switchroom 0.8.1 → 0.11.0

package/telegram-plugin/tests/sandbox-hint-posttool.test.ts

@@ -70,6 +70,7 @@ describe('sandbox-hint-posttool', () => {
       tool_name: 'Bash',
       tool_use_id: 'toolu_003',
       tool_response: {
+        exit_code: 100,
         stderr:
           'E: Unable to acquire the dpkg frontend lock (/var/lib/dpkg/lock-frontend), are you root?',
       },
@@ -141,15 +142,224 @@ describe('sandbox-hint-posttool', () => {
   it('caps the scan window for huge tool_response payloads', () => {
     // 100 KiB of harmless output followed by an EROFS — we cap at 64 KiB
     // so this should NOT match. Keeps a runaway tool_response from
-    // pinning the hook on a regex scan.
+    // pinning the hook on a regex scan. The exit_code is set so the
+    // failure-classifier reaches the scan path — without it, #1303's
+    // success-gate would return early for a different reason.
     const huge = 'x'.repeat(100 * 1024) + ' EROFS happened'
     const result = runHook({
       tool_name: 'Bash',
       tool_use_id: 'toolu_007',
-      tool_response: { stdout: huge },
+      tool_response: { exit_code: 1, stdout: huge },
     })
 
     expect(result.status).toBe(0)
     expect(result.stdout.trim()).toBe('')
   })
+
+  // #1303 — the hook used to fire on every tool whose payload merely
+  // MENTIONED EROFS / read-only-fs / EACCES /usr / dpkg, regardless of
+  // whether the tool actually failed. Concrete repro: reading a file
+  // whose content describes the sandbox model triggered the advisory
+  // every time. Fix: classify tool_response as success-or-failure FIRST
+  // (only failures can have hit a kernel boundary), AND gate on
+  // write-capable tools only (Read/Grep/Glob can't EROFS).
+  describe('#1303 — false-positive guard', () => {
+    it('does NOT emit when a Read on a file MENTIONS EROFS (Read is not write-capable)', () => {
+      const result = runHook({
+        tool_name: 'Read',
+        tool_use_id: 'toolu_fp_read',
+        // Realistic: an Edit on a file whose Read returns content that
+        // happens to talk about the sandbox model. Pre-fix this fired.
+        tool_response: {
+          file: '/state/agent/home/some-doc.md',
+          content:
+            '# Sandbox notes\n\nWhen a write hits EROFS we say "Read-only file system".\n',
+        },
+      })
+
+      expect(result.status).toBe(0)
+      expect(result.stdout.trim()).toBe('')
+    })
+
+    it('does NOT emit when a Grep finds a line containing "Read-only file system"', () => {
+      const result = runHook({
+        tool_name: 'Grep',
+        tool_use_id: 'toolu_fp_grep',
+        tool_response: { stdout: 'docs/sandbox.md:42: Read-only file system semantics' },
+      })
+
+      expect(result.status).toBe(0)
+      expect(result.stdout.trim()).toBe('')
+    })
+
+    it('does NOT emit when a successful Bash mentions EROFS in stdout (exit_code=0)', () => {
+      const result = runHook({
+        tool_name: 'Bash',
+        tool_use_id: 'toolu_fp_bash_success',
+        tool_response: {
+          exit_code: 0,
+          stdout: 'I tested EROFS handling: all good.',
+        },
+      })
+
+      expect(result.status).toBe(0)
+      expect(result.stdout.trim()).toBe('')
+    })
+
+    it('does NOT emit when a successful Edit echoes new content containing "EROFS"', () => {
+      // The Edit tool's tool_response echoes the modified content. If
+      // the new content mentions EROFS — e.g. when editing this very
+      // hook source — the pre-fix logic fired falsely on every keystroke.
+      const result = runHook({
+        tool_name: 'Edit',
+        tool_use_id: 'toolu_fp_edit_success',
+        tool_response: {
+          // is_error explicitly false; no error field; no exit_code.
+          is_error: false,
+          file_path: '/state/agent/home/hook.mjs',
+          old_string: '// old',
+          new_string: '// new code mentioning EROFS and read-only file system semantics',
+        },
+      })
+
+      expect(result.status).toBe(0)
+      expect(result.stdout.trim()).toBe('')
+    })
+
+    it('still emits when an Edit FAILED with is_error=true on a real EROFS', () => {
+      const result = runHook({
+        tool_name: 'Edit',
+        tool_use_id: 'toolu_real_failure',
+        tool_response: {
+          is_error: true,
+          error: "EROFS: read-only file system, open '/opt/switchroom/skills/foo.md'",
+        },
+      })
+
+      expect(result.status).toBe(0)
+      const ctx = parseContext(result.stdout)
+      expect(ctx).toContain('Sandbox boundary hit')
+    })
+
+    it('still emits when a Bash FAILED with non-zero exit_code and stderr containing EROFS', () => {
+      const result = runHook({
+        tool_name: 'Bash',
+        tool_use_id: 'toolu_real_bash_failure',
+        tool_response: {
+          exit_code: 1,
+          stderr: "mkdir: cannot create directory '/opt/foo': Read-only file system",
+          stdout: '',
+        },
+      })
+
+      expect(result.status).toBe(0)
+      const ctx = parseContext(result.stdout)
+      expect(ctx).toContain('Sandbox boundary hit')
+    })
+
+    it('does NOT emit for tools not in the write-capable allowlist, even on failure-shaped payload', () => {
+      // Even a payload that LOOKS like a failure — `is_error: true` —
+      // cannot reflect a kernel sandbox hit if the tool isn't write-
+      // capable. Read can't EROFS. We refuse to advise.
+      const result = runHook({
+        tool_name: 'WebFetch',
+        tool_use_id: 'toolu_fp_webfetch',
+        tool_response: { is_error: true, error: 'EROFS lookalike in HTTP body' },
+      })
+
+      expect(result.status).toBe(0)
+      expect(result.stdout.trim()).toBe('')
+    })
+
+    it('DOES emit for an MCP tool failure (proxies can write)', () => {
+      const result = runHook({
+        tool_name: 'mcp__some-server__write_file',
+        tool_use_id: 'toolu_mcp_failure',
+        tool_response: {
+          is_error: true,
+          error: 'EROFS: read-only file system on /opt/foo',
+        },
+      })
+
+      expect(result.status).toBe(0)
+      const ctx = parseContext(result.stdout)
+      expect(ctx).toContain('Sandbox boundary hit')
+    })
+  })
+
+  // Direct unit tests on the classifier helper.
+  describe('classifyFailure', () => {
+    it('returns null for a successful object response', async () => {
+      const mod = await import('../hooks/sandbox-hint-posttool.mjs')
+      expect(mod.__internals.classifyFailure({ exit_code: 0, stdout: 'EROFS mentioned' }))
+        .toBeNull()
+      expect(mod.__internals.classifyFailure({ is_error: false, content: 'EROFS mentioned' }))
+        .toBeNull()
+    })
+
+    it('returns a structured-failure for is_error=true', async () => {
+      const mod = await import('../hooks/sandbox-hint-posttool.mjs')
+      const got = mod.__internals.classifyFailure({
+        is_error: true,
+        error: 'EROFS: ...',
+      })
+      expect(got?.kind).toBe('structured-failure')
+      expect(got?.body).toContain('EROFS')
+    })
+
+    it('returns a structured-failure for non-zero exit_code with stderr', async () => {
+      const mod = await import('../hooks/sandbox-hint-posttool.mjs')
+      const got = mod.__internals.classifyFailure({
+        exit_code: 1,
+        stderr: 'Read-only file system',
+        stdout: 'also relevant context',
+      })
+      expect(got?.kind).toBe('structured-failure')
+      // Both stderr and stdout included on failed Bash.
+      expect(got?.body).toContain('Read-only file system')
+      expect(got?.body).toContain('also relevant context')
+    })
+
+    it('treats a bare string as a candidate to scan', async () => {
+      const mod = await import('../hooks/sandbox-hint-posttool.mjs')
+      const got = mod.__internals.classifyFailure('mkdir: Read-only file system')
+      expect(got?.kind).toBe('bare-string')
+      expect(got?.body).toContain('Read-only file system')
+    })
+
+    it('returns null for null / undefined / primitives', async () => {
+      const mod = await import('../hooks/sandbox-hint-posttool.mjs')
+      expect(mod.__internals.classifyFailure(null)).toBeNull()
+      expect(mod.__internals.classifyFailure(undefined)).toBeNull()
+      expect(mod.__internals.classifyFailure(42)).toBeNull()
+    })
+  })
+
+  describe('isWriteCapableTool', () => {
+    it('returns true for the canonical write tools', async () => {
+      const mod = await import('../hooks/sandbox-hint-posttool.mjs')
+      for (const n of ['Edit', 'MultiEdit', 'Write', 'NotebookEdit', 'Bash']) {
+        expect(mod.__internals.isWriteCapableTool(n)).toBe(true)
+      }
+    })
+
+    it('returns false for read-only tools', async () => {
+      const mod = await import('../hooks/sandbox-hint-posttool.mjs')
+      for (const n of ['Read', 'Grep', 'Glob', 'WebFetch', 'WebSearch', 'TodoWrite']) {
+        expect(mod.__internals.isWriteCapableTool(n)).toBe(false)
+      }
+    })
+
+    it('returns true for any MCP tool (proxy writes possible)', async () => {
+      const mod = await import('../hooks/sandbox-hint-posttool.mjs')
+      expect(mod.__internals.isWriteCapableTool('mcp__server__do_thing')).toBe(true)
+    })
+
+    it('returns false for empty / non-string', async () => {
+      const mod = await import('../hooks/sandbox-hint-posttool.mjs')
+      expect(mod.__internals.isWriteCapableTool('')).toBe(false)
+      expect(mod.__internals.isWriteCapableTool(null as any)).toBe(false)
+      expect(mod.__internals.isWriteCapableTool(undefined as any)).toBe(false)
+    })
+  })
 })

package/telegram-plugin/tests/silence-poke.test.ts

@@ -4,6 +4,9 @@ import {
   noteOutbound,
   noteSubagentDispatch,
   noteThinking,
+  noteToolStart,
+  noteToolEnd,
+  noteToolLabel,
   consumeArmedPoke,
   endTurn,
   silencePokeEnabled,
@@ -309,6 +312,240 @@ describe('silence-poke — abnormal turn-end invariants (CC-5 follow-up)', () =>
     ).toHaveLength(1) // unchanged: only the original soft
     expect(fx.fallbacks).toHaveLength(0)
   })
+
+  // #1289: the flush-backstop turn-end branch in the gateway (the path
+  // taken when the agent emits assistant text but never calls the reply
+  // tool) was retrofitted in #1067 to null `currentTurn` early but never
+  // had `silencePoke.endTurn` added — leaving state2 populated so the
+  // 300s framework fallback fired after the gateway already flushed the
+  // captured prose and considered the turn over. Pin the contract at
+  // the silence-poke level: a turn that records an outbound (the
+  // flushed message) and then calls endTurn must not later fire a
+  // fallback even if 300s elapses from the original turn start.
+  it('#1289: flush-backstop turn-end (outbound + endTurn) suppresses the 300s fallback', () => {
+    const fx = setupDeps()
+    startTurn('k', 0)
+    // Some time passes while the agent generates prose without calling
+    // the reply tool. No soft/firm armed yet.
+    __tickForTests(60_000)
+    // Gateway turn-flush fires: captured text is sent as an outbound,
+    // then the flush branch nulls currentTurn AND (post-fix) calls
+    // signalTracker.clear + silencePoke.endTurn.
+    noteOutbound('k', 60_000)
+    endTurn('k')
+    // 300s elapses from the original turn start. Pre-fix: the framework
+    // fallback fired here. Post-fix: the state is drained, no fallback.
+    __tickForTests(240_000)
+    expect(fx.fallbacks).toHaveLength(0)
+    expect(
+      fx.emitted.filter((e) => e.kind === 'silence_fallback_sent'),
+    ).toHaveLength(0)
+  })
+})
+
+// #1292 — drive a deterministic, tool-aware fallback message from the
+// gateway's `tool_use` / `tool_result` event stream. The progress card
+// was retired in #1122 PR3 in favour of the conversational shape; the
+// remaining honesty gap was that the 300s framework fallback said
+// "still working… no update in 5 min" on turns where the agent was
+// clearly grinding through tool calls. These tests pin the behaviour:
+// the silence clock is NOT reset by tool churn (header invariant
+// preserved), but the fallback message body becomes tool-aware so the
+// user sees the actual observable.
+describe('silence-poke — #1292 tool-aware framework fallback', () => {
+  it('fallback context exposes in-flight tool snapshot with duration', () => {
+    const fx = setupDeps()
+    startTurn('k', 0)
+    noteToolStart('k', 'T1', 'Grep', 'foo', 30_000)
+    __tickForTests(75_000)
+    __tickForTests(180_000)
+    __tickForTests(305_000)
+    expect(fx.fallbacks).toHaveLength(1)
+    const ctx = fx.fallbacks[0]!
+    expect(ctx.inFlightTools).toHaveLength(1)
+    expect(ctx.inFlightTools[0]!.name).toBe('Grep')
+    expect(ctx.inFlightTools[0]!.label).toBe('foo')
+    expect(ctx.inFlightTools[0]!.durationMs).toBe(305_000 - 30_000)
+  })
+
+  it('formatFrameworkFallbackText names the longest-running tool with duration', () => {
+    const text = formatFrameworkFallbackText('working', 305_000, [
+      { name: 'Grep', label: '"foo"', durationMs: 275_000 },
+    ])
+    expect(text).toBe(
+      'running Grep "foo" for 5m (no update from agent in 5 min)',
+    )
+  })
+
+  it('multiple in-flight tools render as "+ N more"', () => {
+    const text = formatFrameworkFallbackText('working', 305_000, [
+      { name: 'Grep', label: '"foo"', durationMs: 275_000 },
+      { name: 'Read', label: 'config.ts', durationMs: 120_000 },
+      { name: 'Bash', label: null, durationMs: 60_000 },
+    ])
+    expect(text).toBe(
+      'running Grep "foo" + 2 more for 5m (no update from agent in 5 min)',
+    )
+  })
+
+  it('tool with no label renders the bare name', () => {
+    const text = formatFrameworkFallbackText('working', 305_000, [
+      { name: 'Bash', label: null, durationMs: 305_000 },
+    ])
+    expect(text).toBe(
+      'running Bash for 5m (no update from agent in 5 min)',
+    )
+  })
+
+  it('empty inFlightTools falls back to the base "still working" wording', () => {
+    expect(
+      formatFrameworkFallbackText('working', 305_000, []),
+    ).toBe('still working… (no update from agent in 5 min)')
+    expect(
+      formatFrameworkFallbackText('thinking', 305_000, []),
+    ).toBe('still thinking… (no update from agent in 5 min)')
+    // No third arg → same as empty array.
+    expect(
+      formatFrameworkFallbackText('working', 305_000),
+    ).toBe('still working… (no update from agent in 5 min)')
+  })
+
+  it('tool-aware wording wins over "thinking" — the actual observable beats the inferred kind', () => {
+    const text = formatFrameworkFallbackText('thinking', 305_000, [
+      { name: 'Grep', label: '"foo"', durationMs: 305_000 },
+    ])
+    expect(text.startsWith('running Grep')).toBe(true)
+    expect(text).not.toContain('still thinking')
+  })
+
+  it('tool completed before the fallback → empty snapshot → base wording', () => {
+    const fx = setupDeps()
+    startTurn('k', 0)
+    noteToolStart('k', 'T1', 'Grep', 'foo', 30_000)
+    noteToolEnd('k', 'T1', 200_000)
+    __tickForTests(75_000)
+    __tickForTests(180_000)
+    __tickForTests(305_000)
+    expect(fx.fallbacks).toHaveLength(1)
+    expect(fx.fallbacks[0]!.inFlightTools).toHaveLength(0)
+  })
+
+  it('late noteToolLabel updates the in-flight entry in place', () => {
+    const fx = setupDeps()
+    startTurn('k', 0)
+    noteToolStart('k', 'T1', 'Grep', null, 30_000)
+    noteToolLabel('k', 'T1', '"refined-from-sidecar"')
+    __tickForTests(75_000)
+    __tickForTests(180_000)
+    __tickForTests(305_000)
+    expect(fx.fallbacks[0]!.inFlightTools[0]!.label).toBe('"refined-from-sidecar"')
+  })
+
+  it('endTurn drains inFlightTools', () => {
+    setupDeps()
+    startTurn('k', 0)
+    noteToolStart('k', 'T1', 'Grep', 'foo', 30_000)
+    expect(__getStateForTests('k')!.inFlightTools.size).toBe(1)
+    endTurn('k')
+    // A fresh turn under the same key has an empty map.
+    startTurn('k', 1_000_000)
+    expect(__getStateForTests('k')!.inFlightTools.size).toBe(0)
+  })
+
+  it('parallel tools sort by startedAt ascending — longest-running rendered first', () => {
+    const fx = setupDeps()
+    startTurn('k', 0)
+    // Order intentionally NOT chronological to verify sort.
+    noteToolStart('k', 'T-late', 'Read', 'recent.ts', 250_000)
+    noteToolStart('k', 'T-early', 'Grep', '"oldest"', 20_000)
+    noteToolStart('k', 'T-mid', 'Bash', null, 100_000)
+    __tickForTests(75_000)
+    __tickForTests(180_000)
+    __tickForTests(305_000)
+    const snap = fx.fallbacks[0]!.inFlightTools
+    expect(snap.map(t => t.name)).toEqual(['Grep', 'Bash', 'Read'])
+  })
+
+  it('tool churn does NOT reset the silence clock (header invariant preserved)', () => {
+    // The whole point of #1292 (b) over (a) is that we enrich the
+    // fallback TEXT, never the timing. Tool activity must not delay
+    // or suppress the soft/firm/fallback escalation ladder.
+    const fx = setupDeps()
+    startTurn('k', 0)
+    // A constant stream of tool churn through the entire 5min window —
+    // each tool ends quickly so inFlightTools is empty by fallback.
+    for (let t = 5_000; t <= 295_000; t += 10_000) {
+      noteToolStart('k', `T-${t}`, 'Grep', 'foo', t)
+      noteToolEnd('k', `T-${t}`, t + 500)
+    }
+    __tickForTests(75_000) // soft
+    __tickForTests(180_000) // firm
+    __tickForTests(305_000) // fallback
+    expect(
+      fx.emitted.filter(e => e.kind === 'silence_poke_fired'),
+    ).toHaveLength(2)
+    expect(fx.fallbacks).toHaveLength(1)
+  })
+
+  it('Task tool sets subagentDispatchActive AND populates inFlightTools', () => {
+    // Two flags are independent: the soft-threshold extension still
+    // works for sub-agent waits (existing behaviour), AND the fallback
+    // message names the Task tool as the actual observable.
+    const fx = setupDeps()
+    startTurn('k', 0)
+    // Gateway calls both for a Task tool_use (mirrors the wiring at
+    // gateway.ts onSessionEvent).
+    noteSubagentDispatch('k')
+    noteToolStart('k', 'T1', 'Task', 'spinning up @researcher', 10_000)
+    // Soft threshold extends to 300s under subagent — so no soft poke
+    // fires at 75s and no firm fires at 180s (firm requires pokesFired===1,
+    // i.e. soft must fire first). Once we cross the 300s subagent-soft,
+    // soft fires; each tick fires one level via the `continue` in tick(),
+    // so we need three ticks to walk soft → firm → fallback.
+    __tickForTests(75_000)   // suppressed by subagent
+    __tickForTests(180_000)  // still suppressed
+    __tickForTests(305_000)  // soft fires (subagent soft = 300s)
+    __tickForTests(305_001)  // firm fires
+    __tickForTests(305_002)  // fallback fires
+    expect(fx.fallbacks).toHaveLength(1)
+    const snap = fx.fallbacks[0]!.inFlightTools
+    expect(snap[0]!.name).toBe('Task')
+    expect(snap[0]!.label).toBe('spinning up @researcher')
+  })
+
+  it('noteToolStart on an unknown key is a no-op (no crash, no state)', () => {
+    setupDeps()
+    // No startTurn first — silence-poke ignores the call.
+    noteToolStart('k-never-started', 'T1', 'Grep', 'foo', 30_000)
+    expect(__getStateForTests('k-never-started')).toBeUndefined()
+  })
+
+  it('noteToolEnd on an unknown id is a no-op', () => {
+    setupDeps()
+    startTurn('k', 0)
+    noteToolEnd('k', 'never-started', 100_000)
+    expect(__getStateForTests('k')!.inFlightTools.size).toBe(0)
+  })
+
+  it('formatFrameworkFallbackText sub-minute durations render as "Ns"', () => {
+    const text = formatFrameworkFallbackText('working', 305_000, [
+      { name: 'Grep', label: 'foo', durationMs: 12_000 },
+    ])
+    expect(text).toBe(
+      'running Grep foo for 12s (no update from agent in 5 min)',
+    )
+  })
+
+  it('formatFrameworkFallbackText truncates very long labels', () => {
+    const longLabel = '"' + 'x'.repeat(120) + '"'
+    const text = formatFrameworkFallbackText('working', 305_000, [
+      { name: 'Grep', label: longLabel, durationMs: 305_000 },
+    ])
+    // 60-char cap (with trailing ellipsis) — verify clipping without
+    // pinning exact bytes.
+    expect(text.length).toBeLessThan(120)
+    expect(text).toContain('…')
+  })
 })
 
 describe('silence-poke — consumeArmedPoke draining', () => {

package/telegram-plugin/tests/turn-flush-safety.test.ts

@@ -137,6 +137,118 @@ describe('decideTurnFlush', () => {
       }),
     ).toEqual({ kind: 'skip', reason: 'reply-called' })
   })
+
+  // #1291 — when the model emits a soft-commit reply ("on it, back in a
+  // few") and then composes the real substantive answer in terminal text
+  // only, the pre-#1291 behaviour skipped flush entirely because
+  // replyCalled was true. The fix: track capturedTextLenAtLastReply and
+  // flush the post-reply tail when it meets the substantive threshold.
+  describe('#1291 — post-reply tail flush', () => {
+    it('flushes the post-reply tail when it meets the substantive threshold', () => {
+      const decision = decideTurnFlush({
+        chatId: '700',
+        replyCalled: true,
+        // Index 0 = the captured text BEFORE the reply tool was called
+        // (some thinking-as-text). Indices 1..2 are post-reply.
+        capturedText: [
+          'thinking out loud before the reply',
+          'Now here is the actual substantive answer the model composed ',
+          'in terminal text only after the interim reply call.',
+        ],
+        capturedTextLenAtLastReply: 1,
+      })
+      expect(decision).toEqual({
+        kind: 'flush',
+        text:
+          'Now here is the actual substantive answer the model composed ' +
+          '\nin terminal text only after the interim reply call.',
+      })
+    })
+
+    it('skips with reply-called-no-new-text when post-reply tail is below threshold', () => {
+      const decision = decideTurnFlush({
+        chatId: '701',
+        replyCalled: true,
+        capturedText: ['the pre-reply scratch', 'ok.'], // tail = "ok." (3 chars)
+        capturedTextLenAtLastReply: 1,
+      })
+      expect(decision).toEqual({
+        kind: 'skip',
+        reason: 'reply-called-no-new-text',
+      })
+    })
+
+    it('skips with reply-called when there is no post-reply text at all', () => {
+      const decision = decideTurnFlush({
+        chatId: '702',
+        replyCalled: true,
+        capturedText: ['everything-was-before-the-reply'],
+        capturedTextLenAtLastReply: 1, // tail slice is empty
+      })
+      expect(decision).toEqual({ kind: 'skip', reason: 'reply-called' })
+    })
+
+    it('post-reply tail honors a silent marker (skip)', () => {
+      const decision = decideTurnFlush({
+        chatId: '703',
+        replyCalled: true,
+        capturedText: ['real answer pre-reply', 'NO_REPLY'],
+        capturedTextLenAtLastReply: 1,
+        replyCalledTailMinChars: 1, // force the marker check
+      })
+      expect(decision).toEqual({ kind: 'skip', reason: 'silent-marker' })
+    })
+
+    it('post-reply tail with null chatId still skips (no-inbound-chat)', () => {
+      const decision = decideTurnFlush({
+        chatId: null,
+        replyCalled: true,
+        capturedText: [
+          'pre',
+          'this tail would have been substantive enough to flush normally',
+        ],
+        capturedTextLenAtLastReply: 1,
+      })
+      expect(decision).toEqual({ kind: 'skip', reason: 'no-inbound-chat' })
+    })
+
+    it('preserves pre-#1291 behaviour when capturedTextLenAtLastReply is omitted', () => {
+      // Legacy caller doesn't track the marker — defaults to
+      // capturedText.length, so the tail slice is empty and we skip
+      // with reason 'reply-called' (the original behaviour).
+      const decision = decideTurnFlush({
+        chatId: '704',
+        replyCalled: true,
+        capturedText: ['some answer the model emitted'],
+      })
+      expect(decision).toEqual({ kind: 'skip', reason: 'reply-called' })
+    })
+
+    it('respects a custom replyCalledTailMinChars threshold', () => {
+      const decision = decideTurnFlush({
+        chatId: '705',
+        replyCalled: true,
+        capturedText: ['pre-reply', 'short but substantive in this test'],
+        capturedTextLenAtLastReply: 1,
+        replyCalledTailMinChars: 10,
+      })
+      expect(decision.kind).toBe('flush')
+    })
+
+    it('feature flag off still wins over post-reply tail flush', () => {
+      const decision = decideTurnFlush({
+        chatId: '706',
+        replyCalled: true,
+        capturedText: [
+          'pre',
+          'a long substantive post-reply tail that would otherwise flush',
+        ],
+        capturedTextLenAtLastReply: 1,
+        flushEnabled: false,
+      })
+      expect(decision).toEqual({ kind: 'skip', reason: 'flag-disabled' })
+    })
+  })
 })
 
 describe('isSilentFlushMarker', () => {