@inetafrica/open-claudia 3.3.1 → 3.4.0

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## v3.4.0 — Who you are, where you are, and what you may do there are three different questions
+
+- **The bug that started it: a wakeup scheduled in a Codex room kept running on Claude.** `getActiveProvider` resolves the room's overlay from `state.roomKey`, but that key was stamped from `currentConversationKey()` — and a scheduled job resumes its own saved thread, whose conversation key is the job's *project name*, not a room. The overlay never resolved, so every job silently fell back to the creator's personal default. The thread and the room are now separate values (`roomKey`, defaulting to the conversation key so every inbound path is unchanged); the scheduler passes the room the job was created in. The same fusion is why a group answered as Codex to one person and Claude to another. Relatedly, a run that reverts to the provider it was scheduled under because the room's current choice is not runnable now **says so** — in the prompt and in a ⚠️ line on the advisory — instead of leaving a Codex room reporting a Claude quota error with nothing to explain where Claude came from.
+- **A room is not a person.** Authority was resolved from `channelId`, which on every transport where a room holds many people is not an identity at all. Principal is now always the transport USER id, carried separately from the room all the way to the enforcer. A group carrying `isOwner` in `auth.json` can no longer promote every member of that group to owner.
+- **Capability is a lookup, not a judgment.** A live `(principal × room)` grant short-circuits the enforcer *before* any model call, so an owner's own decision is never re-litigated by a judge. The grant unit is the **pair**: trusting someone in one group never trusts them in another, nor trusts the rest of that group — "🌍 Always — everywhere" is a separate, explicit tap next to the default "✅ Always — here". Grants carry a capability ladder (`read` < `act` < `destructive`, so an `act` grant can never authorize a destructive run), an optional subject scope, and optional expiry or one-turn burn-down. Re-granting replaces rather than stacks, so downgrading actually downgrades. Deliberately additive: *no grant* is not a denial — the existing mandate and channel-rule paths still run underneath. New `/grants` lists and revokes; every issue is audited.
+- **Group admins carry zero authority in the pod.** Presence is surface-owned (whoever administers a room decides whether the agent is *in* it — an agent is a user like any other); capability is pod-owned and set by owners alone. Otherwise sharing a room with someone would make them an admin of your account.
+- **A second owner could never approve anything.** Escalation resolved `owners()[0]` and posted every card to that one person, so a card went unanswered whenever they were away. Cards now fan out to every reachable owner, deduped by send target; any owner may decide whichever copy they see, and the decision is idempotent.
+- **A grant that expired looked exactly like one you never gave.** The bot simply started asking again with nothing to explain why. Escalation cards now name the lapsed line and its date, at the moment the lapse bites.
+- **A torn write could silently demote the owner.** `people.json` was written without fsync or a backup and read as `[]` on any failure — no person found means "external", so one interrupted write guarded the owner in their own pod. Worse, a corrupt `auth.json` parsed as *no owner*, and no owner is what lets the next `/auth` from a stranger seize the pod. Both stores now write atomically with a `.bak` snapshot, recover from it transparently, and serialize read-modify-writes through a cross-process lock (the bot and the CLI are separate writers). `hasOwner()` now distinguishes *absent* (fresh pod, still claimable) from *unreadable* (fails closed). The dashboard and installer carried their own `loadAuth` that would have overwritten the recoverable copy with an empty roster; both fixed.
+- **Surface-agnostic by construction.** A room is `<surface>:<id>` — a Spaces task thread resolves identically to a Telegram group, so a Spaces-only pod needs no chat surface at all.
+- Regression coverage: `test-grants.js` (the pair is the unit, the capability ladder, reach vs strength, scope, revocation/expiry/one-turn, replace-not-stack, default-deny) and `test-store-durability.js` (`.bak` recovery, fail-closed vs still-claimable, lock exclusivity and stale reclaim) join the chain.
+
+## v3.3.2 — Known people are recognized by transport id, approved owners stay owners, and a mandate can no longer land on the wrong note
+
+- **Every known person got interrogated on a fresh Kazee DM.** The intro flow matched inbound chats only by `(adapter, channelId)` — but Kazee DMs key the envelope's channelId by the conversation *document* id while people handles store the sender's *user* id, so nothing ever matched: known teammates, and the owner on pods without `KAZEE_OWNER_USER_ID`, all got "who are you" (the Coders Africa incident, 2026-08-19/20). Now a sender whose transport user id already maps to a person is silently **adopted**: the DM channel is linked to their record, an auth entry is written, any stale pending intro is resolved, and `handleInbound` returns false so the router falls through and handles the turn normally. Adoption is gated on adapter-attested `surface: "dm"` — the Kazee adapter sets it only on a positive chat-meta read (`isGroupChat: false`); a failed meta read attests nothing (fail closed) — because auth.json standing is per-CHANNEL and adopting a room would hand every member the sender's standing. Display names are never matched; only the transport id, the same trust level as the env owner match.
+- **Approving an owner onto a second channel demoted them there.** `applyApproval` hardcoded `isOwner: false` into the auth entry while `isChatOwner` reads exactly that file. The entry now mirrors `person.isOwner`, and a stale `false` entry from the bug era is upgraded in place on the next approval.
+- **The mandate writer can no longer be steered by a display name.** `appendMandateLine`'s legacy fallback upserted by `personName` when the record carried no slug — a spoofable transport display name could land owner-authored security text on a same-named OTHER person's note (reachable from telegram-group externals, where there is no person record). Writes are now strictly slug-keyed: `entitySlug`, else the person REGISTRY (`personId` → `resolveEntitySlug`), else **refused** — never the name. The router's rule-capture path passes `personId` so per-person rules keep landing after the fallback's removal.
+- **Stranded grants are surfaced the moment they bite.** The dual-file trap — a mandate granted on the name-obvious note (`rahil-malde.md`) while the enforcer reads the person's hashed record slug — made grants silently do nothing. Escalation cards now carry a ⚠️ hint naming the file holding the dead grant and pointing at Verify / Make-a-rule, whenever the speaker's live mandate is empty but a same-named sibling note (that no other person owns) holds one. Detection only: the stranded text is never applied and never quoted.
+- **Router plumbing for the fall-through:** the cross-channel dedup check is memoized per envelope object, so the adopted first message isn't swallowed by `handleText`'s re-check while true redeliveries (fresh envelope, same message id) still dedup globally.
+- Regression coverage: `test-intro-adoption.js` joins the chain (adoption unit + through-the-router integration, fail-closed attestation, approval owner-mirror and in-place repair); `test-mandate-hygiene.js` pins the name-fallback refusal and personId resolution; `test-kazee-group-gate.js` pins the dm attestation and its fail-closed absence; `test-enforcer.js` pins the stranded-mandate hint and that the stranded text never reaches the live mandate.
+
 ## v3.3.1 — Message length can no longer kill the voice: chunked pocket TTS (re-cut carrying unpublished v3.3.0)
 
 - **Long voice notes died at 60 seconds of synthesis.** `pocketToVoice` sent the ENTIRE cleaned text to the speech gateway as one request under `AbortSignal.timeout(60000)`. A long reply blew that window, the pocket route returned null, and on pods the fallback chain has nowhere to go (no ElevenLabs key, no macOS `say`) — so `say` bounced with "no TTS route available" and agents improvised manual per-paragraph chunking (sales-bot, 2026-08-19). Long text is now sentence-packed into ≤450-char chunks (`chunkForTTS`; run-on sentences hard-split at word boundaries so nothing can recreate the timeout), each chunk synthesized in its own 120s window with one retry (a transient gateway blip no longer wastes the chunks already done), and the wavs concatenated via ffmpeg's concat demuxer into ONE ogg/opus. Short text keeps the exact single-request behavior. Benefits every consumer of `textToVoice`/`textToVoiceFile`: `say`, `tts`, and whole voice-note replies; the voice channel's streamed per-sentence path is untouched. Regression pinned in `test-speech-loopback.js`: multiple gateway calls each inside the pack limit, same voice across chunks, lossless reassembly, temp cleanup, and chunker unit coverage.

package/channels/kazee/adapter.js

@@ -301,6 +301,12 @@ class KazeeAdapter {
         }
         envelope.engaged = true;
         envelope.surface = "group";
+        envelope.isGroup = true;
+      } else if (meta) {
+        // Adapter-attested 1:1 conversation — required before intro-flow may
+        // auto-adopt the chat for a known sender. Set only on a positive meta
+        // read: an unresolvable chat stays unattested (fail closed).
+        envelope.surface = "dm";
       }
     }
 

package/channels/spaces/adapter.js

@@ -269,11 +269,20 @@ class SpacesAdapter {
     if (!engage) return;
 
     const channelId = `task:${n.taskId}`;
+    // A task is a room, never a person. Falling back to the task id when the
+    // notification carries no actor minted an identity out of the room, so
+    // everyone commenting on that task shared one principal. With no actor we
+    // have no principal, and say so in a form that cannot collide with a real
+    // Spaces user id.
+    const actorId = n.actorId ? String(n.actorId) : "";
+    const principalId = actorId || `unknown-actor:${n.taskId}`;
     const envelope = {
       adapter: this,
       channelId,
-      canonicalUserId: canonicalForChannel("spaces", n.actorId || n.taskId),
-      userId: n.actorId || n.taskId,
+      canonicalUserId: canonicalForChannel("spaces", principalId),
+      userId: principalId,
+      // Task threads are multi-party rooms: no room-derived authority, ever.
+      isGroup: true,
       type: "text",
       text: n.content || `[${n.type} on task ${n.title || n.taskId}]`,
       // Thread the bot's reply under the exact comment that triggered this engage

package/channels/telegram/adapter.js

@@ -478,13 +478,16 @@ class TelegramAdapter {
     this.bot.on("document", (msg) => this._emit("message", this._envelopeMedia(msg, "document", msg.document)));
 
     this.bot.on("callback_query", (q) => {
-      const chatId = String(q.message?.chat?.id || q.from?.id);
-      const userId = String(q.from?.id || chatId);
+      const { chatId, userId, canonicalUserId, isGroup } = this._identity(
+        { chat: q.message?.chat, from: q.from },
+        q.from?.id,
+      );
       this._emit("action", {
         adapter: this,
         channelId: chatId,
-        canonicalUserId: canonicalForChannel("telegram", chatId),
+        canonicalUserId,
         userId,
+        isGroup,
         type: "action",
         messageId: q.message?.message_id,
         from: { id: userId, name: [q.from?.first_name, q.from?.last_name].filter(Boolean).join(" "), username: q.from?.username },
@@ -499,14 +502,30 @@ class TelegramAdapter {
     });
   }
 
+  // Who is speaking (sender id) and where (chat id) are different questions.
+  // Resolving canonical identity from the chat id made every member of a group
+  // share one identity — including, where the group carried isOwner, the
+  // owner's. In a Telegram DM chat.id === from.id, so DM identity is unchanged.
+  _identity(msg, fallbackChatId) {
+    const chatId = String(msg?.chat?.id ?? fallbackChatId ?? "");
+    const senderId = msg?.from?.id != null ? String(msg.from.id) : chatId;
+    const chatType = String(msg?.chat?.type || "");
+    return {
+      chatId,
+      userId: senderId,
+      canonicalUserId: canonicalForChannel("telegram", senderId),
+      isGroup: chatType === "group" || chatType === "supergroup" || chatType === "channel",
+    };
+  }
+
   _envelopeText(msg, extra = {}) {
-    const chatId = String(msg.chat.id);
-    const userId = String(msg.from?.id || chatId);
+    const { chatId, userId, canonicalUserId, isGroup } = this._identity(msg);
     return {
       adapter: this,
       channelId: chatId,
-      canonicalUserId: canonicalForChannel("telegram", chatId),
+      canonicalUserId,
       userId,
+      isGroup,
       type: extra.isCommand ? "command" : "text",
       text: msg.text,
       messageId: msg.message_id,
@@ -524,13 +543,13 @@ class TelegramAdapter {
   }
 
   _envelopeMedia(msg, kind, media) {
-    const chatId = String(msg.chat.id);
-    const userId = String(msg.from?.id || chatId);
+    const { chatId, userId, canonicalUserId, isGroup } = this._identity(msg);
     return {
       adapter: this,
       channelId: chatId,
-      canonicalUserId: canonicalForChannel("telegram", chatId),
+      canonicalUserId,
       userId,
+      isGroup,
       type: kind,
       messageId: msg.message_id,
       replyToId: msg.reply_to_message?.message_id,

package/core/access.js

@@ -6,7 +6,8 @@
 
 const fs = require("fs");
 const { AUTH_FILE, CHAT_ID, CHAT_IDS, config, saveEnvKey } = require("./config");
-const { currentTransport, currentUserId } = require("./context");
+const { currentTransport, currentUserId, currentIsGroup } = require("./context");
+const { atomicWriteFileSync, readJsonWithFallback, withFileLock } = require("./fsutil");
 
 // Per-transport owner identifiers that don't live in CHAT_IDS or auth.json.
 // Kazee envelopes carry the chat-document id as channelId, while the bot
@@ -14,6 +15,10 @@ const { currentTransport, currentUserId } = require("./context");
 // /channel add can update the value without a process restart.
 function transportOwnerUserId(transport) {
   if (transport === "kazee") return config.KAZEE_OWNER_USER_ID || "";
+  // Spaces actors are central/Kazee user ids, so the owner carries the same id
+  // there. Without this the owner's own task comments authorize as a stranger
+  // on a Spaces-only pod, which has no Kazee chat surface to fall back on.
+  if (transport === "spaces") return config.KAZEE_OWNER_USER_ID || "";
   // The voice channel is single-owner: the bearer token gates the connection,
   // and every envelope carries this fixed owner id, so it authorizes as owner.
   if (transport === "voice") return config.VOICE_OWNER_USER_ID || "voice-owner";
@@ -33,19 +38,30 @@ function matchesTransportOwner() {
 }
 
 function loadAuth() {
-  try {
-    const auth = JSON.parse(fs.readFileSync(AUTH_FILE, "utf-8"));
-    return {
-      authorized: Array.isArray(auth.authorized) ? auth.authorized : [],
-      pending: Array.isArray(auth.pending) ? auth.pending : [],
-    };
-  } catch (e) {
-    return { authorized: [], pending: [] };
-  }
+  const auth = readJsonWithFallback(AUTH_FILE, null) || {};
+  return {
+    authorized: Array.isArray(auth.authorized) ? auth.authorized : [],
+    pending: Array.isArray(auth.pending) ? auth.pending : [],
+  };
 }
 
+// This file decides who owns the agent, so a torn write is not a small loss:
+// a half-written auth.json used to parse as "no owner", and no owner is what
+// lets the next /auth from a stranger seize ownership. Atomic + `.bak` so the
+// last good roster survives a crash mid-write.
 function saveAuth(auth) {
-  fs.writeFileSync(AUTH_FILE, JSON.stringify(auth, null, 2));
+  atomicWriteFileSync(AUTH_FILE, `${JSON.stringify(auth, null, 2)}\n`, { backup: true });
+}
+
+// Read-modify-write under the store lock — an approval and a revoke landing
+// together must not have one silently overwrite the other's roster.
+function mutateAuth(fn) {
+  return withFileLock(AUTH_FILE, () => {
+    const auth = loadAuth();
+    const result = fn(auth);
+    saveAuth(auth);
+    return result;
+  });
 }
 
 function isChatAuthorized(chatId, envelope) {
@@ -71,8 +87,7 @@ function isChatAuthorized(chatId, envelope) {
   } catch (e) {}
   if (CHAT_IDS.includes(id)) return true;
   try {
-    const auth = JSON.parse(fs.readFileSync(AUTH_FILE, "utf-8"));
-    if (Array.isArray(auth.authorized) && auth.authorized.some((a) => String(a.chatId) === id)) return true;
+    if (loadAuth().authorized.some((a) => String(a.chatId) === id)) return true;
   } catch (e) {}
   // Also accept any chat that has been linked to a person via an intro.
   try {
@@ -86,17 +101,36 @@ function isChatAuthorized(chatId, envelope) {
   return false;
 }
 
+// Owner is a property of the PERSON, never of the room they are speaking in.
+// The argument is named chatId for call-site compatibility, but it is only
+// honoured as an identity in a 1:1 chat, where chat and speaker are the same
+// being. In a group the room id is discarded outright: a group carrying
+// isOwner in auth.json (or sitting in CHAT_IDS) would otherwise promote every
+// member of that group to owner.
 function isChatOwner(chatId) {
   if (matchesTransportOwner()) return true;
-  const id = String(chatId || "");
+  const inGroup = currentIsGroup();
+  const speakerId = String(currentUserId() || "");
+  // In a group only the speaker counts; in a DM the passed chat id is the
+  // speaker, and stays usable for callers outside a turn scope (CLI, tests).
+  const id = inGroup ? speakerId : (String(chatId || "") || speakerId);
   if (!id) return false;
-  if (id === String(CHAT_ID || "")) return true;
+  // A person marked isOwner on their people record owns the agent everywhere,
+  // on every surface — that record is written only by an existing owner.
+  try {
+    const people = require("./people");
+    const transport = currentTransport();
+    if (transport && speakerId) {
+      const person = people.findByHandle(transport, speakerId);
+      if (person && person.isOwner === true) return true;
+    }
+  } catch (e) {}
+  if (!inGroup && id === String(CHAT_ID || "")) return true;
   try {
-    const auth = JSON.parse(fs.readFileSync(AUTH_FILE, "utf-8"));
-    const authorized = Array.isArray(auth.authorized) ? auth.authorized : [];
+    const { authorized } = loadAuth();
     if (authorized.some((a) => String(a.chatId) === id && a.isOwner === true)) return true;
     // No explicit owner flag → fall back to .env CHAT_IDS membership.
-    if (!authorized.some((a) => a.isOwner === true) && CHAT_IDS.includes(id)) return true;
+    if (!inGroup && !authorized.some((a) => a.isOwner === true) && CHAT_IDS.includes(id)) return true;
   } catch (e) {}
   return false;
 }
@@ -114,48 +148,48 @@ function updateAuthorizedChatEnv(auth) {
 }
 
 function approveAuthRequest(chatId) {
-  const auth = loadAuth();
-  if (auth.authorized.some((a) => String(a.chatId) === chatId)) {
-    auth.pending = auth.pending.filter((p) => String(p.chatId) !== chatId);
-    saveAuth(auth);
-    updateAuthorizedChatEnv(auth);
-    return { status: "already_authorized" };
-  }
-  const idx = auth.pending.findIndex((p) => String(p.chatId) === chatId);
-  if (idx < 0) return { status: "not_found" };
-  const approved = auth.pending.splice(idx, 1)[0];
-  auth.authorized.push({
-    chatId: approved.chatId,
-    name: approved.name,
-    username: approved.username,
-    isOwner: false,
-    authorizedAt: new Date().toISOString(),
+  const outcome = mutateAuth((auth) => {
+    if (auth.authorized.some((a) => String(a.chatId) === chatId)) {
+      auth.pending = auth.pending.filter((p) => String(p.chatId) !== chatId);
+      return { status: "already_authorized", auth };
+    }
+    const idx = auth.pending.findIndex((p) => String(p.chatId) === chatId);
+    if (idx < 0) return { status: "not_found" };
+    const approved = auth.pending.splice(idx, 1)[0];
+    auth.authorized.push({
+      chatId: approved.chatId,
+      name: approved.name,
+      username: approved.username,
+      isOwner: false,
+      authorizedAt: new Date().toISOString(),
+    });
+    return { status: "approved", request: approved, auth };
   });
-  saveAuth(auth);
-  updateAuthorizedChatEnv(auth);
-  return { status: "approved", request: approved };
+  if (outcome.auth) updateAuthorizedChatEnv(outcome.auth);
+  return outcome.status === "approved"
+    ? { status: "approved", request: outcome.request }
+    : { status: outcome.status };
 }
 
 function denyAuthRequest(chatId) {
-  const auth = loadAuth();
-  const idx = auth.pending.findIndex((p) => String(p.chatId) === chatId);
-  if (idx < 0) return { status: "not_found" };
-  const denied = auth.pending.splice(idx, 1)[0];
-  saveAuth(auth);
-  return { status: "denied", request: denied };
+  return mutateAuth((auth) => {
+    const idx = auth.pending.findIndex((p) => String(p.chatId) === chatId);
+    if (idx < 0) return { status: "not_found" };
+    return { status: "denied", request: auth.pending.splice(idx, 1)[0] };
+  });
 }
 
 function recordPendingAuthRequest({ chatId, name, username }) {
-  const auth = loadAuth();
-  if (auth.pending.some((p) => String(p.chatId) === String(chatId))) return { status: "already_pending" };
-  auth.pending.push({
-    chatId: String(chatId),
-    name,
-    username,
-    requestedAt: new Date().toISOString(),
+  return mutateAuth((auth) => {
+    if (auth.pending.some((p) => String(p.chatId) === String(chatId))) return { status: "already_pending" };
+    auth.pending.push({
+      chatId: String(chatId),
+      name,
+      username,
+      requestedAt: new Date().toISOString(),
+    });
+    return { status: "queued" };
   });
-  saveAuth(auth);
-  return { status: "queued" };
 }
 
 // Remove a chatId from the legacy auth.json. Owners are never removed
@@ -164,20 +198,21 @@ function recordPendingAuthRequest({ chatId, name, username }) {
 function revokeChat(chatId) {
   const id = String(chatId || "");
   if (!id) return { ok: false, reason: "missing_id" };
-  const auth = loadAuth();
-  const before = auth.authorized.length;
-  auth.authorized = auth.authorized.filter((a) => {
-    if (String(a.chatId) !== id) return true;
-    if (a.isOwner === true) return true;
-    return false;
+  const outcome = mutateAuth((auth) => {
+    const before = { authorized: auth.authorized.length, pending: auth.pending.length };
+    auth.authorized = auth.authorized.filter((a) => {
+      if (String(a.chatId) !== id) return true;
+      if (a.isOwner === true) return true;
+      return false;
+    });
+    auth.pending = auth.pending.filter((p) => String(p.chatId) !== id);
+    if (auth.authorized.length === before.authorized && auth.pending.length === before.pending) {
+      return { ok: false, reason: "not_found" };
+    }
+    return { ok: true, auth };
   });
-  auth.pending = auth.pending.filter((p) => String(p.chatId) !== id);
-  if (auth.authorized.length === before) {
-    if (auth.pending.length === 0) return { ok: false, reason: "not_found" };
-  }
-  saveAuth(auth);
-  updateAuthorizedChatEnv(auth);
-  return { ok: true };
+  if (outcome.auth) updateAuthorizedChatEnv(outcome.auth);
+  return outcome.ok ? { ok: true } : { ok: false, reason: outcome.reason };
 }
 
 function listAuthorizedRaw() {
@@ -188,33 +223,42 @@ function listAuthorizedRaw() {
   };
 }
 
+// The only caller that matters treats `false` as "this pod is unclaimed, so the
+// next /auth may bootstrap an owner". That makes the answer security-critical in
+// exactly one direction: a wrong `false` hands the agent to whoever asks next.
+//
+// So the two ways of having no owner are NOT the same. A missing auth.json means
+// a genuinely fresh pod and answers false. A file that exists but neither it nor
+// its `.bak` will parse means the roster is unknown, not empty — that fails
+// closed, because refusing a legitimate re-bootstrap is recoverable and handing
+// ownership to a stranger is not.
 function hasOwner() {
   if (CHAT_ID) return true;
   // A provisioned Kazee owner (env-injected or set via /channel add) counts
   // before their first message — otherwise a stranger's /auth on a
   // Kazee-only pod would seize ownership.
   if (config.KAZEE_OWNER_USER_ID) return true;
-  try {
-    const auth = JSON.parse(fs.readFileSync(AUTH_FILE, "utf-8"));
-    return Array.isArray(auth.authorized) && auth.authorized.some((a) => a.isOwner === true);
-  } catch (e) {
-    return false;
+  const auth = readJsonWithFallback(AUTH_FILE, null);
+  if (auth && Array.isArray(auth.authorized)) {
+    return auth.authorized.some((a) => a.isOwner === true);
   }
+  try { return fs.existsSync(AUTH_FILE); } catch (e) { return true; }
 }
 
 function bootstrapOwner({ chatId, name, username }) {
   const id = String(chatId);
-  const auth = loadAuth();
-  auth.pending = auth.pending.filter((p) => String(p.chatId) !== id);
-  auth.authorized = auth.authorized.filter((a) => String(a.chatId) !== id);
-  auth.authorized.push({
-    chatId: id,
-    name: name || "",
-    username: username || "",
-    isOwner: true,
-    authorizedAt: new Date().toISOString(),
+  mutateAuth((auth) => {
+    auth.pending = auth.pending.filter((p) => String(p.chatId) !== id);
+    auth.authorized = auth.authorized.filter((a) => String(a.chatId) !== id);
+    auth.authorized.push({
+      chatId: id,
+      name: name || "",
+      username: username || "",
+      isOwner: true,
+      authorizedAt: new Date().toISOString(),
+    });
+    return { ok: true };
   });
-  saveAuth(auth);
   if (currentTransport() === "kazee") {
     // Kazee owner identity is the user id (what transportOwnerUserId
     // compares), not the chat-document id the envelope carries as chatId —
@@ -231,6 +275,7 @@ function bootstrapOwner({ chatId, name, username }) {
 module.exports = {
   loadAuth,
   saveAuth,
+  mutateAuth,
   isChatAuthorized,
   isChatOwner,
   authRequestLabel,

package/core/actions.js

@@ -89,7 +89,21 @@ function appendMandate(rec, line) {
 function appendMandateLine(rec, lineText, log, opts) {
   const entities = require("./entities");
   const mandates = require("./mandates");
-  const ent = rec.entitySlug ? entities.readEntity(rec.entitySlug) : null;
+  // Strictly slug-keyed: resolve through the record's entitySlug, else through
+  // the person record by id. NEVER name-keyed — a display name is spoofable,
+  // and a name-keyed upsert can land security text on a same-named OTHER
+  // person's note (the exact escalation the hashed auto-contact slugs exist
+  // to prevent).
+  let slug = String(rec.entitySlug || "").trim();
+  if (!slug && rec.personId) {
+    try {
+      const people = require("./people");
+      const person = people.findById(String(rec.personId));
+      slug = String((person && people.resolveEntitySlug(person)) || "").trim();
+    } catch (e) { slug = ""; }
+  }
+  if (!slug) return { ok: false, reason: "no linked contact record to hold the grant" };
+  const ent = entities.readEntity(slug);
   const name = (ent && ent.name) || rec.personName;
   if (!name) return { ok: false, reason: "no contact record" };
   const coreText = mandates.splitExpiry(String(lineText || "")).text;
@@ -121,14 +135,12 @@ function appendMandateLine(rec, lineText, log, opts) {
     return { ok: false, reason: "their mandate is full — trim it with /guardrails" };
   }
   const up = entities.upsertEntity({
-    slug: (ent && ent.slug) || rec.entitySlug || undefined,
+    slug,
     name,
     relationship: (ent && ent.relationship) || "external",
     mandate,
     log,
   });
-  // id is slug-scoped, so derive it from the entity the write actually landed
-  // on (legacy name-keyed upserts can resolve to a pre-existing slug).
   const res = { ok: true, id: mandates.lineId(up.entity.slug, coreText), expiresAt: expiresAt || null };
   if (refreshed) res.refreshed = true;
   return res;
@@ -714,6 +726,48 @@ async function handleAction(envelope) {
     if (makeRule && rec.status === "approved" && wasPending) await promptRuleScope();
     return;
   }
+  if (d.startsWith("grn:")) {
+    // Standing capability grant from an approval card, with its REACH. Unlike
+    // the grl: rules below — free text a model judges — this writes a
+    // deterministic (principal × room) record, so the next equivalent request
+    // is cleared by lookup and never reaches the model at all.
+    //
+    // "here" is the default because the grant unit is the PAIR: trusting
+    // someone in one room must not trust them in every room they share with
+    // the bot. "everywhere" is a separate, explicit tap.
+    if (!isChatOwner(envelope.channelId)) return send("Owner only — grants are restricted.");
+    const parts = d.split(":");
+    const rec = require("./approvals").read(parts[1]);
+    const reach = parts[2]; // "room" | "all"
+    if (reach !== "room" && reach !== "all") return;
+    if (!rec) return send("That request expired — nothing to grant from it.");
+    if (!rec.speakerId || !rec.room) return send("I can't tell who asked apart from where they asked — no grant written.");
+    // A reply/triage card only ever cleared talking; an action card carries the
+    // tier it asked for. Never grant more than the card actually showed.
+    const capability = rec.kind === "action"
+      ? (String(rec.tier || "") === "destructive" ? "destructive" : "act")
+      : "read";
+    let record;
+    try {
+      record = require("./grants").grant({
+        adapter: rec.targetAdapter || rec.adapter,
+        senderId: rec.speakerId,
+        room: rec.room,
+        allRooms: reach === "all",
+        capability,
+        personId: rec.personId || null,
+        grantedBy: String(envelope.channelId),
+      });
+    } catch (e) {
+      return send(`Couldn't write that grant: ${e.message}`);
+    }
+    try { require("./audit").log("grant.issued", { id: record.id, principal: `${record.principal.adapter}:${record.principal.channelId}`, room: record.room, capability: record.capability, by: record.grantedBy }); } catch (e) {}
+    const who = rec.personName || "them";
+    const where = reach === "all"
+      ? "every room they share with me"
+      : (rec.channelLabel || rec.room);
+    return send(`✅ Granted ${who} \`${capability}\` in ${where}.\nI'll stop asking for this. Revoke: /grants revoke ${record.id}`);
+  }
   if (d.startsWith("grl:")) {
     // External-guardrail "Make a rule" scope buttons. Owner-only. Records the
     // chosen scope on the conversation state, then the router's handleText

package/core/approvals.js

@@ -119,6 +119,11 @@ function create({
   payloadText = "", targetAdapter = "", targetChannel = "",
   personName = "", personId = "", entitySlug = "", inboundText = "",
   channelLabel = "",
+  // WHO spoke and WHERE, kept apart: a capability grant issued from this card is
+  // for the pair, and targetChannel is only the room. On any transport where a
+  // room holds many people they are different values, so recording only the
+  // room would hand one member's grant to everyone in it.
+  speakerId = "", room = "",
 } = {}) {
   fs.mkdirSync(APPROVALS_DIR, { recursive: true, mode: 0o700 });
   prune();
@@ -142,6 +147,7 @@ function create({
     personName: String(personName || ""), personId: String(personId || ""), entitySlug: String(entitySlug || ""),
     inboundText: String(inboundText || "").slice(0, 1000),
     channelLabel: String(channelLabel || "").slice(0, 120),
+    speakerId: String(speakerId || ""), room: String(room || ""),
     requestedAt: new Date().toISOString(),
   };
   writeRecord(rec);

package/core/config.js

@@ -159,6 +159,7 @@ const AUTH_FILE = config.AUTH_FILE || path.join(CONFIG_DIR, "auth.json");
 const IDENTITIES_FILE = config.IDENTITIES_FILE || path.join(CONFIG_DIR, "identities.json");
 const PEOPLE_FILE = config.PEOPLE_FILE || path.join(CONFIG_DIR, "people.json");
 const INTROS_FILE = config.INTROS_FILE || path.join(CONFIG_DIR, "intros.json");
+const GRANTS_FILE = config.GRANTS_FILE || path.join(CONFIG_DIR, "grants.json");
 const AUDIT_FILE = config.AUDIT_FILE || path.join(CONFIG_DIR, "audit.log");
 const STATE_FILE = path.join(CONFIG_DIR, "state.json");
 const SESSIONS_FILE = path.join(CONFIG_DIR, "sessions.json");
@@ -381,7 +382,7 @@ module.exports = {
   ELEVENLABS_API_KEY, ELEVENLABS_VOICE_ID, ELEVENLABS_MODEL,
   SPEECH_SERVICE_URL, SPEECH_API_KEY, AGENTSPACE_POD_TOKEN, POCKET_TTS_VOICE, TTS_PROVIDER, VOICE_REPLY_MODE,
   SOUL_FILE, CRONS_FILE, JOBS_FILE, TASKS_DIR, VAULT_FILE, AUTH_FILE, IDENTITIES_FILE,
-  PEOPLE_FILE, INTROS_FILE, AUDIT_FILE,
+  PEOPLE_FILE, INTROS_FILE, GRANTS_FILE, AUDIT_FILE,
   STATE_FILE, SESSIONS_FILE,
   TEMP_DIR, FILES_DIR,
   MAX_FILE_SIZE, MAX_VOICE_SIZE, MAX_PROCESS_TIMEOUT, COMPACT_SUMMARY_TIMEOUT,

package/core/context.js

@@ -6,8 +6,8 @@ const { AsyncLocalStorage } = require("node:async_hooks");
 
 const chatContext = new AsyncLocalStorage();
 
-function runInChat({ adapter, channelId, canonicalUserId, userId, transport, raw, conversationKey, inboundText, speakerName, triageApprovalId }, fn) {
-  return chatContext.run({ adapter, channelId, canonicalUserId, userId, transport, raw, conversationKey, inboundText, speakerName, triageApprovalId }, fn);
+function runInChat({ adapter, channelId, canonicalUserId, userId, transport, raw, conversationKey, roomKey, inboundText, speakerName, triageApprovalId, isGroup }, fn) {
+  return chatContext.run({ adapter, channelId, canonicalUserId, userId, transport, raw, conversationKey, roomKey, inboundText, speakerName, triageApprovalId, isGroup: !!isGroup }, fn);
 }
 
 function currentStore() {
@@ -44,6 +44,15 @@ function currentTransport() {
   return s ? s.transport : null;
 }
 
+// True when this turn is happening in a multi-party room rather than a DM.
+// Authority is never derived from a room, so ownership checks that would
+// otherwise accept a configured chat id must refuse it here: a group id in
+// CHAT_IDS or auth.json would otherwise make every member an owner.
+function currentIsGroup() {
+  const s = currentStore();
+  return !!(s && s.isGroup);
+}
+
 // The per-thread conversation key for this turn (e.g. "telegram:6251055967",
 // "spaces:task:42"). Distinct from the (possibly unified) canonical speaker
 // identity: identity says WHO is talking, conversationKey says WHICH thread —
@@ -54,6 +63,19 @@ function currentConversationKey() {
   return s && s.conversationKey ? s.conversationKey : null;
 }
 
+// The room this turn happens in, as `<surface>:<id>` — what owns the shared
+// runtime settings (provider/model/effort) and the capability grants. For an
+// inbound message the thread IS the room, so conversationKey is the default.
+// A scheduled job is the case that forces them apart: it resumes its own saved
+// thread (conversationKey = the job's project) while still belonging to the
+// room it was created in, and must answer under that room's provider — not the
+// creator's personal default.
+function currentRoomKey() {
+  const s = currentStore();
+  if (!s) return null;
+  return s.roomKey || s.conversationKey || null;
+}
+
 // The raw inbound text of the turn being handled, and the transport display
 // name of whoever sent it. Used by the external guardrail to show the owner
 // WHO asked and WHAT they asked on the approval card — the speaker's people
@@ -95,7 +117,9 @@ module.exports = {
   currentCanonicalUserId,
   currentUserId,
   currentTransport,
+  currentIsGroup,
   currentConversationKey,
+  currentRoomKey,
   currentRaw,
   currentInboundText,
   setCurrentInboundText,