@inetafrica/open-claudia 2.2.12 → 2.2.13

package/CHANGELOG.md

@@ -1,5 +1,8 @@
 # Changelog
 
+## v2.2.13
+- **Security fix**: `intro-flow.handleInbound` no longer auto-claims ownership on *any* first inbound message. Previously, if `people.json` had no owner record (fresh pod / fresh install), the very first inbound — including a `/start` tap from a t.me deep-link — would register the sender as the bot owner. In AgentSpace pods this meant anyone who guessed or was sent the bot username could take over a pod simply by clicking Start. The bootstrap path now requires either (a) pod mode (`AGENTSPACE_POD_TOKEN` set) with the inbound chat id pre-seeded in `TELEGRAM_CHAT_ID` env, or (b) local mode with the inbound message literally starting with `/auth`. Anything else gets a "no owner configured" reply and an `intro.bootstrap-refused` audit entry. Existing owner records are unaffected. Follow-up work needed in the AgentSpace backend provisioner to seed `TELEGRAM_CHAT_ID` at pod creation time from the provisioning user's Telegram chat id; until that lands, new pods will refuse all inbound until an operator manually seeds the env.
+
 ## v2.2.12
 - Cross-channel relay (`open-claudia send-to`, and by extension cron/wakeup-fired messages and any other caller of `relay.send`) now passes `parseMode: "Markdown"` when the resolved adapter is Telegram. Previously `relay.send` called `adapter.send(channelId, text)` with no opts, so the Telegram adapter never set `parse_mode` and every relayed message went out as plain text — `*bold*`, backticks, and `_italic_` rendered as literal characters. The main reply path already injected this via `core/runner.js:25-28`; relay was the missing twin. Non-telegram adapters are unaffected.
 

package/core/intro-flow.js

@@ -112,11 +112,32 @@ async function handleInbound(envelope, sendFn) {
       people.seedOwnerFromLegacy();
     }
     if (!people.hasOwnerRecord()) {
+      // No owner record yet. Two failure modes we are guarding against:
+      //   (a) AgentSpace pods: random Telegram users finding the bot username
+      //       and auto-claiming ownership just by sending /start.
+      //   (b) Local installs: any inbound (button taps, joins, automated
+      //       crawls) claiming ownership before the actual operator messages.
+      // Pod mode: only chat ids pre-seeded into TELEGRAM_CHAT_ID may claim.
+      // Local mode: only an explicit "/auth" message may claim.
+      const podMode = !!process.env.AGENTSPACE_POD_TOKEN;
+      const allowedChatIds = String(process.env.TELEGRAM_CHAT_ID || "")
+        .split(",").map((s) => s.trim()).filter(Boolean);
+      if (podMode) {
+        if (allowedChatIds.length === 0 || !allowedChatIds.includes(String(channelId))) {
+          await sendFn("This bot has no owner configured yet. The AgentSpace operator needs to seed the owner chat id before the bot can be used.");
+          audit.log("intro.bootstrap-refused", { reason: "pod-mode-not-preseeded", adapter, channelId });
+          return true;
+        }
+      } else if (!/^\/auth\b/i.test(text)) {
+        await sendFn("This bot has no owner yet. Send /auth from the operator's chat to claim ownership.");
+        audit.log("intro.bootstrap-refused", { reason: "local-mode-non-auth-message", adapter, channelId });
+        return true;
+      }
       const displayName = displayNameFromEnvelope(envelope) || "Owner";
-      const person = people.add({ name: displayName, isOwner: true, bio: "Auto-registered on first message" });
+      const person = people.add({ name: displayName, isOwner: true, bio: "Auto-registered as bootstrap owner" });
       try { people.linkHandle(person.id, { adapter, channelId, displayName, approvedBy: "bootstrap" }); } catch (e) {}
       try { bootstrapOwner({ chatId: channelId, name: displayName, username: usernameFromEnvelope(envelope) }); } catch (e) {}
-      audit.log("people.bootstrap-owner", { personId: person.id, adapter, channelId });
+      audit.log("people.bootstrap-owner", { personId: person.id, adapter, channelId, mode: podMode ? "pod" : "local" });
       await sendFn(`Welcome, ${displayName}. You're registered as the bot owner. Send /start to begin.`);
       return true;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inetafrica/open-claudia",
-  "version": "2.2.12",
+  "version": "2.2.13",
   "description": "Your always-on AI coding assistant — Claude Code, Cursor Agent, and OpenAI Codex via Telegram or Kazee Chat",
   "main": "bot.js",
   "bin": {