@inetafrica/open-claudia 3.3.2 → 3.4.1

package/core/people.js

@@ -8,10 +8,10 @@
 // on first read from the existing auth.json (the bootstrap owner) and
 // any KAZEE_OWNER_USER_ID in env.
 
-const fs = require("fs");
 const { PEOPLE_FILE, AUTH_FILE, config } = require("./config");
 const { channelKey, setIdentityMapping, canonicalForChannel } = require("./identity");
 const { slugify } = require("./entities");
+const { atomicWriteFileSync, readJsonWithFallback, withFileLock } = require("./fsutil");
 
 function nowIso() { return new Date().toISOString(); }
 
@@ -19,18 +19,31 @@ function nextId() {
   return `person_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 8)}`;
 }
 
+// An empty roster is a real state (fresh pod), but it is also what a corrupt
+// read used to return — and the two are not interchangeable. Nobody in the
+// roster means relationship.speakerFor finds no person and classifies every
+// speaker "external", so a single torn write silently demoted the OWNER and
+// started guarding them in their own pod. Recovering from `<file>.bak` makes
+// that self-healing rather than silent.
 function load() {
-  try {
-    const raw = JSON.parse(fs.readFileSync(PEOPLE_FILE, "utf-8"));
-    if (!Array.isArray(raw)) return [];
-    return raw;
-  } catch (e) { return []; }
+  const raw = readJsonWithFallback(PEOPLE_FILE, []);
+  return Array.isArray(raw) ? raw : [];
 }
 
 function save(list) {
-  const tmp = `${PEOPLE_FILE}.tmp`;
-  fs.writeFileSync(tmp, JSON.stringify(list, null, 2));
-  fs.renameSync(tmp, PEOPLE_FILE);
+  atomicWriteFileSync(PEOPLE_FILE, `${JSON.stringify(list, null, 2)}\n`, { backup: true });
+}
+
+// Read-modify-write under the store lock. Every mutation goes through this so
+// the bot process and the CLI cannot each append to the same list and have one
+// of the two renames win outright.
+function mutate(fn) {
+  return withFileLock(PEOPLE_FILE, () => {
+    const list = load();
+    const result = fn(list);
+    save(list);
+    return result;
+  });
 }
 
 function findById(id) {
@@ -58,105 +71,115 @@ function findByHandle(adapter, channelId) {
 function list() { return load(); }
 
 function add({ name, isOwner = false, bio = null }) {
-  const all = load();
-  const p = {
-    id: nextId(),
-    name: String(name || "").trim(),
-    isOwner: !!isOwner,
-    bio: bio ? String(bio) : null,
-    handles: [],
-    notes: [],
-    primaryChannel: null,
-    entitySlug: null,
-    createdAt: nowIso(),
-    updatedAt: nowIso(),
-  };
-  if (!p.name) throw new Error("person name is required");
-  all.push(p);
-  save(all);
-  return p;
+  return mutate((all) => {
+    const p = {
+      id: nextId(),
+      name: String(name || "").trim(),
+      isOwner: !!isOwner,
+      bio: bio ? String(bio) : null,
+      handles: [],
+      notes: [],
+      primaryChannel: null,
+      entitySlug: null,
+      createdAt: nowIso(),
+      updatedAt: nowIso(),
+    };
+    if (!p.name) throw new Error("person name is required");
+    all.push(p);
+    return p;
+  });
 }
 
 function update(id, patch) {
-  const all = load();
-  const idx = all.findIndex((p) => p.id === id);
-  if (idx < 0) return null;
-  all[idx] = { ...all[idx], ...patch, updatedAt: nowIso() };
-  save(all);
-  return all[idx];
+  return mutate((all) => {
+    const idx = all.findIndex((p) => p.id === id);
+    if (idx < 0) return null;
+    all[idx] = { ...all[idx], ...patch, updatedAt: nowIso() };
+    return all[idx];
+  });
 }
 
 function remove(id) {
-  const all = load();
-  const idx = all.findIndex((p) => p.id === id);
-  if (idx < 0) return null;
-  const [removed] = all.splice(idx, 1);
-  save(all);
-  return removed;
+  return mutate((all) => {
+    const idx = all.findIndex((p) => p.id === id);
+    if (idx < 0) return null;
+    const [removed] = all.splice(idx, 1);
+    return removed;
+  });
 }
 
 // Attach a channel handle to a person. Also writes the channel→canonical
 // link in identities.json so the rest of the bot resolves the chat to
 // the same canonical user id as any other handle on this person.
 function linkHandle(personId, { adapter, channelId, displayName = null, approvedBy = null }) {
-  const all = load();
-  const p = all.find((x) => x.id === personId);
-  if (!p) throw new Error(`person not found: ${personId}`);
   const a = String(adapter || "").toLowerCase();
   const c = String(channelId || "");
-  if (!a || !c) throw new Error("adapter and channelId are required");
-
-  if (!Array.isArray(p.handles)) p.handles = [];
-  const conflict = all.find((other) =>
-    other.id !== p.id &&
-    (other.handles || []).some((h) => h.adapter === a && String(h.channelId) === c));
-  if (conflict) throw new Error(`handle ${a}:${c} already linked to ${conflict.name} (${conflict.id})`);
-
-  const canonical = canonicalForChannel(a, c);
-  const existing = p.handles.find((h) => h.adapter === a && String(h.channelId) === c);
-  if (!existing) {
-    p.handles.push({
-      adapter: a,
-      channelId: c,
-      canonicalUserId: canonical,
-      displayName,
-      approvedBy,
-      addedAt: nowIso(),
-    });
-  } else {
-    existing.canonicalUserId = canonical;
-    existing.displayName = displayName || existing.displayName;
-  }
+  const p = mutate((all) => {
+    const person = all.find((x) => x.id === personId);
+    if (!person) throw new Error(`person not found: ${personId}`);
+    if (!a || !c) throw new Error("adapter and channelId are required");
+
+    if (!Array.isArray(person.handles)) person.handles = [];
+    const conflict = all.find((other) =>
+      other.id !== person.id &&
+      (other.handles || []).some((h) => h.adapter === a && String(h.channelId) === c));
+    if (conflict) throw new Error(`handle ${a}:${c} already linked to ${conflict.name} (${conflict.id})`);
+
+    const canonical = canonicalForChannel(a, c);
+    const existing = person.handles.find((h) => h.adapter === a && String(h.channelId) === c);
+    if (!existing) {
+      person.handles.push({
+        adapter: a,
+        channelId: c,
+        canonicalUserId: canonical,
+        displayName,
+        approvedBy,
+        addedAt: nowIso(),
+      });
+    } else {
+      existing.canonicalUserId = canonical;
+      existing.displayName = displayName || existing.displayName;
+    }
 
-  if (!p.primaryChannel) p.primaryChannel = { adapter: a, channelId: c };
-  p.updatedAt = nowIso();
-  save(all);
+    if (!person.primaryChannel) person.primaryChannel = { adapter: a, channelId: c };
+    person.updatedAt = nowIso();
+    return person;
+  });
 
   // Mirror into identities.json so canonicalForChannel resolves cross-handle.
+  // Re-pointing a channel at a new canonical strands everything that channel
+  // already accumulated — settings, sessions, usage — under the old key, which
+  // is how the owner ended up with orphan state buckets. state.linkIdentity is
+  // setIdentityMapping plus that migration; required lazily because state.js
+  // pulls people.js in on the identity path.
   if (p.handles.length > 1) {
     const primary = p.handles[0];
     const primaryCanonical = primary.canonicalUserId || canonicalForChannel(primary.adapter, primary.channelId);
-    try { setIdentityMapping(a, c, primaryCanonical); } catch (e) {}
+    try {
+      require("./state").linkIdentity(a, c, primaryCanonical);
+    } catch (e) {
+      try { setIdentityMapping(a, c, primaryCanonical); } catch (e2) {}
+    }
   }
 
   return p;
 }
 
 function unlinkHandle(personId, { adapter, channelId }) {
-  const all = load();
-  const p = all.find((x) => x.id === personId);
-  if (!p) return null;
-  const a = String(adapter || "").toLowerCase();
-  const c = String(channelId || "");
-  const before = (p.handles || []).length;
-  p.handles = (p.handles || []).filter((h) => !(h.adapter === a && String(h.channelId) === c));
-  if (p.primaryChannel && p.primaryChannel.adapter === a && String(p.primaryChannel.channelId) === c) {
-    p.primaryChannel = p.handles[0] ? { adapter: p.handles[0].adapter, channelId: p.handles[0].channelId } : null;
-  }
-  if (p.handles.length === before) return null;
-  p.updatedAt = nowIso();
-  save(all);
-  return p;
+  return mutate((all) => {
+    const p = all.find((x) => x.id === personId);
+    if (!p) return null;
+    const a = String(adapter || "").toLowerCase();
+    const c = String(channelId || "");
+    const before = (p.handles || []).length;
+    p.handles = (p.handles || []).filter((h) => !(h.adapter === a && String(h.channelId) === c));
+    if (p.primaryChannel && p.primaryChannel.adapter === a && String(p.primaryChannel.channelId) === c) {
+      p.primaryChannel = p.handles[0] ? { adapter: p.handles[0].adapter, channelId: p.handles[0].channelId } : null;
+    }
+    if (p.handles.length === before) return null;
+    p.updatedAt = nowIso();
+    return p;
+  });
 }
 
 // Remove every handle for a given adapter across ALL people records — used when
@@ -166,71 +189,71 @@ function unlinkHandle(personId, { adapter, channelId }) {
 function unlinkAdapterHandles(adapter) {
   const a = String(adapter || "").toLowerCase();
   if (!a) return [];
-  const all = load();
-  const affected = [];
-  for (const p of all) {
-    const before = (p.handles || []).length;
-    if (!before) continue;
-    p.handles = p.handles.filter((h) => h.adapter !== a);
-    if (p.handles.length === before) continue;
-    if (p.primaryChannel && p.primaryChannel.adapter === a) {
-      p.primaryChannel = p.handles[0] ? { adapter: p.handles[0].adapter, channelId: p.handles[0].channelId } : null;
+  return mutate((all) => {
+    const affected = [];
+    for (const p of all) {
+      const before = (p.handles || []).length;
+      if (!before) continue;
+      p.handles = p.handles.filter((h) => h.adapter !== a);
+      if (p.handles.length === before) continue;
+      if (p.primaryChannel && p.primaryChannel.adapter === a) {
+        p.primaryChannel = p.handles[0] ? { adapter: p.handles[0].adapter, channelId: p.handles[0].channelId } : null;
+      }
+      p.updatedAt = nowIso();
+      affected.push(p.id);
     }
-    p.updatedAt = nowIso();
-    affected.push(p.id);
-  }
-  if (affected.length) save(all);
-  return affected;
+    return affected;
+  });
 }
 
 function setPrimary(personId, { adapter, channelId }) {
-  const all = load();
-  const p = all.find((x) => x.id === personId);
-  if (!p) return null;
-  const a = String(adapter || "").toLowerCase();
-  const c = String(channelId || "");
-  const has = (p.handles || []).some((h) => h.adapter === a && String(h.channelId) === c);
-  if (!has) throw new Error(`person ${p.id} has no handle ${a}:${c}`);
-  p.primaryChannel = { adapter: a, channelId: c };
-  p.updatedAt = nowIso();
-  save(all);
-  return p;
+  return mutate((all) => {
+    const p = all.find((x) => x.id === personId);
+    if (!p) return null;
+    const a = String(adapter || "").toLowerCase();
+    const c = String(channelId || "");
+    const has = (p.handles || []).some((h) => h.adapter === a && String(h.channelId) === c);
+    if (!has) throw new Error(`person ${p.id} has no handle ${a}:${c}`);
+    p.primaryChannel = { adapter: a, channelId: c };
+    p.updatedAt = nowIso();
+    return p;
+  });
 }
 
 function note(personId, text, { by = null } = {}) {
-  const all = load();
-  const p = all.find((x) => x.id === personId);
-  if (!p) return null;
-  if (!Array.isArray(p.notes)) p.notes = [];
-  const entry = { at: nowIso(), by, text: String(text || "").trim() };
-  if (!entry.text) throw new Error("note text is required");
-  p.notes.push(entry);
-  p.updatedAt = nowIso();
-  save(all);
-  return entry;
+  return mutate((all) => {
+    const p = all.find((x) => x.id === personId);
+    if (!p) return null;
+    if (!Array.isArray(p.notes)) p.notes = [];
+    const entry = { at: nowIso(), by, text: String(text || "").trim() };
+    if (!entry.text) throw new Error("note text is required");
+    p.notes.push(entry);
+    p.updatedAt = nowIso();
+    return entry;
+  });
 }
 
 function removeNote(personId, index) {
-  const all = load();
-  const p = all.find((x) => x.id === personId);
-  if (!p || !Array.isArray(p.notes)) return null;
-  if (index < 0 || index >= p.notes.length) return null;
-  const [removed] = p.notes.splice(index, 1);
-  p.updatedAt = nowIso();
-  save(all);
-  return removed;
+  return mutate((all) => {
+    const p = all.find((x) => x.id === personId);
+    if (!p || !Array.isArray(p.notes)) return null;
+    if (index < 0 || index >= p.notes.length) return null;
+    const [removed] = p.notes.splice(index, 1);
+    p.updatedAt = nowIso();
+    return removed;
+  });
 }
 
 // Bind a person to their persona pack (entities/<slug>.md). Explicit link so a
 // person can point at a differently-named pack; setEntitySlug(id, null) clears.
 function setEntitySlug(personId, slug) {
-  const all = load();
-  const p = all.find((x) => x.id === personId);
-  if (!p) return null;
-  p.entitySlug = slug ? slugify(slug) : null;
-  p.updatedAt = nowIso();
-  save(all);
-  return p;
+  return mutate((all) => {
+    const p = all.find((x) => x.id === personId);
+    if (!p) return null;
+    p.entitySlug = slug ? slugify(slug) : null;
+    p.updatedAt = nowIso();
+    return p;
+  });
 }
 
 // Which persona pack belongs to this person: the explicit pointer if set,
@@ -252,8 +275,8 @@ function seedOwnerFromLegacy() {
   if (hasOwnerRecord()) return null;
   let legacyOwner = null;
   try {
-    const auth = JSON.parse(fs.readFileSync(AUTH_FILE, "utf-8"));
-    legacyOwner = (auth.authorized || []).find((a) => a.isOwner === true) || null;
+    const auth = readJsonWithFallback(AUTH_FILE, {});
+    legacyOwner = ((auth && auth.authorized) || []).find((a) => a.isOwner === true) || null;
   } catch (e) {}
   if (!legacyOwner) {
     // Pods configured with only KAZEE_OWNER_USER_ID (empty auth.json) DO have

package/core/providers/claude.js

@@ -6,7 +6,10 @@ const { createJsonlDecoder } = require("./events");
 const { createClaudeParserState, normalizeClaudeEvent } = require("./claude-events");
 const { createClaudeHookTransport } = require("./claude-hook");
 
+// claude-fable-5-1 requires Claude Code >= 2.1.251; older CLIs reject it with an
+// API 400 rather than falling back, so a pod on a stale image will error on it.
 const CLAUDE_MODELS = Object.freeze([
+  "claude-fable-5-1",
   "claude-fable-5",
   "claude-opus-5",
   "claude-opus-4-8",

package/core/relationship.js

@@ -40,6 +40,12 @@ function speakerFor(adapterType, channelId, userId) {
     let ownerByCanonical = false;
     try { ownerByCanonical = require("./identity").channelIsOwner(adapterType, speakerId); } catch (e) {}
 
+    // The principal (WHO) and the room (WHERE) are carried separately from here
+    // on: a capability grant is issued for the pair, so collapsing them — as
+    // channelId alone does on every transport where a room holds many people —
+    // would make one member's grant cover the whole room.
+    const room = require("./identity").conversationKeyFor(adapterType, channelId);
+
     if (ownerByCanonical || (person && person.isOwner)) {
       let ownerPerson = person && person.isOwner ? person : null;
       if (!ownerPerson) { try { ownerPerson = (people.owners() || [])[0] || null; } catch (e) {} }
@@ -47,7 +53,7 @@ function speakerFor(adapterType, channelId, userId) {
       return {
         person: ownerPerson || person || null, name, isOwner: true, relationship: "owner",
         slug: null, mandate: "", style: "", entityName: name,
-        adapterType: String(adapterType), channelId: String(channelId),
+        adapterType: String(adapterType), channelId: String(channelId), speakerId, room,
       };
     }
 
@@ -57,7 +63,7 @@ function speakerFor(adapterType, channelId, userId) {
       return {
         person: null, name: "", isOwner: false, relationship: "external",
         slug: null, mandate: "", style: "", entityName: "",
-        adapterType: String(adapterType), channelId: String(channelId),
+        adapterType: String(adapterType), channelId: String(channelId), speakerId, room,
       };
     }
     const entities = require("./entities");
@@ -76,7 +82,7 @@ function speakerFor(adapterType, channelId, userId) {
       mandate: require("./mandates").activeMandateText(String(sections.Mandate || "")).trim(),
       style: String(sections.Style || "").trim(),
       entityName: ent ? ent.name : person.name,
-      adapterType: String(adapterType), channelId: String(channelId),
+      adapterType: String(adapterType), channelId: String(channelId), speakerId, room,
     };
   } catch (e) {
     // Fail closed: an error resolving the speaker is treated as external, not
@@ -85,6 +91,7 @@ function speakerFor(adapterType, channelId, userId) {
       person: null, name: "", isOwner: false, relationship: "external",
       slug: null, mandate: "", style: "", entityName: "",
       adapterType: String(adapterType || ""), channelId: String(channelId || ""),
+      speakerId: String(userId || channelId || ""), room: "",
     };
   }
 }
@@ -173,6 +180,40 @@ async function ownerTarget() {
   return configuredOwnerTarget();
 }
 
+// EVERY reachable owner, not just the first. Approval is an owner-set decision:
+// resolving only owners()[0] meant a pod with two owners silently posted every
+// card to one of them, so the other could never approve anything and a card
+// went unanswered whenever that one owner was away. Deduped by send target, so
+// two owners sharing a channel get one card. The apr: handler is gated on
+// isChatOwner (not on the record's approverChannel), so any owner may decide
+// whichever copy they see, and decide() is idempotent.
+async function ownerTargets() {
+  const out = [];
+  const seen = new Set();
+  const push = (t, person) => {
+    if (!t) return;
+    const key = `${t.adapter}:${t.channelId}`;
+    if (seen.has(key)) return;
+    seen.add(key);
+    out.push({ ...t, person: person || t.person || null });
+  };
+  try {
+    const people = require("./people");
+    for (const owner of people.owners() || []) {
+      const handles = owner.handles || [];
+      const primary = owner.primaryChannel
+        ? handles.find((h) => h.adapter === owner.primaryChannel.adapter &&
+            String(h.channelId) === String(owner.primaryChannel.channelId))
+        : null;
+      const handle = primary || handles[0];
+      if (!handle) continue;
+      try { push(await resolveHandleSendTarget(handle), owner); } catch (e) { /* skip this owner */ }
+    }
+  } catch (e) { /* fall through to the env fallback */ }
+  if (out.length === 0) push(await configuredOwnerTarget(), null);
+  return out;
+}
+
 // Env/legacy-seeded kazee owner handles store the owner's USER id, but kazee
 // sends address a chat-document id — posting buttons to the raw user id 404s
 // and escalation silently dies. Resolve those handles to the 1:1 DM the same
@@ -282,4 +323,4 @@ function ensureContact(envelope) {
   }
 }
 
-module.exports = { speakerFor, currentSpeaker, guardActive, isCurrentSpeakerGuarded, ownerTarget, configuredOwnerTarget, ensureContact };
+module.exports = { speakerFor, currentSpeaker, guardActive, isCurrentSpeakerGuarded, ownerTarget, ownerTargets, configuredOwnerTarget, ensureContact };

package/core/router.js

@@ -95,6 +95,7 @@ function scope(envelope, fn) {
     conversationKey: conversationKeyFor(envelope.adapter?.type, envelope.channelId),
     inboundText: envelope.text || "",
     speakerName: envelope.from?.name || envelope.from?.username || "",
+    isGroup: envelope.isGroup === true || envelope.surface === "group",
   }, fn);
 }
 

package/core/scheduler.js

@@ -33,7 +33,7 @@ const {
   getProviderSettings,
   getUserState,
 } = require("./state");
-const { canonicalForChannel } = require("./identity");
+const { canonicalForChannel, conversationKeyFor } = require("./identity");
 const { send: defaultSend } = require("./io");
 const { providerStatus: defaultProviderStatus } = require("./providers");
 const { redactSensitive } = require("./redact");
@@ -257,6 +257,11 @@ function createSchedulerService(dependencies = {}) {
         attachSession: lineage.attachSession,
         fallbackFrom: null,
         switchedFrom: null,
+        // The room's current selection exists but is not runnable, so this run
+        // reverts to the provider the job was created under. That revert used
+        // to be silent, which is why a Codex room reported a Claude quota
+        // error with nothing to explain where Claude came from.
+        revertedFrom: currentProvider && currentProvider !== job.provider ? currentProvider : null,
         fresh: !lineage.sessionId,
       };
     }
@@ -288,6 +293,8 @@ function createSchedulerService(dependencies = {}) {
     }
     if (target.fallbackFrom) {
       lines.push(`[Archived provider-neutral brief: the originating ${target.fallbackFrom} provider is unavailable. Its native session is not being resumed; this explicitly configured fallback starts fresh.]`);
+    } else if (target.revertedFrom) {
+      lines.push(`[This room currently selects ${target.revertedFrom}, but that provider is not runnable right now, so this occurrence reverted to the provider it was scheduled under (${target.provider}).]`);
     } else if (target.switchedFrom) {
       lines.push(`[Provider now tracks your current selection (${target.provider}); this was scheduled under ${target.switchedFrom}, whose native session cannot cross providers, so this run starts a fresh thread.]`);
     }
@@ -477,6 +484,12 @@ function createSchedulerService(dependencies = {}) {
       // shared session. Matches captured project.name (projectDescriptor(job).name)
       // so sameCapturedProject / getProjectKey resolve the right thread mid-run.
       conversationKey: projectDescriptor(job).name,
+      // …but the thread is not the room. A job belongs to the room it was
+      // created in and must answer under THAT room's provider; without this the
+      // room overlay can't resolve and the run silently falls back to the
+      // creator's personal default — which is how a Codex room kept firing
+      // wakeups on Claude.
+      roomKey: conversationKeyFor(adapter.type, job.channelId),
       // Rides only on triage-approval wakeups; the enforcer's reply vet honours
       // the owner's one-off "handle this request" grant through it.
       triageApprovalId: job.triageApprovalId || "",
@@ -536,7 +549,15 @@ function createSchedulerService(dependencies = {}) {
       const advisory = job.check
         ? (job.watchExpired ? `⏰ Watch "${job.label}" timed out without triggering — waking anyway` : `🔔 Watch "${job.label}" triggered`)
         : `Wakeup: ${job.label}`;
-      try { await send(advisory); } catch (_) { /* advisory only */ }
+      // Say so when the run is NOT on the provider this room is set to: an
+      // unexplained error from a provider the room never selected is worse than
+      // the outage itself.
+      const providerNote = target.revertedFrom
+        ? `\n⚠️ ${target.revertedFrom} is unavailable — running on ${target.provider} instead.`
+        : target.fallbackFrom
+          ? `\n⚠️ ${target.fallbackFrom} is unavailable — running on fallback ${target.provider}.`
+          : "";
+      try { await send(`${advisory}${providerNote}`); } catch (_) { /* advisory only */ }
       let result;
       try { result = await runInProvider(prompt, runContext.cwd, null, { ...runOptions, runContext }); }
       catch (error) {