switchroom 0.7.15 → 0.10.0

package/telegram-plugin/tests/quota-check.test.ts

@@ -380,41 +380,11 @@ describe('fetchAccountQuota — cache + token resolution', () => {
     }
   })
 
-  it('persists the snapshot under the supplied home, not the real homedir (issue #708 regression)', async () => {
-    const home = makeAccountHome({
-      'work@example.com': { accessToken: 'tok' },
-    })
-    const fakeFetch = async () =>
-      new Response('{}', {
-        status: 200,
-        headers: {
-          'anthropic-ratelimit-unified-5h-utilization': '0.42',
-          'anthropic-ratelimit-unified-7d-utilization': '0.17',
-        },
-      })
-    try {
-      const r = await fetchAccountQuota('work@example.com', {
-        home,
-        fetchImpl: fakeFetch as typeof fetch,
-      })
-      expect(r.ok).toBe(true)
-      const snapPath = join(
-        home,
-        '.switchroom',
-        'accounts',
-        'work@example.com',
-        'quota.json',
-      )
-      // The bug: writeAccountQuota was called without opts.home, so the
-      // snapshot landed under the real $HOME instead of the test home.
-      expect(existsSync(snapPath)).toBe(true)
-      const snap = JSON.parse(readFileSync(snapPath, 'utf-8'))
-      expect(snap.fiveHourPct).toBeCloseTo(42, 0)
-      expect(snap.sevenDayPct).toBeCloseTo(17, 0)
-    } finally {
-      rmSync(home, { recursive: true, force: true })
-    }
-  })
+  // Removed in RFC H: per-account quota.json disk persistence is gone.
+  // switchroom-auth-broker holds canonical quota state and exposes it
+  // via list-state; the gateway's in-process cache is enough between
+  // restarts (and the broker survives gateway restarts, so the state
+  // is preserved at the broker side anyway).
 })
 
 describe('getCachedAccountQuota + prefetchAccountQuotaIfStale', () => {

package/telegram-plugin/tests/races.test.ts

@@ -840,3 +840,182 @@ describe('Queue lifecycle: multiple queued messages overwrite notification', ()
     expect(secondNotif!.messageId).not.toBe(firstMsgId)
   })
 })
+
+// ───────────────────────────────────────────────────────────────────────────
+// #1067 — currentTurn atom snapshot-at-entry race regression
+// ───────────────────────────────────────────────────────────────────────────
+//
+// Pre-#1067: gateway.ts had ~13 module-level `let`s holding the implicit
+// "current turn" state (currentSessionChatId, currentTurnStartedAt, etc).
+// Async session-event handlers read those singletons directly. When a
+// handler captured a value, awaited (e.g. sendMessage / progress-card
+// edit), and resumed, an intervening `enqueue` for a different chat could
+// swap the singletons — and the resumed handler would mis-route its
+// effect to the new chat (wrong-chat progress card, wrong-chat status
+// reaction, wrong-chat answer-stream update).
+//
+// Fix: consolidate the singletons into one atom and capture it at handler
+// entry: `const turn = currentTurn; if (turn == null) return;` — every
+// subsequent read uses `turn.*` so the snapshot is stable across awaits.
+//
+// This test models the pattern with a minimal atom + handler harness and
+// asserts the effect lands on the *original* turn's chat, not the
+// usurper's. If the fix is ever undone, this test fails — making the
+// reattribution race detectable in CI.
+
+type _Test1067_CurrentTurn = {
+  sessionChatId: string
+  startedAt: number
+}
+
+interface _Test1067_Effect {
+  chatId: string
+  reason: 'tool_use' | 'turn_end'
+}
+
+describe('#1067 — currentTurn snapshot-at-entry prevents cross-chat reattribution', () => {
+  /** A synchronous swap of the atom — models the enqueue handler. */
+  function enqueue(state: { atom: _Test1067_CurrentTurn | null }, chatId: string, now: number): void {
+    state.atom = { sessionChatId: chatId, startedAt: now }
+  }
+
+  /**
+   * The pre-#1067 anti-pattern: re-read the singleton after the await.
+   * Any mid-await swap mis-attributes the effect to the new chat.
+   */
+  async function legacyToolUseHandler(
+    state: { atom: _Test1067_CurrentTurn | null },
+    effects: _Test1067_Effect[],
+    midAwait: () => Promise<void>,
+  ): Promise<void> {
+    const beforeChatId = state.atom?.sessionChatId
+    if (beforeChatId == null) return
+    // Simulate the await window (status-reaction edit, progress-card mutation,
+    // answer-stream API call — anything that yields the event loop).
+    await midAwait()
+    // Bug: re-read currentTurn after the await. A concurrent enqueue
+    // could have swapped the singletons; this effect now lands on the
+    // wrong chat.
+    const afterChatId = state.atom?.sessionChatId
+    if (afterChatId == null) return
+    effects.push({ chatId: afterChatId, reason: 'tool_use' })
+  }
+
+  /**
+   * The post-#1067 pattern: snapshot at handler entry, use the local
+   * through the rest of the handler — across awaits.
+   */
+  async function fixedToolUseHandler(
+    state: { atom: _Test1067_CurrentTurn | null },
+    effects: _Test1067_Effect[],
+    midAwait: () => Promise<void>,
+  ): Promise<void> {
+    const turn = state.atom // snapshot
+    if (turn == null) return
+    await midAwait()
+    // Use the captured `turn`, not state.atom. The effect goes to the
+    // chat that the handler was actually invoked for.
+    effects.push({ chatId: turn.sessionChatId, reason: 'tool_use' })
+  }
+
+  it('legacy pattern: mid-await enqueue reattributes the effect (regression baseline)', async () => {
+    const state: { atom: _Test1067_CurrentTurn | null } = { atom: null }
+    const effects: _Test1067_Effect[] = []
+
+    enqueue(state, 'A', 100)
+    // Start the handler; it will await midway.
+    let releaseAwait: () => void = () => {}
+    const blocker = new Promise<void>(resolve => { releaseAwait = resolve })
+    const handlerDone = legacyToolUseHandler(state, effects, () => blocker)
+
+    // While handler is suspended, an enqueue for chat B lands. Pre-#1067
+    // gateway would mutate the same singletons.
+    enqueue(state, 'B', 200)
+
+    releaseAwait()
+    await handlerDone
+
+    // Reattribution: the legacy pattern sends A's tool_use effect to B.
+    expect(effects).toEqual([{ chatId: 'B', reason: 'tool_use' }])
+  })
+
+  it('fixed pattern: snapshot-at-entry keeps the effect on the original chat', async () => {
+    const state: { atom: _Test1067_CurrentTurn | null } = { atom: null }
+    const effects: _Test1067_Effect[] = []
+
+    enqueue(state, 'A', 100)
+    let releaseAwait: () => void = () => {}
+    const blocker = new Promise<void>(resolve => { releaseAwait = resolve })
+    const handlerDone = fixedToolUseHandler(state, effects, () => blocker)
+
+    // Mid-handler enqueue for chat B — the race-trigger.
+    enqueue(state, 'B', 200)
+
+    releaseAwait()
+    await handlerDone
+
+    // The effect lands on A, the turn the handler was invoked for.
+    // This is the regression guard for #1067.
+    expect(effects).toEqual([{ chatId: 'A', reason: 'tool_use' }])
+  })
+
+  it('fixed pattern: if currentTurn is cleared mid-handler, the captured snapshot still wins', async () => {
+    // turn_end (or context-exhaustion bail-out) nulls the atom. A handler
+    // already in flight should still complete against its snapshot rather
+    // than dropping the effect — losing the snapshot here would
+    // re-introduce the cross-attribution failure mode if a NEW enqueue
+    // races the cleanup.
+    const state: { atom: _Test1067_CurrentTurn | null } = { atom: null }
+    const effects: _Test1067_Effect[] = []
+
+    enqueue(state, 'A', 100)
+    let releaseAwait: () => void = () => {}
+    const blocker = new Promise<void>(resolve => { releaseAwait = resolve })
+    const handlerDone = fixedToolUseHandler(state, effects, () => blocker)
+
+    // turn_end nulls the atom; then an immediate enqueue for B swaps in
+    // a fresh atom. The legacy reader would see B; the fixed reader
+    // still sees A.
+    state.atom = null
+    enqueue(state, 'B', 200)
+
+    releaseAwait()
+    await handlerDone
+
+    expect(effects).toEqual([{ chatId: 'A', reason: 'tool_use' }])
+  })
+
+  it('fixed pattern: multiple concurrent handlers each see their own turn', async () => {
+    // Pipeline: handler 1 starts under turn A and awaits. While it's
+    // suspended, turn_end + enqueue B happens. Handler 2 then starts
+    // under turn B and awaits. Both eventually resume. Each handler's
+    // effect must reflect the turn it started under.
+    const state: { atom: _Test1067_CurrentTurn | null } = { atom: null }
+    const effects: _Test1067_Effect[] = []
+
+    enqueue(state, 'A', 100)
+    let release1: () => void = () => {}
+    const block1 = new Promise<void>(resolve => { release1 = resolve })
+    const h1 = fixedToolUseHandler(state, effects, () => block1)
+
+    state.atom = null
+    enqueue(state, 'B', 200)
+
+    let release2: () => void = () => {}
+    const block2 = new Promise<void>(resolve => { release2 = resolve })
+    const h2 = fixedToolUseHandler(state, effects, () => block2)
+
+    // Resume in reverse order: handler 2 first, then handler 1. This
+    // proves the snapshot is not order-dependent.
+    release2()
+    await h2
+    release1()
+    await h1
+
+    // Both handlers landed effects on their respective turns; neither
+    // got reattributed to the other's chat.
+    expect(effects).toContainEqual({ chatId: 'A', reason: 'tool_use' })
+    expect(effects).toContainEqual({ chatId: 'B', reason: 'tool_use' })
+    expect(effects).toHaveLength(2)
+  })
+})

package/telegram-plugin/tests/reaction-trigger-flow.test.ts

@@ -0,0 +1,353 @@
+/**
+ * End-to-end flow test for the reaction-trigger pipeline (#1074).
+ *
+ * Mirrors the gateway handler's decision flow (predicate → admin check
+ * → hour cap → debounce → InboundMessage build → dispatch) without
+ * pulling in the gateway module's heavy side-effects. The integration
+ * point that matters is the SHAPE of the InboundMessage emitted to the
+ * dispatcher — that's what the bridge sees as a synthetic turn.
+ *
+ * What this test pins:
+ *   1. A bot-authored 👎 dispatches a single inbound with
+ *      `meta.source="reaction"` after the debounce window.
+ *   2. A ❤️ reaction (not in default allowlist) dispatches NOTHING.
+ *   3. A user-authored target message dispatches NOTHING.
+ *   4. Two reactions within the window collapse into one batched
+ *      synthetic with the second emoji NOT lost.
+ *   5. The hour cap refuses past the limit (no inbound emitted).
+ *   6. Group + non-admin reacter dispatches NOTHING.
+ *   7. Group + admin reacter dispatches normally.
+ *
+ * Each scenario builds a fresh HourCap + DebounceBuffer so state never
+ * leaks across tests.
+ */
+
+import { describe, it, expect } from 'bun:test'
+import {
+  DebounceBuffer,
+  HourCap,
+  REACTIONS_DEFAULTS,
+  buildReactionInboundMeta,
+  buildReactionInboundText,
+  evaluateTriggerCandidate,
+  isGroupChat,
+  resolveReactionsConfig,
+  truncatePreview,
+  type PendingReaction,
+  type ReactionBatch,
+  type ReactionsResolvedConfig,
+} from '../gateway/reaction-trigger.ts'
+
+interface FakeInbound {
+  chatId: string
+  text: string
+  meta: Record<string, string>
+  userId: number
+  user: string
+  messageId: number
+  threadId?: number
+}
+
+/**
+ * Test driver that mirrors the gateway handler flow.
+ */
+interface DriverState {
+  cfg: ReactionsResolvedConfig
+  cap: HourCap
+  buf: DebounceBuffer
+  sched: FakeScheduler
+  dispatched: FakeInbound[]
+  /** Map from message_id → role + text. */
+  history: Map<number, { role: 'user' | 'assistant'; text: string }>
+  /** Set of user_ids treated as group admin (consulted on group chats). */
+  admins: Set<number>
+}
+
+interface FakeScheduler {
+  pending: Array<{ id: number; fn: () => void }>
+  schedule: (fn: () => void, ms: number) => { id: number; fn: () => void }
+  cancel: (h: { id: number }) => void
+  flushAll: () => void
+}
+
+function makeScheduler(): FakeScheduler {
+  let next = 1
+  const pending: Array<{ id: number; fn: () => void }> = []
+  return {
+    pending,
+    schedule(fn) {
+      const h = { id: next++, fn }
+      pending.push(h)
+      return h
+    },
+    cancel(h) {
+      const i = pending.findIndex((p) => p.id === h.id)
+      if (i >= 0) pending.splice(i, 1)
+    },
+    flushAll() {
+      const snap = pending.splice(0)
+      for (const p of snap) p.fn()
+    },
+  }
+}
+
+function makeDriver(over: Partial<ReactionsResolvedConfig> = {}): DriverState {
+  const cfg = { ...REACTIONS_DEFAULTS, ...over }
+  const sched = makeScheduler()
+  const dispatched: FakeInbound[] = []
+  const buf = new DebounceBuffer(
+    cfg.debounceMs,
+    (b) => dispatchBatch(b, dispatched),
+    { schedule: sched.schedule as never, cancel: sched.cancel as never },
+  )
+  return {
+    cfg,
+    cap: new HourCap(cfg.perHourCap),
+    buf,
+    sched,
+    dispatched,
+    history: new Map(),
+    admins: new Set(),
+  }
+}
+
+function dispatchBatch(batch: ReactionBatch, sink: FakeInbound[]): void {
+  const head = batch.reactions[batch.reactions.length - 1]!
+  sink.push({
+    chatId: String(batch.chatId),
+    text: buildReactionInboundText(batch),
+    meta: buildReactionInboundMeta(batch),
+    userId: head.userId,
+    user: head.user,
+    messageId: Date.now(),
+    ...(head.threadId !== undefined ? { threadId: head.threadId } : {}),
+  })
+}
+
+/**
+ * Replays the gateway's handler logic against the driver.
+ *
+ * Returns the rejection reason (or 'enqueued') so the test can assert
+ * the exact branch taken without grepping stderr.
+ */
+function feedReaction(
+  d: DriverState,
+  args: {
+    chatId: number
+    messageId: number
+    emoji: string | null
+    action: 'add' | 'change' | 'remove'
+    reacterId: number
+    reacterName?: string
+    threadId?: number
+  },
+):
+  | { kind: 'persisted_only'; reason: string }
+  | { kind: 'enqueued' } {
+  if (args.action === 'remove' || args.emoji === null) {
+    return { kind: 'persisted_only', reason: 'remove_or_null_emoji' }
+  }
+  const row = d.history.get(args.messageId)
+  const botAuthored = row?.role === 'assistant'
+  const preview = truncatePreview(row?.text ?? '')
+  const decision = evaluateTriggerCandidate(d.cfg, {
+    chatId: args.chatId,
+    messageId: args.messageId,
+    emoji: args.emoji,
+    action: args.action,
+    botAuthored,
+  })
+  if (!decision.ok) {
+    return { kind: 'persisted_only', reason: decision.reason }
+  }
+  if (d.cfg.groupAdminOnly && isGroupChat(args.chatId)) {
+    if (!d.admins.has(args.reacterId)) {
+      return { kind: 'persisted_only', reason: 'group_non_admin' }
+    }
+  }
+  if (!d.cap.tryConsume(String(args.chatId))) {
+    return { kind: 'persisted_only', reason: 'hour_cap_exhausted' }
+  }
+  const pending: PendingReaction = {
+    targetMessageId: args.messageId,
+    emoji: args.emoji,
+    action: args.action,
+    ts: Date.now(),
+    preview,
+    userId: args.reacterId,
+    user: args.reacterName ?? `u${args.reacterId}`,
+    ...(args.threadId !== undefined ? { threadId: args.threadId } : {}),
+  }
+  d.buf.enqueue(args.chatId, pending)
+  return { kind: 'enqueued' }
+}
+
+// ─── Scenarios ───────────────────────────────────────────────────────────
+
+describe('reaction-trigger flow', () => {
+  it('bot-authored 👎 dispatches a synthetic inbound with meta.source="reaction"', () => {
+    const d = makeDriver()
+    d.history.set(42, { role: 'assistant', text: 'hello from bot' })
+    const r = feedReaction(d, {
+      chatId: 100, messageId: 42, emoji: '👎', action: 'add', reacterId: 7,
+    })
+    expect(r.kind).toBe('enqueued')
+    expect(d.dispatched.length).toBe(0)
+    d.sched.flushAll()
+    expect(d.dispatched.length).toBe(1)
+    const out = d.dispatched[0]!
+    expect(out.meta.source).toBe('reaction')
+    expect(out.meta.batched).toBe('false')
+    expect(out.meta.reaction_emoji).toBe('👎')
+    expect(out.meta.target_message_id).toBe('42')
+    expect(out.text).toContain('<channel source="reaction"')
+    expect(out.text).toContain('hello from bot')
+    expect(out.userId).toBe(7)
+  })
+
+  it('❤️ (not in default allowlist) dispatches NOTHING (negative)', () => {
+    const d = makeDriver()
+    d.history.set(42, { role: 'assistant', text: 'hi' })
+    const r = feedReaction(d, {
+      chatId: 100, messageId: 42, emoji: '❤️', action: 'add', reacterId: 7,
+    })
+    expect(r.kind).toBe('persisted_only')
+    if (r.kind === 'persisted_only') expect(r.reason).toBe('emoji_not_in_allowlist')
+    d.sched.flushAll()
+    expect(d.dispatched.length).toBe(0)
+  })
+
+  it('👎 on a USER-authored message dispatches NOTHING (no trigger)', () => {
+    const d = makeDriver()
+    d.history.set(42, { role: 'user', text: 'something the user said' })
+    const r = feedReaction(d, {
+      chatId: 100, messageId: 42, emoji: '👎', action: 'add', reacterId: 7,
+    })
+    expect(r.kind).toBe('persisted_only')
+    if (r.kind === 'persisted_only') expect(r.reason).toBe('not_bot_authored')
+    d.sched.flushAll()
+    expect(d.dispatched.length).toBe(0)
+  })
+
+  it('two qualifying reactions within window collapse into one batched synthetic', () => {
+    const d = makeDriver()
+    d.history.set(42, { role: 'assistant', text: 'first bot msg' })
+    d.history.set(43, { role: 'assistant', text: 'second bot msg' })
+    feedReaction(d, { chatId: 100, messageId: 42, emoji: '👎', action: 'add', reacterId: 7 })
+    feedReaction(d, { chatId: 100, messageId: 43, emoji: '✅', action: 'add', reacterId: 7 })
+    d.sched.flushAll()
+    expect(d.dispatched.length).toBe(1)
+    const out = d.dispatched[0]!
+    expect(out.meta.batched).toBe('true')
+    expect(out.meta.count).toBe('2')
+    // Inline list includes both target msg ids.
+    expect(out.text).toContain('on msg 42')
+    expect(out.text).toContain('on msg 43')
+  })
+
+  it('hour cap refuses past the limit (no inbound emitted)', () => {
+    const d = makeDriver({ perHourCap: 2, debounceMs: 100 })
+    d.history.set(42, { role: 'assistant', text: 'hi' })
+    // Three back-to-back, each in its own debounce window.
+    for (let i = 0; i < 3; i++) {
+      const r = feedReaction(d, {
+        chatId: 100, messageId: 42, emoji: '👎', action: 'add', reacterId: 7,
+      })
+      if (i < 2) expect(r.kind).toBe('enqueued')
+      else {
+        expect(r.kind).toBe('persisted_only')
+        if (r.kind === 'persisted_only') expect(r.reason).toBe('hour_cap_exhausted')
+      }
+      // Drain so each enqueue gets its own debounce flush.
+      d.sched.flushAll()
+    }
+    expect(d.dispatched.length).toBe(2)
+  })
+
+  it('group reaction by non-admin dispatches NOTHING (fail-closed)', () => {
+    const d = makeDriver()
+    d.history.set(42, { role: 'assistant', text: 'group bot msg' })
+    // Negative chat_id → group; admins set is empty.
+    const r = feedReaction(d, {
+      chatId: -1001234, messageId: 42, emoji: '👎', action: 'add', reacterId: 7,
+    })
+    expect(r.kind).toBe('persisted_only')
+    if (r.kind === 'persisted_only') expect(r.reason).toBe('group_non_admin')
+    d.sched.flushAll()
+    expect(d.dispatched.length).toBe(0)
+  })
+
+  it('group reaction by admin dispatches normally', () => {
+    const d = makeDriver()
+    d.admins.add(7)
+    d.history.set(42, { role: 'assistant', text: 'group bot msg' })
+    const r = feedReaction(d, {
+      chatId: -1001234, messageId: 42, emoji: '👎', action: 'add', reacterId: 7,
+    })
+    expect(r.kind).toBe('enqueued')
+    d.sched.flushAll()
+    expect(d.dispatched.length).toBe(1)
+  })
+
+  it('group reaction with group_admin_only=false ignores admin status', () => {
+    const d = makeDriver({ groupAdminOnly: false })
+    d.history.set(42, { role: 'assistant', text: 'group bot msg' })
+    const r = feedReaction(d, {
+      chatId: -1001234, messageId: 42, emoji: '👎', action: 'add', reacterId: 7,
+    })
+    expect(r.kind).toBe('enqueued')
+    d.sched.flushAll()
+    expect(d.dispatched.length).toBe(1)
+  })
+
+  it('reaction-remove (old: [👎], new: []) is persistence-only (action=remove)', () => {
+    const d = makeDriver()
+    d.history.set(42, { role: 'assistant', text: 'hi' })
+    // action=remove is filtered out before predicate evaluation.
+    const r = feedReaction(d, {
+      chatId: 100, messageId: 42, emoji: null, action: 'remove', reacterId: 7,
+    })
+    expect(r.kind).toBe('persisted_only')
+    d.sched.flushAll()
+    expect(d.dispatched.length).toBe(0)
+  })
+
+  it('reaction on a message not in history (no row) fails closed — no trigger', () => {
+    const d = makeDriver()
+    // No history entry for 42 — bot-authored is unknown.
+    const r = feedReaction(d, {
+      chatId: 100, messageId: 42, emoji: '👎', action: 'add', reacterId: 7,
+    })
+    expect(r.kind).toBe('persisted_only')
+    if (r.kind === 'persisted_only') expect(r.reason).toBe('not_bot_authored')
+    d.sched.flushAll()
+    expect(d.dispatched.length).toBe(0)
+  })
+
+  it('enabled=false dispatches NOTHING even on default allowlist match', () => {
+    const d = makeDriver({ enabled: false })
+    d.history.set(42, { role: 'assistant', text: 'hi' })
+    const r = feedReaction(d, {
+      chatId: 100, messageId: 42, emoji: '👎', action: 'add', reacterId: 7,
+    })
+    expect(r.kind).toBe('persisted_only')
+    if (r.kind === 'persisted_only') expect(r.reason).toBe('disabled')
+    d.sched.flushAll()
+    expect(d.dispatched.length).toBe(0)
+  })
+
+  it('cascade: trigger_emojis: [] disables triggering without flipping enabled', () => {
+    // Operator narrows to empty allowlist — every qualifying emoji is
+    // now a miss. This is the "kill switch without bigger hammer" case.
+    const cfg = resolveReactionsConfig({ trigger_emojis: [] })
+    const d = makeDriver(cfg)
+    d.history.set(42, { role: 'assistant', text: 'hi' })
+    const r = feedReaction(d, {
+      chatId: 100, messageId: 42, emoji: '👎', action: 'add', reacterId: 7,
+    })
+    expect(r.kind).toBe('persisted_only')
+    if (r.kind === 'persisted_only') expect(r.reason).toBe('emoji_not_in_allowlist')
+    d.sched.flushAll()
+    expect(d.dispatched.length).toBe(0)
+  })
+})