v0.3.0 — Deterministic remote session control
v0.3.0 turns Anthropic's official Telegram Channel into a bounded operator surface without replacing its poller, pairing, attachment flow, or permission relay.
Highlights
- Deterministic pre-LLM
/usage,/sessions,/model,/rename,/reset, and/resume Ncontrols, including a compact model picker with Cancel and action/session-bound one-shot confirmations. - Stop-owned final delivery: Claude returns canonical CommonMark/GFM; the renderer chooses Rich Message, MarkdownV2, or plain fallback, quotes the inbound message, and never retries an unknown outcome.
- Fully visible, mobile-width tool progress with safe/all/verbose disclosure, subagent coverage, sustained typing, credential redaction, filename-only file previews, head/tail Bash previews, and stable Claude-style verb pairs.
- CJK-adjacent Rich emphasis, deterministic mdast canonicalization, and bounded oversized-final recovery.
- Quoted Artifact document delivery from exact transcript provenance with descriptor-anchored path, ownership, link, size, and retry controls.
- Root Broker Protocol v2 / Session Control Protocol v5: peer-UID-checked socket activation, fixed privileged argv, rate/concurrency limits, exact session identity, hardened service isolation, and exact-commit root-asset install/rollback.
- Automatic and user-locked session titles, metadata-only session catalogues, exact-session resume, and truthful runtime authentication-failure UX.
Upgrade notes
- The 0.2.0 direct helper environment (
CLAUDE_SESSION_RESET_HELPERandCLAUDE_SESSION_RESET_CONFIG) is removed from the unprivileged MCP configuration. - Deploy the exact
v0.3.0user release, then runscripts/install_root_assets.pyfrom the same tagged checkout. - Enable
claude-code-control.socket, reload systemd, restart the Claude service, and verify Broker Protocol v2 / Session Control Protocol v5 capabilities,NoNewPrivileges=yes, an empty effective capability set, one official poller, and both sidecars. - When returning to 0.2.0, roll back root assets before the user release.
Known limitation
Only the canonical Stop final is delivered as assistant prose in 0.3.0. Intermediate assistant commentary emitted before later tool calls is not surfaced; the ordered commentary/tool-segment design is tracked in #55 for 0.4.0.
Verification
- 392 Bun tests
- 117 Python tests
- TypeScript checks and Python compilation
- Python 3.11 / 3.12 CI
- Public-tree privacy scan
bun audit: 0 vulnerabilities
Full details: CHANGELOG.md