switchroom 0.20.9 → 0.20.11

package/telegram-plugin/gateway/privacy-state.ts

@@ -0,0 +1,206 @@
+/**
+ * Per-session privacy state — the gateway side of the `/private` `/public`
+ * feature (switchroom private-mode).
+ *
+ * The operator can pause Hindsight auto-retain for a stretch of a session with
+ * `/private`, then resume it with `/public`. The pause is recorded here as a
+ * list of half-open time intervals in a small JSON state file that the Python
+ * retain side (`vendor/hindsight-memory`) reads to EXCLUDE any turn whose
+ * timestamp falls inside an interval from memory.
+ *
+ * ── The state-file contract (MUST match the Python reader exactly) ──────────
+ * Path: `${TELEGRAM_STATE_DIR}/privacy-state.json` (dir resolved the same way
+ * `src/cli/self-improve-stop.ts:resolveStateDir()` does). Schema:
+ *
+ *   { "version": 1,
+ *     "intervals": [
+ *       { "start": "2026-08-06T02:00:25.558Z", "end": "2026-08-06T02:05:10.100Z" },
+ *       { "start": "2026-08-06T02:10:00.000Z", "end": null }
+ *     ] }
+ *
+ * `end: null` = an OPEN interval = "private right now". At most one is open at
+ * a time. A missing file (or `{"intervals":[]}`) means public — the default.
+ * Timestamps are ISO-8601 via `new Date().toISOString()`.
+ *
+ * ── Invariants ──────────────────────────────────────────────────────────────
+ *   - All writes are ATOMIC (tmp + fsync + rename via `atomicWriteFileSync`),
+ *     so a crash mid-write can never leave the Python reader a torn file.
+ *   - All reads are BEST-EFFORT and never throw: a missing, unreadable, or
+ *     corrupt file resolves to the public default. Losing this state is
+ *     fail-safe (memory records rather than drops), so — unlike the security
+ *     stores — a corrupt file here is tolerated silently rather than
+ *     quarantined.
+ *   - `openPrivateInterval` / `closePrivateInterval` are IDEMPOTENT: a second
+ *     `/private` while already private is a no-op, and `/public` while already
+ *     public is a no-op.
+ */
+
+import { readFileSync, mkdirSync } from 'node:fs'
+import { homedir } from 'node:os'
+import { join } from 'node:path'
+
+import { atomicWriteFileSync } from '../../src/util/atomic.js'
+
+/** One half-open privacy interval. `end: null` = still open ("private now"). */
+export interface PrivacyInterval {
+  start: string
+  end: string | null
+}
+
+/** The on-disk shape of `privacy-state.json`. */
+export interface PrivacyState {
+  version: 1
+  intervals: PrivacyInterval[]
+}
+
+/** The public (default) state — no private intervals. */
+export function emptyPrivacyState(): PrivacyState {
+  return { version: 1, intervals: [] }
+}
+
+// ── Loud, verbatim operator-facing strings ──────────────────────────────────
+// Exported so the gateway command handlers and the boot alert use the exact
+// wording the spec pins (and so tests assert against a single source).
+
+/** Reply to `/private`. */
+export const PRIVATE_ON_REPLY =
+  '🔒 Private mode ON — memory writing paused. Nothing said until /public is stored.'
+
+/** Reply to `/public`. */
+export const PUBLIC_REPLY =
+  '🔓 Public mode — memory writing resumed. The private stretch was excluded from memory.'
+
+/** Loud alert posted when a genuine session start reset a leftover open interval. */
+export const SESSION_RESET_ALERT =
+  '🔓 New session — memory writing is ON by default. Private mode from the previous session was reset.'
+
+/**
+ * Agent state dir — set by start.sh; resolved identically to
+ * `self-improve-stop.ts:resolveStateDir()` so the gateway writer and the
+ * Python reader agree on where `privacy-state.json` lives.
+ */
+export function resolvePrivacyStateDir(): string {
+  return (
+    process.env.TELEGRAM_STATE_DIR ??
+    join(homedir(), '.claude', 'channels', 'telegram')
+  )
+}
+
+/** Absolute path to the shared state file. */
+export function privacyStatePath(stateDir: string = resolvePrivacyStateDir()): string {
+  return join(stateDir, 'privacy-state.json')
+}
+
+/** True iff `v` is a well-formed interval object. */
+function isInterval(v: unknown): v is PrivacyInterval {
+  if (v === null || typeof v !== 'object') return false
+  const o = v as Record<string, unknown>
+  if (typeof o.start !== 'string') return false
+  return o.end === null || typeof o.end === 'string'
+}
+
+/**
+ * Read the current privacy state. BEST-EFFORT: a missing / unreadable /
+ * corrupt file resolves to the public default and NEVER throws. Only
+ * well-formed intervals survive; a partially-corrupt array is filtered down to
+ * its valid members rather than discarded wholesale.
+ */
+export function readPrivacyState(stateDir: string = resolvePrivacyStateDir()): PrivacyState {
+  try {
+    const raw = readFileSync(privacyStatePath(stateDir), 'utf8')
+    const parsed: unknown = JSON.parse(raw)
+    if (parsed === null || typeof parsed !== 'object') return emptyPrivacyState()
+    const rawIntervals = (parsed as Record<string, unknown>).intervals
+    if (!Array.isArray(rawIntervals)) return emptyPrivacyState()
+    return { version: 1, intervals: rawIntervals.filter(isInterval) }
+  } catch {
+    return emptyPrivacyState()
+  }
+}
+
+/**
+ * Atomically persist `state`. BEST-EFFORT: a write failure is logged to stderr
+ * and swallowed so a transient fs error can never crash a command handler or
+ * the boot path. (Losing the write is fail-safe — memory records the turn.)
+ */
+function writePrivacyState(state: PrivacyState, stateDir: string): void {
+  try {
+    mkdirSync(stateDir, { recursive: true })
+  } catch {
+    /* dir may already exist / be unwritable — the write below reports */
+  }
+  try {
+    atomicWriteFileSync(privacyStatePath(stateDir), JSON.stringify(state), 0o600)
+  } catch (err) {
+    process.stderr.write(
+      `telegram gateway: privacy-state write failed: ${err instanceof Error ? err.message : String(err)}\n`,
+    )
+  }
+}
+
+/** True iff an interval is currently open ("private right now"). */
+export function isPrivate(state: PrivacyState): boolean {
+  return state.intervals.some(i => i.end === null)
+}
+
+/**
+ * Start a private stretch. IDEMPOTENT: if an interval is already open this is a
+ * no-op (a second `/private` doesn't stack).
+ */
+export function openPrivateInterval(
+  now: Date = new Date(),
+  stateDir: string = resolvePrivacyStateDir(),
+): void {
+  const state = readPrivacyState(stateDir)
+  if (isPrivate(state)) return
+  state.intervals.push({ start: now.toISOString(), end: null })
+  writePrivacyState(state, stateDir)
+}
+
+/**
+ * End the current private stretch. IDEMPOTENT: if no interval is open (already
+ * public) this is a no-op.
+ */
+export function closePrivateInterval(
+  now: Date = new Date(),
+  stateDir: string = resolvePrivacyStateDir(),
+): void {
+  const state = readPrivacyState(stateDir)
+  const open = state.intervals.find(i => i.end === null)
+  if (!open) return
+  open.end = now.toISOString()
+  writePrivacyState(state, stateDir)
+}
+
+/** Truncate the state file back to the public default. */
+export function resetToPublic(stateDir: string = resolvePrivacyStateDir()): void {
+  writePrivacyState(emptyPrivacyState(), stateDir)
+}
+
+/** Outcome of a session-start reset. */
+export interface SessionResetResult {
+  /** True iff an OPEN interval existed and was reset (a private→public transition). */
+  hadOpenInterval: boolean
+}
+
+/**
+ * Reset privacy to public at a GENUINE session start (cold boot / crash /
+ * planned restart / `/clear`). Always truncates the state file. If — and only
+ * if — an OPEN interval existed (the previous session ended still private),
+ * `onOpenIntervalReset` is invoked so the caller can post the loud alert. When
+ * the previous session was already public there is no transition, so no alert
+ * fires (silent reset).
+ *
+ * The alert is delegated to a callback rather than sent here so this module
+ * stays free of gateway/bot dependencies and unit-testable in isolation.
+ */
+export function resetPrivacyOnGenuineSessionStart(opts: {
+  stateDir?: string
+  onOpenIntervalReset?: () => void
+} = {}): SessionResetResult {
+  const stateDir = opts.stateDir ?? resolvePrivacyStateDir()
+  const hadOpenInterval = isPrivate(readPrivacyState(stateDir))
+  resetToPublic(stateDir)
+  if (hadOpenInterval) opts.onOpenIntervalReset?.()
+  return { hadOpenInterval }
+}

package/telegram-plugin/gateway/self-improve-proposal-wiring.ts

@@ -0,0 +1,176 @@
+/**
+ * Self-improvement proposal IPC handlers, lifted out of gateway.ts.
+ *
+ * Both `post_skill_proposal` (#2670 one-tap self-improvement) and
+ * `post_eval_case_proposal` (RFC amendment §"corrections as eval cases")
+ * arrive over the per-agent gateway socket, are chat-fenced via
+ * `assertAllowedChat`, persisted to their respective store, and rendered as
+ * an Approve/Dismiss card. The store transition + apply on Approve are owned
+ * by the callback handlers (so a gateway restart between post and tap still
+ * resolves), NOT here.
+ *
+ * These live in a module (not inline in gateway.ts) so the gateway anti-
+ * inflation line ratchet stays flat and the handler bodies are unit-testable
+ * against a stubbed `bot` / `swallowingApiCall`. gateway.ts keeps only a thin
+ * delegate per handler.
+ *
+ * The `bot.api.sendMessage` calls are wrapped in the injected
+ * `swallowingApiCall` exactly as they were in gateway.ts — the bot-api-wrapping
+ * lint recognises the wrapper by name in the surrounding context.
+ */
+
+import type { Bot, Context } from 'grammy'
+import type { RetryCallOpts } from '../retry-api-call.js'
+import type { PostSkillProposalMessage, PostEvalCaseProposalMessage } from './ipc-protocol.js'
+import { renderSkillProposalCard, skillProposalKeyboard } from './skill-proposal-card.js'
+import { renderEvalCaseProposalCard, evalCaseProposalKeyboard } from './eval-case-proposal-card.js'
+import {
+  enqueueProposal as enqueueSkillProposal,
+  isSuppressed as isSkillProposalSuppressed,
+} from '../../src/self-improve/skill-proposals.js'
+import { enqueueEvalCaseProposal } from '../../src/self-improve/eval-case-proposals.js'
+
+/** Collaborators the gateway injects into each handler. */
+export interface ProposalWiringDeps {
+  bot: Bot<Context>
+  assertAllowedChat: (chatId: string) => void
+  swallowingApiCall: <T>(fn: () => Promise<T>, opts?: RetryCallOpts) => Promise<T | undefined>
+}
+
+/**
+ * #2670 one-tap self-improvement — persist a skill-improvement proposal and
+ * post its Approve/Dismiss card. Dedups against still-live rejection
+ * fingerprints so a dismissed proposal never re-surfaces.
+ */
+export function handlePostSkillProposal(
+  msg: PostSkillProposalMessage,
+  deps: ProposalWiringDeps,
+): void {
+  const { bot, assertAllowedChat, swallowingApiCall } = deps
+  const self = process.env.SWITCHROOM_AGENT_NAME
+  if (self && msg.agentName !== self) {
+    process.stderr.write(
+      `telegram gateway: post_skill_proposal rejected — agent mismatch (${msg.agentName} != ${self})\n`,
+    )
+    return
+  }
+  try {
+    assertAllowedChat(msg.chatId)
+  } catch (err) {
+    process.stderr.write(
+      `telegram gateway: post_skill_proposal rejected — ${(err as Error).message}\n`,
+    )
+    return
+  }
+  const stateDir = process.env.TELEGRAM_STATE_DIR
+  if (stateDir == null || stateDir.length === 0) {
+    process.stderr.write(`telegram gateway: post_skill_proposal: TELEGRAM_STATE_DIR unset, skipping\n`)
+    return
+  }
+  // Dedup against still-live rejection fingerprints — never re-surface a
+  // proposal the operator already dismissed.
+  if (isSkillProposalSuppressed(stateDir, {
+    lesson: msg.lesson,
+    draft: msg.draft,
+    skill_slug: msg.skillSlug,
+  })) {
+    process.stderr.write(
+      `telegram gateway: post_skill_proposal suppressed (rejected before) slug=${msg.skillSlug}\n`,
+    )
+    return
+  }
+  const proposal = enqueueSkillProposal(stateDir, {
+    skill_slug: msg.skillSlug,
+    is_new: msg.isNew,
+    lesson: msg.lesson,
+    draft: msg.draft,
+    evidence: msg.evidence,
+    chat_id: Number(msg.chatId),
+    // Provenance — absent ⇒ the store's back-compat default (skill-synthesis).
+    ...(msg.origin != null ? { origin: msg.origin } : {}),
+  })
+  const cardText = renderSkillProposalCard({
+    id: proposal.id,
+    skill_slug: proposal.skill_slug,
+    is_new: proposal.is_new,
+    lesson: proposal.lesson,
+    evidence: proposal.evidence,
+    skill_md: proposal.draft['SKILL.md'],
+  })
+  const threadId = msg.threadId
+  void swallowingApiCall(
+    () =>
+      bot.api.sendMessage(msg.chatId, cardText, {
+        parse_mode: 'HTML',
+        reply_markup: skillProposalKeyboard(proposal.id),
+        ...(threadId != null && threadId !== 1 ? { message_thread_id: threadId } : {}),
+      }),
+    { chat_id: msg.chatId, verb: 'skill-proposal-card', ...(threadId != null ? { threadId } : {}) },
+  )
+  process.stderr.write(
+    `telegram gateway: post_skill_proposal agent=${msg.agentName} chat=${msg.chatId} ` +
+    `proposal=${proposal.id} slug=${proposal.skill_slug} new=${proposal.is_new}\n`,
+  )
+}
+
+/**
+ * RFC amendment §"corrections as eval cases" — persist an eval-case proposal
+ * and post its Approve/Dismiss card. On Approve the callback runs the
+ * DETERMINISTIC applier (handleEvalCaseProposalCallback), NOT a model turn, so
+ * the case lands byte-exact. Same per-agent-socket / chat-fenced trust model
+ * as handlePostSkillProposal.
+ */
+export function handlePostEvalCaseProposal(
+  msg: PostEvalCaseProposalMessage,
+  deps: ProposalWiringDeps,
+): void {
+  const { bot, assertAllowedChat, swallowingApiCall } = deps
+  const self = process.env.SWITCHROOM_AGENT_NAME
+  if (self && msg.agentName !== self) {
+    process.stderr.write(
+      `telegram gateway: post_eval_case_proposal rejected — agent mismatch (${msg.agentName} != ${self})\n`,
+    )
+    return
+  }
+  try {
+    assertAllowedChat(msg.chatId)
+  } catch (err) {
+    process.stderr.write(
+      `telegram gateway: post_eval_case_proposal rejected — ${(err as Error).message}\n`,
+    )
+    return
+  }
+  const stateDir = process.env.TELEGRAM_STATE_DIR
+  if (stateDir == null || stateDir.length === 0) {
+    process.stderr.write(`telegram gateway: post_eval_case_proposal: TELEGRAM_STATE_DIR unset, skipping\n`)
+    return
+  }
+  const proposal = enqueueEvalCaseProposal(stateDir, {
+    skill_slug: msg.skillSlug,
+    skill_dir: msg.skillDir,
+    case: msg.case,
+    fingerprint: msg.fingerprint,
+    held_out: msg.heldOut === true,
+    chat_id: Number(msg.chatId),
+  })
+  const cardText = renderEvalCaseProposalCard({
+    id: proposal.id,
+    skill_slug: proposal.skill_slug,
+    held_out: proposal.held_out,
+    case: proposal.case,
+  })
+  const threadId = msg.threadId
+  void swallowingApiCall(
+    () =>
+      bot.api.sendMessage(msg.chatId, cardText, {
+        parse_mode: 'HTML',
+        reply_markup: evalCaseProposalKeyboard(proposal.id),
+        ...(threadId != null && threadId !== 1 ? { message_thread_id: threadId } : {}),
+      }),
+    { chat_id: msg.chatId, verb: 'eval-case-proposal-card', ...(threadId != null ? { threadId } : {}) },
+  )
+  process.stderr.write(
+    `telegram gateway: post_eval_case_proposal agent=${msg.agentName} chat=${msg.chatId} ` +
+    `proposal=${proposal.id} slug=${proposal.skill_slug} held_out=${proposal.held_out}\n`,
+  )
+}

package/telegram-plugin/gateway/stale-pin-sweep-wiring.ts

@@ -51,9 +51,7 @@ export interface StalePinSweepBotSeam {
       ) => Promise<unknown>
       unpinChatMessage: (chatId: string, messageId: number) => Promise<unknown>
       unpinAllForumTopicMessages: (chatId: string, threadId: number) => Promise<unknown>
-      getChatMember: (chatId: string, userId: number) => Promise<unknown>
     }
-    botInfo?: { id?: number }
   }
   /** The gateway's retry/telemetry envelope (`robustApiCall`). */
   call: <T>(fn: () => Promise<T>, meta: { chat_id: string; verb: string }) => Promise<T>
@@ -68,6 +66,14 @@ export interface StalePinSweepWiring {
   loadPinRows: () => PersistedStatusPin[]
   /** Mutex-won AND bot-constructed. False ⇒ the drain must not write. */
   eligible: () => boolean
+  /**
+   * The SHARED per-process pin-rights negative cache (status-pin.ts
+   * `PinRightsCache`), unifying the sweep and the live status-pin path on which
+   * chats are rights-less. Only `isBlocked`/`block` are used here; the live
+   * path owns `clear` (on a successful explicit pin) and boot owns the reset.
+   * Optional — undefined ⇒ the sweep relies purely on its reactive classifier.
+   */
+  rightsCache?: { isBlocked: (chatId: string) => boolean; block: (chatId: string) => boolean }
   store: { path: string; fs: SweepStoreFsSeam }
   /** Per-deployment override of `UNPIN_ALL_FORUM_TOPIC_ENABLED`; undefined =
    *  take the standing policy (the wholesale topic drain stays OFF). */
@@ -168,18 +174,16 @@ export function createGatewayStalePinSweeper(w: StalePinSweepWiring): StalePinSw
         chat_id: chatId,
         verb: 'stale-pin-sweep.unpin-all-topic',
       }),
-    // Rights are checked before ANY write in a group. Telegram is HONEST about
-    // missing pin rights (400 "not enough rights to manage pinned messages"),
-    // but the precheck keeps a rights-less bot from emitting doomed traffic.
-    canPinInChat: async (chatId) => {
-      const self = bot().botInfo?.id
-      if (self == null) return false
-      const member = (await call(() => bot().api.getChatMember(chatId, self), {
-        chat_id: chatId,
-        verb: 'stale-pin-sweep.get-chat-member',
-      })) as { status?: string; can_pin_messages?: boolean } | undefined
-      return member?.status === 'administrator' && member.can_pin_messages === true
-    },
+    // No proactive rights precheck. The old `getChatMember` precheck read
+    // `bot().botInfo?.id`, but the sweep runs against the chat-lock-wrapped bot
+    // (`wrapBot({ api: bot.api })`), which carries only `.api` — `.botInfo` was
+    // always undefined, so `self` was always null and every group precheck
+    // returned false, forfeiting every group cursor without a single unpin. The
+    // sweep now relies SOLELY on its reactive classifier: it attempts the unpin
+    // and classifies Telegram's honest `400 "not enough rights"` via
+    // `isPinRightsError`. Telegram is authoritative about pin rights; a precheck
+    // could only ever be redundant with (and, wired against the wrong bot,
+    // wrong about) that answer.
     recordedPinIds: (chatId, threadId) => {
       try {
         return recordedPinIdsFor(w.loadPinRows(), chatId, threadId)
@@ -200,6 +204,12 @@ export function createGatewayStalePinSweeper(w: StalePinSweepWiring): StalePinSw
         log,
       }),
     eligible: w.eligible,
+    rightsBlocked: w.rightsCache ? (chatId) => w.rightsCache!.isBlocked(chatId) : undefined,
+    recordRightsBlock: w.rightsCache
+      ? (chatId) => {
+          w.rightsCache!.block(chatId)
+        }
+      : undefined,
     sleep: w.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms))),
     now,
     store: w.store,