switchroom 0.13.18 → 0.13.20

package/dist/cli/switchroom.js

@@ -47331,8 +47331,8 @@ var {
 } = import__.default;
 
 // src/build-info.ts
-var VERSION = "0.13.18";
-var COMMIT_SHA = "847c860e";
+var VERSION = "0.13.20";
+var COMMIT_SHA = "9962efb4";
 
 // src/cli/agent.ts
 init_source();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switchroom",
-  "version": "0.13.18",
+  "version": "0.13.20",
   "description": "Run Claude Code 24/7 on your Claude Pro/Max subscription over Telegram. Open-source alternative to OpenClaw and NanoClaw — no API keys.",
   "type": "module",
   "bin": {

package/telegram-plugin/dist/gateway/gateway.js

@@ -37062,6 +37062,9 @@ function decideSilentReplyAnchor(input) {
   if (!input.effectivelySilent) {
     return { kind: "fresh", becomesAnchor: false };
   }
+  if (input.wasOverPingSuppressed === true) {
+    return { kind: "fresh", becomesAnchor: false };
+  }
   if (input.hasFiles || input.hasButtons) {
     return { kind: "fresh", becomesAnchor: false };
   }
@@ -40352,6 +40355,90 @@ function getOpenTags(html) {
   return tagStack;
 }
 
+// text-voice-scrub.ts
+var NULL = "\x00";
+var FENCE_PH = `${NULL}VS_FENCE`;
+var INLINE_PH = `${NULL}VS_INLINE`;
+var HTML_CODE_PH = `${NULL}VS_HTMLCODE`;
+var HTML_PRE_PH = `${NULL}VS_HTMLPRE`;
+var URL_PH = `${NULL}VS_URL`;
+var URL_RE = /https?:\/\/\S+/g;
+function enabled4() {
+  const v = process.env.SWITCHROOM_DISABLE_VOICE_SCRUB;
+  return !(v === "1" || v === "true");
+}
+function park(text) {
+  const parts = [];
+  let parked = text;
+  parked = parked.replace(/```[\s\S]*?```/g, (m) => {
+    const idx = parts.length;
+    parts.push({ prefix: FENCE_PH, idx, raw: m });
+    return `${FENCE_PH}${idx}${NULL}`;
+  });
+  parked = parked.replace(/<pre>[\s\S]*?<\/pre>/gi, (m) => {
+    const idx = parts.length;
+    parts.push({ prefix: HTML_PRE_PH, idx, raw: m });
+    return `${HTML_PRE_PH}${idx}${NULL}`;
+  });
+  parked = parked.replace(/<code[^>]*>[\s\S]*?<\/code>/gi, (m) => {
+    const idx = parts.length;
+    parts.push({ prefix: HTML_CODE_PH, idx, raw: m });
+    return `${HTML_CODE_PH}${idx}${NULL}`;
+  });
+  parked = parked.replace(/`[^`\n]+`/g, (m) => {
+    const idx = parts.length;
+    parts.push({ prefix: INLINE_PH, idx, raw: m });
+    return `${INLINE_PH}${idx}${NULL}`;
+  });
+  parked = parked.replace(URL_RE, (m) => {
+    const idx = parts.length;
+    parts.push({ prefix: URL_PH, idx, raw: m });
+    return `${URL_PH}${idx}${NULL}`;
+  });
+  return { parked, parts };
+}
+function restore(text, parts) {
+  let restored = text;
+  for (let i = parts.length - 1;i >= 0; i--) {
+    const p = parts[i];
+    restored = restored.replace(`${p.prefix}${p.idx}${NULL}`, () => p.raw);
+  }
+  return restored;
+}
+function replaceDashes(text) {
+  let replaced = 0;
+  let out = text;
+  out = out.replace(/(\S) [\u2014\u2013] (\S)/g, (_m, before, after) => {
+    replaced++;
+    const sentenceStart = /[A-Z]/.test(after);
+    return sentenceStart ? `${before}. ${after}` : `${before}, ${after}`;
+  });
+  out = out.replace(/ [\u2014\u2013](\s*\n)/g, (_m, ws) => {
+    replaced++;
+    return `.${ws}`;
+  });
+  out = out.replace(/(\w)[\u2014\u2013](\w)/g, (_m, before, after) => {
+    replaced++;
+    return `${before}, ${after}`;
+  });
+  out = out.replace(/[\u2014\u2013]/g, () => {
+    replaced++;
+    return "-";
+  });
+  return { out, replaced };
+}
+function scrubVoice(text) {
+  if (!enabled4() || text.length === 0) {
+    return { scrubbed: text, replaced: 0 };
+  }
+  const { parked, parts } = park(text);
+  const { out, replaced } = replaceDashes(parked);
+  if (replaced === 0) {
+    return { scrubbed: text, replaced: 0 };
+  }
+  return { scrubbed: restore(out, parts), replaced };
+}
+
 // telegram-button-constraints.ts
 var TELEGRAM_BUTTON_LIMITS = {
   TEXT_MAX: 64,
@@ -44636,9 +44723,9 @@ function transition(state3, event) {
 
 // gateway/inbound-delivery-machine-shadow.ts
 var state3 = initialState();
-var enabled4 = process.env.SWITCHROOM_DELIVERY_MACHINE_SHADOW !== "0";
+var enabled5 = process.env.SWITCHROOM_DELIVERY_MACHINE_SHADOW !== "0";
 function shadowEmit(event) {
-  if (!enabled4)
+  if (!enabled5)
     return [];
   try {
     const result = transition(state3, event);
@@ -44696,12 +44783,12 @@ function redeliverBufferedInbound2(buffer, agent, send, spool) {
 }
 
 // gateway/inbound-delivery-machine-dispatch.ts
-var enabled5 = process.env.SWITCHROOM_DELIVERY_MACHINE_CUTOVER !== "0";
+var enabled6 = process.env.SWITCHROOM_DELIVERY_MACHINE_CUTOVER !== "0";
 function isDispatchEnabled() {
-  return enabled5;
+  return enabled6;
 }
 function dispatchEffects(effects, ctx) {
-  if (!enabled5)
+  if (!enabled6)
     return;
   for (const effect of effects) {
     dispatchOne(effect, ctx);
@@ -48204,10 +48291,10 @@ function sweepStaleTurnActiveMarker(stateDir, opts) {
 }
 
 // ../src/build-info.ts
-var VERSION = "0.13.18";
-var COMMIT_SHA = "847c860e";
-var COMMIT_DATE = "2026-05-23T06:38:45Z";
-var LATEST_PR = 1680;
+var VERSION = "0.13.20";
+var COMMIT_SHA = "9962efb4";
+var COMMIT_DATE = "2026-05-23T08:29:36Z";
+var LATEST_PR = 1684;
 var COMMITS_AHEAD_OF_TAG = 0;
 
 // gateway/boot-version.ts
@@ -50647,6 +50734,18 @@ async function executeReply(args) {
   if (rawText == null || rawText === "")
     throw new Error("reply: text is required and cannot be empty");
   let text = repairEscapedWhitespace(rawText);
+  {
+    const scrub = scrubVoice(text);
+    if (scrub.replaced > 0) {
+      text = scrub.scrubbed;
+      emitRuntimeMetric({
+        kind: "voice_scrub_applied",
+        chatKey: statusKey(chat_id, args.message_thread_id != null ? Number(args.message_thread_id) : undefined),
+        replaced: scrub.replaced,
+        site: "reply"
+      });
+    }
+  }
   process.stderr.write(`telegram channel: reply: invoked chatId=${chat_id} charCount=${text.length} preview=${JSON.stringify(text.slice(0, 80))}
 `);
   {
@@ -50668,6 +50767,7 @@ async function executeReply(args) {
   const format = args.format ?? configParseMode;
   const disableLinkPreview = args.disable_web_page_preview != null ? Boolean(args.disable_web_page_preview) : access.disableLinkPreview ?? true;
   let disableNotification = args.disable_notification === true;
+  let wasOverPingSuppressed = false;
   {
     const turn2 = currentTurn;
     if (turn2 != null) {
@@ -50686,6 +50786,7 @@ async function executeReply(args) {
           sinceFirstPingMs: decision.sinceFirstPingMs ?? 0
         });
         disableNotification = true;
+        wasOverPingSuppressed = true;
       } else if (decision.claimSlot) {
         turn2.firstPingAt = now;
       }
@@ -50794,7 +50895,8 @@ ${url}`;
         anchorText: turn2.silentAnchorText,
         newReplyText: effectiveText,
         hasFiles: files.length > 0,
-        hasButtons: replyMarkup != null
+        hasButtons: replyMarkup != null,
+        wasOverPingSuppressed
       });
       if (decision.kind === "edit-anchor") {
         const editParams = {
@@ -51704,7 +51806,19 @@ async function executeEditMessage(args) {
   const editAccess = loadAccess();
   const editConfigMode = editAccess.parseMode ?? "html";
   const editFormat = args.format ?? editConfigMode;
-  const editRawText = repairEscapedWhitespace(args.text);
+  let editRawText = repairEscapedWhitespace(args.text);
+  {
+    const scrub = scrubVoice(editRawText);
+    if (scrub.replaced > 0) {
+      editRawText = scrub.scrubbed;
+      emitRuntimeMetric({
+        kind: "voice_scrub_applied",
+        chatKey: statusKey(args.chat_id, undefined),
+        replaced: scrub.replaced,
+        site: "edit_message"
+      });
+    }
+  }
   let editParseMode;
   let editText;
   if (editFormat === "html") {

package/telegram-plugin/gateway/gateway.ts

@@ -154,6 +154,7 @@ const SILENT_END_FALLBACK_TEXT =
   '⚠️ The agent finished working but didn’t send a reply — your last ' +
   'message may not have been answered. Please try asking again.'
 import { markdownToHtml, splitHtmlChunks, repairEscapedWhitespace, telegramHtmlToPlainText } from '../format.js'
+import { scrubVoice } from '../text-voice-scrub.js'
 import {
   validateInlineKeyboard,
   type AnyButton,
@@ -4197,6 +4198,26 @@ async function executeReply(args: Record<string, unknown>): Promise<{ content: A
   const rawText = args.text as string | undefined
   if (rawText == null || rawText === '') throw new Error('reply: text is required and cannot be empty')
   let text = repairEscapedWhitespace(rawText)
+  // Voice scrub (#1683): replace em / en dashes with commas / periods.
+  // Runs BEFORE outboundDedup so retries see the scrubbed key, and
+  // BEFORE markdownToHtml so code-block content is correctly parked
+  // by the scrubber's own placeholder pass (otherwise the html
+  // converter would have already escaped/parked code, and the scrub
+  // would see only the parked placeholders). Kill switch:
+  // `SWITCHROOM_DISABLE_VOICE_SCRUB=1`.
+  {
+    const scrub = scrubVoice(text)
+    if (scrub.replaced > 0) {
+      text = scrub.scrubbed
+      emitRuntimeMetric({
+        kind: 'voice_scrub_applied',
+        chatKey: statusKey(chat_id, args.message_thread_id != null
+          ? Number(args.message_thread_id) : undefined),
+        replaced: scrub.replaced,
+        site: 'reply',
+      })
+    }
+  }
   process.stderr.write(`telegram channel: reply: invoked chatId=${chat_id} charCount=${text.length} preview=${JSON.stringify(text.slice(0, 80))}\n`)
 
   // #546 dedup check: was this content just sent via turn-flush or
@@ -4252,6 +4273,12 @@ async function executeReply(args: Record<string, unknown>): Promise<{ content: A
   // and subsequent pings would be silenced. Acceptable trade-off (a
   // failed first ping is an edge case; the alternative — claim after
   // send — races concurrent reply calls).
+  // Tracks whether the over-ping safety net coerced this reply
+  // from ping→silent. Threaded into the silent-anchor predicate
+  // below: a demoted final-answer reply must NOT merge into the
+  // silent preamble bubble; it lands as a fresh silent bubble so
+  // the user can still find it (see #1674 / silent-anchor follow-up).
+  let wasOverPingSuppressed = false
   {
     const turn = currentTurn
     if (turn != null) {
@@ -4278,6 +4305,7 @@ async function executeReply(args: Record<string, unknown>): Promise<{ content: A
           sinceFirstPingMs: decision.sinceFirstPingMs ?? 0,
         })
         disableNotification = true
+        wasOverPingSuppressed = true
       } else if (decision.claimSlot) {
         turn.firstPingAt = now
       }
@@ -4445,6 +4473,7 @@ async function executeReply(args: Record<string, unknown>): Promise<{ content: A
         newReplyText: effectiveText,
         hasFiles: files.length > 0,
         hasButtons: replyMarkup != null,
+        wasOverPingSuppressed,
       })
       if (decision.kind === 'edit-anchor') {
         const editParams: {
@@ -5834,7 +5863,23 @@ async function executeEditMessage(args: Record<string, unknown>): Promise<unknow
   const editAccess = loadAccess()
   const editConfigMode = editAccess.parseMode ?? 'html'
   const editFormat = (args.format as string | undefined) ?? editConfigMode
-  const editRawText = repairEscapedWhitespace(args.text as string)
+  let editRawText = repairEscapedWhitespace(args.text as string)
+  // Voice scrub (#1683): same em-dash scrub as the reply path. Edits
+  // are how silent-anchor and progress-update mutate already-sent
+  // bubbles, so without this an edit can re-introduce dashes the
+  // original send had scrubbed out.
+  {
+    const scrub = scrubVoice(editRawText)
+    if (scrub.replaced > 0) {
+      editRawText = scrub.scrubbed
+      emitRuntimeMetric({
+        kind: 'voice_scrub_applied',
+        chatKey: statusKey(args.chat_id as string, undefined),
+        replaced: scrub.replaced,
+        site: 'edit_message',
+      })
+    }
+  }
   let editParseMode: 'HTML' | 'MarkdownV2' | undefined
   let editText: string
   if (editFormat === 'html') {

package/telegram-plugin/runtime-metrics.ts

@@ -142,6 +142,24 @@ export type RuntimeMetricEvent =
       key: string
       sinceFirstPingMs: number
     }
+  /**
+   * Voice scrubber engaged: em / en dashes were rewritten to commas /
+   * periods on an outbound reply. Each event is a soft-layer policy
+   * violation the framework caught (SOUL.md.hbs "never use em-dashes"
+   * is the soft layer, this scrub is the hard layer). Fleet-wide
+   * trend over weeks shows whether the soft prompt is gaining or
+   * losing ground; a per-agent spike is prompt drift on that agent.
+   *
+   *   chatKey   → `<chatId>:<threadIdOrEmpty>` (statusKey shape)
+   *   replaced  → count of dashes rewritten in this single message
+   *   site      → which reply path saw the scrub (executeReply / edit / answer-stream)
+   */
+  | {
+      kind: 'voice_scrub_applied'
+      chatKey: string
+      replaced: number
+      site: 'reply' | 'edit_message' | 'progress_update' | 'answer_stream'
+    }
 
 /**
  * The JSONL sink lives under the runtime state dir so it's per-agent

package/telegram-plugin/silent-reply-anchor.ts

@@ -65,6 +65,15 @@ export interface SilentReplyAnchorDecisionInput {
    *  are too easy to get wrong, and the markup is rare enough
    *  that fresh-send is the safer default. */
   hasButtons: boolean
+  /** True iff this reply was an intended-ping (model requested
+   *  `disable_notification:false`) that the over-ping safety net
+   *  (#1674) coerced to silent. Anchor merge MUST bypass when true:
+   *  semantically the model intended this as a distinct/final
+   *  delivery, and merging it into the existing silent preamble
+   *  would bury the content (the user already stopped looking at
+   *  the anchor bubble because earlier ticks edited it silently).
+   *  Optional — defaults to false for non-gateway callers. */
+  wasOverPingSuppressed?: boolean
 }
 
 /**
@@ -108,6 +117,19 @@ export function decideSilentReplyAnchor(
     return { kind: 'fresh', becomesAnchor: false }
   }
 
+  // Over-ping-suppressed replies bypass the anchor. The model
+  // intended a ping (almost always: a final/distinct reply); the
+  // safety net demoted to silent so the user isn't double-beeped.
+  // Merging the demoted reply into the existing silent anchor
+  // hides it — the user has already disengaged from the bubble
+  // that's been edited silently for the rest of the turn. Land
+  // as a fresh silent bubble instead, preserving discoverability.
+  // Don't capture as next anchor either: this reply is the
+  // *answer*, not more preamble.
+  if (input.wasOverPingSuppressed === true) {
+    return { kind: 'fresh', becomesAnchor: false }
+  }
+
   // Files / buttons bypass the anchor — edit-text can't merge
   // media, and keyboards across edits are a foot-gun.
   if (input.hasFiles || input.hasButtons) {

package/telegram-plugin/tests/silent-reply-anchor.test.ts

@@ -175,4 +175,73 @@ describe('decideSilentReplyAnchor — silent replies edit a single growing ancho
       expect(d.mergedText.length).toBe(TELEGRAM_MSG_CAP)
     }
   })
+
+  // Follow-up to #1679 — when the over-ping safety net coerces a
+  // model-intended ping to silent, the demoted reply must NOT be
+  // merged into the existing silent anchor. The anchor has been
+  // edited silently for the whole turn; the user has long since
+  // disengaged. Merging the (semantically final) demoted reply
+  // there would hide the answer entirely.
+  describe('over-ping-suppressed messages bypass anchor merge', () => {
+    it('demoted reply with an active anchor lands as a fresh silent (not edit, not next-anchor)', () => {
+      const d = decideSilentReplyAnchor({
+        effectivelySilent: true,
+        anchorMessageId: 12345,
+        anchorText: 'on it — gathering facts',
+        newReplyText: 'Delivered all three steps with a wrap-up summary.',
+        hasFiles: false,
+        hasButtons: false,
+        wasOverPingSuppressed: true,
+      })
+      expect(d).toEqual({ kind: 'fresh', becomesAnchor: false })
+    })
+
+    it('demoted reply with no anchor yet also fresh-sends without capturing the anchor', () => {
+      // The model fired a stray ping before any silent ack; the
+      // safety-net demoted that ping. A demoted message is never
+      // anchor material — it's an answer, not preamble.
+      const d = decideSilentReplyAnchor({
+        effectivelySilent: true,
+        anchorMessageId: null,
+        anchorText: '',
+        newReplyText: 'Delivered all three steps with a wrap-up summary.',
+        hasFiles: false,
+        hasButtons: false,
+        wasOverPingSuppressed: true,
+      })
+      expect(d).toEqual({ kind: 'fresh', becomesAnchor: false })
+    })
+
+    it('genuinely silent reply (not over-ping-suppressed) still merges normally', () => {
+      // Regression guard: the new bypass must not over-fire on
+      // legitimate beat-3 silent ticks.
+      const d = decideSilentReplyAnchor({
+        effectivelySilent: true,
+        anchorMessageId: 12345,
+        anchorText: 'on it — gathering facts',
+        newReplyText: 'Step 1: hostname is example-host',
+        hasFiles: false,
+        hasButtons: false,
+        wasOverPingSuppressed: false,
+      })
+      expect(d).toEqual({
+        kind: 'edit-anchor',
+        messageId: 12345,
+        mergedText:
+          'on it — gathering facts\n\nStep 1: hostname is example-host',
+      })
+    })
+
+    it('omitting wasOverPingSuppressed defaults to false (backward compat)', () => {
+      const d = decideSilentReplyAnchor({
+        effectivelySilent: true,
+        anchorMessageId: 12345,
+        anchorText: 'on it',
+        newReplyText: 'next thought',
+        hasFiles: false,
+        hasButtons: false,
+      })
+      expect(d.kind).toBe('edit-anchor')
+    })
+  })
 })

package/telegram-plugin/tests/text-voice-scrub.test.ts

@@ -0,0 +1,174 @@
+/**
+ * Unit suite for #1683 text-voice-scrub.
+ *
+ * The fleet sample on 2026-05-23 showed 73% of outbound replies
+ * shipped at least one em-dash despite the SOUL.md.hbs soft rule.
+ * These tests pin the deterministic transform that the framework
+ * enforces, including the code/inline/HTML/URL preservation that
+ * keeps the scrub from mangling legitimate non-prose contexts.
+ */
+
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+
+import { scrubVoice } from '../text-voice-scrub.js'
+
+describe('scrubVoice — em / en dash replacement', () => {
+  beforeEach(() => {
+    delete process.env.SWITCHROOM_DISABLE_VOICE_SCRUB
+  })
+  afterEach(() => {
+    delete process.env.SWITCHROOM_DISABLE_VOICE_SCRUB
+  })
+
+  describe('mechanical rewrite of spaced dashes', () => {
+    it('replaces a spaced em-dash before lowercase with a comma', () => {
+      const r = scrubVoice('on it — checking the calendar')
+      expect(r.scrubbed).toBe('on it, checking the calendar')
+      expect(r.replaced).toBe(1)
+    })
+
+    it('replaces a spaced em-dash before an uppercase letter with a period', () => {
+      // The model often writes "Here's the result — Done." style.
+      const r = scrubVoice("Here's the result — Done.")
+      expect(r.scrubbed).toBe("Here's the result. Done.")
+      expect(r.replaced).toBe(1)
+    })
+
+    it('handles multiple em-dashes in one sentence', () => {
+      const r = scrubVoice('one — two — three — done')
+      expect(r.scrubbed).toBe('one, two, three, done')
+      expect(r.replaced).toBe(3)
+    })
+
+    it('treats en-dash (–) identically to em-dash', () => {
+      const r = scrubVoice('on it – checking the calendar')
+      expect(r.scrubbed).toBe('on it, checking the calendar')
+      expect(r.replaced).toBe(1)
+    })
+
+    it('replaces unspaced word-dash-word as a comma', () => {
+      // Less common but seen in tightly-typed prose.
+      const r = scrubVoice('flag—on or flag—off')
+      expect(r.scrubbed).toBe('flag, on or flag, off')
+      expect(r.replaced).toBe(2)
+    })
+
+    it('replaces end-of-line dashes with a period', () => {
+      const r = scrubVoice('thinking out loud —\nnext line here')
+      expect(r.scrubbed).toBe('thinking out loud.\nnext line here')
+      expect(r.replaced).toBe(1)
+    })
+
+    it('converts a leading-dash sentence-start to ASCII hyphen', () => {
+      // Quoted-style or list-bullet em-dash at message start; falls
+      // through to the catch-all rule.
+      const r = scrubVoice('— note: ship it')
+      expect(r.scrubbed).toBe('- note: ship it')
+      expect(r.replaced).toBe(1)
+    })
+  })
+
+  describe('protected regions are left alone', () => {
+    it('preserves dashes inside fenced code blocks', () => {
+      const input = 'here is code:\n```bash\nfoo --bar — baz\n```\nand prose — done'
+      const r = scrubVoice(input)
+      expect(r.scrubbed).toBe(
+        'here is code:\n```bash\nfoo --bar — baz\n```\nand prose, done',
+      )
+      expect(r.replaced).toBe(1)
+    })
+
+    it('preserves dashes inside inline code', () => {
+      const r = scrubVoice('the flag `--really — keep` matters — yes')
+      expect(r.scrubbed).toBe('the flag `--really — keep` matters, yes')
+      expect(r.replaced).toBe(1)
+    })
+
+    it('preserves dashes inside <code> HTML tags', () => {
+      const r = scrubVoice('see <code>x — y</code> and note — ok')
+      expect(r.scrubbed).toBe('see <code>x — y</code> and note, ok')
+      expect(r.replaced).toBe(1)
+    })
+
+    it('preserves dashes inside <pre> HTML tags', () => {
+      const r = scrubVoice('block:\n<pre>x — y\nz — w</pre>\nend — ok')
+      expect(r.scrubbed).toBe('block:\n<pre>x — y\nz — w</pre>\nend, ok')
+      expect(r.replaced).toBe(1)
+    })
+
+    it('preserves dashes inside URLs', () => {
+      const r = scrubVoice('see https://example.com/a—b for context — ok')
+      expect(r.scrubbed).toBe(
+        'see https://example.com/a—b for context, ok',
+      )
+      expect(r.replaced).toBe(1)
+    })
+
+    it('preserves a code block containing markdown that could otherwise match', () => {
+      // The placeholder restore must put the original raw fence back,
+      // not a transformed copy.
+      const fence =
+        '```\n# heading — title\nfunction f() {}\n```'
+      const r = scrubVoice(fence + '\ntrailing — yes')
+      expect(r.scrubbed).toBe(fence + '\ntrailing, yes')
+      expect(r.replaced).toBe(1)
+    })
+  })
+
+  describe('no-op cases', () => {
+    it('returns identity (same string, replaced=0) when input has no dashes', () => {
+      const input = 'no dashes anywhere, just commas and periods.'
+      const r = scrubVoice(input)
+      expect(r.scrubbed).toBe(input)
+      expect(r.replaced).toBe(0)
+    })
+
+    it('returns identity when input is empty', () => {
+      const r = scrubVoice('')
+      expect(r.scrubbed).toBe('')
+      expect(r.replaced).toBe(0)
+    })
+
+    it('kill switch (SWITCHROOM_DISABLE_VOICE_SCRUB=1) returns input unchanged', () => {
+      process.env.SWITCHROOM_DISABLE_VOICE_SCRUB = '1'
+      const r = scrubVoice('on it — checking')
+      expect(r.scrubbed).toBe('on it — checking')
+      expect(r.replaced).toBe(0)
+    })
+
+    it('kill switch accepts "true" as well as "1"', () => {
+      process.env.SWITCHROOM_DISABLE_VOICE_SCRUB = 'true'
+      const r = scrubVoice('on it — checking')
+      expect(r.scrubbed).toBe('on it — checking')
+      expect(r.replaced).toBe(0)
+    })
+  })
+
+  describe('realistic fleet samples', () => {
+    it('scrubs a multi-step status message', () => {
+      const input =
+        "I'll check the calendar — should take a few seconds. " +
+        'Result: empty for Saturday — nothing scheduled. Anything else?'
+      const r = scrubVoice(input)
+      expect(r.scrubbed).toBe(
+        "I'll check the calendar, should take a few seconds. " +
+        'Result: empty for Saturday, nothing scheduled. Anything else?',
+      )
+      expect(r.replaced).toBe(2)
+    })
+
+    it('mixed prose and code keeps the code untouched', () => {
+      const input =
+        'Running `git status --short` — looks clean. ' +
+        '```\nM file.ts — modified\n```\n' +
+        'Ready to commit — go?'
+      const r = scrubVoice(input)
+      expect(r.scrubbed).toBe(
+        'Running `git status --short`, looks clean. ' +
+        '```\nM file.ts — modified\n```\n' +
+        'Ready to commit, go?',
+      )
+      expect(r.replaced).toBe(2)
+    })
+  })
+})

package/telegram-plugin/text-voice-scrub.ts

@@ -0,0 +1,199 @@
+/**
+ * text-voice-scrub.ts — deterministic prose-style enforcement at the
+ * gateway.
+ *
+ * Background. Despite three landed soft fixes (SOUL.md.hbs "never use
+ * em-dashes" rule, PR #1177 voice consolidation, the /humanizer skill),
+ * sampling 2,867 recent fleet outbound replies on 2026-05-23 showed
+ * em-dashes still present in 73% of agent messages (3.23 per 1k chars).
+ * Soft layer was not winning. The operator's framing is the same one
+ * that drove the over-ping safety net (#1674) and the silent-reply
+ * auto-edit (#1677): when the model authors voice and the framework
+ * owns enforcement, soft instructions fail under load. Make the
+ * framework do it.
+ *
+ * Scope. Em / en dashes only. The wider "AI-tell phrase denylist"
+ * (smoking gun, by design, etc.) was scoped OUT after data showed
+ * those phrases land in <0.5% of fleet messages and substituting
+ * them risks semantic loss. Em-dash → comma/period is a pure
+ * mechanical transform with no semantic loss when the surrounding
+ * text is whitespace-separated prose, and a no-op when the dash
+ * is inside code or a URL.
+ *
+ * Pipeline integration. Apply BEFORE markdownToHtml so the scrub
+ * runs on the original model text, not on rendered HTML where
+ * the dash might already be tag-escaped or live inside a parked
+ * code-block placeholder. Apply BEFORE outboundDedup.check so
+ * dedup keys see the post-scrub content (same text from a retry
+ * collapses cleanly).
+ *
+ * Code-region awareness. The scrubber MUST preserve dashes inside:
+ *   - fenced code blocks: ```lang\n...\n```
+ *   - inline code: `...`
+ *   - explicit Telegram HTML code tags: <code>...</code>, <pre>...</pre>
+ *   - URLs (rare to contain em-dashes, but technically valid IDN)
+ * The strategy is to park each protected region with a sentinel,
+ * scrub the rest, then restore. Mirrors the well-trodden
+ * markdownToHtml() codeBlocks/inlineCode placeholder pattern at
+ * format.ts:254-272.
+ *
+ * Kill switch. `SWITCHROOM_DISABLE_VOICE_SCRUB=1` returns the input
+ * unchanged and reports zero replacements. Same shape every other
+ * gateway safety net uses; rollback is one env var + agent restart.
+ */
+
+export interface VoiceScrubResult {
+  /** The scrubbed text. Equal to input when no replacements made or
+   *  when the kill switch is set. */
+  scrubbed: string
+  /** Count of dash replacements made across the whole input. Surfaces
+   *  to the runtime-metrics fan-out so the cadence dashboard can track
+   *  fleet-wide voice-scrub rate over time. */
+  replaced: number
+}
+
+const NULL = '\x00'
+const FENCE_PH = `${NULL}VS_FENCE`
+const INLINE_PH = `${NULL}VS_INLINE`
+const HTML_CODE_PH = `${NULL}VS_HTMLCODE`
+const HTML_PRE_PH = `${NULL}VS_HTMLPRE`
+const URL_PH = `${NULL}VS_URL`
+
+const URL_RE = /https?:\/\/\S+/g
+
+function enabled(): boolean {
+  const v = process.env.SWITCHROOM_DISABLE_VOICE_SCRUB
+  return !(v === '1' || v === 'true')
+}
+
+/**
+ * Park code-like regions behind placeholders so the dash-replacement
+ * pass can't touch them. Returns the parked-string and the original
+ * fragments keyed by index.
+ */
+function park(text: string): {
+  parked: string
+  parts: Array<{ prefix: string; idx: number; raw: string }>
+} {
+  const parts: Array<{ prefix: string; idx: number; raw: string }> = []
+  let parked = text
+
+  // Order matters: fenced first (so a ` inside a fence isn't taken
+  // as inline-code start), then HTML code tags, then inline backticks,
+  // then URLs.
+  parked = parked.replace(/```[\s\S]*?```/g, (m) => {
+    const idx = parts.length
+    parts.push({ prefix: FENCE_PH, idx, raw: m })
+    return `${FENCE_PH}${idx}${NULL}`
+  })
+  parked = parked.replace(/<pre>[\s\S]*?<\/pre>/gi, (m) => {
+    const idx = parts.length
+    parts.push({ prefix: HTML_PRE_PH, idx, raw: m })
+    return `${HTML_PRE_PH}${idx}${NULL}`
+  })
+  parked = parked.replace(/<code[^>]*>[\s\S]*?<\/code>/gi, (m) => {
+    const idx = parts.length
+    parts.push({ prefix: HTML_CODE_PH, idx, raw: m })
+    return `${HTML_CODE_PH}${idx}${NULL}`
+  })
+  parked = parked.replace(/`[^`\n]+`/g, (m) => {
+    const idx = parts.length
+    parts.push({ prefix: INLINE_PH, idx, raw: m })
+    return `${INLINE_PH}${idx}${NULL}`
+  })
+  parked = parked.replace(URL_RE, (m) => {
+    const idx = parts.length
+    parts.push({ prefix: URL_PH, idx, raw: m })
+    return `${URL_PH}${idx}${NULL}`
+  })
+
+  return { parked, parts }
+}
+
+function restore(
+  text: string,
+  parts: Array<{ prefix: string; idx: number; raw: string }>,
+): string {
+  let restored = text
+  // Restore in reverse-insertion order so a placeholder accidentally
+  // emitted by a nested replacement gets the right raw region.
+  for (let i = parts.length - 1; i >= 0; i--) {
+    const p = parts[i]!
+    restored = restored.replace(`${p.prefix}${p.idx}${NULL}`, () => p.raw)
+  }
+  return restored
+}
+
+/**
+ * Replace em / en dashes with context-appropriate punctuation.
+ *
+ * Rules, applied in order:
+ *   1. ` — ` / ` – ` (flanked by single space) → `, ` if followed by a
+ *      lowercase or open-paren character; otherwise `. ` if followed by
+ *      an uppercase or end-of-string. Heuristic: lowercase = mid-clause
+ *      continuation (comma reads naturally); uppercase = new sentence
+ *      (period reads naturally).
+ *   2. End-of-line dash (` —\n` / ` –\n`) → `.\n` — treat as full stop.
+ *   3. Bare dash with no flanking spaces between word chars
+ *      (e.g. "word—word") → `, ` — the missing-space form is rarer but
+ *      semantically the same as #1.
+ *   4. Surviving dash (uncommon, e.g. at sentence start "— note") → `-`
+ *      so the message still renders without the AI tell.
+ */
+function replaceDashes(text: string): { out: string; replaced: number } {
+  let replaced = 0
+  let out = text
+
+  // #1: spaced em-dash mid-prose. Decide between ", " and ". " on
+  // the leading character of the following token.
+  out = out.replace(/(\S) [—–] (\S)/g, (_m, before: string, after: string) => {
+    replaced++
+    // If `after` is uppercase ASCII or one of a known sentence-starter
+    // set, treat as new sentence; otherwise a parenthetical comma.
+    const sentenceStart = /[A-Z]/.test(after)
+    return sentenceStart ? `${before}. ${after}` : `${before}, ${after}`
+  })
+
+  // #2: dash at end of line. Treat as full stop.
+  out = out.replace(/ [—–](\s*\n)/g, (_m, ws: string) => {
+    replaced++
+    return `.${ws}`
+  })
+
+  // #3: bare dash between word chars (no flanking spaces). Treat as
+  // missing-space form of #1; comma is the safe fallback.
+  out = out.replace(/(\w)[—–](\w)/g, (_m, before: string, after: string) => {
+    replaced++
+    return `${before}, ${after}`
+  })
+
+  // #4: anything still standing — convert to ASCII hyphen so no
+  // typographic dash escapes the gate. Rare path; covers leading
+  // "— note" / quoted dash / etc.
+  out = out.replace(/[—–]/g, () => {
+    replaced++
+    return '-'
+  })
+
+  return { out, replaced }
+}
+
+/**
+ * Public entry: scrub em / en dashes from outbound text while
+ * preserving dashes inside code and URLs.
+ *
+ * Pure: no IO, no module-scope state, deterministic. Kill switch is
+ * checked per call so an operator can flip it via env var without a
+ * restart of an in-process test.
+ */
+export function scrubVoice(text: string): VoiceScrubResult {
+  if (!enabled() || text.length === 0) {
+    return { scrubbed: text, replaced: 0 }
+  }
+  const { parked, parts } = park(text)
+  const { out, replaced } = replaceDashes(parked)
+  if (replaced === 0) {
+    return { scrubbed: text, replaced: 0 }
+  }
+  return { scrubbed: restore(out, parts), replaced }
+}