@inetafrica/open-claudia 2.14.8 → 3.0.0

package/setup.js

@@ -8,6 +8,12 @@ const crypto = require("crypto");
 const { execSync } = require("child_process");
 const Vault = require("./vault");
 const CONFIG_DIR = require("./config-dir");
+const { ensureConfigDir } = require("./core/config-dir");
+const { atomicWriteFileSync } = require("./core/fsutil");
+const { inspectProviderConfiguration } = require("./core/provider-status");
+const { ProviderRegistry } = require("./core/providers");
+const { createClaudeProvider } = require("./core/providers/claude");
+const { createCodexProvider } = require("./core/providers/codex");
 
 const ENV_FILE = path.join(CONFIG_DIR, ".env");
 const VAULT_FILE = path.join(CONFIG_DIR, "vault.enc");
@@ -16,8 +22,12 @@ const CRONS_FILE = path.join(CONFIG_DIR, "crons.json");
 const AUTH_FILE = path.join(CONFIG_DIR, "auth.json");
 const SETUP_STATE_FILE = path.join(CONFIG_DIR, ".setup-state.json");
 
-const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-const ask = (q) => new Promise((r) => rl.question(q, r));
+let rl = null;
+function promptInterface() {
+  if (!rl) rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  return rl;
+}
+const ask = (q) => new Promise((r) => promptInterface().question(q, r));
 
 // ── Auth file helpers ──────────────────────────────────────────────
 
@@ -29,7 +39,7 @@ function loadAuth() {
 }
 
 function saveAuth(auth) {
-  fs.writeFileSync(AUTH_FILE, JSON.stringify(auth, null, 2));
+  atomicWriteFileSync(AUTH_FILE, JSON.stringify(auth, null, 2), { backup: true, mode: 0o600 });
 }
 
 // ── Setup state helpers ────────────────────────────────────────────
@@ -42,13 +52,25 @@ function loadSetupState() {
 }
 
 function saveSetupState(state) {
-  fs.writeFileSync(SETUP_STATE_FILE, JSON.stringify(state, null, 2));
+  atomicWriteFileSync(SETUP_STATE_FILE, JSON.stringify(state, null, 2), { backup: true, mode: 0o600 });
 }
 
 function clearSetupState() {
   if (fs.existsSync(SETUP_STATE_FILE)) fs.unlinkSync(SETUP_STATE_FILE);
 }
 
+function upgradeSetupState(value) {
+  const state = value && typeof value === "object"
+    ? { ...value, completedSteps: [...(value.completedSteps || [])], data: { ...(value.data || {}) } }
+    : { completedSteps: [], data: {} };
+  if (state.completedSteps.includes("prerequisites")
+    && (!Object.prototype.hasOwnProperty.call(state.data, "codexPath")
+      || !Object.prototype.hasOwnProperty.call(state.data, "defaultProvider"))) {
+    state.completedSteps = state.completedSteps.filter((step) => step !== "prerequisites");
+  }
+  return state;
+}
+
 // ── Telegram helpers ───────────────────────────────────────────────
 
 function telegramGet(token, method, params = "") {
@@ -147,9 +169,56 @@ function findBinary(name) {
 }
 
 function findClaude() { return findBinary("claude"); }
+function findCodex() { return findBinary("codex"); }
 function findWhisper() { return findBinary("whisper-cli"); }
 function findFfmpeg() { return findBinary("ffmpeg"); }
 
+function inspectProviderSetup(options = {}) {
+  if (!options.paths) return inspectProviderConfiguration(options);
+  const resolved = {};
+  for (const providerId of ["claude", "codex"]) {
+    const value = String(options.paths[providerId] || "").trim();
+    if (!value) {
+      resolved[providerId] = null;
+      continue;
+    }
+    try {
+      fs.accessSync(value, fs.constants.X_OK);
+      resolved[providerId] = path.resolve(value);
+    } catch (_) {
+      resolved[providerId] = null;
+    }
+  }
+  const registry = new ProviderRegistry({ defaultProvider: options.defaultProvider || null });
+  registry.registerProvider(createClaudeProvider({ resolveExecutable: () => resolved.claude }));
+  registry.registerProvider(createCodexProvider({ resolveExecutable: () => resolved.codex }));
+  return inspectProviderConfiguration({
+    ...options,
+    registry,
+    executableStatus(providerId) {
+      const configured = String(options.paths[providerId] || "").trim();
+      if (resolved[providerId]) {
+        return { state: "available", executable: resolved[providerId], configured: true, reason: null };
+      }
+      return {
+        state: configured ? "missing" : "unconfigured",
+        executable: null,
+        configured: !!configured,
+        reason: configured
+          ? `Configured ${providerId} executable was not found`
+          : `${providerId} is not configured or installed`,
+      };
+    },
+  });
+}
+
+function providerStatusLine(provider) {
+  const availability = provider.availability.state;
+  if (availability !== "available") return `${provider.label}: ${availability}`;
+  const version = provider.compatibility.version ? ` ${provider.compatibility.version}` : "";
+  return `${provider.label}: ${provider.compatibility.state}${version}; auth ${provider.auth.state}`;
+}
+
 function findWhisperModel() {
   const candidates = [
     "/opt/homebrew/share/whisper-cpp/models/ggml-base.en.bin",
@@ -285,7 +354,7 @@ async function setupDaemon(platform) {
     const serviceName = "claude-telegram-bot";
     const serviceFile = `/etc/systemd/system/${serviceName}.service`;
     const unit = `[Unit]
-Description=Claude Code Telegram Bot
+Description=Open Claudia Provider Bot
 After=network.target
 
 [Service]
@@ -483,7 +552,7 @@ function updateEnvKey(key, value) {
     return line;
   });
   if (!found) updated.push(`${key}=${value}`);
-  fs.writeFileSync(ENV_FILE, updated.join("\n"));
+  atomicWriteFileSync(ENV_FILE, updated.join("\n"), { backup: true, mode: 0o600 });
 }
 
 // ── Main setup (resumable) ─────────────────────────────────────────
@@ -497,6 +566,7 @@ const { validateKazee } = require("./core/kazee-probe");
 const KAZEE_DEFAULT_URL = "https://chat.inet.africa";
 
 async function main() {
+  ensureConfigDir(CONFIG_DIR);
   // Check if this is an auth subcommand
   const args = process.argv.slice(2);
   if (args.includes("--auth") || args.includes("auth")) {
@@ -504,10 +574,12 @@ async function main() {
     return;
   }
 
-  console.log("\n  Claude Code Telegram Bot — Setup\n");
+  console.log("\n  Open Claudia — Setup\n");
 
   // Load or create state
-  let state = loadSetupState() || { completedSteps: [], data: {} };
+  // Resume files from the Claude-only wizard must pass through the provider
+  // step once before the new config keys can be serialized safely.
+  let state = upgradeSetupState(loadSetupState());
   const resuming = state.completedSteps.length > 0;
 
   if (resuming) {
@@ -525,27 +597,71 @@ async function main() {
   if (!state.completedSteps.includes("prerequisites")) {
     console.log("Checking prerequisites...\n");
 
-    const claudePath = findClaude();
-    if (!claudePath) {
-      console.log("  Claude Code CLI not found. Install it first:");
-      console.log("  https://docs.anthropic.com/en/docs/claude-code");
-      process.exit(1);
+    const providerReport = inspectProviderSetup();
+    for (const provider of providerReport.providers) {
+      console.log(`  ${providerStatusLine(provider)}`);
+      if (provider.recovery) console.log(`    Recovery: ${provider.recovery.split("\n")[0]}`);
     }
-    console.log(`  Claude CLI: ${claudePath}`);
+    console.log("");
 
-    try {
-      execSync(`"${claudePath}" -p "say ok" --max-budget-usd 0.01 --output-format text 2>&1`, {
-        encoding: "utf-8", timeout: 30000,
-      });
-      console.log("  Claude auth: OK");
-    } catch (e) {
-      const errMsg = (e.stderr || e.stdout || e.message || "").toLowerCase();
-      if (errMsg.includes("auth") || errMsg.includes("login") || errMsg.includes("api key") || errMsg.includes("unauthorized")) {
-        console.log("  Claude auth: NOT LOGGED IN");
-        console.log("  Run 'claude auth' or 'claude login' to authenticate first.");
-        process.exit(1);
+    const autoProviders = providerReport.providers
+      .filter((provider) => provider.availability.state === "available"
+        && provider.compatibility.state === "compatible")
+      .map((provider) => provider.id);
+    const choice = (await ask("  Providers to configure (auto/claude/codex/both/none) [auto]: "))
+      .trim().toLowerCase() || "auto";
+    const wanted = choice === "none" ? []
+      : choice === "both" ? ["claude", "codex"]
+      : choice === "claude" || choice === "codex" ? [choice]
+      : autoProviders;
+    const detectedById = Object.fromEntries(providerReport.providers.map((provider) => [
+      provider.id,
+      provider.availability.executable || null,
+    ]));
+    const providerPaths = { claude: null, codex: null };
+    for (const providerId of wanted) {
+      let detected = detectedById[providerId]
+        || state.data?.[providerId === "claude" ? "claudePath" : "codexPath"]
+        || (providerId === "claude" ? findClaude() : findCodex());
+      if (!detected) {
+        const envKey = providerId === "claude" ? "CLAUDE_PATH" : "CODEX_PATH";
+        const entered = (await ask(`  ${envKey} (blank to leave unconfigured): `)).trim();
+        if (entered) {
+          try {
+            fs.accessSync(entered, fs.constants.X_OK);
+            detected = path.resolve(entered);
+          } catch (_) {
+            console.log(`  ${entered} is not executable; ${providerId} remains unconfigured.`);
+          }
+        }
+      }
+      providerPaths[providerId] = detected || null;
+    }
+    const finalProviderReport = inspectProviderSetup({ paths: providerPaths });
+    for (const provider of finalProviderReport.providers) {
+      if (provider.availability.state === "available" && provider.compatibility.state !== "compatible") {
+        console.log(`  ${providerStatusLine(provider)}`);
+        if (provider.recovery) console.log(`    Recovery: ${provider.recovery.split("\n")[0]}`);
       }
-      console.log("  Claude auth: OK");
+    }
+    const configuredProviders = finalProviderReport.providers
+      .filter((provider) => provider.availability.state === "available"
+        && provider.compatibility.state === "compatible")
+      .map((provider) => provider.id);
+    let defaultProvider = configuredProviders[0] || null;
+    if (configuredProviders.length > 1) {
+      const reportedDefault = providerReport.defaultProvider.providerId;
+      const suggestedDefault = configuredProviders.includes(reportedDefault)
+        ? reportedDefault
+        : configuredProviders[0];
+      const answer = (await ask(`  Default provider (claude/codex) [${suggestedDefault}]: `))
+        .trim().toLowerCase();
+      const proposed = answer || suggestedDefault;
+      defaultProvider = configuredProviders.includes(proposed) ? proposed : configuredProviders[0];
+    }
+    if (!configuredProviders.length) {
+      console.log("  No model provider configured. Setup, doctor, health, and the web UI will still work;");
+      console.log("  model turns will return NO_AVAILABLE_PROVIDER until Claude Code or OpenAI Codex is configured.\n");
     }
 
     const platform = detectPlatform();
@@ -592,7 +708,9 @@ async function main() {
       }
     }
 
-    state.data.claudePath = claudePath;
+    state.data.claudePath = providerPaths.claude || "";
+    state.data.codexPath = providerPaths.codex || "";
+    state.data.defaultProvider = defaultProvider || "";
     state.data.platform = platform;
     state.data.ffmpegPath = ffmpegPath || "";
     state.data.whisperPath = whisperPath || "";
@@ -648,7 +766,7 @@ async function main() {
 
     // Send confirmation
     console.log("  Sending test message...");
-    const sent = await sendMessage(token, userInfo.chatId, "Setup verified! Your Claude Code bot is connected.");
+    const sent = await sendMessage(token, userInfo.chatId, "Setup verified! Your Open Claudia bot is connected.");
     if (sent) {
       console.log("  Test message sent! Check your Telegram.\n");
     } else {
@@ -747,6 +865,15 @@ async function main() {
       `TELEGRAM_CHAT_ID=${d.chatId}`,
       `WORKSPACE=${d.workspace}`,
       `CLAUDE_PATH=${d.claudePath}`,
+      `CODEX_PATH=${d.codexPath}`,
+      `DEFAULT_PROVIDER=${d.defaultProvider}`,
+      "UTILITY_PROVIDER=active",
+      "PROVIDER_FALLBACKS=",
+      "DREAM_PROVIDER=",
+      "MEMORY_PROVIDER=",
+      "RECALL_PROVIDER=",
+      "ENFORCER_PROVIDER=",
+      "SUBAGENT_PROVIDER=",
       `WHISPER_CLI=${d.whisperPath}`,
       `WHISPER_MODEL=${d.whisperModel}`,
       `FFMPEG=${d.ffmpegPath}`,
@@ -763,9 +890,30 @@ async function main() {
       envLines.push(`KAZEE_BOT_USER_ID=${d.kazee.botUserId || ""}`);
       envLines.push(`KAZEE_OWNER_USER_ID=${d.kazee.ownerUserId || ""}`);
     }
-    const env = envLines.join("\n");
-
-    fs.writeFileSync(ENV_FILE, env);
+    const existingEnv = fs.existsSync(ENV_FILE)
+      ? fs.readFileSync(ENV_FILE, "utf8").split(/\r?\n/).reduce((result, line) => {
+          const index = line.indexOf("=");
+          if (index > 0) result[line.slice(0, index).trim()] = line.slice(index + 1).trim();
+          return result;
+        }, {})
+      : {};
+    const mergedEnv = { ...existingEnv };
+    const preserveExistingPolicy = new Set([
+      "UTILITY_PROVIDER", "PROVIDER_FALLBACKS", "DREAM_PROVIDER", "MEMORY_PROVIDER",
+      "RECALL_PROVIDER", "ENFORCER_PROVIDER", "SUBAGENT_PROVIDER",
+    ]);
+    for (const line of envLines) {
+      const index = line.indexOf("=");
+      const key = line.slice(0, index);
+      const value = line.slice(index + 1);
+      // A resumed/second setup must never erase the other provider's existing
+      // credential/config merely because its prompt was left blank.
+      if (preserveExistingPolicy.has(key) && Object.prototype.hasOwnProperty.call(existingEnv, key)) continue;
+      if (!value && Object.prototype.hasOwnProperty.call(existingEnv, key)) continue;
+      mergedEnv[key] = value;
+    }
+    const env = Object.entries(mergedEnv).map(([key, value]) => `${key}=${value}`).join("\n");
+    atomicWriteFileSync(ENV_FILE, env, { backup: true, mode: 0o600 });
     console.log(`  Config saved: ${ENV_FILE}\n`);
 
     if (!fs.existsSync(CRONS_FILE)) fs.writeFileSync(CRONS_FILE, "[]");
@@ -794,13 +942,25 @@ async function main() {
   // Done — clean up state file
   clearSetupState();
   console.log("\n  Setup complete! Start chatting with your bot in Telegram.\n");
-  rl.close();
+  if (rl) rl.close();
 }
 
 // Allow running auth directly: node setup.js auth
-module.exports = { runAuth, loadAuth, saveAuth, AUTH_FILE };
-
-main().catch((e) => {
-  console.error(e);
-  process.exit(1);
-});
+module.exports = {
+  runAuth,
+  loadAuth,
+  saveAuth,
+  AUTH_FILE,
+  inspectProviderSetup,
+  providerStatusLine,
+  upgradeSetupState,
+  main,
+};
+
+if (require.main === module) {
+  main().catch((e) => {
+    if (rl) rl.close();
+    console.error(e);
+    process.exit(1);
+  });
+}

package/soul.md

@@ -0,0 +1,39 @@
+# Soul
+
+You are Sumeet's personal AI assistant: Open Claudia running the selected coding-agent provider, available 24/7 through his configured chat channels.
+
+## Identity
+- Name: Open Claudia
+- Tone: Direct, concise, technical. Like a sharp senior engineer who's also a good friend.
+- Never over-explain. Sumeet is technical — he gets it.
+- Mobile-first: keep messages short. Send files for anything long.
+
+## About Sumeet
+- Full-stack developer / founder
+- Works across many projects in ~/Workspace
+- Tech stack: Node.js, React/Next.js, MongoDB, Kubernetes, Docker
+- Uses Cursor IDE and Claude Code CLI daily
+- Communicates via Telegram on mobile when away from desk
+
+## Key Projects
+- **crm** — Kazee CRM platform (monorepo: crm-backend, frontend, helpdesk-frontend, spaces-backend, spaces-frontend, workflow-kanban). MongoDB, Node.js backend, Next.js frontends.
+- **metriq / metriq-api** — Metrics/analytics platform
+- **ticket-central** — Ticketing system
+- **hr-hub** — HR management
+- **kazee-connect-subscription-service** — Subscription/billing service
+- **k8s / kubernetes-applications / kazee-infratructure** — Kubernetes deployment configs
+- **janus-devops / janus-webrtc** — WebRTC infrastructure
+
+## Working Style
+- Prefers action over discussion. Do the thing, then explain what you did.
+- Likes plans for big changes, but hates over-planning small ones.
+- Appreciates when you proactively flag issues or suggest improvements.
+- Send files directly via Telegram when output is long.
+
+## What You Can Do
+- Write, edit, and refactor code across all projects
+- Run commands, tests, builds, deployments
+- Send files, images, code snippets directly to Telegram
+- Run scheduled checks and report results
+- Monitor git status, PRs, deployments
+- Help with architecture decisions and code reviews

package/test-ability-extraction.js

@@ -86,6 +86,11 @@ const reused = review.applyAction({
 });
 assert.strictEqual(reused.appliedTo, "chat-mobile", "update records the cross-project reuse");
 assert.deepStrictEqual(packs.readPack("mobile-app-deploy").applied_on, ["spaces", "chat-mobile"], "applied_on grew");
+const abilityFile = path.join(process.env.PACKS_DIR, "mobile-app-deploy", "PACK.md");
+assert.ok(fs.existsSync(`${abilityFile}.bak`), "reviewer writes retain the previous complete pack backup");
+assert.strictEqual(fs.statSync(abilityFile).mode & 0o777, 0o600, "reviewer memory files stay owner-only");
+assert.deepStrictEqual(fs.readdirSync(path.dirname(abilityFile)).filter((name) => name.endsWith(".tmp")), [],
+  "atomic reviewer writes leave no partial temporary file");
 
 graph.syncFromCorpus(packs, entStub);
 edges = graph.allEdges();

package/test-approval-async.js

@@ -7,6 +7,7 @@ const assert = require("assert");
 const fs = require("fs");
 const os = require("os");
 const path = require("path");
+const { spawn } = require("child_process");
 
 const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "approval-async-test-"));
 process.env.APPROVALS_DIR = path.join(tmp, "approvals");
@@ -48,6 +49,30 @@ const approvals = require("./core/approvals");
   assert.strictEqual(replay.ok, false, "second consume refused (single use)");
   assert.ok(/already consumed/.test(replay.reason));
 
+  const concurrent = approvals.create({ tool: "fleet", command: CMD, channelId: "c1", adapter: "tg" });
+  approvals.decide(concurrent.id, "approved", "c1");
+  const consumeInChild = () => new Promise((resolve, reject) => {
+    const source = [
+      `const approvals = require(${JSON.stringify(path.join(__dirname, "core", "approvals.js"))});`,
+      `process.stdout.write(JSON.stringify(approvals.consume(${JSON.stringify(concurrent.id)}, ${JSON.stringify(CMD)})));`,
+    ].join("\n");
+    const child = spawn(process.execPath, ["-e", source], {
+      env: { ...process.env, APPROVALS_DIR: approvals.APPROVALS_DIR },
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+    let stdout = "";
+    let stderr = "";
+    child.stdout.on("data", (chunk) => { stdout += chunk; });
+    child.stderr.on("data", (chunk) => { stderr += chunk; });
+    child.once("error", reject);
+    child.once("close", (code) => {
+      if (code !== 0) reject(new Error(stderr || `approval child exited ${code}`));
+      else resolve(JSON.parse(stdout));
+    });
+  });
+  const concurrentResults = await Promise.all([consumeInChild(), consumeInChild()]);
+  assert.strictEqual(concurrentResults.filter((result) => result.ok).length, 1, "concurrent redemption has exactly one winner");
+
   // ── unknown id fails closed ──
   assert.strictEqual(approvals.consume("apr_nope", CMD).ok, false, "unknown id refused");
 
@@ -62,11 +87,45 @@ const approvals = require("./core/approvals");
   assert.strictEqual(expired.ok, false, "expired token refused");
   assert.ok(/expired/.test(expired.reason));
 
-  // ── long commands: stored payload is capped at 1000 chars and matching respects the cap ──
-  const longCmd = "open-claudia tool run fleet purge " + "x".repeat(1200);
-  const lrec = approvals.create({ tool: "fleet", verb: "purge", tier: "destructive", command: longCmd, channelId: "c1", adapter: "tg" });
+  // ── command binding: the whole visible payload is hashed. Commands too long
+  // to display completely are rejected rather than approving a hidden suffix.
+  const boundCmd = "open-claudia tool run fleet purge " + "x".repeat(400);
+  const lrec = approvals.create({ tool: "fleet", verb: "purge", tier: "destructive", command: boundCmd, channelId: "c1", adapter: "tg" });
+  assert.strictEqual(lrec.command, boundCmd, "the exact approved command is retained");
+  assert.match(lrec.commandHash, /^[a-f0-9]{64}$/, "the approval carries a full-payload digest");
   approvals.decide(lrec.id, "approved", "c1");
-  assert.strictEqual(approvals.consume(lrec.id, longCmd).ok, true, "capped command still matches its own approval");
+  const changedSuffix = `${boundCmd.slice(0, -8)}DIFFERENT`;
+  assert.strictEqual(approvals.consume(lrec.id, changedSuffix).ok, false, "a suffix mismatch is refused");
+  assert.strictEqual(approvals.consume(lrec.id, boundCmd).ok, true, "the full exact command still redeems");
+  assert.throws(
+    () => approvals.create({ tool: "fleet", command: "open-claudia tool run fleet purge " + "x".repeat(1200) }),
+    (error) => error && error.code === "APPROVAL_PAYLOAD_TOO_LARGE",
+    "an approval never hides an undisplayed command suffix",
+  );
+
+  const legacy = approvals.create({ tool: "fleet", command: CMD, channelId: "c1", adapter: "tg" });
+  approvals.decide(legacy.id, "approved", "c1");
+  const legacyFile = path.join(approvals.APPROVALS_DIR, `${legacy.id}.json`);
+  const legacyRecord = JSON.parse(fs.readFileSync(legacyFile, "utf8"));
+  delete legacyRecord.commandHash;
+  fs.writeFileSync(legacyFile, JSON.stringify(legacyRecord));
+  assert.strictEqual(approvals.consume(legacy.id, CMD).ok, true, "safe short pre-hash approvals remain redeemable");
+
+  const unsafeLegacy = approvals.create({ tool: "fleet", command: CMD, channelId: "c1", adapter: "tg" });
+  approvals.decide(unsafeLegacy.id, "approved", "c1");
+  const unsafeLegacyFile = path.join(approvals.APPROVALS_DIR, `${unsafeLegacy.id}.json`);
+  const unsafeLegacyRecord = JSON.parse(fs.readFileSync(unsafeLegacyFile, "utf8"));
+  delete unsafeLegacyRecord.commandHash;
+  unsafeLegacyRecord.command = "x".repeat(600);
+  fs.writeFileSync(unsafeLegacyFile, JSON.stringify(unsafeLegacyRecord));
+  assert.strictEqual(
+    approvals.consume(unsafeLegacy.id, unsafeLegacyRecord.command).ok,
+    false,
+    "legacy approvals with an undisplayed suffix require a fresh decision",
+  );
+
+  const quotedCommand = approvals.formatApprovedCommand(["open-claudia", "tool", "run", "fleet", "purge", "node one", "it's-safe"]);
+  assert.strictEqual(quotedCommand, "open-claudia tool run fleet purge 'node one' 'it'\"'\"'s-safe'");
 
   // ── waitForDecision default fast-path window is 90s (not the old 5 min) ──
   const src = fs.readFileSync(path.join(__dirname, "core", "approvals.js"), "utf-8");