switchroom 0.15.21 → 0.15.22

package/dist/cli/switchroom.js

@@ -50477,8 +50477,8 @@ var {
 } = import__.default;
 
 // src/build-info.ts
-var VERSION = "0.15.21";
-var COMMIT_SHA = "36706e85";
+var VERSION = "0.15.22";
+var COMMIT_SHA = "a6c13429";
 
 // src/cli/agent.ts
 init_source();

package/dist/host-control/main.js

@@ -20817,6 +20817,85 @@ function stripCallerAllow(cfg, caller) {
   return clone;
 }
 
+// src/host-control/config-blast-radius.ts
+function toObject2(v) {
+  return v && typeof v === "object" && !Array.isArray(v) ? v : {};
+}
+function changedConfigPaths(before, after, prefix = "") {
+  if (deepEqual(before, after))
+    return [];
+  const bObj = before && typeof before === "object" && !Array.isArray(before);
+  const aObj = after && typeof after === "object" && !Array.isArray(after);
+  if (bObj && aObj) {
+    const keys = new Set([
+      ...Object.keys(before),
+      ...Object.keys(after)
+    ]);
+    const out = [];
+    for (const k of keys) {
+      out.push(...changedConfigPaths(before[k], after[k], prefix ? `${prefix}.${k}` : k));
+    }
+    return out;
+  }
+  return [prefix || "<root>"];
+}
+function deepEqual(a, b) {
+  if (a === b)
+    return true;
+  if (typeof a !== typeof b)
+    return false;
+  if (a && b && typeof a === "object") {
+    if (Array.isArray(a) !== Array.isArray(b))
+      return false;
+    if (Array.isArray(a) && Array.isArray(b)) {
+      if (a.length !== b.length)
+        return false;
+      return a.every((x, i) => deepEqual(x, b[i]));
+    }
+    const ao = a;
+    const bo = b;
+    const keys = new Set([...Object.keys(ao), ...Object.keys(bo)]);
+    for (const k of keys)
+      if (!deepEqual(ao[k], bo[k]))
+        return false;
+    return true;
+  }
+  return false;
+}
+function classifyBlastRadius(beforeYaml, afterYaml) {
+  let before;
+  let after;
+  try {
+    before = toObject2($parse(beforeYaml));
+    after = toObject2($parse(afterYaml));
+  } catch {
+    return { agents: [], fleetWide: true, changedPaths: ["<unparseable>"] };
+  }
+  const changedPaths = changedConfigPaths(before, after).sort();
+  if (changedPaths.length === 0) {
+    return { agents: [], fleetWide: false, changedPaths: [] };
+  }
+  const agents = new Set;
+  let fleetWide = false;
+  for (const path2 of changedPaths) {
+    if (path2 === "<root>") {
+      fleetWide = true;
+      continue;
+    }
+    const segs = path2.split(".");
+    if (segs[0] === "agents" && segs.length >= 2) {
+      agents.add(segs[1]);
+    } else {
+      fleetWide = true;
+    }
+  }
+  return {
+    agents: fleetWide ? [] : [...agents].sort(),
+    fleetWide,
+    changedPaths
+  };
+}
+
 // src/host-control/server.ts
 function resolveDigests(imageRefs) {
   const out = new Map;
@@ -21509,7 +21588,12 @@ class HostdServer {
       const runner = this.opts.runReconcile ?? (async () => this.runSwitchroom(["apply"]));
       const recRes = await runner({ requestId: approvalId });
       if (recRes.exit_code === 0) {
-        await approval.finalize({ outcome: "applied" });
+        const blast = classifyBlastRadius(snapshot, postApply);
+        await approval.finalize({
+          outcome: "applied",
+          affectedAgents: blast.agents,
+          fleetWide: blast.fleetWide
+        });
         return {
           v: 1,
           request_id: req.request_id,
@@ -21893,7 +21977,9 @@ class SocketApprovalGateway {
             type: "request_config_finalize",
             requestId: req.requestId,
             outcome: outcome.outcome,
-            ...outcome.detail ? { detail: outcome.detail } : {}
+            ...outcome.detail ? { detail: outcome.detail } : {},
+            ...outcome.affectedAgents ? { affectedAgents: outcome.affectedAgents } : {},
+            ...outcome.fleetWide !== undefined ? { fleetWide: outcome.fleetWide } : {}
           }) + `
 `);
           client2.end();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switchroom",
-  "version": "0.15.21",
+  "version": "0.15.22",
   "description": "Run Claude Code 24/7 on your Claude Pro/Max subscription over Telegram. Open-source alternative to OpenClaw and NanoClaw — no API keys.",
   "type": "module",
   "bin": {

package/telegram-plugin/dist/gateway/gateway.js

@@ -31013,6 +31013,7 @@ __export(exports_config_approval_handler, {
   parseConfigApprovalCallback: () => parseConfigApprovalCallback,
   handleRequestConfigFinalize: () => handleRequestConfigFinalize,
   handleRequestConfigApproval: () => handleRequestConfigApproval,
+  buildLiveNote: () => buildLiveNote,
   buildConfigApprovalCardBody: () => buildConfigApprovalCardBody,
   _resetPendingConfigApprovalsForTest: () => _resetPendingConfigApprovalsForTest,
   _peekPendingConfigApprovalForTest: () => _peekPendingConfigApprovalForTest,
@@ -31156,6 +31157,22 @@ async function resolvePendingConfigApproval(requestId, verdict, deps) {
   }
   return true;
 }
+function buildLiveNote(affectedAgents, fleetWide) {
+  if (fleetWide) {
+    return `
+
+\u26a0\ufe0f Shared config changed \u2014 affects all agents. Not live until they ` + `restart: run <code>switchroom rollout</code> (or <code>/update apply</code>).`;
+  }
+  const agents = (affectedAgents ?? []).filter((a) => typeof a === "string" && a.length > 0);
+  if (agents.length === 0)
+    return "";
+  const list2 = agents.map(escapeHtml12).join(", ");
+  const cmds = agents.map((a) => `/restart ${escapeHtml12(a)}`).join(" \u00b7 ");
+  return `
+
+\uD83D\uDD04 Not live until restart \u2014 affects: <b>${list2}</b>
+${cmds}`;
+}
 async function handleRequestConfigFinalize(_client, msg, deps) {
   const entry = pending.get(msg.requestId);
   if (!entry) {
@@ -31163,8 +31180,9 @@ async function handleRequestConfigFinalize(_client, msg, deps) {
     return;
   }
   pending.delete(msg.requestId);
+  const liveNote = msg.outcome === "applied" ? buildLiveNote(msg.affectedAgents, msg.fleetWide) : "";
   const body = msg.outcome === "applied" ? `\u2705 <b>Applied</b>${msg.detail ? `
-${escapeHtml12(msg.detail)}` : ""}` : `\u26a0\ufe0f <b>Reconcile failed; rolled back</b>${msg.detail ? `
+${escapeHtml12(msg.detail)}` : ""}${liveNote}` : `\u26a0\ufe0f <b>Reconcile failed; rolled back</b>${msg.detail ? `
 ${escapeHtml12(msg.detail)}` : ""}`;
   try {
     await deps.editCard({
@@ -47641,6 +47659,16 @@ function validateClientMessage(msg) {
         return false;
       if (m.detail !== undefined && (typeof m.detail !== "string" || m.detail.length > 500))
         return false;
+      if (m.affectedAgents !== undefined) {
+        if (!Array.isArray(m.affectedAgents) || m.affectedAgents.length > 64)
+          return false;
+        for (const a of m.affectedAgents) {
+          if (typeof a !== "string" || !/^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/.test(a))
+            return false;
+        }
+      }
+      if (m.fleetWide !== undefined && typeof m.fleetWide !== "boolean")
+        return false;
       return true;
     }
     case "request_drive_approval": {
@@ -54392,10 +54420,10 @@ function readTurnActiveMarkerAgeMs(stateDir, now) {
 }
 
 // ../src/build-info.ts
-var VERSION = "0.15.21";
-var COMMIT_SHA = "36706e85";
-var COMMIT_DATE = "2026-06-14T01:34:05Z";
-var LATEST_PR = 2345;
+var VERSION = "0.15.22";
+var COMMIT_SHA = "a6c13429";
+var COMMIT_DATE = "2026-06-14T03:27:21Z";
+var LATEST_PR = 2349;
 var COMMITS_AHEAD_OF_TAG = 0;
 
 // gateway/boot-version.ts

package/telegram-plugin/gateway/config-approval-handler.test.ts

@@ -13,6 +13,7 @@
 import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
 import {
   buildConfigApprovalCardBody,
+  buildLiveNote,
   handleRequestConfigApproval,
   handleRequestConfigFinalize,
   parseConfigApprovalCallback,
@@ -266,6 +267,29 @@ describe("timeout path", () => {
   });
 });
 
+describe("buildLiveNote", () => {
+  it("names specific affected agents + the per-agent restart command", () => {
+    const note = buildLiveNote(["clerk", "gymbro"], false);
+    expect(note).toContain("clerk, gymbro");
+    expect(note).toContain("/restart clerk");
+    expect(note).toContain("/restart gymbro");
+    expect(note).toContain("Not live until restart");
+  });
+  it("guides to a full rollout when fleet-wide (no per-agent list)", () => {
+    const note = buildLiveNote([], true);
+    expect(note).toContain("all agents");
+    expect(note).toContain("switchroom rollout");
+    expect(note).not.toContain("/restart");
+  });
+  it("is empty when nothing is runtime-affected", () => {
+    expect(buildLiveNote([], false)).toBe("");
+    expect(buildLiveNote(undefined, undefined)).toBe("");
+  });
+  it("HTML-escapes agent names", () => {
+    expect(buildLiveNote(["a<b>"], false)).toContain("a&lt;b&gt;");
+  });
+});
+
 describe("handleRequestConfigFinalize", () => {
   it("edits the card to '✅ Applied' on success", async () => {
     const { client, deps, editCalls } = fakeDeps();

package/telegram-plugin/gateway/config-approval-handler.ts

@@ -377,6 +377,27 @@ export async function resolvePendingConfigApproval(
   return true;
 }
 
+/**
+ * The "make it live" note appended to an Applied card. claude loads config at
+ * boot, so an applied edit is inert in the running agents until they restart —
+ * this names exactly what must bounce (and the command) instead of letting the
+ * change silently not take effect. Fleet-wide (shared config) → guide to a full
+ * rollout, never a per-agent list. Empty when nothing runtime-affected.
+ */
+export function buildLiveNote(affectedAgents?: string[], fleetWide?: boolean): string {
+  if (fleetWide) {
+    return (
+      `\n\n⚠️ Shared config changed — affects all agents. Not live until they ` +
+      `restart: run <code>switchroom rollout</code> (or <code>/update apply</code>).`
+    );
+  }
+  const agents = (affectedAgents ?? []).filter((a) => typeof a === "string" && a.length > 0);
+  if (agents.length === 0) return "";
+  const list = agents.map(escapeHtml).join(", ");
+  const cmds = agents.map((a) => `/restart ${escapeHtml(a)}`).join(" · ");
+  return `\n\n🔄 Not live until restart — affects: <b>${list}</b>\n${cmds}`;
+}
+
 /** IPC `request_config_finalize` handler — edits the card to the terminal outcome. */
 export async function handleRequestConfigFinalize(
   _client: Pick<IpcClient, "send">,
@@ -393,9 +414,15 @@ export async function handleRequestConfigFinalize(
   // Clean up the pending entry — finalize is the terminal transition.
   pending.delete(msg.requestId);
 
+  // On apply, tell the operator what must restart for the edit to go LIVE —
+  // claude loads config at boot, so an applied edit is inert until restart.
+  // Specific agents → name them + the one-liner to bounce them; shared config
+  // → guide to a full rollout (never silently leave the change un-live).
+  const liveNote =
+    msg.outcome === "applied" ? buildLiveNote(msg.affectedAgents, msg.fleetWide) : "";
   const body =
     msg.outcome === "applied"
-      ? `✅ <b>Applied</b>${msg.detail ? `\n${escapeHtml(msg.detail)}` : ""}`
+      ? `✅ <b>Applied</b>${msg.detail ? `\n${escapeHtml(msg.detail)}` : ""}${liveNote}`
       : `⚠️ <b>Reconcile failed; rolled back</b>${msg.detail ? `\n${escapeHtml(msg.detail)}` : ""}`;
   try {
     await deps.editCard({

package/telegram-plugin/gateway/ipc-protocol.ts

@@ -391,6 +391,14 @@ export interface RequestConfigFinalizeMessage {
   outcome: "applied" | "reconcile_failed_rolled_back";
   /** Optional short diagnostic appended to the card body. */
   detail?: string;
+  /**
+   * On `applied`: agents that must restart for the edit to go live (claude
+   * loads config at boot). Empty when `fleetWide`. The finalize card offers a
+   * one-tap restart of these. Computed host-side by classifyBlastRadius.
+   */
+  affectedAgents?: string[];
+  /** On `applied`: a shared/inherited key changed → all agents affected. */
+  fleetWide?: boolean;
 }
 
 /**

package/telegram-plugin/gateway/ipc-server.ts

@@ -307,6 +307,16 @@ export function validateClientMessage(msg: unknown): msg is ClientToGateway {
       if (m.detail !== undefined
         && (typeof m.detail !== "string"
           || (m.detail as string).length > 500)) return false;
+      // affectedAgents (optional): a bounded list of kebab-case agent names —
+      // they drive a restart button, so validate shape + charclass even though
+      // the sender (hostd) is trusted (defense in depth).
+      if (m.affectedAgents !== undefined) {
+        if (!Array.isArray(m.affectedAgents) || (m.affectedAgents as unknown[]).length > 64) return false;
+        for (const a of m.affectedAgents as unknown[]) {
+          if (typeof a !== "string" || !/^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/.test(a)) return false;
+        }
+      }
+      if (m.fleetWide !== undefined && typeof m.fleetWide !== "boolean") return false;
       return true;
     }
     case "request_drive_approval": {

package/telegram-plugin/tests/ipc-validator.test.ts

@@ -332,4 +332,32 @@ describe('validateClientMessage', () => {
       expect(validateClientMessage({ ...valid, ttlMs: '300000' })).toBe(false)
     })
   })
+
+  describe('request_config_finalize — affectedAgents / fleetWide (#2346)', () => {
+    const valid = { type: 'request_config_finalize', requestId: 'r1', outcome: 'applied' }
+
+    it('accepts the bare message and the new optional fields', () => {
+      expect(validateClientMessage(valid)).toBe(true)
+      expect(validateClientMessage({ ...valid, affectedAgents: ['clerk', 'gymbro'], fleetWide: false })).toBe(true)
+      expect(validateClientMessage({ ...valid, affectedAgents: [], fleetWide: true })).toBe(true)
+    })
+
+    it('rejects a non-array affectedAgents', () => {
+      expect(validateClientMessage({ ...valid, affectedAgents: 'clerk' })).toBe(false)
+    })
+
+    it('rejects affectedAgents with an unsafe / non-kebab name (defense in depth)', () => {
+      expect(validateClientMessage({ ...valid, affectedAgents: ['../etc'] })).toBe(false)
+      expect(validateClientMessage({ ...valid, affectedAgents: ['has space'] })).toBe(false)
+      expect(validateClientMessage({ ...valid, affectedAgents: [42] })).toBe(false)
+    })
+
+    it('rejects an over-long affectedAgents list', () => {
+      expect(validateClientMessage({ ...valid, affectedAgents: Array.from({ length: 65 }, (_, i) => `a${i}`) })).toBe(false)
+    })
+
+    it('rejects a non-boolean fleetWide', () => {
+      expect(validateClientMessage({ ...valid, fleetWide: 'yes' })).toBe(false)
+    })
+  })
 })

package/telegram-plugin/uat/scenarios/jtbd-effort-command-dm.test.ts

@@ -0,0 +1,90 @@
+/**
+ * UAT — `/effort` command (#2336, #2342): show + tap-to-switch the
+ * Claude reasoning effort for the live session. The effort sibling of
+ * `/model`; the picker-driven menu is the same shape.
+ *
+ * Verified live on test-harness v0.15.21. Switches are session-only
+ * (revert on restart), so the tap test restores the original level.
+ *
+ * Self-skips green on an unwired host (spinUp can't resolve the chat).
+ */
+import { describe, expect, it } from "vitest";
+import { spinUp } from "../harness.js";
+
+const AGENT = "test-harness";
+const T = 30_000;
+
+describe("uat: /effort — show, tap-switch, bad-arg", () => {
+  it(
+    "bare /effort shows the effort menu with a tap keyboard",
+    async () => {
+      const sc = await spinUp({ agent: AGENT });
+      try {
+        await sc.sendDM("/effort");
+        const menu = await sc.expectMessage(/Effort —/, { from: "bot", timeout: T });
+        expect(menu.text).toMatch(/faster → smarter|low · medium · high/i);
+        expect(menu.text).toMatch(/switchroom\.yaml/i);
+        const kb = await sc.driver.getKeyboard(sc.botUserId, menu.messageId);
+        const labels = (kb ?? []).flat().map((b) => b.text);
+        expect(labels.some((t) => /low/i.test(t)), "low button present").toBe(true);
+        expect(labels.some((t) => /max/i.test(t)), "max button present").toBe(true);
+      } finally {
+        await sc.tearDown();
+      }
+    },
+    60_000,
+  );
+
+  it(
+    "tapping a level switches the live session, then restores",
+    async () => {
+      const sc = await spinUp({ agent: AGENT });
+      try {
+        await sc.sendDM("/effort");
+        const menu = await sc.expectMessage(/Effort —/, { from: "bot", timeout: T });
+        const kb = await sc.driver.getKeyboard(sc.botUserId, menu.messageId);
+        const flat = (kb ?? []).flat();
+        // The current level is prefixed with ✅; pick a DIFFERENT one.
+        const current = flat.find((b) => /✅/.test(b.text));
+        const target = flat.find(
+          (b) => b.callbackData && !/✅/.test(b.text) && /medium|high/i.test(b.text),
+        );
+        expect(target, "a non-current effort button to tap").toBeDefined();
+        await sc.driver.pressButton(sc.botUserId, menu.messageId, target!.callbackData!);
+        // The card edits in place to prepend a confirmation line.
+        await new Promise((r) => setTimeout(r, 4000));
+        const after = await sc.driver.getMessage(sc.botUserId, menu.messageId);
+        expect(after?.text ?? "").toMatch(/Effort →|Switched|effort/i);
+
+        // Restore the original level so test-harness isn't left changed.
+        if (current?.callbackData) {
+          const kb2 = await sc.driver.getKeyboard(sc.botUserId, menu.messageId);
+          const restore = (kb2 ?? [])
+            .flat()
+            .find((b) => b.callbackData === current.callbackData);
+          if (restore?.callbackData) {
+            await sc.driver.pressButton(sc.botUserId, menu.messageId, restore.callbackData);
+          }
+        }
+      } finally {
+        await sc.tearDown();
+      }
+    },
+    90_000,
+  );
+
+  it(
+    "/effort bogus → reply (error/help), never silence",
+    async () => {
+      const sc = await spinUp({ agent: AGENT });
+      try {
+        await sc.sendDM("/effort definitely-not-a-level");
+        const reply = await sc.expectMessage(/\S/, { from: "bot", timeout: T });
+        expect(reply.text.length).toBeGreaterThan(0);
+      } finally {
+        await sc.tearDown();
+      }
+    },
+    60_000,
+  );
+});

package/telegram-plugin/uat/scenarios/jtbd-grant-resume-telegram-id-dm.test.ts

@@ -0,0 +1,97 @@
+/**
+ * End-to-end UAT — agent AUTO-RESUMES after a vault grant approval,
+ * under the live `telegram-id` (single-factor) posture. Regression gate
+ * for the mid-turn-strand fix (#2340).
+ *
+ * THE BUG (#2340, clerk 2026-06-13): the gateway injects a synthetic
+ * "✅ approved — resume your task" inbound after the operator taps
+ * Approve. That inject used a raw `sendToAgent` and only buffered on a
+ * disconnected bridge. When the approval landed WHILE the agent's
+ * grant-requesting turn was still finishing, the socket write succeeded
+ * (`delivered=true`) but claude was mid-turn, so the channel
+ * notification stranded in its TUI composer (the #1556 race) and the
+ * agent sat idle until manually poked. Fix: route the resume through
+ * the same turn-gate as normal inbounds (buffer mid-turn, flush at
+ * turn-end). This scenario proves the agent resumes on its own.
+ *
+ * Posture: the live fleet runs `vault.broker.approvalAuth: telegram-id`
+ * (broker auto-unlocked), so tapping Approve mints silently — NO
+ * passphrase prompt. The sibling `vault-grant-auto-resume-dm.test.ts`
+ * covers the (now-legacy) passphrase posture and stays skipped.
+ *
+ * No sacrificial key needed: `vault_request_access` mints an ACL grant
+ * for the key *pattern*; the card → approve → resume cycle fires
+ * whether or not the key holds a value. We assert the RESUME (a fresh
+ * bot turn after the tap, with no driver nudge), not a secret value —
+ * so nothing sensitive is read or leaked.
+ *
+ * Self-skips green when the driver can't resolve the chat (unwired
+ * host), matching the other opt-in scenarios — uat/** is excluded from
+ * gating CI anyway. Mutates host vault state (mints a short grant on
+ * test-harness); harmless + TTL-expiring.
+ */
+
+import { describe, expect, it } from "vitest";
+import { spinUp } from "../harness.js";
+
+const AGENT = "test-harness";
+const KEY = "uat/resume-probe";
+
+describe("uat: agent auto-resumes after vault grant approval — telegram-id (#2340)", () => {
+  it(
+    "fires card → operator taps Approve → agent emits a NEW turn with no nudge",
+    async () => {
+      const sc = await spinUp({ agent: AGENT });
+      try {
+        // 1. Ask the agent to request access then resume. Steer it to
+        //    end its turn after the tool call so the approval lands at
+        //    a turn boundary — the exact window #2340 fixes.
+        await sc.sendDM(
+          `Call your vault_request_access MCP tool with key="${KEY}", ` +
+          `scope="read", reason="UAT #2340 resume gate". After the tool ` +
+          `returns "waiting for operator", END YOUR TURN. When the ` +
+          `operator approves, you should AUTOMATICALLY resume: confirm ` +
+          `the grant landed and that you saw the approval for ${KEY}.`,
+        );
+
+        // 2. Wait for the approval card.
+        const card = await sc.expectMessage(/wants vault access/i, {
+          from: "bot",
+          timeout: 120_000,
+        });
+
+        // 3. Find + tap the Approve button.
+        const kb = await sc.driver.getKeyboard(sc.botUserId, card.messageId);
+        const approve = kb!
+          .flat()
+          .find((b) => b.callbackData !== undefined && /approve/i.test(b.text));
+        expect(approve, "Approve button present on the card").toBeDefined();
+        const tapAtMsgId = card.messageId;
+        await sc.driver.pressButton(sc.botUserId, card.messageId, approve!.callbackData!);
+
+        // 4. Single-factor: card edits to "Granted" with no passphrase
+        //    prompt. Anchor on the grant confirmation.
+        await sc.expectMessage(/Granted|already has|access to/i, {
+          from: "bot",
+          timeout: 30_000,
+        });
+
+        // 5. THE #2340 ASSERTION: the agent auto-resumes — a NEW bot
+        //    turn referencing the approval/grant/key, WITHOUT the driver
+        //    sending anything else. Pre-fix this stranded mid-turn and
+        //    timed out. The resume reply must be a message newer than
+        //    the card we tapped (not the card edit).
+        const resume = await sc.expectMessage(
+          (m) =>
+            m.messageId > tapAtMsgId &&
+            /(approv|grant|access|resume|landed|✅)/i.test(m.text),
+          { from: "bot", timeout: 150_000 },
+        );
+        expect(resume.text.length).toBeGreaterThan(0);
+      } finally {
+        await sc.tearDown();
+      }
+    },
+    360_000,
+  );
+});

package/telegram-plugin/uat/scenarios/jtbd-model-command-dm.test.ts

@@ -34,10 +34,13 @@ describe("uat: /model command — show, switch, bad-name", () => {
       const sc = await spinUp({ agent: AGENT });
       try {
         await sc.sendDM("/model");
-        // v2 (picker-driven menu): "Now: <model>"; v1 / fallback path:
-        // "Configured: <model>". Either proves the gateway handled the
-        // command rather than forwarding it to claude as plain text.
-        const shape = /Now:|Configured:/i;
+        // v2 (picker-driven menu) renders the live model as
+        // "Default (new sessions): <model>" (shipped wording, verified
+        // live on test-harness v0.15.21); "Now: <model>" was the
+        // pre-ship wording; v1 / fallback path renders "Configured:
+        // <model>". Any of these proves the gateway handled the command
+        // rather than forwarding it to claude as plain text.
+        const shape = /Default \(new sessions\):|Now:|Configured:/i;
         const reply = await sc.expectMessage(shape, {
           from: "bot",
           timeout: REPLY_TIMEOUT_MS,

package/telegram-plugin/uat/scenarios/jtbd-model-tap-dm.test.ts

@@ -0,0 +1,71 @@
+/**
+ * UAT — `/model` v2 dashboard BUTTON TAP (#2263, #2270, #2271). The
+ * existing jtbd-model-command scenario covers the bare dashboard +
+ * typed-arg forms; this one exercises the genuinely new path the
+ * mtcute driver can now drive: tapping a model button to switch the
+ * live session via the picker, and the menu never leaving a dead card
+ * (#2270 — keeps buttons + clears the toast).
+ *
+ * Switches are session-only (revert on restart); the test taps a
+ * different model then restores the original so test-harness isn't
+ * left changed.
+ *
+ * Self-skips green on an unwired host.
+ */
+import { describe, expect, it } from "vitest";
+import { spinUp } from "../harness.js";
+
+const AGENT = "test-harness";
+
+describe("uat: /model dashboard button tap switches the live session", () => {
+  it(
+    "tap a non-current model → switch confirmation; then restore",
+    async () => {
+      const sc = await spinUp({ agent: AGENT });
+      try {
+        await sc.sendDM("/model");
+        const menu = await sc.expectMessage(/Default \(new sessions\):|Now:/i, {
+          from: "bot",
+          timeout: 30_000,
+        });
+        const kb = await sc.driver.getKeyboard(sc.botUserId, menu.messageId);
+        const flat = (kb ?? []).flat().filter((b) => b.callbackData);
+        // Model buttons carry mdl:s:<tag>; the current one is prefixed
+        // ✅. Refresh (mdl:r) is excluded — pick a non-current model.
+        const originalLabel = flat
+          .find((b) => /✅/.test(b.text))
+          ?.text.replace(/^✅\s*/, "");
+        const target = flat.find(
+          (b) => /mdl:s:/.test(b.callbackData!) && !/✅/.test(b.text),
+        );
+        expect(target, "a non-current model button to tap").toBeDefined();
+
+        await sc.driver.pressButton(sc.botUserId, menu.messageId, target!.callbackData!);
+        await new Promise((r) => setTimeout(r, 6000));
+        // #2270: the card never goes dead — it edits in place to a
+        // confirmation and KEEPS a keyboard.
+        const after = await sc.driver.getMessage(sc.botUserId, menu.messageId);
+        expect(after?.text ?? "").toMatch(/Set model to|Switched|model/i);
+        const kbAfter = await sc.driver.getKeyboard(sc.botUserId, menu.messageId);
+        expect(
+          (kbAfter ?? []).flat().length,
+          "menu keeps its buttons after a tap (no dead card, #2270)",
+        ).toBeGreaterThan(0);
+
+        // Restore the original model: tap the button whose label now
+        // matches the original (it's no longer the ✅ row).
+        if (originalLabel) {
+          const restore = (kbAfter ?? [])
+            .flat()
+            .find((b) => b.callbackData?.startsWith("mdl:s:") && b.text.replace(/^✅\s*/, "") === originalLabel);
+          if (restore?.callbackData) {
+            await sc.driver.pressButton(sc.botUserId, menu.messageId, restore.callbackData);
+          }
+        }
+      } finally {
+        await sc.tearDown();
+      }
+    },
+    120_000,
+  );
+});

package/telegram-plugin/uat/scenarios/jtbd-whoami-dm.test.ts

@@ -0,0 +1,40 @@
+/**
+ * UAT — `/whoami` (#2341): the operator's read-only view of THIS
+ * agent's sandbox (same data the agent's `config whoami` MCP tool and
+ * the `switchroom config whoami` host CLI report). Read-only, like
+ * `/version`; mutates nothing.
+ *
+ * Verified live on test-harness v0.15.21. Self-skips green on an
+ * unwired host.
+ */
+import { describe, expect, it } from "vitest";
+import { spinUp } from "../harness.js";
+
+const AGENT = "test-harness";
+
+describe("uat: /whoami shows the agent sandbox card", () => {
+  it(
+    "renders tier, model, tools, MCP, and powers",
+    async () => {
+      const sc = await spinUp({ agent: AGENT });
+      try {
+        await sc.sendDM("/whoami");
+        // Header: "👤 <agent> · <tier>"
+        const reply = await sc.expectMessage(/👤\s*test-harness/i, {
+          from: "bot",
+          timeout: 30_000,
+        });
+        // The card's load-bearing fields — proves whoami resolved the
+        // sandbox (tier/model/tools/mcp/powers), not just echoed a stub.
+        expect(reply.text).toMatch(/Model:/i);
+        expect(reply.text).toMatch(/Tools:/i);
+        expect(reply.text).toMatch(/Powers:/i);
+        // Tier marker present in the header (standard / admin / root).
+        expect(reply.text).toMatch(/·\s*(standard|admin|root)/i);
+      } finally {
+        await sc.tearDown();
+      }
+    },
+    60_000,
+  );
+});