fix(mgmt): keep operator-invited group rooms joined — #85 greet-leave vs invite-then-relink (#120) #121

Merged

robocub merged 1 commit from fix/120-operator-greet-leave into master

2026-07-14 20:29:31 +00:00

robocub commented

2026-07-13 18:33:15 +00:00

Collaborator

Fixes #120, reproduced live earlier tonight (issue comment 1264): greet_when_joined's #85 anti-spoof leave ran after every accepted-invite join, so an operator's invite of the bot into a populated (>2-member) room was undone within seconds — silently breaking the documented manual invite-then-relink flow for restricted rooms.

Fix: the inviter's tier is threaded into greet_when_joined. Operator-accepted invites keep the group-room join (skipping only the greeting — the DM command gate ignores such rooms anyway); every self-serve join keeps the full #85 leave (the anti-spoof exists to stop self-serve users forging is_direct; an operator may place the bot anywhere by definition).

Evidence: new scenario mgmt_operator_room_invite (suite → 28) reproduced the bug pre-fix (known_fail, leave_logged=true bot_still_joined=false) and passes post-fix on the same staging env (30.8 s); mgmt_dm_e2ee (DM greeting) + mgmt_self_serve_link (invite gate) unchanged and green; 124 unit tests + clippy -D warnings.

Held for operator review — it relaxes the #85 gate for operator-tier invites only, but it's still a gate change, per the autonomous-run guardrails.

🤖 Generated with Claude Code

Fixes #120, reproduced live earlier tonight (issue comment 1264): `greet_when_joined`'s #85 anti-spoof leave ran after **every** accepted-invite join, so an **operator's** invite of the bot into a populated (>2-member) room was undone within seconds — silently breaking the documented manual invite-then-relink flow for restricted rooms. **Fix:** the inviter's tier is threaded into `greet_when_joined`. Operator-accepted invites keep the group-room join (skipping only the greeting — the DM command gate ignores such rooms anyway); **every self-serve join keeps the full #85 leave** (the anti-spoof exists to stop self-serve users forging `is_direct`; an operator may place the bot anywhere by definition). **Evidence:** new scenario `mgmt_operator_room_invite` (suite → 28) reproduced the bug pre-fix (`known_fail`, `leave_logged=true bot_still_joined=false`) and passes post-fix on the same staging env (30.8 s); `mgmt_dm_e2ee` (DM greeting) + `mgmt_self_serve_link` (invite gate) unchanged and green; 124 unit tests + clippy `-D warnings`. **Held for operator review** — it relaxes the #85 gate for operator-tier invites only, but it's still a gate change, per the autonomous-run guardrails. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

robocub added 1 commit

2026-07-13 18:33:15 +00:00

fix(mgmt): keep operator-invited group rooms joined — #85 greet-leave no longer breaks invite-then-relink (#120 )

CI / test (push) Successful in 9m22s

Details

CI / test (pull_request) Successful in 9m24s

Details

2f37558027

greet_when_joined's #85 anti-spoof left ANY joined room that isn't a
≤2-member DM, after EVERY accepted invite — including an operator's invite
of the bot into a to-be-bridged room. For a populated room the bot joined
and left within seconds, consuming the invite, so the documented manual
invite-then-relink flow for restricted rooms was silently broken.
Reproduced live (issue #120 comment 1264) by the new scenario before the
fix: leave_logged=true, bot_still_joined=false.

Fix: thread the inviter's tier into greet_when_joined. Operator-accepted
invites keep the group-room join (skipping only the greeting — the DM
command gate ignores such rooms anyway); every self-serve join keeps the
full #85 leave. The #85 anti-spoof exists to stop self-serve users pulling
the bot into group rooms via a forged is_direct; an operator may place the
bot anywhere by definition.

New scenario mgmt_operator_room_invite (suite → 28) reproduced the bug as
KnownFail and now asserts the fixed contract as the regression guard.

Verified: 124 unit tests + clippy -D warnings; live
mgmt_operator_room_invite PASS (30.8s, was known-fail pre-fix on the same
staging env), mgmt_dm_e2ee + mgmt_self_serve_link PASS (DM greeting and the
self-serve invite gate unchanged).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>