@inetafrica/open-claudia 2.14.1 → 2.14.2

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## v2.14.2
+- **Token validation now hits the right service — the previous probe could never succeed.** v2.14.0/.1 validated a Kazee bot token by `GET {host}/api/me`, but chat-central has **no `/me` route** (confirmed against `src/config/routes.ts`) — every attempt 404'd. chat-central doesn't resolve identity itself; it delegates on every request to `@libraries/inet-central-auth`, which POSTs the opaque `kzb_…` token to **Central's `POST /api/principal/verify`**. `core/kazee-probe.js` now calls that endpoint: one request both **validates the token and returns the bot's own user id** (`principal.id`, with `principal.kind === "Bot"` enforced) plus its display name. Verified live end-to-end (real token → `ok` + botUserId + "Maya Bot"; bad token → clean 401).
+- **Central is hard-coded too (env-overridable).** New `CENTRAL_DEFAULT_URL = "https://central.inet.africa"` mirrors chat-central's own default; override with `CENTRAL_BASE_URL` for non-prod. The wizard now says "Verifying the bot token…" and greets the bot by name ("Connected as Maya Bot ✅"); `setup.js` prints "Verified as <name>."
+- **Agent-space / OpenClaw:** no new deps, no new required env, no schema change; Docker image builds identically. Correctness fix to the onboarding probe — the wizard flow (token-first, listen-to-capture owner) is unchanged.
+
 ## v2.14.1
 - **The Kazee host URL is no longer asked — it's fixed infrastructure, like Telegram's `api.telegram.org`.** v2.14.0 fixed the probe but still made Step 1 ask the operator to type the host; the Kazee host never varies, so prompting for it is pure friction (and a chance to get it wrong). `core/config.js` now defines `KAZEE_DEFAULT_URL = "https://chat.inet.africa"` and `loadChannels` falls back to it whenever `KAZEE_URL` is unset. `/channel add kazee` is now **two steps, token-first**: Step 1 asks only for the bot token, Step 2 is the listen-to-capture owner flow. `setup.js` likewise drops its URL prompt (default inlined, since `config.js` exits before an `.env` exists). An explicit `KAZEE_URL` in `.env` still overrides, so nothing breaks for a deployment that set one.
 - **Agent-space / OpenClaw:** no new deps, no new required env, no schema change; Docker image builds identically. Pure UX fix to the onboarding wizard.

package/core/channel-wizard.js

@@ -93,7 +93,7 @@ async function handleText(envelope) {
     }
     session.data.token = text;
     session.step = "validating";
-    await send("Validating against the Kazee API…");
+    await send("Verifying the bot token…");
     const check = await validateKazee({ url: session.data.url, token: session.data.token });
     if (!check.ok) {
       sessions.delete(envelope.canonicalUserId);
@@ -102,6 +102,7 @@ async function handleText(envelope) {
     }
     session.data.url = check.url || session.data.url.replace(/\/+$/, "");
     session.data.botUserId = check.botUserId || "";
+    session.data.botName = check.botName || "";
 
     // Bring the adapter live now so it can receive the owner's message.
     const live = await bringLive(session);
@@ -111,8 +112,11 @@ async function handleText(envelope) {
       return;
     }
     session.step = "awaiting-owner-message";
+    const connected = session.data.botName
+      ? `Connected as ${session.data.botName} ✅`
+      : "Connected to Kazee ✅";
     await send(
-      "Connected to Kazee ✅\n\nStep 2 of 2: open Kazee and send me any message — I'll grab your account and confirm it here.\n\n(Or send \"skip\" to leave the owner unset.)",
+      `${connected}\n\nStep 2 of 2: open Kazee and send me any message — I'll grab your account and confirm it here.\n\n(Or send "skip" to leave the owner unset.)`,
       { keyboard: cancelKeyboard },
     );
     return;

package/core/kazee-probe.js

@@ -1,57 +1,85 @@
-// Standalone Kazee GET /me probe. Lives outside the adapter so setup.js
-// can use it before .env exists (channel-wizard, which is the other
-// consumer, imports it indirectly).
+// Standalone Kazee bot-token probe. Lives outside the adapter so setup.js
+// can use it before .env exists (channel-wizard imports it too).
+//
+// A Kazee bot token is an inet-central OPAQUE token (kzb_…). chat-central
+// itself has NO /me endpoint — it delegates auth on every request to
+// inet-central-auth, which POSTs the token to Central's
+// `/api/principal/verify`. That single call both validates the token and
+// returns the principal, whose `id` IS the bot's Kazee user id and whose
+// `kind` must be "Bot". So we validate against Central, not chat-central.
+// (Verified live 2026-07-09: principal { id, kind:"Bot", firstName, … }.)
 
 const https = require("https");
 const http = require("http");
 const { URL } = require("url");
 
-// The adapter mounts every REST route under {root}/api and talks socket.io
-// at {root}. Callers may hand us either the bare root host or a URL that
-// already ends in /api — normalise both to the root so we always probe the
-// real {root}/api/me and the caller can store one canonical KAZEE_URL.
+// Central is fixed infrastructure — like the Kazee host it never varies, so
+// it's hard-coded (env override for non-prod). Mirrors chat-central's own
+// default (src/config/inet-central-auth.ts).
+const CENTRAL_DEFAULT_URL = "https://central.inet.africa";
+
+// The adapter mounts REST under {root}/api and talks socket.io at {root}.
+// Callers may hand us either the bare root or a URL already ending in /api —
+// normalise both to the root so we store one canonical KAZEE_URL.
 function normalizeKazeeRoot(url) {
   return String(url || "").trim().replace(/\/+$/, "").replace(/\/api$/i, "");
 }
 
-function validateKazee({ url, token }) {
+// Validate a Kazee bot token and resolve the bot's own user id.
+//   url        Kazee host (only normalised + echoed back for storage)
+//   token      the kzb_… bot token to verify
+//   centralUrl override Central base (defaults to env or CENTRAL_DEFAULT_URL)
+// Resolves { ok:true, url, botUserId, botName } or { ok:false, error }.
+function validateKazee({ url, token, centralUrl }) {
   return new Promise((resolve) => {
     const root = normalizeKazeeRoot(url);
+    const central = String(centralUrl || process.env.CENTRAL_BASE_URL || CENTRAL_DEFAULT_URL)
+      .trim().replace(/\/+$/, "");
     let u;
-    try { u = new URL(root + "/api/me"); }
-    catch (e) { return resolve({ ok: false, error: `Bad URL: ${e.message}` }); }
+    try { u = new URL(central + "/api/principal/verify"); }
+    catch (e) { return resolve({ ok: false, error: `Bad Central URL: ${e.message}` }); }
+
+    const payload = JSON.stringify({ token: String(token || "") });
     const lib = u.protocol === "https:" ? https : http;
     const req = lib.request({
-      method: "GET",
+      method: "POST",
       hostname: u.hostname,
       port: u.port || (u.protocol === "https:" ? 443 : 80),
       path: u.pathname + (u.search || ""),
-      headers: { Authorization: `Bearer ${token}`, Accept: "application/json" },
+      headers: {
+        "Content-Type": "application/json",
+        "Content-Length": Buffer.byteLength(payload),
+        Accept: "application/json",
+      },
     }, (res) => {
       let chunks = "";
       res.on("data", (c) => { chunks += c; });
       res.on("end", () => {
-        if (res.statusCode >= 200 && res.statusCode < 300) {
-          try {
-            const body = chunks ? JSON.parse(chunks) : {};
-            const botUserId = body?.user?._id || body?.user?.id || body?._id || "";
-            resolve({ ok: true, botUserId, url: root });
-          } catch (e) {
-            resolve({ ok: true, botUserId: "", url: root });
-          }
-        } else if (res.statusCode === 401 || res.statusCode === 403) {
-          resolve({ ok: false, error: "Token rejected (401/403). Check that it's a valid Kazee bot token." });
-        } else if (res.statusCode === 404) {
-          resolve({ ok: false, error: "GET /api/me returned 404. Check the URL points at your Kazee host (e.g. https://chat.example.com)." });
-        } else {
-          resolve({ ok: false, error: `GET /api/me → HTTP ${res.statusCode}` });
+        let body = null;
+        try { body = chunks ? JSON.parse(chunks) : null; } catch (e) { body = null; }
+
+        if (res.statusCode < 200 || res.statusCode >= 300) {
+          const detail = body && body.error ? `: ${body.error}` : "";
+          return resolve({ ok: false, error: `Central rejected the token (HTTP ${res.statusCode})${detail}. Check the bot token.` });
+        }
+        if (!body || !body.success || !body.valid || !body.principal) {
+          const detail = body && body.error ? `: ${body.error}` : "";
+          return resolve({ ok: false, error: `Token not valid${detail}. Paste a current Kazee bot token.` });
+        }
+        const p = body.principal;
+        if (p.kind !== "Bot") {
+          return resolve({ ok: false, error: `That token is a ${p.kind || "non-bot"} principal, not a bot. Paste a bot token (kzb_…).` });
         }
+        const botUserId = String(p.id || p._id || p.userId || "");
+        const botName = p.name || [p.firstName, p.lastName].filter(Boolean).join(" ") || "";
+        resolve({ ok: true, url: root, botUserId, botName });
       });
     });
     req.on("error", (e) => resolve({ ok: false, error: e.message }));
-    req.setTimeout(15000, () => req.destroy(new Error("Timed out after 15s")));
+    req.setTimeout(15000, () => req.destroy(new Error("Central verify timed out after 15s")));
+    req.write(payload);
     req.end();
   });
 }
 
-module.exports = { validateKazee, normalizeKazeeRoot };
+module.exports = { validateKazee, normalizeKazeeRoot, CENTRAL_DEFAULT_URL };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inetafrica/open-claudia",
-  "version": "2.14.1",
+  "version": "2.14.2",
   "description": "Your always-on AI coding assistant — Claude Code, Cursor Agent, and OpenAI Codex via Telegram or Kazee Chat",
   "main": "bot.js",
   "bin": {

package/setup.js

@@ -681,7 +681,7 @@ async function main() {
       while (true) {
         const token = (await ask("  Kazee bot token: ")).trim();
         if (!token) { console.log("  Empty token."); continue; }
-        console.log("  Validating against Kazee /api/me…");
+        console.log("  Verifying the bot token…");
         const check = await validateKazee({ url, token });
         if (!check.ok) {
           console.log(`  Validation failed: ${check.error}`);
@@ -689,6 +689,7 @@ async function main() {
           if (retry.toLowerCase() === "n") break;
           continue;
         }
+        if (check.botName) console.log(`  Verified as ${check.botName}.`);
         const ownerUserId = (await ask("  Kazee owner user id (blank to skip): ")).trim();
         state.data.kazee = { url: check.url || url.replace(/\/+$/, ""), token, ownerUserId, botUserId: check.botUserId || "" };
         console.log("  Kazee channel configured.");