@inetafrica/open-claudia 2.0.0 → 2.0.2

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## v2.0.1
+- Kazee owner detection: `envelope.channelId` is the chat-document id, but `KAZEE_OWNER_USER_ID` is the Kazee user id. `isChatOwner`/`isChatAuthorized` now also short-circuit when the inbound user id matches the configured transport owner, so the owner running `/auth` (or anything else) on a fresh Kazee install is recognized immediately instead of being queued as a non-owner request.
+- `chatContext` now carries `userId` and `transport` in addition to `chatId`; new `currentUserId()` / `currentTransport()` exports.
+
 ## v2.0.0
 - **Multi-channel**: the bot can now run on Telegram and Kazee Chat in the same process. `CHANNELS=telegram,kazee` selects which channels start up; each channel implements the new `ChannelAdapter` contract (send/edit/delete/upload/keyboard/typing/voice-fetch) and a `chatContext` AsyncLocalStorage routes replies, edits, and notifications back to the originating channel.
 - Kazee adapter speaks V2 socket (inbound messages, edits, deletes, reactions, typing, presence) and uses REST for sending, editing, deleting, and uploads. Interactive button keyboards are sent as `type:"interactive"` with portable `interactive.buttons` so web and mobile clients render them natively.

package/bin/cli.js

@@ -29,6 +29,82 @@ function startBot(botFile, args) {
   require(path.join(botDir, botFile));
 }
 
+function sendViaLoopback(kind, restArgs) {
+  const http = require("http");
+  const filePath = restArgs[0];
+  if (!filePath) {
+    console.error(`Usage: open-claudia ${kind} <path>${kind === "send-voice" ? "" : " [caption]"}`);
+    process.exit(2);
+  }
+  const caption = restArgs.slice(1).join(" ");
+  if (!fs.existsSync(filePath)) {
+    console.error(`File not found: ${filePath}`);
+    process.exit(2);
+  }
+
+  const channelId = process.env.OC_CHANNEL_ID;
+  const adapterId = process.env.OC_CHANNEL_ADAPTER;
+  let sendUrl = process.env.OC_SEND_URL;
+  let sendToken = process.env.OC_SEND_TOKEN;
+
+  if (!sendUrl || !sendToken) {
+    const info = readLoopbackInfo();
+    if (info) { sendUrl = info.url; sendToken = info.token; }
+  }
+  if (!sendUrl || !sendToken || !channelId || !adapterId) {
+    console.error("No active chat context. This command only works from inside a running Claude task spawned by the bot.");
+    process.exit(2);
+  }
+
+  const u = new URL(sendUrl);
+  const fileName = path.basename(filePath);
+  const stat = fs.statSync(filePath);
+  const params = new URLSearchParams({ channelId, adapter: adapterId, fileName });
+  if (caption) params.set("caption", caption);
+
+  const req = http.request({
+    method: "POST",
+    hostname: u.hostname,
+    port: u.port,
+    path: `/${kind}?${params.toString()}`,
+    headers: {
+      Authorization: `Bearer ${sendToken}`,
+      "Content-Type": "application/octet-stream",
+      "Content-Length": stat.size,
+    },
+  }, (res) => {
+    let body = "";
+    res.on("data", (c) => { body += c; });
+    res.on("end", () => {
+      if (res.statusCode >= 200 && res.statusCode < 300) {
+        console.log(`Sent ${fileName} (${stat.size} bytes).`);
+        process.exit(0);
+      } else {
+        console.error(`Loopback ${res.statusCode}: ${body}`);
+        process.exit(1);
+      }
+    });
+  });
+  req.on("error", (e) => { console.error("Loopback request failed:", e.message); process.exit(1); });
+  fs.createReadStream(filePath).pipe(req);
+}
+
+function readLoopbackInfo() {
+  try {
+    const dir = path.join(configDir, "loopback");
+    if (!fs.existsSync(dir)) return null;
+    const entries = fs.readdirSync(dir).filter((f) => f.endsWith(".json"));
+    let newest = null;
+    for (const f of entries) {
+      const full = path.join(dir, f);
+      const stat = fs.statSync(full);
+      if (!newest || stat.mtimeMs > newest.mtimeMs) newest = { full, mtimeMs: stat.mtimeMs };
+    }
+    if (!newest) return null;
+    return JSON.parse(fs.readFileSync(newest.full, "utf-8"));
+  } catch (e) { return null; }
+}
+
 function findBotProcesses() {
   try {
     if (process.platform === "win32") {
@@ -150,6 +226,13 @@ switch (command) {
     break;
   }
 
+  case "send-file":
+  case "send-photo":
+  case "send-voice": {
+    sendViaLoopback(command, args.slice(1));
+    break;
+  }
+
   default:
     console.log(`
 Open Claudia — AI Coding Assistant via Telegram
@@ -164,6 +247,11 @@ Commands:
   open-claudia health   Run environment health checks
   open-claudia logs     View recent logs
 
+Send tools (only work inside an active bot-spawned task):
+  open-claudia send-file <path> [caption]
+  open-claudia send-photo <path> [caption]
+  open-claudia send-voice <path>
+
 Start options:
   --web           Also start the web UI
   --quick         Skip slow health checks (Claude auth, Telegram API)

package/bot.js

@@ -17,6 +17,7 @@ const { initCrons } = require("./core/cron");
 const { onMessage, onAction } = require("./core/router");
 const { publicCommands } = require("./core/commands");
 const registry = require("./core/adapter-registry");
+const loopback = require("./core/loopback");
 require("./core/handlers"); // side-effect: register slash commands
 
 const CURRENT_VERSION = require(path.join(__dirname, "package.json")).version;
@@ -42,6 +43,7 @@ async function gracefulShutdown(signal) {
     }
   }
   for (const a of adapters) { try { await a.stop(); } catch (e) {} }
+  try { loopback.stop(); } catch (e) {}
   try {
     const mediaDir = path.join(CONFIG_DIR, "media");
     if (fs.existsSync(mediaDir)) {
@@ -159,6 +161,13 @@ setInterval(checkForUpdates, 5 * 60 * 1000);
 
   initCrons();
 
+  try {
+    const lb = await loopback.start(registry);
+    console.log(`Loopback send endpoint: ${lb.url}`);
+  } catch (e) {
+    console.error("Loopback start failed:", e.message);
+  }
+
   for (const adapter of adapters) {
     try {
       await adapter.start();

package/channels/kazee/adapter.js

@@ -121,13 +121,16 @@ class KazeeAdapter {
 
     const text = (msg.content || "").toString();
     const isCommand = text.trim().startsWith("/");
-    const type = isCommand ? "command" : (msg.type === "voice" || msg.type === "audio" || msg.type === "image" || msg.type === "file" ? msg.type : "text");
+    // chat-central's message.type enum has no "voice" — voice notes arrive
+    // as type "audio". Map the channel types we accept onto router types.
+    const KNOWN_TYPES = { voice: "voice", audio: "audio", image: "photo", video: "document", file: "document" };
+    const routerType = isCommand ? "command" : (KNOWN_TYPES[msg.type] || "text");
     const envelope = {
       adapter: this,
       channelId,
       canonicalUserId: canonicalForChannel("kazee", userId),
       userId,
-      type: type === "image" ? "photo" : type === "file" ? "document" : type,
+      type: routerType,
       text,
       messageId: msg._id || msg.id,
       replyToId: msg.replyTo,
@@ -136,14 +139,28 @@ class KazeeAdapter {
     };
 
     if (msg.attachments && msg.attachments.length) {
-      envelope.media = msg.attachments.map((a) => ({
-        type: a.type || (a.mimeType?.startsWith("image/") ? "photo" : "document"),
-        fileId: a.url || a._id,
-        fileName: a.name || a.filename,
-        mimeType: a.mimeType,
-        size: a.size,
-      }));
-      if (envelope.type === "text") envelope.type = envelope.media[0].type === "image" ? "photo" : envelope.media[0].type;
+      envelope.media = msg.attachments.map((a) => {
+        let kind = a.type;
+        if (!kind) {
+          const mime = (a.mimeType || "").toLowerCase();
+          if (mime.startsWith("image/")) kind = "photo";
+          else if (mime.startsWith("audio/")) kind = "audio";
+          else if (mime.startsWith("video/")) kind = "video";
+          else kind = "document";
+        } else if (kind === "image") kind = "photo";
+        else if (kind === "file") kind = "document";
+        return {
+          type: kind,
+          fileId: a.url || a._id,
+          fileName: a.name || a.filename,
+          mimeType: a.mimeType,
+          size: a.size,
+        };
+      });
+      if (envelope.type === "text") {
+        const k = envelope.media[0].type;
+        envelope.type = k === "video" ? "document" : k;
+      }
     }
 
     this._emit("message", envelope);
@@ -203,6 +220,11 @@ class KazeeAdapter {
     return ok;
   }
 
+  async sendPhoto(channelId, filePath, caption) {
+    // Kazee's sendFile picks the right message type by extension already.
+    return this.sendFile(channelId, filePath, caption);
+  }
+
   async sendFile(channelId, filePath, caption) {
     try {
       const buffer = fs.readFileSync(filePath);

package/channels/telegram/adapter.js

@@ -92,7 +92,34 @@ class TelegramAdapter {
     this.bot.on("audio", (msg) => this._emit("message", this._envelopeMedia(msg, "audio", msg.audio)));
     this.bot.on("photo", (msg) => {
       const photo = msg.photo[msg.photo.length - 1];
-      this._emit("message", this._envelopeMedia(msg, "photo", photo));
+      if (!msg.media_group_id) {
+        this._emit("message", this._envelopeMedia(msg, "photo", photo));
+        return;
+      }
+      // Telegram delivers an album as N separate `photo` updates sharing
+      // the same media_group_id. Buffer briefly so the handler gets one
+      // envelope with media[] of all photos instead of N separate turns.
+      if (!this._photoGroups) this._photoGroups = new Map();
+      let batch = this._photoGroups.get(msg.media_group_id);
+      if (!batch) {
+        batch = { firstMsg: msg, items: [], timer: null };
+        this._photoGroups.set(msg.media_group_id, batch);
+      }
+      if (msg.caption && !batch.firstMsg.caption) batch.firstMsg.caption = msg.caption;
+      batch.items.push({
+        type: "photo",
+        fileId: photo.file_id,
+        fileName: photo.file_name,
+        mimeType: photo.mime_type,
+        size: photo.file_size,
+      });
+      if (batch.timer) clearTimeout(batch.timer);
+      batch.timer = setTimeout(() => {
+        this._photoGroups.delete(msg.media_group_id);
+        const env = this._envelopeMedia(batch.firstMsg, "photo", photo);
+        env.media = batch.items;
+        this._emit("message", env);
+      }, 600);
     });
     this.bot.on("document", (msg) => this._emit("message", this._envelopeMedia(msg, "document", msg.document)));
 
@@ -251,6 +278,16 @@ class TelegramAdapter {
     }
   }
 
+  async sendPhoto(channelId, filePath, caption) {
+    try {
+      await this.bot.sendPhoto(channelId, filePath, caption ? { caption } : {});
+      return true;
+    } catch (e) {
+      console.error("Send photo error:", e.message);
+      return false;
+    }
+  }
+
   async typing(channelId) {
     try { await this.bot.sendChatAction(channelId, "typing"); } catch (e) {}
   }

package/core/access.js

@@ -5,7 +5,25 @@
 // in the inbound envelope's canonicalUserId, not here.
 
 const fs = require("fs");
-const { AUTH_FILE, CHAT_ID, CHAT_IDS, saveEnvKey } = require("./config");
+const { AUTH_FILE, CHAT_ID, CHAT_IDS, config, saveEnvKey } = require("./config");
+const { currentTransport, currentUserId } = require("./context");
+
+// Per-transport owner identifiers that don't live in CHAT_IDS or auth.json.
+// Kazee envelopes carry the chat-document id as channelId, while the bot
+// owner is identified by the Kazee user id. Resolve via env at call time so
+// /channel add can update the value without a process restart.
+function transportOwnerUserId(transport) {
+  if (transport === "kazee") return config.KAZEE_OWNER_USER_ID || "";
+  return "";
+}
+
+function matchesTransportOwner() {
+  const transport = currentTransport();
+  const userId = currentUserId();
+  if (!transport || !userId) return false;
+  const ownerUserId = transportOwnerUserId(transport);
+  return ownerUserId && String(userId) === String(ownerUserId);
+}
 
 function loadAuth() {
   try {
@@ -24,6 +42,7 @@ function saveAuth(auth) {
 }
 
 function isChatAuthorized(chatId) {
+  if (matchesTransportOwner()) return true;
   const id = String(chatId || "");
   if (!id) return false;
   if (CHAT_IDS.includes(id)) return true;
@@ -35,6 +54,7 @@ function isChatAuthorized(chatId) {
 }
 
 function isChatOwner(chatId) {
+  if (matchesTransportOwner()) return true;
   const id = String(chatId || "");
   if (!id) return false;
   if (id === String(CHAT_ID || "")) return true;

package/core/context.js

@@ -6,8 +6,8 @@ const { AsyncLocalStorage } = require("node:async_hooks");
 
 const chatContext = new AsyncLocalStorage();
 
-function runInChat({ adapter, channelId, canonicalUserId, raw }, fn) {
-  return chatContext.run({ adapter, channelId, canonicalUserId, raw }, fn);
+function runInChat({ adapter, channelId, canonicalUserId, userId, transport, raw }, fn) {
+  return chatContext.run({ adapter, channelId, canonicalUserId, userId, transport, raw }, fn);
 }
 
 function currentStore() {
@@ -34,11 +34,23 @@ function currentRaw() {
   return s ? s.raw : null;
 }
 
+function currentUserId() {
+  const s = currentStore();
+  return s ? s.userId : null;
+}
+
+function currentTransport() {
+  const s = currentStore();
+  return s ? s.transport : null;
+}
+
 module.exports = {
   chatContext,
   runInChat,
   currentAdapter,
   currentChannelId,
   currentCanonicalUserId,
+  currentUserId,
+  currentTransport,
   currentRaw,
 };

package/core/loopback.js

@@ -0,0 +1,123 @@
+// Bot ↔ subprocess send channel. Each running bot publishes a tiny HTTP
+// server on 127.0.0.1:<random-port> and writes {port, token} to a
+// per-PID file under CONFIG_DIR/loopback. Subprocesses spawned through
+// runClaude inherit OC_SEND_URL, OC_SEND_TOKEN, OC_CHANNEL_ID, and
+// OC_CHANNEL_ADAPTER in their env; the `open-claudia send-file /
+// send-voice / send-photo` CLI subcommands POST a file back through
+// this endpoint so the active channel's adapter can deliver it.
+//
+// Bound to 127.0.0.1 only and gated by a random token so other local
+// processes can't impersonate the bot.
+
+const fs = require("fs");
+const path = require("path");
+const http = require("http");
+const os = require("os");
+const crypto = require("crypto");
+const { CONFIG_DIR } = require("./config");
+
+const INFO_DIR = path.join(CONFIG_DIR, "loopback");
+const INFO_FILE = path.join(INFO_DIR, `${process.pid}.json`);
+
+let server = null;
+let token = null;
+let registry = null;
+
+function info() {
+  if (!server) return null;
+  const addr = server.address();
+  return { port: addr.port, token, pid: process.pid, url: `http://127.0.0.1:${addr.port}` };
+}
+
+function writeInfo() {
+  fs.mkdirSync(INFO_DIR, { recursive: true });
+  fs.writeFileSync(INFO_FILE, JSON.stringify(info(), null, 2), { mode: 0o600 });
+}
+
+function deleteInfo() {
+  try { fs.unlinkSync(INFO_FILE); } catch (e) {}
+}
+
+function reply(res, code, body) {
+  const data = JSON.stringify(body);
+  res.writeHead(code, { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(data) });
+  res.end(data);
+}
+
+function authOk(req) {
+  return (req.headers["authorization"] || "") === `Bearer ${token}`;
+}
+
+function readBodyToFile(req, dest) {
+  return new Promise((resolve, reject) => {
+    const out = fs.createWriteStream(dest);
+    req.pipe(out);
+    out.on("finish", () => resolve());
+    out.on("error", reject);
+    req.on("error", reject);
+  });
+}
+
+const KINDS = new Set(["send-file", "send-voice", "send-photo"]);
+
+async function handle(req, res) {
+  try {
+    if (req.method !== "POST") return reply(res, 405, { error: "method not allowed" });
+    if (!authOk(req)) return reply(res, 401, { error: "unauthorized" });
+    const url = new URL(req.url, "http://127.0.0.1");
+    const kind = url.pathname.slice(1);
+    if (!KINDS.has(kind)) return reply(res, 404, { error: "not found" });
+    const channelId = url.searchParams.get("channelId");
+    const adapterId = url.searchParams.get("adapter");
+    const caption = url.searchParams.get("caption") || "";
+    const fileName = url.searchParams.get("fileName") || `file-${Date.now()}.bin`;
+    if (!channelId || !adapterId) return reply(res, 400, { error: "missing channelId/adapter" });
+    const adapter = registry.findAdapter(adapterId);
+    if (!adapter) return reply(res, 400, { error: `unknown adapter ${adapterId}` });
+
+    const safeName = path.basename(fileName).replace(/[^A-Za-z0-9._-]/g, "_") || `file-${Date.now()}`;
+    const tmp = path.join(os.tmpdir(), `oc-loopback-${process.pid}-${Date.now()}-${safeName}`);
+    await readBodyToFile(req, tmp);
+
+    let ok = false;
+    try {
+      if (kind === "send-voice") {
+        ok = await adapter.sendVoice(channelId, tmp); // adapter unlinks on success/failure
+      } else if (kind === "send-photo" && typeof adapter.sendPhoto === "function") {
+        ok = await adapter.sendPhoto(channelId, tmp, caption);
+      } else {
+        ok = await adapter.sendFile(channelId, tmp, caption);
+      }
+    } finally {
+      if (kind !== "send-voice") { try { fs.unlinkSync(tmp); } catch (e) {} }
+    }
+    return reply(res, ok ? 200 : 500, { ok });
+  } catch (e) {
+    console.error("loopback handle error:", e.message);
+    return reply(res, 500, { error: e.message });
+  }
+}
+
+function start(adapterRegistry) {
+  if (server) return Promise.resolve(info());
+  registry = adapterRegistry;
+  token = crypto.randomBytes(24).toString("hex");
+  server = http.createServer(handle);
+  return new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", () => {
+      writeInfo();
+      resolve(info());
+    });
+  });
+}
+
+function stop() {
+  if (server) try { server.close(); } catch (e) {}
+  server = null;
+  deleteInfo();
+}
+
+process.on("exit", deleteInfo);
+
+module.exports = { start, stop, info, INFO_DIR, INFO_FILE };

package/core/router.js

@@ -45,6 +45,8 @@ function scope(envelope, fn) {
     adapter: envelope.adapter,
     channelId: envelope.channelId,
     canonicalUserId: envelope.canonicalUserId,
+    userId: envelope.userId,
+    transport: envelope.adapter?.type,
     raw: envelope.raw,
   }, fn);
 }
@@ -143,11 +145,15 @@ async function handlePhoto(envelope) {
   const state = currentState();
   if (!state.currentSession) return send("Pick a project first.");
   try {
-    const media = envelope.media?.[0];
-    if (!media) return;
-    const p = await envelope.adapter.downloadMedia(media);
+    const items = envelope.media || [];
+    if (!items.length) return;
+    const paths = [];
+    for (const m of items) paths.push(await envelope.adapter.downloadMedia(m));
     const caption = envelope.caption || "Describe this image. If code/UI/error — explain and fix.";
-    await runClaude(`Image at ${p}\n\nView it, then: ${caption}`, state.currentSession.dir, envelope.messageId);
+    const prompt = paths.length === 1
+      ? `Image at ${paths[0]}\n\nView it, then: ${caption}`
+      : `Images:\n${paths.map((p, i) => `${i + 1}. ${p}`).join("\n")}\n\nView all ${paths.length}, then: ${caption}`;
+    await runClaude(prompt, state.currentSession.dir, envelope.messageId);
   } catch (err) { await send(`Image failed: ${err.message}`); }
 }
 

package/core/runner.js

@@ -20,6 +20,25 @@ const {
   promptWithTranscriptPointer, stripTranscriptPointerForStorage,
 } = require("./transcripts");
 const { getClaudeOAuthToken, claudeAuthRecoveryMessage, isClaudeAuthErrorText, claudeUsageLimitMessage, isClaudeUsageLimitText, runClaudeAuthStatusDiagnostic, claudeSubprocessEnv } = require("./auth-flow");
+const loopback = require("./loopback");
+
+function chatEnvOverlay() {
+  const adapter = currentAdapter();
+  const channelId = currentChannelId();
+  const lb = loopback.info();
+  const overlay = {};
+  if (adapter && adapter.id) overlay.OC_CHANNEL_ADAPTER = adapter.id;
+  if (channelId) overlay.OC_CHANNEL_ID = String(channelId);
+  if (lb) {
+    overlay.OC_SEND_URL = lb.url;
+    overlay.OC_SEND_TOKEN = lb.token;
+  }
+  return overlay;
+}
+
+function subprocessEnv() {
+  return { ...claudeSubprocessEnv(), ...chatEnvOverlay() };
+}
 
 function parseStreamEvents(data) {
   const events = [];
@@ -126,7 +145,7 @@ function preflightClaudeAuthMessage() {
     const { execSync } = require("child_process");
     const output = execSync(`"${CLAUDE_PATH}" auth status`, {
       cwd: process.env.HOME || require("os").homedir(),
-      env: claudeSubprocessEnv(),
+      env: subprocessEnv(),
       encoding: "utf8",
       timeout: 10000,
       stdio: ["ignore", "pipe", "pipe"],
@@ -218,7 +237,7 @@ async function runClaudeCapture(prompt, cwd, opts = {}) {
     const args = buildClaudeArgs(prompt, { ...opts, skipAutoCompact: true });
     const proc = spawn(getActiveBinary(), args, {
       cwd,
-      env: claudeSubprocessEnv(),
+      env: subprocessEnv(),
       stdio: ["ignore", "pipe", "pipe"],
       detached: process.platform !== "win32",
     });
@@ -377,7 +396,7 @@ async function runClaude(prompt, cwd, replyToMsgId, opts = {}) {
   const binaryPath = getActiveBinary();
   const proc = spawn(binaryPath, args, {
     cwd,
-    env: claudeSubprocessEnv(),
+    env: subprocessEnv(),
     stdio: ["ignore", "pipe", "pipe"],
     detached: process.platform !== "win32",
   });

package/core/system-prompt.js

@@ -45,7 +45,11 @@ ${soul}
 ${transcriptPointerNote(state)}
 
 ## Delivery
-Reply normally in your final answer. If you must send a large file, image, or artifact directly, use the channel API/CLI; never print or embed bot tokens in prompts, commands, logs, or messages.
+Reply normally in your final answer. To send a file, image, or voice clip back to the current chat, run the bot CLI from inside this task — channel context is already in the env:
+- \`open-claudia send-file <path> [caption]\` — any document/binary
+- \`open-claudia send-photo <path> [caption]\` — image with inline preview
+- \`open-claudia send-voice <path>\` — ogg/opus voice note
+Never print or embed bot tokens in prompts, commands, logs, or messages.
 
 ## Guidelines
 - Keep responses concise — many users are on mobile.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inetafrica/open-claudia",
-  "version": "2.0.0",
+  "version": "2.0.2",
   "description": "Your always-on AI coding assistant — Claude Code, Cursor Agent, and OpenAI Codex via Telegram or Kazee Chat",
   "main": "bot.js",
   "bin": {