switchroom 0.15.45 → 0.16.5

package/examples/minimal.yaml

@@ -12,6 +12,7 @@
 
 switchroom:
   version: 1
+  # timezone: "Region/City"  # agents' local time + cron evaluation; defaults to UTC if unset
 
 telegram:
   bot_token: "vault:telegram-bot-token"

package/examples/switchroom.yaml

@@ -26,6 +26,7 @@ switchroom:
   version: 1
   agents_dir: ~/.switchroom/agents
   skills_dir: ~/.switchroom/skills           # shared skill pool (symlinked per agent)
+  # timezone: "Region/City"  # agents' local time + cron evaluation; defaults to UTC if unset
 
 telegram:
   # Single-agent fallback ONLY. This is the bot the one shipped agent

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switchroom",
-  "version": "0.15.45",
+  "version": "0.16.5",
   "description": "Run Claude Code 24/7 on your Claude Pro/Max subscription over Telegram. Open-source alternative to OpenClaw and NanoClaw — no API keys.",
   "type": "module",
   "bin": {
@@ -23,9 +23,9 @@
     "build": "node scripts/build.mjs",
     "build:cli": "node scripts/build.mjs && bun build --compile --target=bun-linux-x64 --minify bin/switchroom.ts --outfile switchroom-linux-amd64",
     "pretest": "npm run build",
-    "test": "vitest run && bun test telegram-plugin/tests/history.test.ts telegram-plugin/tests/history-reaper.test.ts telegram-plugin/tests/ipc-server-client.test.ts telegram-plugin/tests/ipc-server-race.test.ts telegram-plugin/tests/gateway-bridge.test.ts telegram-plugin/tests/gateway-startup-mutex.test.ts telegram-plugin/tests/gateway-clean-shutdown-marker.test.ts telegram-plugin/tests/boot-card-dedupe.test.ts telegram-plugin/tests/boot-card-reason.test.ts telegram-plugin/tests/progress-update.test.ts telegram-plugin/tests/quota-cache.test.ts telegram-plugin/tests/silent-reply-guard.test.ts telegram-plugin/tests/unhandled-rejection-policy.test.ts telegram-plugin/tests/registry-turns.test.ts telegram-plugin/registry/subagents.test.ts telegram-plugin/registry/subagents-bugs.test.ts telegram-plugin/tests/subagent-watcher-parent-turn-key.test.ts telegram-plugin/tests/turns-writer.test.ts telegram-plugin/tests/resume-inbound-builder.test.ts telegram-plugin/registry/api-registry.test.ts telegram-plugin/registry/turns-schema.test.ts telegram-plugin/tests/idle-footer-wiring.test.ts telegram-plugin/tests/subagent-tracker-hooks.test.ts telegram-plugin/tests/resolve-calling-subagent.test.ts telegram-plugin/tests/gateway-update-placeholder-dispatch.test.ts telegram-plugin/tests/reaction-trigger.test.ts telegram-plugin/tests/reaction-trigger-flow.test.ts telegram-plugin/gateway/webhook-ingest-server.test.ts",
+    "test": "vitest run && bun test telegram-plugin/tests/history.test.ts telegram-plugin/tests/cross-turn-card-gate.test.ts telegram-plugin/tests/emission-authority-open-gate.test.ts telegram-plugin/tests/emission-authority-ping-gate.test.ts telegram-plugin/tests/emission-authority-card-drain-gate.test.ts telegram-plugin/tests/per-topic-current-turn.test.ts telegram-plugin/tests/history-reaper.test.ts telegram-plugin/tests/ipc-server-client.test.ts telegram-plugin/tests/ipc-server-race.test.ts telegram-plugin/tests/gateway-bridge.test.ts telegram-plugin/tests/gateway-startup-mutex.test.ts telegram-plugin/tests/gateway-clean-shutdown-marker.test.ts telegram-plugin/tests/boot-card-dedupe.test.ts telegram-plugin/tests/boot-card-reason.test.ts telegram-plugin/tests/progress-update.test.ts telegram-plugin/tests/quota-cache.test.ts telegram-plugin/tests/silent-reply-guard.test.ts telegram-plugin/tests/unhandled-rejection-policy.test.ts telegram-plugin/tests/registry-turns.test.ts telegram-plugin/registry/subagents.test.ts telegram-plugin/registry/subagents-bugs.test.ts telegram-plugin/tests/subagent-watcher-parent-turn-key.test.ts telegram-plugin/tests/turns-writer.test.ts telegram-plugin/tests/resume-inbound-builder.test.ts telegram-plugin/registry/api-registry.test.ts telegram-plugin/registry/turns-schema.test.ts telegram-plugin/tests/idle-footer-wiring.test.ts telegram-plugin/tests/subagent-tracker-hooks.test.ts telegram-plugin/tests/resolve-calling-subagent.test.ts telegram-plugin/tests/gateway-update-placeholder-dispatch.test.ts telegram-plugin/tests/reaction-trigger.test.ts telegram-plugin/tests/reaction-trigger-flow.test.ts telegram-plugin/gateway/webhook-ingest-server.test.ts",
     "test:vitest": "vitest run",
-    "test:bun": "bun test src/watchdog/state.test.ts src/watchdog/policy.test.ts src/vault/grants.test.ts src/vault/write-grants.test.ts src/vault/broker/server-grants.test.ts src/vault/broker/server-write-grants.test.ts src/vault/broker/server-mint-grant-passphrase-attest.test.ts src/vault/broker/server-passphrase-attest.test.ts src/vault/broker/server-mint-grant-posture-attest.test.ts src/vault/broker/server-admin-only-keys.test.ts src/vault/broker/client-token.test.ts src/vault/broker/server-unlock.test.ts src/vault/broker/auto-unlock.test.ts src/vault/broker/drift-detection.test.ts tests/vault-broker-passphrase.test.ts src/cli/vault-get-broker.test.ts src/vault/resolver-via-broker.test.ts src/vault/broker/scope.test.ts src/vault/broker/server.test.ts src/drive/disconnect.test.ts src/drive/grants.test.ts src/drive/oauth.test.ts src/drive/onboarding.test.ts src/drive/reconciler.test.ts src/drive/vault-slots.test.ts src/drive/wrapper.test.ts src/vault/approvals/kernel.test.ts src/vault/approvals/approval-origin.test.ts src/vault/approvals/schema-idempotent.test.ts src/vault/broker/server-approvals.test.ts telegram-plugin/tests/boot-probes.test.ts telegram-plugin/tests/boot-version-string.test.ts telegram-plugin/tests/history.test.ts telegram-plugin/tests/history-reaper.test.ts telegram-plugin/tests/ipc-server-client.test.ts telegram-plugin/tests/ipc-server-race.test.ts telegram-plugin/tests/gateway-bridge.test.ts telegram-plugin/tests/gateway-startup-mutex.test.ts telegram-plugin/tests/gateway-clean-shutdown-marker.test.ts telegram-plugin/tests/boot-card-dedupe.test.ts telegram-plugin/tests/boot-card-reason.test.ts telegram-plugin/tests/progress-update.test.ts telegram-plugin/tests/quota-cache.test.ts telegram-plugin/tests/silent-reply-guard.test.ts telegram-plugin/tests/unhandled-rejection-policy.test.ts telegram-plugin/tests/registry-turns.test.ts telegram-plugin/registry/subagents.test.ts telegram-plugin/registry/subagents-bugs.test.ts telegram-plugin/tests/subagent-watcher-parent-turn-key.test.ts telegram-plugin/tests/turns-writer.test.ts telegram-plugin/tests/resume-inbound-builder.test.ts telegram-plugin/tests/subagent-tracker-hooks.test.ts telegram-plugin/tests/resolve-calling-subagent.test.ts telegram-plugin/tests/gateway-update-placeholder-dispatch.test.ts telegram-plugin/tests/reaction-trigger.test.ts telegram-plugin/tests/reaction-trigger-flow.test.ts telegram-plugin/uat/load-env.test.ts telegram-plugin/uat/feed-matcher.test.ts telegram-plugin/gateway/webhook-ingest-server.test.ts",
+    "test:bun": "bun test src/watchdog/state.test.ts src/watchdog/policy.test.ts src/vault/grants.test.ts src/vault/write-grants.test.ts src/vault/broker/server-grants.test.ts src/vault/broker/server-write-grants.test.ts src/vault/broker/server-mint-grant-passphrase-attest.test.ts src/vault/broker/server-passphrase-attest.test.ts src/vault/broker/server-mint-grant-posture-attest.test.ts src/vault/broker/server-admin-only-keys.test.ts src/vault/broker/client-token.test.ts src/vault/broker/server-unlock.test.ts src/vault/broker/auto-unlock.test.ts src/vault/broker/drift-detection.test.ts tests/vault-broker-passphrase.test.ts src/cli/vault-get-broker.test.ts src/vault/resolver-via-broker.test.ts src/vault/broker/scope.test.ts src/vault/broker/server.test.ts src/litellm/provision-apply-e2e.test.ts src/drive/disconnect.test.ts src/drive/grants.test.ts src/drive/oauth.test.ts src/drive/onboarding.test.ts src/drive/reconciler.test.ts src/drive/vault-slots.test.ts src/drive/wrapper.test.ts src/vault/approvals/kernel.test.ts src/vault/approvals/approval-origin.test.ts src/vault/approvals/schema-idempotent.test.ts src/vault/broker/server-approvals.test.ts telegram-plugin/tests/boot-probes.test.ts telegram-plugin/tests/boot-version-string.test.ts telegram-plugin/tests/history.test.ts telegram-plugin/tests/cross-turn-card-gate.test.ts telegram-plugin/tests/emission-authority-open-gate.test.ts telegram-plugin/tests/emission-authority-ping-gate.test.ts telegram-plugin/tests/emission-authority-card-drain-gate.test.ts telegram-plugin/tests/per-topic-current-turn.test.ts telegram-plugin/tests/history-reaper.test.ts telegram-plugin/tests/ipc-server-client.test.ts telegram-plugin/tests/ipc-server-race.test.ts telegram-plugin/tests/gateway-bridge.test.ts telegram-plugin/tests/gateway-startup-mutex.test.ts telegram-plugin/tests/gateway-clean-shutdown-marker.test.ts telegram-plugin/tests/boot-card-dedupe.test.ts telegram-plugin/tests/boot-card-reason.test.ts telegram-plugin/tests/progress-update.test.ts telegram-plugin/tests/quota-cache.test.ts telegram-plugin/tests/silent-reply-guard.test.ts telegram-plugin/tests/unhandled-rejection-policy.test.ts telegram-plugin/tests/registry-turns.test.ts telegram-plugin/registry/subagents.test.ts telegram-plugin/registry/subagents-bugs.test.ts telegram-plugin/tests/subagent-watcher-parent-turn-key.test.ts telegram-plugin/tests/turns-writer.test.ts telegram-plugin/tests/resume-inbound-builder.test.ts telegram-plugin/tests/subagent-tracker-hooks.test.ts telegram-plugin/tests/resolve-calling-subagent.test.ts telegram-plugin/tests/gateway-update-placeholder-dispatch.test.ts telegram-plugin/tests/reaction-trigger.test.ts telegram-plugin/tests/reaction-trigger-flow.test.ts telegram-plugin/tests/subagent-watcher-workflow-visibility.test.ts telegram-plugin/uat/load-env.test.ts telegram-plugin/uat/feed-matcher.test.ts telegram-plugin/gateway/webhook-ingest-server.test.ts",
     "test:watch": "vitest",
     "lint": "tsc --noEmit && node scripts/check-plugin-references.mjs && bash scripts/check-bot-api-wrapping.sh && node scripts/check-bun-test-imports.mjs && node scripts/check-no-pii-secrets.mjs && node scripts/check-vault-test-hermeticity.mjs && node scripts/check-no-broadcast-delivery.mjs && node scripts/check-stale-tool-descriptions.mjs && node scripts/check-web-subscription-honest.mjs",
     "lint:tsc": "tsc --noEmit",

package/profiles/_base/start.sh.hbs

@@ -67,6 +67,22 @@ if [ "$SWITCHROOM_RUNTIME" = "docker" ] && [ -z "$SWITCHROOM_DOCKER_TMUX_INNER"
   # lifecycle. Ampersand-backgrounded by callers below.
   _switchroom_supervise() {
     local _name="$1"; local _logfile="$2"; shift 2
+    # Optional `--oneshot-ok` flag (must directly follow the logfile):
+    # marks a sidecar that can LEGITIMATELY complete. For such a sidecar
+    # a clean exit 0 means "job done" → stop supervising, no respawn.
+    # This is the autoaccept sidecar's case: under
+    # SWITCHROOM_WEDGE_WATCHDOG=0 it dispatches the first-run prompts and
+    # exits 0 by design (and if the watch loop ever returns cleanly, that
+    # too is a completed job, not a crash). Without this flag the old
+    # supervisor respawned that clean exit every 60s forever — pure
+    # restart/log churn with zero productive work (klanker, #2471 wedge
+    # diagnosis: 192 status=0 respawns). A must-always-run sidecar (the
+    # gateway, the scheduler) must NOT pass this flag — a clean exit
+    # there IS abnormal and must still restart.
+    local _oneshot_ok=0
+    if [ "${1:-}" = "--oneshot-ok" ]; then
+      _oneshot_ok=1; shift
+    fi
     local _cap=60
     local _delay=1
     local _attempt=0
@@ -88,6 +104,15 @@ if [ "$SWITCHROOM_RUNTIME" = "docker" ] && [ -z "$SWITCHROOM_DOCKER_TMUX_INNER"
         echo "[supervise] $_name exit 78 (EX_CONFIG) — quarantined, not restarting. Operator action required." >> "$_logfile"
         return 0
       fi
+      # Clean completion of an opt-in one-shot-capable sidecar: the job
+      # finished successfully, so do NOT respawn (respawning a
+      # legitimately-completed exit-0 is the churn this guard removes).
+      # A non-zero exit still falls through to the indefinite backoff
+      # below — a crash always self-heals.
+      if [ $_oneshot_ok -eq 1 ] && [ $_exit -eq 0 ]; then
+        echo "[supervise] $_name completed cleanly (exit 0) — one-shot-ok, not respawning." >> "$_logfile"
+        return 0
+      fi
       # A run that stayed up for at least the backoff cap means the
       # dependency was healthy and this exit is a fresh transient
       # blip — reset backoff so recovery latency is minimal. Only
@@ -139,7 +164,13 @@ if [ "$SWITCHROOM_RUNTIME" = "docker" ] && [ -z "$SWITCHROOM_DOCKER_TMUX_INNER"
   #    keeps a flaky run from busy-looping. Set SWITCHROOM_WEDGE_WATCHDOG=0
   #    to restore the legacy boot-only single-shot behaviour.
   if [ -f /opt/switchroom/autoaccept-poll.js ] && command -v bun >/dev/null 2>&1; then
-    _switchroom_supervise autoaccept /var/log/switchroom/autoaccept.log \
+    # --oneshot-ok: this sidecar can legitimately complete (exit 0) — the
+    # boot-only mode (SWITCHROOM_WEDGE_WATCHDOG=0) dispatches the first-run
+    # prompts then exits, and a clean watch-loop return is also a finished
+    # job, not a crash. Marking it one-shot-ok stops the supervisor from
+    # respawning that clean exit every 60s forever (the #2471-diagnosed
+    # churn). A genuine crash (non-zero) still backs off + retries.
+    _switchroom_supervise autoaccept /var/log/switchroom/autoaccept.log --oneshot-ok \
       bun /opt/switchroom/autoaccept-poll.js "{{name}}" &
   fi
 
@@ -287,6 +318,12 @@ export TELEGRAM_STATE_DIR="{{agentDir}}/telegram"
 # basename(process.cwd()) inside the plugin because Claude Code spawns
 # MCP servers with cwd = $HOME regardless of the parent's cwd.
 export SWITCHROOM_AGENT_NAME="{{name}}"
+# SWITCHROOM_AGENT_START_CWD is the agent's real start directory (the dir this
+# script cd's into and where the agent's own CLAUDE.md lives). The
+# repo-context-pretool hook reads it to suppress re-injection of the agent's
+# own CLAUDE.md (already in the system prompt) while still injecting markers
+# for worktree repos the agent navigates into mid-session.
+export SWITCHROOM_AGENT_START_CWD="{{agentDir}}"
 {{#if switchroomConfigPathQ}}
 # SWITCHROOM_CONFIG lets the agent's own shell tool invoke `switchroom`
 # without passing `--config` every time. The telegram-plugin MCP server
@@ -735,6 +772,65 @@ if command -v switchroom >/dev/null 2>&1; then
   unset sr_wk_pair sr_wk_env sr_wk_key sr_wk_val
 fi
 
+# LiteLLM routing (opt-in, #litellm). When SWITCHROOM_LITELLM is set (compose
+# env, gated on litellm.enabled && keyConfirmed), route the unmodified `claude`
+# CLI through the operator's LiteLLM proxy at ANTHROPIC_BASE_URL: fetch the
+# per-agent virtual key from the vault-broker and export it as the
+# x-litellm-api-key Bearer header. The broker enforces the per-key ACL (the
+# agent's standing secrets[] grant added by `switchroom apply`).
+#
+# Subscription-native by construction: claude still sends its Pro/Max OAuth
+# `Authorization: Bearer`, which LiteLLM forwards UNCHANGED to Anthropic
+# (forward_client_headers_to_llm_api). The proxy only meters and applies
+# content-safety guardrails — it never alters the model or Claude's operation.
+# See reference/invariants.md § "Operator-controlled gateway carve-out".
+#
+# FAIL-OPEN (operator decision 2026-06-28): if the key is missing OR the proxy
+# is unreachable at boot, strip the routing env and fall back to the direct
+# broker-OAuth Anthropic path, logging the reason LOUDLY. Availability wins over
+# tracking/guardrails — a proxy outage must never take an agent dark. The
+# tradeoff is an explicit, logged guardrail lapse for that session, not a silent
+# one. Re-probed on every (re)boot, so recovery is automatic.
+#
+# Static tags (x-litellm-customer-id / x-litellm-tags) give per-AGENT
+# attribution in LiteLLM. Per-SESSION is NOT achievable here: claude sends no
+# session id on the wire and ANTHROPIC_CUSTOM_HEADERS is fixed per process — so
+# per-session cost/issue tracking is handled out-of-band by correlating
+# LiteLLM's request log against switchroom's turn ledger, never by mutating the
+# claude protocol.
+if [ -n "$SWITCHROOM_LITELLM" ] && command -v switchroom >/dev/null 2>&1; then
+  sr_ll_key="$(switchroom vault get "litellm/$SWITCHROOM_AGENT_NAME/api-key" 2>/dev/null || true)"
+  sr_ll_ok=""
+  if [ -z "$sr_ll_key" ]; then
+    echo "litellm: no virtual key for agent '$SWITCHROOM_AGENT_NAME' — falling back to direct OAuth (no tracking/guardrail)" >&2
+  elif command -v curl >/dev/null 2>&1 && [ -n "$ANTHROPIC_BASE_URL" ] \
+       && ! curl -fsS -m 5 -o /dev/null "${ANTHROPIC_BASE_URL%/}/health/liveliness" 2>/dev/null; then
+    echo "litellm: proxy unreachable at $ANTHROPIC_BASE_URL — falling back to direct OAuth (no tracking/guardrail this session)" >&2
+  else
+    sr_ll_ok="1"
+  fi
+  if [ -n "$sr_ll_ok" ]; then
+    # Newline-separated Name: Value pairs (claude CLI ANTHROPIC_CUSTOM_HEADERS format).
+    # Tags: agent:<name> for per-agent spend tracking; profile:<profile> for
+    # fleet-level cost breakdown by role. Per-turn tags (cron vs telegram) are
+    # NOT achievable here — ANTHROPIC_CUSTOM_HEADERS is fixed per process and
+    # the claude CLI sends no session id. Use scheduler.jsonl ↔ /spend/logs
+    # time-window correlation for cron attribution instead.
+    export ANTHROPIC_CUSTOM_HEADERS="x-litellm-api-key: Bearer $sr_ll_key
+x-litellm-customer-id: $SWITCHROOM_AGENT_NAME
+x-litellm-tags: agent:$SWITCHROOM_AGENT_NAME,profile:${SWITCHROOM_AGENT_PROFILE:-default}"
+    # Let Claude Code enumerate models from the LiteLLM gateway so non-Claude
+    # models configured in the proxy appear in the /model picker and can be
+    # selected via --model. Without this, the CLI only knows its bundled list.
+    export CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY=1
+  else
+    # Fail-open: drop every routing var so the claude CLI talks to Anthropic
+    # directly on its OAuth credential (subscription path), unproxied.
+    unset ANTHROPIC_BASE_URL ANTHROPIC_SMALL_FAST_MODEL SWITCHROOM_LITELLM
+  fi
+  unset sr_ll_key sr_ll_ok
+fi
+
 {{#if useSwitchroomPlugin}}
 if [ -n "$APPEND_PROMPT" ]; then
   exec claude $CONTINUE_FLAG --dangerously-load-development-channels server:switchroom-telegram --plugin-dir "{{securityPluginDir}}"{{#if hindsightEnabled}} --plugin-dir "{{agentDir}}/.claude/plugins/hindsight-memory"{{/if}} $SR_FLEET_ARG{{#if modelQ}} --model {{{modelQ}}}{{/if}}{{#if thinkingEffort}} --effort {{thinkingEffort}}{{/if}}{{#if permissionMode}} --permission-mode {{permissionMode}}{{/if}}{{#if fallbackModelQ}} --fallback-model {{{fallbackModelQ}}}{{/if}} --append-system-prompt "$APPEND_PROMPT"{{#if dangerousMode}} --dangerously-skip-permissions{{/if}}{{#if extraCliArgs}}{{{extraCliArgs}}}{{/if}}

package/profiles/_shared/execution-discipline.md.hbs

@@ -0,0 +1,18 @@
+## Grounding — check before you assert
+
+Your memory and prior context are leads, not facts. Anything you state as true — about the code, a file, a system's state, a config value, a number, a status, or what you can and can't do — must come from something you actually checked this turn, not from recall, habit, or assumption. When you have a way to look, look.
+
+- **Read the ground truth.** Mutable state — file and code contents, git status, config, versions, running services, processes, schedules, permissions — is read live with the right tool, not remembered. "I think it's X" is a lead to verify, not an answer.
+- **Prefer finding over guessing.** If a fact exists somewhere you can reach — the codebase, a system, a doc, the web, a tool's output — go get it before answering. Favor the source over a plausible-sounding recollection.
+- **Don't assert a limit you haven't tested.** Before saying you can't do something — "no access", "operator-only", "not editable", "no handle" — verify it live. A fabricated boundary is as wrong as a fabricated fact, and it stops work that was actually possible.
+- **A weak or empty result isn't a conclusion.** Vary the query, path, command, or source before deciding something doesn't exist or isn't true.
+- **Final answers carry evidence.** Tool output, a file you read, a check you ran, or a named blocker — not "it should work."
+
+When you genuinely can't verify something this turn, say so plainly ("I haven't checked this —") instead of stating it as fact. A confident wrong answer costs far more than an honest "let me confirm."
+
+## Execution Bias
+
+How you should decide what to do next. These are procedural rules, not vibe.
+
+- **Act in-turn.** If the request is actionable, do it this turn. Don't finish with a plan or promise when tools can move it forward.
+- **Non-final turn:** use tools to advance, or ask the one clarifying question that unblocks safe progress. One question, not five.

package/profiles/default/CLAUDE.md.hbs

@@ -31,25 +31,6 @@ You are operating in the **{{topicName}}** {{#if topicEmoji}}{{topicEmoji}} {{/i
 - **Batch foreseeable approvals; don't drip surprises.** When you can already see that several actions will each need the user's approval, tell them up front which approvals are coming and why. Request independent ones together so they can decide once; for dependent ones (one's input comes from another), say what you're doing first and what approval comes next — a permission card should never arrive out of the blue.
 - **A timed-out approval isn't a denial.** If a request came back denied only because the user was away (a timeout, not an explicit "no"), don't silently abandon it. When they're back, remind them it's still pending and re-offer it if they still want it.
 
-## Execution Bias
-
-How you should decide what to do next. These are procedural rules, not vibe.
-
-- **Act in-turn.** If the request is actionable, do it this turn. Don't finish with a plan or promise when tools can move it forward.
-- **Verify mutable facts before claiming them.** Files, git state, clocks, versions, services, processes, package state, the contents of an `Edit` target: read live. Memory and prior context are not verification sources. "I think the function is at line 200" is not an answer; `Grep`/`Read` is.
-- **Final answer needs evidence.** Test/build/lint output, screenshot, inspection, tool output, or a named blocker. "It should work" is not a finalization.
-- **Weak or empty tool result is not a conclusion.** Vary the query, path, command, or source before deciding the thing isn't there.
-- **Non-final turn:** use tools to advance, or ask the one clarifying question that unblocks safe progress. One question, not five.
-
-{{!--
-  Telegram-style guidance (the 5-beat pacing contract) lives in the
-  fleet invariants file at `~/.switchroom/fleet/switchroom-invariants.md`
-  and reaches the agent via Claude Code native CLAUDE.md discovery
-  (`--add-dir ~/.switchroom/fleet`). Do not re-include the
-  `{{> telegram-style}}` partial here — that would re-introduce the
-  session-level duplication the prompt redesign removed.
---}}
-
 ## Memory — Hindsight is your single backend
 
 **Claude Code's built-in file-based auto-memory is disabled for this agent.** Don't try to write `.md` files under `.claude/projects/.../memory/` or maintain a `MEMORY.md` index — that whole system is off. There's exactly one memory backend: **Hindsight**.

package/telegram-plugin/.claude-plugin/plugin.json

@@ -6,8 +6,8 @@
     "name": "Ken Thompson",
     "email": "me@kenthompson.com.au"
   },
-  "homepage": "https://github.com/mekenthompson/switchroom",
-  "repository": "https://github.com/mekenthompson/switchroom",
+  "homepage": "https://github.com/switchroom/switchroom",
+  "repository": "https://github.com/switchroom/switchroom",
   "license": "MIT",
   "keywords": [
     "telegram",

package/telegram-plugin/answer-stream-flag.ts

@@ -3,7 +3,7 @@
  *
  * Default **OFF** (flipped 2026-06-03, operator request) — see the rationale
  * on the `ANSWER_STREAM_VISIBLE_ENABLED` gate in `gateway/gateway.ts`. When
- * off, the answer lane streams to the invisible compose-box draft and the
+ * off, the answer lane stays dormant (no draft, no visible preview) and the
  * reply tool is the single canonical formatted message — no unformatted
  * preliminary that flashes and gets deleted. Opt back IN per agent with
  * `SWITCHROOM_VISIBLE_ANSWER_STREAM=1` (also accepts true/on/yes).
@@ -17,25 +17,6 @@ export function parseVisibleAnswerStreamEnabled(raw: string | undefined): boolea
   return v === '1' || v === 'true' || v === 'on' || v === 'yes'
 }
 
-/**
- * Draft-answer-lane retirement (2026-06-05). The compose-box draft transport
- * (`sendMessageDraft`) is invisible to the mtcute UAT harness, so the live
- * answer-stream surface couldn't be tested. Retired by DEFAULT: the answer lane
- * now opens a real, observable edit-in-place message instead of the compose-box
- * draft (and the onMetric silence-liveness reset from #2169 now fires on visible
- * sends in BOTH DMs and supergroups, not just DM drafts). Kill switch
- * `SWITCHROOM_DRAFT_ANSWER_LANE=0` (also false/off/no) restores the legacy
- * invisible draft.
- *
- * Returns true when the draft lane is RETIRED (the default — env unset or any
- * truthy value); false only for an explicit disable of the retirement.
- */
-export function parseDraftLaneRetiredEnabled(raw: string | undefined): boolean {
-  if (raw == null) return true
-  const v = raw.trim().toLowerCase()
-  return !(v === '0' || v === 'false' || v === 'off' || v === 'no')
-}
-
 /**
  * `minInitialChars` sentinel meaning "never open a visible chat-timeline
  * preview" — mirrors the `Number.MAX_SAFE_INTEGER` gate the createAnswerStream
@@ -43,63 +24,45 @@ export function parseDraftLaneRetiredEnabled(raw: string | undefined): boolean {
  */
 export const ANSWER_LANE_NEVER_OPENS = Number.MAX_SAFE_INTEGER
 
-export type AnswerLaneState = 'visible' | 'draft' | 'dormant'
+/** The answer-lane rendering state. 'draft' is removed — lane is either
+ *  visible (opt-in) or dormant (the default: reply tool is the only message). */
+export type AnswerLaneState = 'visible' | 'dormant'
 
 export interface AnswerLaneConfig {
   /** `minInitialChars` for createAnswerStream: `1` opens a visible preview on
    *  the first text chunk; `ANSWER_LANE_NEVER_OPENS` suppresses it. */
   minInitialChars: number
-  /** Whether the lane streams to the invisible compose-box draft transport. */
-  usesDraftTransport: boolean
   /** Whether a USER-VISIBLE chat-timeline preview opens — i.e. the surface that
    *  flashed (raw preview → formatted reply → preview deleted). This is THE
-   *  regression invariant: it must equal `visibleEnabled`, never depend on the
-   *  draft flag. */
+   *  regression invariant: it must equal `visibleEnabled`. */
   opensVisiblePreview: boolean
   /** Label for the boot log. */
   state: AnswerLaneState
 }
 
 /**
- * Resolve the answer-lane config from the two INDEPENDENT inputs.
+ * Resolve the answer-lane config from the single input.
  *
- * The visible PREVIEW (the flash surface) is gated on `visibleEnabled` ALONE;
- * draft retirement controls only the TRANSPORT (whether `sendMessageDraft` is
- * available). Conflating them was the v0.14.68 regression: retiring the draft
- * (the default) forced a visible preview that flashed on every streaming turn,
- * re-opening the flash v0.14.52 had removed. The load-bearing invariant —
- * `opensVisiblePreview === visibleEnabled` for EVERY `draftFnAvailable` — is
- * what this function exists to make total-enumerable (the gateway IIFE is not).
+ * The draft transport (`sendMessageDraft`) is permanently retired — the lane
+ * is either VISIBLE (opt-in via SWITCHROOM_VISIBLE_ANSWER_STREAM=1) or
+ * DORMANT (the unconditional default). In dormant mode no preview opens and
+ * the reply tool is the single canonical formatted message.
  *
- *   visibleEnabled                       → 'visible'  (preview opens, minChars 1)
- *   !visible, draft transport available  → 'draft'    (no preview; draft renders)
- *   !visible, no draft transport         → 'dormant'  (no preview, no draft:
- *                                                       the reply tool is the
- *                                                       only message — the default)
+ *   visibleEnabled  → 'visible'  (preview opens on first chunk, minChars 1)
+ *   !visibleEnabled → 'dormant'  (no preview, no draft — reply tool only)
  */
 export function resolveAnswerLaneConfig(input: {
   visibleEnabled: boolean
-  draftFnAvailable: boolean
 }): AnswerLaneConfig {
   if (input.visibleEnabled) {
     return {
       minInitialChars: 1,
-      usesDraftTransport: false,
       opensVisiblePreview: true,
       state: 'visible',
     }
   }
-  if (input.draftFnAvailable) {
-    return {
-      minInitialChars: ANSWER_LANE_NEVER_OPENS,
-      usesDraftTransport: true,
-      opensVisiblePreview: false,
-      state: 'draft',
-    }
-  }
   return {
     minInitialChars: ANSWER_LANE_NEVER_OPENS,
-    usesDraftTransport: false,
     opensVisiblePreview: false,
     state: 'dormant',
   }

package/telegram-plugin/answer-stream.ts

@@ -1,11 +1,4 @@
 import { isSilentFlushMarker } from './turn-flush-safety.js'
-import {
-  DRAFT_METHOD_UNAVAILABLE_RE as _DRAFT_METHOD_UNAVAILABLE_RE,
-  DRAFT_CHAT_UNSUPPORTED_RE as _DRAFT_CHAT_UNSUPPORTED_RE,
-  shouldFallbackFromDraftTransport as _shouldFallbackFromDraftTransport,
-  allocateDraftId as _allocateDraftId,
-  __resetDraftIdForTests as _resetDraftIdForTests,
-} from './draft-transport.js'
 
 /**
  * Answer-lane incremental streaming for long Telegram replies.
@@ -19,9 +12,8 @@ import {
  *
  * Design constraints honored:
  *   1. Separate message ID from the progress card — never overwritten.
- *   2. sendMessageDraft for DMs (detected by chatType='private'); regular
- *      sendMessage+editMessageText for groups/channels. Runtime fallback
- *      when draft API rejects (DRAFT_METHOD_UNAVAILABLE_RE / DRAFT_CHAT_UNSUPPORTED_RE).
+ *   2. sendMessage+editMessageText for all chats (in-place edit-in-place engine).
+ *      The draft transport (sendMessageDraft) has been permanently retired.
  *   3. minInitialChars (~50) — don't open the answer lane until enough text
  *      has arrived. Lowered 400 → 50 in #553 PR 3 so short replies
  *      ("yes", "done", "the answer is 42") become visible on the first
@@ -38,21 +30,12 @@ import {
  *   - No finalizable-draft-lifecycle SDK — we implement the loop directly.
  *   - materialize() always sends a fresh message regardless of transport,
  *     to guarantee a push notification on turn completion.
- *
- * Draft-transport helpers (regex constants, shouldFallbackFromDraftTransport,
- * allocateDraftId) live in draft-transport.ts and are re-exported here so
- * existing callers that import from this module continue to work.
  */
 
 export const MIN_INITIAL_CHARS = 50
 export const DEFAULT_THROTTLE_MS = 1000
 const TELEGRAM_MAX_CHARS = 4096
 
-// Re-export shared constants so existing callers / tests keep working.
-export const DRAFT_METHOD_UNAVAILABLE_RE = _DRAFT_METHOD_UNAVAILABLE_RE
-export const DRAFT_CHAT_UNSUPPORTED_RE = _DRAFT_CHAT_UNSUPPORTED_RE
-export { _shouldFallbackFromDraftTransport as shouldFallbackFromDraftTransport }
-
 /** Called when a late sendMessage/edit resolves after a new turn has started. */
 export type OnSupersededCallback = (params: {
   messageId: number
@@ -62,8 +45,6 @@ export type OnSupersededCallback = (params: {
 export interface AnswerStreamConfig {
   /** chatId for all API calls */
   chatId: string
-  /** True if this is a DM — tries sendMessageDraft first */
-  isPrivateChat: boolean
   /** Optional forum thread */
   threadId?: number
   /** Minimum chars before opening the answer lane. Default: MIN_INITIAL_CHARS */
@@ -74,16 +55,6 @@ export interface AnswerStreamConfig {
   replyToMessageId?: number
 
   // ── Transport callbacks ────────────────────────────────────────────────
-  /**
-   * sendMessageDraft(chatId, draftId, text, params?). Optional — when absent,
-   * the answer stream falls back immediately to sendMessage+editMessageText.
-   */
-  sendMessageDraft?: (
-    chatId: string,
-    draftId: number,
-    text: string,
-    params?: { message_thread_id?: number; parse_mode?: 'HTML' },
-  ) => Promise<unknown>
   sendMessage: (
     chatId: string,
     text: string,
@@ -132,7 +103,7 @@ export interface AnswerStreamConfig {
    * Acceptance #203: answer_lane_update / answer_lane_materialized events.
    */
   onMetric?: (ev:
-    | { kind: 'answer_lane_update'; chatId: string; messageId: number | undefined; charCount: number; transport: 'draft' | 'message' | 'edit' }
+    | { kind: 'answer_lane_update'; chatId: string; messageId: number | undefined; charCount: number; transport: 'message' | 'edit' }
     | { kind: 'answer_lane_materialized'; chatId: string; messageId: number | undefined; suppressed?: boolean }
   ) => void
 
@@ -199,19 +170,13 @@ export interface AnswerStreamHandle {
   retract(): Promise<void>
 }
 
-// Draft-id allocation now lives in draft-transport.ts (shared with
-// draft-stream.ts). Re-alias locally so the rest of this file is unchanged.
-const allocateDraftId = _allocateDraftId
-
 export function createAnswerStream(config: AnswerStreamConfig): AnswerStreamHandle {
   const {
     chatId,
-    isPrivateChat,
     threadId,
     minInitialChars = MIN_INITIAL_CHARS,
     throttleMs = DEFAULT_THROTTLE_MS,
     replyToMessageId,
-    sendMessageDraft: draftApi,
     sendMessage,
     editMessageText,
     onSuperseded,
@@ -225,11 +190,6 @@ export function createAnswerStream(config: AnswerStreamConfig): AnswerStreamHand
 
   const effectiveThrottle = Math.max(250, throttleMs)
 
-  // Draft transport is only used in DMs and only when the API method is available.
-  const preferDraft = isPrivateChat && draftApi != null
-  let usesDraftTransport = preferDraft
-  let draftId = preferDraft ? allocateDraftId() : undefined
-
   // Stream state
   let streamMsgId: number | undefined
   let pendingText: string | null = null
@@ -249,62 +209,6 @@ export function createAnswerStream(config: AnswerStreamConfig): AnswerStreamHand
     }
   }
 
-  /**
-   * Clear the in-progress sendMessageDraft (#1704). When the answer
-   * stream was using draft transport (DMs), Telegram leaves the draft
-   * sitting in the user's compose area until something replaces or
-   * clears it. On Telegram Desktop this blocks the user from typing —
-   * the compose field is occupied by the bot's draft preview.
-   *
-   * Every terminal path on the stream (materialize / stop / retract)
-   * must clear the draft. Best-effort: a failed clear is logged but
-   * not re-thrown — the worst case is a transient stale draft that
-   * Telegram's own 30 s draft expiry eventually mops up.
-   *
-   * #1792 — accepts an explicit `targetDraftId` so `forceNewMessage`
-   * can clear the OLD id before bumping the closure's `draftId`. The
-   * default reads the live closure, which is what stop() / retract()
-   * want — clear whatever's current at the time the call lands.
-   */
-  async function clearDraftBestEffort(
-    targetDraftId: number | undefined = draftId,
-  ): Promise<void> {
-    if (!usesDraftTransport || draftApi == null || targetDraftId == null) return
-    try {
-      const params: { message_thread_id?: number } = {}
-      if (threadId != null) params.message_thread_id = threadId
-      await draftApi(
-        chatId,
-        targetDraftId,
-        '',
-        Object.keys(params).length > 0 ? params : undefined,
-      )
-    } catch {
-      // Best-effort cleanup
-    }
-  }
-
-  async function sendDraft(text: string): Promise<boolean> {
-    if (!draftApi || draftId == null) return false
-    try {
-      const params: { message_thread_id?: number } = {}
-      if (threadId != null) params.message_thread_id = threadId
-      await draftApi(chatId, draftId, text, Object.keys(params).length > 0 ? params : undefined)
-      onMetric?.({ kind: 'answer_lane_update', chatId, messageId: streamMsgId, charCount: text.length, transport: 'draft' })
-      return true
-    } catch (err) {
-      if (_shouldFallbackFromDraftTransport(err)) {
-        warn?.(
-          `answer-stream: sendMessageDraft rejected — falling back to sendMessage/editMessageText (${err instanceof Error ? err.message : String(err)})`,
-        )
-        usesDraftTransport = false
-        draftId = undefined
-        return false
-      }
-      throw err
-    }
-  }
-
   async function sendOrEdit(text: string, gen: number): Promise<void> {
     if (stopped) return
     const trimmed = text.trimEnd()
@@ -315,15 +219,6 @@ export function createAnswerStream(config: AnswerStreamConfig): AnswerStreamHand
     lastSentText = trimmed
 
     try {
-      if (usesDraftTransport) {
-        const ok = await sendDraft(trimmed)
-        if (!ok) {
-          // Draft failed with a permanent error → fell back to message transport
-          // Retry the same text via message transport
-          await sendOrEditViaMessage(trimmed, gen, prevText)
-        }
-        return
-      }
       await sendOrEditViaMessage(trimmed, gen, prevText)
     } catch (err) {
       // Log but don't crash — transient errors are common
@@ -419,7 +314,7 @@ export function createAnswerStream(config: AnswerStreamConfig): AnswerStreamHand
       if (!trimmed) return
 
       // minInitialChars gate: don't open the lane yet
-      if (streamMsgId == null && !usesDraftTransport && trimmed.length < minInitialChars) return
+      if (streamMsgId == null && trimmed.length < minInitialChars) return
 
       pendingText = trimmed
 
@@ -460,9 +355,6 @@ export function createAnswerStream(config: AnswerStreamConfig): AnswerStreamHand
         try { await inFlight } catch { /* ignore */ }
       }
 
-      // Clear draft so Telegram input area doesn't show stale text
-      await clearDraftBestEffort()
-
       // The text we want to materialize. Prefer pendingText (most recent
       // snapshot from the model) over lastSentText (what last reached the
       // wire). They usually match, but if a buffered update was scheduled
@@ -527,7 +419,7 @@ export function createAnswerStream(config: AnswerStreamConfig): AnswerStreamHand
         purpose: 'materialize',
       }
       if (threadId != null) sendParams.message_thread_id = threadId
-      // Don't quote-reply on materialize — the draft stream already established
+      // Don't quote-reply on materialize — the stream already established
       // the reply context visually. A second reply_parameters would create a
       // nested quote that looks wrong.
 
@@ -563,21 +455,6 @@ export function createAnswerStream(config: AnswerStreamConfig): AnswerStreamHand
       pendingText = null
       stopped = false
       materialized = false
-      if (usesDraftTransport) {
-        // #1792: clear the OLD draftId BEFORE rotating. Otherwise the
-        // stale content stays in the user's compose box until the 30 s
-        // Telegram draft expiry — the typical caller (gateway.ts mid-
-        // turn rapid-steer path: `forceNewMessage(); stop();`) cleans
-        // up the prior turn's stream, so the prior draft's content is
-        // semantically retracted. Fire-and-forget — forceNewMessage is
-        // sync; the worst-case failure mode is the same 30 s expiry
-        // we'd have had without the call.
-        const staleDraftId = draftId
-        if (staleDraftId != null) {
-          void clearDraftBestEffort(staleDraftId)
-        }
-        draftId = allocateDraftId()
-      }
       log?.(`answer-stream: forceNewMessage (gen=${generation})`)
     },
 
@@ -588,14 +465,6 @@ export function createAnswerStream(config: AnswerStreamConfig): AnswerStreamHand
     stop(): void {
       stopped = true
       cancelScheduled()
-      // #1704: clear the compose-box draft. stop() is sync — fire and
-      // forget. A dropped clear falls back on Telegram's own 30 s
-      // draft expiry; the worst case is a transient stale preview.
-      // (#1792: the stale-id-after-rotation hazard is owned by
-      // forceNewMessage itself now — it clears its own draftId before
-      // rotating. stop() just clears whatever's current; clearing an
-      // already-cleared or never-used id is a harmless no-op.)
-      void clearDraftBestEffort()
     },
 
     async retract(): Promise<void> {
@@ -607,14 +476,6 @@ export function createAnswerStream(config: AnswerStreamConfig): AnswerStreamHand
       if (inFlight) {
         try { await inFlight } catch { /* ignore */ }
       }
-      // #1704: clear the compose-box draft when this stream was using
-      // draft transport. Without this, Telegram Desktop leaves the
-      // draft sitting in the user's input area and blocks them from
-      // typing until the 30 s draft expiry. Awaited so a follow-up
-      // sendMessage on the same chat doesn't race a stale draft edit.
-      // (See #1792 note in stop() — forceNewMessage owns its own stale
-      // id cleanup; retract just clears whatever's current.)
-      await clearDraftBestEffort()
       // Delete the preliminary message if one was sent and deleteMessage
       // is wired. Best-effort: failures are logged but not re-thrown.
       const msgId = streamMsgId
@@ -633,9 +494,3 @@ export function createAnswerStream(config: AnswerStreamConfig): AnswerStreamHand
     },
   }
 }
-
-/** Reset the draft-id counter for tests. */
-/** Reset the shared draft-id counter for tests. Delegates to draft-transport.ts. */
-export function __resetDraftIdForTests(): void {
-  _resetDraftIdForTests()
-}