin=${originTurnId})\n`,
     )
     const plain = redactOutboundText(text, 'captured_prose')
-    const plainChunks = splitMarkdownChunks(plain, RICH_MESSAGE_MAX_CHARS)
+    // #4043: these pieces go through the PLAIN `sendMessage` endpoint (4096
+    // cap), not the rich one — splitting at RICH_MESSAGE_MAX_CHARS produced
+    // pieces Telegram rejects with `message is too long`, so a long recovered
+    // answer fell through to the generic apology and was lost.
+    const plainChunks = splitPlainTextToCap(plain)
     try {
       let liveThreadId: number | undefined = threadId
       const plainSentIds: number[] = []