@inetafrica/open-claudia 2.9.3 → 2.10.0

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## v2.10.0
+- **Unified multi-channel identity — foundation, gated OFF by default (Phase 0).** An owned bot is meant to be one mind across every channel its owner reaches it on; today it split-brains because conversation state (session, transcript, run-lock, queue) is keyed per `transport:channelId`, so an unlinked channel (voice bridge, a stray Kazee DM) becomes a separate assistant with its own history. This release lands the identity-resolution foundation behind a single flag, `OC_UNIFIED_IDENTITY` (default **off**). **With the flag off nothing changes** — every new code path is gated, so publishing this version is behaviourally identical to v2.9.3 until an operator sets `OC_UNIFIED_IDENTITY=1` and restarts. Boot log now prints `Unified identity: on|off` for visibility.
+- **Resolution seam (0.1).** `identity.canonicalForChannel` — the single chokepoint every adapter (Telegram/Kazee/voice) routes through — gains a flag-gated branch: a *configured owner channel* (one whose `transport:channelId` matches an operator-declared owner id — a `TELEGRAM_CHAT_ID`, `KAZEE_OWNER_USER_ID`, or `VOICE_OWNER_USER_ID`) with no explicit `/link` now resolves to the single owner canonical (the owner's first-linked handle, matching `people.linkHandle`'s primary convention). Because it's the one seam, state/transcript/scheduler all unify downstream for free. Owner detection uses only trusted, operator-set signals — never a guess — so a stranger's channel can never be merged by mistake (verified: a non-owner channel still resolves to its own default bucket).
+- **One-time owner-state merge (0.2).** The first inbound message from a configured owner channel that was previously siloed folds that channel's pre-existing state + sessions into the owner's canonical bucket (`state.autoLinkOwnerChannel`, called from the router before any state is read). The merge is **non-destructive** (it folds, never overwrites), **idempotent** (in-memory guard plus a naturally-no-op re-migrate once the source is gone — safe across restarts), and **backs up** `state.json`/`sessions.json`/`identities.json` to `~/.open-claudia/backups/` before touching anything. It deliberately does **not** write into `identities.json`, so turning the flag back off cleanly reverts routing while the already-merged history stays with the owner.
+- **Agent-space / OpenClaw ready.** No new dependencies, no new native modules, and no new *required* env or files — the Docker `:latest` image and the npm package build and run exactly as before with the flag off, so existing single-user deployments are unaffected and the multi-user owned-agent rollout can flip the flag per-deployment when ready. New `test-unified-identity.js` (wired into `npm test`) proves both flag states in isolated child processes: flag-off byte-identical resolution + inert auto-link; flag-on unification, stranger isolation, and the merge (result, idempotence, buckets folded, sessions preserved, backups written).
+- **Explicitly deferred (not shipped hot):** the unified serialized-queue reply-routing fix (when the owner sends from two channels *simultaneously* under the flag, a queued message currently drains in the finishing turn's origin scope — Phase 1), per-person persona packs (Phase 2), and the independent external-speaker guardrail/enforcer (Phase 3). The flag stays off until at least the Phase 1 queue-scope fix lands, so none of these are live-exposed.
+
 ## v2.9.3
 - **Bot advertises a distinct "thinking" state before its first token (Kazee parity Phase 2).** The typing pipeline now carries an additive `state` discriminator (`'thinking' | 'typing'`) — no new socket event. The runner advertises `thinking` from the moment a turn starts until the first stream event (text delta, assistant content, tool call, or result), then flips to plain `typing`; Kazee clients render "<name> is thinking…" in the header/chat-list for that pre-token window and fall back to normal typing text otherwise. The Telegram adapter ignores `state` (its chat action has no such distinction), so the change is inert there. Pairs with the chat-central `message:interactiveUpdated` broadcast (server-authoritative button selection) landing in the same release across chat-central/web/mobile.
 - **Ships the v2.9.2 work that never published.** v2.9.2 (Kazee REST media fallback when a socket send lacks a media path, plus an explicit `typing:stop` on turn end) was committed to main but no tag was ever pushed, so CI never published it. This tag carries it to npm alongside the thinking-state change.

package/bot.js

@@ -203,6 +203,7 @@ setInterval(checkForUpdates, 5 * 60 * 1000);
   console.log(`Soul: ${SOUL_FILE}`);
   console.log(`Vault: ${VAULT_FILE} (${vault.exists() ? "exists" : "not created"})`);
   console.log(`Onboarded: ${isOnboarded()}`);
+  console.log(`Unified identity: ${require("./core/config").UNIFIED_IDENTITY ? "ON" : "off"}`);
 
   // Notify owner that bot is back online via every adapter that knows
   // an owner channel. Kazee skipped: ownerUserId is a user id, not a

package/core/config.js

@@ -94,6 +94,11 @@ const DEFAULT_CLAUDE_MODEL = config.CLAUDE_MODEL || process.env.CLAUDE_MODEL ||
 const AUTO_COMPACT_TOKENS = parseInt(config.AUTO_COMPACT_TOKENS || process.env.AUTO_COMPACT_TOKENS || "380000", 10);
 const MIN_COMPACT_INTERVAL_MS = parseInt(config.MIN_COMPACT_INTERVAL_MS || process.env.MIN_COMPACT_INTERVAL_MS || "1800000", 10);
 const PROJECT_TRANSCRIPTS = configTruthy(config.PROJECT_TRANSCRIPTS || process.env.PROJECT_TRANSCRIPTS, true);
+// Unified multi-channel identity (Phase 0). Default OFF: when unset the bot
+// behaves exactly as before — every code path added for unification is gated
+// on this flag, so publishing is behaviourally inert until an operator flips
+// OC_UNIFIED_IDENTITY=1 in .env and restarts.
+const UNIFIED_IDENTITY = configTruthy(config.OC_UNIFIED_IDENTITY || process.env.OC_UNIFIED_IDENTITY, false);
 const TRANSCRIPT_MAX_ENTRY_CHARS = parseInt(config.TRANSCRIPT_MAX_ENTRY_CHARS || process.env.TRANSCRIPT_MAX_ENTRY_CHARS || "12000", 10);
 const TRANSCRIPTS_DIR = config.TRANSCRIPTS_DIR || process.env.TRANSCRIPTS_DIR || path.join(CONFIG_DIR, "transcripts");
 const WHISPER_CLI = config.WHISPER_CLI || "";
@@ -245,6 +250,7 @@ module.exports = {
   AUTO_COMPACT_TOKENS,
   MIN_COMPACT_INTERVAL_MS,
   PROJECT_TRANSCRIPTS,
+  UNIFIED_IDENTITY,
   TRANSCRIPT_MAX_ENTRY_CHARS,
   TRANSCRIPTS_DIR,
   WHISPER_CLI, WHISPER_MODEL, FFMPEG,

package/core/identity.js

@@ -36,9 +36,55 @@ function saveIdentities() {
   try { fs.writeFileSync(IDENTITIES_FILE, JSON.stringify(identities, null, 2)); } catch (e) {}
 }
 
+// A channel is a "configured owner channel" when its (transport, channelId)
+// matches an owner identifier the operator set in .env — a telegram chat id,
+// the Kazee owner user id, or the voice-bridge owner id. These are trusted,
+// operator-declared signals (never guesses), so unifying them into the owner's
+// canonical bucket cannot merge a stranger's state by mistake.
+function isConfiguredOwnerChannel(transport, channelId) {
+  const t = String(transport || "").toLowerCase();
+  const c = String(channelId || "");
+  if (!c) return false;
+  let cfg;
+  try { cfg = require("./config"); } catch (e) { return false; }
+  if (t === "telegram") return (cfg.CHAT_IDS || []).map(String).includes(c);
+  if (t === "kazee") return !!cfg.config.KAZEE_OWNER_USER_ID && c === String(cfg.config.KAZEE_OWNER_USER_ID);
+  if (t === "voice") return c === String(cfg.config.VOICE_OWNER_USER_ID || "voice-owner");
+  return false;
+}
+
+// The owner's single stable canonical id = their first-linked handle's
+// canonical (matching people.linkHandle's primary convention), falling back to
+// the legacy telegram bootstrap id. Lazy + guarded so an early or partial
+// people-module load during boot degrades to the telegram fallback rather than
+// throwing on the identity-resolution hot path.
+function ownerCanonical() {
+  try {
+    const people = require("./people");
+    const owner = (people.owners() || [])[0];
+    const h = owner && Array.isArray(owner.handles) ? owner.handles[0] : null;
+    if (h) return normalizeCanonicalUserId(h.canonicalUserId || defaultCanonicalForChannel(h.adapter, h.channelId));
+  } catch (e) {}
+  try { const { CHAT_ID } = require("./config"); return defaultCanonicalForChannel("telegram", CHAT_ID || ""); } catch (e) {}
+  return "";
+}
+
 function canonicalForChannel(transport, channelId) {
   const key = channelKey(transport, channelId);
-  return normalizeCanonicalUserId(identities.channels[key]) || defaultCanonicalForChannel(transport, channelId);
+  const explicit = normalizeCanonicalUserId(identities.channels[key]);
+  if (explicit) return explicit;
+  // Flag-gated (Phase 0): a configured owner channel with no explicit /link
+  // still resolves to the single owner canonical, so all of the owner's
+  // channels share one brain without a manual link. Flag OFF ⇒ byte-identical
+  // to prior behaviour (returns the default `transport:channelId`).
+  try {
+    const { UNIFIED_IDENTITY } = require("./config");
+    if (UNIFIED_IDENTITY && isConfiguredOwnerChannel(transport, channelId)) {
+      const owner = ownerCanonical();
+      if (owner) return owner;
+    }
+  } catch (e) {}
+  return defaultCanonicalForChannel(transport, channelId);
 }
 
 function canonicalForTelegram(chatId) {
@@ -79,6 +125,8 @@ module.exports = {
   normalizeCanonicalUserId,
   channelKey,
   defaultCanonicalForChannel,
+  isConfiguredOwnerChannel,
+  ownerCanonical,
   canonicalForChannel,
   canonicalForTelegram,
   canonicalForStoredUserKey,

package/core/router.js

@@ -10,7 +10,7 @@ const { handleAction } = require("./actions");
 const { isChatAuthorized } = require("./access");
 const introFlow = require("./intro-flow");
 const { send, deleteMessage } = require("./io");
-const { currentState } = require("./state");
+const { currentState, autoLinkOwnerChannel } = require("./state");
 const { runClaude } = require("./runner");
 const { transcribeAudio } = require("./media");
 const { vault } = require("./vault-store");
@@ -55,6 +55,11 @@ function scope(envelope, fn) {
 async function onMessage(envelope) {
   return scope(envelope, async () => {
     try {
+      // Phase 0 unified identity (flag-gated; a no-op when the flag is off):
+      // fold a configured owner channel's pre-existing siloed state into the
+      // owner's canonical bucket on first contact, before any state is read.
+      try { autoLinkOwnerChannel(envelope.adapter?.type, envelope.channelId); } catch (e) {}
+
       // While a channel wizard is open, capture text input before slash
       // dispatch — except for /cancel, which always bails out.
       if (channelWizard.isAwaiting(envelope.canonicalUserId)) {

package/core/state.js

@@ -3,12 +3,18 @@
 // linked channels share the same conversation, settings, and usage.
 
 const fs = require("fs");
-const { STATE_FILE, SESSIONS_FILE, CHAT_ID } = require("./config");
+const path = require("path");
+const { STATE_FILE, SESSIONS_FILE, IDENTITIES_FILE, CONFIG_DIR, CHAT_ID, UNIFIED_IDENTITY } = require("./config");
 const {
   normalizeCanonicalUserId,
   canonicalForTelegram,
   canonicalForStoredUserKey,
   setIdentityMapping,
+  isConfiguredOwnerChannel,
+  ownerCanonical,
+  defaultCanonicalForChannel,
+  channelKey,
+  identities,
 } = require("./identity");
 const { currentChannelId, currentCanonicalUserId } = require("./context");
 
@@ -245,6 +251,47 @@ function linkIdentity(transport, channelId, canonicalUserId) {
   return result;
 }
 
+// ── Phase 0 unified identity: one-time owner-channel merge ───────────
+// When the unified-identity flag is on, the first inbound message from a
+// configured owner channel that was never explicitly /linked folds its
+// pre-existing siloed state into the owner's canonical bucket. Idempotent
+// (in-memory guard + a naturally-no-op migrate once the source is moved),
+// non-destructive (merges, and backs up state/sessions/identities first), and
+// completely inert when the flag is off. Deliberately does NOT write into
+// identities.json — resolution comes from the flag+config path in
+// identity.canonicalForChannel, so turning the flag back off cleanly reverts
+// routing while the already-merged history stays with the owner.
+const autoLinkedOwnerChannels = new Set();
+
+function backupIdentityState() {
+  try {
+    const stamp = new Date().toISOString().replace(/[:.]/g, "-");
+    const dir = path.join(CONFIG_DIR, "backups");
+    fs.mkdirSync(dir, { recursive: true });
+    for (const f of [STATE_FILE, SESSIONS_FILE, IDENTITIES_FILE]) {
+      try { if (fs.existsSync(f)) fs.copyFileSync(f, path.join(dir, `${path.basename(f)}.${stamp}.bak`)); } catch (e) {}
+    }
+  } catch (e) {}
+}
+
+function autoLinkOwnerChannel(transport, channelId) {
+  if (!UNIFIED_IDENTITY) return null;
+  if (!isConfiguredOwnerChannel(transport, channelId)) return null;
+  const key = channelKey(transport, channelId);
+  if (autoLinkedOwnerChannels.has(key)) return null;
+  autoLinkedOwnerChannels.add(key);
+  // An explicit /link already unifies this channel — nothing to migrate.
+  if (Object.prototype.hasOwnProperty.call(identities.channels, key)) return null;
+  const to = ownerCanonical();
+  const from = defaultCanonicalForChannel(transport, channelId);
+  if (!to || from === to) return null;
+  const hasState = !!(savedState.users && savedState.users[from]) || !!loadSessions()[from];
+  if (!hasState) return null;
+  backupIdentityState();
+  migrateUserData(from, to);
+  return { from, to };
+}
+
 module.exports = {
   userStates,
   savedState,
@@ -264,4 +311,5 @@ module.exports = {
   userOwnsClaudeSession,
   migrateUserData,
   linkIdentity,
+  autoLinkOwnerChannel,
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inetafrica/open-claudia",
-  "version": "2.9.3",
+  "version": "2.10.0",
   "description": "Your always-on AI coding assistant — Claude Code, Cursor Agent, and OpenAI Codex via Telegram or Kazee Chat",
   "main": "bot.js",
   "bin": {
@@ -9,7 +9,7 @@
   "scripts": {
     "setup": "node setup.js",
     "start": "node bot.js",
-    "test": "OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node -e \"require('./vault'); console.log('OK')\" && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-runner-watchdog-static.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-usage-accounting.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-recall-engine.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-recall-graph.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-recall-discoverer.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-project-transcripts-smoke.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-abilities.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-ability-extraction.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-ability-couse.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-ability-transfer.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-ability-tiers.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-ability-merge-guard.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-learning-e2e.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-pack-nesting.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-journal-dedupe.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-read-signal.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-tools.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-tool-graph.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-tool-guard.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-tooling-mode.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-tool-manifest.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-recall-evolution.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-approval-async.js"
+    "test": "OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node -e \"require('./vault'); console.log('OK')\" && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-runner-watchdog-static.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-usage-accounting.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-recall-engine.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-recall-graph.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-recall-discoverer.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-project-transcripts-smoke.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-abilities.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-ability-extraction.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-ability-couse.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-ability-transfer.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-ability-tiers.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-ability-merge-guard.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-learning-e2e.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-pack-nesting.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-journal-dedupe.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-read-signal.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-tools.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-tool-graph.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-tool-guard.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-tooling-mode.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-tool-manifest.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-recall-evolution.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-approval-async.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-unified-identity.js"
   },
   "files": [
     "bot.js",