switchroom 0.20.8 → 0.20.9

package/telegram-plugin/tests/handback-tasknotif-dedup.test.ts

@@ -0,0 +1,248 @@
+/**
+ * Double-wake dedup (v0.20.8 candidate) — one background sub-agent completion
+ * must produce ONE parent wake, not two.
+ *
+ * The bug: a single background sub-agent completion fanned out to TWO
+ * independent wakes of the parent session —
+ *   1. the claude CLI's own `<task-notification>` (enqueued by the CLI itself;
+ *      switchroom read it only as a background-shell liveness signal), and
+ *   2. the gateway-synthesized `subagent_handback` inbound (subagent-watcher
+ *      `onFinish` → `pendingInboundBuffer.push`).
+ * Nothing linked them. The CLI-native wake cannot be suppressed (it is the
+ * CLI's internal queue), so the fix gates the ONE lever switchroom holds — the
+ * handback enqueue — on a recently-seen terminal `<task-notification>` for
+ * EXACTLY the same task/agent id (`CliTaskNotificationLedger`,
+ * subagent-handback-marker.ts; consumed by `decideSubagentHandback`).
+ *
+ * FAIL-OPEN contract pinned here: every uncertain path DELIVERS the handback.
+ * A dropped real wake (silent worker, user waits forever) is strictly worse
+ * than an occasional double.
+ */
+
+import { describe, it, expect } from 'vitest'
+import {
+  CliTaskNotificationLedger,
+  TASK_NOTIFICATION_DEDUP_TTL_MS,
+} from '../gateway/subagent-handback-marker.js'
+import { decideSubagentHandback } from '../gateway/subagent-handback-inbound-builder.js'
+import { projectTranscriptLine } from '../session-tail.js'
+import { applyBackgroundShellLiveness } from '../gateway/background-shell-liveness.js'
+import { readFileSync } from 'node:fs'
+import { join, dirname } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const T0 = 1_700_000_000_000
+
+const base = {
+  handbackEnvValue: undefined as string | undefined,
+  outcome: 'completed' as 'completed' | 'failed' | 'orphan',
+  isBackground: true,
+  fleetChatId: '777',
+  ownerChatId: '999',
+  taskDescription: 'Do the thing',
+  resultText: 'Done.',
+  jsonlAgentId: 'a204deeaedb27b580',
+  nowMs: T0,
+}
+
+// A real captured queue-operation enqueue line shape (fixture
+// bg-shell-liveness-3519.jsonl), retargeted at an AGENT task id — the live
+// transcripts prove `<task-id>` for a backgrounded agent equals the
+// `agent-<id>.jsonl` stem the subagent-watcher uses as `agentId`
+// (verified: <task-id>a204deeaedb27b580</task-id> ↔
+// subagents/agent-a204deeaedb27b580.jsonl).
+function notifLine(taskId: string, status: string): string {
+  return JSON.stringify({
+    type: 'queue-operation',
+    operation: 'enqueue',
+    timestamp: '2026-08-04T00:00:00.000Z',
+    sessionId: 'deadbeef-0000-4000-8000-000000000000',
+    content:
+      `<task-notification>\n<task-id>${taskId}</task-id>\n` +
+      `<tool-use-id>toolu_01TESTTESTTESTTEST</tool-use-id>\n` +
+      `<output-file>/tmp/tasks/${taskId}.output</output-file>\n` +
+      `<status>${status}</status>\n<summary>Agent done</summary>\n</task-notification>`,
+  })
+}
+
+describe('CliTaskNotificationLedger', () => {
+  it('records a terminal notification and reports it within the TTL', () => {
+    const l = new CliTaskNotificationLedger()
+    l.record('a204deeaedb27b580', 'completed', T0)
+    expect(l.seenRecently('a204deeaedb27b580', T0 + 5_000)).toBe(true)
+    expect(l.seenRecently('a204deeaedb27b580', T0 + TASK_NOTIFICATION_DEDUP_TTL_MS)).toBe(true)
+  })
+
+  it('fail-open: expires after the TTL (a resumed worker second completion delivers)', () => {
+    const l = new CliTaskNotificationLedger()
+    l.record('a204deeaedb27b580', 'completed', T0)
+    expect(l.seenRecently('a204deeaedb27b580', T0 + TASK_NOTIFICATION_DEDUP_TTL_MS + 1)).toBe(false)
+  })
+
+  it('fail-open: a DIFFERENT task id never matches', () => {
+    const l = new CliTaskNotificationLedger()
+    l.record('a204deeaedb27b580', 'completed', T0)
+    expect(l.seenRecently('a999999999999999', T0 + 1)).toBe(false)
+  })
+
+  it('fail-open: non-terminal statuses and empty ids are never recorded', () => {
+    const l = new CliTaskNotificationLedger()
+    l.record('a204deeaedb27b580', 'running', T0)
+    l.record('', 'completed', T0)
+    expect(l.seenRecently('a204deeaedb27b580', T0 + 1)).toBe(false)
+    expect(l.seenRecently('', T0 + 1)).toBe(false)
+  })
+
+  it('records failed and killed as terminal (the CLI wakes the parent for those too)', () => {
+    const l = new CliTaskNotificationLedger()
+    l.record('aaa', 'failed', T0)
+    l.record('bbb', 'killed', T0)
+    expect(l.seenRecently('aaa', T0 + 1)).toBe(true)
+    expect(l.seenRecently('bbb', T0 + 1)).toBe(true)
+  })
+
+  it('prunes expired entries on write (bounded memory)', () => {
+    const l = new CliTaskNotificationLedger()
+    l.record('old', 'completed', T0)
+    l.record('new', 'completed', T0 + TASK_NOTIFICATION_DEDUP_TTL_MS + 60_000)
+    // The old entry is both expired AND physically pruned; either way the
+    // observable contract is: it no longer suppresses.
+    expect(l.seenRecently('old', T0 + TASK_NOTIFICATION_DEDUP_TTL_MS + 60_001)).toBe(false)
+    expect(l.seenRecently('new', T0 + TASK_NOTIFICATION_DEDUP_TTL_MS + 60_001)).toBe(true)
+  })
+})
+
+describe('decideSubagentHandback × CLI task-notification dedup', () => {
+  // ── Outcome (a): one background completion → exactly ONE parent wake ──────
+  // RED-before/GREEN-after core: on pre-fix code this decision delivered a
+  // second wake; post-fix it is suppressed with the dedicated reason.
+  it('suppresses the handback when the CLI already woke the parent for this exact completion', () => {
+    const ledger = new CliTaskNotificationLedger()
+    // The CLI's wake for this completion (wake #1) is observed by the tail…
+    for (const ev of projectTranscriptLine(notifLine('a204deeaedb27b580', 'completed'))) {
+      if (ev.kind === 'task_notification') ledger.record(ev.taskId, ev.status, T0)
+    }
+    // …then the watcher's onFinish runs the decide gate (would-be wake #2).
+    const wakes: string[] = ['cli-task-notification'] // wake #1 already happened
+    const d = decideSubagentHandback({
+      ...base,
+      cliTaskNotificationSeen: ledger.seenRecently(base.jsonlAgentId, T0 + 2_000),
+    })
+    if (d.deliver) wakes.push('subagent_handback')
+    expect(d).toEqual({ deliver: false, reason: 'cli-task-notification' })
+    expect(wakes).toHaveLength(1) // exactly one parent wake, not two
+  })
+
+  it('suppresses a FAILED completion the CLI already reported, too', () => {
+    const d = decideSubagentHandback({
+      ...base,
+      outcome: 'failed',
+      cliTaskNotificationSeen: true,
+    })
+    expect(d).toEqual({ deliver: false, reason: 'cli-task-notification' })
+  })
+
+  // ── Outcome (b): fail-open — a handback with NO matching notification fires ─
+  it('fail-open: delivers when no notification was seen (flag false)', () => {
+    const d = decideSubagentHandback({ ...base, cliTaskNotificationSeen: false })
+    expect(d.deliver).toBe(true)
+    if (d.deliver) {
+      expect(d.chatId).toBe('777')
+      expect(d.inbound.meta?.source).toBe('subagent_handback')
+    }
+  })
+
+  it('fail-open: delivers when the flag is omitted entirely (older callers)', () => {
+    const d = decideSubagentHandback({ ...base })
+    expect(d.deliver).toBe(true)
+  })
+
+  it('fail-open end-to-end: a notification for a DIFFERENT agent id does not suppress', () => {
+    const ledger = new CliTaskNotificationLedger()
+    for (const ev of projectTranscriptLine(notifLine('a999999999999999', 'completed'))) {
+      if (ev.kind === 'task_notification') ledger.record(ev.taskId, ev.status, T0)
+    }
+    const d = decideSubagentHandback({
+      ...base,
+      cliTaskNotificationSeen: ledger.seenRecently(base.jsonlAgentId, T0 + 2_000),
+    })
+    expect(d.deliver).toBe(true)
+  })
+
+  it('fail-open end-to-end: an EXPIRED notification does not suppress', () => {
+    const ledger = new CliTaskNotificationLedger()
+    ledger.record(base.jsonlAgentId, 'completed', T0)
+    const d = decideSubagentHandback({
+      ...base,
+      cliTaskNotificationSeen: ledger.seenRecently(
+        base.jsonlAgentId,
+        T0 + TASK_NOTIFICATION_DEDUP_TTL_MS + 1,
+      ),
+    })
+    expect(d.deliver).toBe(true)
+  })
+
+  it('gate ordering: foreground/outcome/env gates still win over the dedup reason', () => {
+    expect(
+      decideSubagentHandback({ ...base, isBackground: false, cliTaskNotificationSeen: true }),
+    ).toEqual({ deliver: false, reason: 'foreground' })
+    expect(
+      decideSubagentHandback({ ...base, outcome: 'orphan', cliTaskNotificationSeen: true }),
+    ).toEqual({ deliver: false, reason: 'outcome-not-terminal' })
+    expect(
+      decideSubagentHandback({ ...base, handbackEnvValue: '0', cliTaskNotificationSeen: true }),
+    ).toEqual({ deliver: false, reason: 'env-disabled' })
+  })
+})
+
+// ── Outcome (c): the task-notification keeps working as a liveness signal ────
+// Recording into the dedup ledger is an ADDITIVE read of the same event; the
+// background-shell-liveness consumer must still see the shell as DEAD.
+describe('task_notification still drives background-shell liveness (not swallowed)', () => {
+  it('one projected event feeds BOTH the liveness registry and the dedup ledger', () => {
+    const dead: string[] = []
+    const alive: string[] = []
+    const registry = {
+      noteBackgroundShellAlive: (_k: string, id: string) => void alive.push(id),
+      noteBackgroundShellDead: (_k: string, id: string) => void dead.push(id),
+    }
+    const ledger = new CliTaskNotificationLedger()
+    const events = projectTranscriptLine(notifLine('bxa4sv3dq', 'completed'))
+    expect(events).toHaveLength(1)
+    for (const ev of events) {
+      applyBackgroundShellLiveness(registry, 'chat:-', ev)
+      if (ev.kind === 'task_notification') ledger.record(ev.taskId, ev.status, T0)
+    }
+    expect(dead).toEqual(['bxa4sv3dq']) // liveness signal intact
+    expect(ledger.seenRecently('bxa4sv3dq', T0 + 1)).toBe(true) // dedup recorded
+    expect(alive).toEqual([])
+  })
+
+  it('a foreground-shell task-notification with NO handback in flight changes nothing else', () => {
+    // A background Bash shell death has no subagent-watcher onFinish — the
+    // ledger entry simply ages out; nothing consults it for shells.
+    const ledger = new CliTaskNotificationLedger()
+    ledger.record('bxa4sv3dq', 'completed', T0)
+    expect(ledger.seenRecently('bxa4sv3dq', T0 + TASK_NOTIFICATION_DEDUP_TTL_MS + 1)).toBe(false)
+  })
+})
+
+// ── Wiring pins — the gateway must actually consult the ledger ───────────────
+// gateway.ts is not unit-instantiable; pin the two wiring sites statically
+// (repo precedent: subagent-handback-marker.test.ts scans gateway source).
+describe('gateway wiring pins', () => {
+  const here = dirname(fileURLToPath(import.meta.url))
+  const gatewaySrc = readFileSync(join(here, '..', 'gateway', 'gateway.ts'), 'utf8')
+
+  it('onSessionEvent records terminal task-notifications into the ledger', () => {
+    expect(gatewaySrc).toMatch(
+      /if \(ev\.kind === 'task_notification'\) cliTaskNotifLedger\.record\(ev\.taskId, ev\.status, Date\.now\(\)\)/,
+    )
+  })
+
+  it('the onFinish decide callsite passes the fail-open seenRecently read', () => {
+    expect(gatewaySrc).toMatch(
+      /cliTaskNotificationSeen: cliTaskNotifLedger\.seenRecently\(agentId, Date\.now\(\)\)/,
+    )
+  })
+})

package/telegram-plugin/tests/render/emphasis-guard.test.ts

@@ -78,18 +78,117 @@ describe("guardAccidentalEmphasis (#3252) — intended emphasis is LEFT UNTOUCHE
     expect(guardAccidentalEmphasis(s)).toBe(s);
   });
 
-  it("leaves space-flanked operators (`3 * 4`) verbatim — GFM cannot emphasise them", () => {
-    const s = "the product 3 * 4 equals 12";
+  it("leaves a lone glob (`*.ts`) verbatim", () => {
+    const s = "match *.ts files only";
+    expect(guardAccidentalEmphasis(s)).toBe(s);
+  });
+});
+
+describe("guardAccidentalEmphasis (#3464) — boundary-flanked `*` (whitespace/boundary on BOTH sides) IS escaped", () => {
+  // A `*` with whitespace or a string boundary on both immediate sides is
+  // neither left- nor right-flanking under GFM — it can never open or close
+  // emphasis, so escaping it is always safe and never touches an intended span.
+  it("escapes a space-flanked operator `3 * 4` (flipped from the old leave-alone pin)", () => {
+    const out = guardAccidentalEmphasis("the product 3 * 4 equals 12");
+    expect(out).toBe("the product 3 \\* 4 equals 12");
+    expect(copyText(out)).toBe("the product 3 * 4 equals 12");
+  });
+
+  it("escapes a bare trailing glob `rm *` (space before, EOL after — boundary both sides)", () => {
+    // `run rm * to clear` — the `*` is whitespace-flanked on both sides.
+    const out = guardAccidentalEmphasis("run rm * to clear the dir");
+    expect(out).toBe("run rm \\* to clear the dir");
+    expect(copyText(out)).toBe("run rm * to clear the dir");
+  });
+
+  it("escapes a single space-flanked `*` in `a * b`", () => {
+    const out = guardAccidentalEmphasis("compute a * b now");
+    expect(out).toBe("compute a \\* b now");
+    expect(copyText(out)).toBe("compute a * b now");
+  });
+
+  it("escapes BOTH space-flanked `*` in `a * b * c`", () => {
+    const out = guardAccidentalEmphasis("compute a * b * c now");
+    expect(out).toBe("compute a \\* b \\* c now");
+    expect(copyText(out)).toBe("compute a * b * c now");
+  });
+
+  it("escapes a `*` at the string end (` *`) — boundary on the trailing side", () => {
+    const out = guardAccidentalEmphasis("clear with rm *");
+    expect(out).toBe("clear with rm \\*");
+  });
+
+  it("PRESERVES a line-leading `* ` — it is a list BULLET, not an operator (#3464 blocker)", () => {
+    // A line-leading `* ` cannot be disambiguated from a `*`-bullet, and Telegram
+    // renders it as a bullet regardless — matching origin/main. Escaping it would
+    // break `*`-bullets on every reply AND (since this arm runs before the
+    // heading guard) disarm the glued-`#` fix for `* #4382`. So it stays verbatim.
+    const s = "* is the multiply op";
     expect(guardAccidentalEmphasis(s)).toBe(s);
   });
 
-  it("leaves a bare trailing glob (`rm *`) verbatim", () => {
-    const s = "run rm * to clear the dir";
+  it("escapes a bare lone `*` (boundary on both sides, no trailing space → not a bullet)", () => {
+    expect(guardAccidentalEmphasis("*")).toBe("\\*");
+  });
+
+  it("leaves `*italic*` untouched (delimiters word-adjacent on the inner side)", () => {
+    const s = "this is *italic* text";
     expect(guardAccidentalEmphasis(s)).toBe(s);
   });
 
-  it("leaves a lone glob (`*.ts`) verbatim", () => {
-    const s = "match *.ts files only";
+  it("leaves `**bold**` untouched", () => {
+    const s = "this is **bold** text";
+    expect(guardAccidentalEmphasis(s)).toBe(s);
+  });
+
+  it("leaves intra-word `x*y` behaviour to the intra-word arm (single `*`, not boundary-flanked)", () => {
+    // A lone intra-word `*` (one asterisk total) stays byte-identical per the
+    // pair threshold; the boundary arm does not match it (alnum on both sides).
+    const s = "the value x*y here";
+    expect(guardAccidentalEmphasis(s)).toBe(s);
+  });
+
+  it("is idempotent on a boundary-flanked escape (double-apply is byte-identical)", () => {
+    const once = guardAccidentalEmphasis("a * b and c * d");
+    expect(guardAccidentalEmphasis(once)).toBe(once);
+    expect(once).not.toContain("\\\\*");
+  });
+
+  it("escapes a `*` alone on its own line (`\\n` counts as whitespace, no bullet)", () => {
+    const out = guardAccidentalEmphasis("line one\n*\nline two");
+    expect(out).toBe("line one\n\\*\nline two");
+  });
+});
+
+describe("guardAccidentalEmphasis (#3464) — line-leading `*` BULLETS are preserved (blocker 2)", () => {
+  it("leaves a multi-line `*`-bullet list unchanged", () => {
+    const s = "* bullet a\n* bullet b";
+    expect(guardAccidentalEmphasis(s)).toBe(s);
+  });
+
+  it("leaves a mixed `*`/`-` bullet list unchanged", () => {
+    const s = "* one\n- two\n* three";
+    expect(guardAccidentalEmphasis(s)).toBe(s);
+  });
+
+  it("leaves `+ item` and `- item` bullets unchanged (they carry no `*`)", () => {
+    expect(guardAccidentalEmphasis("+ item")).toBe("+ item");
+    expect(guardAccidentalEmphasis("- item")).toBe("- item");
+  });
+
+  it("leaves an indented (≤3 space) `*` bullet unchanged", () => {
+    const s = "  * indented bullet";
+    expect(guardAccidentalEmphasis(s)).toBe(s);
+  });
+
+  it("STILL escapes a non-bullet `*` on a line that ALSO has a `*` bullet", () => {
+    // Line 1 is a bullet (preserved); line 2 has a space-flanked operator (escaped).
+    const out = guardAccidentalEmphasis("* bullet\ncompute a * b");
+    expect(out).toBe("* bullet\ncompute a \\* b");
+  });
+
+  it("is a strict no-op for a pure `*`-bullet list (arm stays disarmed)", () => {
+    const s = "* a\n* b\n* c";
     expect(guardAccidentalEmphasis(s)).toBe(s);
   });
 });

package/telegram-plugin/tests/render/heading-guard-blockquote-glued-hash.test.ts

@@ -14,49 +14,43 @@ import { guardAccidentalFormatting } from "../../rich-send.js";
 // On the renderer-BYPASS seam (cards / banners / status / approval sends), no
 // such belt runs, so the glued `#` reaches Telegram unescaped.
 //
-// ── Why this test PINS the current behavior instead of changing it ───────────
-// Whether this is a bug depends on a fact we CANNOT determine from the byte
-// stream: does Telegram's non-spec Bot API rich parser actually promote a
-// space-less `#` to a heading when it sits AFTER a `>`/list marker, the way it
-// demonstrably does at a bare line start (`#3460` → giant heading, #3306/#3463)?
+// ── Live UAT confirmed the promotion → these pins are now FLIPPED (#3464) ─────
+// The question was a fact we could NOT determine from the byte stream: does
+// Telegram's non-spec Bot API rich parser actually promote a space-less `#` to a
+// heading when it sits AFTER a `>`/list marker, the way it demonstrably does at
+// a bare line start (`#3460` → giant heading, #3306/#3463)?
 //   - CommonMark treats `> #3460` as a blockquote whose content is the paragraph
 //     `#3460` (no ATX heading — no space after `#`); `> # Heading` (WITH space)
 //     is a real nested heading. Telegram's promotion of the SPACE-LESS form is
-//     the documented non-spec deviation — but only ever OBSERVED at a bare line
-//     start, never confirmed inside a blockquote/list.
-//   - There is no repo evidence (UAT fixture, doc note, or #3306/#3463 UAT
-//     result) establishing that the promotion fires in this nested position.
-//     The render.ts belt escaping it is a GENERIC side effect of a `^…#`
-//     paragraph regex, not a confirmed-behavior signal.
-// Issue #3464 itself says: "Verify against Telegram live-UAT whether the
-// non-spec heading promotion actually fires inside blockquotes/lists before
-// adding escaping (avoid stray backslashes if it does not)." That live UAT
-// cannot run in vitest. Ken's hard constraint on this guard family is that a
-// wrong "fix" adding stray backslashes would itself corrupt legitimate
-// formatting — the exact thing to avoid. So this test DOCUMENTS the current,
-// deliberately-conservative behavior; if live UAT later confirms Telegram DOES
-// promote here, extend the guard and flip these expectations in the same PR.
+//     the documented non-spec deviation.
+// Issue #3464 said: "Verify against Telegram live-UAT whether the non-spec
+// heading promotion actually fires inside blockquotes/lists before adding
+// escaping (avoid stray backslashes if it does not)." That live UAT has now run
+// and CONFIRMED the promotion fires in the nested position — a `#` glued after a
+// `>`/list marker is promoted to a heading exactly as at a bare line start. So
+// `guardAccidentalHeading` now escapes it (via `ACCIDENTAL_HEADING_AFTER_MARKER`
+// in line-start-guard.ts), and the previously-pinned "left untouched"
+// expectations are flipped to assert the escaped outcome. A real nested heading
+// (`> # Heading`, space AFTER the `#`) and a bare `#` remain untouched (below).
 
-describe("guardAccidentalHeading — glued `#` after a blockquote/list marker is NOT escaped (#3464, awaits live-UAT)", () => {
-  it("leaves `> #3460` untouched (glued hash after a blockquote marker)", () => {
-    expect(guardAccidentalHeading("> #3460 done")).toBe("> #3460 done");
+describe("guardAccidentalHeading — glued `#` after a blockquote/list marker IS escaped (#3464, live-UAT confirmed)", () => {
+  it("escapes `> #3460` (glued hash after a blockquote marker)", () => {
+    expect(guardAccidentalHeading("> #3460 done")).toBe("> \\#3460 done");
   });
 
-  it("leaves `- #3460` untouched (glued hash after an unordered-list marker)", () => {
-    expect(guardAccidentalHeading("- #3460 done")).toBe("- #3460 done");
+  it("escapes `- #3460` (glued hash after an unordered-list marker)", () => {
+    expect(guardAccidentalHeading("- #3460 done")).toBe("- \\#3460 done");
   });
 
-  it("leaves `* #3460` untouched (glued hash after a `*` bullet)", () => {
-    expect(guardAccidentalHeading("* #3460 x")).toBe("* #3460 x");
+  it("escapes `* #3460` (glued hash after a `*` bullet)", () => {
+    expect(guardAccidentalHeading("* #3460 x")).toBe("* \\#3460 x");
   });
 
-  it("leaves `1. #3460` untouched (glued hash after an ordered-list marker)", () => {
-    expect(guardAccidentalHeading("1. #3460 x")).toBe("1. #3460 x");
+  it("escapes `1. #3460` (glued hash after an ordered-list marker)", () => {
+    expect(guardAccidentalHeading("1. #3460 x")).toBe("1. \\#3460 x");
   });
 
-  it("still escapes the SAME `#3460` at a bare line start (the confirmed case)", () => {
-    // Proves the untouched results above are the `^`-anchor scope, not the guard
-    // being disabled: at a real line start the accidental heading IS escaped.
+  it("still escapes the SAME `#3460` at a bare line start (the original confirmed case)", () => {
     expect(guardAccidentalHeading("#3460 done")).toBe("\\#3460 done");
   });
 });
@@ -71,16 +65,109 @@ describe("guardAccidentalHeading — a real nested heading (space form) must sta
   });
 });
 
-describe("guardAccidentalFormatting (universal seam) — same conservative behavior end-to-end (#3464)", () => {
-  it("leaves `> #3460` untouched through the full composition", () => {
-    expect(guardAccidentalFormatting("> #3460 done")).toBe("> #3460 done");
+describe("guardAccidentalFormatting (universal seam) — glued `#` after a marker IS escaped end-to-end (#3464)", () => {
+  it("escapes `> #3460` through the full composition", () => {
+    expect(guardAccidentalFormatting("> #3460 done")).toBe("> \\#3460 done");
   });
 
-  it("leaves `- #3460` untouched through the full composition", () => {
-    expect(guardAccidentalFormatting("- #3460 done")).toBe("- #3460 done");
+  it("escapes `- #3460` through the full composition", () => {
+    expect(guardAccidentalFormatting("- #3460 done")).toBe("- \\#3460 done");
   });
 
   it("still escapes a bare line-leading `#3460` at the seam (control)", () => {
     expect(guardAccidentalFormatting("#3460 done")).toBe("\\#3460 done");
   });
 });
+
+describe("guardAccidentalHeading (#3464) — every list/blockquote marker shape + nesting is escaped", () => {
+  it("escapes `- #4382's x` (apostrophe-suffixed hash after a `-` bullet)", () => {
+    expect(guardAccidentalHeading("- #4382's x")).toBe("- \\#4382's x");
+  });
+
+  it("escapes `* #x` (after a `*` bullet)", () => {
+    expect(guardAccidentalHeading("* #x")).toBe("* \\#x");
+  });
+
+  it("escapes `+ #x` (after a `+` bullet)", () => {
+    expect(guardAccidentalHeading("+ #x")).toBe("+ \\#x");
+  });
+
+  it("escapes `1. #x` (after a `.`-delimited ordered marker)", () => {
+    expect(guardAccidentalHeading("1. #x")).toBe("1. \\#x");
+  });
+
+  it("escapes `1) #x` (after a `)`-delimited ordered marker)", () => {
+    expect(guardAccidentalHeading("1) #x")).toBe("1) \\#x");
+  });
+
+  it("escapes `> #x` (after a blockquote marker)", () => {
+    expect(guardAccidentalHeading("> #x")).toBe("> \\#x");
+  });
+
+  it("escapes nested `- > #x` (a bullet then a blockquote marker)", () => {
+    expect(guardAccidentalHeading("- > #x")).toBe("- > \\#x");
+  });
+});
+
+describe("guardAccidentalHeading (#3464) — invariants that must stay untouched", () => {
+  it("leaves `- # Heading` (real nested heading, space after `#`)", () => {
+    expect(guardAccidentalHeading("- # Heading")).toBe("- # Heading");
+  });
+
+  it("leaves `# Heading` (real bare heading, space after `#`)", () => {
+    expect(guardAccidentalHeading("# Heading")).toBe("# Heading");
+  });
+
+  it("still escapes bare `#4382 done` (unchanged from before this PR)", () => {
+    expect(guardAccidentalHeading("#4382 done")).toBe("\\#4382 done");
+  });
+});
+
+describe("guardAccidentalFormatting (#3464) — `*`-bullet marker survives emphasis AND the glued `#` is escaped (blocker 1, end-to-end)", () => {
+  // The composed pipeline (rich-send.ts) runs guardAccidentalEmphasis BEFORE
+  // guardAccidentalHeading. If the emphasis arm escaped the leading `* ` bullet,
+  // the LITERAL `*` marker the heading guard needs would be gone and the glued
+  // `#` would NOT be escaped. These tests exercise the REAL ordering — the unit
+  // tests above call the heading guard in isolation and cannot catch that.
+  it("escapes `* #3460 x` end-to-end (marker preserved, `#` escaped)", () => {
+    expect(guardAccidentalFormatting("* #3460 x")).toBe("* \\#3460 x");
+  });
+
+  it("escapes `* #x` end-to-end", () => {
+    expect(guardAccidentalFormatting("* #x")).toBe("* \\#x");
+  });
+
+  it("escapes `- #3460 x` end-to-end (regression guard — `-` marker never touched)", () => {
+    expect(guardAccidentalFormatting("- #3460 x")).toBe("- \\#3460 x");
+  });
+
+  it("escapes `> #x` end-to-end", () => {
+    expect(guardAccidentalFormatting("> #x")).toBe("> \\#x");
+  });
+
+  it("leaves a plain `*`-bullet list unchanged end-to-end (no glued `#`)", () => {
+    const s = "* bullet a\n* bullet b";
+    expect(guardAccidentalFormatting(s)).toBe(s);
+  });
+
+  it("leaves a mixed `*`/`-` bullet list unchanged end-to-end", () => {
+    const s = "* one\n- two\n* three";
+    expect(guardAccidentalFormatting(s)).toBe(s);
+  });
+});
+
+describe("guardAccidentalHeading (#3464) — idempotence (double-apply is byte-identical)", () => {
+  for (const input of [
+    "- #4382 done",
+    "> #x",
+    "- > #x",
+    "1. #x",
+    "#4382 done",
+  ]) {
+    it(`is idempotent on ${JSON.stringify(input)}`, () => {
+      const once = guardAccidentalHeading(input);
+      expect(guardAccidentalHeading(once)).toBe(once);
+      expect(once).not.toContain("\\\\#");
+    });
+  }
+});

package/telegram-plugin/tests/reply-quote-wire.test.ts

@@ -433,3 +433,50 @@ describe('quote_text lands on the wire as ReplyParameters.quote (a String)', ()
     expect(long.startsWith(quote)).toBe(true)
   })
 })
+
+/**
+ * #4368 — a fabricated reply anchor on the wire.
+ *
+ * The model's `reply` tool can quote a SYNTHETIC inbound: a boot-resume /
+ * subagent-handback / cron turn fabricates a `message_id` from `Date.now()`
+ * (~1.78e13). Telegram's `reply_parameters.message_id` HARD-rejects anything
+ * out of the signed-int32 range (400 `field "message_id" must be a valid
+ * Number`), and `allow_sending_without_reply` does NOT bypass that — so quoting
+ * a synthetic id used to 400 EVERY chunk of the reply, losing the answer.
+ *
+ * `executeReply` (whose body is `sendReply`) must route `args.reply_to` through
+ * `parseSourceMessageId` so an out-of-range anchor is DROPPED and the reply
+ * lands UNANCHORED. This reads what actually goes over the wire — a builder-
+ * level assertion would not catch a future opts transform re-introducing it.
+ */
+describe('synthetic reply anchor is dropped on the wire (#4368)', () => {
+  it('quoting an out-of-int32 reply_to sends UNANCHORED and still delivers', async () => {
+    const h = makeHarness()
+    const res = await sendReply(h.deps, {
+      args: {
+        chat_id: CHAT,
+        text: 'The answer must land even when the quoted inbound was synthetic.',
+        reply_to: 1_785_000_000_000,
+      },
+      turn: null,
+    })
+
+    const sends = h.sends()
+    expect(sends.length).toBeGreaterThan(0)
+    // The fabricated id never reaches the wire: no reply_parameters at all …
+    expect(h.replyParams(sends[0])).toBeUndefined()
+    // … and specifically no out-of-range message_id anywhere in the payload.
+    expect(JSON.stringify(sends[0].payload)).not.toContain('1785000000000')
+    // … and the answer actually delivered (not a failure notice).
+    expect(res.content[0]?.text ?? '').toMatch(/sent/i)
+  })
+
+  it('a real (in-range) reply_to is still honored as a quote anchor', async () => {
+    const h = makeHarness()
+    await sendReply(h.deps, {
+      args: { chat_id: CHAT, text: 'ok', reply_to: 4242 },
+      turn: null,
+    })
+    expect(h.replyParams(h.sends()[0])!).toEqual({ message_id: 4242 })
+  })
+})

package/telegram-plugin/tests/sticker-aliases.test.ts

@@ -230,3 +230,46 @@ describe('resolveGifSendArgs', () => {
     expect(r.replyTo).toBe(88)
   })
 })
+
+// #4368 — a fabricated reply anchor (a synthetic boot-resume/handback/cron
+// inbound id at `Date.now()` scale, ~1.78e13) is out of the signed-int32 range
+// Telegram accepts for `reply_parameters.message_id`. It must be DROPPED at the
+// resolver boundary so the sticker/GIF still sends (unanchored) rather than the
+// agent's echoed synthetic id 400ing the whole send. Before the fix these
+// resolvers ran `Number(raw.reply_to)`, which is finite and > 0 for a 13-digit
+// timestamp, so the fabricated id passed straight through onto the wire.
+const SYNTHETIC_MESSAGE_ID = String(1_785_000_000_000)
+
+describe('resolveStickerSendArgs — synthetic reply anchor (#4368)', () => {
+  it('drops an out-of-int32 reply_to so the sticker sends unanchored', () => {
+    const r = resolveStickerSendArgs(
+      { chat_id: '1', sticker: SAMPLE_FILE_ID, reply_to: SYNTHETIC_MESSAGE_ID },
+      {},
+    )
+    expect(r.replyTo).toBeUndefined()
+  })
+
+  it('still preserves a real (in-range) reply_to', () => {
+    const r = resolveStickerSendArgs(
+      { chat_id: '1', sticker: SAMPLE_FILE_ID, reply_to: '4242' },
+      {},
+    )
+    expect(r.replyTo).toBe(4242)
+  })
+})
+
+describe('resolveGifSendArgs — synthetic reply anchor (#4368)', () => {
+  it('drops an out-of-int32 reply_to so the GIF sends unanchored', () => {
+    const r = resolveGifSendArgs({
+      chat_id: '1',
+      gif: SAMPLE_FILE_ID,
+      reply_to: SYNTHETIC_MESSAGE_ID,
+    })
+    expect(r.replyTo).toBeUndefined()
+  })
+
+  it('still preserves a real (in-range) reply_to', () => {
+    const r = resolveGifSendArgs({ chat_id: '1', gif: SAMPLE_FILE_ID, reply_to: '4242' })
+    expect(r.replyTo).toBe(4242)
+  })
+})