@inetafrica/open-claudia 2.14.0 → 2.14.2

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## v2.14.2
+- **Token validation now hits the right service — the previous probe could never succeed.** v2.14.0/.1 validated a Kazee bot token by `GET {host}/api/me`, but chat-central has **no `/me` route** (confirmed against `src/config/routes.ts`) — every attempt 404'd. chat-central doesn't resolve identity itself; it delegates on every request to `@libraries/inet-central-auth`, which POSTs the opaque `kzb_…` token to **Central's `POST /api/principal/verify`**. `core/kazee-probe.js` now calls that endpoint: one request both **validates the token and returns the bot's own user id** (`principal.id`, with `principal.kind === "Bot"` enforced) plus its display name. Verified live end-to-end (real token → `ok` + botUserId + "Maya Bot"; bad token → clean 401).
+- **Central is hard-coded too (env-overridable).** New `CENTRAL_DEFAULT_URL = "https://central.inet.africa"` mirrors chat-central's own default; override with `CENTRAL_BASE_URL` for non-prod. The wizard now says "Verifying the bot token…" and greets the bot by name ("Connected as Maya Bot ✅"); `setup.js` prints "Verified as <name>."
+- **Agent-space / OpenClaw:** no new deps, no new required env, no schema change; Docker image builds identically. Correctness fix to the onboarding probe — the wizard flow (token-first, listen-to-capture owner) is unchanged.
+
+## v2.14.1
+- **The Kazee host URL is no longer asked — it's fixed infrastructure, like Telegram's `api.telegram.org`.** v2.14.0 fixed the probe but still made Step 1 ask the operator to type the host; the Kazee host never varies, so prompting for it is pure friction (and a chance to get it wrong). `core/config.js` now defines `KAZEE_DEFAULT_URL = "https://chat.inet.africa"` and `loadChannels` falls back to it whenever `KAZEE_URL` is unset. `/channel add kazee` is now **two steps, token-first**: Step 1 asks only for the bot token, Step 2 is the listen-to-capture owner flow. `setup.js` likewise drops its URL prompt (default inlined, since `config.js` exits before an `.env` exists). An explicit `KAZEE_URL` in `.env` still overrides, so nothing breaks for a deployment that set one.
+- **Agent-space / OpenClaw:** no new deps, no new required env, no schema change; Docker image builds identically. Pure UX fix to the onboarding wizard.
+
 ## v2.14.0
 - **`/channel add kazee` now finishes cleanly — the validation step was probing the wrong path.** The live adapter mounts every REST route under `{root}/api`, but the setup probe hit `{root}/me`. So the correct host (`https://chat.example.com`) always 404'd at validation, while the only URL that *passed* (`…/api`) then made the adapter build `…/api/api` and break. There was no single URL a user could type to succeed. `kazee-probe` now normalises either form to the root and probes the real `{root}/api/me` (new exported `normalizeKazeeRoot`); the wizard and `setup.js` both store the normalised root. Step 1 now asks for the host and states "I add the /api path myself."
 - **The bot's own user id is no longer thrown away.** Validation already fetches it from `/me`, but the wizard never persisted `KAZEE_BOT_USER_ID` or passed it to the adapter — so a wizard-added channel booted without self-echo filtering or slash-command registration (and `loadChannels` warned on every restart). The wizard and `setup.js` now save it and hand it to the adapter.

package/core/channel-wizard.js

@@ -15,7 +15,7 @@
 // validateKazee() is exported separately so setup.js can reuse the same
 // /me probe without going through the chat-driven flow.
 
-const { saveEnvKey, config } = require("./config");
+const { saveEnvKey, config, KAZEE_DEFAULT_URL } = require("./config");
 const { send, deleteMessage } = require("./io");
 const { publicCommands } = require("./commands");
 const registry = require("./adapter-registry");
@@ -59,9 +59,10 @@ async function start(canonicalUserId, kind, envelope) {
   const origin = envelope?.adapter && envelope?.channelId
     ? { adapter: envelope.adapter, channelId: envelope.channelId }
     : null;
-  sessions.set(canonicalUserId, { kind: "kazee", step: "awaiting-url", data: {}, origin });
+  const url = config.KAZEE_URL || KAZEE_DEFAULT_URL;
+  sessions.set(canonicalUserId, { kind: "kazee", step: "awaiting-token", data: { url }, origin });
   await send(
-    "Add a Kazee channel.\n\nStep 1 of 3: Kazee host URL (e.g. https://chat.example.com). I add the /api path myself.",
+    "Add a Kazee channel.\n\nStep 1 of 2: paste the Kazee bot token. I'll delete your message after reading it.",
     { keyboard: cancelKeyboard },
   );
 }
@@ -84,20 +85,6 @@ async function handleText(envelope) {
   if (!session) return;
   const text = (envelope.text || "").trim();
 
-  if (session.step === "awaiting-url") {
-    if (!/^https?:\/\//i.test(text)) {
-      await send("That doesn't look like a URL. Try again, or hit Cancel.", { keyboard: cancelKeyboard });
-      return;
-    }
-    session.data.url = text;
-    session.step = "awaiting-token";
-    await send(
-      "Step 2 of 3: Kazee bot token. I'll delete your message after reading.",
-      { keyboard: cancelKeyboard },
-    );
-    return;
-  }
-
   if (session.step === "awaiting-token") {
     await deleteMessage(envelope.messageId);
     if (!text) {
@@ -106,7 +93,7 @@ async function handleText(envelope) {
     }
     session.data.token = text;
     session.step = "validating";
-    await send("Validating against the Kazee API…");
+    await send("Verifying the bot token…");
     const check = await validateKazee({ url: session.data.url, token: session.data.token });
     if (!check.ok) {
       sessions.delete(envelope.canonicalUserId);
@@ -115,6 +102,7 @@ async function handleText(envelope) {
     }
     session.data.url = check.url || session.data.url.replace(/\/+$/, "");
     session.data.botUserId = check.botUserId || "";
+    session.data.botName = check.botName || "";
 
     // Bring the adapter live now so it can receive the owner's message.
     const live = await bringLive(session);
@@ -124,8 +112,11 @@ async function handleText(envelope) {
       return;
     }
     session.step = "awaiting-owner-message";
+    const connected = session.data.botName
+      ? `Connected as ${session.data.botName} ✅`
+      : "Connected to Kazee ✅";
     await send(
-      "Connected to Kazee ✅\n\nStep 3 of 3: open Kazee and send me any message — I'll grab your account and confirm it here.\n\n(Or send \"skip\" to leave the owner unset.)",
+      `${connected}\n\nStep 2 of 2: open Kazee and send me any message — I'll grab your account and confirm it here.\n\n(Or send "skip" to leave the owner unset.)`,
       { keyboard: cancelKeyboard },
     );
     return;

package/core/config.js

@@ -163,6 +163,11 @@ const FULL_PATH = [
   ),
 ].filter(Boolean).join(path.delimiter);
 
+// Kazee runs on one fixed host — like Telegram's api.telegram.org it's
+// infrastructure, not a per-user setting. Hard-coded so onboarding only asks
+// for the bot token (the actual secret). Override with KAZEE_URL if ever needed.
+const KAZEE_DEFAULT_URL = "https://chat.inet.africa";
+
 // Channels: declarative list of {id, type, opts}. Defaults to telegram for
 // backwards compat with installs predating CHANNELS.
 function loadChannels() {
@@ -185,7 +190,7 @@ function loadChannels() {
         opts: { token: TOKEN, ownerChatId: CHAT_ID || "", chatIds: CHAT_IDS },
       });
     } else if (type === "kazee") {
-      const url = config.KAZEE_URL;
+      const url = config.KAZEE_URL || KAZEE_DEFAULT_URL;
       const token = config.KAZEE_BOT_TOKEN;
       const ownerUserId = config.KAZEE_OWNER_USER_ID || "";
       const botUserId = config.KAZEE_BOT_USER_ID || "";
@@ -238,6 +243,7 @@ module.exports = {
   saveEnvKey,
   loadChannels,
   botSubprocessEnv,
+  KAZEE_DEFAULT_URL,
   BOT_DIR,
   CONFIG_DIR,
   TOKEN, CHAT_IDS, CHAT_ID,

package/core/kazee-probe.js

@@ -1,57 +1,85 @@
-// Standalone Kazee GET /me probe. Lives outside the adapter so setup.js
-// can use it before .env exists (channel-wizard, which is the other
-// consumer, imports it indirectly).
+// Standalone Kazee bot-token probe. Lives outside the adapter so setup.js
+// can use it before .env exists (channel-wizard imports it too).
+//
+// A Kazee bot token is an inet-central OPAQUE token (kzb_…). chat-central
+// itself has NO /me endpoint — it delegates auth on every request to
+// inet-central-auth, which POSTs the token to Central's
+// `/api/principal/verify`. That single call both validates the token and
+// returns the principal, whose `id` IS the bot's Kazee user id and whose
+// `kind` must be "Bot". So we validate against Central, not chat-central.
+// (Verified live 2026-07-09: principal { id, kind:"Bot", firstName, … }.)
 
 const https = require("https");
 const http = require("http");
 const { URL } = require("url");
 
-// The adapter mounts every REST route under {root}/api and talks socket.io
-// at {root}. Callers may hand us either the bare root host or a URL that
-// already ends in /api — normalise both to the root so we always probe the
-// real {root}/api/me and the caller can store one canonical KAZEE_URL.
+// Central is fixed infrastructure — like the Kazee host it never varies, so
+// it's hard-coded (env override for non-prod). Mirrors chat-central's own
+// default (src/config/inet-central-auth.ts).
+const CENTRAL_DEFAULT_URL = "https://central.inet.africa";
+
+// The adapter mounts REST under {root}/api and talks socket.io at {root}.
+// Callers may hand us either the bare root or a URL already ending in /api —
+// normalise both to the root so we store one canonical KAZEE_URL.
 function normalizeKazeeRoot(url) {
   return String(url || "").trim().replace(/\/+$/, "").replace(/\/api$/i, "");
 }
 
-function validateKazee({ url, token }) {
+// Validate a Kazee bot token and resolve the bot's own user id.
+//   url        Kazee host (only normalised + echoed back for storage)
+//   token      the kzb_… bot token to verify
+//   centralUrl override Central base (defaults to env or CENTRAL_DEFAULT_URL)
+// Resolves { ok:true, url, botUserId, botName } or { ok:false, error }.
+function validateKazee({ url, token, centralUrl }) {
   return new Promise((resolve) => {
     const root = normalizeKazeeRoot(url);
+    const central = String(centralUrl || process.env.CENTRAL_BASE_URL || CENTRAL_DEFAULT_URL)
+      .trim().replace(/\/+$/, "");
     let u;
-    try { u = new URL(root + "/api/me"); }
-    catch (e) { return resolve({ ok: false, error: `Bad URL: ${e.message}` }); }
+    try { u = new URL(central + "/api/principal/verify"); }
+    catch (e) { return resolve({ ok: false, error: `Bad Central URL: ${e.message}` }); }
+
+    const payload = JSON.stringify({ token: String(token || "") });
     const lib = u.protocol === "https:" ? https : http;
     const req = lib.request({
-      method: "GET",
+      method: "POST",
       hostname: u.hostname,
       port: u.port || (u.protocol === "https:" ? 443 : 80),
       path: u.pathname + (u.search || ""),
-      headers: { Authorization: `Bearer ${token}`, Accept: "application/json" },
+      headers: {
+        "Content-Type": "application/json",
+        "Content-Length": Buffer.byteLength(payload),
+        Accept: "application/json",
+      },
     }, (res) => {
       let chunks = "";
       res.on("data", (c) => { chunks += c; });
       res.on("end", () => {
-        if (res.statusCode >= 200 && res.statusCode < 300) {
-          try {
-            const body = chunks ? JSON.parse(chunks) : {};
-            const botUserId = body?.user?._id || body?.user?.id || body?._id || "";
-            resolve({ ok: true, botUserId, url: root });
-          } catch (e) {
-            resolve({ ok: true, botUserId: "", url: root });
-          }
-        } else if (res.statusCode === 401 || res.statusCode === 403) {
-          resolve({ ok: false, error: "Token rejected (401/403). Check that it's a valid Kazee bot token." });
-        } else if (res.statusCode === 404) {
-          resolve({ ok: false, error: "GET /api/me returned 404. Check the URL points at your Kazee host (e.g. https://chat.example.com)." });
-        } else {
-          resolve({ ok: false, error: `GET /api/me → HTTP ${res.statusCode}` });
+        let body = null;
+        try { body = chunks ? JSON.parse(chunks) : null; } catch (e) { body = null; }
+
+        if (res.statusCode < 200 || res.statusCode >= 300) {
+          const detail = body && body.error ? `: ${body.error}` : "";
+          return resolve({ ok: false, error: `Central rejected the token (HTTP ${res.statusCode})${detail}. Check the bot token.` });
+        }
+        if (!body || !body.success || !body.valid || !body.principal) {
+          const detail = body && body.error ? `: ${body.error}` : "";
+          return resolve({ ok: false, error: `Token not valid${detail}. Paste a current Kazee bot token.` });
+        }
+        const p = body.principal;
+        if (p.kind !== "Bot") {
+          return resolve({ ok: false, error: `That token is a ${p.kind || "non-bot"} principal, not a bot. Paste a bot token (kzb_…).` });
         }
+        const botUserId = String(p.id || p._id || p.userId || "");
+        const botName = p.name || [p.firstName, p.lastName].filter(Boolean).join(" ") || "";
+        resolve({ ok: true, url: root, botUserId, botName });
       });
     });
     req.on("error", (e) => resolve({ ok: false, error: e.message }));
-    req.setTimeout(15000, () => req.destroy(new Error("Timed out after 15s")));
+    req.setTimeout(15000, () => req.destroy(new Error("Central verify timed out after 15s")));
+    req.write(payload);
     req.end();
   });
 }
 
-module.exports = { validateKazee, normalizeKazeeRoot };
+module.exports = { validateKazee, normalizeKazeeRoot, CENTRAL_DEFAULT_URL };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inetafrica/open-claudia",
-  "version": "2.14.0",
+  "version": "2.14.2",
   "description": "Your always-on AI coding assistant — Claude Code, Cursor Agent, and OpenAI Codex via Telegram or Kazee Chat",
   "main": "bot.js",
   "bin": {

package/setup.js

@@ -492,6 +492,10 @@ const STEPS = ["prerequisites", "telegram", "auth", "channels", "workspace", "va
 
 const { validateKazee } = require("./core/kazee-probe");
 
+// Fixed Kazee host — mirrors KAZEE_DEFAULT_URL in core/config.js. Kept inline
+// because config.js exits when no .env exists yet (setup runs before that).
+const KAZEE_DEFAULT_URL = "https://chat.inet.africa";
+
 async function main() {
   // Check if this is an auth subcommand
   const args = process.argv.slice(2);
@@ -673,12 +677,11 @@ async function main() {
     console.log("\n  Extra Channels (optional)\n");
     const addKazee = await ask("  Add a Kazee channel now? (y/n) [n]: ");
     if (addKazee.toLowerCase() === "y") {
+      const url = KAZEE_DEFAULT_URL; // fixed host — never prompted, like Telegram's api host
       while (true) {
-        const url = (await ask("  Kazee host URL (e.g. https://chat.example.com — I add /api myself): ")).trim();
-        if (!/^https?:\/\//i.test(url)) { console.log("  That doesn't look like a URL."); continue; }
         const token = (await ask("  Kazee bot token: ")).trim();
         if (!token) { console.log("  Empty token."); continue; }
-        console.log("  Validating against Kazee /api/me…");
+        console.log("  Verifying the bot token…");
         const check = await validateKazee({ url, token });
         if (!check.ok) {
           console.log(`  Validation failed: ${check.error}`);
@@ -686,6 +689,7 @@ async function main() {
           if (retry.toLowerCase() === "n") break;
           continue;
         }
+        if (check.botName) console.log(`  Verified as ${check.botName}.`);
         const ownerUserId = (await ask("  Kazee owner user id (blank to skip): ")).trim();
         state.data.kazee = { url: check.url || url.replace(/\/+$/, ""), token, ownerUserId, botUserId: check.botUserId || "" };
         console.log("  Kazee channel configured.");