@alfe.ai/openclaw-identity 0.0.18 → 0.1.0

package/dist/plugin2.cjs

@@ -147,6 +147,75 @@ function setCachedResolve(key, value) {
 		expiresAt: Date.now() + RESOLVE_CACHE_TTL_MS
 	});
 }
+function resolveCachedSession(params) {
+	const conversationId = params.conversationId;
+	const explicitClaimed = params.claimedIdentityId;
+	if (!conversationId) return {
+		hit: false,
+		conversationId: null
+	};
+	const cached = getCachedResolve(conversationId);
+	if (cached?.identityId == null) return {
+		hit: false,
+		conversationId,
+		error: "session_identity_unavailable: inbound identity cache miss for this conversationId. Pass claimedIdentityId explicitly, or wait for the next inbound message."
+	};
+	if (explicitClaimed && explicitClaimed !== cached.identityId) return {
+		hit: false,
+		conversationId,
+		error: "claimedIdentityId conflicts with the inbound session identity. Either omit claimedIdentityId (recommended) or remove conversationId."
+	};
+	return {
+		hit: true,
+		cached: {
+			...cached,
+			identityId: cached.identityId
+		}
+	};
+}
+/**
+* Resolution order for the request flow (needs the full requester tuple):
+*  1. conversationId hits cache → derive all four from cached entry.
+*  2. conversationId set but cache miss → reject session_identity_unavailable.
+*  3. No conversationId AND no claimedIdentityId → reject missing_identity.
+*  4. claimedIdentityId + full requester tuple supplied → legacy explicit
+*     flow. Layer 1's server-side `no_op_already_verified` guard catches
+*     the common misuse case (looking up an existing identity by name).
+*/
+function resolveRequesterContext(params) {
+	const session = resolveCachedSession(params);
+	if (session.hit) return {
+		claimedIdentityId: session.cached.identityId,
+		requestingIdentityId: session.cached.identityId,
+		requestingProvider: session.cached.senderProvider,
+		requestingPlatformId: session.cached.senderPlatformId
+	};
+	if (session.conversationId) return { error: session.error };
+	const claimedIdentityId = params.claimedIdentityId;
+	const requestingIdentityId = params.requestingIdentityId;
+	const requestingProvider = params.requestingProvider;
+	const requestingPlatformId = params.requestingPlatformId;
+	if (!claimedIdentityId) return { error: "missing_identity: pass conversationId (recommended — auto-binds to the inbound sender) or claimedIdentityId + requestingIdentityId + requestingProvider + requestingPlatformId explicitly." };
+	if (!requestingIdentityId || !requestingProvider || !requestingPlatformId) return { error: "missing_identity: when claimedIdentityId is supplied without conversationId, requestingIdentityId / requestingProvider / requestingPlatformId are also required. Prefer passing conversationId so all four are auto-derived." };
+	return {
+		claimedIdentityId,
+		requestingIdentityId,
+		requestingProvider,
+		requestingPlatformId
+	};
+}
+/**
+* Confirm flow only needs `claimedIdentityId` — same conflict / cache-miss
+* branches as the requester resolver, but no requester tuple.
+*/
+function resolveClaimedIdentity(params) {
+	const session = resolveCachedSession(params);
+	if (session.hit) return { claimedIdentityId: session.cached.identityId };
+	if (session.conversationId) return { error: session.error };
+	const claimedIdentityId = params.claimedIdentityId;
+	if (!claimedIdentityId) return { error: "missing_identity: pass conversationId (recommended — auto-binds to the inbound sender) or claimedIdentityId explicitly." };
+	return { claimedIdentityId };
+}
 function ok(data) {
 	return {
 		content: [{
@@ -180,8 +249,16 @@ function defineTool(def) {
 		}
 	};
 }
-const ACTIVATED_KEY = "__alfeIdentityPluginActivated";
-const g = globalThis;
+let cachedClient = null;
+function getClient() {
+	if (cachedClient) return cachedClient;
+	const config = (0, _alfe_ai_config.resolveConfig)();
+	cachedClient = new _alfe_ai_agent_api_client.AgentApiClient({
+		apiKey: config.apiKey,
+		apiUrl: config.apiUrl
+	});
+	return cachedClient;
+}
 const plugin = {
 	id: "@alfe.ai/openclaw-identity",
 	name: "Alfe Identity",
@@ -189,24 +266,11 @@ const plugin = {
 	version: pkg.version,
 	activate(api) {
 		const log = api.logger;
-		if (g[ACTIVATED_KEY] === true) {
-			log.debug("Alfe Identity plugin already activated — skipping duplicate");
-			return;
-		}
-		g[ACTIVATED_KEY] = true;
-		log.info("Alfe Identity plugin activating...");
-		let client;
-		try {
-			const config = (0, _alfe_ai_config.resolveConfig)();
-			client = new _alfe_ai_agent_api_client.AgentApiClient({
-				apiKey: config.apiKey,
-				apiUrl: config.apiUrl
-			});
-		} catch (err) {
-			g[ACTIVATED_KEY] = false;
-			log.error(`Identity plugin: failed to resolve config — ${err instanceof Error ? err.message : String(err)}`);
-			return;
-		}
+		const client = new Proxy({}, { get(_t, prop) {
+			const c = getClient();
+			const v = c[prop];
+			return typeof v === "function" ? v.bind(c) : v;
+		} });
 		const tools = [
 			defineTool({
 				name: "who_is_this",
@@ -335,12 +399,13 @@ const plugin = {
 			}),
 			defineTool({
 				name: "request_identity_verification",
-				description: "Send a verification phrase to verify the user controls an email or mobile endpoint. Use this when the user has just told you their email or mobile number and you want them to confirm it. Pass exactly one of `contactEmail` or `contactMobile`. The person must relay the phrase back via `confirm_identity_verification`.",
+				description: "Send a verification phrase to the inbound user's email or mobile to prove they own that contact endpoint. Use when the user has just told you their email or mobile number and you want them to confirm it. PASS conversationId (from the inbound message metadata) — that auto-binds the verification to the inbound sender's identity (the WhatsApp / SMS / Discord / Google Chat user who just spoke). Any merge into a pre-existing account with the same contact happens automatically. Do NOT pass claimedIdentityId yourself unless you have a specific reason to verify a different identity than the inbound sender; looking up an identity by name and passing it here is a footgun and the server will reject with no_op_already_verified.",
 				parameters: _sinclair_typebox.Type.Object({
-					claimedIdentityId: _sinclair_typebox.Type.String({ description: "Identity being claimed" }),
-					requestingIdentityId: _sinclair_typebox.Type.String({ description: "Identity of the person making the claim" }),
-					requestingProvider: _sinclair_typebox.Type.String({ description: "Provider the requester is on (discord, slack, chat, etc.)" }),
-					requestingPlatformId: _sinclair_typebox.Type.String({ description: "Requester's provider-specific user ID" }),
+					conversationId: _sinclair_typebox.Type.Optional(_sinclair_typebox.Type.String({ description: "Conversation ID from the inbound message — the daemon attaches this to every message. Pass it to auto-bind the verification to the inbound sender's identity. When set you should NOT also pass claimedIdentityId / requestingIdentityId / requestingProvider / requestingPlatformId." })),
+					claimedIdentityId: _sinclair_typebox.Type.Optional(_sinclair_typebox.Type.String({ description: "Override for the inbound sender's identity. NEVER set this from a lookup_identity result — that's a footgun (the verification will no-op). Leave unset and pass conversationId so the inbound identity is used automatically. Only set this for explicit non-inbound verification flows (rare — dashboard / admin only)." })),
+					requestingIdentityId: _sinclair_typebox.Type.Optional(_sinclair_typebox.Type.String({ description: "Identity of the person making the claim. Auto-derived from conversationId; only set explicitly when conversationId is omitted." })),
+					requestingProvider: _sinclair_typebox.Type.Optional(_sinclair_typebox.Type.String({ description: "Provider the requester is on (discord, slack, whatsapp, etc.). Auto-derived from conversationId; only set explicitly when conversationId is omitted." })),
+					requestingPlatformId: _sinclair_typebox.Type.Optional(_sinclair_typebox.Type.String({ description: "Requester's provider-specific user ID. Auto-derived from conversationId; only set explicitly when conversationId is omitted." })),
 					contactEmail: _sinclair_typebox.Type.Optional(_sinclair_typebox.Type.String({ description: "Email to verify (mutually exclusive with contactMobile)" })),
 					contactMobile: _sinclair_typebox.Type.Optional(_sinclair_typebox.Type.String({ description: "E.164 mobile to verify (mutually exclusive with contactEmail)" })),
 					preferredChannel: _sinclair_typebox.Type.Optional(_sinclair_typebox.Type.String({ description: "When neither contactEmail nor contactMobile is provided, pick which existing verified contact to deliver to: 'mobile' or 'email'" }))
@@ -356,11 +421,13 @@ const plugin = {
 						channel: "mobile",
 						value: contactMobile
 					} : void 0;
+					const resolved = resolveRequesterContext(params);
+					if ("error" in resolved) return Promise.resolve({ error: resolved.error });
 					return client.requestIdentityVerification({
-						claimedIdentityId: params.claimedIdentityId,
-						requestingIdentityId: params.requestingIdentityId,
-						requestingProvider: params.requestingProvider,
-						requestingPlatformId: params.requestingPlatformId,
+						claimedIdentityId: resolved.claimedIdentityId,
+						requestingIdentityId: resolved.requestingIdentityId,
+						requestingProvider: resolved.requestingProvider,
+						requestingPlatformId: resolved.requestingPlatformId,
 						preferredChannel: params.preferredChannel,
 						contact
 					});
@@ -368,17 +435,22 @@ const plugin = {
 			}),
 			defineTool({
 				name: "confirm_identity_verification",
-				description: "Confirm a verification by submitting the phrase the user received. Returns `{ verified, identityId, action }` where `action` is 'merged' (the verified contact already lived on another identity, which is now the survivor) or 'contact_verified' (the contact was attached to the claimed identity).",
+				description: "Confirm a verification by submitting the phrase the user received. Returns `{ verified, identityId, action }` where `action` is 'merged' (the verified contact already lived on another identity, which is now the survivor) or 'contact_verified' (the contact was attached to the claimed identity). PASS the same conversationId you used on request_identity_verification — claimedIdentityId is auto-derived from it.",
 				parameters: _sinclair_typebox.Type.Object({
-					claimedIdentityId: _sinclair_typebox.Type.String({ description: "Identity being claimed (matches request)" }),
+					conversationId: _sinclair_typebox.Type.Optional(_sinclair_typebox.Type.String({ description: "Conversation ID from the inbound message — same one passed to request_identity_verification. Auto-binds claimedIdentityId to the inbound sender." })),
+					claimedIdentityId: _sinclair_typebox.Type.Optional(_sinclair_typebox.Type.String({ description: "Override for the inbound sender's identity. Must match the value used on the request. Leave unset and pass conversationId." })),
 					verificationId: _sinclair_typebox.Type.String({ description: "Verification ID returned from request_identity_verification" }),
 					phrase: _sinclair_typebox.Type.String({ description: "Three-word phrase the person received via mobile or email" })
 				}),
-				handler: (params) => client.confirmIdentityVerification({
-					claimedIdentityId: params.claimedIdentityId,
-					verificationId: params.verificationId,
-					phrase: params.phrase
-				})
+				handler: (params) => {
+					const resolved = resolveClaimedIdentity(params);
+					if ("error" in resolved) return Promise.resolve({ error: resolved.error });
+					return client.confirmIdentityVerification({
+						claimedIdentityId: resolved.claimedIdentityId,
+						verificationId: params.verificationId,
+						phrase: params.phrase
+					});
+				}
 			})
 		];
 		for (const tool of tools) api.registerTool(tool);
@@ -419,7 +491,9 @@ const plugin = {
 				setCachedResolve(cacheKey, {
 					identityId: r.identityId,
 					status: r.status,
-					permissions: [...r.permissions, ...forwarded]
+					permissions: [...r.permissions, ...forwarded],
+					senderProvider: provider,
+					senderPlatformId: senderId
 				});
 				if (r.identityId == null) {
 					log.warn(`Identity not provisioned for ${provider}:${senderId} — blocking inbound message`);
@@ -475,7 +549,7 @@ const plugin = {
 		log.info("Alfe Identity plugin activated");
 	},
 	deactivate(api) {
-		g[ACTIVATED_KEY] = false;
+		cachedClient = null;
 		api.logger.info("Alfe Identity plugin deactivated");
 	}
 };

package/dist/plugin2.js

@@ -147,6 +147,75 @@ function setCachedResolve(key, value) {
 		expiresAt: Date.now() + RESOLVE_CACHE_TTL_MS
 	});
 }
+function resolveCachedSession(params) {
+	const conversationId = params.conversationId;
+	const explicitClaimed = params.claimedIdentityId;
+	if (!conversationId) return {
+		hit: false,
+		conversationId: null
+	};
+	const cached = getCachedResolve(conversationId);
+	if (cached?.identityId == null) return {
+		hit: false,
+		conversationId,
+		error: "session_identity_unavailable: inbound identity cache miss for this conversationId. Pass claimedIdentityId explicitly, or wait for the next inbound message."
+	};
+	if (explicitClaimed && explicitClaimed !== cached.identityId) return {
+		hit: false,
+		conversationId,
+		error: "claimedIdentityId conflicts with the inbound session identity. Either omit claimedIdentityId (recommended) or remove conversationId."
+	};
+	return {
+		hit: true,
+		cached: {
+			...cached,
+			identityId: cached.identityId
+		}
+	};
+}
+/**
+* Resolution order for the request flow (needs the full requester tuple):
+*  1. conversationId hits cache → derive all four from cached entry.
+*  2. conversationId set but cache miss → reject session_identity_unavailable.
+*  3. No conversationId AND no claimedIdentityId → reject missing_identity.
+*  4. claimedIdentityId + full requester tuple supplied → legacy explicit
+*     flow. Layer 1's server-side `no_op_already_verified` guard catches
+*     the common misuse case (looking up an existing identity by name).
+*/
+function resolveRequesterContext(params) {
+	const session = resolveCachedSession(params);
+	if (session.hit) return {
+		claimedIdentityId: session.cached.identityId,
+		requestingIdentityId: session.cached.identityId,
+		requestingProvider: session.cached.senderProvider,
+		requestingPlatformId: session.cached.senderPlatformId
+	};
+	if (session.conversationId) return { error: session.error };
+	const claimedIdentityId = params.claimedIdentityId;
+	const requestingIdentityId = params.requestingIdentityId;
+	const requestingProvider = params.requestingProvider;
+	const requestingPlatformId = params.requestingPlatformId;
+	if (!claimedIdentityId) return { error: "missing_identity: pass conversationId (recommended — auto-binds to the inbound sender) or claimedIdentityId + requestingIdentityId + requestingProvider + requestingPlatformId explicitly." };
+	if (!requestingIdentityId || !requestingProvider || !requestingPlatformId) return { error: "missing_identity: when claimedIdentityId is supplied without conversationId, requestingIdentityId / requestingProvider / requestingPlatformId are also required. Prefer passing conversationId so all four are auto-derived." };
+	return {
+		claimedIdentityId,
+		requestingIdentityId,
+		requestingProvider,
+		requestingPlatformId
+	};
+}
+/**
+* Confirm flow only needs `claimedIdentityId` — same conflict / cache-miss
+* branches as the requester resolver, but no requester tuple.
+*/
+function resolveClaimedIdentity(params) {
+	const session = resolveCachedSession(params);
+	if (session.hit) return { claimedIdentityId: session.cached.identityId };
+	if (session.conversationId) return { error: session.error };
+	const claimedIdentityId = params.claimedIdentityId;
+	if (!claimedIdentityId) return { error: "missing_identity: pass conversationId (recommended — auto-binds to the inbound sender) or claimedIdentityId explicitly." };
+	return { claimedIdentityId };
+}
 function ok(data) {
 	return {
 		content: [{
@@ -180,8 +249,16 @@ function defineTool(def) {
 		}
 	};
 }
-const ACTIVATED_KEY = "__alfeIdentityPluginActivated";
-const g = globalThis;
+let cachedClient = null;
+function getClient() {
+	if (cachedClient) return cachedClient;
+	const config = resolveConfig();
+	cachedClient = new AgentApiClient({
+		apiKey: config.apiKey,
+		apiUrl: config.apiUrl
+	});
+	return cachedClient;
+}
 const plugin = {
 	id: "@alfe.ai/openclaw-identity",
 	name: "Alfe Identity",
@@ -189,24 +266,11 @@ const plugin = {
 	version: pkg.version,
 	activate(api) {
 		const log = api.logger;
-		if (g[ACTIVATED_KEY] === true) {
-			log.debug("Alfe Identity plugin already activated — skipping duplicate");
-			return;
-		}
-		g[ACTIVATED_KEY] = true;
-		log.info("Alfe Identity plugin activating...");
-		let client;
-		try {
-			const config = resolveConfig();
-			client = new AgentApiClient({
-				apiKey: config.apiKey,
-				apiUrl: config.apiUrl
-			});
-		} catch (err) {
-			g[ACTIVATED_KEY] = false;
-			log.error(`Identity plugin: failed to resolve config — ${err instanceof Error ? err.message : String(err)}`);
-			return;
-		}
+		const client = new Proxy({}, { get(_t, prop) {
+			const c = getClient();
+			const v = c[prop];
+			return typeof v === "function" ? v.bind(c) : v;
+		} });
 		const tools = [
 			defineTool({
 				name: "who_is_this",
@@ -335,12 +399,13 @@ const plugin = {
 			}),
 			defineTool({
 				name: "request_identity_verification",
-				description: "Send a verification phrase to verify the user controls an email or mobile endpoint. Use this when the user has just told you their email or mobile number and you want them to confirm it. Pass exactly one of `contactEmail` or `contactMobile`. The person must relay the phrase back via `confirm_identity_verification`.",
+				description: "Send a verification phrase to the inbound user's email or mobile to prove they own that contact endpoint. Use when the user has just told you their email or mobile number and you want them to confirm it. PASS conversationId (from the inbound message metadata) — that auto-binds the verification to the inbound sender's identity (the WhatsApp / SMS / Discord / Google Chat user who just spoke). Any merge into a pre-existing account with the same contact happens automatically. Do NOT pass claimedIdentityId yourself unless you have a specific reason to verify a different identity than the inbound sender; looking up an identity by name and passing it here is a footgun and the server will reject with no_op_already_verified.",
 				parameters: Type.Object({
-					claimedIdentityId: Type.String({ description: "Identity being claimed" }),
-					requestingIdentityId: Type.String({ description: "Identity of the person making the claim" }),
-					requestingProvider: Type.String({ description: "Provider the requester is on (discord, slack, chat, etc.)" }),
-					requestingPlatformId: Type.String({ description: "Requester's provider-specific user ID" }),
+					conversationId: Type.Optional(Type.String({ description: "Conversation ID from the inbound message — the daemon attaches this to every message. Pass it to auto-bind the verification to the inbound sender's identity. When set you should NOT also pass claimedIdentityId / requestingIdentityId / requestingProvider / requestingPlatformId." })),
+					claimedIdentityId: Type.Optional(Type.String({ description: "Override for the inbound sender's identity. NEVER set this from a lookup_identity result — that's a footgun (the verification will no-op). Leave unset and pass conversationId so the inbound identity is used automatically. Only set this for explicit non-inbound verification flows (rare — dashboard / admin only)." })),
+					requestingIdentityId: Type.Optional(Type.String({ description: "Identity of the person making the claim. Auto-derived from conversationId; only set explicitly when conversationId is omitted." })),
+					requestingProvider: Type.Optional(Type.String({ description: "Provider the requester is on (discord, slack, whatsapp, etc.). Auto-derived from conversationId; only set explicitly when conversationId is omitted." })),
+					requestingPlatformId: Type.Optional(Type.String({ description: "Requester's provider-specific user ID. Auto-derived from conversationId; only set explicitly when conversationId is omitted." })),
 					contactEmail: Type.Optional(Type.String({ description: "Email to verify (mutually exclusive with contactMobile)" })),
 					contactMobile: Type.Optional(Type.String({ description: "E.164 mobile to verify (mutually exclusive with contactEmail)" })),
 					preferredChannel: Type.Optional(Type.String({ description: "When neither contactEmail nor contactMobile is provided, pick which existing verified contact to deliver to: 'mobile' or 'email'" }))
@@ -356,11 +421,13 @@ const plugin = {
 						channel: "mobile",
 						value: contactMobile
 					} : void 0;
+					const resolved = resolveRequesterContext(params);
+					if ("error" in resolved) return Promise.resolve({ error: resolved.error });
 					return client.requestIdentityVerification({
-						claimedIdentityId: params.claimedIdentityId,
-						requestingIdentityId: params.requestingIdentityId,
-						requestingProvider: params.requestingProvider,
-						requestingPlatformId: params.requestingPlatformId,
+						claimedIdentityId: resolved.claimedIdentityId,
+						requestingIdentityId: resolved.requestingIdentityId,
+						requestingProvider: resolved.requestingProvider,
+						requestingPlatformId: resolved.requestingPlatformId,
 						preferredChannel: params.preferredChannel,
 						contact
 					});
@@ -368,17 +435,22 @@ const plugin = {
 			}),
 			defineTool({
 				name: "confirm_identity_verification",
-				description: "Confirm a verification by submitting the phrase the user received. Returns `{ verified, identityId, action }` where `action` is 'merged' (the verified contact already lived on another identity, which is now the survivor) or 'contact_verified' (the contact was attached to the claimed identity).",
+				description: "Confirm a verification by submitting the phrase the user received. Returns `{ verified, identityId, action }` where `action` is 'merged' (the verified contact already lived on another identity, which is now the survivor) or 'contact_verified' (the contact was attached to the claimed identity). PASS the same conversationId you used on request_identity_verification — claimedIdentityId is auto-derived from it.",
 				parameters: Type.Object({
-					claimedIdentityId: Type.String({ description: "Identity being claimed (matches request)" }),
+					conversationId: Type.Optional(Type.String({ description: "Conversation ID from the inbound message — same one passed to request_identity_verification. Auto-binds claimedIdentityId to the inbound sender." })),
+					claimedIdentityId: Type.Optional(Type.String({ description: "Override for the inbound sender's identity. Must match the value used on the request. Leave unset and pass conversationId." })),
 					verificationId: Type.String({ description: "Verification ID returned from request_identity_verification" }),
 					phrase: Type.String({ description: "Three-word phrase the person received via mobile or email" })
 				}),
-				handler: (params) => client.confirmIdentityVerification({
-					claimedIdentityId: params.claimedIdentityId,
-					verificationId: params.verificationId,
-					phrase: params.phrase
-				})
+				handler: (params) => {
+					const resolved = resolveClaimedIdentity(params);
+					if ("error" in resolved) return Promise.resolve({ error: resolved.error });
+					return client.confirmIdentityVerification({
+						claimedIdentityId: resolved.claimedIdentityId,
+						verificationId: params.verificationId,
+						phrase: params.phrase
+					});
+				}
 			})
 		];
 		for (const tool of tools) api.registerTool(tool);
@@ -419,7 +491,9 @@ const plugin = {
 				setCachedResolve(cacheKey, {
 					identityId: r.identityId,
 					status: r.status,
-					permissions: [...r.permissions, ...forwarded]
+					permissions: [...r.permissions, ...forwarded],
+					senderProvider: provider,
+					senderPlatformId: senderId
 				});
 				if (r.identityId == null) {
 					log.warn(`Identity not provisioned for ${provider}:${senderId} — blocking inbound message`);
@@ -475,7 +549,7 @@ const plugin = {
 		log.info("Alfe Identity plugin activated");
 	},
 	deactivate(api) {
-		g[ACTIVATED_KEY] = false;
+		cachedClient = null;
 		api.logger.info("Alfe Identity plugin deactivated");
 	}
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alfe.ai/openclaw-identity",
-  "version": "0.0.18",
+  "version": "0.1.0",
   "description": "OpenClaw identity plugin — identity resolution, access gating, permission enforcement",
   "type": "module",
   "main": "./dist/plugin.js",
@@ -29,8 +29,8 @@
   "dependencies": {
     "@auriclabs/roles": "0.1.1",
     "@sinclair/typebox": "^0.34.48",
-    "@alfe.ai/agent-api-client": "0.1.2",
-    "@alfe.ai/config": "0.0.8"
+    "@alfe.ai/config": "0.0.8",
+    "@alfe.ai/agent-api-client": "0.1.2"
   },
   "license": "UNLICENSED",
   "scripts": {