@inetafrica/open-claudia 1.20.0 → 1.20.1

package/bot.js

@@ -651,6 +651,20 @@ function getLastProjectSession(userId, projectName) {
   return sessions.length > 0 ? sessions[0] : null;
 }
 
+// Guard against cross-user session-id leakage from migration glitches:
+// confirm sessionId is recorded under this userId in sessions.json
+// before we hand it to `claude --resume`.
+function userOwnsClaudeSession(userId, sessionId) {
+  if (!sessionId) return false;
+  const all = loadSessions();
+  const bucket = all[normalizeCanonicalUserId(userId)];
+  if (!bucket) return false;
+  for (const list of Object.values(bucket)) {
+    if (Array.isArray(list) && list.some((s) => s && s.id === sessionId)) return true;
+  }
+  return false;
+}
+
 function isAuthorized(msg) {
   const chatId = String(msg.chat.id);
   if (CHAT_IDS.includes(chatId)) return true;
@@ -1348,12 +1362,12 @@ if (PROJECT_TRANSCRIPTS) {
 
 function transcriptProjectInfo(state = currentState()) {
   if (!state.currentSession) return null;
-  return projectTranscripts.pointer(state.currentSession.dir, state.currentSession.name);
+  return projectTranscripts.pointer(state.currentSession.dir, state.currentSession.name, state.userId);
 }
 
 function transcriptPointerNote(state = currentState()) {
   if (!state.currentSession) return "";
-  return projectTranscripts.buildPointerNote(state.currentSession.dir, state.currentSession.name);
+  return projectTranscripts.buildPointerNote(state.currentSession.dir, state.currentSession.name, state.userId);
 }
 
 function appendProjectTranscript(role, text, metadata = {}, state = currentState()) {
@@ -1378,7 +1392,7 @@ function appendProjectTranscript(role, text, metadata = {}, state = currentState
 
 function promptWithTranscriptPointer(prompt, state = currentState()) {
   if (!state.currentSession) return prompt;
-  return projectTranscripts.withPointer(prompt, state.currentSession.dir, state.currentSession.name);
+  return projectTranscripts.withPointer(prompt, state.currentSession.dir, state.currentSession.name, state.userId);
 }
 
 function stripTranscriptPointerForStorage(prompt) {
@@ -1728,7 +1742,14 @@ function buildClaudeArgs(prompt, opts = {}) {
   if (transcriptInfo) args.push("--add-dir", transcriptInfo.transcriptsDir);
   if (opts.resumeSessionId) args.push("--resume", opts.resumeSessionId);
   else if (opts.continueSession) args.push("--continue");
-  else if (state.lastSessionId && !opts.fresh) args.push("--resume", state.lastSessionId);
+  else if (state.lastSessionId && !opts.fresh) {
+    if (userOwnsClaudeSession(state.userId, state.lastSessionId)) {
+      args.push("--resume", state.lastSessionId);
+    } else {
+      console.warn(`[session-guard] dropping stale lastSessionId=${state.lastSessionId.slice(0, 8)} for ${state.userId}; not present in sessions.json — starting fresh`);
+      state.lastSessionId = null;
+    }
+  }
   if (settings.model) args.push("--model", settings.model);
   if (settings.effort) args.push("--effort", settings.effort);
   if (settings.budget) args.push("--max-budget-usd", String(settings.budget));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inetafrica/open-claudia",
-  "version": "1.20.0",
+  "version": "1.20.1",
   "description": "Your always-on AI coding assistant — Claude Code, Cursor Agent, and OpenAI Codex via Telegram",
   "main": "bot.js",
   "bin": {

package/project-transcripts.js

@@ -21,8 +21,10 @@ function safeName(value) {
   return String(value || "project").replace(/[^A-Za-z0-9._-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 80) || "project";
 }
 
-function projectHash(projectPath) {
-  return crypto.createHash("sha256").update(normalizeProjectPath(projectPath)).digest("hex").slice(0, 24);
+function projectHash(projectPath, userId) {
+  const normalized = normalizeProjectPath(projectPath);
+  const seed = userId ? `${String(userId)} ${normalized}` : normalized;
+  return crypto.createHash("sha256").update(seed).digest("hex").slice(0, 24);
 }
 
 function mkdirp(dir) {
@@ -39,13 +41,14 @@ class ProjectTranscripts {
     this.redact = redact;
   }
 
-  projectInfo(projectPath, projectName) {
+  projectInfo(projectPath, projectName, userId) {
     const normalizedPath = normalizeProjectPath(projectPath);
-    const hash = projectHash(normalizedPath);
+    const hash = projectHash(normalizedPath, userId);
     const name = projectName || path.basename(normalizedPath) || "project";
     const baseName = `${hash}-${safeName(name)}`;
     return {
       hash,
+      userId: userId || null,
       projectName: name,
       projectPath: normalizedPath,
       transcriptPath: path.join(this.transcriptsDir, `${baseName}.jsonl`),
@@ -54,13 +57,13 @@ class ProjectTranscripts {
     };
   }
 
-  pointer(projectPath, projectName) {
+  pointer(projectPath, projectName, userId) {
     if (!this.enabled || !projectPath) return null;
-    return this.projectInfo(projectPath, projectName);
+    return this.projectInfo(projectPath, projectName, userId);
   }
 
-  buildPointerNote(projectPath, projectName) {
-    const info = this.pointer(projectPath, projectName);
+  buildPointerNote(projectPath, projectName, userId) {
+    const info = this.pointer(projectPath, projectName, userId);
     if (!info) return "";
     return [
       "## Project Transcript Memory",
@@ -71,8 +74,8 @@ class ProjectTranscripts {
     ].join("\n");
   }
 
-  withPointer(prompt, projectPath, projectName) {
-    const note = this.buildPointerNote(projectPath, projectName);
+  withPointer(prompt, projectPath, projectName, userId) {
+    const note = this.buildPointerNote(projectPath, projectName, userId);
     if (!note) return prompt;
     return `${note}\n\nCurrent user request:\n${prompt}`;
   }
@@ -96,13 +99,14 @@ class ProjectTranscripts {
 
   append(entry) {
     if (!this.enabled || !entry || !entry.projectPath) return null;
-    const info = this.projectInfo(entry.projectPath, entry.projectName);
+    const canonicalUserId = entry.userId || entry.canonicalUserId || null;
+    const info = this.projectInfo(entry.projectPath, entry.projectName, canonicalUserId);
     mkdirp(this.transcriptsDir);
     const textData = this.truncateText(entry.text);
     const now = new Date().toISOString();
     const record = {
       timestamp: entry.timestamp || now,
-      canonicalUserId: entry.userId || entry.canonicalUserId || null,
+      canonicalUserId,
       chat: entry.chat || null,
       project: { name: info.projectName, path: info.projectPath, hash: info.hash },
       backend: entry.backend || null,
@@ -118,6 +122,7 @@ class ProjectTranscripts {
     fs.appendFileSync(info.transcriptPath, JSON.stringify(record) + "\n", { mode: 0o600 });
     const metadata = {
       projectHash: info.hash,
+      canonicalUserId,
       projectName: info.projectName,
       projectPath: info.projectPath,
       transcriptPath: info.transcriptPath,