@inetafrica/open-claudia 3.5.63 → 3.5.64

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## 3.5.64
+
+3.5.63 plus three fixes found in a review of every unreleased branch (Sumeet, 15 Oct 08:29 EAT: "see if there's anything in back branches ... get ready for a release of everything that's currently unreleased"; 09:17 EAT "yes to all").
+
+- **A leftover start-up lock no longer keeps a bot down** (`core/migration-backup.js`). In a container the bot is process 1 after every restart, so a lock file left by a run that died holding it (it says "1") looked alive to the liveness check forever, and the bot exited at start with MIGRATION_LOCKED on every restart. network-bot crash-looped 100+ times on 10 Oct and kazee-tickets-bot 192 times from 14 Oct 15:30 EAT; both were cleared by hand. A lock naming our own process is now treated as stale; a live other holder still blocks. Written on 10 Oct but never pushed until now.
+- **A post chat-central answered without saving is not treated as posted** (`channels/kazee/adapter.js`, from the 5 Oct calls branch).
+- **Calls: the job rules from the 5 Oct test calls** (`core/system-prompt.js`, `channels/kazee/call/quick-voice.js`), lost when calls were rebuilt on the quick voice: Cazy, Kazy, Cozy or Kazi mean Kazee; look in our tools, memory and on the web before saying there is no record or a system cannot be reached; work out dates against today and check states before saying them; a write only after the caller's yes to that exact action.
+- **Changelog notes that never reached this line:** 3.5.33 (quiet chats by default: no "Heard:" echo, progress message or notes lines unless /heard, /progress or /notes turn them on) and 3.5.47 (the guard's floor is scoped, so a group's own rules can allow read-only diagnostics; credentials stay blocked). Both changes are already in the code.
+
+Tests: `test-provider-migration-backup.js` (a lock naming our own pid is reclaimed; fails without the fix), `test-kazee-message-id.js`, `test-call-quick-voice.js` (the call rules on every call path and in the quick voice). Known: `test-cokept-warming.js` fails on the Mac's Node 26 on this release and on 3.5.59 alike; the cloud build passes it. Not looked into yet.
+
 ## 3.5.63
 
 3.5.62 plus a passive-group fix (APP-29; Sumeet, 14 Oct: "my chat with Judith Brenda and books bot ... doesn't seem to be auto waking yet it's definitely relevant"). Canary first.

package/channels/kazee/adapter.js

@@ -84,6 +84,17 @@ const INVALID_THREAD_RE = /INVALID_THREAD|Invalid thread|Thread not found in thi
 // chat-central drops a typing threadRootId that is not a Mongo ObjectId.
 const OBJECT_ID_RE = /^[0-9a-f]{24}$/i;
 
+// chat-central's answer to a post it did NOT save: handleChatMessage
+// (src/handlers/messageHandler.ts) catches the failed save, logs "Returning
+// payload without save on receive" and returns our own payload, stamped
+// `receivedAt`, which send_message answers 201 { success: true, message }.
+// That payload has no `_id` and carries the text as `message`, not `content`.
+function unsavedPayload(res) {
+  const m = res && res.message && typeof res.message === "object" ? res.message : null;
+  if (!m || m._id || m.id) return false;
+  return m.receivedAt != null || (typeof m.message === "string" && !("content" in m));
+}
+
 // The thread a message belongs to: its root's id, or "" for the main timeline.
 // The field is an id today; accept a populated root doc too.
 function threadRootOf(msg) {
@@ -1480,8 +1491,24 @@ class KazeeAdapter {
       this._rememberSentSafely(id, body.threadRootId || null, channelId);
       if (id && botTags.length) this._rememberTagsSafely(id, botTags);
       if (id) return String(id);
-      // POST returned 2xx but carried no message id (server fast-ack / payload
-      // fallback path). Returning null makes the caller treat a delivered
+      if (unsavedPayload(res)) {
+        // Nothing was posted (see unsavedPayload). A replyTo that is not a
+        // Mongo ObjectId fails the Message schema's cast inside createMessage,
+        // before the insert, so nothing was saved and one retry without the
+        // quote cannot post twice. (handleChatMessage's catch also covers
+        // steps after the insert, so with any other cause this answer does
+        // not prove nothing was saved: no retry then.)
+        if (body.replyTo && !OBJECT_ID_RE.test(String(body.replyTo))) {
+          console.error(`Kazee send: not saved with replyTo ${String(body.replyTo).slice(0, 80)}; retrying once without it`);
+          delete body.replyTo;
+          attempt--;
+          continue;
+        }
+        console.error("Kazee send: NOT posted: the server returned the message unsaved (no id)");
+        return null;
+      }
+      // POST returned 2xx but carried no message id and is not the unsaved
+      // payload above (a server fast-ack). Returning null makes the caller treat a delivered
       // reply as a failed send and resend it — the Kazee double-send. Signal
       // success with a truthy, non-editable sentinel so nothing sends twice.
       console.error("Kazee send: POST ok but no message id in response keys:", Object.keys(res || {}).join(","));

package/channels/kazee/call/quick-voice.js

@@ -86,6 +86,7 @@ function buildQuickPrompt({ ownerName = "", relay = false } = {}) {
       : "You keep the conversation going. Claudia herself (the full assistant, with tools) does the real work in the background, and her answers are spoken when they are ready.",
     "",
     "A message about what the caller just said starts with [Caller], then [Work]: what Claudia is doing for them right now, then [Now]: their local day and time. Start your reply with ONE tag, then the spoken line on the same line.",
+    "The caller's words come from speech recognition, which mishears names: Cazy, Kazy, Cozy or Kazi mean Kazee (the platform and its apps, like Kazee Chat). Always say Kazee.",
     "",
     "You answer yourself whatever you can answer from what you are given: the time or day from [Now], what Claudia is doing or already answered on this call from [Work], what you two were working on from the chat you were given at call start, and everyday general knowledge that does not depend on their business, systems, people, data or anything recent (a spelling, simple sums, a well-known fact). Never make them wait for Claudia for those. Anything about their business, systems, people, data, money, or anything recent or that you are not sure of, is Claudia's.",
     "",

package/core/migration-backup.js

@@ -259,8 +259,14 @@ function acquireLock(root) {
         const stat = assertRegularFile(filePath, "MIGRATION_LOCKED", "migration lock");
         const pid = Number(fs.readFileSync(filePath, "utf8").trim());
         if (Number.isSafeInteger(pid) && pid > 0 && Date.now() - stat.mtimeMs > 1000) {
-          try { process.kill(pid, 0); }
-          catch (probeError) { stale = probeError.code === "ESRCH"; }
+          // We haven't taken the lock yet, so one naming our own pid was left by an
+          // earlier run that died holding it. In a container the bot is pid 1 after
+          // every restart, so the liveness probe below would find "us" alive forever.
+          if (pid === process.pid) stale = true;
+          else {
+            try { process.kill(pid, 0); }
+            catch (probeError) { stale = probeError.code === "ESRCH"; }
+          }
         }
       } catch (_) {}
       if (stale) {

package/core/system-prompt.js

@@ -1260,6 +1260,12 @@ const LIVE_CALL_GUIDANCE = [
   "- Keep the work moving (the caller, 12 Oct): answer what they asked first, directly. Then, when there is an obvious next step, end with it in a few words: an offer (\"Want me to fix it now?\"), a suggestion, or \"Does that answer it?\". Leave it out for a quick fact, small talk, or when they are wrapping up, and never change the subject just to have one.",
   "- If your reply answers more than one of their questions, open each part with a few words naming its topic, like \"On the mail backup, ...\" then \"On your voice question, ...\", so they can tell which answer is which.",
   "- Do NOT read out code, file paths, command syntax, IDs, or URLs. Describe them in plain words, or offer to send the details to the chat as text.",
+  // Job rules from the 5 Oct test calls (calls v2: d5e65cf, 2213352, f7db2e7,
+  // d82a8c7, 0b20579), brought over when the call was rebuilt on the quick voice.
+  "- The caller's words come from speech recognition, which mishears names: Cazy, Kazy, Cozy or Kazi mean Kazee (the platform and its apps, like Kazee Chat). Always say and write Kazee.",
+  "- Look before you say you do not know something, have no record of it, or cannot reach a system: our own systems (tasks, CRM, Books, People, tickets, calendars, the PBX) through our tools (open-claudia tool search, then tool show and tool run); memory (entity show, pack show, transcript-search --all); the outside world (events, news, weather, places, businesses, prices, opening hours, public facts) on the web with WebSearch or WebFetch. If you still cannot, say what you tried and offer the closest thing you can do instead.",
+  "- Work out \"tonight\", \"tomorrow\" or \"on Saturday\" from the record's own date against today's date in the runtime state; if unsure, say the date. Before you say something is built, live, done, fixed or broken, check it with a tool; if you only have notes, say \"my notes say\".",
+  "- Writes (sending, changing, booking, creating, deleting): do one only after the caller has said yes to that exact action on this call; until then do the read-only part and ask. Destructive actions always go to the chat's approval buttons, never a spoken yes.",
   "- Speak first, then work. Unless your whole reply is one short sentence you can say right now, your FIRST action is a call-say of a few words (about 3 to 12) that shows you heard them and says what you will do, for example \"Sure, let me check the call logs.\", \"Good question, give me a second.\" or \"Yep, on it.\" Do it before any lookup and before working out the answer: think after it, not before.",
   "- If the work runs on, say a brief progress line with call-say about every ten seconds (\"Still looking, nearly there.\"). Tool time is dead air the caller sits through, so keep lookups short and offer longer digging after the call.",
   "- When a useful, complete answer sentence is ready before your full response, speak it with call-say too. This command delivers checked speech into this call; ordinary provider previews are not spoken. Acknowledgements and what-you-will-do-next lines are fine; never state a result or claim a completed action before tool evidence.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inetafrica/open-claudia",
-  "version": "3.5.63",
+  "version": "3.5.64",
   "description": "An always-on, provider-agnostic coding-agent harness for Claude Code and OpenAI Codex via chat",
   "main": "bot.js",
   "bin": {

package/test-kazee-message-id.js

@@ -89,6 +89,44 @@ async function sendFailing() {
   // success-without-id path was double-sending.
   assert.strictEqual(await sendFailing(), null, "real failure → null");
 
+  // chat-central's unsaved answer (P3e, 5 Oct call): handleChatMessage could
+  // not save the message (a call turn's synthetic replyTo failed the ObjectId
+  // cast) and send_message answered 201 with our own payload, no _id. That is
+  // NOT a post.
+  const unsaved = (extra = {}) => ({ success: true, message: { message: "hello", type: "text", findMeCode: "oc-1", receivedAt: "2026-10-05T04:28:29.184Z", ...extra } });
+  const scripted = (...answers) => {
+    const a = makeAdapter();
+    a.posts = [];
+    a._request = async (_method, _route, body) => { a.posts.push({ ...body }); return answers.shift(); };
+    return a;
+  };
+  // (1) With a replyTo that is not a Kazee message id: one retry without it.
+  let a = scripted(unsaved({ replyTo: "call-101221138374860-1791174486793-t5" }), { success: true, message: { _id: OID } });
+  assert.strictEqual(await a.send("room1", "hello", { replyTo: "call-101221138374860-1791174486793-t5" }), OID, "the retry's id");
+  assert.strictEqual(a.posts.length, 2, "one retry");
+  assert.strictEqual(a.posts[0].replyTo, "call-101221138374860-1791174486793-t5");
+  assert.ok(!("replyTo" in a.posts[1]), "the retry carries no replyTo");
+  // A retry that is unsaved too: not posted, and no third POST.
+  a = scripted(unsaved(), unsaved());
+  assert.strictEqual(await a.send("room1", "hello", { replyTo: "call-1-2-t3" }), null, "still unsaved → null");
+  assert.strictEqual(a.posts.length, 2, "at most one retry");
+  // (2) Unsaved without a replyTo: null, no second POST. The payload shape
+  // without receivedAt (`message` text, no `content`) counts too.
+  a = scripted(unsaved());
+  assert.strictEqual(await a.send("room1", "hello", {}), null, "unsaved → not posted");
+  assert.strictEqual(a.posts.length, 1, "no retry without a replyTo");
+  a = scripted({ success: true, message: { message: "hello", type: "text" } });
+  assert.strictEqual(await a.send("room1", "hello", {}), null, "the payload shape without receivedAt");
+  // A real ObjectId replyTo: the unsaved answer does not prove nothing was
+  // saved (the server's catch also covers steps after the insert): no retry.
+  a = scripted(unsaved(), { success: true, message: { _id: OID } });
+  assert.strictEqual(await a.send("room1", "hello", { replyTo: OID }), null, "no retry with a real replyTo");
+  assert.strictEqual(a.posts.length, 1);
+  // (3) Any other 2xx without an id is still the fast-ack sentinel: one POST.
+  a = scripted({ success: true, message: { content: "hello", type: "text" } });
+  assert.strictEqual(await a.send("room1", "hello", { replyTo: "call-1-2-t3" }), true, "other idless shape → sentinel true");
+  assert.strictEqual(a.posts.length, 1, "never posted twice");
+
   fs.rmSync(HOME, { recursive: true, force: true });
   console.log("kazee-message-id OK");
 })().catch((e) => {

package/test-provider-language.js

@@ -639,7 +639,10 @@ assert.match(pkg.description, /provider-agnostic coding-agent harness/i);
 // 3.5.63 = 3.5.62 + passive groups judge captioned photos and files (APP-29), a proven bug
 // (books bot logs, 14 Oct: Judith's captioned screenshots "group gate: silent") under
 // Sumeet's standing clear-cut bug-fix rule (5 Oct 2026 12:08 EAT): canary first.
-assert.strictEqual(pkg.version, "3.5.63", "release version must remain unchanged without explicit approval");
+// 3.5.64 = 3.5.63 + the own-pid migration lock fix (kazee-tickets-bot crash loop, 14 Oct),
+// a chat post chat-central answered unsaved is not posted, and the 5 Oct call job rules;
+// Sumeet, 15 Oct 09:17 EAT: "yes to all" (canary on network-bot, then every bot).
+assert.strictEqual(pkg.version, "3.5.64", "release version must remain unchanged without explicit approval");
 for (const keyword of ["claude", "codex", "coding-agent", "provider-agnostic"]) {
   assert.ok(pkg.keywords.includes(keyword), `package keyword missing: ${keyword}`);
 }

package/test-provider-migration-backup.js

@@ -238,6 +238,35 @@ function corruptionAndLockProbe() {
   }
 }
 
+function leftoverLockProbe() {
+  const root = tempRoot("leftover-lock");
+  try {
+    const configDir = installFixture("claude-only", root);
+    const opts = options(configDir);
+    ensureMigrationSnapshot(opts);
+    const lockPath = path.join(configDir, "migration-backups", MIGRATION_ID, ".lock");
+    const old = new Date(Date.now() - 60_000);
+    const leaveLock = (pid) => {
+      fs.writeFileSync(lockPath, `${pid}\n`, { mode: 0o600 });
+      fs.utimesSync(lockPath, old, old);
+    };
+
+    // A live other process still holds the lock.
+    leaveLock(process.ppid);
+    assert.throws(() => ensureMigrationSnapshot(opts), (error) => error.code === "MIGRATION_LOCKED");
+
+    // In a container the bot is pid 1 after every restart, so a lock left by a run
+    // that died holding it names our own pid: it is stale, not held (network-bot,
+    // 10 Oct 2026: 100 restarts on MIGRATION_LOCKED).
+    leaveLock(process.pid);
+    const snapshot = ensureMigrationSnapshot(opts);
+    assert.ok(snapshot.reused, "leftover own-pid lock reclaimed");
+    assert.ok(!fs.existsSync(lockPath), "lock released after the reclaimed run");
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+}
+
 function activationProbe() {
   const root = tempRoot("activate");
   try {
@@ -464,6 +493,7 @@ function integrationAndDocsProbe() {
 fixtureMatrix();
 interruptionProbe();
 corruptionAndLockProbe();
+leftoverLockProbe();
 activationProbe();
 rollbackProbe();
 sourceChangeProbe();