switchroom 0.19.42 → 0.19.44

package/telegram-plugin/tests/nested-indent-idiom.test.ts

@@ -0,0 +1,162 @@
+import { describe, it, expect } from 'vitest'
+import { readFileSync, readdirSync, statSync } from 'node:fs'
+import { join, relative } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { renderBootCard } from '../gateway/boot-card.js'
+import { renderUpdateOutcomeLine } from '../gateway/update-announce.js'
+import { NESTED_PREFIX } from '../status-no-truncate.js'
+
+/**
+ * #4115 — ONE indent idiom in the repo, and it is the one that actually
+ * renders.
+ *
+ * #3668 fixed the status card's nested lines by moving `NESTED_PREFIX` off
+ * ASCII spaces onto U+2800 BRAILLE PATTERN BLANK: card bodies reach Telegram
+ * as GFM markdown parsed SERVER-SIDE, and that parser left-trims a leading
+ * whitespace run off a content line, so an ASCII (or U+00A0) indent is dropped
+ * on the wire and the line renders FLAT. Live-verified on a phone 2026-07-26 —
+ * the record is on `WORKER_STEP_INDENT` in `status-no-truncate.ts`.
+ *
+ * The boot card and the update-announce line were NOT migrated by that PR, so
+ * they kept shipping the collapsed non-indent to the user. These tests assert
+ * what RENDERS (the leading run survives a server-side left-trim), not merely
+ * that a constant was referenced — a byte-equality assertion against the old
+ * literal is exactly what let the pre-#3668 indent ship green and inert.
+ */
+
+/** Every rule a server-side trimmer could plausibly use. */
+const isTrimmableWhitespace = (ch: string): boolean =>
+  /\s/u.test(ch) || /\p{White_Space}/u.test(ch) || /\p{Zs}/u.test(ch)
+
+/**
+ * The assertion that ties to rendering: after a leading-whitespace left-trim
+ * of the kind Telegram applies, the line STILL carries its full indent, and it
+ * does not lead with either character already proven flat on a phone.
+ */
+function expectSurvivesLeftTrim(line: string): void {
+  expect(line.startsWith(NESTED_PREFIX)).toBe(true)
+  expect(
+    line.replace(/^[\s\p{White_Space}]+/u, '').startsWith(NESTED_PREFIX),
+    `nested line "${line.slice(0, 40)}…" loses its indent to a leading-whitespace trim — ` +
+      `it renders FLAT on a phone (#3668/#4115). Use NESTED_PREFIX.`,
+  ).toBe(true)
+  expect(line.startsWith(' ')).toBe(false)
+  expect(line.startsWith(' ')).toBe(false)
+  const indent = [...line.slice(0, line.indexOf('↳'))]
+  expect(indent.length).toBeGreaterThan(0)
+  for (const ch of indent) expect(isTrimmableWhitespace(ch)).toBe(false)
+}
+
+/** Card lines with the stack's own break chrome removed. */
+function linesOf(card: string): string[] {
+  return card.split('\n').map((l) => l.replace(/[ \t]+$/, ''))
+}
+
+describe('boot card nested lines render as a real indent (#4115)', () => {
+  it("a probe's next-step continuation line survives a server-side left-trim", () => {
+    // Fail-before: this row was `'    ↳ ' + nextStep` — four ASCII spaces, all
+    // of them trimmed, so the line rendered flush against its probe row.
+    const out = renderBootCard({
+      agentName: 'lawgpt',
+      version: 'v0.7.16',
+      probes: {
+        skills: {
+          status: 'degraded',
+          label: 'Skills',
+          detail: '10/10 dangling: a, b, c +7 more',
+          nextStep: 'Run `switchroom agent reconcile lawgpt` to rebuild symlinks',
+        },
+      },
+    })
+    const nested = linesOf(out).filter((l) => l.includes('↳'))
+    expect(nested.length).toBe(1)
+    expectSurvivesLeftTrim(nested[0])
+  })
+
+  it('the crash row tail-logs continuation line survives a server-side left-trim', () => {
+    const out = renderBootCard({
+      agentName: 'lawgpt',
+      version: 'v0.7.16',
+      restartReason: 'crash',
+      restartAgeMs: 6_100,
+    })
+    const nested = linesOf(out).filter((l) => l.includes('↳'))
+    expect(nested.length).toBe(1)
+    expect(nested[0]).toContain('Tail logs:')
+    expectSurvivesLeftTrim(nested[0])
+  })
+})
+
+describe('update-announce recovery line renders as a real indent (#4115)', () => {
+  it('the failure card\'s recovery continuation survives a server-side left-trim', () => {
+    // Fail-before: the recovery row was `'    ↳ Recovery: …'`.
+    const line = renderUpdateOutcomeLine({
+      ts: '2026-05-17T11:59:00.000Z',
+      op: 'update_apply',
+      caller: { kind: 'operator' },
+      request_id: 'req-2',
+      result: 'error',
+      exit_code: 1,
+      duration_ms: 100,
+      phase: 'terminal',
+      stderr_tail: 'compose pull failed: registry timeout',
+      install_context: { install_type: 'binary', detected_at: '2026-05-17T11:00:00Z' },
+    })
+    const nested = linesOf(line).filter((l) => l.includes('↳'))
+    expect(nested.length).toBe(1)
+    expect(nested[0]).toContain('Recovery:')
+    expectSurvivesLeftTrim(nested[0])
+  })
+})
+
+describe('GUARD: no ASCII-space nested indent may reappear in the source (#4115)', () => {
+  // A run of ASCII spaces/tabs immediately before the `↳` nesting glyph — the
+  // exact shape that renders flat. The one exported constant is the only legal
+  // way to indent a nested card line.
+  const ASCII_INDENT_BEFORE_ARROW = /[ \t]{2,}↳/
+
+  const here = fileURLToPath(import.meta.url)
+  const repoRoot = join(here, '..', '..', '..')
+  const ROOTS = ['telegram-plugin', 'src']
+  const SKIP_DIRS = new Set(['node_modules', 'dist', '.git', 'coverage'])
+
+  function walk(dir: string, out: string[]): string[] {
+    for (const name of readdirSync(dir)) {
+      if (SKIP_DIRS.has(name)) continue
+      const p = join(dir, name)
+      if (statSync(p).isDirectory()) walk(p, out)
+      else if (p.endsWith('.ts') && p !== here) out.push(p)
+    }
+    return out
+  }
+
+  it('no source file hardcodes an ASCII-indent-plus-↳ nested line', () => {
+    const offenders: string[] = []
+    for (const root of ROOTS) {
+      for (const file of walk(join(repoRoot, root), [])) {
+        const text = readFileSync(file, 'utf8')
+        text.split('\n').forEach((line, i) => {
+          if (ASCII_INDENT_BEFORE_ARROW.test(line)) {
+            offenders.push(`${relative(repoRoot, file)}:${i + 1}: ${line.trim().slice(0, 100)}`)
+          }
+        })
+      }
+    }
+    expect(
+      offenders,
+      `Hardcoded ASCII indent before a '↳' nesting glyph. Telegram left-trims a leading ` +
+        `ASCII-whitespace run off a content line, so this renders FLAT on a phone (#3668/#4115). ` +
+        `Import NESTED_PREFIX from status-no-truncate.js instead:\n  ${offenders.join('\n  ')}`,
+    ).toEqual([])
+  })
+
+  it('the guard actually fires on the shape it is guarding against', () => {
+    // A guard that cannot fail is not a guard: pin the detector on the exact
+    // literal the two migrated call sites used to carry.
+    expect(ASCII_INDENT_BEFORE_ARROW.test("degradedRows.push(`    ↳ ${next}`)")).toBe(true)
+    expect(ASCII_INDENT_BEFORE_ARROW.test('   ↳ Recovery: reinstall')).toBe(true)
+    // …and stays quiet on the legal idiom and on prose that merely mentions ↳.
+    expect(ASCII_INDENT_BEFORE_ARROW.test(`${NESTED_PREFIX}Recovery: reinstall`)).toBe(false)
+    expect(ASCII_INDENT_BEFORE_ARROW.test('the nested ↳ block is windowed')).toBe(false)
+  })
+})

package/telegram-plugin/tests/nested-prefix-indent.test.ts

@@ -0,0 +1,115 @@
+import { describe, it, expect } from 'vitest'
+import { renderStatusCard } from '../tool-activity-summary.js'
+import { NESTED_PREFIX } from '../status-no-truncate.js'
+import { COLLAPSE_SAFE_SEPARATOR } from '../card-format.js'
+
+/**
+ * #3668 — the nested (foreground sub-agent) child block must actually LOOK
+ * nested on a phone.
+ *
+ * `NESTED_PREFIX` used to be three ASCII spaces plus `↳ `. Card bodies reach
+ * Telegram as GFM markdown parsed SERVER-SIDE, and that parser left-trims a
+ * leading whitespace run off a content line, so the indent was dropped on the
+ * wire and every child step rendered FLAT against its parent's steps — the
+ * whole nesting cue reduced to one `↳` glyph.
+ *
+ * The replacement is the repo's already-live-verified indent idiom, U+2800
+ * BRAILLE PATTERN BLANK: general category So (Symbol, other), not Zs, so no
+ * whitespace-trimming rule can classify it as whitespace, yet it renders as
+ * blank width. Evidence, in order of strength:
+ *
+ *   1. LIVE: on 2026-07-26 four candidate indents were sent to a real phone in
+ *      one message (recorded at `status-no-truncate.ts`, WORKER_STEP_INDENT) —
+ *      three U+00A0 rendered FLAT, three U+2800 INDENTED CORRECTLY, a leading
+ *      `↳ ` rendered as visible ink, a leading `· ` was promoted by Telegram
+ *      into a real list bullet.
+ *   2. SHIPPED: `WORKER_STEP_INDENT` (the combined worker card) has used U+2800
+ *      since that check and renders indented in production.
+ *   3. CATEGORY: the property below — U+2800 is not `\s`, not `White_Space`,
+ *      not `Zs`.
+ *
+ * Note what is NOT claimed: no character was chosen on inference. #3662 shipped
+ * U+00A0 on exactly that kind of inference, was merged green, and was inert on
+ * a phone — which is why these tests assert the PROPERTY, not just the bytes.
+ */
+
+/** Every rule a server-side trimmer could plausibly use. */
+const isTrimmableWhitespace = (ch: string): boolean =>
+  /\s/u.test(ch) || /\p{White_Space}/u.test(ch) || /\p{Zs}/u.test(ch)
+
+function nestedCard(children: string[]): string {
+  return renderStatusCard({
+    header: { emoji: '🤖', label: 'Agent', elapsedMs: 95_000, toolCount: 12, state: 'running' },
+    steps: ['Reading gateway.ts'],
+    childSteps: children,
+    final: false,
+  })!
+}
+
+/** The card's pre-join lines, hard-break chrome removed. */
+function linesOf(card: string): string[] {
+  return card
+    .split('\n')
+    .map((l) => l.replace(/[ \t]+$/, '').replace(new RegExp(`${COLLAPSE_SAFE_SEPARATOR}$`), ''))
+}
+
+describe('NESTED_PREFIX renders as a real indent (#3668)', () => {
+  it('contains no character any whitespace rule would trim', () => {
+    // The `↳ ` glyph is visible ink and is kept; the run BEFORE it is the
+    // indent, and every char of THAT must survive a left-trim. Pin the width
+    // too — a single blank char reads as near-flat on a phone and would undo
+    // the fix while keeping the character-class assertion green.
+    const indent = [...NESTED_PREFIX.slice(0, NESTED_PREFIX.indexOf('↳'))]
+    expect(indent.length).toBe(3)
+    for (const ch of indent) {
+      const cp = `U+${ch.codePointAt(0)!.toString(16).toUpperCase().padStart(4, '0')}`
+      expect(
+        isTrimmableWhitespace(ch),
+        `NESTED_PREFIX's indent contains ${cp}, which is Unicode whitespace ` +
+          `(\\s / White_Space / Zs). Telegram left-trims a leading whitespace run off a ` +
+          `content line, so this indent renders FLAT on a phone — the #3662/#3668 failure. ` +
+          `Use U+2800 BRAILLE PATTERN BLANK (category So), live-verified 2026-07-26.`,
+      ).toBe(false)
+    }
+  })
+
+  it('leads with exactly three U+2800 and keeps the ↳ glyph', () => {
+    // Byte pin, companion to the property above: that one says "not
+    // whitespace", this one says "the specific glyph we live-tested", in the
+    // order that matters (blanks LEAD, so the glyph is never what gets trimmed).
+    expect(NESTED_PREFIX).toBe('\u2800\u2800\u2800↳ ')
+    // Not a GFM block-structure lead-in: `stackCardLines` promotes every
+    // inter-line break to a hard break *because* card lines are never block
+    // lines, and a live check showed Telegram promotes a leading `·` to a real
+    // list bullet.
+    expect(/^[-*+>|#·]/.test(NESTED_PREFIX)).toBe(false)
+  })
+
+  it('every rendered child line survives a server-side leading-whitespace trim with its indent intact', () => {
+    const card = nestedCard(['Searching memory', 'Running tests'])
+    const childLines = linesOf(card).filter((l) => l.includes('↳'))
+    expect(childLines.length).toBe(2)
+    for (const line of childLines) {
+      // Fail-before assertion: with the old ASCII prefix, `line` started with
+      // `'   '` and this strip removed the whole indent.
+      expect(line.startsWith(NESTED_PREFIX)).toBe(true)
+      expect(line.replace(/^[\s\p{White_Space}]+/u, '').startsWith(NESTED_PREFIX)).toBe(true)
+      // And it leads with neither of the two characters already proven flat.
+      expect(line.startsWith(' ')).toBe(false)
+      expect(line.startsWith('\u00A0')).toBe(false)
+    }
+  })
+
+  it('golden line ordering — parent steps stay flush, child steps sit one level in', () => {
+    // Set-membership assertions alone would pass a render that emitted all the
+    // parents and then all the children. This pins the ORDER, which is the
+    // thing "nested" actually means.
+    const card = nestedCard(['Searching memory', 'Running tests'])
+    const body = linesOf(card).slice(2)
+    expect(body).toEqual([
+      '~~_✓ Reading gateway.ts_~~',
+      `${NESTED_PREFIX}~~_Searching memory_~~`,
+      `${NESTED_PREFIX}**→ Running tests**`,
+    ])
+  })
+})

package/telegram-plugin/tests/no-robust-api-call-factory.test.ts

@@ -0,0 +1,62 @@
+/**
+ * `createRobustApiCall` must stay deleted (#3863).
+ *
+ * It was a second `createRetryApiCall` wiring in `shared/bot-runtime.ts`,
+ * described as "exactly how gateway.ts constructs its robustApiCall". It had
+ * ZERO production callers — and, worse, its flood-breaker hooks were OPTIONAL
+ * (`floodStatePath` defaulted to absent), so the default construction was a
+ * send path blind to the shared flood window: the exact failure
+ * `scripts/check-retry-flood-hooks.mjs` exists to prevent, sitting in the file
+ * a future caller would naturally reach for.
+ *
+ * It was also load-bearing DOCUMENTATION: `flood-circuit-breaker.ts` and
+ * `flood-429-ledger.ts` both cited it as a live wiring, so the breaker's
+ * "every onFloodWait goes through here" completeness argument was partly
+ * anchored to dead code.
+ *
+ * This is a source-level guard on purpose: the defect is the existence of the
+ * identifier, and there is no runtime behaviour to assert.
+ *
+ * The rule is "the name may appear only inside backticks" — i.e. as PROSE in a
+ * docblock explaining why it is gone. Any bare occurrence is code (a
+ * declaration, an import, a call) and fails.
+ */
+import { describe, it, expect } from 'vitest'
+import { readFileSync, readdirSync, statSync } from 'node:fs'
+import { join, extname } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const REPO_ROOT = fileURLToPath(new URL('../../', import.meta.url))
+const SEARCH_ROOTS = ['telegram-plugin', 'src', 'bin', 'scripts', 'docs']
+const SKIP_DIRS = new Set(['node_modules', 'dist', '.git', 'vendor', 'coverage'])
+const SEARCH_EXTS = new Set(['.ts', '.tsx', '.js', '.mjs', '.cjs', '.md'])
+
+function* walk(dir: string): Generator<string> {
+  for (const entry of readdirSync(dir)) {
+    if (SKIP_DIRS.has(entry)) continue
+    const full = join(dir, entry)
+    if (statSync(full).isDirectory()) yield* walk(full)
+    else if (SEARCH_EXTS.has(extname(entry))) yield full
+  }
+}
+
+describe('#3863 — the dead createRobustApiCall factory', () => {
+  it('appears in no source, script or doc file except as backticked prose', () => {
+    const selfPath = fileURLToPath(import.meta.url)
+    const offenders: string[] = []
+    for (const root of SEARCH_ROOTS) {
+      for (const file of walk(join(REPO_ROOT, root))) {
+        if (file === selfPath) continue
+        // Drop the backticked (prose) occurrences; anything left is code.
+        const bare = readFileSync(file, 'utf8').replaceAll('`createRobustApiCall`', '')
+        if (bare.includes('createRobustApiCall')) offenders.push(file.slice(REPO_ROOT.length))
+      }
+    }
+    expect(offenders).toEqual([])
+  })
+
+  it('is not exported by shared/bot-runtime.ts', async () => {
+    const mod = (await import('../shared/bot-runtime.js')) as Record<string, unknown>
+    expect(Object.keys(mod)).not.toContain('createRobustApiCall')
+  })
+})

package/telegram-plugin/tests/obligation-store.test.ts

@@ -2,6 +2,7 @@ import { describe, it, expect } from "vitest";
 import {
   loadObligations,
   persistObligations,
+  removeUnmaintainedSnapshot,
   type ObligationStoreFsSeam,
 } from "../gateway/obligation-store.js";
 import type { Obligation } from "../gateway/obligation-ledger.js";
@@ -33,6 +34,10 @@ function memFs(seed: Record<string, string> = {}) {
     fsyncDirSync: (p) => {
       calls.push(`fsyncDir:${p}`);
     },
+    unlinkSync: (p) => {
+      calls.push(`unlink:${p}`);
+      files.delete(p);
+    },
   };
   return { fs, files, calls };
 }
@@ -240,4 +245,50 @@ describe("obligation-store — power-cut durability (fsync ordering)", () => {
     expect(files.has(PATH)).toBe(true);
     expect(loadObligations(PATH, fs)).toHaveLength(1);
   });
+
+  // ── #4146: a snapshot nobody maintains must not read as "nobody waiting" ──
+
+  it("removeUnmaintainedSnapshot deletes a leftover snapshot and says why", () => {
+    // The exact hazard: the agent once ran with the ledger on, so an EMPTY
+    // open set is on disk. Persistence is now off, so that emptiness is a
+    // leftover — and the W1-d audience classifier would read it as positive
+    // proof that nobody is waiting, and suppress a message owed to a human.
+    const { fs, files } = memFs({ [PATH]: JSON.stringify({ v: 1, obligations: [] }) });
+    const logs: string[] = [];
+    expect(removeUnmaintainedSnapshot(PATH, fs, "static=true enabled=false", (l) => logs.push(l))).toBe(true);
+    expect(files.has(PATH)).toBe(false);
+    // ...and the classifier's precondition now genuinely holds: absent file.
+    expect(fs.existsSync(PATH)).toBe(false);
+    expect(logs.join("")).toContain("static=true enabled=false");
+    expect(logs.join("")).toContain("#4146");
+  });
+
+  it("removeUnmaintainedSnapshot is a no-op when there is nothing to remove", () => {
+    const { fs } = memFs();
+    const logs: string[] = [];
+    expect(removeUnmaintainedSnapshot(PATH, fs, "reason", (l) => logs.push(l))).toBe(false);
+    expect(logs).toEqual([]);
+  });
+
+  it("removeUnmaintainedSnapshot never throws, and reports failure rather than claiming success", () => {
+    // A failure here must degrade to the reader-side ledger-off guard, not
+    // crash gateway boot and not be mistaken for a completed cleanup.
+    const { fs } = memFs({ [PATH]: "{}" });
+    const logs: string[] = [];
+    const failing: ObligationStoreFsSeam = {
+      ...fs,
+      unlinkSync: () => {
+        throw new Error("EACCES: permission denied, unlink");
+      },
+    };
+    expect(removeUnmaintainedSnapshot(PATH, failing, "reason", (l) => logs.push(l))).toBe(false);
+    expect(logs.join("")).toContain("could not remove unmaintained snapshot");
+  });
+
+  it("a seam with no unlinkSync degrades to no cleanup rather than throwing", () => {
+    const { fs, files } = memFs({ [PATH]: "{}" });
+    const { unlinkSync: _dropped, ...legacySeam } = fs;
+    expect(removeUnmaintainedSnapshot(PATH, legacySeam, "reason", () => {})).toBe(false);
+    expect(files.has(PATH)).toBe(true);
+  });
 });