switchroom 0.19.44 → 0.19.46

package/telegram-plugin/tests/stream-render-golden.test.ts

@@ -25,6 +25,8 @@ import { tmpdir } from 'node:os'
 import {
   handleSessionEvent,
   __resetParkedTurnStartsForTest,
+  flushCompletionTracker,
+  closeFlushCompletionWindows,
   type StreamRenderDeps,
 } from '../gateway/stream-render.js'
 import {
@@ -33,7 +35,7 @@ import {
   type SendReplyRequest,
 } from '../gateway/outbound-send-path.js'
 import { OutboundDedupCache } from '../recent-outbound-dedup.js'
-import { FlushedTurnSupersedeRegistry } from '../flushed-turn-supersede.js'
+import { FlushedTurnSupersedeRegistry, SUPERSEDE_COMPLETED_GRACE_MS } from '../flushed-turn-supersede.js'
 import { BackstopDeliveryLedger } from '../gateway/backstop-delivery.js'
 import { redact } from '../secret-detect/redact.js'
 import { createTurnTypingLoop } from '../gateway/turn-typing-loop.js'
@@ -279,6 +281,9 @@ function makeSendReplyDeps(dedup: OutboundDedupCache, sharedSupersede?: FlushedT
     streamKey: key,
     resolveReplyOwnerTurn: () => ownerRes(null, 'none'),
     getLastSubagentHandbackAt: () => null,
+    // #4176 — no sub-agent live (these suites drive the parent session's own
+    // flush→reply collapse). The gate is exercised in send-reply-golden.test.ts.
+    subagentReplyAuthority: { subagentCouldOwnReply: () => false },
     findTurnByOriginId: () => null,
     findTurnByQuotedMessageId: () => null,
     resolveAnswerThreadWithLog: (_c: string, explicit: number | undefined) => explicit,
@@ -698,3 +703,201 @@ describe('#3544 — turn-start typing is unconditional at the enqueue seam', ()
     rig.emitter.reset()
   })
 })
+
+
+// ── #4173 — the turn-completion window wiring, driven through the REAL paths ──
+//
+// The pure three-phase rule is pinned in flushed-turn-supersede.test.ts /
+// reply-owner-resolve.test.ts; THESE tests pin the stream-render WIRING — the
+// quiescence flush OPENING the window and the real turn_end CLOSING it — which
+// nothing else covers (deleting either hook leaves every pure test green).
+describe('#4173 — quiescence flush opens the completion window; the real turn_end closes it', () => {
+  const settleFlush = () => new Promise((r) => setTimeout(r, 650))
+  const ANSWER =
+    'The composed terminal answer that the model never sent via reply, long enough to be a ' +
+    'genuine substantive flush delivery for the completion-window wiring tests.'
+
+  beforeEach(() => {
+    // drain module-scope tracker state left by other suites
+    flushCompletionTracker.closeAll(Date.now())
+  })
+
+  it('END-TO-END: the synthetic quiescence turn_end OPENS the window (atom + record ' +
+    'claimable far past any fixed TTL); the REAL turn_end then CLOSES both to the ' +
+    'replay grace', async () => {
+    const supersede = new FlushedTurnSupersedeRegistry()
+    // Pre-stamp a bogus value so the OPEN assertion proves the flush branch
+    // actively nulled it (not that it was merely never written).
+    const turn = makeTurn({ capturedText: [ANSWER], realEndObservedAt: 111 } as Partial<CurrentTurn>)
+    const sh = makeStreamDeps({ turn, flushedTurnSupersede: supersede })
+
+    // The answer-ready quiescence flush: a SYNTHETIC turn_end.
+    handleSessionEvent(sh.deps, { kind: 'turn_end', durationMs: -1, reason: 'answer-ready-quiescence' })
+    await settleFlush()
+    expect(sh.delivered).toContain(ANSWER)
+
+    // OPEN: the atom's window was re-opened at fire time…
+    expect((turn as unknown as { realEndObservedAt: number | null }).realEndObservedAt).toBeNull()
+    // …and the record is claimable 20 minutes out (a /compact longer than any
+    // tuned TTL still collapses to one bubble — the #4166 unbounded case).
+    // Removing the flush branch's `flushCompletionTracker.open(turn)` leaves
+    // the record born-completed via turn-end stamping in prod; in this harness
+    // the observable red is the atom assertion above.
+    expect(
+      supersede.peek(CHAT, undefined, { liveTurnId: turn.turnId, now: Date.now() + 20 * 60_000 }).reason,
+    ).toBe('supersede')
+
+    // The session's REAL turn_end lands later — the completion signal.
+    handleSessionEvent(sh.deps, { kind: 'turn_end', durationMs: 1200 })
+    await settleFlush()
+
+    // CLOSED: the atom is stamped…
+    const stamped = (turn as unknown as { realEndObservedAt: number | null }).realEndObservedAt
+    expect(stamped).not.toBeNull()
+    // …the record still honours the bounded tool-call-replay grace…
+    expect(
+      supersede.peek(CHAT, undefined, { liveTurnId: turn.turnId, now: Date.now() + 1_000 }).reason,
+    ).toBe('supersede')
+    // …and EXPIRES past it: a decoupled same-bridge reply (the Task-sub-agent-
+    // after-parent-turn-end shape) can no longer edit over the flushed answer.
+    // Removing the close hook (`closeFlushCompletionWindows` in case 'turn_end')
+    // turns THIS red — the record would stay open for 30 minutes.
+    expect(
+      supersede.peek(CHAT, undefined, {
+        liveTurnId: turn.turnId,
+        now: Date.now() + SUPERSEDE_COMPLETED_GRACE_MS + 5_000,
+      }).reason,
+    ).toBe('expired')
+  })
+
+  it('the REAL-turn_end backstop variant does NOT re-open the window ' +
+    '(the `durationMs === -1` conditional is load-bearing)', async () => {
+    const supersede = new FlushedTurnSupersedeRegistry()
+    const turn = makeTurn({ capturedText: [ANSWER], realEndObservedAt: 999 } as Partial<CurrentTurn>)
+    const sh = makeStreamDeps({ turn, flushedTurnSupersede: supersede })
+
+    // The turn-end BACKSTOP: the flush fires ON a real turn_end. The session
+    // already stopped, so the window must stay closed (born completed).
+    handleSessionEvent(sh.deps, { kind: 'turn_end', durationMs: 1200 })
+    await settleFlush()
+    expect(sh.delivered).toContain(ANSWER)
+
+    // Unconditionally opening in the flush branch (dropping the -1 check)
+    // nulls this and turns the test red.
+    expect((turn as unknown as { realEndObservedAt: number | null }).realEndObservedAt).not.toBeNull()
+    // The record was born completed (inherited from the atom), so it expires
+    // on the grace, never the 30-minute open cap.
+    expect(
+      supersede.peek(CHAT, undefined, {
+        liveTurnId: turn.turnId,
+        now: Date.now() + SUPERSEDE_COMPLETED_GRACE_MS + 5_000,
+      }).reason,
+    ).toBe('expired')
+  })
+})
+
+// ── LOW #2 (#4167 review) — the two CLOSE PROXIES, which nothing covered ──────
+//
+// `closeFlushCompletionWindows` has three call sites: the real turn_end (pinned
+// by the #4173 block above) and two PROXIES — a new turn minting on the serial
+// session (`case 'enqueue'`), and the main bridge dying (gateway.ts). Both were
+// untested: deleting the `beginTurn` call left all 18 stream-render tests green,
+// and the bridge-death sweep had no coverage at all. A silently-dropped proxy
+// leaves a flushed turn's window OPEN for the full 30-minute crash cap, which is
+// exactly the tail that makes an edit-over of a delivered answer possible.
+describe('#4173 close proxies — a new turn mint and bridge death both close open windows', () => {
+  const settleFlush = () => new Promise((r) => setTimeout(r, 650))
+  const ANSWER =
+    'The composed terminal answer that the model never sent via reply, long enough to be a ' +
+    'genuine substantive flush delivery for the close-proxy wiring tests.'
+  const CLOSED_BY_GRACE = SUPERSEDE_COMPLETED_GRACE_MS + 5_000
+  // Well inside the 30-minute OPEN cap: if the window did NOT close, the record
+  // is still claimable here — which is what makes these assertions bite.
+  const STILL_OPEN_AT = 10 * 60_000
+
+  beforeEach(() => {
+    __resetParkedTurnStartsForTest()
+    flushCompletionTracker.closeAll(Date.now())
+  })
+
+  async function flushWithOpenWindow(supersede: FlushedTurnSupersedeRegistry) {
+    const turn = makeTurn({ capturedText: [ANSWER], realEndObservedAt: 111 } as Partial<CurrentTurn>)
+    const sh = makeStreamDeps({ turn, flushedTurnSupersede: supersede })
+    handleSessionEvent(sh.deps, { kind: 'turn_end', durationMs: -1, reason: 'answer-ready-quiescence' })
+    await settleFlush()
+    expect(sh.delivered).toContain(ANSWER)
+    // Precondition: the window is genuinely OPEN (claimable 10 minutes out).
+    expect((turn as unknown as { realEndObservedAt: number | null }).realEndObservedAt).toBeNull()
+    expect(
+      supersede.peek(CHAT, undefined, { liveTurnId: turn.turnId, now: Date.now() + STILL_OPEN_AT }).reason,
+    ).toBe('supersede')
+    return { turn, sh }
+  }
+
+  it('PROXY A: a NEW TURN minting (case `enqueue`) closes the prior flush window — ' +
+    'the record then expires on the replay grace, not the 30-minute open cap', async () => {
+    const supersede = new FlushedTurnSupersedeRegistry()
+    const { turn, sh } = await flushWithOpenWindow(supersede)
+
+    // The serial session moved on: the CLI enqueues the next turn. The harness's
+    // fake `endCurrentTurnAtomic` does not null the turn, so clear it here — an
+    // idle session is what makes `enqueue` MINT rather than park.
+    ;(sh.deps as unknown as { setCurrentTurn: (t: CurrentTurn | null) => void }).setCurrentTurn(null)
+    handleSessionEvent(sh.deps, {
+      kind: 'enqueue',
+      chatId: CHAT,
+      messageId: null,
+      threadId: null,
+      rawContent: 'the next user message',
+    })
+
+    // The atom is stamped…
+    expect((turn as unknown as { realEndObservedAt: number | null }).realEndObservedAt).not.toBeNull()
+    // …the bounded replay grace still honours the flushed turn's own late reply…
+    expect(
+      supersede.peek(CHAT, undefined, { liveTurnId: turn.turnId, now: Date.now() + 1_000 }).reason,
+    ).toBe('supersede')
+    // …and past the grace it is EXPIRED. Deleting `closeFlushCompletionWindows`
+    // from `beginTurn` turns BOTH of the assertions below red (the record would
+    // still read 'supersede' out to the 30-minute cap).
+    expect(
+      supersede.peek(CHAT, undefined, { liveTurnId: turn.turnId, now: Date.now() + CLOSED_BY_GRACE }).reason,
+    ).toBe('expired')
+    expect(
+      supersede.peek(CHAT, undefined, { liveTurnId: turn.turnId, now: Date.now() + STILL_OPEN_AT }).reason,
+    ).toBe('expired')
+  })
+
+  it('PROXY B: the bridge-death sweep (`closeFlushCompletionWindows`) closes an open ' +
+    'window to the grace and reports how many atoms it stamped', async () => {
+    const supersede = new FlushedTurnSupersedeRegistry()
+    const { turn } = await flushWithOpenWindow(supersede)
+
+    // The main claude bridge disconnected: the exact call gateway.ts makes.
+    const closed = closeFlushCompletionWindows(supersede, Date.now())
+    expect(closed).toBe(1) // the open atom was stamped, not silently skipped
+
+    expect((turn as unknown as { realEndObservedAt: number | null }).realEndObservedAt).not.toBeNull()
+    expect(
+      supersede.peek(CHAT, undefined, { liveTurnId: turn.turnId, now: Date.now() + CLOSED_BY_GRACE }).reason,
+    ).toBe('expired')
+    // Idempotent: a second disconnect sweep stamps nothing further.
+    expect(closeFlushCompletionWindows(supersede, Date.now())).toBe(0)
+  })
+
+  it('PROXY B wiring: gateway.ts calls the sweep on MAIN-bridge disconnect and the ' +
+    '#4176 sub-agent liveness reset alongside it (gateway.ts is not importable)', () => {
+    const src = readFileSync(new URL('../gateway/gateway.ts', import.meta.url), 'utf8')
+    const call = 'const closedWindows = closeFlushCompletionWindows(flushedTurnSupersede, Date.now())'
+    expect(src).toContain(call)
+    // The sweep must sit under the main-bridge guard: a CRON bridge dying says
+    // nothing about the main session's flush windows, so closing there would
+    // shorten a live window on an unrelated session.
+    const idx = src.indexOf(call)
+    expect(idx).toBeGreaterThan(0)
+    const before = src.slice(Math.max(0, idx - 1200), idx)
+    expect(before).toContain('isCronIdentity')
+    // #4176 — the sub-agents die with the session; the reset is co-located.
+    expect(before).toContain('subagentReplyAuthority.reset()')
+  })
+})