@inetafrica/open-claudia 3.0.9 → 3.0.12

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## v3.0.10 — Kazee-only pods are first-class
+
+- **/doctor no longer demands Telegram env on a Kazee-only install.** `health.js` required `TELEGRAM_BOT_TOKEN`/`TELEGRAM_CHAT_ID` unconditionally — a pod provisioned with `CHANNELS=kazee` failed its env check despite being perfectly configured. Required keys are now derived from `CHANNELS` (default `telegram`, preserving legacy behaviour): telegram installs require the Telegram pair, kazee installs require `KAZEE_BOT_TOKEN`, and `WORKSPACE` stays universal.
+- **Kazee owner bootstrap stores the right identity in the right key.** `/auth` bootstrap on a kazee transport wrote the chat-document id into `TELEGRAM_CHAT_ID` — the wrong id (owner checks compare the Kazee *user* id) in the wrong key (polluting Telegram's authorized list). It now writes `KAZEE_OWNER_USER_ID` with the sender's user id and updates the in-memory config so ownership is live without a restart.
+- **An env-provisioned Kazee owner counts as an owner.** `hasOwner()` only looked at `TELEGRAM_CHAT_ID` and auth.json — on a Kazee-only pod provisioned with `KAZEE_OWNER_USER_ID` (the agent-space wizard path), the first stranger to send `/auth` would have been crowned bootstrap owner. `KAZEE_OWNER_USER_ID` now counts.
+- **Agent-space / OpenClaw:** no new deps, no new env, no schema change; Docker image builds identically (FROM the pre-baked `:base`). This is the bot-side half of Kazee pod provisioning via the agent-space wizard (wizard + provisioner land in agent-space itself). Coverage: new hermetic `test-kazee-channel-health.js` (required-key matrix; kazee bootstrap env writes; provisioned-owner /auth guard), wired into `npm test` and shipped in `files`.
+
 ## v3.0.9 — one fat record no longer kills the turn
 
 - **Decoder failures are warnings, not run failures.** The v3 JSONL stream decoder capped provider records at 1MB and surfaced any oversized or malformed line as a terminal `error` event — so a single base64-image tool result (routine in image workflows) killed an otherwise healthy live turn with `Claude Code run failed: Provider JSONL record exceeded 1048576 bytes` (rahil, v3.0.8, 2026-07-12). `LINE_TOO_LARGE` / `MALFORMED_JSON` now normalize to a new non-terminal `warning` event: the record is skipped, the stream continues, and the warning is logged. If the dropped line happened to be the terminal record, the existing `PROVIDER_MISSING_TERMINAL` net still fails the run cleanly.

package/bot.js

@@ -74,8 +74,14 @@ registry.setHandlers({ onMessage, onAction });
 const adapters = registry.bootstrap();
 
 if (adapters.length === 0) {
-  console.error("No channels configured. Set CHANNELS=telegram and TELEGRAM_BOT_TOKEN/TELEGRAM_CHAT_ID, or CHANNELS=kazee with KAZEE_URL/KAZEE_BOT_TOKEN.");
-  process.exit(1);
+  if (process.env.WEB_UI === "true") {
+    // Channel-less pods are valid: the dashboard (and AgentSpace) can attach
+    // telegram/kazee later, and addAdapter() boots them without a restart.
+    console.log("No channels configured yet — waiting for one to be attached via the dashboard.");
+  } else {
+    console.error("No channels configured. Set CHANNELS=telegram and TELEGRAM_BOT_TOKEN/TELEGRAM_CHAT_ID, or CHANNELS=kazee with KAZEE_URL/KAZEE_BOT_TOKEN.");
+    process.exit(1);
+  }
 }
 
 // ── Graceful shutdown & error handling ─────────────────────────────
@@ -290,16 +296,22 @@ setInterval(checkForUpdates, 5 * 60 * 1000);
 
   // Notify owner that bot is back online via every adapter that knows
   // an owner channel. Kazee skipped: ownerUserId is a user id, not a
-  // chat_id, and chat-central has no DM-by-userId send. Owner DM still
-  // wakes the bot fine — this is just the proactive "I'm back" ping.
+  // chat_id — boot onboarding below opens the DM when outreach is needed.
+  // Skipped entirely pre-onboarding: a fresh pod's first words should be
+  // the onboarding greeting, not "Back online".
   for (const a of adapters) {
     try {
-      if (a.type === "telegram" && CHAT_ID) {
+      if (a.type === "telegram" && CHAT_ID && isOnboarded()) {
         await a.send(CHAT_ID, `Back online and ready! Running v${CURRENT_VERSION}.`);
       }
     } catch (e) {}
   }
 
+  // Proactive first-boot outreach: greet an env-provisioned owner, guide them
+  // through /login, then run the LLM onboarding interview once authed.
+  try { await require("./core/boot-onboarding").initBootOnboarding(adapters); }
+  catch (e) { console.error("boot onboarding failed:", e.message); }
+
   // Surface jobs the provider migration disabled. Announce once per job:
   // marked only after a successful send, so a down adapter retries next boot.
   try {

package/channels/kazee/adapter.js

@@ -264,6 +264,30 @@ class KazeeAdapter {
     return null;
   }
 
+  // Get-or-create the 1:1 chat between the bot and a user, returning its
+  // chatId. chat-central's createChat returns the existing DM when one
+  // already exists, so this is idempotent. Requires chats.create on the bot
+  // token — callers must treat null as "outreach unavailable", not fatal.
+  async openDirectChat(userId) {
+    if (!this.botUserId || !userId) return null;
+    try {
+      const res = await this._request("POST", "/chat", {
+        participants: { members: [String(this.botUserId), String(userId)] },
+        chatName: "Direct Message",
+        chatType: "chat",
+        isGroupChat: false,
+      });
+      if (res && res.success === false) {
+        console.error("Kazee openDirectChat rejected:", res.error || "unknown error");
+        return null;
+      }
+      return res && res.chatId ? String(res.chatId) : null;
+    } catch (e) {
+      console.error("Kazee openDirectChat error:", e.message);
+      return null;
+    }
+  }
+
   async edit(channelId, messageId, text, opts = {}) {
     const buttons = this._normalizeKeyboard(opts.keyboard);
     const body = { content: normalize(text) };

package/core/access.js

@@ -169,6 +169,10 @@ function listAuthorizedRaw() {
 
 function hasOwner() {
   if (CHAT_ID) return true;
+  // A provisioned Kazee owner (env-injected or set via /channel add) counts
+  // before their first message — otherwise a stranger's /auth on a
+  // Kazee-only pod would seize ownership.
+  if (config.KAZEE_OWNER_USER_ID) return true;
   try {
     const auth = JSON.parse(fs.readFileSync(AUTH_FILE, "utf-8"));
     return Array.isArray(auth.authorized) && auth.authorized.some((a) => a.isOwner === true);
@@ -190,6 +194,15 @@ function bootstrapOwner({ chatId, name, username }) {
     authorizedAt: new Date().toISOString(),
   });
   saveAuth(auth);
+  if (currentTransport() === "kazee") {
+    // Kazee owner identity is the user id (what transportOwnerUserId
+    // compares), not the chat-document id the envelope carries as chatId —
+    // and it must never be written into TELEGRAM_CHAT_ID.
+    const ownerUserId = String(currentUserId() || id);
+    saveEnvKey("KAZEE_OWNER_USER_ID", ownerUserId);
+    config.KAZEE_OWNER_USER_ID = ownerUserId;
+    return;
+  }
   if (!CHAT_IDS.includes(id)) CHAT_IDS.push(id);
   saveEnvKey("TELEGRAM_CHAT_ID", CHAT_IDS.join(","));
 }

package/core/boot-onboarding.js

@@ -0,0 +1,212 @@
+// Proactive first-boot outreach. A provisioned pod knows its owner from env
+// (TELEGRAM_CHAT_ID / KAZEE_OWNER_USER_ID) but historically sat silent until
+// the owner messaged first. Instead: greet the owner at boot, walk them
+// through connecting a provider (/login), and once one is authenticated run
+// an LLM-led interview that captures the bot's role and the owner's profile
+// into the soul file. Flags persist in CONFIG_DIR so restarts and upgrades
+// never re-ping; no env-provisioned owner means stay quiet and let /auth
+// claim ownership exactly as before.
+
+"use strict";
+
+const fs = require("fs");
+const path = require("path");
+
+const { CONFIG_DIR, WORKSPACE, SOUL_FILE, config, saveEnvKey } = require("./config");
+const { runInChat } = require("./context");
+const { canonicalForChannel } = require("./identity");
+
+const FLAGS_FILE = path.join(CONFIG_DIR, "boot-onboarding.json");
+const AUTH_POLL_MS = 30 * 1000;
+
+let authWatcher = null;
+
+function readFlags() {
+  try { return JSON.parse(fs.readFileSync(FLAGS_FILE, "utf8")) || {}; }
+  catch (e) { return {}; }
+}
+
+function writeFlags(patch) {
+  const flags = { ...readFlags(), ...patch };
+  try { fs.writeFileSync(FLAGS_FILE, JSON.stringify(flags, null, 2)); }
+  catch (e) { console.error("boot-onboarding: could not persist flags:", e.message); }
+  return flags;
+}
+
+function isOnboarded() {
+  return config.ONBOARDED === "true";
+}
+
+// Authoritative auth check via the provider registry (probes CLI auth state,
+// so API-key-provisioned pods count as authenticated — token presence alone
+// would miss them). Registry caches healthy probes; negatives always re-probe.
+function authenticatedProviderId() {
+  try {
+    const providers = require("./providers");
+    for (const provider of providers.listProviders()) {
+      try {
+        const status = providers.providerStatus(provider.id);
+        if (status.availability?.state === "available"
+            && status.compatibility?.state !== "incompatible"
+            && status.auth?.state === "authenticated") return provider.id;
+      } catch (e) { /* try the next provider */ }
+    }
+  } catch (e) {
+    console.error("boot-onboarding: provider status check failed:", e.message);
+  }
+  return null;
+}
+
+async function resolveOwnerChat(adapters) {
+  for (const a of adapters) {
+    if (a.type === "telegram" && a.ownerChatId) {
+      return { adapter: a, channelId: String(a.ownerChatId), userId: String(a.ownerChatId) };
+    }
+  }
+  for (const a of adapters) {
+    if (a.type === "kazee" && a.ownerUserId && typeof a.openDirectChat === "function") {
+      const chatId = await a.openDirectChat(a.ownerUserId);
+      if (chatId) return { adapter: a, channelId: String(chatId), userId: String(a.ownerUserId) };
+      console.error("boot-onboarding: could not open a Kazee DM with the owner — outreach skipped (bot token may lack chats.create).");
+    }
+  }
+  return null;
+}
+
+// The scope must land in the same state bucket as the owner's own replies:
+// kazee envelopes key canonical identity on the sender's userId, telegram DMs
+// on the chat id — mirror that here or the interview forks into a bucket the
+// owner's replies never reach.
+function chatScope(ownerChat) {
+  return {
+    adapter: ownerChat.adapter,
+    channelId: ownerChat.channelId,
+    canonicalUserId: canonicalForChannel(ownerChat.adapter.type, ownerChat.userId),
+    userId: ownerChat.userId,
+    transport: ownerChat.adapter.type,
+    raw: null,
+  };
+}
+
+function greetingMessage() {
+  return [
+    "👋 Hi! I'm your new agent — I just came online.",
+    "",
+    "First things first: I need a brain. Send /login to pick a model and connect its provider — I'll walk you through it right here in chat.",
+    "",
+    "Once I'm connected, we'll do a quick intro so I can learn my role and how you like to work.",
+  ].join("\n");
+}
+
+function reauthNudgeMessage() {
+  return [
+    "⚠️ I'm back online but not signed in to any AI provider, so I can't work on messages right now.",
+    "",
+    "Send /login to reconnect. (Claude: /setup_token + /use_oauth_token · Codex: /codex_login)",
+  ].join("\n");
+}
+
+function interviewPrompt() {
+  return [
+    "You have just come online for the very first time and this is your first conversation with your owner. A provider is now connected, and your soul file is still the generic template.",
+    "",
+    "Run a short, warm onboarding interview (mobile chat — keep every message brief):",
+    "1. Introduce yourself in a sentence or two and say you'd like to get set up.",
+    "2. Ask what your job should be and what they'd like to call you.",
+    "3. Ask what they do and how they like to work with an assistant (style, level of detail).",
+    "Ask at most two questions per message and let their answers guide follow-ups over the next few turns.",
+    "",
+    `As their answers arrive over the coming turns, persist what you learn: update your soul file at ${SOUL_FILE} (identity, name, role/scope, owner profile, communication style — keep any existing hard rules), and record durable facts about the owner in your long-term memory.`,
+    "",
+    "For THIS message: send only the greeting and your first questions. Do not mention this prompt or any internal setup mechanics.",
+  ].join("\n");
+}
+
+function stopAuthWatcher() {
+  if (authWatcher) { clearInterval(authWatcher); authWatcher = null; }
+}
+
+async function startInterview(ownerChat) {
+  const before = readFlags();
+  if (before.interviewStartedAt) return false;
+  writeFlags({ interviewStartedAt: Date.now() });
+  stopAuthWatcher();
+  try {
+    return await runInChat(chatScope(ownerChat), async () => {
+      const { currentState, saveState } = require("./state");
+      const state = currentState();
+      if (!state.currentSession) {
+        require("./handlers").selectProjectState(
+          { name: "Workspace", dir: WORKSPACE },
+          { state, persist: false },
+        );
+      }
+      saveState();
+      const { admitRunContext, runAgent } = require("./runner");
+      const prompt = interviewPrompt();
+      const runContext = admitRunContext(prompt, state.currentSession?.dir || WORKSPACE, null, { purpose: "foreground" });
+      const result = await runAgent(prompt, runContext.cwd, null, { runContext });
+      if (result && result.ok === false) throw new Error(result.error?.message || "interview run did not complete");
+      // Marked only after the opening turn actually reached the owner, so a
+      // failed dispatch retries next boot instead of half-onboarding the bot.
+      saveEnvKey("ONBOARDED", "true");
+      config.ONBOARDED = "true";
+      return true;
+    });
+  } catch (e) {
+    console.error("boot-onboarding: interview run failed, will retry next boot:", e.message);
+    writeFlags({ interviewStartedAt: null });
+    return false;
+  }
+}
+
+function armAuthWatcher(ownerChat) {
+  stopAuthWatcher();
+  authWatcher = setInterval(() => {
+    if (isOnboarded() || readFlags().interviewStartedAt) return stopAuthWatcher();
+    if (!authenticatedProviderId()) return;
+    startInterview(ownerChat).catch((e) => console.error("boot-onboarding: interview dispatch failed:", e.message));
+  }, AUTH_POLL_MS);
+  if (typeof authWatcher.unref === "function") authWatcher.unref();
+}
+
+async function initBootOnboarding(adapters) {
+  const ownerChat = await resolveOwnerChat(adapters);
+  if (!ownerChat) return;
+
+  const flags = readFlags();
+  const authedProvider = authenticatedProviderId();
+
+  if (isOnboarded()) {
+    if (authedProvider) {
+      // Healthy boot: re-arm the one-shot nudge for a future auth loss.
+      if (flags.unauthNudgedAt) writeFlags({ unauthNudgedAt: null });
+      return;
+    }
+    if (!flags.unauthNudgedAt) {
+      const sent = await runInChat(chatScope(ownerChat), () => require("./io").send(reauthNudgeMessage()));
+      if (sent?.ok) writeFlags({ unauthNudgedAt: Date.now() });
+    }
+    return;
+  }
+
+  if (authedProvider) {
+    await startInterview(ownerChat);
+    return;
+  }
+
+  if (!flags.greetedAt) {
+    const sent = await runInChat(chatScope(ownerChat), () => require("./io").send(greetingMessage()));
+    if (sent?.ok) writeFlags({ greetedAt: Date.now() });
+  }
+  armAuthWatcher(ownerChat);
+}
+
+module.exports = {
+  initBootOnboarding,
+  startInterview,
+  resolveOwnerChat,
+  readFlags,
+  FLAGS_FILE,
+  stopAuthWatcher,
+};

package/core/router.js

@@ -37,6 +37,18 @@ async function deliverRouterError(error) {
   const code = error?.code || "ROUTER_ERROR";
   if (!USER_VISIBLE_PROVIDER_ERRORS.has(code)) return null;
   const message = error?.message || "No compatible provider is available.";
+  if (code === "PROVIDER_UNAUTHENTICATED") {
+    const providerId = error?.details?.providerId;
+    await send([
+      "I'm not signed in to an AI provider yet, so I can't work on that message.",
+      "",
+      "Send /login to pick a model and connect — I'll walk you through it right here in chat.",
+      providerId === "codex"
+        ? "Shortcuts: /codex_login (device auth) or /codex_setup_token (paste an OpenAI API key securely)."
+        : "Shortcuts: /setup_token then /use_oauth_token (long-lived Claude token), or /login for the guided flow.",
+    ].join("\n"));
+    return { ok: false, status: "failed", error: { code, message } };
+  }
   await send(`${message}\n\nOpen /backend to review providers, or run /doctor for local compatibility and authentication checks.`);
   return { ok: false, status: "failed", error: { code, message } };
 }

package/health.js

@@ -8,12 +8,20 @@ const { inspectProviderConfiguration } = require("./core/provider-status");
 const ENV_FILE = path.join(CONFIG_DIR, ".env");
 const AUTH_FILE = path.join(CONFIG_DIR, "auth.json");
 
-// Required env keys for the bot to function
-const REQUIRED_ENV_KEYS = [
-  "TELEGRAM_BOT_TOKEN",
-  "TELEGRAM_CHAT_ID",
-  "WORKSPACE",
-];
+// Required env keys depend on which channels the install runs: WORKSPACE is
+// universal, and each channel listed in CHANNELS (default telegram) adds its
+// own keys — a Kazee-only pod must not fail /doctor over missing Telegram env.
+function requiredEnvKeys(env = {}) {
+  const channels = String(env.CHANNELS || "telegram")
+    .split(",")
+    .map((entry) => entry.trim().split(":")[0])
+    .filter(Boolean);
+  const keys = [];
+  if (channels.includes("telegram")) keys.push("TELEGRAM_BOT_TOKEN", "TELEGRAM_CHAT_ID");
+  if (channels.includes("kazee")) keys.push("KAZEE_BOT_TOKEN");
+  keys.push("WORKSPACE");
+  return keys;
+}
 
 // Optional but recommended
 const OPTIONAL_ENV_KEYS = [
@@ -255,7 +263,7 @@ async function runHealthChecks(options = {}) {
     return results;
   }
 
-  const missingKeys = REQUIRED_ENV_KEYS.filter((k) => !env[k]);
+  const missingKeys = requiredEnvKeys(env).filter((k) => !env[k]);
   if (missingKeys.length > 0) {
     results.checks.env = { ok: false, reason: "missing_keys", message: `Missing required config: ${missingKeys.join(", ")}`, missingKeys };
     results.ok = false;
@@ -471,6 +479,6 @@ module.exports = {
   ensureSetup,
   formatSetupResults,
   ensureAgentBrowser,
-  REQUIRED_ENV_KEYS,
+  requiredEnvKeys,
   OPTIONAL_ENV_KEYS,
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inetafrica/open-claudia",
-  "version": "3.0.9",
+  "version": "3.0.12",
   "description": "An always-on, provider-agnostic coding-agent harness for Claude Code and OpenAI Codex via chat",
   "main": "bot.js",
   "bin": {
@@ -9,7 +9,7 @@
   "scripts": {
     "setup": "node setup.js",
     "start": "node bot.js",
-    "pretest": "node test-provider-fixture.js && node test-provider-core-prompt.js && node test-provider-prompt-parity.js && node test-provider-env-isolation.js && node test-provider-resume-parity.js && node test-provider-bootstrap.js && node test-provider-registry.js && node test-provider-stream-decoder.js && node test-provider-events.js && node test-provider-claude.js && node test-provider-codex.js && node test-provider-runner.js && node test-provider-run-lifecycle.js && node test-provider-gateway.js && node test-provider-side-chat.js && node test-single-runtime.js && node test-provider-migration-backup.js && node test-provider-state-migration.js && node test-provider-session-history.js && node test-provider-session-commands.js && node test-provider-compaction.js && node test-provider-scheduler.js && node test-cursor-removal.js && node test-utility-provider-policy.js && node test-provider-subagent.js && node test-provider-recall.js && node test-provider-pack-review.js && node test-memory-mutation-queue.js && node test-provider-dream.js && node test-provider-enforcer.js && node test-provider-tool-hooks.js && node test-provider-boot-matrix.js && node test-provider-capabilities.js && node test-provider-language.js && node test-provider-coupling-audit.js && node test-provider-parity-e2e.js",
+    "pretest": "node test-provider-fixture.js && node test-provider-core-prompt.js && node test-provider-prompt-parity.js && node test-provider-env-isolation.js && node test-provider-resume-parity.js && node test-provider-bootstrap.js && node test-provider-registry.js && node test-provider-stream-decoder.js && node test-provider-events.js && node test-provider-claude.js && node test-provider-codex.js && node test-provider-runner.js && node test-provider-run-lifecycle.js && node test-provider-gateway.js && node test-provider-side-chat.js && node test-single-runtime.js && node test-provider-migration-backup.js && node test-provider-state-migration.js && node test-provider-session-history.js && node test-provider-session-commands.js && node test-provider-compaction.js && node test-provider-scheduler.js && node test-cursor-removal.js && node test-utility-provider-policy.js && node test-provider-subagent.js && node test-provider-recall.js && node test-provider-pack-review.js && node test-memory-mutation-queue.js && node test-provider-dream.js && node test-provider-enforcer.js && node test-provider-tool-hooks.js && node test-provider-boot-matrix.js && node test-provider-capabilities.js && node test-provider-language.js && node test-provider-coupling-audit.js && node test-provider-parity-e2e.js && node test-kazee-channel-health.js",
     "test": "OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node -e \"require('./vault'); console.log('OK')\" && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-runner-watchdog-static.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-usage-accounting.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-recall-engine.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-recall-graph.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-recall-discoverer.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-project-transcripts-smoke.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-abilities.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-ability-extraction.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-ability-couse.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-ability-transfer.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-ability-tiers.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-ability-merge-guard.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-learning-e2e.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-pack-nesting.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-journal-dedupe.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-read-signal.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-tools.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-tool-graph.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-tool-guard.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-tooling-mode.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-tool-manifest.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-recall-evolution.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-approval-async.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-unified-identity.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-queue-routing.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-persona-packs.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-speaker-persona.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-persona-pipeline.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-recall-relationship-gate.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-relationship.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-enforcer.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-identity-prune.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-kazee-message-id.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-delivery-contract.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-run-lock.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-web-sessions.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-telegram-poll-recovery.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-telegram-409-grace.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-telegram-conflict-heal-guard.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-single-instance.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-streaming-split.js"
   },
   "files": [
@@ -65,6 +65,7 @@
     "test-enforcer.js",
     "test-identity-prune.js",
     "test-kazee-message-id.js",
+    "test-kazee-channel-health.js",
     "test-delivery-contract.js",
     "test-run-lock.js",
     "test-web-sessions.js",

package/test-kazee-channel-health.js

@@ -0,0 +1,135 @@
+#!/usr/bin/env node
+
+"use strict";
+
+const assert = require("assert");
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+const { spawnSync } = require("child_process");
+
+if (process.argv[2] === "--owner-probe") {
+  (async () => {
+    const { runInChat } = require("./core/context");
+    const access = require("./core/access");
+    const { config } = require("./core/config");
+
+    if (process.env.PROBE_MODE === "provisioned") {
+      // Agent-space injects KAZEE_OWNER_USER_ID at provision time: the owner
+      // exists before their first message, so a stranger's /auth must not
+      // reach the bootstrap path.
+      assert.strictEqual(access.hasOwner(), true, "env-provisioned kazee owner counts as owner");
+      console.log("OWNER_PROBE_OK");
+      return;
+    }
+
+    assert.strictEqual(access.hasOwner(), false, "fresh kazee pod starts ownerless");
+    await runInChat({
+      adapter: { type: "kazee", id: "kazee" },
+      channelId: "chat-doc-1",
+      canonicalUserId: "kazee:user-77",
+      userId: "user-77",
+      transport: "kazee",
+    }, async () => {
+      access.bootstrapOwner({ chatId: "chat-doc-1", name: "Owner", username: "" });
+    });
+
+    const env = fs.readFileSync(path.join(process.env.OPEN_CLAUDIA_CONFIG_DIR, ".env"), "utf8");
+    assert.match(env, /^KAZEE_OWNER_USER_ID=user-77$/m, "kazee bootstrap stores the owner USER id");
+    assert.ok(!/^TELEGRAM_CHAT_ID=.*(chat-doc-1|user-77)/m.test(env), "kazee ids must never land in TELEGRAM_CHAT_ID");
+    assert.strictEqual(config.KAZEE_OWNER_USER_ID, "user-77", "owner is live without a restart");
+    assert.strictEqual(access.hasOwner(), true);
+
+    await runInChat({
+      adapter: { type: "kazee", id: "kazee" },
+      channelId: "chat-doc-2",
+      canonicalUserId: "kazee:user-77",
+      userId: "user-77",
+      transport: "kazee",
+    }, async () => {
+      assert.strictEqual(access.isChatOwner("chat-doc-2"), true, "owner matches by user id from any kazee chat");
+      assert.strictEqual(access.isChatAuthorized("chat-doc-2"), true);
+    });
+
+    await runInChat({
+      adapter: { type: "kazee", id: "kazee" },
+      channelId: "chat-doc-3",
+      canonicalUserId: "kazee:stranger-1",
+      userId: "stranger-1",
+      transport: "kazee",
+    }, async () => {
+      assert.strictEqual(access.isChatOwner("chat-doc-3"), false, "strangers are not owner");
+    });
+
+    console.log("OWNER_PROBE_OK");
+  })().catch((error) => {
+    process.stderr.write(`${error.stack || error.message}\n`);
+    process.exitCode = 1;
+  });
+} else {
+  const { requiredEnvKeys } = require("./health");
+
+  assert.deepStrictEqual(
+    requiredEnvKeys({}),
+    ["TELEGRAM_BOT_TOKEN", "TELEGRAM_CHAT_ID", "WORKSPACE"],
+    "no CHANNELS keeps the legacy telegram requirement",
+  );
+  assert.deepStrictEqual(
+    requiredEnvKeys({ CHANNELS: "kazee" }),
+    ["KAZEE_BOT_TOKEN", "WORKSPACE"],
+    "a kazee-only pod must not require telegram env",
+  );
+  assert.deepStrictEqual(
+    requiredEnvKeys({ CHANNELS: "telegram, kazee:main" }),
+    ["TELEGRAM_BOT_TOKEN", "TELEGRAM_CHAT_ID", "KAZEE_BOT_TOKEN", "WORKSPACE"],
+    "dual-channel installs require both, id overrides included",
+  );
+  assert.deepStrictEqual(requiredEnvKeys({ CHANNELS: "voice" }), ["WORKSPACE"]);
+
+  const scenarios = [
+    { name: "bootstrap", mode: "bootstrap", envLines: [
+      "CHANNELS=kazee",
+      "KAZEE_BOT_TOKEN=fixture-kazee-token",
+      "KAZEE_BOT_USER_ID=bot-1",
+    ] },
+    { name: "provisioned", mode: "provisioned", envLines: [
+      "CHANNELS=kazee",
+      "KAZEE_BOT_TOKEN=fixture-kazee-token",
+      "KAZEE_BOT_USER_ID=bot-1",
+      "KAZEE_OWNER_USER_ID=owner-1",
+    ] },
+  ];
+
+  for (const scenario of scenarios) {
+    const temp = fs.mkdtempSync(path.join(os.tmpdir(), `open-claudia-kazee-${scenario.name}-`));
+    try {
+      const configDir = path.join(temp, "config");
+      const workspace = path.join(temp, "workspace");
+      fs.mkdirSync(configDir);
+      fs.mkdirSync(workspace);
+      fs.writeFileSync(
+        path.join(configDir, ".env"),
+        `${scenario.envLines.join("\n")}\nWORKSPACE=${workspace}\n`,
+      );
+      const child = spawnSync(process.execPath, [__filename, "--owner-probe"], {
+        cwd: __dirname,
+        env: {
+          HOME: path.join(temp, "config"),
+          PATH: [path.dirname(process.execPath), "/usr/bin", "/bin"].join(path.delimiter),
+          OPEN_CLAUDIA_CONFIG_DIR: configDir,
+          OPEN_CLAUDIA_TEST: "1",
+          PROBE_MODE: scenario.mode,
+        },
+        encoding: "utf8",
+        timeout: 30000,
+      });
+      assert.ifError(child.error);
+      assert.strictEqual(child.status, 0, `${scenario.name}: ${child.stderr || child.stdout}`);
+      assert.match(child.stdout, /OWNER_PROBE_OK/, scenario.name);
+    } finally {
+      fs.rmSync(temp, { recursive: true, force: true });
+    }
+  }
+
+  console.log("kazee channel health OK");
+}

package/test-provider-language.js

@@ -32,11 +32,12 @@ assert.doesNotMatch(setup, /Your Claude Code bot is connected|Description=Claude
 
 const pkg = JSON.parse(read("package.json"));
 assert.match(pkg.description, /provider-agnostic coding-agent harness/i);
-// 3.0.9 approved by Sumeet 2026-07-12 ("ok then please fix that"): decoder
-// LINE_TOO_LARGE/MALFORMED_JSON downgraded to non-fatal warnings and the JSONL
-// line cap raised 1MB→16MB after a base64-image tool result killed rahil's
-// live turn on v3.0.8.
-assert.strictEqual(pkg.version, "3.0.9", "release version must remain unchanged without explicit approval");
+// 3.0.12 approved by Sumeet 2026-07-13 ("Yes" to the platform unification
+// epic): dashboard auth hardening (no forced password change, login
+// rate-limiting + lockout, constant-time compares, Secure cookie),
+// channel-less boot with the web UI up, and live `channels` in /api/status
+// for AgentSpace channel chips.
+assert.strictEqual(pkg.version, "3.0.12", "release version must remain unchanged without explicit approval");
 for (const keyword of ["claude", "codex", "coding-agent", "provider-agnostic"]) {
   assert.ok(pkg.keywords.includes(keyword), `package keyword missing: ${keyword}`);
 }

package/web.js

@@ -143,6 +143,59 @@ function checkAuth(req) {
   return webSessions.valid(token);
 }
 
+// Hash both sides so timingSafeEqual gets equal-length buffers and the
+// comparison leaks neither content nor password length.
+function safeEqual(a, b) {
+  const ha = crypto.createHash("sha256").update(String(a)).digest();
+  const hb = crypto.createHash("sha256").update(String(b)).digest();
+  return crypto.timingSafeEqual(ha, hb);
+}
+
+// Login rate limiting: 5 failures → lockout with exponential backoff
+// (30s, 60s, ... capped at 15min). Keyed by client IP (first XFF hop
+// when behind the ingress). In-memory — resets on restart, which is fine.
+const loginFailures = new Map();
+const LOCKOUT_THRESHOLD = 5;
+const LOCKOUT_BASE_MS = 30 * 1000;
+const LOCKOUT_MAX_MS = 15 * 60 * 1000;
+
+function clientKey(req) {
+  const xff = String(req.headers["x-forwarded-for"] || "").split(",")[0].trim();
+  return xff || req.socket?.remoteAddress || "unknown";
+}
+
+function loginLockedMs(req) {
+  const rec = loginFailures.get(clientKey(req));
+  if (!rec || !rec.lockedUntil) return 0;
+  const left = rec.lockedUntil - Date.now();
+  return left > 0 ? left : 0;
+}
+
+function recordLoginFailure(req) {
+  const key = clientKey(req);
+  const rec = loginFailures.get(key) || { count: 0, lockouts: 0, lockedUntil: 0 };
+  rec.count += 1;
+  if (rec.count >= LOCKOUT_THRESHOLD) {
+    rec.count = 0;
+    const wait = Math.min(LOCKOUT_BASE_MS * 2 ** rec.lockouts, LOCKOUT_MAX_MS);
+    rec.lockouts += 1;
+    rec.lockedUntil = Date.now() + wait;
+  }
+  loginFailures.set(key, rec);
+}
+
+function clearLoginFailures(req) {
+  loginFailures.delete(clientKey(req));
+}
+
+// Secure flag only when the client actually arrived over HTTPS (ingress
+// sets X-Forwarded-Proto) — keeps plain-HTTP port-forward logins working.
+function sessionCookie(req) {
+  const proto = String(req.headers["x-forwarded-proto"] || "").split(",")[0].trim();
+  const secure = proto === "https" ? "; Secure" : "";
+  return `oc_session=${webSessions.issue()}; Path=/; HttpOnly; SameSite=Strict; Max-Age=86400${secure}`;
+}
+
 // ── Config helpers ─────────────────────────────────────────────────
 
 function loadEnv() {
@@ -289,6 +342,32 @@ function telegramGet(token, method) {
   });
 }
 
+// Live channel list from the in-process adapter registry — the source of
+// truth for what this pod is actually connected to (provisioning-time env
+// goes stale once channels are attached/removed at runtime).
+let tgUsernameCache = null;
+async function liveChannels() {
+  let adapters = [];
+  try { adapters = require("./core/adapter-registry").getAdapters(); } catch (e) { return []; }
+  const out = [];
+  for (const a of adapters) {
+    const ch = { id: a.id, type: a.type };
+    if (a.type === "telegram") {
+      const token = loadEnv().TELEGRAM_BOT_TOKEN || process.env.TELEGRAM_BOT_TOKEN;
+      if (token) {
+        if (!tgUsernameCache) {
+          const me = await telegramGet(token, "getMe");
+          if (me && me.ok) tgUsernameCache = (me.result && me.result.username) || null;
+        }
+        if (tgUsernameCache) ch.username = tgUsernameCache;
+      }
+    }
+    if (a.type === "kazee" && a.botUserId) ch.botUserId = String(a.botUserId);
+    out.push(ch);
+  }
+  return out;
+}
+
 // ── API routes ─────────────────────────────────────────────────────
 
 async function handleAPI(req, res, body, dependencies = {}) {
@@ -296,14 +375,23 @@ async function handleAPI(req, res, body, dependencies = {}) {
 
   // Login — no auth required
   if (url === "/api/login" && req.method === "POST") {
-    const { password } = JSON.parse(body);
-    if (password === getPassword()) {
+    const lockedMs = loginLockedMs(req);
+    if (lockedMs > 0) {
+      const seconds = Math.ceil(lockedMs / 1000);
+      res.writeHead(429, { "Content-Type": "application/json", "Retry-After": String(seconds) });
+      return res.end(JSON.stringify({ ok: false, error: `Too many attempts — try again in ${seconds}s` }));
+    }
+    let password;
+    try { ({ password } = JSON.parse(body)); } catch (e) { /* fall through to failure */ }
+    if (typeof password === "string" && safeEqual(password, getPassword())) {
+      clearLoginFailures(req);
       res.writeHead(200, {
         "Content-Type": "application/json",
-        "Set-Cookie": `oc_session=${webSessions.issue()}; Path=/; HttpOnly; SameSite=Strict; Max-Age=86400`,
+        "Set-Cookie": sessionCookie(req),
       });
-      return res.end(JSON.stringify({ ok: true, mustChangePassword: !isPasswordChanged() }));
+      return res.end(JSON.stringify({ ok: true }));
     }
+    recordLoginFailure(req);
     res.writeHead(401, { "Content-Type": "application/json" });
     return res.end(JSON.stringify({ ok: false, error: "Wrong password" }));
   }
@@ -347,6 +435,7 @@ async function handleAPI(req, res, body, dependencies = {}) {
       providers: providerStatus.providers,
       defaultProvider: providerStatus.defaultProvider,
       onboarded: env.ONBOARDED === "true",
+      channels: await liveChannels(),
     }));
   }
 
@@ -575,10 +664,10 @@ async function handleAPI(req, res, body, dependencies = {}) {
     }));
   }
 
-  // Change password
+  // Change password (voluntary — never forced)
   if (url === "/api/password" && req.method === "POST") {
     const { current, newPassword } = JSON.parse(body);
-    if (current !== getPassword()) {
+    if (typeof current !== "string" || !safeEqual(current, getPassword())) {
       res.writeHead(400, { "Content-Type": "application/json" });
       return res.end(JSON.stringify({ error: "Wrong current password" }));
     }
@@ -593,7 +682,7 @@ async function handleAPI(req, res, body, dependencies = {}) {
     webSessions.revokeAll();
     res.writeHead(200, {
       "Content-Type": "application/json",
-      "Set-Cookie": `oc_session=${webSessions.issue()}; Path=/; HttpOnly; SameSite=Strict; Max-Age=86400`,
+      "Set-Cookie": sessionCookie(req),
     });
     return res.end(JSON.stringify({ ok: true }));
   }
@@ -718,38 +807,8 @@ function showLogin() {
 async function doLogin() {
   const pw = $("#pw").value;
   const r = await api("/api/login", { method: "POST", body: { password: pw } });
-  if (r?.ok && r.mustChangePassword) showForceChangePassword(pw);
-  else if (r?.ok) init();
-  else $("#login-msg").innerHTML = '<div class="msg err">Wrong password</div>';
-}
-
-function showForceChangePassword(currentPw) {
-  $("#app").innerHTML = \`
-    <div class="login-page"><div class="login-box">
-      <h1>Change Password</h1>
-      <p class="subtitle">You must set a secure password before continuing</p>
-      <div id="change-msg"></div>
-      <div class="card">
-        <div class="form-group">
-          <input type="password" id="new-pw-1" placeholder="New password">
-        </div>
-        <div class="form-group">
-          <input type="password" id="new-pw-2" placeholder="Confirm password" onkeydown="if(event.key==='Enter')doForceChange()">
-        </div>
-        <p style="font-size:11px;color:#888;margin:8px 0">Min 12 chars, uppercase, lowercase, number, and symbol</p>
-        <button onclick="doForceChange()" style="width:100%">Set Password</button>
-      </div>
-    </div></div>\`;
-  window._forceChangePw = currentPw;
-  setTimeout(() => $("#new-pw-1")?.focus(), 100);
-}
-
-async function doForceChange() {
-  const p1 = $("#new-pw-1").value, p2 = $("#new-pw-2").value;
-  if (p1 !== p2) { $("#change-msg").innerHTML = '<div class="msg err">Passwords do not match</div>'; return; }
-  const r = await api("/api/password", { method: "POST", body: { current: window._forceChangePw, newPassword: p1 } });
-  if (r?.ok) { delete window._forceChangePw; init(); }
-  else $("#change-msg").innerHTML = '<div class="msg err">' + (r?.error || "Failed") + '</div>';
+  if (r?.ok) init();
+  else $("#login-msg").innerHTML = '<div class="msg err">' + (r?.error || "Wrong password") + '</div>';
 }
 
 function render() {
@@ -1248,7 +1307,7 @@ function startWebServer(options = {}) {
       if (consume(token)) {
         res.writeHead(302, {
           "Location": "/",
-          "Set-Cookie": `oc_session=${webSessions.issue()}; Path=/; HttpOnly; SameSite=Strict; Max-Age=86400`,
+          "Set-Cookie": sessionCookie(req),
         });
         return res.end();
       }