@inetafrica/open-claudia 2.13.0 → 2.14.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## v2.14.0
+- **`/channel add kazee` now finishes cleanly — the validation step was probing the wrong path.** The live adapter mounts every REST route under `{root}/api`, but the setup probe hit `{root}/me`. So the correct host (`https://chat.example.com`) always 404'd at validation, while the only URL that *passed* (`…/api`) then made the adapter build `…/api/api` and break. There was no single URL a user could type to succeed. `kazee-probe` now normalises either form to the root and probes the real `{root}/api/me` (new exported `normalizeKazeeRoot`); the wizard and `setup.js` both store the normalised root. Step 1 now asks for the host and states "I add the /api path myself."
+- **The bot's own user id is no longer thrown away.** Validation already fetches it from `/me`, but the wizard never persisted `KAZEE_BOT_USER_ID` or passed it to the adapter — so a wizard-added channel booted without self-echo filtering or slash-command registration (and `loadChannels` warned on every restart). The wizard and `setup.js` now save it and hand it to the adapter.
+- **Owner is captured by listening, not by pasting a Mongo id (Step 3 redesign).** After URL+token validate, the wizard brings Kazee **live immediately** (owner still blank) and asks the operator to send any message from their Kazee account. A new cross-channel hook — `router.tryCaptureOwner` → `channel-wizard.tryCaptureOwner` — intercepts that inbound Kazee message (it lands on a different channel than the operator's, so the operator-keyed `isAwaiting()` gate can't see it), then asks back on the operator's channel *"Is this you — the owner?"* with **Yes / No, keep listening / Skip** buttons. Yes grabs the sender's Kazee user id; owner recognition then flows through the existing env path (`identity.isConfiguredOwnerChannel` reads `KAZEE_OWNER_USER_ID`). Pasting an id or "skip" still works as a fallback; Cancel now tears the half-added adapter back down and rolls the `.env` edits back.
+- **Agent-space / OpenClaw:** no new deps, no new env, no schema change; Docker image builds identically. Purely a UX + correctness fix to the Kazee onboarding wizard — inert for deployments that never run `/channel add kazee`.
+
+## v2.13.1
+- **Guardrail no longer mistakes the owner for an external speaker on `/link`'d or env-unified channels (Phase 3 fix).** v2.13.0's relationship classifier resolved ownership through `people.findByHandle` alone — the handles physically listed on the owner's person record — while the queue/state/run-lock resolve it through `identity.canonicalForChannel`, which also honours explicit `/link`s (`identities.json`) and the configured-owner env path. A channel the owner had unified by `/link` or env-config (e.g. a second Kazee handle) was therefore *owner* to the run-lock (shared queue → "Queued.") but *external* to the guardrail (default-deny → the stranger reply), so the bot could greet its own owner as a limited-access outsider. The classifier now resolves ownership through **canonical identity — the same source of truth the rest of the bot uses**: a channel is the owner's when it resolves to the owner canonical **or** its person record is `isOwner`. New `identity.channelIsOwner()`; `relationship.speakerFor` consults it before default-deny. Every guard consumer (external-mode system-prompt block, `io`/`loopback` egress gates, runner turn-guard, CLI guards) funnels through this one function, so the fix lands everywhere at once.
+- **R1 preserved — a note still can never confer owner.** `channelIsOwner` is driven only by the canonical map, which is written **exclusively by owner/operator actions** (`/link`, `.env`), never by a note; and the owner stays anchored to a real owner record via `ownerCanonical → people.isOwner`. The default-deny posture for genuinely external or unmapped channels is unchanged.
+- **Tests.** `test-relationship.js` gains a regression reproducing the exact production bug — an owner Kazee channel `/link`'d to the owner canonical but **absent from the people record** now resolves to `owner` (unguarded), while an unmapped channel on the same transport stays `external` (guarded), proving the fix does not widen access. Full `npm test` green.
+- **Agent-space / OpenClaw:** no new deps, no new env, no schema change; Docker image builds identically. Purely a correctness fix to owner recognition — inert for deployments that never hit the split-brain.
+
 ## v2.13.0
 - **The independent relationship guardrail is now LIVE — an owned bot is finally safe to point at external people (Phase 3).** Phases 0–2 unified the bot's identity across channels and taught it WHO it's talking to; this phase adds the missing half: hard limits on what it may do or say when that person is **not** the owner. Everything is a strict **no-op for the owner and for no-context callers** (CLI/cron/tests) — the owner reply/tool/file paths stay **byte-for-byte unchanged** (risk R9/R14), so this is inert on every existing single-owner deployment until an external channel is actually `/auth`'d. Classification lives in `core/relationship.js` and is **cheap, synchronous, and never derived from message text**: the owner is owner **only** via `people.isOwner`; a non-owner whose note claims relationship `owner` is coerced to `external` (**R1 — a note can never confer owner powers**); every unclassified or unmapped authed non-owner defaults to `external` (**default-deny**).
 - **Owner-authored mandate, set from chat (3.1).** `entity persona <name> --relationship|--role|--style|--knows|--mandate` lets the owner declare, per person, the ONLY things the bot is cleared to do or discuss with them. The verb is **owner-gated** (an external speaker can never edit their own mandate — self-escalation is refused) and each flag replaces its section wholesale.

package/core/channel-wizard.js

@@ -5,6 +5,13 @@
 // enters the wizard their next plain-text message becomes the wizard's
 // input. A Cancel button (payload "chw:cancel") bails out at any step.
 //
+// Owner capture is cross-channel: once URL+token validate, we bring the
+// Kazee adapter live and listen for an inbound message ON KAZEE, then ask
+// the operator (back on the channel they ran /channel from) to confirm
+// "is this you?". router.tryCaptureOwner() feeds that inbound message in —
+// it arrives on a different channel than the operator's, so isAwaiting()
+// (keyed to the operator) never sees it via handleText().
+//
 // validateKazee() is exported separately so setup.js can reuse the same
 // /me probe without going through the chat-driven flow.
 
@@ -31,22 +38,45 @@ function endSession(canonicalUserId) {
 
 const cancelKeyboard = { inline_keyboard: [[{ text: "Cancel", callback_data: "chw:cancel" }]] };
 
-async function start(canonicalUserId, kind) {
+// Prompts issued while listening for (and confirming) the owner's Kazee
+// message must land on the channel the operator ran /channel from — not the
+// Kazee chat a trigger arrived on. Reach it through the stored origin
+// adapter, bypassing the ambient io.send() scope.
+async function sayToOrigin(session, text, opts) {
+  try {
+    if (session?.origin?.adapter && session.origin.channelId) {
+      return await session.origin.adapter.send(session.origin.channelId, text, opts);
+    }
+  } catch (e) { console.error("channel-wizard sayToOrigin:", e.message); }
+  return send(text, opts); // fallback: ambient scope
+}
+
+async function start(canonicalUserId, kind, envelope) {
   if (kind !== "kazee") {
     await send(`Channel type "${kind}" not supported yet.`);
     return;
   }
-  sessions.set(canonicalUserId, { kind: "kazee", step: "awaiting-url", data: {} });
+  const origin = envelope?.adapter && envelope?.channelId
+    ? { adapter: envelope.adapter, channelId: envelope.channelId }
+    : null;
+  sessions.set(canonicalUserId, { kind: "kazee", step: "awaiting-url", data: {}, origin });
   await send(
-    "Add a Kazee channel.\n\nStep 1 of 3: Kazee bot API URL (e.g. https://chat.example.com/api).",
+    "Add a Kazee channel.\n\nStep 1 of 3: Kazee host URL (e.g. https://chat.example.com). I add the /api path myself.",
     { keyboard: cancelKeyboard },
   );
 }
 
 async function cancel(canonicalUserId, { silent } = {}) {
-  if (!sessions.has(canonicalUserId)) return;
+  const session = sessions.get(canonicalUserId);
+  if (!session) return;
   sessions.delete(canonicalUserId);
-  if (!silent) await send("Channel setup cancelled.");
+  // If we already brought the adapter live for owner-capture, tear it back
+  // down and roll the .env edits back so a cancel leaves no half-added channel.
+  if (session.data?.live) {
+    try { await registry.removeAdapter("kazee"); } catch (e) {}
+    revertEnv(session.data.previous);
+  }
+  if (!silent) await sayToOrigin(session, "Channel setup cancelled.");
 }
 
 async function handleText(envelope) {
@@ -59,7 +89,7 @@ async function handleText(envelope) {
       await send("That doesn't look like a URL. Try again, or hit Cancel.", { keyboard: cancelKeyboard });
       return;
     }
-    session.data.url = text.replace(/\/$/, "");
+    session.data.url = text;
     session.step = "awaiting-token";
     await send(
       "Step 2 of 3: Kazee bot token. I'll delete your message after reading.",
@@ -83,83 +113,177 @@ async function handleText(envelope) {
       await send(`Validation failed: ${check.error}\n\nRun /channel add kazee to try again.`);
       return;
     }
+    session.data.url = check.url || session.data.url.replace(/\/+$/, "");
     session.data.botUserId = check.botUserId || "";
-    session.step = "awaiting-owner";
+
+    // Bring the adapter live now so it can receive the owner's message.
+    const live = await bringLive(session);
+    if (!live.ok) {
+      sessions.delete(envelope.canonicalUserId);
+      await send(`Could not start the Kazee adapter: ${live.error}\n\nReverted .env. Run /channel add kazee to try again.`);
+      return;
+    }
+    session.step = "awaiting-owner-message";
     await send(
-      `Step 3 of 3: Kazee user id that should be treated as the owner (or send "skip" to leave blank).`,
+      "Connected to Kazee ✅\n\nStep 3 of 3: open Kazee and send me any message — I'll grab your account and confirm it here.\n\n(Or send \"skip\" to leave the owner unset.)",
       { keyboard: cancelKeyboard },
     );
     return;
   }
 
-  if (session.step === "awaiting-owner") {
-    const ownerUserId = text.toLowerCase() === "skip" ? "" : text;
-    session.data.ownerUserId = ownerUserId;
-    session.step = "applying";
-    await applySession(envelope.canonicalUserId, session);
+  // Text fallback for step 3 — the operator can still type a user id or
+  // "skip" on their own channel instead of sending a Kazee message.
+  if (session.step === "awaiting-owner-message" || session.step === "confirming-owner") {
+    if (text.toLowerCase() === "skip") {
+      await finalizeOwner(envelope.canonicalUserId, session, "");
+      return;
+    }
+    if (/^[a-f0-9]{24}$/i.test(text)) {
+      await finalizeOwner(envelope.canonicalUserId, session, text);
+      return;
+    }
+    if (session.step === "awaiting-owner-message") {
+      await send(
+        "Still listening. Send a message from your Kazee account, paste a user id, or send \"skip\".",
+        { keyboard: cancelKeyboard },
+      );
+    }
     return;
   }
 }
 
+// Fired by router.tryCaptureOwner() for inbound messages arriving ON the
+// freshly-added Kazee adapter while a session is listening. Returns true
+// when it consumed the message (so the router stops normal processing).
+async function tryCaptureOwner(envelope) {
+  const adapterId = envelope.adapter?.id;
+  if (!adapterId) return false;
+  for (const [, session] of sessions) {
+    if (session.step !== "awaiting-owner-message") continue;
+    if (session.data.adapterId !== adapterId) continue;
+    const userId = String(envelope.userId || envelope.from?.id || "");
+    if (!userId) return true; // consume malformed input, keep listening
+    const name = envelope.from?.name || envelope.from?.username || "";
+    session.data.candidate = { userId, name };
+    session.step = "confirming-owner";
+    // Light ack on the Kazee side so the sender knows it landed.
+    try { await envelope.adapter.send(envelope.channelId, "Got your message 👋 — finishing setup on my end."); } catch (e) {}
+    const who = name ? `${name} (${userId})` : userId;
+    await sayToOrigin(
+      session,
+      `Got a Kazee message from ${who}.\n\nIs this you — the owner?`,
+      { keyboard: { inline_keyboard: [
+        [{ text: "Yes, that's me", callback_data: "chw:owner-yes" }],
+        [{ text: "No, keep listening", callback_data: "chw:owner-no" }],
+        [{ text: "Skip (no owner)", callback_data: "chw:owner-skip" }],
+      ] } },
+    );
+    return true;
+  }
+  return false;
+}
+
 async function handleAction(envelope) {
   const payload = envelope.action?.payload || envelope.action?.buttonId || "";
-  if (payload !== "chw:cancel") return false;
-  await cancel(envelope.canonicalUserId);
+  if (!String(payload).startsWith("chw:")) return false;
+  const session = sessions.get(envelope.canonicalUserId);
+
+  if (payload === "chw:cancel") {
+    await cancel(envelope.canonicalUserId);
+    return true;
+  }
+  if (!session) return true; // stale button — swallow so it doesn't fall through
+
+  if (payload === "chw:owner-yes") {
+    const cand = session.data.candidate;
+    if (!cand?.userId) {
+      session.step = "awaiting-owner-message";
+      await sayToOrigin(session, "Lost that candidate — send another message from Kazee.", { keyboard: cancelKeyboard });
+      return true;
+    }
+    await finalizeOwner(envelope.canonicalUserId, session, cand.userId);
+    return true;
+  }
+  if (payload === "chw:owner-no") {
+    session.data.candidate = null;
+    session.step = "awaiting-owner-message";
+    await sayToOrigin(session, "OK — still listening. Send a message from the owner's Kazee account.", { keyboard: cancelKeyboard });
+    return true;
+  }
+  if (payload === "chw:owner-skip") {
+    await finalizeOwner(envelope.canonicalUserId, session, "");
+    return true;
+  }
   return true;
 }
 
-async function applySession(canonicalUserId, session) {
-  const { url, token, ownerUserId } = session.data;
+// ── env plumbing ────────────────────────────────────────────────────
 
-  // Capture rollback state so we can undo .env changes if the adapter
-  // refuses to start.
-  const previous = {
+function snapshotEnv() {
+  return {
     KAZEE_URL: config.KAZEE_URL || "",
     KAZEE_BOT_TOKEN: config.KAZEE_BOT_TOKEN || "",
+    KAZEE_BOT_USER_ID: config.KAZEE_BOT_USER_ID || "",
     KAZEE_OWNER_USER_ID: config.KAZEE_OWNER_USER_ID || "",
     CHANNELS: config.CHANNELS || "telegram",
   };
+}
+
+function revertEnv(previous) {
+  if (!previous) return;
+  for (const [k, v] of Object.entries(previous)) {
+    saveEnvKey(k, v);
+    config[k] = v;
+  }
+}
+
+// Persist URL/token/botUserId, add "kazee" to CHANNELS, and boot the adapter
+// (owner still blank). Snapshots the prior env for rollback on failure/cancel.
+async function bringLive(session) {
+  const { url, token, botUserId } = session.data;
+  const previous = snapshotEnv();
+  session.data.previous = previous;
 
   saveEnvKey("KAZEE_URL", url);
   saveEnvKey("KAZEE_BOT_TOKEN", token);
-  saveEnvKey("KAZEE_OWNER_USER_ID", ownerUserId);
-
+  saveEnvKey("KAZEE_BOT_USER_ID", botUserId);
   const channels = previous.CHANNELS.split(",").map((s) => s.trim()).filter(Boolean);
-  if (!channels.some((c) => c === "kazee" || c.startsWith("kazee:"))) {
-    channels.push("kazee");
-  }
+  if (!channels.some((c) => c === "kazee" || c.startsWith("kazee:"))) channels.push("kazee");
   const newChannels = channels.join(",");
   saveEnvKey("CHANNELS", newChannels);
 
-  // Refresh in-process view so subsequent loadChannels() sees the new
-  // values without a restart.
   config.KAZEE_URL = url;
   config.KAZEE_BOT_TOKEN = token;
-  config.KAZEE_OWNER_USER_ID = ownerUserId;
+  config.KAZEE_BOT_USER_ID = botUserId;
   config.CHANNELS = newChannels;
 
   const result = await registry.addAdapter(
-    { id: "kazee", type: "kazee", opts: { url, token, ownerUserId } },
+    { id: "kazee", type: "kazee", opts: { url, token, ownerUserId: "", botUserId } },
     { publicCommands: publicCommands() },
   );
-
   if (!result.ok) {
-    // Roll the .env back so the next bot start doesn't crash-loop.
-    saveEnvKey("KAZEE_URL", previous.KAZEE_URL);
-    saveEnvKey("KAZEE_BOT_TOKEN", previous.KAZEE_BOT_TOKEN);
-    saveEnvKey("KAZEE_OWNER_USER_ID", previous.KAZEE_OWNER_USER_ID);
-    saveEnvKey("CHANNELS", previous.CHANNELS);
-    config.KAZEE_URL = previous.KAZEE_URL;
-    config.KAZEE_BOT_TOKEN = previous.KAZEE_BOT_TOKEN;
-    config.KAZEE_OWNER_USER_ID = previous.KAZEE_OWNER_USER_ID;
-    config.CHANNELS = previous.CHANNELS;
-    sessions.delete(canonicalUserId);
-    await send(`Could not start the Kazee adapter: ${result.error}\n\nReverted .env. Run /channel add kazee to try again.`);
-    return;
+    revertEnv(previous);
+    return result;
   }
+  session.data.adapterId = "kazee";
+  session.data.live = true;
+  return result;
+}
 
+// Owner decided (id or blank). Persist it, flip the live adapter's owner,
+// and close the session.
+async function finalizeOwner(canonicalUserId, session, ownerUserId) {
+  saveEnvKey("KAZEE_OWNER_USER_ID", ownerUserId);
+  config.KAZEE_OWNER_USER_ID = ownerUserId;
+  const adapter = registry.findAdapter("kazee");
+  if (adapter) adapter.ownerUserId = ownerUserId;
   sessions.delete(canonicalUserId);
-  await send("Kazee channel added and live.");
+  await sayToOrigin(
+    session,
+    ownerUserId
+      ? "Kazee channel added and live. You're set as the owner — message me from Kazee and I'll know it's you. 🎉"
+      : "Kazee channel added and live. No owner set — run /channel add kazee again if you want to set one.",
+  );
 }
 
 module.exports = {
@@ -170,5 +294,6 @@ module.exports = {
   cancel,
   handleText,
   handleAction,
+  tryCaptureOwner,
   validateKazee,
 };

package/core/handlers.js

@@ -1664,7 +1664,7 @@ register({
     if (addMatch) {
       const kind = addMatch[1].toLowerCase();
       if (kind !== "kazee") return send(`Channel type "${kind}" not supported.`);
-      await wizard.start(env.canonicalUserId, "kazee");
+      await wizard.start(env.canonicalUserId, "kazee", env);
       return;
     }
 

package/core/identity.js

@@ -69,6 +69,23 @@ function ownerCanonical() {
   return "";
 }
 
+// True when a channel resolves to the owner's canonical identity — the shared
+// source of truth the queue/state/run-lock already uses. The relationship
+// guardrail leans on this so the owner is recognised on EVERY channel they've
+// unified: a people-record handle, an explicit /link (identities.json), or the
+// configured-owner env path. Resolving ownership through the people-record
+// handle list alone is too narrow — a channel unified by /link or env-config is
+// never mirrored onto the record, so the owner would be falsely classed
+// external there. The canonical map is only ever written by owner/operator
+// actions, so this can never let a note confer owner (R1 preserved — a note
+// touches neither identities.json nor .env).
+function channelIsOwner(transport, channelId) {
+  const canonical = normalizeCanonicalUserId(canonicalForChannel(transport, channelId));
+  if (!canonical) return false;
+  const owner = normalizeCanonicalUserId(ownerCanonical());
+  return !!owner && canonical === owner;
+}
+
 function canonicalForChannel(transport, channelId) {
   const key = channelKey(transport, channelId);
   const explicit = normalizeCanonicalUserId(identities.channels[key]);
@@ -127,6 +144,7 @@ module.exports = {
   defaultCanonicalForChannel,
   isConfiguredOwnerChannel,
   ownerCanonical,
+  channelIsOwner,
   canonicalForChannel,
   canonicalForTelegram,
   canonicalForStoredUserKey,

package/core/kazee-probe.js

@@ -6,10 +6,19 @@ const https = require("https");
 const http = require("http");
 const { URL } = require("url");
 
+// The adapter mounts every REST route under {root}/api and talks socket.io
+// at {root}. Callers may hand us either the bare root host or a URL that
+// already ends in /api — normalise both to the root so we always probe the
+// real {root}/api/me and the caller can store one canonical KAZEE_URL.
+function normalizeKazeeRoot(url) {
+  return String(url || "").trim().replace(/\/+$/, "").replace(/\/api$/i, "");
+}
+
 function validateKazee({ url, token }) {
   return new Promise((resolve) => {
+    const root = normalizeKazeeRoot(url);
     let u;
-    try { u = new URL(url.replace(/\/$/, "") + "/me"); }
+    try { u = new URL(root + "/api/me"); }
     catch (e) { return resolve({ ok: false, error: `Bad URL: ${e.message}` }); }
     const lib = u.protocol === "https:" ? https : http;
     const req = lib.request({
@@ -26,16 +35,16 @@ function validateKazee({ url, token }) {
           try {
             const body = chunks ? JSON.parse(chunks) : {};
             const botUserId = body?.user?._id || body?.user?.id || body?._id || "";
-            resolve({ ok: true, botUserId });
+            resolve({ ok: true, botUserId, url: root });
           } catch (e) {
-            resolve({ ok: true, botUserId: "" });
+            resolve({ ok: true, botUserId: "", url: root });
           }
         } else if (res.statusCode === 401 || res.statusCode === 403) {
           resolve({ ok: false, error: "Token rejected (401/403). Check that it's a valid Kazee bot token." });
         } else if (res.statusCode === 404) {
-          resolve({ ok: false, error: "GET /me returned 404. Check that the URL points at the Kazee bot API root." });
+          resolve({ ok: false, error: "GET /api/me returned 404. Check the URL points at your Kazee host (e.g. https://chat.example.com)." });
         } else {
-          resolve({ ok: false, error: `GET /me → HTTP ${res.statusCode}` });
+          resolve({ ok: false, error: `GET /api/me → HTTP ${res.statusCode}` });
         }
       });
     });
@@ -45,4 +54,4 @@ function validateKazee({ url, token }) {
   });
 }
 
-module.exports = { validateKazee };
+module.exports = { validateKazee, normalizeKazeeRoot };

package/core/relationship.js

@@ -18,18 +18,37 @@ function speakerFor(adapterType, channelId) {
     if (!adapterType || !channelId) return null;
     const people = require("./people");
     const person = people.findByHandle(adapterType, channelId);
-    if (!person) {
-      // Authed but not mapped to a person record → treat as external.
+
+    // Ownership is resolved through canonical identity — the SAME source of
+    // truth the queue/state/run-lock uses — so the owner is recognised on every
+    // channel they've unified (a people handle, an explicit /link, or the
+    // configured-owner env path), not just channels physically mirrored onto
+    // the people record. Consulting only findByHandle is too narrow: a channel
+    // unified by /link or env-config is never written back to the record, so the
+    // owner would be falsely classed external there. channelIsOwner is driven
+    // only by owner/operator-written identity links (identities.json / .env), so
+    // a note can never trip it (R1 preserved — the owner stays anchored to a
+    // real owner record via ownerCanonical → people.isOwner).
+    let ownerByCanonical = false;
+    try { ownerByCanonical = require("./identity").channelIsOwner(adapterType, channelId); } catch (e) {}
+
+    if (ownerByCanonical || (person && person.isOwner)) {
+      let ownerPerson = person && person.isOwner ? person : null;
+      if (!ownerPerson) { try { ownerPerson = (people.owners() || [])[0] || null; } catch (e) {} }
+      const name = ownerPerson ? ownerPerson.name : (person ? person.name : "");
       return {
-        person: null, name: "", isOwner: false, relationship: "external",
-        slug: null, mandate: "", style: "", entityName: "",
+        person: ownerPerson || person || null, name, isOwner: true, relationship: "owner",
+        slug: null, mandate: "", style: "", entityName: name,
         adapterType: String(adapterType), channelId: String(channelId),
       };
     }
-    if (person.isOwner) {
+
+    if (!person) {
+      // Authed but not mapped to a person record and not an owner-canonical
+      // channel → treat as external (default-deny).
       return {
-        person, name: person.name, isOwner: true, relationship: "owner",
-        slug: null, mandate: "", style: "", entityName: person.name,
+        person: null, name: "", isOwner: false, relationship: "external",
+        slug: null, mandate: "", style: "", entityName: "",
         adapterType: String(adapterType), channelId: String(channelId),
       };
     }

package/core/router.js

@@ -63,6 +63,12 @@ async function onMessage(envelope) {
       // owner's canonical bucket on first contact, before any state is read.
       try { autoLinkOwnerChannel(envelope.adapter?.type, envelope.channelId); } catch (e) {}
 
+      // A channel wizard listening for the owner's message on a freshly-added
+      // adapter consumes that inbound message here: it arrives on a different
+      // channel than the operator's, so the isAwaiting() gate below (keyed to
+      // the operator) never sees it.
+      if (await channelWizard.tryCaptureOwner(envelope)) return;
+
       // While a channel wizard is open, capture text input before slash
       // dispatch — except for /cancel, which always bails out.
       if (channelWizard.isAwaiting(envelope.canonicalUserId)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inetafrica/open-claudia",
-  "version": "2.13.0",
+  "version": "2.14.0",
   "description": "Your always-on AI coding assistant — Claude Code, Cursor Agent, and OpenAI Codex via Telegram or Kazee Chat",
   "main": "bot.js",
   "bin": {

package/setup.js

@@ -674,11 +674,11 @@ async function main() {
     const addKazee = await ask("  Add a Kazee channel now? (y/n) [n]: ");
     if (addKazee.toLowerCase() === "y") {
       while (true) {
-        const url = (await ask("  Kazee bot API URL (e.g. https://chat.example.com/api): ")).trim();
+        const url = (await ask("  Kazee host URL (e.g. https://chat.example.com — I add /api myself): ")).trim();
         if (!/^https?:\/\//i.test(url)) { console.log("  That doesn't look like a URL."); continue; }
         const token = (await ask("  Kazee bot token: ")).trim();
         if (!token) { console.log("  Empty token."); continue; }
-        console.log("  Validating against Kazee /me…");
+        console.log("  Validating against Kazee /api/me…");
         const check = await validateKazee({ url, token });
         if (!check.ok) {
           console.log(`  Validation failed: ${check.error}`);
@@ -687,7 +687,7 @@ async function main() {
           continue;
         }
         const ownerUserId = (await ask("  Kazee owner user id (blank to skip): ")).trim();
-        state.data.kazee = { url: url.replace(/\/$/, ""), token, ownerUserId };
+        state.data.kazee = { url: check.url || url.replace(/\/+$/, ""), token, ownerUserId, botUserId: check.botUserId || "" };
         console.log("  Kazee channel configured.");
         break;
       }
@@ -756,6 +756,7 @@ async function main() {
     if (d.kazee) {
       envLines.push(`KAZEE_URL=${d.kazee.url}`);
       envLines.push(`KAZEE_BOT_TOKEN=${d.kazee.token}`);
+      envLines.push(`KAZEE_BOT_USER_ID=${d.kazee.botUserId || ""}`);
       envLines.push(`KAZEE_OWNER_USER_ID=${d.kazee.ownerUserId || ""}`);
     }
     const env = envLines.join("\n");

package/test-relationship.js

@@ -119,4 +119,28 @@ assert.ok(target, "ownerTarget resolves an owner handle");
 assert.strictEqual(target.adapter, "telegram", "ownerTarget adapter");
 assert.strictEqual(target.channelId, CH_OWNER_ALT, "ownerTarget picks the primary channel, not the first");
 
+// ── split-brain fix: an owner channel unified via /link (identities.json) but
+// NEVER mirrored onto the people record must STILL resolve to the owner. This
+// is the production bug — a Kazee handle /link'd to the owner's canonical id was
+// invisible to people.findByHandle, so the guardrail falsely treated the owner
+// as an external speaker. Ownership now flows through canonical identity. ──
+const identity = require("./core/identity");
+const ownerCanon = identity.ownerCanonical();
+assert.ok(ownerCanon, "owner has a canonical id");
+identity.setIdentityMapping("kazee", "owner-linked-kazee", ownerCanon);
+assert.strictEqual(people.findByHandle("kazee", "owner-linked-kazee"), null,
+  "precondition: the /link'd kazee channel is absent from the people record");
+const linkedSp = relationship.speakerFor("kazee", "owner-linked-kazee");
+assert.strictEqual(linkedSp.isOwner, true, "owner-canonical channel → owner even without a people handle");
+assert.strictEqual(linkedSp.relationship, "owner", "owner-canonical channel relationship");
+assert.strictEqual(linkedSp.mandate, "", "owner never carries a mandate");
+assert.strictEqual(relationship.guardActive(linkedSp), false, "owner-canonical channel is never guarded");
+
+// ── and the fix must NOT widen: an unmapped channel on the same transport that
+// does not resolve to the owner canonical stays external + guarded. ──
+const strayKazee = relationship.speakerFor("kazee", "some-stranger-999");
+assert.strictEqual(strayKazee.isOwner, false, "unmapped kazee channel is not owner");
+assert.strictEqual(strayKazee.relationship, "external", "unmapped kazee channel → external");
+assert.strictEqual(relationship.guardActive(strayKazee), true, "unmapped kazee channel stays guarded");
+
 console.log("relationship OK");