@inetafrica/open-claudia 3.3.2 → 3.4.1

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## v3.4.1 — Fable 5.1, and the CLI floor it quietly needs
+
+- **`claude-fable-5-1` joins the Claude model picker.** The identifier is dash-form; `claude-fable-5.1` does not exist and fails as an unknown model.
+- **It carries a CLI floor: Claude Code >= 2.1.251.** An older CLI does not degrade gracefully — it returns an API 400 naming the required version. The local install was taken 2.1.150 -> 2.1.258 before the model was listed, and the picker offering a button the local binary cannot serve is the failure mode to avoid. Pod images install Claude Code unpinned, so a rebuild clears the floor by itself, but pods still on older images will 400 on this model until they are rolled.
+- Verified by building the real main invocation through the provider and spawning it, rather than by a hand-written CLI probe: the API reported `claude-fable-5-1` as the serving model, and `claude-opus-4-8` was re-run through the same harness to prove the incumbent path was untouched. Full suite 135/135.
+
+## v3.4.0 — Who you are, where you are, and what you may do there are three different questions
+
+- **The bug that started it: a wakeup scheduled in a Codex room kept running on Claude.** `getActiveProvider` resolves the room's overlay from `state.roomKey`, but that key was stamped from `currentConversationKey()` — and a scheduled job resumes its own saved thread, whose conversation key is the job's *project name*, not a room. The overlay never resolved, so every job silently fell back to the creator's personal default. The thread and the room are now separate values (`roomKey`, defaulting to the conversation key so every inbound path is unchanged); the scheduler passes the room the job was created in. The same fusion is why a group answered as Codex to one person and Claude to another. Relatedly, a run that reverts to the provider it was scheduled under because the room's current choice is not runnable now **says so** — in the prompt and in a ⚠️ line on the advisory — instead of leaving a Codex room reporting a Claude quota error with nothing to explain where Claude came from.
+- **A room is not a person.** Authority was resolved from `channelId`, which on every transport where a room holds many people is not an identity at all. Principal is now always the transport USER id, carried separately from the room all the way to the enforcer. A group carrying `isOwner` in `auth.json` can no longer promote every member of that group to owner.
+- **Capability is a lookup, not a judgment.** A live `(principal × room)` grant short-circuits the enforcer *before* any model call, so an owner's own decision is never re-litigated by a judge. The grant unit is the **pair**: trusting someone in one group never trusts them in another, nor trusts the rest of that group — "🌍 Always — everywhere" is a separate, explicit tap next to the default "✅ Always — here". Grants carry a capability ladder (`read` < `act` < `destructive`, so an `act` grant can never authorize a destructive run), an optional subject scope, and optional expiry or one-turn burn-down. Re-granting replaces rather than stacks, so downgrading actually downgrades. Deliberately additive: *no grant* is not a denial — the existing mandate and channel-rule paths still run underneath. New `/grants` lists and revokes; every issue is audited.
+- **Group admins carry zero authority in the pod.** Presence is surface-owned (whoever administers a room decides whether the agent is *in* it — an agent is a user like any other); capability is pod-owned and set by owners alone. Otherwise sharing a room with someone would make them an admin of your account.
+- **A second owner could never approve anything.** Escalation resolved `owners()[0]` and posted every card to that one person, so a card went unanswered whenever they were away. Cards now fan out to every reachable owner, deduped by send target; any owner may decide whichever copy they see, and the decision is idempotent.
+- **A grant that expired looked exactly like one you never gave.** The bot simply started asking again with nothing to explain why. Escalation cards now name the lapsed line and its date, at the moment the lapse bites.
+- **A torn write could silently demote the owner.** `people.json` was written without fsync or a backup and read as `[]` on any failure — no person found means "external", so one interrupted write guarded the owner in their own pod. Worse, a corrupt `auth.json` parsed as *no owner*, and no owner is what lets the next `/auth` from a stranger seize the pod. Both stores now write atomically with a `.bak` snapshot, recover from it transparently, and serialize read-modify-writes through a cross-process lock (the bot and the CLI are separate writers). `hasOwner()` now distinguishes *absent* (fresh pod, still claimable) from *unreadable* (fails closed). The dashboard and installer carried their own `loadAuth` that would have overwritten the recoverable copy with an empty roster; both fixed.
+- **Surface-agnostic by construction.** A room is `<surface>:<id>` — a Spaces task thread resolves identically to a Telegram group, so a Spaces-only pod needs no chat surface at all.
+- Regression coverage: `test-grants.js` (the pair is the unit, the capability ladder, reach vs strength, scope, revocation/expiry/one-turn, replace-not-stack, default-deny) and `test-store-durability.js` (`.bak` recovery, fail-closed vs still-claimable, lock exclusivity and stale reclaim) join the chain.
+
 ## v3.3.2 — Known people are recognized by transport id, approved owners stay owners, and a mandate can no longer land on the wrong note
 
 - **Every known person got interrogated on a fresh Kazee DM.** The intro flow matched inbound chats only by `(adapter, channelId)` — but Kazee DMs key the envelope's channelId by the conversation *document* id while people handles store the sender's *user* id, so nothing ever matched: known teammates, and the owner on pods without `KAZEE_OWNER_USER_ID`, all got "who are you" (the Coders Africa incident, 2026-08-19/20). Now a sender whose transport user id already maps to a person is silently **adopted**: the DM channel is linked to their record, an auth entry is written, any stale pending intro is resolved, and `handleInbound` returns false so the router falls through and handles the turn normally. Adoption is gated on adapter-attested `surface: "dm"` — the Kazee adapter sets it only on a positive chat-meta read (`isGroupChat: false`); a failed meta read attests nothing (fail closed) — because auth.json standing is per-CHANNEL and adopting a room would hand every member the sender's standing. Display names are never matched; only the transport id, the same trust level as the env owner match.

package/channels/kazee/adapter.js

@@ -301,6 +301,7 @@ class KazeeAdapter {
         }
         envelope.engaged = true;
         envelope.surface = "group";
+        envelope.isGroup = true;
       } else if (meta) {
         // Adapter-attested 1:1 conversation — required before intro-flow may
         // auto-adopt the chat for a known sender. Set only on a positive meta

package/channels/spaces/adapter.js

@@ -269,11 +269,20 @@ class SpacesAdapter {
     if (!engage) return;
 
     const channelId = `task:${n.taskId}`;
+    // A task is a room, never a person. Falling back to the task id when the
+    // notification carries no actor minted an identity out of the room, so
+    // everyone commenting on that task shared one principal. With no actor we
+    // have no principal, and say so in a form that cannot collide with a real
+    // Spaces user id.
+    const actorId = n.actorId ? String(n.actorId) : "";
+    const principalId = actorId || `unknown-actor:${n.taskId}`;
     const envelope = {
       adapter: this,
       channelId,
-      canonicalUserId: canonicalForChannel("spaces", n.actorId || n.taskId),
-      userId: n.actorId || n.taskId,
+      canonicalUserId: canonicalForChannel("spaces", principalId),
+      userId: principalId,
+      // Task threads are multi-party rooms: no room-derived authority, ever.
+      isGroup: true,
       type: "text",
       text: n.content || `[${n.type} on task ${n.title || n.taskId}]`,
       // Thread the bot's reply under the exact comment that triggered this engage

package/channels/telegram/adapter.js

@@ -478,13 +478,16 @@ class TelegramAdapter {
     this.bot.on("document", (msg) => this._emit("message", this._envelopeMedia(msg, "document", msg.document)));
 
     this.bot.on("callback_query", (q) => {
-      const chatId = String(q.message?.chat?.id || q.from?.id);
-      const userId = String(q.from?.id || chatId);
+      const { chatId, userId, canonicalUserId, isGroup } = this._identity(
+        { chat: q.message?.chat, from: q.from },
+        q.from?.id,
+      );
       this._emit("action", {
         adapter: this,
         channelId: chatId,
-        canonicalUserId: canonicalForChannel("telegram", chatId),
+        canonicalUserId,
         userId,
+        isGroup,
         type: "action",
         messageId: q.message?.message_id,
         from: { id: userId, name: [q.from?.first_name, q.from?.last_name].filter(Boolean).join(" "), username: q.from?.username },
@@ -499,14 +502,30 @@ class TelegramAdapter {
     });
   }
 
+  // Who is speaking (sender id) and where (chat id) are different questions.
+  // Resolving canonical identity from the chat id made every member of a group
+  // share one identity — including, where the group carried isOwner, the
+  // owner's. In a Telegram DM chat.id === from.id, so DM identity is unchanged.
+  _identity(msg, fallbackChatId) {
+    const chatId = String(msg?.chat?.id ?? fallbackChatId ?? "");
+    const senderId = msg?.from?.id != null ? String(msg.from.id) : chatId;
+    const chatType = String(msg?.chat?.type || "");
+    return {
+      chatId,
+      userId: senderId,
+      canonicalUserId: canonicalForChannel("telegram", senderId),
+      isGroup: chatType === "group" || chatType === "supergroup" || chatType === "channel",
+    };
+  }
+
   _envelopeText(msg, extra = {}) {
-    const chatId = String(msg.chat.id);
-    const userId = String(msg.from?.id || chatId);
+    const { chatId, userId, canonicalUserId, isGroup } = this._identity(msg);
     return {
       adapter: this,
       channelId: chatId,
-      canonicalUserId: canonicalForChannel("telegram", chatId),
+      canonicalUserId,
       userId,
+      isGroup,
       type: extra.isCommand ? "command" : "text",
       text: msg.text,
       messageId: msg.message_id,
@@ -524,13 +543,13 @@ class TelegramAdapter {
   }
 
   _envelopeMedia(msg, kind, media) {
-    const chatId = String(msg.chat.id);
-    const userId = String(msg.from?.id || chatId);
+    const { chatId, userId, canonicalUserId, isGroup } = this._identity(msg);
     return {
       adapter: this,
       channelId: chatId,
-      canonicalUserId: canonicalForChannel("telegram", chatId),
+      canonicalUserId,
       userId,
+      isGroup,
       type: kind,
       messageId: msg.message_id,
       replyToId: msg.reply_to_message?.message_id,

package/core/access.js

@@ -6,7 +6,8 @@
 
 const fs = require("fs");
 const { AUTH_FILE, CHAT_ID, CHAT_IDS, config, saveEnvKey } = require("./config");
-const { currentTransport, currentUserId } = require("./context");
+const { currentTransport, currentUserId, currentIsGroup } = require("./context");
+const { atomicWriteFileSync, readJsonWithFallback, withFileLock } = require("./fsutil");
 
 // Per-transport owner identifiers that don't live in CHAT_IDS or auth.json.
 // Kazee envelopes carry the chat-document id as channelId, while the bot
@@ -14,6 +15,10 @@ const { currentTransport, currentUserId } = require("./context");
 // /channel add can update the value without a process restart.
 function transportOwnerUserId(transport) {
   if (transport === "kazee") return config.KAZEE_OWNER_USER_ID || "";
+  // Spaces actors are central/Kazee user ids, so the owner carries the same id
+  // there. Without this the owner's own task comments authorize as a stranger
+  // on a Spaces-only pod, which has no Kazee chat surface to fall back on.
+  if (transport === "spaces") return config.KAZEE_OWNER_USER_ID || "";
   // The voice channel is single-owner: the bearer token gates the connection,
   // and every envelope carries this fixed owner id, so it authorizes as owner.
   if (transport === "voice") return config.VOICE_OWNER_USER_ID || "voice-owner";
@@ -33,19 +38,30 @@ function matchesTransportOwner() {
 }
 
 function loadAuth() {
-  try {
-    const auth = JSON.parse(fs.readFileSync(AUTH_FILE, "utf-8"));
-    return {
-      authorized: Array.isArray(auth.authorized) ? auth.authorized : [],
-      pending: Array.isArray(auth.pending) ? auth.pending : [],
-    };
-  } catch (e) {
-    return { authorized: [], pending: [] };
-  }
+  const auth = readJsonWithFallback(AUTH_FILE, null) || {};
+  return {
+    authorized: Array.isArray(auth.authorized) ? auth.authorized : [],
+    pending: Array.isArray(auth.pending) ? auth.pending : [],
+  };
 }
 
+// This file decides who owns the agent, so a torn write is not a small loss:
+// a half-written auth.json used to parse as "no owner", and no owner is what
+// lets the next /auth from a stranger seize ownership. Atomic + `.bak` so the
+// last good roster survives a crash mid-write.
 function saveAuth(auth) {
-  fs.writeFileSync(AUTH_FILE, JSON.stringify(auth, null, 2));
+  atomicWriteFileSync(AUTH_FILE, `${JSON.stringify(auth, null, 2)}\n`, { backup: true });
+}
+
+// Read-modify-write under the store lock — an approval and a revoke landing
+// together must not have one silently overwrite the other's roster.
+function mutateAuth(fn) {
+  return withFileLock(AUTH_FILE, () => {
+    const auth = loadAuth();
+    const result = fn(auth);
+    saveAuth(auth);
+    return result;
+  });
 }
 
 function isChatAuthorized(chatId, envelope) {
@@ -71,8 +87,7 @@ function isChatAuthorized(chatId, envelope) {
   } catch (e) {}
   if (CHAT_IDS.includes(id)) return true;
   try {
-    const auth = JSON.parse(fs.readFileSync(AUTH_FILE, "utf-8"));
-    if (Array.isArray(auth.authorized) && auth.authorized.some((a) => String(a.chatId) === id)) return true;
+    if (loadAuth().authorized.some((a) => String(a.chatId) === id)) return true;
   } catch (e) {}
   // Also accept any chat that has been linked to a person via an intro.
   try {
@@ -86,17 +101,36 @@ function isChatAuthorized(chatId, envelope) {
   return false;
 }
 
+// Owner is a property of the PERSON, never of the room they are speaking in.
+// The argument is named chatId for call-site compatibility, but it is only
+// honoured as an identity in a 1:1 chat, where chat and speaker are the same
+// being. In a group the room id is discarded outright: a group carrying
+// isOwner in auth.json (or sitting in CHAT_IDS) would otherwise promote every
+// member of that group to owner.
 function isChatOwner(chatId) {
   if (matchesTransportOwner()) return true;
-  const id = String(chatId || "");
+  const inGroup = currentIsGroup();
+  const speakerId = String(currentUserId() || "");
+  // In a group only the speaker counts; in a DM the passed chat id is the
+  // speaker, and stays usable for callers outside a turn scope (CLI, tests).
+  const id = inGroup ? speakerId : (String(chatId || "") || speakerId);
   if (!id) return false;
-  if (id === String(CHAT_ID || "")) return true;
+  // A person marked isOwner on their people record owns the agent everywhere,
+  // on every surface — that record is written only by an existing owner.
+  try {
+    const people = require("./people");
+    const transport = currentTransport();
+    if (transport && speakerId) {
+      const person = people.findByHandle(transport, speakerId);
+      if (person && person.isOwner === true) return true;
+    }
+  } catch (e) {}
+  if (!inGroup && id === String(CHAT_ID || "")) return true;
   try {
-    const auth = JSON.parse(fs.readFileSync(AUTH_FILE, "utf-8"));
-    const authorized = Array.isArray(auth.authorized) ? auth.authorized : [];
+    const { authorized } = loadAuth();
     if (authorized.some((a) => String(a.chatId) === id && a.isOwner === true)) return true;
     // No explicit owner flag → fall back to .env CHAT_IDS membership.
-    if (!authorized.some((a) => a.isOwner === true) && CHAT_IDS.includes(id)) return true;
+    if (!inGroup && !authorized.some((a) => a.isOwner === true) && CHAT_IDS.includes(id)) return true;
   } catch (e) {}
   return false;
 }
@@ -114,48 +148,48 @@ function updateAuthorizedChatEnv(auth) {
 }
 
 function approveAuthRequest(chatId) {
-  const auth = loadAuth();
-  if (auth.authorized.some((a) => String(a.chatId) === chatId)) {
-    auth.pending = auth.pending.filter((p) => String(p.chatId) !== chatId);
-    saveAuth(auth);
-    updateAuthorizedChatEnv(auth);
-    return { status: "already_authorized" };
-  }
-  const idx = auth.pending.findIndex((p) => String(p.chatId) === chatId);
-  if (idx < 0) return { status: "not_found" };
-  const approved = auth.pending.splice(idx, 1)[0];
-  auth.authorized.push({
-    chatId: approved.chatId,
-    name: approved.name,
-    username: approved.username,
-    isOwner: false,
-    authorizedAt: new Date().toISOString(),
+  const outcome = mutateAuth((auth) => {
+    if (auth.authorized.some((a) => String(a.chatId) === chatId)) {
+      auth.pending = auth.pending.filter((p) => String(p.chatId) !== chatId);
+      return { status: "already_authorized", auth };
+    }
+    const idx = auth.pending.findIndex((p) => String(p.chatId) === chatId);
+    if (idx < 0) return { status: "not_found" };
+    const approved = auth.pending.splice(idx, 1)[0];
+    auth.authorized.push({
+      chatId: approved.chatId,
+      name: approved.name,
+      username: approved.username,
+      isOwner: false,
+      authorizedAt: new Date().toISOString(),
+    });
+    return { status: "approved", request: approved, auth };
   });
-  saveAuth(auth);
-  updateAuthorizedChatEnv(auth);
-  return { status: "approved", request: approved };
+  if (outcome.auth) updateAuthorizedChatEnv(outcome.auth);
+  return outcome.status === "approved"
+    ? { status: "approved", request: outcome.request }
+    : { status: outcome.status };
 }
 
 function denyAuthRequest(chatId) {
-  const auth = loadAuth();
-  const idx = auth.pending.findIndex((p) => String(p.chatId) === chatId);
-  if (idx < 0) return { status: "not_found" };
-  const denied = auth.pending.splice(idx, 1)[0];
-  saveAuth(auth);
-  return { status: "denied", request: denied };
+  return mutateAuth((auth) => {
+    const idx = auth.pending.findIndex((p) => String(p.chatId) === chatId);
+    if (idx < 0) return { status: "not_found" };
+    return { status: "denied", request: auth.pending.splice(idx, 1)[0] };
+  });
 }
 
 function recordPendingAuthRequest({ chatId, name, username }) {
-  const auth = loadAuth();
-  if (auth.pending.some((p) => String(p.chatId) === String(chatId))) return { status: "already_pending" };
-  auth.pending.push({
-    chatId: String(chatId),
-    name,
-    username,
-    requestedAt: new Date().toISOString(),
+  return mutateAuth((auth) => {
+    if (auth.pending.some((p) => String(p.chatId) === String(chatId))) return { status: "already_pending" };
+    auth.pending.push({
+      chatId: String(chatId),
+      name,
+      username,
+      requestedAt: new Date().toISOString(),
+    });
+    return { status: "queued" };
   });
-  saveAuth(auth);
-  return { status: "queued" };
 }
 
 // Remove a chatId from the legacy auth.json. Owners are never removed
@@ -164,20 +198,21 @@ function recordPendingAuthRequest({ chatId, name, username }) {
 function revokeChat(chatId) {
   const id = String(chatId || "");
   if (!id) return { ok: false, reason: "missing_id" };
-  const auth = loadAuth();
-  const before = auth.authorized.length;
-  auth.authorized = auth.authorized.filter((a) => {
-    if (String(a.chatId) !== id) return true;
-    if (a.isOwner === true) return true;
-    return false;
+  const outcome = mutateAuth((auth) => {
+    const before = { authorized: auth.authorized.length, pending: auth.pending.length };
+    auth.authorized = auth.authorized.filter((a) => {
+      if (String(a.chatId) !== id) return true;
+      if (a.isOwner === true) return true;
+      return false;
+    });
+    auth.pending = auth.pending.filter((p) => String(p.chatId) !== id);
+    if (auth.authorized.length === before.authorized && auth.pending.length === before.pending) {
+      return { ok: false, reason: "not_found" };
+    }
+    return { ok: true, auth };
   });
-  auth.pending = auth.pending.filter((p) => String(p.chatId) !== id);
-  if (auth.authorized.length === before) {
-    if (auth.pending.length === 0) return { ok: false, reason: "not_found" };
-  }
-  saveAuth(auth);
-  updateAuthorizedChatEnv(auth);
-  return { ok: true };
+  if (outcome.auth) updateAuthorizedChatEnv(outcome.auth);
+  return outcome.ok ? { ok: true } : { ok: false, reason: outcome.reason };
 }
 
 function listAuthorizedRaw() {
@@ -188,33 +223,42 @@ function listAuthorizedRaw() {
   };
 }
 
+// The only caller that matters treats `false` as "this pod is unclaimed, so the
+// next /auth may bootstrap an owner". That makes the answer security-critical in
+// exactly one direction: a wrong `false` hands the agent to whoever asks next.
+//
+// So the two ways of having no owner are NOT the same. A missing auth.json means
+// a genuinely fresh pod and answers false. A file that exists but neither it nor
+// its `.bak` will parse means the roster is unknown, not empty — that fails
+// closed, because refusing a legitimate re-bootstrap is recoverable and handing
+// ownership to a stranger is not.
 function hasOwner() {
   if (CHAT_ID) return true;
   // A provisioned Kazee owner (env-injected or set via /channel add) counts
   // before their first message — otherwise a stranger's /auth on a
   // Kazee-only pod would seize ownership.
   if (config.KAZEE_OWNER_USER_ID) return true;
-  try {
-    const auth = JSON.parse(fs.readFileSync(AUTH_FILE, "utf-8"));
-    return Array.isArray(auth.authorized) && auth.authorized.some((a) => a.isOwner === true);
-  } catch (e) {
-    return false;
+  const auth = readJsonWithFallback(AUTH_FILE, null);
+  if (auth && Array.isArray(auth.authorized)) {
+    return auth.authorized.some((a) => a.isOwner === true);
   }
+  try { return fs.existsSync(AUTH_FILE); } catch (e) { return true; }
 }
 
 function bootstrapOwner({ chatId, name, username }) {
   const id = String(chatId);
-  const auth = loadAuth();
-  auth.pending = auth.pending.filter((p) => String(p.chatId) !== id);
-  auth.authorized = auth.authorized.filter((a) => String(a.chatId) !== id);
-  auth.authorized.push({
-    chatId: id,
-    name: name || "",
-    username: username || "",
-    isOwner: true,
-    authorizedAt: new Date().toISOString(),
+  mutateAuth((auth) => {
+    auth.pending = auth.pending.filter((p) => String(p.chatId) !== id);
+    auth.authorized = auth.authorized.filter((a) => String(a.chatId) !== id);
+    auth.authorized.push({
+      chatId: id,
+      name: name || "",
+      username: username || "",
+      isOwner: true,
+      authorizedAt: new Date().toISOString(),
+    });
+    return { ok: true };
   });
-  saveAuth(auth);
   if (currentTransport() === "kazee") {
     // Kazee owner identity is the user id (what transportOwnerUserId
     // compares), not the chat-document id the envelope carries as chatId —
@@ -231,6 +275,7 @@ function bootstrapOwner({ chatId, name, username }) {
 module.exports = {
   loadAuth,
   saveAuth,
+  mutateAuth,
   isChatAuthorized,
   isChatOwner,
   authRequestLabel,

package/core/actions.js

@@ -726,6 +726,48 @@ async function handleAction(envelope) {
     if (makeRule && rec.status === "approved" && wasPending) await promptRuleScope();
     return;
   }
+  if (d.startsWith("grn:")) {
+    // Standing capability grant from an approval card, with its REACH. Unlike
+    // the grl: rules below — free text a model judges — this writes a
+    // deterministic (principal × room) record, so the next equivalent request
+    // is cleared by lookup and never reaches the model at all.
+    //
+    // "here" is the default because the grant unit is the PAIR: trusting
+    // someone in one room must not trust them in every room they share with
+    // the bot. "everywhere" is a separate, explicit tap.
+    if (!isChatOwner(envelope.channelId)) return send("Owner only — grants are restricted.");
+    const parts = d.split(":");
+    const rec = require("./approvals").read(parts[1]);
+    const reach = parts[2]; // "room" | "all"
+    if (reach !== "room" && reach !== "all") return;
+    if (!rec) return send("That request expired — nothing to grant from it.");
+    if (!rec.speakerId || !rec.room) return send("I can't tell who asked apart from where they asked — no grant written.");
+    // A reply/triage card only ever cleared talking; an action card carries the
+    // tier it asked for. Never grant more than the card actually showed.
+    const capability = rec.kind === "action"
+      ? (String(rec.tier || "") === "destructive" ? "destructive" : "act")
+      : "read";
+    let record;
+    try {
+      record = require("./grants").grant({
+        adapter: rec.targetAdapter || rec.adapter,
+        senderId: rec.speakerId,
+        room: rec.room,
+        allRooms: reach === "all",
+        capability,
+        personId: rec.personId || null,
+        grantedBy: String(envelope.channelId),
+      });
+    } catch (e) {
+      return send(`Couldn't write that grant: ${e.message}`);
+    }
+    try { require("./audit").log("grant.issued", { id: record.id, principal: `${record.principal.adapter}:${record.principal.channelId}`, room: record.room, capability: record.capability, by: record.grantedBy }); } catch (e) {}
+    const who = rec.personName || "them";
+    const where = reach === "all"
+      ? "every room they share with me"
+      : (rec.channelLabel || rec.room);
+    return send(`✅ Granted ${who} \`${capability}\` in ${where}.\nI'll stop asking for this. Revoke: /grants revoke ${record.id}`);
+  }
   if (d.startsWith("grl:")) {
     // External-guardrail "Make a rule" scope buttons. Owner-only. Records the
     // chosen scope on the conversation state, then the router's handleText

package/core/approvals.js

@@ -119,6 +119,11 @@ function create({
   payloadText = "", targetAdapter = "", targetChannel = "",
   personName = "", personId = "", entitySlug = "", inboundText = "",
   channelLabel = "",
+  // WHO spoke and WHERE, kept apart: a capability grant issued from this card is
+  // for the pair, and targetChannel is only the room. On any transport where a
+  // room holds many people they are different values, so recording only the
+  // room would hand one member's grant to everyone in it.
+  speakerId = "", room = "",
 } = {}) {
   fs.mkdirSync(APPROVALS_DIR, { recursive: true, mode: 0o700 });
   prune();
@@ -142,6 +147,7 @@ function create({
     personName: String(personName || ""), personId: String(personId || ""), entitySlug: String(entitySlug || ""),
     inboundText: String(inboundText || "").slice(0, 1000),
     channelLabel: String(channelLabel || "").slice(0, 120),
+    speakerId: String(speakerId || ""), room: String(room || ""),
     requestedAt: new Date().toISOString(),
   };
   writeRecord(rec);

package/core/config.js

@@ -159,6 +159,7 @@ const AUTH_FILE = config.AUTH_FILE || path.join(CONFIG_DIR, "auth.json");
 const IDENTITIES_FILE = config.IDENTITIES_FILE || path.join(CONFIG_DIR, "identities.json");
 const PEOPLE_FILE = config.PEOPLE_FILE || path.join(CONFIG_DIR, "people.json");
 const INTROS_FILE = config.INTROS_FILE || path.join(CONFIG_DIR, "intros.json");
+const GRANTS_FILE = config.GRANTS_FILE || path.join(CONFIG_DIR, "grants.json");
 const AUDIT_FILE = config.AUDIT_FILE || path.join(CONFIG_DIR, "audit.log");
 const STATE_FILE = path.join(CONFIG_DIR, "state.json");
 const SESSIONS_FILE = path.join(CONFIG_DIR, "sessions.json");
@@ -381,7 +382,7 @@ module.exports = {
   ELEVENLABS_API_KEY, ELEVENLABS_VOICE_ID, ELEVENLABS_MODEL,
   SPEECH_SERVICE_URL, SPEECH_API_KEY, AGENTSPACE_POD_TOKEN, POCKET_TTS_VOICE, TTS_PROVIDER, VOICE_REPLY_MODE,
   SOUL_FILE, CRONS_FILE, JOBS_FILE, TASKS_DIR, VAULT_FILE, AUTH_FILE, IDENTITIES_FILE,
-  PEOPLE_FILE, INTROS_FILE, AUDIT_FILE,
+  PEOPLE_FILE, INTROS_FILE, GRANTS_FILE, AUDIT_FILE,
   STATE_FILE, SESSIONS_FILE,
   TEMP_DIR, FILES_DIR,
   MAX_FILE_SIZE, MAX_VOICE_SIZE, MAX_PROCESS_TIMEOUT, COMPACT_SUMMARY_TIMEOUT,

package/core/context.js

@@ -6,8 +6,8 @@ const { AsyncLocalStorage } = require("node:async_hooks");
 
 const chatContext = new AsyncLocalStorage();
 
-function runInChat({ adapter, channelId, canonicalUserId, userId, transport, raw, conversationKey, inboundText, speakerName, triageApprovalId }, fn) {
-  return chatContext.run({ adapter, channelId, canonicalUserId, userId, transport, raw, conversationKey, inboundText, speakerName, triageApprovalId }, fn);
+function runInChat({ adapter, channelId, canonicalUserId, userId, transport, raw, conversationKey, roomKey, inboundText, speakerName, triageApprovalId, isGroup }, fn) {
+  return chatContext.run({ adapter, channelId, canonicalUserId, userId, transport, raw, conversationKey, roomKey, inboundText, speakerName, triageApprovalId, isGroup: !!isGroup }, fn);
 }
 
 function currentStore() {
@@ -44,6 +44,15 @@ function currentTransport() {
   return s ? s.transport : null;
 }
 
+// True when this turn is happening in a multi-party room rather than a DM.
+// Authority is never derived from a room, so ownership checks that would
+// otherwise accept a configured chat id must refuse it here: a group id in
+// CHAT_IDS or auth.json would otherwise make every member an owner.
+function currentIsGroup() {
+  const s = currentStore();
+  return !!(s && s.isGroup);
+}
+
 // The per-thread conversation key for this turn (e.g. "telegram:6251055967",
 // "spaces:task:42"). Distinct from the (possibly unified) canonical speaker
 // identity: identity says WHO is talking, conversationKey says WHICH thread —
@@ -54,6 +63,19 @@ function currentConversationKey() {
   return s && s.conversationKey ? s.conversationKey : null;
 }
 
+// The room this turn happens in, as `<surface>:<id>` — what owns the shared
+// runtime settings (provider/model/effort) and the capability grants. For an
+// inbound message the thread IS the room, so conversationKey is the default.
+// A scheduled job is the case that forces them apart: it resumes its own saved
+// thread (conversationKey = the job's project) while still belonging to the
+// room it was created in, and must answer under that room's provider — not the
+// creator's personal default.
+function currentRoomKey() {
+  const s = currentStore();
+  if (!s) return null;
+  return s.roomKey || s.conversationKey || null;
+}
+
 // The raw inbound text of the turn being handled, and the transport display
 // name of whoever sent it. Used by the external guardrail to show the owner
 // WHO asked and WHAT they asked on the approval card — the speaker's people
@@ -95,7 +117,9 @@ module.exports = {
   currentCanonicalUserId,
   currentUserId,
   currentTransport,
+  currentIsGroup,
   currentConversationKey,
+  currentRoomKey,
   currentRaw,
   currentInboundText,
   setCurrentInboundText,