@inetafrica/open-claudia 2.14.7 → 2.14.8

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## v2.14.8
+- **Kazee replies no longer post twice.** On a successful send, the Kazee adapter's `send()` returned the created message's id so the runner can edit its streaming preview in place — but it read only `res.message._id`, then fell back to the ActionHero envelope's numeric `messageId`, then `res._id`. chat-central serves the new message's id under `message.id` on some routes (the adapter's own reply-to fetch already handles `m._id || m.id`), so when only `.id` was present `send()` returned `null`. The final-delivery path in `core/runner.js` reads that return as "did the send fail?": `const sent = await send(firstChunk, { replyTo }); if (!sent) await send(firstChunk);`. A successful-but-idless send therefore looked like a failure and the reply was posted a second time — once as a reply-quote, once as a plain bubble (exactly the pair seen in-chat). `send()` now returns `message._id || message.id` (or the top-level equivalents) and **never** the numeric envelope `messageId` — that counter is a per-request id, not a chat message id, and using it also made later `PUT /message/<counter>` edits 500.
+- **A streaming preview minted on one channel is never edited on another.** Under unified identity the owner's Telegram and Kazee turns share ONE per-canonical state object, and `statusMessageId` (the id of the live "typing…/preview" bubble) sat on it untagged. A Telegram message id (e.g. `24991`) could then be edited under the Kazee adapter → `PUT /message/24991` → *"Cast to ObjectId failed"* 500, a frozen preview, and a duplicate final send. `statusMessageId` now carries the channel it was minted on (`statusMessageChannel`, `core/state.js`); every edit-in-place site in `core/runner.js` (streaming tick + final delivery + the external-hold notice) only edits when the channel matches, otherwise it discards the stale id and sends fresh on the correct channel. Telegram-only deployments are unaffected (single channel → always matches).
+- **Agent-space / OpenClaw:** no new deps, no new env, no schema change; Docker image builds identically. Both are correctness fixes to multi-channel message delivery — the double-send fix helps every Kazee deployment; the channel-scope guard is inert unless a canonical spans two channels. New hermetic test `test-kazee-message-id.js` (id extraction across `_id`/`id`/top-level shapes + the numeric-envelope-counter guard) wired into `npm test`; full suite green.
+
 ## v2.14.7
 - **New `/link remove <key>` — prune a single identity link through the code path, not by hand-editing `identities.json`.** Until now the only identity commands were `/links` (list) and `/link` (create); there was no way to drop a specific channel→canonical mapping. `/channel remove <transport>` clears a whole transport's links, but only when that adapter is currently live (`removeAdapter` bails with *"No adapter …"* otherwise), and it never touches `telegram` entries by design — so a stray or stale link (e.g. a leftover test fixture, or a link whose transport is no longer added) had no clean removal path, and hand-editing the file doesn't stick because `identity.js` loads the map once into a shared in-memory object and re-serializes the whole thing on every write (a disk-only edit is resurrected by the cache). New `identity.removeIdentityMapping(key)` removes one channel key from the in-memory map **then** persists (memory + disk consistent), and prunes the canonical's `preferred`-channel pointer only when that was its last remaining channel. Owner-only; refuses to remove your own configured owner channel (`identity.isConfiguredOwnerChannel` — a live Telegram chat id or Kazee owner id) so you can't accidentally drop yourself out of unified identity — re-point with `/link` instead. `/links` now shows a *"Remove one with /link remove <key>"* hint.
 - **Agent-space / OpenClaw:** no new deps, no new env, no schema change; Docker image builds identically. Purely an owner-driven identity-maintenance command — inert for any deployment that never runs it. New hermetic test `test-identity-prune.js` (last-link pruning + memory/disk consistency + unknown-key no-op) wired into `npm test`; full suite green.

package/channels/kazee/adapter.js

@@ -226,7 +226,22 @@ class KazeeAdapter {
     for (let attempt = 0; attempt < 3; attempt++) {
       try {
         const res = await this._request("POST", `/chat/${encodeURIComponent(channelId)}/message`, body);
-        return res?.message?._id || res?.messageId || res?._id || null;
+        // Return the created chat message's id so callers can edit it in place.
+        // The id can arrive as `_id` (raw Mongo doc) or `id` (serialized) and
+        // may sit on `res.message` or at the top level — mirror the reply-to
+        // fetch which already handles `m._id || m.id`. Never fall back to the
+        // envelope's `messageId`: that's ActionHero's numeric request counter,
+        // not a chat message id, and using it makes later edits 500 (and, when
+        // the real id is missing, a null return double-sends the reply).
+        const m = res?.message || res || {};
+        const id = m._id || m.id;
+        if (id) return String(id);
+        // POST returned 2xx but carried no message id (server fast-ack / payload
+        // fallback path). Returning null makes the caller treat a delivered
+        // reply as a failed send and resend it — the Kazee double-send. Signal
+        // success with a truthy, non-editable sentinel so nothing sends twice.
+        console.error("Kazee send: POST ok but no message id in response keys:", Object.keys(res || {}).join(","));
+        return true;
       } catch (e) {
         const errMsg = e.message || "";
         // Don't retry on client errors (4xx) — they won't self-heal.

package/core/runner.js

@@ -789,6 +789,13 @@ async function runClaude(prompt, cwd, replyToMsgId, opts = {}) {
   const channelId = currentChannelId();
   const adapter = currentAdapter();
   const { settings } = state;
+  // A streaming status/preview message id is only editable on the channel it
+  // was minted on. Under unified identity the owner's Telegram + Kazee turns
+  // share one per-canonical state object, so a message id minted on one channel
+  // must never be used as an edit target under the other adapter (Telegram int
+  // vs Kazee ObjectId → PUT /message/<id> 500s). Also rejects the non-string
+  // "sent, no id" sentinel a socket adapter returns, so we edit only real ids.
+  const canEditStatus = () => typeof state.statusMessageId === "string" && state.statusMessageChannel === channelId;
   // Owner-vs-external, resolved once per turn. All internal-activity chatter
   // (recall banners, tool/skill traces, usage alerts) is owner-only so nothing
   // about how the assistant works leaks to an external speaker.
@@ -861,6 +868,7 @@ async function runClaude(prompt, cwd, replyToMsgId, opts = {}) {
   state.cancelRequested = false;
   startTyping();
   state.statusMessageId = null;
+  state.statusMessageChannel = null;
   state.streamBuffer = "";
   let assistantText = "";
 
@@ -1236,9 +1244,17 @@ async function runClaude(prompt, cwd, replyToMsgId, opts = {}) {
       // vetted and delivered.
       const display = formatProgress(guardedTurn ? "" : assistantText, toolUses, currentTool, elapsed, currentToolDetail);
       if (display && display !== lastUpdate) {
+        // A statusMessageId minted on another channel (shared per-canonical
+        // state under unified identity) can't be edited here — drop it so a
+        // fresh preview is created on this channel instead of 500-ing.
+        if (state.statusMessageId && state.statusMessageChannel !== channelId) {
+          state.statusMessageId = null;
+          state.statusMessageChannel = null;
+        }
         if (!state.statusMessageId && assistantText) {
           state.statusMessageId = await send(display.length > 4000 ? display.slice(-4000) : display, telegramHtmlOpts({ replyTo: replyToMsgId }));
-        } else if (state.statusMessageId) {
+          state.statusMessageChannel = channelId;
+        } else if (canEditStatus()) {
           await editMessage(state.statusMessageId, display.length > 4000 ? display.slice(-4000) : display, telegramHtmlOpts({ streaming: true }));
         }
         lastUpdate = display;
@@ -1474,7 +1490,7 @@ async function runClaude(prompt, cwd, replyToMsgId, opts = {}) {
       const finalText = redactSensitive(assistantText || "(no output)");
       appendProjectTranscript("assistant", finalText, {
         exitCode: code,
-        sourceMessageId: state.statusMessageId || null,
+        sourceMessageId: typeof state.statusMessageId === "string" ? state.statusMessageId : null,
       }, state, getActiveSessionId);
 
       // Phase 3 (3.3): vet the outbound reply for external speakers. Owner/no-
@@ -1504,8 +1520,11 @@ async function runClaude(prompt, cwd, replyToMsgId, opts = {}) {
         // external now. Clear the voice-input flag so it can't leak into the
         // next turn (no TTS flush runs on this path).
         state.lastInputWasVoice = false;
-        if (state.statusMessageId) { try { await editMessage(state.statusMessageId, "Checking with the owner…", telegramHtmlOpts()); } catch (e) {} }
-      } else if (state.statusMessageId && chunks.length === 1) {
+        if (canEditStatus()) { try { await editMessage(state.statusMessageId, "Checking with the owner…", telegramHtmlOpts()); } catch (e) {} }
+      } else if (canEditStatus() && chunks.length === 1) {
+        // Edit the streaming preview into the final reply — but only if that
+        // preview was minted on THIS channel. A foreign-channel id falls through
+        // to a fresh send below (never edited cross-channel, which would 500).
         await editMessage(state.statusMessageId, firstChunk, telegramHtmlOpts({ streaming: true }));
       } else {
         const sent = await send(firstChunk, telegramHtmlOpts({ replyTo: replyToMsgId }));

package/core/state.js

@@ -69,6 +69,12 @@ function createUserState(userId) {
     cancelRequested: false,
     typingHeartbeat: null,
     statusMessageId: null,
+    // Channel the statusMessageId was minted on. Under unified identity the
+    // owner's Telegram + Kazee turns share ONE state object, but a message id
+    // is only valid on the channel that created it — editing a Telegram id on
+    // Kazee 500s. Guard every edit-in-place against this so a foreign-channel
+    // id is discarded (fresh send) instead of edited.
+    statusMessageChannel: null,
     streamBuffer: "",
     streamInterval: null,
     lastSessionId: saved.lastSessionId || null,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inetafrica/open-claudia",
-  "version": "2.14.7",
+  "version": "2.14.8",
   "description": "Your always-on AI coding assistant — Claude Code, Cursor Agent, and OpenAI Codex via Telegram or Kazee Chat",
   "main": "bot.js",
   "bin": {
@@ -9,7 +9,7 @@
   "scripts": {
     "setup": "node setup.js",
     "start": "node bot.js",
-    "test": "OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node -e \"require('./vault'); console.log('OK')\" && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-runner-watchdog-static.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-usage-accounting.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-recall-engine.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-recall-graph.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-recall-discoverer.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-project-transcripts-smoke.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-abilities.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-ability-extraction.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-ability-couse.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-ability-transfer.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-ability-tiers.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-ability-merge-guard.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-learning-e2e.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-pack-nesting.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-journal-dedupe.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-read-signal.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-tools.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-tool-graph.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-tool-guard.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-tooling-mode.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-tool-manifest.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-recall-evolution.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-approval-async.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-unified-identity.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-queue-routing.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-persona-packs.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-speaker-persona.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-persona-pipeline.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-recall-relationship-gate.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-relationship.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-enforcer.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-identity-prune.js"
+    "test": "OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node -e \"require('./vault'); console.log('OK')\" && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-runner-watchdog-static.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-usage-accounting.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-recall-engine.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-recall-graph.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-recall-discoverer.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-project-transcripts-smoke.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-abilities.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-ability-extraction.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-ability-couse.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-ability-transfer.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-ability-tiers.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-ability-merge-guard.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-learning-e2e.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-pack-nesting.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-journal-dedupe.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-read-signal.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-tools.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-tool-graph.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-tool-guard.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-tooling-mode.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-tool-manifest.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-recall-evolution.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-approval-async.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-unified-identity.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-queue-routing.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-persona-packs.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-speaker-persona.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-persona-pipeline.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-recall-relationship-gate.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-relationship.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-enforcer.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-identity-prune.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-kazee-message-id.js"
   },
   "files": [
     "bot.js",
@@ -60,7 +60,8 @@
     "test-recall-relationship-gate.js",
     "test-relationship.js",
     "test-enforcer.js",
-    "test-identity-prune.js"
+    "test-identity-prune.js",
+    "test-kazee-message-id.js"
   ],
   "keywords": [
     "claude",

package/test-kazee-message-id.js

@@ -0,0 +1,98 @@
+// Kazee adapter send() must return the created chat message's id so the runner
+// can edit the streaming preview in place. Regression guard for the double-send
+// bug: when send() returned null on a *successful* POST (because the id sat at
+// `message.id` rather than `message._id`), runner.js's `if (!sent) send()`
+// fallback fired and posted the reply twice. It must also NEVER return the
+// ActionHero envelope's numeric `messageId` (a per-request counter, not a chat
+// id) — doing so made later PUT /message/<counter> edits 500.
+//
+// Hermetic: temp HOME so requiring core/config + core/identity never reads the
+// real config. Stub _request so no network/socket is touched.
+
+const fs = require("fs");
+const path = require("path");
+const os = require("os");
+const assert = require("assert");
+
+const REPO = __dirname;
+const HOME = fs.mkdtempSync(path.join(os.tmpdir(), "oc-kzid-"));
+const CFG = path.join(HOME, ".open-claudia");
+fs.mkdirSync(CFG, { recursive: true });
+fs.writeFileSync(path.join(CFG, ".env"), [
+  `WORKSPACE=${path.join(HOME, "ws")}`,
+  `CLAUDE_PATH=${process.execPath}`,
+  `TELEGRAM_BOT_TOKEN=dummy`,
+  `TELEGRAM_CHAT_ID=6251055967`,
+  ``,
+].join("\n"));
+process.env.HOME = HOME;
+
+const { KazeeAdapter } = require(path.join(REPO, "channels/kazee/adapter"));
+
+function makeAdapter() {
+  return new KazeeAdapter({ id: "kazee", url: "http://test.invalid", token: "t", botUserId: "bot1" });
+}
+
+// Drive send() against a canned _request response and return the resolved id.
+async function sendWith(res) {
+  const a = makeAdapter();
+  a._request = async () => res;
+  return a.send("room1", "hello", {});
+}
+
+// Drive send() against a _request that throws (genuine transport failure).
+async function sendFailing() {
+  const a = makeAdapter();
+  a._request = async () => { throw new Error("Kazee POST /chat/x/message → 404: boom"); };
+  return a.send("room1", "hello", {});
+}
+
+(async () => {
+  const OID = "6a4fbe7008ae07aaf42b36da"; // Mongo ObjectId shape
+
+  // Raw Mongo doc: id under message._id.
+  assert.strictEqual(await sendWith({ success: true, message: { _id: OID } }), OID, "message._id");
+
+  // Serialized doc: id under message.id (the previously-broken case that
+  // returned null → double-send).
+  assert.strictEqual(await sendWith({ success: true, message: { id: OID } }), OID, "message.id");
+
+  // Top-level id variants (defensive; some routes flatten).
+  assert.strictEqual(await sendWith({ _id: OID }), OID, "top-level _id");
+  assert.strictEqual(await sendWith({ id: OID }), OID, "top-level id");
+
+  // Real ids must come back as strings (so the runner's `typeof === "string"`
+  // editability guard treats them as editable targets).
+  assert.strictEqual(typeof (await sendWith({ message: { _id: OID } })), "string", "real id is a string");
+
+  // The ActionHero envelope's numeric request counter must NEVER be used as a
+  // chat message id — that is exactly what produced PUT /message/24991 → 500.
+  // With no real id present the call is still a *successful* send, so it must
+  // resolve to the truthy sentinel (not 24991, and crucially not a falsy null
+  // that would make the runner resend and double-post the reply).
+  assert.strictEqual(
+    await sendWith({ success: true, message: {}, messageId: 24991 }),
+    true,
+    "numeric envelope messageId is never the id; idless success → sentinel true",
+  );
+
+  // Genuinely idless success → truthy sentinel, NOT null. A null here is the
+  // root cause of the double-send: send() succeeded (message delivered) but the
+  // caller reads null as "failed" and resends. The sentinel is non-string so it
+  // is never used as an edit target.
+  assert.strictEqual(await sendWith({ success: true }), true, "idless success → sentinel true");
+  assert.strictEqual(await sendWith({}), true, "empty-body success → sentinel true");
+  assert.strictEqual(typeof (await sendWith({ success: true })), "boolean", "sentinel is non-string (not editable)");
+
+  // A genuine transport failure (throw / non-2xx) must still return null so the
+  // caller CAN fall back to a plain resend — that path is correct, only the
+  // success-without-id path was double-sending.
+  assert.strictEqual(await sendFailing(), null, "real failure → null");
+
+  fs.rmSync(HOME, { recursive: true, force: true });
+  console.log("kazee-message-id OK");
+})().catch((e) => {
+  try { fs.rmSync(HOME, { recursive: true, force: true }); } catch (_) {}
+  console.error(e);
+  process.exit(1);
+});