switchroom 0.19.5 → 0.19.7

package/telegram-plugin/tests/stream-render-golden.test.ts

@@ -56,7 +56,12 @@ function makeFakeBot() {
   const api = {
     sendRichMessage: async (c: string, b: { markdown: string }, o: Record<string, unknown> = {}) => rec('sendRichMessage', c, b.markdown, o),
     sendMessage: async (c: string, t: string, o: Record<string, unknown> = {}) => rec('sendMessage', c, t, o),
-    editMessageText: async (c: string, m: number, b: unknown, o: Record<string, unknown> = {}) => { rec('editMessageText', c, typeof b === 'string' ? b : (b as { markdown: string }).markdown, o); return {} },
+    editMessageText: async (c: string, m: number, b: unknown, o: Record<string, unknown> = {}) => {
+      // Preserve the REAL edit target id (m) so tests can assert an edit-in-place
+      // hit the flushed message, not a synthetic fresh id.
+      calls.push({ method: 'editMessageText', chat_id: c, text: typeof b === 'string' ? b : (b as { markdown: string }).markdown, opts: o, reply_markup: o.reply_markup ?? null, message_id: m })
+      return {}
+    },
     deleteMessage: async (c: string, m: number) => { rec('deleteMessage', c, null); return true },
   }
   return { api, calls }
@@ -100,6 +105,7 @@ function makeStreamDeps(opts?: {
   dedup?: OutboundDedupCache
   turn?: CurrentTurn | null
   deliverResult?: { sentIds: number[]; chunkCount: number; delivered: boolean; exhausted: boolean }
+  flushedTurnSupersede?: FlushedTurnSupersedeRegistry
 }): StreamHarness {
   const { api, calls } = makeFakeBot()
   const dedup = opts?.dedup ?? new OutboundDedupCache()
@@ -135,7 +141,7 @@ function makeStreamDeps(opts?: {
     activeTurnStartedAt: new Map(),
     backstopDeliveryLedger: ledger,
     bot: { api },
-    flushedTurnSupersede: new FlushedTurnSupersedeRegistry(),
+    flushedTurnSupersede: opts?.flushedTurnSupersede ?? new FlushedTurnSupersedeRegistry(),
     idleTracker: { noteEvent: noop },
     lastPtyPreviewByChat: new Map(),
     obligationLedger: { close: noop, noteTurnEnded: noop },
@@ -206,12 +212,12 @@ function makeStreamDeps(opts?: {
 }
 
 // ── the P2 sendReply harness (same content, sharing the ONE cache) ─────────
-function makeSendReplyDeps(dedup: OutboundDedupCache) {
+function makeSendReplyDeps(dedup: OutboundDedupCache, sharedSupersede?: FlushedTurnSupersedeRegistry) {
   const { api, calls } = makeFakeBot()
   const key = (c: string, t?: number | null) => `${c}:${t ?? 'main'}`
   const deps = {
     outboundDedup: dedup,
-    flushedTurnSupersede: new FlushedTurnSupersedeRegistry(),
+    flushedTurnSupersede: sharedSupersede ?? new FlushedTurnSupersedeRegistry(),
     firstTextReplyLogged: new Set<string>(),
     suppressPtyPreview: new Set<string>(),
     activeDraftStreams: new Map(),
@@ -238,7 +244,8 @@ function makeSendReplyDeps(dedup: OutboundDedupCache) {
     assertSendable: () => {},
     statusKey: key,
     streamKey: key,
-    resolveReplyOwnerTurn: () => null,
+    resolveReplyOwnerTurn: () => ({ turn: null, tier: 'none' as const }),
+    getLastSubagentHandbackAt: () => null,
     findTurnByOriginId: () => null,
     findTurnByQuotedMessageId: () => null,
     resolveAnswerThreadWithLog: (_c: string, explicit: number | undefined) => explicit,
@@ -385,6 +392,136 @@ describe('cross-surface dedup — ONE OutboundDedupCache across P4 stream + P2 r
   })
 })
 
+// ── F3 (dup-audit 2026-07-21): the flush RECORD wiring is load-bearing ──────
+//
+// The entire flush→reply dedup depends on stream-render.ts recording the
+// flush's delivered ids into the shared FlushedTurnSupersedeRegistry
+// (`flushedTurnSupersede.record(...)`). Every OTHER outcome test seeds that
+// record by hand (send-reply-golden's seedRecord/seedFlushRecord), so DELETING
+// the record call would reintroduce the dominant flush→reply duplicate with all
+// those tests still green. This drives the REAL flush record() end-to-end (no
+// pre-seed) across ONE shared registry and asserts the reworded same-turn reply
+// collapses to EXACTLY ONE message — so it goes RED if the record() call is
+// removed. This is the guard the audit flagged as missing.
+describe('F3 — flush record() → same-turn reworded reply collapse (end-to-end, no pre-seed)', () => {
+  const settleFlush = () => new Promise((r) => setTimeout(r, 650))
+  const FLUSHED_ANSWER =
+    'All twelve agents are healthy right now. The gateway, the vault broker and the ' +
+    'approval kernel all report green health checks, and no container has restarted in ' +
+    'the last twenty four hours, so there is nothing that needs your attention at the moment.'
+  const REWORDED =
+    'Good news on the fleet. Every one of the twelve agents is running fine at the moment. ' +
+    'Gateway, vault broker and approval kernel are all green, and nothing has restarted in ' +
+    'the past day, so you do not need to do anything right now.'
+
+  it('flush → record → late reworded reply collapses to ONE message ' +
+    '(RED if stream-render flushedTurnSupersede.record is removed)', async () => {
+    // ONE shared supersede registry across BOTH surfaces — exactly the gateway
+    // singleton wiring. The flush RECORDS (the real stream-render.ts:1828 call);
+    // the reply CONSUMES. Nothing is pre-seeded.
+    const supersede = new FlushedTurnSupersedeRegistry()
+    const turn = makeTurn({ capturedText: [FLUSHED_ANSWER], capturedBlockMeta: [true] })
+    const sh = makeStreamDeps({ turn, flushedTurnSupersede: supersede })
+
+    // Drive the REAL turn-flush path: it delivers message A (deliverAnswer → id
+    // 4242) AND records {turnId, [4242]} into the shared registry.
+    handleSessionEvent(sh.deps, { kind: 'turn_end', durationMs: 1200 })
+    await settleFlush()
+    expect(sh.delivered).toContain(FLUSHED_ANSWER)
+    // The record actually landed (this is what a removal breaks first).
+    expect(
+      supersede.peek(CHAT, undefined, { liveTurnId: turn.turnId, now: Date.now() }).reason,
+    ).toBe('supersede')
+
+    // The model's REAL reply lands late with a REWORDED version of the same
+    // answer: no live turn, latest-ended tier, NO handback in flight (CASE A).
+    const s = makeSendReplyDeps(new OutboundDedupCache(), supersede)
+    s.deps.resolveReplyOwnerTurn = () => ({ turn, tier: 'latest-ended' as const })
+    // (getLastSubagentHandbackAt returns null in the base deps → own answer.)
+
+    const res = await sendReply(s.deps, req(REWORDED))
+
+    // EXACTLY ONE client-visible message: the flushed message (4242) edited in
+    // place into the reworded reply — NO fresh second bubble. Without the
+    // record(), the reply finds no record, falls to the latch branch, sees
+    // reworded ≠ flushed content, does NOT suppress, and ships a DUPLICATE
+    // sendRichMessage (edits=0, sends=1) → these assertions fail.
+    const edits = s.calls.filter((c) => c.method === 'editMessageText')
+    expect(edits).toHaveLength(1)
+    expect(edits[0]!.message_id).toBe(4242)
+    expect(s.calls.filter((c) => c.method === 'sendRichMessage')).toHaveLength(0)
+    expect(res.content[0]!.text).toMatch(/^sent/)
+  })
+})
+
+// ── F5 (dup-audit): true take()-before-record() interleaving ────────────────
+//
+// The residual race the supersede registry cannot reach: a reply whose
+// supersede take() runs in the window AFTER the flush FIRED but BEFORE it
+// recorded its message ids. The flush arms `turn.answerDelivered='flush'` (+
+// flushedAnswerText) SYNCHRONOUSLY at fire time — before its async deliver and
+// before record — so a same-answer reply landing in that window is suppressed by
+// the latch, not shipped as a duplicate. This drives a genuine two-emitter
+// interleave (inverted ordering: reply take() strictly before flush record())
+// and asserts exactly one delivered message.
+describe('F5 — take()-before-record() interleaving delivers exactly one message', () => {
+  const settleFlush = () => new Promise((r) => setTimeout(r, 650))
+  // ≥200 chars so the late reply is a substantive final answer (the floor the
+  // flush latch is scoped to) — else it would never trip the suppression.
+  const ANSWER =
+    'Yes, that is all done and confirmed. The migration ran cleanly against the staging ' +
+    'database, every integration check passed on the first attempt, the rollback plan is ' +
+    'staged in case it is ever needed, and I have written the full run log to the shared ' +
+    'drive so the team can review exactly what changed and when it happened.'
+
+  it('a reply whose take() runs BEFORE the flush record() is suppressed by the ' +
+    'flush-armed latch — one delivered message, not two', async () => {
+    const supersede = new FlushedTurnSupersedeRegistry()
+    const turn = makeTurn({ capturedText: [ANSWER], capturedBlockMeta: [true] })
+    const sh = makeStreamDeps({ turn, flushedTurnSupersede: supersede })
+
+    // Fire the flush. Its latch is set SYNCHRONOUSLY here; deliverAnswer + record
+    // run in the async IIFE that has NOT completed — the pre-record window.
+    handleSessionEvent(sh.deps, { kind: 'turn_end', durationMs: 1200 })
+    // INVERTED ORDERING: the reply's take() runs now, before the flush record().
+    expect(
+      supersede.peek(CHAT, undefined, { liveTurnId: turn.turnId, now: Date.now() }).reason,
+    ).toBe('no-record') // record genuinely not written yet
+
+    const s = makeSendReplyDeps(new OutboundDedupCache(), supersede)
+    s.deps.resolveReplyOwnerTurn = () => ({ turn, tier: 'latest-ended' as const })
+    // The same answer landing again in the race window → latch backstop suppresses.
+    const res = await sendReply(s.deps, req(ANSWER))
+
+    expect(s.calls).toHaveLength(0) // the reply shipped nothing
+    expect(res.content[0]!.text).toContain('deduped')
+
+    await settleFlush() // let the flush's async deliver + record complete
+    // Exactly one message reached the user: the flush's message A.
+    expect(sh.delivered).toHaveLength(1)
+    expect(sh.delivered[0]).toContain('done and confirmed')
+  })
+})
+
+// ── Double-flush idempotency at the delivery primitive (audit §3.5) ─────────
+//
+// The E2-vs-E3 double flush (answer-ready quiescence THEN turn-end backstop for
+// the SAME turn) is guarded by backstopDeliveryLedger.claim. The ledger is
+// unit-tested, but the audit wanted it pinned at the SEND-COUNT level in the
+// flush integration. Two turn_end dispatches for one turn must deliver once.
+describe('double-flush idempotency — deliverAnswer fires once (send-count level)', () => {
+  const settleFlush = () => new Promise((r) => setTimeout(r, 650))
+  it('two turn_end dispatches for the same turn deliver the answer EXACTLY once', async () => {
+    const turn = makeTurn()
+    const answer = turn.capturedText.join('')
+    const sh = makeStreamDeps({ turn })
+    handleSessionEvent(sh.deps, { kind: 'turn_end', durationMs: 1200 }) // claims the latch
+    handleSessionEvent(sh.deps, { kind: 'turn_end', durationMs: 1200 }) // claim fails → no-op
+    await settleFlush()
+    expect(sh.delivered).toEqual([answer])
+  })
+})
+
 describe('structural — the singleton lives once in gateway, never in the modules (Amendment 1)', () => {
   const gatewaySrc = readFileSync(new URL('../gateway/gateway.ts', import.meta.url), 'utf8')
   const streamSrc = readFileSync(new URL('../gateway/stream-render.ts', import.meta.url), 'utf8')

package/telegram-plugin/tests/subagent-handback-marker.test.ts

@@ -0,0 +1,165 @@
+/**
+ * Unit coverage for the per-chat/thread subagent-handback marker
+ * (fix/backstop-duplicate-reply; thread-keying — dup-audit F2 2026-07-21). The
+ * marker is the deterministic signal the supersede path uses to tell a flushed
+ * turn's OWN reworded late reply (no handback in flight → supersede) from a
+ * background handback attributed to that ended turn (handback in flight → keep
+ * the #3429 content gate).
+ */
+
+import { describe, it, expect } from 'vitest'
+import { readFileSync, readdirSync } from 'node:fs'
+import { fileURLToPath } from 'node:url'
+import { dirname, join } from 'node:path'
+import {
+  SubagentHandbackMarker,
+  stampsHandbackMarker,
+  INBOUND_SOURCE_CLASSIFICATION,
+} from '../gateway/subagent-handback-marker.js'
+
+describe('SubagentHandbackMarker', () => {
+  it('returns null for a chat with no recorded handback', () => {
+    const m = new SubagentHandbackMarker()
+    expect(m.lastAt('chatA', undefined)).toBe(null)
+  })
+
+  it('returns the recorded enqueue ts for the chat', () => {
+    const m = new SubagentHandbackMarker()
+    m.record('chatA', undefined, 1_000_000)
+    expect(m.lastAt('chatA', undefined)).toBe(1_000_000)
+  })
+
+  it('is per-chat — one chat never leaks into another', () => {
+    const m = new SubagentHandbackMarker()
+    m.record('chatA', undefined, 1_000_000)
+    expect(m.lastAt('chatB', undefined)).toBe(null)
+  })
+
+  it('keeps only the MOST RECENT enqueue (overwrites)', () => {
+    const m = new SubagentHandbackMarker()
+    m.record('chatA', undefined, 1_000_000)
+    m.record('chatA', undefined, 1_050_000)
+    expect(m.lastAt('chatA', undefined)).toBe(1_050_000)
+  })
+
+  // ── F2: thread-keying (dup-audit 2026-07-21) ────────────────────────────
+  it('is per-THREAD — a handback in topic A does not leak into topic B', () => {
+    const m = new SubagentHandbackMarker()
+    m.record('chatA', 111, 1_000_000)
+    // Same chat, different topic → no marker: topic B's CASE-A collapse is
+    // untouched by topic A's handback (the visible-dup gap F2 closed).
+    expect(m.lastAt('chatA', 222)).toBe(null)
+    expect(m.lastAt('chatA', 111)).toBe(1_000_000)
+  })
+
+  it('a thread handback does not leak into the DM (no-thread) lane of the same chat', () => {
+    const m = new SubagentHandbackMarker()
+    m.record('chatA', 111, 1_000_000)
+    expect(m.lastAt('chatA', undefined)).toBe(null)
+  })
+
+  it('the no-thread lane keys identically to the supersede registry (chat only)', () => {
+    const m = new SubagentHandbackMarker()
+    m.record('chatA', undefined, 1_000_000)
+    // A later thread read must NOT see the DM stamp, and vice-versa.
+    expect(m.lastAt('chatA', undefined)).toBe(1_000_000)
+    expect(m.lastAt('chatA', 111)).toBe(null)
+  })
+
+  // ── MUST-FIX 2 (dup-audit / Fable): chat-wide gate read ─────────────────
+  it('lastAtInChat returns the MOST RECENT handback across ALL topics of a chat', () => {
+    const m = new SubagentHandbackMarker()
+    m.record('chatA', 111, 1_000)
+    m.record('chatA', 222, 3_000)
+    m.record('chatA', undefined, 2_000)
+    expect(m.lastAtInChat('chatA')).toBe(3_000)
+    expect(m.lastAtInChat('chatB')).toBe(null)
+  })
+
+  it('lastAtInChat makes the gate un-steerable: a topic-A stamp is seen chat-wide ' +
+    'even when a thread-specific read of topic B would miss it', () => {
+    const m = new SubagentHandbackMarker()
+    m.record('chatA', 111, 5_000)
+    // The content gate reads chat-wide → sees topic A's handback…
+    expect(m.lastAtInChat('chatA')).toBe(5_000)
+    // …whereas a thread-specific read of topic 222 (the F2 regression) missed it,
+    // which is exactly how a steered `message_thread_id` bypassed the gate.
+    expect(m.lastAt('chatA', 222)).toBe(null)
+  })
+})
+
+// ── MUST-FIX 3 (dup-audit / Fable): fail-safe classification + exhaustiveness ──
+describe('inbound source classification (F1 durability)', () => {
+  it('stampsHandbackMarker: subagent_handback stamps; other known sources do not', () => {
+    expect(stampsHandbackMarker('subagent_handback')).toBe(true)
+    expect(stampsHandbackMarker('cron')).toBe(false)
+    expect(stampsHandbackMarker('reaction')).toBe(false)
+    expect(stampsHandbackMarker('resume_interrupted')).toBe(false)
+    expect(stampsHandbackMarker('vault_grant_approved')).toBe(false)
+  })
+
+  it('a normal user inbound (no meta.source) never stamps', () => {
+    expect(stampsHandbackMarker(null)).toBe(false)
+    expect(stampsHandbackMarker(undefined)).toBe(false)
+  })
+
+  it('FAIL-SAFE default: an UNKNOWN synthesized source STAMPS (visible dup, never ' +
+    'silent edit-over)', () => {
+    // The unsafe old default (deny → no stamp → bypass eligible → silent loss)
+    // is inverted: an unclassified future decoupled source keeps the content gate.
+    expect(stampsHandbackMarker('some_future_decoupled_source')).toBe(true)
+    expect(stampsHandbackMarker('another_unclassified_source')).toBe(true)
+  })
+
+  // The real tripwire: scan the gateway for meta.source literals and FAIL when a
+  // new one is added without a registry classification. The grep-the-predicate
+  // structural test could not catch rot; this does.
+  it('exhaustiveness: every gateway-inbound meta.source literal is classified in the registry', () => {
+    const gatewayDir = join(dirname(fileURLToPath(import.meta.url)), '..', 'gateway')
+    const repoRoot = join(dirname(fileURLToPath(import.meta.url)), '..', '..')
+    // `source:` fields that are NOT inbound meta.source tags (config cascade, the
+    // model-source selector, doc comments, typeof guards). Allowlisted so a
+    // genuinely new INBOUND source still trips this guard.
+    const NON_INBOUND_SOURCE_LITERALS = new Set([
+      'env', 'config', 'default', 'transcript', 'override', 'gateway', 'cli', 'string', 'github',
+    ])
+    // The scan surface = every gateway module PLUS the out-of-gateway inbound
+    // builders whose synthesized inbounds are delivered THROUGH the gateway
+    // (dup-audit pass-2 / Fable): `src/web/webhook-dispatch.ts` builds the
+    // `webhook` / `linear` inbounds injected via `webhookInject` → the same
+    // buffer chokepoint. Grep for other `meta:`+`source:` inbound builders if new
+    // dirs appear.
+    const files: string[] = [
+      ...readdirSync(gatewayDir)
+        .filter((f) => f.endsWith('.ts') && !f.endsWith('.test.ts'))
+        .map((f) => join(gatewayDir, f)),
+      join(repoRoot, 'src', 'web', 'webhook-dispatch.ts'),
+    ]
+    const found = new Set<string>()
+    // Catch BOTH quote styles and full source spellings (digits / underscores /
+    // any case) — a single-quote-only, `[a-z_]+`-only regex silently missed the
+    // double-quoted `mental_model_proposal_*` and the out-of-gateway webhook
+    // sources (pass-2 porosity). Variable-valued `source: expr` stays structurally
+    // invisible; the fail-safe stamp default is the safety boundary, not this scan.
+    const patterns = [
+      /source:\s*['"]([A-Za-z0-9_]+)['"]/g,
+      /meta\??\.source\s*===\s*['"]([A-Za-z0-9_]+)['"]/g,
+    ]
+    for (const f of files) {
+      const src = readFileSync(f, 'utf8')
+      for (const re of patterns) {
+        let m: RegExpExecArray | null
+        while ((m = re.exec(src)) != null) found.add(m[1]!)
+      }
+    }
+    const unclassified = [...found]
+      .filter((s) => !NON_INBOUND_SOURCE_LITERALS.has(s))
+      .filter((s) => INBOUND_SOURCE_CLASSIFICATION[s] == null)
+      .sort()
+    // If this fails: a new meta.source literal was added. Classify it in
+    // INBOUND_SOURCE_CLASSIFICATION (decoupledCompletion true ONLY if its reply
+    // can land as a late reply with no live turn of its own), or — if it is a
+    // non-inbound `source:` field — add it to NON_INBOUND_SOURCE_LITERALS.
+    expect(unclassified).toEqual([])
+  })
+})