v0.3.0 — Deterministic remote session control

v0.3.0 — Deterministic remote session control

v0.3.0 turns Anthropic's official Telegram Channel into a bounded operator surface without replacing its poller, pairing, attachment flow, or permission relay.

Highlights

• Deterministic pre-LLM /usage, /sessions, /model, /rename, /reset, and /resume N controls, including a compact model picker with Cancel and action/session-bound one-shot confirmations.
• Stop-owned final delivery: Claude returns canonical CommonMark/GFM; the renderer chooses Rich Message, MarkdownV2, or plain fallback, quotes the inbound message, and never retries an unknown outcome.
• Fully visible, mobile-width tool progress with safe/all/verbose disclosure, subagent coverage, sustained typing, credential redaction, filename-only file previews, head/tail Bash previews, and stable Claude-style verb pairs.
• CJK-adjacent Rich emphasis, deterministic mdast canonicalization, and bounded oversized-final recovery.
• Quoted Artifact document delivery from exact transcript provenance with descriptor-anchored path, ownership, link, size, and retry controls.
• Root Broker Protocol v2 / Session Control Protocol v5: peer-UID-checked socket activation, fixed privileged argv, rate/concurrency limits, exact session identity, hardened service isolation, and exact-commit root-asset install/rollback.
• Automatic and user-locked session titles, metadata-only session catalogues, exact-session resume, and truthful runtime authentication-failure UX.

Upgrade notes

• The 0.2.0 direct helper environment (CLAUDE_SESSION_RESET_HELPER and CLAUDE_SESSION_RESET_CONFIG) is removed from the unprivileged MCP configuration.
• Deploy the exact v0.3.0 user release, then run scripts/install_root_assets.py from the same tagged checkout.
• Enable claude-code-control.socket, reload systemd, restart the Claude service, and verify Broker Protocol v2 / Session Control Protocol v5 capabilities, NoNewPrivileges=yes, an empty effective capability set, one official poller, and both sidecars.
• When returning to 0.2.0, roll back root assets before the user release.

Known limitation

Only the canonical Stop final is delivered as assistant prose in 0.3.0. Intermediate assistant commentary emitted before later tool calls is not surfaced; the ordered commentary/tool-segment design is tracked in #55 for 0.4.0.

Verification

• 392 Bun tests
• 117 Python tests
• TypeScript checks and Python compilation
• Python 3.11 / 3.12 CI
• Public-tree privacy scan
• bun audit: 0 vulnerabilities

Full details: CHANGELOG.md

v0.2.0 — Processing reactions

Processing reactions

• Official Telegram Channel acknowledges accepted messages with 👀.
• Confirmed renderer replies replace it with 👍.
• Definitive local/permanent failures replace it with 👎.
• Timeout, rate-limit, server, transport, and unknown outcomes remain 👀.
• Confirmed /reset acceptance finalizes 👍 before reset scheduling.
• Reaction failure never alters a confirmed reply or reset outcome.

Security hardening

• Token-bearing Bot API clients reject redirects.
• Telegram JSON response bodies are capped at 64 KiB before parsing.
• Numeric message IDs, including reply_to, must be positive safe integers.
• Exported token-bearing primitives enforce the configured allowlist.

Deliberate limits

v0.2.0 does not add Claude hooks, durable reaction status, tool-by-tool live status, session pickers, or cross-project resume. Cancellation and StopFailure leave 👀 unchanged because the official Channel currently exposes no trusted per-turn lifecycle correlation to sidecars.

v0.1.0

Initial source-only release.

• Deterministic Telegram Rich Message / MarkdownV2 renderer MCP
• Approval-gated session-control MCP with durable request idempotency
• Root-owned fail-closed Claude Code session reset helper
• Exact-SHA local installation and atomic rollback
• Python 3.11/3.12 CI, privacy scan, strict typecheck, dependency audit

See CHANGELOG.md and SECURITY.md before deployment.