ctrlrelay 0.12.1__tar.gz → 0.12.2__tar.gz

{ctrlrelay-0.12.1 → ctrlrelay-0.12.2}/CHANGELOG.md

@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.12.2] - 2026-10-06
+
+### Fixed
+
+- Stay quiet when somebody is talking in the channel (#194)
+
 ## [0.12.1] - 2026-10-06
 
 ### Fixed
@@ -1683,7 +1689,8 @@ pipeline).
   per-phase implementation plans (Phase 0 through Phase 4).
 - `docs/Claude_Code_Project_Guide.md` — project development guide.
 
-[Unreleased]: https://github.com/AInvirion/ctrlrelay/compare/v0.12.1...HEAD
+[Unreleased]: https://github.com/AInvirion/ctrlrelay/compare/v0.12.2...HEAD
+[0.12.2]: https://github.com/AInvirion/ctrlrelay/compare/v0.12.1...v0.12.2
 [0.12.1]: https://github.com/AInvirion/ctrlrelay/compare/v0.12.0...v0.12.1
 [0.12.0]: https://github.com/AInvirion/ctrlrelay/compare/v0.11.3...v0.12.0
 [0.11.3]: https://github.com/AInvirion/ctrlrelay/compare/v0.11.2...v0.11.3

{ctrlrelay-0.12.1 → ctrlrelay-0.12.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: ctrlrelay
-Version: 0.12.1
+Version: 0.12.2
 Summary: Local-first orchestrator for headless coding agents across multiple GitHub repos
 Project-URL: Homepage, https://github.com/AInvirion/ctrlrelay
 Project-URL: Documentation, https://ainvirion.github.io/ctrlrelay/

{ctrlrelay-0.12.1 → ctrlrelay-0.12.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "ctrlrelay"
-version = "0.12.1"
+version = "0.12.2"
 description = "Local-first orchestrator for headless coding agents across multiple GitHub repos"
 readme = "README.md"
 requires-python = ">=3.12"

{ctrlrelay-0.12.1 → ctrlrelay-0.12.2}/src/ctrlrelay/bridge/server.py

@@ -37,6 +37,35 @@ _log = logging.getLogger(__name__)
 _ASKED_SESSIONS_MAX = 500
 
 
+_PENDING_SHOWN = 5
+
+
+def _format_pending(rows: list[dict]) -> str:
+    """A sample of outstanding questions, never the whole catalogue.
+
+    Capped because this list is unbounded by nature - one row per blocked
+    session, and a config error can block every repo in a sweep. Measured
+    on the live channel at 20 pending: 4042 characters, about 202 per
+    row. This deployment sweeps 87 repos, and the server's MaxPostSize is
+    16383, so at roughly 81 blocked sessions the message exceeded the
+    limit and posted NOTHING - the notice whose job is to say a reply was
+    dropped, dropped.
+
+    The count of what is withheld is part of the message, not a detail:
+    truncating to "here are five" and not saying five of how many is the
+    same information loss one level down.
+    """
+    shown = rows[:_PENDING_SHOWN]
+    lines = [
+        f"  • `{r['session_id']}` ({r['repo']}): {(r['question'] or '')[:80]}"
+        for r in shown
+    ]
+    rest = len(rows) - len(shown)
+    if rest > 0:
+        lines.append(f"  … and {rest} more.")
+    return "Pending:\n" + "\n".join(lines)
+
+
 def names_session(text: str, session_id: str) -> bool:
     """True when ``text`` names ``session_id`` as a whole token.
 
@@ -617,7 +646,7 @@ class BridgeServer:
         match: _PendingQuestion | None = None
         hinted_session_id: str | None = None
         live_listing: str | None = None
-        ambiguous_notice: str | None = None
+        unaddressed_pending: int | None = None
 
         async with self._pending_lock:
             self._drop_expired_questions()
@@ -629,20 +658,16 @@ class BridgeServer:
             elif len(self._pending_questions) == 1:
                 match = next(iter(self._pending_questions.values()))
             elif len(self._pending_questions) > 1:
-                ambiguous_notice = (
-                    "Your message wasn't routed - "
-                    f"{len(self._pending_questions)} questions are waiting "
-                    "and a plain message doesn't say which one you "
-                    "mean.\n\n"
-                    "Reply to the question you want to answer "
-                    "(Telegram: reply; Mattermost: reply in its thread)."
-                    "\n\n"
-                    f"{self._live_question_listing()}"
-                )
+                # A plain message pointing at nothing, with several
+                # questions live. This used to post the whole list; the
+                # bridge shares its channel with people, so that made
+                # every sentence typed in it produce a wall. Counted,
+                # not inferred.
+                unaddressed_pending = len(self._pending_questions)
 
             if match is not None:
                 self._pending_questions.pop(match.request_id, None)
-            elif ambiguous_notice is None:
+            elif unaddressed_pending is None:
                 # Snapshot what the orphan branch needs, so the lock can be
                 # released before we touch the chat app or the database.
                 hinted_session_id = (
@@ -656,10 +681,20 @@ class BridgeServer:
                     else None
                 )
 
-        if ambiguous_notice is not None:
-            await self._send_notice(
-                ambiguous_notice,
-                log="bridge: ambiguous fresh reply, refusing to guess",
+        if unaddressed_pending is not None:
+            # Silent on purpose. See `_format_pending` for the measurement
+            # and the tradeoff: a plain message while several questions
+            # are open is ignored, so an answer typed without the reply
+            # gesture gets no response. The alternative was a notice on
+            # every message in a shared channel, which is what the
+            # operator reported.
+            log_event(
+                _logger,
+                "bridge.reply.unaddressed",
+                pending=unaddressed_pending,
+                live=True,
+                text_length=len(text),
+                text_hash=hash_text(text),
             )
             return
 
@@ -764,19 +799,27 @@ class BridgeServer:
                     f"({outcome['reason']})"
                 ),
             )
-        elif outcome["status"] == "ambiguous":
-            pending_list = "\n".join(
-                f"  • `{r['session_id']}` ({r['repo']}): "
-                f"{(r['question'] or '')[:80]}"
-                for r in outcome["rows"]
+        elif outcome["status"] == "unaddressed":
+            # Somebody is talking in the channel. Say nothing: the bridge
+            # does not own this channel and a message that points at no
+            # question is not a failed answer. Logged so a genuinely
+            # missed answer is still diagnosable.
+            log_event(
+                _logger,
+                "bridge.reply.unaddressed",
+                pending=len(outcome["rows"]),
+                text_length=len(text),
+                text_hash=hash_text(text),
             )
+        elif outcome["status"] == "ambiguous":
+            # Reached only when the operator DID point at something - they
+            # named more than one session id in one message. That is a
+            # failed answer and is worth a reply.
             await self._send_notice(
-                "⚠️ Your reply wasn't routed — multiple BLOCKED sessions "
-                "are unanswered and the reply didn't point at one of "
-                "them.\n\n"
-                f"Pending:\n{pending_list}\n\n"
-                "Reply to the question you mean, or paste "
-                "its session_id anywhere in your message."
+                "⚠️ Your reply wasn't routed — it names more than one "
+                "session.\n\n"
+                f"{_format_pending(outcome['rows'])}\n\n"
+                "Send one message per session."
             )
         elif live_listing is not None:
             # Reply-to pointed at a message this bridge no longer tracks
@@ -830,11 +873,16 @@ class BridgeServer:
         text.
 
         Caller must hold ``_pending_lock``."""
+        qs = list(self._pending_questions.values())
+        shown = qs[:_PENDING_SHOWN]
         rows = "\n".join(
             f"  - {q.repo or 'unknown repo'}"
             + (f" (session: {q.session_id})" if q.session_id else "")
-            for q in self._pending_questions.values()
+            for q in shown
         )
+        rest = len(qs) - len(shown)
+        if rest > 0:
+            rows += f"\n  … and {rest} more."
         return f"Still waiting:\n{rows}"
 
     async def _send_notice(self, text: str, log: str | None = None) -> None:
@@ -938,8 +986,16 @@ class BridgeServer:
         elif len(rows) == 1:
             target = rows[0]
         else:
-            # Multiple unanswered, no session_id hint — can't route safely.
-            return {"status": "ambiguous", "rows": rows}
+            # Multiple unanswered, and the message pointed at nothing: no
+            # reply-to, no session id. That is not a failed answer, it is
+            # somebody talking in the channel.
+            #
+            # This used to return "ambiguous", which posted every pending
+            # session as one block. Measured on the live channel: 4042
+            # characters, 29 lines, fired by `ok` and by a message
+            # addressed to @here. The operator could not hold a
+            # conversation in the channel the bot lives in.
+            return {"status": "unaddressed", "rows": rows}
 
         return await self._attach_orphan_answer(target, text)
 

{ctrlrelay-0.12.1 → ctrlrelay-0.12.2}/tests/test_bridge_server.py

@@ -291,7 +291,7 @@ class TestBridgeServer:
         task.cancel()
 
     @pytest.mark.asyncio
-    async def test_orphan_reply_refuses_to_guess_when_multiple_blocked(
+    async def test_orphan_reply_stays_silent_when_multiple_blocked(
         self, socket_path, tmp_path,
     ) -> None:
         """When two repos are BLOCKED at once and the reply text doesn't
@@ -334,12 +334,13 @@ class TestBridgeServer:
         assert len(unanswered) == 2
         assert all(r["answer"] is None for r in unanswered)
 
-        # And the operator is told which session_ids are pending.
-        sent_text = server.handler.send.await_args.args[0]  # type: ignore[attr-defined]
-        assert "multiple BLOCKED sessions" in sent_text.lower() or \
-               "multiple" in sent_text
-        assert "secops-owner-repoA-111" in sent_text
-        assert "secops-owner-repoB-222" in sent_text
+        # And NOTHING is posted (#193). A message pointing at no question
+        # is somebody talking in the channel, not a failed answer. This
+        # used to post every pending session as one block - measured on
+        # the live channel at 4042 characters, fired by `ok` and by a
+        # message addressed to @here, which made the channel unusable for
+        # conversation.
+        server.handler.send.assert_not_awaited()  # type: ignore[attr-defined]
 
         db.close()
         await server.stop()
@@ -518,7 +519,7 @@ class TestReplyRoutingIsStrict:
         shutil.rmtree(d, ignore_errors=True)
 
     @pytest.mark.asyncio
-    async def test_fresh_message_refuses_when_several_questions_live(
+    async def test_fresh_message_is_ignored_when_several_questions_live(
         self, socket_path,
     ) -> None:
         from unittest.mock import AsyncMock
@@ -548,10 +549,12 @@ class TestReplyRoutingIsStrict:
                 await asyncio.wait_for(reader.readline(), timeout=0.3)
             assert set(server._pending_questions) == {"r-1", "r-2"}
 
-            server.handler.send.assert_awaited_once()  # type: ignore[attr-defined]
-            notice = server.handler.send.await_args.args[0]  # type: ignore[attr-defined]
-            assert "wasn't routed" in notice
-            assert "reply" in notice.lower()
+            # Silent (#193). The tradeoff is stated rather than hidden:
+            # an answer typed without the reply gesture now gets no
+            # response at all, and the operator learns of it by the
+            # session not resuming. The alternative was a notice on every
+            # message typed in a channel the bridge shares with people.
+            server.handler.send.assert_not_awaited()  # type: ignore[attr-defined]
         finally:
             writer.close()
             await writer.wait_closed()
@@ -798,11 +801,20 @@ class TestReplyRoutingIsStrict:
                 await writer.drain()
                 await asyncio.wait_for(reader.readline(), timeout=1)
 
-            # Two live questions + plain message -> ambiguous notice path.
+            # A reply-to naming a post this bridge does not track, with
+            # questions still live -> the "pointed at a question I no
+            # longer track" notice. That path still posts.
+            #
+            # It used to drive the plain-message-with-several-live path,
+            # which #193 made silent on purpose. A lock test that observes
+            # the lock THROUGH a notice stops observing anything the day
+            # that notice is removed, and would have gone green while
+            # testing nothing had the assertion been `send` not awaited.
             await asyncio.wait_for(
-                server._on_reply("yes", reply_to_post_id=None),
+                server._on_reply("yes", reply_to_post_id="not-a-tracked-post"),
                 timeout=2,
             )
+            server.handler.send.assert_awaited()  # type: ignore[attr-defined]
             assert lock_was_free.is_set()
         finally:
             writer.close()
@@ -1767,3 +1779,148 @@ class TestStartRunsTheHandlerPreflight:
                 await task
             except asyncio.CancelledError:
                 pass
+
+
+class TestTheBridgeSharesItsChannelWithPeople:
+    """#193: a message pointing at no question is conversation, not an answer.
+
+    Measured on the live Mattermost channel on 2026-10-06: a `⚠️ Your reply
+    wasn't routed` notice of **4042 characters over 29 lines**, listing
+    every pending session, fired by `ok` and by a message addressed to
+    `@here`. The operator could not talk to their team in the channel the
+    bridge posts into.
+
+    It also had a hard ceiling. At ~202 characters per row and a server
+    `MaxPostSize` of 16383 - read from that server, not assumed - roughly
+    81 blocked sessions make the notice exceed the limit and post
+    **nothing**: the message whose job is to say a reply was dropped,
+    dropped. This deployment sweeps 87 repos.
+    """
+
+    @pytest.fixture
+    def socket_path(self):
+        # Same as the other classes: tmp_path can exceed AF_UNIX's
+        # 104-char limit, so use a short directory.
+        d = tempfile.mkdtemp()
+        yield Path(d) / "b.sock"
+        shutil.rmtree(d, ignore_errors=True)
+
+    @pytest.mark.asyncio
+    async def test_chat_in_the_channel_produces_no_post(
+        self, socket_path, tmp_path,
+    ) -> None:
+        from unittest.mock import AsyncMock
+
+        from ctrlrelay.bridge.server import BridgeServer
+        from ctrlrelay.core.state import StateDB
+
+        db = StateDB(tmp_path / "state.db")
+        for i in range(6):
+            db.add_pending_resume(
+                session_id=f"secops-owner-repo{i}-{i}{i}{i}",
+                pipeline="secops",
+                repo=f"owner/repo{i}",
+                question=f"question {i}?",
+            )
+
+        server = BridgeServer(
+            socket_path=socket_path, handler=FakeChatHandler(), state_db=db,
+        )
+        task = asyncio.create_task(server.start())
+        await asyncio.sleep(0.1)
+        server.handler.send = AsyncMock()  # type: ignore[attr-defined]
+
+        await server._on_reply(
+            "@here por cierto, agregue a CTRLRelay aca", reply_to_post_id=None
+        )
+
+        server.handler.send.assert_not_awaited()  # type: ignore[attr-defined]
+
+        # And nothing was routed to anybody by accident.
+        assert all(
+            r["answer"] is None for r in db.list_unanswered_pending_resumes()
+        )
+
+        db.close()
+        await server.stop()
+        task.cancel()
+
+    @pytest.mark.asyncio
+    async def test_naming_a_session_still_routes(
+        self, socket_path, tmp_path,
+    ) -> None:
+        """The half that must not regress.
+
+        Going quiet is only safe if the deliberate path still works. If
+        this ever fails, the fix above has made the bridge unanswerable
+        rather than merely quiet.
+        """
+        from unittest.mock import AsyncMock
+
+        from ctrlrelay.bridge.server import BridgeServer
+        from ctrlrelay.core.state import StateDB
+
+        db = StateDB(tmp_path / "state.db")
+        for i in range(6):
+            db.add_pending_resume(
+                session_id=f"secops-owner-repo{i}-{i}{i}{i}",
+                pipeline="secops",
+                repo=f"owner/repo{i}",
+                question=f"question {i}?",
+            )
+
+        server = BridgeServer(
+            socket_path=socket_path, handler=FakeChatHandler(), state_db=db,
+        )
+        task = asyncio.create_task(server.start())
+        await asyncio.sleep(0.1)
+        server.handler.send = AsyncMock()  # type: ignore[attr-defined]
+
+        await server._on_reply(
+            "secops-owner-repo3-333 approved", reply_to_post_id=None
+        )
+
+        row = db.get_pending_resume("secops-owner-repo3-333")
+        assert row["answer"] == "secops-owner-repo3-333 approved"
+        assert row["answered_at"] is not None
+
+        # and only that one
+        others = [
+            r for r in db.list_unanswered_pending_resumes()
+            if r["session_id"] != "secops-owner-repo3-333"
+        ]
+        assert len(others) == 5
+        assert all(r["answer"] is None for r in others)
+
+        db.close()
+        await server.stop()
+        task.cancel()
+
+    def test_the_pending_list_is_capped_and_says_how_many_it_withheld(
+        self,
+    ) -> None:
+        """Truncating without the count is the same loss one level down."""
+        from ctrlrelay.bridge.server import _PENDING_SHOWN, _format_pending
+
+        rows = [
+            {"session_id": f"s-{i}", "repo": f"owner/r{i}", "question": "q" * 200}
+            for i in range(40)
+        ]
+        out = _format_pending(rows)
+
+        assert out.count("  • ") == _PENDING_SHOWN
+        assert f"… and {40 - _PENDING_SHOWN} more." in out
+
+        # The ceiling this exists for: comfortably under MaxPostSize even
+        # at a count that used to overflow it.
+        assert len(out) < 2000, len(out)
+
+    def test_a_short_list_says_nothing_about_withholding(self) -> None:
+        """The paired case, so the cap is not asserted by a constant."""
+        from ctrlrelay.bridge.server import _format_pending
+
+        rows = [{"session_id": "s-1", "repo": "owner/r1", "question": "q?"}]
+        out = _format_pending(rows)
+
+        assert "  • " in out
+        assert "more." not in out