switchroom 0.21.10 → 0.21.12

package/telegram-plugin/history.ts

@@ -1263,6 +1263,20 @@ export function getRecentOutboundCount(
  *   - explicit number → only that thread (precise for supergroups with topics)
  *   - explicit null → only chat-root (non-thread) messages
  *
+ * `untilMs` semantics — the optional UPPER bound (#4681):
+ *   - omitted → open-ended forward, the original behaviour. Correct for a caller
+ *     whose SCOPE is already tied to the obligation (its own topic): anything
+ *     substantive delivered there since it opened is plausibly its answer.
+ *   - a number → only rows at or before it. Required by any caller whose scope is
+ *     licensed by a SEPARATE, time-bounded piece of evidence — the obligation
+ *     escalate branch's reroute fallback, where an `EXPLICIT_OVERRIDDEN` record
+ *     licenses a look in ANOTHER topic. There an open-ended forward query lets
+ *     unrelated traffic in that topic, arriving arbitrarily later, be mistaken
+ *     for the answer that routing produced. See `escalation-staleness.ts`.
+ *   Applied at SECOND granularity like the lower bound, rounded UP (ceil) so
+ *   rounding can only ever ADMIT a borderline row, never drop a legitimate one —
+ *   the false-negative-safe direction for this predicate.
+ *
  * Falls back to false (safe: never suppresses escalation) if history is not yet
  * initialised or the query fails.
  */
@@ -1271,6 +1285,7 @@ export function hasOutboundDeliveredSince(
   sinceMs: number,
   threadId?: number | null,
   minChars = 200,
+  untilMs?: number,
 ): boolean {
   try {
     const cutoffSec = Math.floor(sinceMs / 1000)
@@ -1287,6 +1302,12 @@ export function hasOutboundDeliveredSince(
     // edits / typing indicators are structurally excluded.
     let sql =
       "SELECT 1 FROM messages WHERE chat_id = ? AND role = 'assistant' AND ts >= ? AND LENGTH(text) >= ?"
+    if (untilMs != null && Number.isFinite(untilMs)) {
+      // Ceil: `ts` is whole seconds, so a bound of e.g. 18_500 ms past the
+      // second boundary must still admit the row written in that second.
+      sql += ' AND ts <= ?'
+      params.push(Math.ceil(untilMs / 1000))
+    }
     if (threadId !== undefined) {
       if (threadId === null) {
         sql += ' AND thread_id IS NULL'

package/telegram-plugin/registry/subagents-bugs.test.ts

@@ -431,9 +431,9 @@ function seedTurn(turnKey: string, chatId = '12345', threadId: string | null = n
 describe('Bug 5 — parent_turn_key stamped from the turn-active marker', () => {
   it('stamps parent_turn_key = marker.turnKey when a turn is active', () => {
     // Supergroup forum-topic turn_key (chat:thread:startedAt).
-    const turnKey = '-1003831053471:4:1780370238492'
-    seedTurn(turnKey, '-1003831053471', '4')
-    writeTurnActiveMarker(turnKey, '-1003831053471', '4')
+    const turnKey = '-1001234567890:4:1780370238492'
+    seedTurn(turnKey, '-1001234567890', '4')
+    writeTurnActiveMarker(turnKey, '-1001234567890', '4')
 
     const event = {
       session_id: 'sess-turnkey',

package/telegram-plugin/render/html-fold.ts

@@ -57,10 +57,28 @@
 //                     angle bracket without tripping `unsupported start tag`.
 //
 // ── The invariant ─────────────────────────────────────────────────────────
-// CONTENT is never lost. Only MARKUP is dropped, and only where dropping it
-// loses no reader-visible text: a matched pair, a comment, a void tag.
-// Anything not demonstrably markup survives to the wire as escaped literal
-// text. (Known residual, NOT introduced by this module and not fixed here: a
+// Only MARKUP is dropped. A token that is not demonstrably markup — an
+// UNMATCHED open/close marker, which is overwhelmingly the shape prose
+// actually takes — always survives to the wire as escaped literal text. That
+// case is protected absolutely. The three shapes classified as markup, and so
+// dropped, are a matched pair, a comment, and a void tag.
+//
+// The invariant is NOT "content is never lost", and must not be read that
+// way. MATCHING is a syntactic discriminator, not a semantic one, so a
+// BALANCED pair of angle brackets in prose is indistinguishable from real
+// markup and is dropped with it:
+//   "Use <key> then later </key> done."      -> "Use  then later  done."
+//   "Wrap it in <b> and close with </b>."    -> "Wrap it in ** and close
+//                                               with **."
+// — author-visible prose is deleted in both, and the second additionally
+// re-wraps the surviving text in the construct the pair named. This is the
+// accepted, deliberate price of the matching discriminator, NOT a defect to
+// fix by weakening it: the alternative (classifying by tag NAME) is what
+// silently deleted every `<service>/<key>` and `<agent>` in this project's own
+// agent output — far more common, and far more damaging, than a balanced pair
+// of brackets in prose.
+//
+// (Second known residual, NOT introduced by this module and not fixed here: a
 // `<` in prose that mdast hands over as a TEXT node rather than an `html` node
 // — the decoded `&lt;c&gt;`, or `response in <1s` — never reaches this module
 // and still ships unescaped. That is a `plain`-node / `escapeMarkdown`

package/telegram-plugin/render/parse.ts

@@ -114,6 +114,7 @@ import {
   type HtmlFoldTarget,
   type HtmlTagInfo,
 } from "./html-fold.js";
+import { codeFenceFor } from "../format.js";
 
 /** Copy UTF-16 offsets off an mdast node. Falls back to 0-length when a
  *  synthesized node lacks a position (from-markdown always sets one, but the
@@ -684,7 +685,14 @@ function buildPreBlock(
   if (ctx.noBreaks === true) {
     return [{ type: "code", text: text.replace(/\s*\r?\n\s*/g, " "), ...span }];
   }
-  const fence = "```";
+  // The fence ships as a `raw` node — verbatim wire passthrough, so nothing
+  // downstream will widen it for us. A hardcoded ``` around a body carrying
+  // its own ``` earns `can't find end of Pre entity` and a plain-text resend
+  // of the whole message. Width comes from the same shared rule
+  // `renderCodeBlock` uses (`codeFenceFor`, format.ts): `buildPreBlock`
+  // returns `Inline[]` and so cannot route through `renderCodeBlock` (which
+  // takes a `Block`), but the width rule is SHARED, not copied.
+  const fence = codeFenceFor(text);
   return [
     mkSeparator(ctx, span.start, span.start),
     {

package/telegram-plugin/render/render.ts

@@ -32,7 +32,13 @@
 // equivalent entities rather than accidentally re-triggering formatting or
 // breaking out of a code span.
 
-import { escapeMarkdown, codeSpanSafe, escapeLinkHref, RICH_MESSAGE_MAX_CHARS } from "../format.js";
+import {
+  escapeMarkdown,
+  codeSpanSafe,
+  codeFenceFor,
+  escapeLinkHref,
+  RICH_MESSAGE_MAX_CHARS,
+} from "../format.js";
 import type {
   Block,
   BlockquoteNode,
@@ -165,15 +171,11 @@ function renderBlockquote(node: BlockquoteNode): string {
 
 function renderCodeBlock(node: CodeBlockNode): string {
   const lang = node.language ?? "";
-  // Fenced code content is verbatim per the formatting guide; the only
-  // hazard is an embedded ``` closing the fence early. Widen the fence to a
-  // run of backticks one longer than the longest run already present in the
-  // content, mirroring the guide's `preBlock` defusal strategy.
-  const longestRun = Math.max(
-    0,
-    ...(node.text.match(/`+/g) ?? []).map((run) => run.length),
-  );
-  const fence = "`".repeat(Math.max(3, longestRun + 1));
+  // Fenced code content is verbatim per the formatting guide; the only hazard
+  // is an embedded ``` closing the fence early. Width comes from the shared
+  // rule (`codeFenceFor`, format.ts) — one backtick longer than the longest
+  // run in the body — which the `<pre>` fold and `degradeToCodeFence` use too.
+  const fence = codeFenceFor(node.text);
   return `${fence}${lang}\n${node.text}\n${fence}`;
 }
 
@@ -415,11 +417,10 @@ function tableDegradationReason(node: TableNode): string | null {
 
 /** Wrap a block's raw source text in a widened preformatted code fence — the
  *  degraded rendering for a malformed table (content verbatim, no broken
- *  markup). Fence-widening mirrors `renderCodeBlock`. */
+ *  markup). Fence-widening is the shared `codeFenceFor` rule. */
 function degradeToCodeFence(source: string, node: Block): string {
   const raw = source.slice(node.start, node.end);
-  const longestRun = Math.max(0, ...(raw.match(/`+/g) ?? []).map((run) => run.length));
-  const fence = "`".repeat(Math.max(3, longestRun + 1));
+  const fence = codeFenceFor(raw);
   return `${fence}\n${raw}\n${fence}`;
 }
 

package/telegram-plugin/tests/answer-route-side-effect.test.ts

@@ -0,0 +1,111 @@
+/**
+ * The override RECORD is a side effect, and only the real gateway body performs
+ * it. This file is the mechanism that proves it still does.
+ *
+ * WHY A SEPARATE FILE FROM THE DRIFT GUARD. `escalation-staleness.test.ts`
+ * ("the recorded override and the EXPLICIT_OVERRIDDEN marker cannot drift
+ * apart") re-spells `resolveAnswerThreadWithLog`'s body in the test and calls
+ * `createAnswerRouteOverrides().note(...)` on its own instance. That proves the
+ * two PREDICATES agree; it cannot prove the gateway CALLS either one. Delete
+ * `answerRouteOverrides.note({...})` from `gateway.ts` and every one of those 64
+ * cases stays green, the whole vitest suite stays green, and `tsc --noEmit`
+ * exits 0 — while the escalation sweep silently loses the only evidence that
+ * ties "topic A's answer landed in B" to "an answer was delivered at all", and
+ * resumes nagging on top of answers the user already received.
+ *
+ * That is not hypothetical: the call site has conflicted twice already. On main,
+ * #4680 extracted the surrounding block into the pure `formatReplyRouteLog` and
+ * dropped the `note()` call in the process. The next person to resolve that
+ * conflict in main's favour reverts this PR's entire premise with a green tree.
+ * Round 3 caught it by hand — this file replaces that prompt discipline with a
+ * deterministic red.
+ *
+ * HOW. It calls the REAL `resolveAnswerThreadWithLog` from `gateway.ts` (exported
+ * as a test seam; no production caller) and asserts on the PROCESS-WIDE
+ * `answerRouteOverrides` singleton that obligation escalation reads. Nothing here
+ * re-derives the override predicate: the only thing asserted is that driving the
+ * real router mutated the real registry.
+ *
+ * Note for future readers: gateway.ts IS importable from a test runner. Several
+ * older comments in this directory claim otherwise ("the gateway IIFE is too
+ * entangled to instantiate in-process"); that was true before the P0e import
+ * cleanup and is stale now — the boot work is `isGatewayMain`-gated, so a plain
+ * `import` is inert.
+ */
+import { describe, it, expect, beforeEach, vi } from 'vitest'
+import { resolveAnswerThreadWithLog } from '../gateway/gateway.js'
+import { answerRouteOverrides } from '../gateway/answer-route-overrides.js'
+import type { CurrentTurn } from '../gateway/gateway.js'
+
+const CHAT = '-100999'
+/** The topic the model addressed its reply to (marko, 2026-08-10 06:36). */
+const MODEL_TOPIC = 4
+/** The topic the framework's authority actually routed it into. */
+const ROUTED_TOPIC = 635
+
+const turn = (chatId: string, threadId: number | undefined): CurrentTurn =>
+  ({
+    turnId: 't1',
+    sessionChatId: chatId,
+    sessionThreadId: threadId,
+    replyCalled: false,
+  }) as unknown as CurrentTurn
+
+describe('the gateway router RECORDS the override it performs (side-effect pin)', () => {
+  beforeEach(() => {
+    // Module singleton — without this a neighbouring file's records leak in and
+    // a deleted `note()` could still look satisfied.
+    answerRouteOverrides.clear()
+    // The router writes its `reply-route` line to stderr; keep the run quiet.
+    vi.spyOn(process.stderr, 'write').mockImplementation((() => true) as never)
+  })
+
+  it('a model-steered reply overridden by a same-chat anchor lands in the registry ' +
+    'obligation escalation reads', () => {
+    expect(answerRouteOverrides.routedOverridesSince(CHAT, MODEL_TOPIC, 0)).toEqual([])
+
+    const routed = resolveAnswerThreadWithLog(
+      CHAT,
+      MODEL_TOPIC,
+      turn(CHAT, ROUTED_TOPIC),
+      'echo',
+      null,
+      'reply',
+    )
+
+    // Precondition: this really is the override shape, not an agreeing route.
+    expect(routed).toBe(ROUTED_TOPIC)
+    expect(routed).not.toBe(MODEL_TOPIC)
+
+    // THE PIN. Empty here means `answerRouteOverrides.note(...)` no longer runs
+    // in `resolveAnswerThreadWithLog` — the escalation sweep has lost its only
+    // per-turn evidence and will nag on top of delivered answers.
+    const recorded = answerRouteOverrides.routedOverridesSince(CHAT, MODEL_TOPIC, 0)
+    expect(recorded).toHaveLength(1)
+    expect(recorded[0]!.routedThreadId).toBe(ROUTED_TOPIC)
+    expect(recorded[0]!.atMs).toBeGreaterThan(0)
+  })
+
+  it('records under the topic the MODEL named, not the one it routed to — the ' +
+    'consumer keys its lookup by the intended topic', () => {
+    resolveAnswerThreadWithLog(CHAT, MODEL_TOPIC, turn(CHAT, ROUTED_TOPIC), 'echo', null, 'reply')
+    expect(answerRouteOverrides.routedOverridesSince(CHAT, ROUTED_TOPIC, 0)).toEqual([])
+    expect(answerRouteOverrides.routedOverridesSince(CHAT, MODEL_TOPIC, 0)).toHaveLength(1)
+  })
+
+  it('NEGATIVE CONTROL: a route that overrode nothing records nothing (so the ' +
+    'pin above cannot be satisfied by an unconditional write)', () => {
+    // Anchor agrees with the model's topic — no override, nothing to record.
+    const routed = resolveAnswerThreadWithLog(
+      CHAT,
+      MODEL_TOPIC,
+      turn(CHAT, MODEL_TOPIC),
+      'echo',
+      null,
+      'reply',
+    )
+    expect(routed).toBe(MODEL_TOPIC)
+    expect(answerRouteOverrides.routedOverridesSince(CHAT, MODEL_TOPIC, 0)).toEqual([])
+    expect(answerRouteOverrides.size()).toBe(0)
+  })
+})

package/telegram-plugin/tests/catch-all-forwarded-history.test.ts

@@ -49,10 +49,10 @@ describe('(a) a forwarded plain-text message records a history row with forwarde
     const forwardOrigin = parseForwardOrigin({
       type: 'user',
       date: 1_700_000_000,
-      sender_user: { id: 424242, is_bot: false, first_name: 'Ken', last_name: 'Thompson' },
+      sender_user: { id: 424242, is_bot: false, first_name: 'Alice', last_name: 'Example' },
     })
     expect(forwardOrigin).toBeDefined()
-    expect(forwardOrigin!.name).toBe('Ken Thompson')
+    expect(forwardOrigin!.name).toBe('Alice Example')
 
     recordInbound({
       chat_id,
@@ -74,7 +74,7 @@ describe('(a) a forwarded plain-text message records a history row with forwarde
     // forwarded provenance.
     expect(row.role).toBe('user')
     expect(row.text).toBe('here is the brief I forwarded')
-    expect(row.forwarded_from).toBe('Ken Thompson')
+    expect(row.forwarded_from).toBe('Alice Example')
     expect(row.forwarded_from_type).toBe('user')
     expect(row.forwarded_from_id).toBe('424242')
   })