@inetafrica/open-claudia 3.5.74 → 3.5.76

package/channels/kazee/call/session.js

@@ -1,6 +1,7 @@
 "use strict";
 
-const { MediaStreamTrack, RTCPeerConnection, RTCRtpHeaderExtensionParameters, RtpHeader, RtpPacket } = require("werift");
+// Loaded on the first call, so a bot that takes no calls never holds this library.
+const werift = () => require("werift");
 const { JanusClient } = require("./janus-client");
 const { projectAssignedIce, supportedIceServers } = require("./access");
 const { AdaptiveTurnDetector, OpusAudioCodec, WEBRTC_SAMPLES, downsample48To16, upsampleTo48, rmsDbfs } = require("./audio");
@@ -227,7 +228,7 @@ class KazeeCallSession {
   constructor({ roomId, chatId, callerId, botUserId, janusUrl, janusToken, janusTokenExpiresAt, roomToken, roomTokenExpiresAt, managedRoom = false, refreshRoomAccess, iceServers = [], iceCredentialsExpiresAt, onTranscript, onEnded, onMediaReady,
     maxCallMs, idleMs, checkInMs, checkInGraceMs, dropMs, dropGiveUpMs, humDb, finalWaitMs, synthesize = synthesizePcm, synthesizeStream = null, asCaller = false, greeting = null,
     turnDecision = detectTurn, acknowledgement = selectAcknowledgement, onSpeechStart, onSpeechNoise, onEarlyWords, onUtteranceDropped,
-    JanusClientImpl = JanusClient, PeerConnectionImpl = RTCPeerConnection, SpeechStreamImpl = SpeechStream } = {}) {
+    JanusClientImpl = JanusClient, PeerConnectionImpl = werift().RTCPeerConnection, SpeechStreamImpl = SpeechStream } = {}) {
     this.roomId = Number(roomId);
     this.chatId = String(chatId);
     this.callerId = String(callerId);
@@ -357,7 +358,7 @@ class KazeeCallSession {
     // A feed's connection also takes the caller's camera; with the
     // orientation extension a phone held upright gives an upright still.
     const pc = new this.PeerConnectionImpl(camera
-      ? { iceServers: this.iceServers, headerExtensions: { audio: [], video: [new RTCRtpHeaderExtensionParameters({ id: 13, uri: VIDEO_ORIENTATION_URI })] } }
+      ? { iceServers: this.iceServers, headerExtensions: { audio: [], video: [new (werift().RTCRtpHeaderExtensionParameters)({ id: 13, uri: VIDEO_ORIENTATION_URI })] } }
       : { iceServers: this.iceServers });
     if (Number.isFinite(expiresAt)) {
       this._transportIceExpiry.set(pc, expiresAt);
@@ -515,7 +516,7 @@ class KazeeCallSession {
         this._maybeGreet();
       }
     });
-    const track = new MediaStreamTrack({ kind: "audio" });
+    const track = new (werift().MediaStreamTrack)({ kind: "audio" });
     const sender = pc.addTrack(track);
     this.publisher = { pc, track, sender, pending: [], remoteSet: false };
     const offer = await pc.createOffer();
@@ -1046,7 +1047,7 @@ class KazeeCallSession {
     if (frame.length < WEBRTC_SAMPLES * 2) frame = Buffer.concat([frame, Buffer.alloc(WEBRTC_SAMPLES * 2 - frame.length)]);
     const opus = this.codec.encode(frame);
     const payloadType = this.publisher?.sender?.codec?.payloadType || 111;
-    this.publisher?.track?.writeRtp(new RtpPacket(new RtpHeader({
+    this.publisher?.track?.writeRtp(new (werift().RtpPacket)(new (werift().RtpHeader)({
       payloadType, sequenceNumber: this.sequence++ & 0xffff, timestamp: this.timestamp >>> 0, ssrc: this.ssrc,
     }), opus));
     this.timestamp = (this.timestamp + WEBRTC_SAMPLES) >>> 0;

package/channels/spaces/adapter.js

@@ -21,6 +21,15 @@ const { SpacesClient, contentText } = require("./client");
 const { createSpacesSocket } = require("./socket");
 const spacesState = require("./state");
 
+// Central's name for the Spaces back end, the app a personal bot's pass is for.
+const SPACES_APPLICATION = "kazee-spaces-backend";
+
+function spacesBearer(token) {
+  let personal = false;
+  try { personal = require("../../core/bot-profile").isPersonal(); } catch (_) { /* no profile: as before */ }
+  return personal ? require("../../core/app-pass").tokenFor(SPACES_APPLICATION) : token;
+}
+
 // Notification `type`/`category` values that warrant a full agent turn. The
 // Spaces server emits PLURAL categories (mentions, comments, reactions,
 // task_updated), so the engage set must match the plural forms — matching only
@@ -54,7 +63,11 @@ class SpacesAdapter {
     // the only thing calling poll(); it can be disabled, so the adapter drives
     // its own timer and never depends on it.
     this.pollMs = Number(pollMs) > 0 ? Number(pollMs) : 60000;
-    this.client = new SpacesClient({ baseUrl: this.url, token });
+    // A personal bot never shows Spaces its own key: anything that still goes
+    // through this channel while it is idle (a reply, an approval mirror, a
+    // task title) carries a pass for its owner (core/app-pass.js). Other bots
+    // keep the key, as before.
+    this.client = new SpacesClient({ baseUrl: this.url, token: () => spacesBearer(token) });
     this._listeners = { message: new Set(), action: new Set() };
     this._socket = null;
     this._seen = new Set(); // notification-id dedup across socket + poll
@@ -79,6 +92,17 @@ class SpacesAdapter {
   }
 
   async start() {
+    // A personal bot acts in Spaces only as its owner, through a pass
+    // (core/app-pass.js), so it has no Spaces identity of its own to watch or
+    // reply as. It watches its owner's Spaces inbox through the connected-apps
+    // plane instead, and the conversational channel stays idle.
+    try {
+      if (require("../../core/bot-profile").isPersonal()) {
+        this.idleReason = "personal-bot";
+        console.log("Spaces channel idle: a personal bot acts in Spaces only as its owner, through a pass");
+        return;
+      }
+    } catch (_) { /* no profile: behave as before */ }
     this._socket = createSpacesSocket({
       url: this.url,
       token: this.token,

package/channels/spaces/client.js

@@ -222,13 +222,17 @@ function buildCommentContent(text, mentions = []) {
 }
 
 class SpacesClient {
+  // `token` is the bearer, or a function that returns it (sync or async): a
+  // personal bot passes core/app-pass's provider, so every call goes out with
+  // a fresh pass for its owner and never with the bot's own key.
   constructor({ baseUrl = "https://api.spaces.kazee.africa", token }) {
     this.baseUrl = baseUrl.replace(/\/$/, "");
     this.token = token;
   }
 
-  _get(urlPath, timeoutMs) { return request(this.baseUrl, this.token, "GET", urlPath, null, timeoutMs); }
-  _post(urlPath, body, timeoutMs) { return request(this.baseUrl, this.token, "POST", urlPath, body, timeoutMs); }
+  async _bearer() { return typeof this.token === "function" ? this.token() : this.token; }
+  async _get(urlPath, timeoutMs) { return request(this.baseUrl, await this._bearer(), "GET", urlPath, null, timeoutMs); }
+  async _post(urlPath, body, timeoutMs) { return request(this.baseUrl, await this._bearer(), "POST", urlPath, body, timeoutMs); }
 
   async listTasks() {
     const res = await this._get("/api/tasks");

package/channels/telegram/adapter.js

@@ -6,7 +6,6 @@
 const fs = require("fs");
 const path = require("path");
 const https = require("https");
-const TelegramBot = require("node-telegram-bot-api");
 const { TEMP_DIR, FILES_DIR, CONFIG_DIR } = require("../../core/config");
 const { safeJoin } = require("../../core/safe-filename");
 const { canonicalForChannel } = require("../../core/identity");
@@ -27,6 +26,8 @@ class TelegramAdapter {
     // one bot) sidesteps the stale-socket trap that drove the old restart storm.
     // We still own the agent so a heal can destroy any lingering socket.
     this._agent = new https.Agent({ keepAlive: false });
+    // Loaded here so a bot with no Telegram token never holds this library.
+    const TelegramBot = require("node-telegram-bot-api");
     this.bot = new TelegramBot(token, {
       polling: { autoStart: false, params: { timeout: 30 } },
       // Socket-idle timeout on every request (getUpdates included). With

package/channels/web/adapter.js

@@ -23,6 +23,20 @@ const HISTORY_LIMIT = 200;
 const MEDIA_TTL_MS = 60 * 60 * 1000;
 
 const WEB_OWNER_ID = "web-owner";
+// A personal bot's dashboard session that names nobody (password login,
+// Agent Space's link): not its owner.
+const WEB_GUEST_ID = "web-guest";
+
+// Who a dashboard message is from. An autonomous bot's dashboard is its
+// owner's channel. A personal bot has one owner, Central's: the session
+// names the person it was opened for (her /dashboard link), else a guest,
+// and access.js decides whether that is the owner.
+function webSpeaker(sessionUserId) {
+  let personal = false;
+  try { personal = require("../../core/bot-profile").isPersonal(); } catch (e) {}
+  if (!personal) return WEB_OWNER_ID;
+  return sessionUserId ? String(sessionUserId) : WEB_GUEST_ID;
+}
 
 class WebAdapter {
   constructor({ id = "web" } = {}) {
@@ -64,38 +78,40 @@ class WebAdapter {
 
   // ── inbound (called by web.js /api/chat routes) ─────────────────
 
-  postText(text) {
+  postText(text, { userId } = {}) {
     const body = String(text || "");
     if (!body.trim()) return null;
+    const speaker = webSpeaker(userId);
     const messageId = this._mkId("t");
     // Echo into history/stream so every connected tab sees the user's turn.
     this._pushFrame({ kind: "message", role: "user", messageId, text: body, ts: Date.now() });
     this._emit("message", {
       adapter: this,
-      channelId: this.channelId,
-      canonicalUserId: canonicalForChannel("web", this.channelId),
-      userId: this.ownerUserId,
+      channelId: speaker,
+      canonicalUserId: canonicalForChannel("web", speaker),
+      userId: speaker,
       type: body.trim().startsWith("/") ? "command" : "text",
       text: body,
       messageId,
-      from: { id: this.ownerUserId, name: "Owner", username: "" },
+      from: { id: speaker, name: speaker === WEB_OWNER_ID ? "Owner" : "", username: "" },
       raw: { source: "web" },
     });
     return messageId;
   }
 
-  postAction({ id, payload, messageId } = {}) {
+  postAction({ id, payload, messageId } = {}, { userId } = {}) {
     const p = String(payload != null ? payload : (id != null ? id : ""));
     if (!p) return null;
+    const speaker = webSpeaker(userId);
     const callbackId = this._mkId("cb");
     this._emit("action", {
       adapter: this,
-      channelId: this.channelId,
-      canonicalUserId: canonicalForChannel("web", this.channelId),
-      userId: this.ownerUserId,
+      channelId: speaker,
+      canonicalUserId: canonicalForChannel("web", speaker),
+      userId: speaker,
       type: "action",
       messageId,
-      from: { id: this.ownerUserId, name: "Owner", username: "" },
+      from: { id: speaker, name: speaker === WEB_OWNER_ID ? "Owner" : "", username: "" },
       action: {
         buttonId: String(id != null ? id : p),
         payload: p,
@@ -260,4 +276,4 @@ class WebAdapter {
   }
 }
 
-module.exports = { WebAdapter, WEB_OWNER_ID };
+module.exports = { WebAdapter, WEB_OWNER_ID, WEB_GUEST_ID };

package/core/access.js

@@ -14,6 +14,14 @@ const { atomicWriteFileSync, readJsonWithFallback, withFileLock } = require("./f
 // owner is identified by the Kazee user id. Resolve via env at call time so
 // /channel add can update the value without a process restart.
 function transportOwnerUserId(transport) {
+  // A personal bot's dashboard and voice bridge are ways to reach its one
+  // owner (Central's), not owners of their own: they count only when they
+  // name her.
+  const personalOwner = personalBotOwner();
+  if (personalOwner !== null && (transport === "web" || transport === "voice")) {
+    if (transport === "web") return personalOwner;
+    return String(config.VOICE_OWNER_USER_ID || "") === personalOwner ? personalOwner : "";
+  }
   if (transport === "kazee") return config.KAZEE_OWNER_USER_ID || "";
   // Spaces actors are central/Kazee user ids, so the owner carries the same id
   // there. Without this the owner's own task comments authorize as a stranger
@@ -29,6 +37,16 @@ function transportOwnerUserId(transport) {
   return "";
 }
 
+// Central's owner of a personal bot ("" when not yet known), or null for an
+// autonomous bot.
+function personalBotOwner() {
+  try {
+    const botProfile = require("./bot-profile");
+    if (botProfile.isPersonal()) return botProfile.ownerUserId();
+  } catch (e) {}
+  return null;
+}
+
 function matchesTransportOwner() {
   const transport = currentTransport();
   const userId = currentUserId();
@@ -109,6 +127,13 @@ function isChatAuthorized(chatId, envelope) {
 // member of that group to owner.
 function isChatOwner(chatId) {
   if (matchesTransportOwner()) return true;
+  // A personal bot has exactly one owner, the person in Central
+  // (core/bot-profile.js, applied to KAZEE_OWNER_USER_ID). The second-owner
+  // setup — people records, auth.json or chat ids marked owner — does not
+  // apply: admins look after the bot through Agent Space and Central.
+  try {
+    if (require("./bot-profile").isPersonal()) return false;
+  } catch (e) {}
   const inGroup = currentIsGroup();
   const speakerId = String(currentUserId() || "");
   // In a group only the speaker counts; in a DM the passed chat id is the

package/core/actions.js

@@ -148,6 +148,14 @@ function appendMandateLine(rec, lineText, log, opts) {
 }
 
 async function handleAction(envelope) {
+  // HTML views: an event from a view page this bot sent (channels/kazee
+  // adapter, view:event). core/views.js runs its handler or wakes the
+  // conversation it came from; nothing is sent into the chat from here.
+  if (envelope.view) {
+    try { await require("./views").handleViewEvent(envelope.view, { adapter: envelope.adapter }); }
+    catch (e) { console.error("[views] handling an event failed:", e.message); }
+    return;
+  }
   // Kazee Cards: an answer to a card this bot sent (channels/kazee adapter,
   // card:response). The card ledger decides what it wakes; nothing is sent
   // into the chat from here.

package/core/app-pass.js

@@ -0,0 +1,145 @@
+// One pass helper for every app call (plan v2 "personal bots act for their
+// owner", 25 Oct).
+//
+// A personal bot never hands its own key (KAZEE_BOT_TOKEN) to an app. For each
+// app it trades the key for a 10-minute pass at Central (POST /api/bots/pass),
+// reuses it until just before it runs out, then gets a new one. The pass acts
+// as its owner: the app sees "Cynthia, via smart-cynthia" with the AI mark.
+// An autonomous bot, or one whose Central has no bot:me yet, keeps using its
+// own key, unchanged.
+//
+// A refused pass throws PassRefused with a plain message telling the owner how
+// to switch it on; the owner hears it at most once a day per app and reason
+// (bot.js sends it as a one-tap card, core/owner-setup.js).
+//
+// Parent process only, like the key itself (a CONFINED secret never passed to
+// a provider or tool subprocess).
+
+const botProfile = require("./bot-profile");
+
+// Get a new pass this long before the old one runs out.
+const RENEW_BEFORE_MS = 60 * 1000;
+const TELL_OWNER_EVERY_MS = 24 * 60 * 60 * 1000;
+
+// Central's Application.name -> what the owner calls it.
+const APP_LABELS = {
+  "kazee-spaces-backend": "Spaces",
+  "kazee-crm": "CRM",
+  crm: "CRM",
+  Ticket_Central: "Tickets",
+  "agent-space-backend": "Agent Space",
+  "kazee-infrastructure": "Infrastructure",
+};
+
+const passes = new Map();   // applicationName -> { token, expiresAt }
+const inflight = new Map(); // applicationName -> Promise<string>
+const told = new Map();     // `${app}:${reason}` -> last told at
+let ownerNotifier = null;
+
+class PassRefused extends Error {
+  constructor(applicationName, reason, ownerMessage, status) {
+    super(`Central refused a pass for ${applicationName}: ${reason}`);
+    this.applicationName = applicationName;
+    this.reason = reason;
+    this.ownerMessage = ownerMessage;
+    this.status = status;
+  }
+}
+
+function appLabel(applicationName) {
+  return APP_LABELS[applicationName] || applicationName;
+}
+
+// What the owner reads when Central refuses a pass.
+function ownerHelp(reason, applicationName) {
+  const first = botProfile.ownerFirstName();
+  const app = appLabel(applicationName);
+  const where = botProfile.MY_ASSISTANTS;
+  switch (reason) {
+    case "consent-off":
+      return `${first}, my permission to act for you is switched off, so I can't work in ${app} for you. To switch it back on: ${where}, tap Let it act for me and tick ${app}.`;
+    case "consent-ended":
+      return `${first}, your permission for me to act for you has ended, so I can't work in ${app}. Renew it with one tap in ${where}.`;
+    case "app-not-ticked":
+      return `${first}, you haven't let me act for you in ${app}. To allow it: ${where}, and tick ${app}.`;
+    case "owner-no-access":
+      return `${first}, your own account can't use ${app} right now, so I can't either. Ask your admin for access.`;
+    case "owner-inactive":
+      return `I can't act in ${app}: Central says my owner's account is not active.`;
+    case "bot-disabled":
+      return `I can't act in ${app}: an admin has switched me off in Central.`;
+    case "consent-none":
+    default:
+      return `${first}, I can't work in ${app} for you yet. To let me act for you: open ${where}, tap Let it act for me and tick ${app}.`;
+  }
+}
+
+function setOwnerNotifier(fn) {
+  ownerNotifier = typeof fn === "function" ? fn : null;
+}
+
+async function tellOwnerOnce(err, now) {
+  if (!ownerNotifier) return;
+  const key = `${err.applicationName}:${err.reason}`;
+  const last = told.get(key) || 0;
+  if (now - last < TELL_OWNER_EVERY_MS) return;
+  told.set(key, now);
+  try { await ownerNotifier(err.ownerMessage, err); }
+  catch (e) { console.error("app-pass: could not tell the owner:", e.message); }
+}
+
+async function fetchPass(applicationName, request, now) {
+  const token = botProfile.botToken();
+  if (!token) throw new Error("KAZEE_BOT_TOKEN unset");
+  const res = await request("POST", "/api/bots/pass", token, { applicationName });
+  const body = (res && res.body) || {};
+  if (res && (res.status === 200 || res.status === 201) && typeof body.pass === "string" && body.pass.startsWith("kzp_")) {
+    const expiresAt = Date.parse(body.expiresAt);
+    passes.set(applicationName, { token: body.pass, expiresAt: Number.isFinite(expiresAt) ? expiresAt : now() + 9 * 60 * 1000 });
+    return body.pass;
+  }
+  const reason = body.reason || (res && res.status === 401 ? "bot-key-invalid" : `http-${res && res.status}`);
+  const err = new PassRefused(applicationName, reason, ownerHelp(reason, applicationName), res && res.status);
+  await tellOwnerOnce(err, now());
+  throw err;
+}
+
+// The token to present at `applicationName`: a pass for a personal bot, the
+// bot's own key otherwise.
+async function tokenFor(applicationName, { request = botProfile.centralRequest, now = Date.now } = {}) {
+  if (!botProfile.isPersonal()) return botProfile.botToken();
+  const held = passes.get(applicationName);
+  if (held && held.expiresAt - now() > RENEW_BEFORE_MS) return held.token;
+  if (inflight.has(applicationName)) return inflight.get(applicationName);
+  const p = fetchPass(applicationName, request, now).finally(() => inflight.delete(applicationName));
+  inflight.set(applicationName, p);
+  return p;
+}
+
+// A token getter for clients that take one (channels/spaces/client.js).
+function provider(applicationName, opts) {
+  return () => tokenFor(applicationName, opts);
+}
+
+// Drop a held pass (an app answered 401 to it).
+function invalidate(applicationName) {
+  passes.delete(applicationName);
+}
+
+function reset() {
+  passes.clear();
+  inflight.clear();
+  told.clear();
+}
+
+module.exports = {
+  tokenFor,
+  provider,
+  invalidate,
+  reset,
+  setOwnerNotifier,
+  ownerHelp,
+  appLabel,
+  PassRefused,
+  RENEW_BEFORE_MS,
+};

package/core/bot-profile.js

@@ -0,0 +1,228 @@
+// What kind of bot this is, from Central (plan v2 "personal bots act for their
+// owner", 25 Oct).
+//
+// On start, and every 15 minutes, the bot asks Central with its own key
+// (GET /api/bots/me): personal or autonomous, its one owner, and the owner's
+// consent (the apps she ticked, the end date, renewDue a week before it ends).
+// The answer is kept on disk so a restart while Central is down still knows.
+//
+// A personal bot:
+//   • has exactly one owner, the person in Central. applyOwner() puts her id in
+//     KAZEE_OWNER_USER_ID, and access.js counts no other owner (no second-owner
+//     records). Admins look after the bot through Agent Space and Central.
+//   • never hands its own key to an app: core/app-pass.js trades it for a pass.
+//   • gets its own instructions (instructionsBlock).
+// An autonomous bot, or a bot whose Central has no bot:me yet, is unchanged.
+
+const fs = require("fs");
+const path = require("path");
+const https = require("https");
+const http = require("http");
+const { URL } = require("url");
+
+const FILE_NAME = "bot-profile.json";
+const REFRESH_MS = 15 * 60 * 1000;
+
+let profile;
+let timer = null;
+
+function configModule() { return require("./config"); }
+
+function profileFile(dir) {
+  return path.join(dir || configModule().CONFIG_DIR, FILE_NAME);
+}
+
+function readProfile(dir) {
+  try {
+    const raw = JSON.parse(fs.readFileSync(profileFile(dir), "utf-8"));
+    return raw && raw.bot ? raw : null;
+  } catch (_) {
+    return null;
+  }
+}
+
+function get() {
+  if (profile === undefined) profile = readProfile();
+  return profile;
+}
+
+function isPersonal() { return get()?.bot?.botKind === "personal"; }
+function ownerUserId() { return isPersonal() ? String(get()?.owner?.id || "") : ""; }
+function ownerName() { return isPersonal() ? String(get()?.owner?.name || "") : ""; }
+function ownerFirstName() { return ownerName().split(" ")[0] || "your owner"; }
+function consent() { return isPersonal() ? get()?.consent || null : null; }
+function consentApplications() {
+  const c = consent();
+  return c && c.live !== false ? (c.applications || []).map((a) => a.name).filter(Boolean) : [];
+}
+function renewDue() { return !!consent()?.renewDue; }
+
+// The apps whose back ends take a pass, so the owner can tick them (Central's
+// OWNER_PASS_APPLICATIONS). Central's list when bot:me sends one, else its
+// default; Chat is left out, the bot talks there as itself.
+const DEFAULT_PASS_APPLICATIONS = ["Ticket_Central", "kazee-crm", "agent-space-backend", "kazee-infrastructure", "kazee-spaces-backend"];
+function passApplications() {
+  if (!isPersonal()) return [];
+  const p = get();
+  const list = Array.isArray(p?.passApplications) && p.passApplications.length ? p.passApplications : DEFAULT_PASS_APPLICATIONS;
+  const chat = p?.chatApplications || [];
+  return list.filter((a) => a && !chat.includes(a));
+}
+
+// Read straight from disk with no config: config.js calls this while it loads,
+// so the owner is right before any adapter is built.
+function cachedPersonalOwnerId(dir) {
+  const p = readProfile(dir);
+  return p?.bot?.botKind === "personal" && p.owner?.id ? String(p.owner.id) : "";
+}
+
+// A personal bot's one owner replaces the configured Kazee owner.
+function applyOwner(config) {
+  const owner = ownerUserId();
+  if (owner && config) config.KAZEE_OWNER_USER_ID = owner;
+  return owner;
+}
+
+function centralUrl() {
+  const { config } = configModule();
+  return String(config.CENTRAL_URL || "https://central.inet.africa").replace(/\/$/, "");
+}
+
+function botToken() {
+  const { config } = configModule();
+  return config.KAZEE_BOT_TOKEN || process.env.KAZEE_BOT_TOKEN || "";
+}
+
+// One JSON request to Central. Resolves { status, body } for any HTTP answer;
+// rejects only when Central can't be reached.
+function centralRequest(method, urlPath, token, body, timeoutMs = 15000) {
+  return new Promise((resolve, reject) => {
+    const u = new URL(centralUrl() + urlPath);
+    const lib = u.protocol === "https:" ? https : http;
+    const data = body != null ? Buffer.from(JSON.stringify(body)) : null;
+    const headers = { Authorization: `Bearer ${token}`, Accept: "application/json" };
+    if (data) {
+      headers["Content-Type"] = "application/json";
+      headers["Content-Length"] = data.length;
+    }
+    const req = lib.request(
+      { method, hostname: u.hostname, port: u.port || (u.protocol === "https:" ? 443 : 80), path: u.pathname + (u.search || ""), headers },
+      (res) => {
+        let chunks = "";
+        res.on("data", (c) => { chunks += c; });
+        res.on("end", () => {
+          let parsed = {};
+          try { parsed = chunks ? JSON.parse(chunks) : {}; } catch (_) {}
+          resolve({ status: res.statusCode, body: parsed });
+        });
+      },
+    );
+    req.on("error", reject);
+    req.setTimeout(timeoutMs, () => req.destroy(new Error(`${method} ${urlPath} timeout`)));
+    if (data) req.write(data);
+    req.end();
+  });
+}
+
+// Ask Central what this bot is. An old Central (404) or a refusal leaves a
+// bot that was never told as it was; Central down keeps the last answer.
+async function refresh({ request = centralRequest } = {}) {
+  const token = botToken();
+  if (!token) return get();
+  let res;
+  try {
+    res = await request("GET", "/api/bots/me", token);
+  } catch (e) {
+    console.error("bot-profile: Central unreachable, keeping the last answer:", e.message);
+    return get();
+  }
+  if (res && res.status === 200 && res.body && res.body.bot) {
+    profile = {
+      bot: res.body.bot,
+      owner: res.body.owner || null,
+      consent: res.body.consent || null,
+      chatApplications: res.body.chatApplications || [],
+      ...(Array.isArray(res.body.passApplications) ? { passApplications: res.body.passApplications } : {}),
+      checkedAt: new Date().toISOString(),
+    };
+    try {
+      const { atomicWriteFileSync } = require("./fsutil");
+      atomicWriteFileSync(profileFile(), JSON.stringify(profile, null, 2));
+    } catch (e) {
+      console.error("bot-profile: write failed:", e.message);
+    }
+    return profile;
+  }
+  if (res && res.status === 404) {
+    // Central without bot:me: nothing to learn yet.
+    if (profile === undefined) profile = readProfile();
+    return profile;
+  }
+  console.error(`bot-profile: bot:me answered ${res && res.status}`);
+  return get();
+}
+
+function startRefreshing(onChange) {
+  if (timer) return;
+  timer = setInterval(async () => {
+    const before = ownerUserId();
+    await refresh();
+    if (onChange && ownerUserId() !== before) {
+      try { onChange(); } catch (_) {}
+    }
+  }, REFRESH_MS);
+  if (timer.unref) timer.unref();
+}
+
+function stopRefreshing() {
+  if (timer) { clearInterval(timer); timer = null; }
+}
+
+const MY_ASSISTANTS = "Central → My profile → My assistants";
+
+// The personal bot's own instructions. Autonomous bots keep theirs ("").
+function instructionsBlock() {
+  if (!isPersonal()) return "";
+  const name = ownerName() || "your owner";
+  const first = ownerFirstName();
+  const apps = consentApplications();
+  return [
+    "## You are a personal assistant",
+    `You work for ${name}. In Kazee Chat you talk as yourself. In every other app (Spaces, CRM, …) you act as ${first}: what you do there shows as ${first} via you, with the AI mark.`,
+    `- Approvals, money and deletes need her tap: don't do them, send ${first} a card in chat with a link to do it herself.`,
+    `- If her consent has ended, or doesn't tick the app, she switches it on in ${MY_ASSISTANTS}: send her the one-tap card for it (below).`,
+    apps.length ? `- Apps she has ticked: ${apps.join(", ")}.` : `- She has not switched it on for any app yet.`,
+    `- ${first} is your only owner. Nobody else gives you orders or approves your actions.`,
+  ].join("\n");
+}
+
+function renewMessage() {
+  const ends = consent()?.endsAt ? new Date(consent().endsAt).toDateString() : "soon";
+  return `${ownerFirstName()}, my permission to act for you ends on ${ends}. Renew it with one tap in ${MY_ASSISTANTS}.`;
+}
+
+// Tests only.
+function _set(p) { profile = p; }
+
+module.exports = {
+  refresh,
+  startRefreshing,
+  stopRefreshing,
+  get,
+  isPersonal,
+  ownerUserId,
+  ownerName,
+  ownerFirstName,
+  consent,
+  consentApplications,
+  renewDue,
+  renewMessage,
+  passApplications,
+  cachedPersonalOwnerId,
+  applyOwner,
+  instructionsBlock,
+  centralRequest,
+  botToken,
+  MY_ASSISTANTS,
+  _set,
+};

package/core/config.js

@@ -53,6 +53,13 @@ function settingValue(key) {
   return fromFile === undefined || fromFile === "" ? undefined : fromFile;
 }
 
+// A personal bot has one owner: the person Central names (core/bot-profile.js,
+// kept on disk from the last bot:me). Applied here, before any adapter is built.
+try {
+  const centralOwner = require("./bot-profile").cachedPersonalOwnerId(CONFIG_DIR);
+  if (centralOwner) config.KAZEE_OWNER_USER_ID = centralOwner;
+} catch (_) { /* no profile yet */ }
+
 function hasPathSeparator(value) {
   return value.includes("/") || value.includes("\\");
 }