refactor(auth): drop first-DM claim — shared-identity channels already carry operator identity

The first-DM heuristic (f43ffa4) was solving a problem the platform had
already solved: a channel bound with sharedIdentity resolves every
message's UserID to the binding web user (routing.processInbound), so
the operator's own IM channel passes isAdminChatter's owner-equality
check with zero configuration. The toggle in the agent config page IS
the 'this channel is personally mine' declaration; public-facing
channels leave it off and their minted app_user chatters stay guests.

Also closes the group hole that surfaced while verifying this: on a
shared-identity channel EVERY group speaker gets rewritten to the owner
id before group routing, and the platform-side sender id is gone by the
time the agent sees the message — so groups on shared-identity channels
can never vouch for a speaker and are denied admin outright.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: idoubi

internal/agent/admin_chatter_test.go

@@ -0,0 +1,52 @@
+package agent
+
+import (
+	"testing"
+
+	"github.com/fastclaw-ai/fastclaw/internal/bus"
+)
+
+// Shared-identity channels resolve the chatter to the channel owner's
+// web user id, so an owner-bound personal channel is admin in DMs with
+// zero extra configuration. Groups on such channels must NOT inherit
+// that: routing rewrites every group speaker to the owner id, so owner
+// equality proves nothing there.
+func TestAdminChatterSharedIdentity(t *testing.T) {
+	a := &Agent{ownerUserID: "u_owner"}
+
+	dm := bus.InboundMessage{
+		Channel:        "telegram",
+		UserID:         "u_owner",
+		PeerKind:       "dm",
+		SharedIdentity: true,
+	}
+	if !a.isAdminChatter(dm) {
+		t.Fatal("shared-identity DM resolved to owner should be admin")
+	}
+
+	group := dm
+	group.PeerKind = "group"
+	if a.isAdminChatter(group) {
+		t.Fatal("group speaker on shared-identity channel must not be admin")
+	}
+}
+
+// Regular (non-shared) IM chatters are minted as app_users — never equal
+// to the owner id — so they stay guests unless the admins allowlist
+// names their platform id.
+func TestAdminChatterRegularIMChannel(t *testing.T) {
+	a := &Agent{
+		ownerUserID: "u_owner",
+		admins:      map[string][]string{"telegram": {"u_app_listed"}},
+	}
+
+	stranger := bus.InboundMessage{Channel: "telegram", UserID: "u_app_stranger", PeerKind: "dm"}
+	if a.isAdminChatter(stranger) {
+		t.Fatal("minted app_user chatter must not be admin")
+	}
+
+	listed := bus.InboundMessage{Channel: "telegram", UserID: "u_app_listed", PeerKind: "dm"}
+	if !a.isAdminChatter(listed) {
+		t.Fatal("allowlisted chatter should be admin")
+	}
+}

internal/agent/claim_admin_test.go

@@ -240,98 +240,6 @@ func (a *Agent) bindSession(ctx context.Context, channel, accountID, sessionID,
 	a.registry.SetExecutor(ex)
 }
 
-// maybeClaimChannelAdmin implements first-DM-wins operator claiming on
-// self-hosted installs: the first human to DM the agent on an IM channel
-// that has no admins allowlist AND no prior chat history on that channel
-// becomes the channel's admin. Rationale: the operator who just bound
-// their own bot token is invariably the first to message it — making
-// them hand-edit an admins list for their own agent is friction with no
-// security payoff. The claim never fires when:
-//   - the deploy is hosted (strangers everywhere),
-//   - the turn is runtime-originated (cron / heartbeat / subagent),
-//   - the message came from a group (the first speaker could be anyone),
-//   - an admins list for the channel already exists (explicit config wins),
-//   - the channel already has other chat history (an agent that has been
-//     serving the public must not hand admin to whoever messages next
-//     after an upgrade).
-//
-// Persisted through the same layer AgentFileConfigLoader reads (the
-// agents.config row via dataStore, agent.json in file mode) so the claim
-// survives restarts.
-func (a *Agent) maybeClaimChannelAdmin(ctx context.Context, msg bus.InboundMessage) {
-	if buildinfo.IsHostedDeploy() || msg.Source != bus.SourceUser {
-		return
-	}
-	switch msg.Channel {
-	case "", "web", "api":
-		return
-	}
-	if msg.PeerKind != "dm" || msg.UserID == "" {
-		return
-	}
-	if len(a.admins[msg.Channel]) > 0 {
-		return
-	}
-	if a.channelHasHistory(ctx, msg.Channel, msg.ChatID) {
-		return
-	}
-	if a.admins == nil {
-		a.admins = map[string][]string{}
-	}
-	a.admins[msg.Channel] = []string{msg.UserID}
-	if err := a.persistAdmins(ctx); err != nil {
-		slog.Warn("channel-admin claim not persisted (active for this process only)",
-			"agent", a.name, "channel", msg.Channel, "error", err)
-	}
-	slog.Info("channel admin claimed by first DM chatter",
-		"agent", a.name, "channel", msg.Channel, "userID", msg.UserID, "sender", msg.SenderName)
-}
-
-// channelHasHistory reports whether any OTHER chat session exists for
-// (agent, channel). Errors count as history — when in doubt, don't grant
-// admin. Bounded page walk; sessions are updated_at-ordered so an active
-// channel surfaces in the first page.
-func (a *Agent) channelHasHistory(ctx context.Context, channel, currentChatID string) bool {
-	if a.dataStore == nil {
-		// File-mode single-user install: no cross-chatter history to protect.
-		return false
-	}
-	const pageSize = 200
-	for page := range 20 {
-		metas, total, err := a.dataStore.ListSessionsPaginated(ctx, []string{a.name}, page*pageSize, pageSize)
-		if err != nil {
-			return true
-		}
-		for _, m := range metas {
-			if m.Channel == channel && m.ChatID != currentChatID {
-				return true
-			}
-		}
-		if (page+1)*pageSize >= total || len(metas) == 0 {
-			return false
-		}
-	}
-	// Thousands of sessions and still unsure — stay conservative.
-	return true
-}
-
-// persistAdmins writes the in-memory admins allowlist to the layer
-// AgentFileConfigLoader reads it back from on the next boot.
-func (a *Agent) persistAdmins(ctx context.Context) error {
-	if a.dataStore != nil {
-		rec, err := a.dataStore.GetAgent(ctx, a.name)
-		if err == nil && rec != nil {
-			if rec.Config == nil {
-				rec.Config = map[string]interface{}{}
-			}
-			rec.Config["admins"] = a.admins
-			return a.dataStore.SaveAgent(ctx, rec)
-		}
-		// Lookup miss (agent not in store) → fall through to file.
-	}
-	return config.MergeAgentFileAdmins(a.homePath, a.admins)
-}
-
 // NewAgent creates a new Agent from a resolved config.
 func NewAgent(rc config.ResolvedAgent, prov provider.Provider, mb *bus.MessageBus, homeDir string) *Agent {
 	return NewAgentWithSkillsCfg(rc, prov, mb, homeDir, config.SkillsCfg{})
@@ -2048,7 +1956,6 @@ func (a *Agent) HandleMessage(ctx context.Context, msg bus.InboundMessage) strin
 	// admin. File tools use this to refuse identity-file reads from
 	// regular chatters (SOUL/IDENTITY/BOOTSTRAP/... leak as verbatim
 	// chat replies otherwise).
-	a.maybeClaimChannelAdmin(ctx, msg)
 	a.registry.SetCallerIsAdmin(a.isTrustedTurn(msg))
 	// Plumb the persistent session_key for goal-scoped tools.
 	// SetSessionID above uses msg.ChatID (the channel-level chat
@@ -2810,7 +2717,6 @@ func (a *Agent) HandleMessageStream(ctx context.Context, msg bus.InboundMessage)
 		sess.SetProviderModel(prov, mdl)
 	}
 	a.bindSession(ctx, msg.Channel, msg.AccountID, msg.ChatID, msg.ProjectID)
-	a.maybeClaimChannelAdmin(ctx, msg)
 	a.registry.SetCallerIsAdmin(a.isTrustedTurn(msg))
 	a.registry.SetGoalSessionKey(sess.SessionKey())
 	// Per-user file writes (USER.md / MEMORY.md) need to land in the

internal/agent/loop.go

@@ -190,6 +190,17 @@ func (a *Agent) isAdminChatter(msg bus.InboundMessage) bool {
 	if msg.Channel == "web" || msg.Channel == "api" {
 		return msg.UserID != "" && msg.UserID == a.ownerUserID
 	}
+	// Shared-identity channels rewrite EVERY speaker's UserID to the
+	// channel owner's id (routing.processInbound), which makes the
+	// owner-equality check below meaningless in groups: any group member
+	// would pass as the owner. The platform-side sender id is gone by
+	// this point, so there's nothing to match against an allowlist
+	// either — deny. DMs on a shared-identity channel are fine: the
+	// owner marked the channel as personally theirs, and a DM sender on
+	// their own bot is them by construction.
+	if msg.SharedIdentity && msg.PeerKind == "group" {
+		return false
+	}
 	list, ok := a.admins[msg.Channel]
 	if !ok || len(list) == 0 {
 		// No allowlist configured for this channel. Fall back to

internal/agent/slash.go

@@ -11,7 +11,6 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
-	"fmt"
 	"os"
 	"path/filepath"
 	"strings"
@@ -536,36 +535,6 @@ func defaultAgentFileConfigLoader(_, home string) (AgentFileConfig, bool) {
 	return cfg, true
 }
 
-// MergeAgentFileAdmins writes the admins allowlist into <home>/agent.json,
-// preserving every other field already in the file (raw-map merge, not a
-// struct round-trip, so keys this build doesn't know about survive).
-// Fallback persistence for the first-DM admin claim when no store-backed
-// agents.config row is available; the store path lives on the Agent.
-func MergeAgentFileAdmins(home string, admins map[string][]string) error {
-	if home == "" {
-		return fmt.Errorf("agent home not set")
-	}
-	path := filepath.Join(home, "agent.json")
-	raw := map[string]json.RawMessage{}
-	if data, err := os.ReadFile(path); err == nil {
-		// Corrupt existing JSON → start fresh rather than fail the claim.
-		_ = json.Unmarshal(data, &raw)
-	}
-	blob, err := json.Marshal(admins)
-	if err != nil {
-		return err
-	}
-	raw["admins"] = blob
-	out, err := json.MarshalIndent(raw, "", "  ")
-	if err != nil {
-		return err
-	}
-	if err := os.MkdirAll(home, 0o755); err != nil {
-		return err
-	}
-	return os.WriteFile(path, out, 0o600)
-}
-
 // AgentFileConfig is the schema for an agent's per-row override JSON
 // (agents.config column). Per-agent providers/channels live in their own
 // scoped DB tables and are NOT persisted here.