@inetafrica/open-claudia 3.5.74 → 3.5.76

package/CHANGELOG.md

@@ -1,5 +1,36 @@
 # Changelog
 
+## 3.5.76
+
+3.5.75 plus the memory cuts from the usage work, the lessons ranking fix, the empty-lock fix, `handoff --new`, HTML views and the type-check guard (Sumeet 9 Nov: "all bots get all features"). Every new setting is optional: unset, a bot behaves as 3.5.75 except where noted.
+
+- **Recall helper sleeps when idle** (`core/recall/warm-walker.js`): the warm recall walker stops after 10 minutes with no walks (about 160 MB back) and starts again on the next one. `RECALL_WARM_WALKER_IDLE_MS` changes the wait; `0` keeps it running.
+- **Usage history read only when needed** (`core/runner.js`): a bot no longer parses its whole usage history after every turn; it reads it only when usage alerts are on.
+- **Node flags for the bot only** (`docker-entrypoint.sh`): `OC_NODE_FLAGS` in a bot's env (for example a heap limit) goes on the main node command line, never `NODE_OPTIONS`, so agents, hooks and CLI runs do not inherit it. Unset, the start command is unchanged.
+- **`RECALL_ENGINE` in the bot's `.env` works** (`core/recall/index.js`): the engine set in `.env` is now honoured, not only one set in the process env. A per-chat `/engine` choice still comes first.
+- **Pack reviews wait their turn** (`core/pack-review.js`): reviews run one at a time per bot behind a queue instead of being dropped when too many came at once. `OC_REVIEW_CONCURRENCY` (default 1) and `OC_REVIEW_QUEUE_MAX` (default 20; the oldest is dropped with a log line) tune it.
+- **Heavy libraries load on demand**: the call library (werift) loads on the first Kazee call and the Telegram library only when a Telegram token is set (about 40 MB less idle). The first call after a start takes a few seconds longer.
+- **Type checks take their turn** (`core/tool-guard.js`): `tsc` now counts in the test-run guard, so only one test run or type check goes at a time on a bot and the free-memory floor applies.
+- **Lessons keep their ranking** (`core/lessons.js`): reading one pack's topic lessons no longer resets every other lesson's ranking to zero.
+- **An old empty migration lock no longer blocks start** (`core/migration-backup.js`): a lock file left empty by a run that died before writing its pid is treated as stale once old, so the bot stops crash-looping on it. A fresh empty lock still counts as held.
+- **`open-claudia handoff --new "<title>" "<message>"`** (`core/thread-handoff.js`): starts a real titled Kazee thread, posts the hand-off in it tagging the person who asked (so it shows in their Threads list), then wakes it. Refused hand-offs start nothing.
+- **HTML views** (`bin/views.js`, `core/views.js`): `open-claudia view send <page.html> --title "<t>" [--handler <file>] [--wake each|none]` sends an interactive page into Kazee Chat as a card with an Open button; it opens walled off (libraries from public CDNs, no data fetched from the internet). What the person does on the page runs the handler or wakes the conversation. `open-claudia view push` sends data back into open pages; `open-claudia view example` prints a quiz page and handler. Kazee Chat only.
+
+Tests: `test-walker-idle-stop.js`, `test-usage-history-lazy.js`, `test-node-flags-entrypoint.js`, `test-recall-engine-env.js`, `test-review-queue.js`, `test-lazy-heavy-libs.js`, `test-lessons-meta-keep.js`, `test-views.js` (all in the suite), plus additions to `test-test-run-guard.js`, `test-provider-migration-backup.js` and `test-thread-handoff.js`.
+
+## 3.5.75
+
+3.5.74 plus personal bots act for their owner through a pass (from the Maia build), and the one-tap switch-on card. Nothing changes for a bot until Central has `bot:me` (an older Central answers 404 and the bot stays as it was). Autonomous bots are unchanged.
+
+- **Type check** (`core/bot-profile.js`): on start, and every 15 minutes, the bot asks Central `GET /api/bots/me` with its own key for its kind, its one owner and the owner's consent (ticked apps, end date, `renewDue`). The answer is kept in `bot-profile.json`, so a restart while Central is down still knows.
+- **One owner**: a personal bot's owner is the person in Central. Her id replaces `KAZEE_OWNER_USER_ID`, from config load and on every refresh. `access.isChatOwner` counts no other owner (no people records, `auth.json` or chat ids marked owner), and the web dashboard and the voice bridge reach her rather than being owners themselves.
+- **One pass helper** (`core/app-pass.js`): every app call of a personal bot trades its key for a 10-minute pass for that app (`POST /api/bots/pass`), reused until a minute before it ends, one request per app at a time; the bot's own key is never sent to an app. Kazee Chat keeps the bot's own key. The owner reads each app's own name (Spaces, CRM, Tickets, Agent Space, Infrastructure) for Central's exact app names.
+- **Spaces**: the conversational channel stays idle for a personal bot (no socket of its own); anything still sent through it, and the connected-apps plane watching the apps the owner ticked, goes out with her pass.
+- **One-tap card** (SEC-28, `core/owner-setup.js`): when an app refuses a pass because she has not switched the bot on there, and a week before her consent ends, the owner gets a Kazee Chat card with one button that opens Central at the form (Switch me on / Renew); at most once a day per app and reason. `open-claudia owner-setup [--apps a,b] [--renew]` sends it on request; `open-claudia pass <app>` prints a fresh pass, never the key.
+- **Instructions**: a personal bot gets its own block in the core instructions (who it works for, approvals, money and deletes need her tap, send the one-tap card).
+
+Tests: `test-bot-acts-for-owner.js` (in the suite).
+
 ## 3.5.74
 
 3.5.73 plus the Rust command helper, released on Sumeet's card of 8 Nov ("Yes, Maya Cloud first, then one bot at a time") after 3 clean days on his Mac (about 62,000 commands, no crashes).

package/Dockerfile

@@ -102,5 +102,7 @@ EXPOSE 8080
 # Switch to non-root user
 USER 1001
 
+# OC_NODE_FLAGS in a bot's env: docker-entrypoint.sh puts those flags on this
+# node command only. Unset, the command below runs as is.
 ENTRYPOINT ["docker-entrypoint.sh"]
 CMD ["node", "bin/cli.js", "web"]

package/bin/cli.js

@@ -218,6 +218,41 @@ switch (command) {
     break;
   }
 
+  case "pass": {
+    // A fresh pass for one app (core/app-pass.js), for a tool that calls an
+    // app for a personal bot's owner: e.g. `open-claudia pass kazee-spaces-backend`.
+    // Never prints the bot's own key: an autonomous bot has no pass to give.
+    const applicationName = args[1];
+    if (!applicationName) {
+      console.error("Usage: open-claudia pass <Central application name, e.g. kazee-spaces-backend>");
+      process.exit(2);
+    }
+    (async () => {
+      const botProfile = require(path.join(botDir, "core/bot-profile"));
+      const appPass = require(path.join(botDir, "core/app-pass"));
+      await botProfile.refresh();
+      if (!botProfile.isPersonal()) {
+        console.error("Only a personal bot uses passes; this bot calls apps with its own key.");
+        process.exit(2);
+      }
+      try {
+        process.stdout.write(await appPass.tokenFor(applicationName));
+        process.stdout.write("\n");
+        process.exit(0);
+      } catch (e) {
+        console.error(e instanceof appPass.PassRefused ? e.ownerMessage : e.message);
+        process.exit(1);
+      }
+    })();
+    break;
+  }
+
+  case "owner-setup": {
+    // The one-tap card for a personal bot's owner (core/owner-setup.js).
+    require("./owner-setup").run(args.slice(1)).then((code) => process.exit(code));
+    break;
+  }
+
   case "health": {
     console.log("Running health checks...\n");
     const verbose = args.includes("-v") || args.includes("--verbose");
@@ -459,6 +494,10 @@ switch (command) {
     require("./cards").runDecide(args.slice(1));
     break;
   }
+  case "view": {
+    require("./views").runView(args.slice(1));
+    break;
+  }
   case "teach": {
     Promise.resolve(require("./teach").run(args.slice(1)))
       .catch((e) => { console.error(`teach command failed: ${e.message}`); process.exitCode = 1; });
@@ -647,6 +686,7 @@ Send tools (only work inside an active bot-spawned task):
   open-claudia card pieces           List the pieces a card is built from (table, tick, date, slots, rows, board...) and their examples
   open-claudia card update <id> ...  Close/open a card you sent, add a note, or replace its spec (card example <name> for specs)
   open-claudia decide "<q>" --option id="label" ...   Queue a decision card for the owner (one at a time; decide list|cancel)
+  open-claudia view send <page.html> --title "<t>" [--handler <file>]   Send an interactive web page (Kazee Chat); view push|example
   open-claudia teach list|show|finish|cancel <id>   Browser recordings from Teach me; finish deletes the pictures, cancel the whole recording
 
 Memory tools:
@@ -679,12 +719,19 @@ Background work (only inside an active bot-spawned task):
 Cluster control (self-management of this bot's own deployment via the broker):
   open-claudia cluster status|logs|restart|start|stop|scale <0|1>|sync
 
+Personal bots (acting for their owner):
+  open-claudia pass <app>                    A fresh 10-minute pass to act as your owner at one app
+                                             (e.g. kazee-spaces-backend); never your own key
+  open-claudia owner-setup [--apps a,b] [--renew]  Send your owner a one-tap card in Kazee Chat to switch
+                                             you on (default: apps not switched on yet) or renew
+
 Multi-user / cross-channel:
   open-claudia people list|show|add|note|link      Roster of known team members
   open-claudia intros list|approve|reject          Pending introductions from unknown chats
   open-claudia auth list|revoke <chatId>           Raw authorization view + direct deauth
   open-claudia send-to --person "<name>" "<msg>"   Relay a message to another team member
   open-claudia handoff --thread <id> "<msg>"       Post in another Kazee thread and wake it to start work
+  open-claudia handoff --new "<title>" "<msg>"    Start a titled thread, tag the asker, hand off into it
                                                    ([--chat <chatId>] [--title "<label>"]; owner only)
   open-claudia recent --person "<name>" [--limit]  Read recent activity from another chat
 

package/bin/handoff.js

@@ -9,8 +9,12 @@ Hand work to another Kazee thread: post the message there (visibly, as the
 bot) and wake that thread's conversation to start on it now.
 
   open-claudia handoff --thread <threadId> "<message>" [--chat <chatId>] [--title "<short label>"]
+  open-claudia handoff --new "<thread title>" "<message>" [--chat <chatId>]
 
   --thread  the target thread's id (its root message id)
+  --new     start a NEW titled thread (1-80 characters) and hand off into it;
+            the person who asked is tagged so it shows in their Threads list.
+            Never post a plain main-chat message and hand off onto that.
   --chat    the Kazee chat the thread is in (default: this conversation's chat)
   --title   a short label for the wake-up job (cron-list shows it)
 
@@ -35,6 +39,7 @@ async function run(argv) {
     process.exit(args[0] === "--help" || args[0] === "help" ? 0 : 2);
   }
   const targetThreadId = takeFlag(args, "thread");
+  const newTitle = takeFlag(args, "new");
   const targetChatId = takeFlag(args, "chat");
   const title = takeFlag(args, "title");
   if (args[0] && /^--[a-z]/.test(args[0])) {
@@ -42,16 +47,20 @@ async function run(argv) {
     process.exit(2);
   }
   const message = args.join(" ").trim();
-  if (!targetThreadId) { console.error("Missing --thread <threadId>."); process.exit(2); }
+  if (targetThreadId && newTitle !== null) { console.error('Use --thread <threadId> or --new "<title>", not both.'); process.exit(2); }
+  if (!targetThreadId && newTitle === null) { console.error('Missing --thread <threadId> (an existing thread) or --new "<title>" (a new thread).'); process.exit(2); }
+  if (newTitle !== null && !newTitle.trim()) { console.error('--new needs a title: --new "<title>".'); process.exit(2); }
   if (!message) { console.error("Missing message text."); process.exit(2); }
   try {
-    const body = { targetThreadId, message };
+    const body = { message };
+    if (targetThreadId) body.targetThreadId = targetThreadId;
+    if (newTitle !== null) body.newThreadTitle = newTitle;
     if (targetChatId) body.targetChatId = targetChatId;
     if (title) body.title = title;
     const res = await postJson("thread-handoff", body);
     const target = res.target || {};
     const where = target.title ? `"${target.title}" (${target.threadId})` : `thread ${target.threadId || targetThreadId}`;
-    console.log(`Handed off to ${where}: posted message ${res.messageId || "(no id)"}, wake job ${res.jobId || "?"} (hand-off ${res.hop || "?"} of ${res.maxHops || 3} in a row).`);
+    console.log(`Handed off to ${res.newThread ? "new thread " : ""}${where}: posted message ${res.messageId || "(no id)"}, wake job ${res.jobId || "?"} (hand-off ${res.hop || "?"} of ${res.maxHops || 3} in a row).`);
     process.exit(0);
   } catch (e) {
     console.error(e.message);

package/bin/owner-setup.js

@@ -0,0 +1,56 @@
+// open-claudia owner-setup — send a personal bot's owner the one-tap card that opens
+// Central at the form to switch the bot on (or renew it). See
+// core/owner-setup.js. The running bot sends it to the owner's direct Kazee chat.
+
+const path = require("path");
+
+const HELP = `
+Send your owner a one-tap card to switch you on, or to renew.
+
+  open-claudia owner-setup                  the apps you can work in that your owner hasn't switched on yet
+  open-claudia owner-setup --apps Tickets   just these apps (Central names or Tickets, CRM, Spaces...)
+  open-claudia owner-setup --renew          renew before your owner's permission ends
+
+Personal bots only. You can never switch yourself on: only your owner can confirm.
+`;
+
+function takeFlag(args, name) {
+  const idx = args.indexOf(`--${name}`);
+  if (idx < 0) return null;
+  const v = args[idx + 1];
+  args.splice(idx, 2);
+  return v;
+}
+
+// Resolves the exit code. deps (tests): refresh, post, log, error.
+async function run(args, deps = {}) {
+  const log = deps.log || console.log;
+  const error = deps.error || console.error;
+  args = [...args];
+  if (args[0] === "--help" || args[0] === "help") { log(HELP); return 0; }
+  const botProfile = require(path.join(__dirname, "..", "core", "bot-profile"));
+  const ownerSetup = require(path.join(__dirname, "..", "core", "owner-setup"));
+  const renew = args.includes("--renew");
+  const apps = String(takeFlag(args, "apps") || "").split(",").map((s) => s.trim()).filter(Boolean);
+  try {
+    await (deps.refresh || botProfile.refresh)();
+  } catch (_) { /* the last answer on disk */ }
+  const planned = ownerSetup.plan({ apps, renew });
+  if (planned.refused) { error(planned.refused); return 2; }
+  if (planned.nothing) { log(planned.nothing); return 0; }
+  try {
+    const post = deps.post || require("./loopback-client").postJson;
+    const res = await post("owner-setup", { apps, renew });
+    if (res.nothing) { log(res.nothing); return 0; }
+    const who = botProfile.ownerFirstName();
+    if (res.sent === "already-sent") log(`${who} already got this card in the last day; not sent again.`);
+    else if (res.sent === "card") log(`Sent ${who} a card in Kazee Chat: "${res.title}".`);
+    else log(`The card could not be sent, so ${who} got the text with the link instead.`);
+    return 0;
+  } catch (e) {
+    error(`owner-setup: ${e.message}`);
+    return 1;
+  }
+}
+
+module.exports = { run, HELP };

package/bin/views.js

@@ -0,0 +1,255 @@
+// `open-claudia view ...`: HTML views in Kazee Chat from inside a turn. A
+// view is a web page sent as a card with an Open button; it opens in a
+// walled-off panel and talks back with kazee.send / kazee.on (core/views.js
+// answers its events).
+
+const fs = require("fs");
+const path = require("path");
+const { postJson } = require("./loopback-client");
+
+const FILE_MAX = 2 * 1024 * 1024;
+const PUSH_MAX = 16384;
+
+const VIEW_USAGE = `Usage:
+  open-claudia view send <page.html> --title "<title>" [--body "<text>"] [--label "<button>"]
+                         [--preview <picture.png|.jpg>] [--handler <file>] [--wake each|none]
+  open-claudia view push <messageId> <json | -> [--to <userId>]
+  open-claudia view example [page|handler]
+Views are Kazee Chat only. The page (.html, at most 2 MB) opens in a walled-off
+panel: it may load scripts, styles and fonts from cdn.jsdelivr.net, unpkg.com,
+cdnjs.cloudflare.com and esm.sh, but cannot fetch anything from the internet,
+so put its data in the page. In the page:
+  kazee.send(name, data)   send an event to you (name: a-z 0-9 _ . -, data under 4 KB as JSON)
+  kazee.on(data => ...)    receive what you push (view push, or a handler's {"push": ...})
+Events wake this conversation (--wake each, the default; events close together
+come as one wake) or are dropped (--wake none). With --handler, a script runs
+once per event instead (node for .js, else run directly; 10 s; its folder is the
+working directory). It gets the event as JSON on stdin
+  {"messageId","chatId","userId","userName","name","data","at"}
+and each line it prints that is JSON is an order:
+  {"push": <data>, "to": "<userId>"}   back to the page ("to" optional: only that person)
+  {"wake": "<text>"}                    wake this conversation
+Never put answers you check (a quiz key) in the page: people can read it. Keep them in the handler.`;
+
+const EXAMPLE_PAGE = `<!doctype html>
+<html>
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Quick quiz</title>
+<style>
+  body { font: 16px/1.4 system-ui, sans-serif; margin: 0; padding: 16px; background: #f7f7f8; color: #1d1d1f; }
+  .q { background: #fff; border-radius: 12px; padding: 14px; margin-bottom: 12px; box-shadow: 0 1px 2px rgba(0,0,0,.08); }
+  .q h3 { margin: 0 0 10px; font-size: 16px; }
+  button { display: block; width: 100%; text-align: left; margin: 6px 0; padding: 10px 12px; border: 1px solid #d0d0d6;
+           border-radius: 8px; background: #fff; font: inherit; cursor: pointer; }
+  button:disabled { cursor: default; opacity: .7; }
+  button.right { border-color: #2e9d57; background: #e7f6ec; opacity: 1; }
+  button.wrong { border-color: #d0453b; background: #fbeceb; opacity: 1; }
+  .note { font-size: 14px; color: #555; min-height: 1.2em; }
+  #score { font-weight: 600; text-align: center; }
+</style>
+</head>
+<body>
+<div id="quiz"></div>
+<p id="score"></p>
+<script>
+  // The questions only. The right answers stay in the handler: anyone can read this page.
+  const QUESTIONS = [
+    { id: "q1", text: "Which planet is closest to the sun?", options: ["Venus", "Mercury", "Mars"] },
+    { id: "q2", text: "How many legs does a spider have?", options: ["6", "8", "10"] },
+    { id: "q3", text: "What is the boiling point of water at sea level?", options: ["90 °C", "100 °C", "120 °C"] },
+  ];
+  const results = {};
+  const quiz = document.getElementById("quiz");
+  for (const q of QUESTIONS) {
+    const box = document.createElement("div");
+    box.className = "q";
+    box.innerHTML = "<h3></h3><div class='opts'></div><div class='note'></div>";
+    box.querySelector("h3").textContent = q.text;
+    q.options.forEach((label, i) => {
+      const b = document.createElement("button");
+      b.textContent = label;
+      b.onclick = () => {
+        box.querySelectorAll("button").forEach((x) => { x.disabled = true; });
+        b.dataset.picked = "1";
+        box.querySelector(".note").textContent = "Checking...";
+        window.kazee.send("answer", { q: q.id, choice: i });
+      };
+      box.querySelector(".opts").appendChild(b);
+    });
+    box.id = q.id;
+    quiz.appendChild(box);
+  }
+  // The bot's replies: { q, correct, right, note } for each answer.
+  window.kazee.on((data) => {
+    if (!data || !data.q) return;
+    const box = document.getElementById(data.q);
+    if (!box) return;
+    const buttons = box.querySelectorAll("button");
+    buttons.forEach((b, i) => {
+      if (i === data.right) b.className = "right";
+      else if (b.dataset.picked) b.className = "wrong";
+    });
+    box.querySelector(".note").textContent = data.note || "";
+    results[data.q] = !!data.correct;
+    const done = Object.keys(results).length;
+    if (done === QUESTIONS.length) {
+      const score = Object.values(results).filter(Boolean).length;
+      document.getElementById("score").textContent = "You got " + score + " of " + QUESTIONS.length + ".";
+      window.kazee.send("done", { score, of: QUESTIONS.length });
+    }
+  });
+</script>
+</body>
+</html>
+`;
+
+const EXAMPLE_HANDLER = `// handler.js: answers the quiz page's events. Sent with
+//   open-claudia view send quiz.html --title "Quick quiz" --handler handler.js
+// It runs once per event: the event is JSON on stdin, each JSON line printed is an order.
+const KEY = { q1: { right: 1, note: "Mercury is closest." },
+              q2: { right: 1, note: "Spiders have 8 legs." },
+              q3: { right: 1, note: "100 °C at sea level." } };
+
+let input = "";
+process.stdin.on("data", (c) => { input += c; });
+process.stdin.on("end", () => {
+  const ev = JSON.parse(input);
+  const out = (order) => console.log(JSON.stringify(order));
+  if (ev.name === "answer" && ev.data && KEY[ev.data.q]) {
+    const k = KEY[ev.data.q];
+    // Only to the person who answered: others with the page open keep their own quiz.
+    out({ push: { q: ev.data.q, correct: ev.data.choice === k.right, right: k.right, note: k.note }, to: ev.userId });
+  } else if (ev.name === "done" && ev.data) {
+    // Wake the conversation once, when someone finishes.
+    out({ wake: \`\${ev.userName || "Someone"} finished the quiz: \${Number(ev.data.score)} of \${Number(ev.data.of)}.\` });
+  }
+});
+`;
+
+function flag(args, name) {
+  const i = args.indexOf(name);
+  if (i < 0) return undefined;
+  const v = args[i + 1];
+  if (v === undefined || v.startsWith("--")) throw new Error(`${name} needs a value`);
+  args.splice(i, 2);
+  return v;
+}
+
+function readFileFor(file, what, exts) {
+  const full = path.resolve(file);
+  const ext = path.extname(full).toLowerCase();
+  if (!exts.includes(ext)) throw new Error(`the ${what} must be a ${exts.join(" or ")} file: ${file}`);
+  let st;
+  try { st = fs.statSync(full); } catch (_) { throw new Error(`${what} not found: ${file}`); }
+  if (!st.isFile()) throw new Error(`${what} is not a file: ${file}`);
+  if (st.size === 0) throw new Error(`the ${what} is empty: ${file}`);
+  if (st.size > FILE_MAX) throw new Error(`the ${what} is over 2 MB: ${file}`);
+  return { fileName: path.basename(full), data: fs.readFileSync(full).toString("base64") };
+}
+
+/** `view send` arguments into the loopback body (throws on bad input). */
+function parseSend(argv) {
+  const args = [...argv];
+  const title = flag(args, "--title");
+  const body = flag(args, "--body");
+  const label = flag(args, "--label");
+  const preview = flag(args, "--preview");
+  const handler = flag(args, "--handler");
+  const wake = flag(args, "--wake");
+  const unknown = args.find((a) => a.startsWith("--"));
+  if (unknown) throw new Error(`unknown option ${unknown}`);
+  if (args.length !== 1) throw new Error(args.length ? `one page only (got ${args.join(" ")})` : "missing the page (.html file)");
+  if (!title || !title.trim()) throw new Error("--title is required");
+  if (title.trim().length > 140) throw new Error("--title is over 140 characters");
+  if (body && body.length > 600) throw new Error("--body is over 600 characters");
+  if (label && label.trim().length > 40) throw new Error("--label is over 40 characters");
+  if (wake !== undefined && !["each", "none"].includes(wake)) throw new Error("--wake must be each or none");
+  let handlerPath = null;
+  if (handler) {
+    handlerPath = path.resolve(handler);
+    let st = null;
+    try { st = fs.statSync(handlerPath); } catch (_) {}
+    if (!st || !st.isFile()) throw new Error(`handler not found: ${handler}`);
+    if (!/\.(c|m)?js$/i.test(handlerPath)) {
+      try { fs.accessSync(handlerPath, fs.constants.X_OK); }
+      catch (_) { throw new Error(`the handler is not a .js file and not executable (chmod +x it): ${handler}`); }
+    }
+  }
+  return {
+    title: title.trim(),
+    ...(body ? { body } : {}),
+    ...(label ? { label: label.trim() } : {}),
+    ...(wake ? { wake } : {}),
+    handler: handlerPath,
+    page: readFileFor(args[0], "page", [".html", ".htm"]),
+    ...(preview ? { preview: readFileFor(preview, "preview", [".png", ".jpg", ".jpeg"]) } : {}),
+  };
+}
+
+/** `view push` arguments into the loopback body; `readStdin` for "-". */
+function parsePush(argv, readStdin = () => fs.readFileSync(0, "utf8")) {
+  const args = [...argv];
+  const to = flag(args, "--to");
+  const unknown = args.find((a) => a.startsWith("--"));
+  if (unknown) throw new Error(`unknown option ${unknown}`);
+  const [messageId, raw] = args;
+  if (!messageId) throw new Error("missing the view's message id");
+  if (raw === undefined) throw new Error("missing the data (JSON, or - for stdin)");
+  if (args.length > 2) throw new Error("too many arguments (quote the JSON)");
+  const text = raw === "-" ? readStdin() : raw;
+  let data;
+  try { data = JSON.parse(text); }
+  catch (_) { throw new Error(`the data is not JSON (a string needs quotes: '"hello"')`); }
+  if (Buffer.byteLength(JSON.stringify(data)) > PUSH_MAX) throw new Error("the data is over 16 KB as JSON");
+  return { messageId, data, ...(to ? { to } : {}) };
+}
+
+function exampleText(which) {
+  if (which === "page") return EXAMPLE_PAGE;
+  if (which === "handler") return EXAMPLE_HANDLER;
+  if (which) throw new Error("examples: page, handler (or nothing for both)");
+  return [
+    "# quiz.html (open-claudia view example page > quiz.html)",
+    EXAMPLE_PAGE,
+    "# handler.js (open-claudia view example handler > handler.js)",
+    EXAMPLE_HANDLER,
+    '# Send it: open-claudia view send quiz.html --title "Quick quiz" --handler handler.js',
+    "",
+  ].join("\n");
+}
+
+function fail(msg, code = 1) {
+  console.error(msg);
+  process.exit(code);
+}
+
+async function runView(argv) {
+  const args = [...argv];
+  const sub = args.shift();
+  try {
+    if (sub === "example") {
+      process.stdout.write(exampleText(args[0]));
+      return;
+    }
+    if (sub === "send") {
+      const body = parseSend(args);
+      const res = await postJson("view-send", body);
+      const events = res.handler ? `events run ${res.handler}` : `events wake this conversation: ${res.wake}`;
+      console.log(`Sent view ${res.messageId} (${events})`);
+      return;
+    }
+    if (sub === "push") {
+      const body = parsePush(args);
+      await postJson("view-push", body);
+      console.log(`Pushed to view ${body.messageId}${body.to ? ` (only to ${body.to})` : ""}`);
+      return;
+    }
+    fail(VIEW_USAGE, sub && sub !== "help" && sub !== "--help" ? 1 : 0);
+  } catch (e) {
+    fail(`view ${sub}: ${e.message}`);
+  }
+}
+
+module.exports = { runView, parseSend, parsePush, exampleText, VIEW_USAGE, EXAMPLE_PAGE, EXAMPLE_HANDLER };

package/bot.js

@@ -264,6 +264,42 @@ setInterval(checkForUpdates, 5 * 60 * 1000);
 
 // ── Boot ────────────────────────────────────────────────────────────
 
+// Tell a personal bot's owner in her Kazee DM that an app refused a pass: a
+// one-tap card to switch the bot on there, else the text (core/owner-setup.js).
+// Best effort: no Kazee adapter or DM means no message.
+async function tellPersonalOwner(text, err) {
+  const ownerSetup = require("./core/owner-setup");
+  const kazee = adapters.find((a) => a.type === "kazee");
+  if (kazee) await ownerSetup.tellOwner(ownerSetup.forRefusal(err, text), { adapter: kazee });
+}
+
+// A week before the consent ends: the renew card, once a day.
+async function maybeSendRenewNotice() {
+  const kazee = adapters.find((a) => a.type === "kazee");
+  if (kazee) await require("./core/owner-setup").maybeSendRenew({ adapter: kazee });
+}
+
+async function startBotProfile() {
+  const botProfile = require("./core/bot-profile");
+  const applyOwner = () => {
+    const owner = botProfile.applyOwner(config);
+    if (!owner) return;
+    for (const a of adapters) {
+      if (a.type === "kazee" || a.type === "spaces") a.ownerUserId = owner;
+    }
+  };
+  await botProfile.refresh();
+  applyOwner();
+  console.log(botProfile.isPersonal()
+    ? `Bot profile: personal, owner ${botProfile.ownerName() || botProfile.ownerUserId()}; apps ticked: ${botProfile.consentApplications().join(", ") || "none"}`
+    : `Bot profile: ${botProfile.get()?.bot?.botKind || "unknown (Central has no bot:me)"}`);
+  require("./core/app-pass").setOwnerNotifier(tellPersonalOwner);
+  botProfile.startRefreshing(applyOwner);
+  const renewTimer = setInterval(() => { maybeSendRenewNotice(); }, 60 * 60 * 1000);
+  if (renewTimer.unref) renewTimer.unref();
+  setTimeout(() => { maybeSendRenewNotice(); }, 60 * 1000).unref?.();
+}
+
 // Minimal boot: adapters + slash commands only. No scheduler/crons, no dream,
 // no connected-apps, no loopback, no web UI, no onboarding — nothing that can
 // run an agent turn or write memory. The alert tells the owner exactly why and
@@ -332,6 +368,12 @@ async function safeModeBoot() {
     }
   } catch (e) {}
 
+  // Personal or autonomous, and who the one owner is: asked of Central before
+  // the adapters start (core/bot-profile.js). A personal bot's app calls go
+  // through passes for that owner (core/app-pass.js).
+  try { await startBotProfile(); }
+  catch (e) { console.error("bot profile init failed:", e.message); }
+
   initScheduler(adapters);
   try { require("./core/dream").initDream(adapters); }
   catch (e) { console.error("dream init failed:", e.message); }

package/channels/kazee/adapter.js

@@ -546,6 +546,25 @@ class KazeeAdapter {
         raw: payload,
       });
     });
+    // HTML views: someone in the chat sent an event from a view page this bot
+    // sent (kazee.send in the page). Routed like a card answer; core/views.js
+    // runs the view's handler or wakes the conversation the view came from.
+    socket.on("view:event", (payload) => {
+      if (!payload || !payload.messageId) return;
+      const userId = payload.userId ? String(payload.userId) : "";
+      this._emit("action", {
+        adapter: this,
+        channelId: String(payload.chatId || ""),
+        canonicalUserId: userId ? canonicalForChannel("kazee", userId) : null,
+        userId: userId || null,
+        type: "action",
+        messageId: payload.messageId,
+        threadId: payload.threadRoot ? String(payload.threadRoot) : null,
+        action: { buttonId: `kv:${payload.messageId}`, payload: `kv:${payload.messageId}`, sourceMessageId: payload.messageId },
+        view: payload,
+        raw: payload,
+      });
+    });
     socket.on("message:action", (payload) => {
       const channelId = String(payload.chatId);
       const known = this._sentMessages.has(String(payload.messageId || ""));
@@ -733,6 +752,18 @@ class KazeeAdapter {
   // What the bot reads to name a thread: the root's text, the first replies
   // (the bot's own marked) and the title the thread already has, when the
   // server sends one. Throws like _fetchThread.
+  // Start a real thread (chat-central startThread): a titled header root the
+  // chat's bots never hear. Followers are the starter plus whoever the first
+  // reply tags, so callers tag the person the thread is for. Resolves the
+  // root message id; throws when chat-central refuses.
+  async startThread(chatId, title) {
+    const route = `/thread/${encodeURIComponent(String(chatId))}/start`;
+    const res = await withTimeout(this._request("POST", route, { userId: String(this.botUserId), title: String(title || "") }), THREAD_TITLE_TIMEOUT_MS, "Kazee thread start");
+    const root = res && ((res.message && res.message._id) || (res.data && res.data._id));
+    if (!root) throw new Error(`Kazee thread start gave no root id${res && res.error ? `: ${res.error}` : ""}`);
+    return String(root);
+  }
+
   async threadTitleSource(chatId, rootId) {
     const data = await this._fetchThread(String(chatId), String(rootId), THREAD_TITLE_SOURCE_LIMIT);
     const root = data.root && typeof data.root === "object" ? data.root : null;
@@ -1435,6 +1466,9 @@ class KazeeAdapter {
     };
     if (opts.replyTo) body.replyTo = opts.replyTo;
     if (buttons) body.interactive = { buttons };
+    // People tagged as @[Name](id) in the text (a hand-off into a new thread
+    // tags whoever asked, so it shows in their Threads list and as unread).
+    if (Array.isArray(opts.mentions) && opts.mentions.length) body.mentions = opts.mentions.map(String);
     const threadId = opts.threadId ? String(opts.threadId) : null;
     if (threadId) body.threadRootId = threadId;
     // Tags of other bots (./bot-handoffs.js). chat-central reads mentions out
@@ -1574,6 +1608,32 @@ class KazeeAdapter {
     return view;
   }
 
+  // Upload one file as chat media (chat-central `uploadMedia`) and answer its
+  // media id. For HTML views: the page and its preview picture go up first,
+  // then the card names them by id. Throws when the server keeps no id.
+  async uploadMedia(channelId, { buffer, fileName, contentType } = {}) {
+    const upload = await this._uploadMultipart(
+      `/chat/media/${encodeURIComponent(channelId)}`,
+      { media: { buffer, fileName, contentType } },
+    );
+    const saved = Array.isArray(upload?.media) ? upload.media[0] : null;
+    if (!saved || !saved._id) {
+      const why = Array.isArray(upload?.errors) && upload.errors[0]?.error ? `: ${upload.errors[0].error}` : "";
+      throw new Error(`Kazee Chat kept no media id for ${fileName}${why}`);
+    }
+    return String(saved._id);
+  }
+
+  // HTML views: hand data to an open view page (kazee.on in the page).
+  // Only the message's sender may push; `to` limits it to one person.
+  async pushView(messageId, data, to) {
+    const body = { data: data === undefined ? null : data };
+    if (to) body.to = String(to);
+    const res = await this._request("PUT", `/message/${encodeURIComponent(messageId)}/view/push`, body);
+    if (res && res.success === false) throw new Error(res.error || "view push refused");
+    return true;
+  }
+
   // A card as the server shows it now (its state: open, closed, decided),
   // read through the one-message lookup. Null when the message is gone.
   async readCard(chatId, messageId) {
@@ -2083,7 +2143,7 @@ class KazeeAdapter {
       const boundary = `----oc-${Date.now()}-${Math.random().toString(36).slice(2)}`;
       const parts = [];
       for (const [field, info] of Object.entries(files)) {
-        parts.push(Buffer.from(`--${boundary}\r\nContent-Disposition: form-data; name="${field}"; filename="${info.fileName}"\r\nContent-Type: application/octet-stream\r\n\r\n`));
+        parts.push(Buffer.from(`--${boundary}\r\nContent-Disposition: form-data; name="${field}"; filename="${info.fileName}"\r\nContent-Type: ${info.contentType || "application/octet-stream"}\r\n\r\n`));
         parts.push(info.buffer);
         parts.push(Buffer.from("\r\n"));
       }

package/channels/kazee/call/camera.js

@@ -11,7 +11,6 @@ const fs = require("fs");
 const os = require("os");
 const path = require("path");
 const { spawn } = require("child_process");
-const { dePacketizeRtpPackets } = require("werift");
 
 const STILL_EVERY_S = 2;
 const STILL_SIZE = 768;
@@ -152,7 +151,7 @@ class CameraStills {
       if ((packets[index].header.sequenceNumber - packets[index - 1].header.sequenceNumber + 65536) % 65536 !== 1) return this._lost();
     }
     let frame;
-    try { frame = dePacketizeRtpPackets("VP8", packets); } catch (_) { return this._lost(); }
+    try { frame = require("werift").dePacketizeRtpPackets("VP8", packets); } catch (_) { return this._lost(); }
     if (!frame?.data?.length) return;
     const size = frame.isKeyframe ? vp8KeyframeSize(frame.data) : null;
     if (this._needKeyframe) {