@agfpd/voicetalk-runtime 0.3.1 → 0.4.0

package/scripts/verify-install.ts

@@ -0,0 +1,202 @@
+// Standalone real macOS install proof shipped IN the package. No dependencies,
+// daemon, keychain identities, lifecycle commands, microphone, speaker, voice
+// service or repository checkout required.
+// Usage after unpacking:
+//   bun package/scripts/verify-install.ts [package-dir] [previous-package-dir] [recovery-backup-dir]
+import { strict as assert } from 'assert'
+import { execFileSync, spawn, spawnSync, type ChildProcess } from 'child_process'
+import { createHash, randomUUID } from 'crypto'
+import { chmodSync, copyFileSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'fs'
+import { join, resolve } from 'path'
+import { proveInstallPair } from './verify-install-pair.ts'
+
+assert.equal(process.platform, 'darwin', 'real codesign proof requires macOS')
+const pkg = resolve(process.argv[2] ?? join(import.meta.dir, '..'))
+const { selfInstall } = await import(join(pkg, 'src/selfInstall.ts')) as typeof import('../src/selfInstall.ts')
+const version = JSON.parse(readFileSync(join(pkg, 'package.json'), 'utf8')).version as string
+// SHORT root on purpose: the router's inbound unix socket lives under IAPEER_ROOT and
+// macOS sun_path is ~104 bytes; $TMPDIR (/var/folders/…) would overflow it.
+const tmp = mkdtempSync('/tmp/vtp-')
+const fakeIap = join(tmp, 'fake-iapeer')
+// Do not inherit host credentials, daemon discovery, identity, audio or voice knobs.
+const env: NodeJS.ProcessEnv = {
+  PATH: process.env.PATH ?? '/usr/bin:/bin',
+  HOME: join(tmp, 'home'), TMPDIR: tmp,
+  IAPEER_TEST_SANDBOX: '1', IAPEER_ROOT: join(tmp, 'root'), IAPEER_BIN_DIR: join(tmp, 'bin'),
+  IAP_BIN: fakeIap, VOICETALK_AUDIO: '0', VOICETALK_PLAYBACK: '0',
+  VOICETALK_VOICE_ENDPOINT: 'http://127.0.0.1:1',
+}
+mkdirSync(env.HOME!, { recursive: true })
+const bin = join(env.IAPEER_BIN_DIR!, 'voicetalk-runtime')
+const manifest = join(env.IAPEER_ROOT!, 'runtimes/voicetalk/runtime.json')
+const hash = (path: string) => createHash('sha256').update(readFileSync(path)).digest('hex')
+const verify = () => execFileSync('/usr/bin/codesign', ['--verify', '--deep', '--strict', bin], { env })
+const runningVersion = () => execFileSync(bin, ['--version'], { env, encoding: 'utf8' }).trim()
+const sleep = (ms: number) => new Promise(resolve => setTimeout(resolve, ms))
+let router: ChildProcess | undefined
+let routerExit: Promise<void> | undefined
+
+// Stand-in for the iapeer daemon: records argv + message body, never contacts a fleet.
+const argvFile = join(tmp, 'daemon-argv.txt')
+const bodyFile = join(tmp, 'daemon-body.txt')
+writeFileSync(fakeIap,
+  `#!/bin/sh\nprintf '%s\\n' "$*" > ${JSON.stringify(argvFile)}\n` +
+  `while [ "$#" -gt 0 ]; do\n  if [ "$1" = "--message-file" ]; then shift; cat "$1" > ${JSON.stringify(bodyFile)}; fi\n  shift || true\ndone\n` +
+  `printf '%s\\n' 'delivered to proof-target (claude)'\nexit 0\n`)
+chmodSync(fakeIap, 0o755)
+
+async function stopRouter(): Promise<void> {
+  if (!router || router.exitCode !== null || router.signalCode !== null) return
+  router.kill('SIGTERM') // ONLY the proof's own child, never a host runtime
+  await Promise.race([routerExit, sleep(3000)])
+  if (router.exitCode === null && router.signalCode === null) {
+    router.kill('SIGKILL')
+    await routerExit
+  }
+}
+
+async function waitFor(predicate: () => boolean, ms = 8000): Promise<boolean> {
+  const deadline = Date.now() + ms
+  while (Date.now() < deadline) {
+    if (predicate()) return true
+    await sleep(50)
+  }
+  return predicate()
+}
+
+/** The installed binary RUNS as a router: headless `run` (audio off) in a bound
+ *  natural peer, an outbound envelope reaches the audio sink, an inbound `say`
+ *  reaches the (fake) daemon framed for the spoken modality. */
+async function proveRunningRouter(executable = bin, expectedVersion = version, runEnv = env): Promise<void> {
+  assert.equal(execFileSync(executable, ['--version'], { env: runEnv, encoding: 'utf8' }).trim(), expectedVersion)
+  const peer = join(tmp, 'proof-owner')
+  mkdirSync(join(peer, '.iapeer'), { recursive: true })
+  writeFileSync(join(peer, '.iapeer/peer-profile.json'), JSON.stringify({
+    personality: 'proof-owner', default_runtime: 'voicetalk', runtimes: ['voicetalk'], intelligence: 'natural',
+    interfaces: { voicetalk: { wake_words: { 'проба': 'proof-target' }, default_target: 'proof-target' } },
+  }))
+  const doctor = spawnSync(executable, ['doctor', '--json'], { cwd: peer, env: runEnv, encoding: 'utf8' })
+  assert.equal(doctor.status, 0, `doctor: ${doctor.stdout}${doctor.stderr}`)
+  assert.equal(JSON.parse(doctor.stdout).ok, true)
+  rmSync(argvFile, { force: true }); rmSync(bodyFile, { force: true })
+  const root = runEnv.IAPEER_ROOT!
+  const sock = join(root, 'runtimes/voicetalk/inbox/proof-owner.sock')
+  assert.ok(Buffer.byteLength(sock) < 104, `socket path too long for sun_path: ${sock}`)
+  router = spawn(executable, ['run'], { cwd: peer, env: runEnv, stdio: ['pipe', 'pipe', 'pipe'] })
+  routerExit = new Promise<void>(resolve => router!.once('close', () => resolve()))
+  let stderr = ''
+  let spawnError: Error | undefined
+  router.once('error', error => { spawnError = error })
+  router.stdout!.resume()
+  router.stderr!.on('data', chunk => { stderr += String(chunk) })
+  try {
+    const up = await waitFor(() => { assert.ifError(spawnError); return existsSync(sock) })
+    assert.ok(up, `router never opened its inbound socket: ${stderr}`)
+    const outbound = `исходящее ${randomUUID()}`
+    router.stdin!.write('<iap from-personality="proof-target" from-runtime="claude" from-intelligence="artificial">' +
+      `<message><![CDATA[${outbound}]]></message></iap>`)
+    const spokenLog = join(root, 'runtimes/voicetalk/spoken.log')
+    assert.ok(await waitFor(() => existsSync(spokenLog) && readFileSync(spokenLog, 'utf8').includes(outbound)),
+      `outbound envelope did not reach the audio sink: ${stderr}`)
+    const inbound = `входящее ${randomUUID()}`
+    const say = spawnSync(executable, ['say', '--peer', 'proof-target', inbound], { cwd: peer, env: runEnv, encoding: 'utf8' })
+    assert.equal(say.status, 0, `say: ${say.stdout}${say.stderr}\nrouter: ${stderr}`)
+    assert.equal(JSON.parse(say.stdout.trim()).ok, true)
+    assert.match(readFileSync(argvFile, 'utf8').trim(), /^send proof-target --message-file /)
+    const body = readFileSync(bodyFile, 'utf8')
+    assert.ok(body.includes('via voicetalk') && body.includes(inbound), body)
+    assert.equal(router.exitCode, null, stderr)
+    console.log(`PASS installed router run: version ${expectedVersion}, doctor ok, outbound→sink, inbound say→daemon (fake), audio off`)
+  } finally {
+    await stopRouter()
+  }
+}
+
+try {
+  // Exercise the actual shipped CLI + default compile/signature runner.
+  const compiled = execFileSync(process.execPath, [join(pkg, 'src/cli.ts'), 'self-install'], { env, encoding: 'utf8', timeout: 120_000 })
+  assert.match(compiled, /\(compiled\)/)
+  verify()
+  assert.equal(runningVersion(), version)
+  assert.equal(JSON.parse(readFileSync(manifest, 'utf8')).version, version)
+  console.log(`PASS package CLI compile: strict signature + executable version ${version}`)
+  await proveRunningRouter()
+
+  const validHash = hash(bin)
+  const copied = execFileSync(bin, ['self-install'], { env, encoding: 'utf8', timeout: 120_000 })
+  assert.match(copied, /\(copied-self\)/)
+  verify()
+  assert.equal(hash(bin), validHash, 'valid copy-self must retain the exact signature/bytes')
+  console.log('PASS package CLI copy-self: strict signature, bytes/signature unchanged')
+
+  // Feed an unsigned native input through the shipped copy-self implementation.
+  const unsigned = join(tmp, 'unsigned-voicetalk-runtime')
+  copyFileSync(bin, unsigned)
+  execFileSync('/usr/bin/codesign', ['--remove-signature', unsigned], { env })
+  const repaired = selfInstall({ env, sourceEntry: join(tmp, 'missing.ts'), execPath: unsigned })
+  assert.equal(repaired.binMode, 'copied-self')
+  assert.equal(repaired.signature, 'repaired')
+  verify()
+  assert.equal(runningVersion(), version)
+  console.log('PASS unsigned native copy: ad-hoc repaired, strict verify + executable')
+
+  await proveInstallPair({ pkg, tmp, env, candidateBin: bin, selfInstall, run: proveRunningRouter,
+    previousPkg: process.argv[3] ? resolve(process.argv[3]) : undefined,
+    recoveryBackup: process.argv[4] ? resolve(process.argv[4]) : undefined,
+  })
+
+  // Impossible-to-sign input: real codesign failure must preserve BOTH old surfaces.
+  const bad = join(tmp, 'truncated-mach-o')
+  writeFileSync(bad, readFileSync(bin).subarray(0, 1024))
+  const invalid = spawnSync('/usr/bin/codesign', ['--verify', '--deep', '--strict', bad], { env, encoding: 'utf8' })
+  assert.ifError(invalid.error)
+  assert.notEqual(invalid.status, 0, 'negative fixture must really be strict-invalid')
+  console.log(`REAL truncated Mach-O strict verify: status=${invalid.status}, SHA256=${hash(bad)}`)
+  const before = [hash(bin), hash(manifest)]
+  assert.throws(() => selfInstall({ env, sourceEntry: join(tmp, 'missing.ts'), execPath: bad,
+    runner: (cmd, args, passedEnv) => {
+      const result = spawnSync(cmd, args, { encoding: 'utf8', env: passedEnv, timeout: 120_000 })
+      console.log(`REAL truncated ${args[0]}: status=${result.status}, stderr=${result.stderr?.trim() ?? ''}`)
+      return result
+    },
+  }), /codesign .* failed/)
+  assert.deepEqual([hash(bin), hash(manifest)], before)
+  assert.deepEqual(readdirSync(env.IAPEER_BIN_DIR!), ['voicetalk-runtime'], 'no stage/.dead artifact left')
+  verify()
+  assert.equal(runningVersion(), version)
+  console.log(`PASS un-signable copy rejected: old bin+manifest SHA256 unchanged ${before.join(' ')}, stage removed`)
+  await proveRunningRouter() // previous router still RUNS after the rejection
+
+  // The incident's minimal fresh-compile input: accept ONLY if strict-valid and
+  // executable, otherwise prove the real failing compiler/signing path is closed.
+  const minimal = join(tmp, 'minimal.ts')
+  const marker = 'minimal fresh compile signature proof'
+  writeFileSync(minimal, `console.log(${JSON.stringify(marker)})\n`)
+  const previous = [hash(bin), hash(manifest)]
+  let failure: unknown
+  try {
+    selfInstall({ env, sourceEntry: minimal, execPath: process.execPath, runner: (cmd, args, passedEnv) => {
+      const r = spawnSync(cmd, args, { encoding: 'utf8', env: passedEnv, timeout: 120_000 })
+      console.log(`REAL minimal ${args[0]}: status=${r.status}, error=${r.error?.message ?? '-'}, stderr=${r.stderr?.trim() ?? ''}`)
+      return r
+    } })
+  } catch (e) {
+    failure = e
+  }
+  if (failure) {
+    assert.match(String(failure), /codesign .* failed/)
+    assert.deepEqual([hash(bin), hash(manifest)], previous)
+    verify()
+    assert.equal(runningVersion(), version)
+    console.log('PASS strict-invalid minimal compile rejected: old bin+manifest SHA256 unchanged')
+  } else {
+    verify()
+    assert.equal(execFileSync(bin, [], { env, encoding: 'utf8' }).trim(), marker)
+    console.log('PASS minimal compile accepted ONLY after strict verify + execution')
+  }
+  assert.deepEqual(readdirSync(env.IAPEER_BIN_DIR!), ['voicetalk-runtime'])
+  console.log(`PASS artifact ${version}: no core/helper/voice-service dependency; all writes sandboxed`)
+} finally {
+  await stopRouter()
+  rmSync(tmp, { recursive: true, force: true })
+}

package/src/audio.ts

@@ -320,6 +320,9 @@ export class Microphone {
   private stopped = false
   private attempt = 0
   private timer: ReturnType<typeof setTimeout> | null = null
+  /** Replay position, kept across pause/resume (test seam only). */
+  private replayOffset = 0
+  private pausedAt = 0
 
   constructor(private readonly opts: MicOptions) {}
 
@@ -342,6 +345,37 @@ export class Microphone {
     return this.child !== null
   }
 
+  /** Release the input device and resolve only once the capture child has actually
+   *  EXITED — a killed-but-not-yet-reaped ffmpeg still holds the CoreAudio client. This is
+   *  the hand-off to a second listener (native voice): the other side may open the same
+   *  physical microphone only after this resolves, or both would hear the room. */
+  async pause(capMs = 3_000): Promise<{ released: boolean }> {
+    const child = this.child
+    this.stop()
+    if (this.opts.filePath) this.pausedAt = Date.now()
+    if (!child || child.exitCode !== null || child.signalCode !== null) return { released: true }
+    return await new Promise(resolve => {
+      const timer = setTimeout(() => resolve({ released: false }), capMs)
+      child.once('close', () => {
+        clearTimeout(timer)
+        resolve({ released: true })
+      })
+    })
+  }
+
+  /** Take the device back after a pause. A replayed recording does not rewind: the audio
+   *  that "played" while the device was handed off belongs to the other listener, so the
+   *  replay skips ahead by the paused wall-clock time — exactly what a real microphone
+   *  would have missed. */
+  resume(): void {
+    if (this.opts.filePath && this.pausedAt) {
+      const frames = Math.floor((Date.now() - this.pausedAt) / FRAME_MS)
+      this.replayOffset += frames * FRAME_BYTES
+      this.pausedAt = 0
+    }
+    this.start()
+  }
+
   private spawnChild(): void {
     if (this.stopped) return
     this.attempt += 1
@@ -397,9 +431,9 @@ export class Microphone {
       return
     }
     this.opts.onStart?.(this.attempt)
-    let offset = 0
     const tick = () => {
       if (this.stopped) return
+      const offset = this.replayOffset
       if (offset >= pcm.length) {
         // Keep the stream alive with silence so compose/window timers still fire.
         this.opts.onData(Buffer.alloc(FRAME_BYTES))
@@ -407,7 +441,7 @@ export class Microphone {
         return
       }
       this.opts.onData(Buffer.from(pcm.subarray(offset, offset + FRAME_BYTES)))
-      offset += FRAME_BYTES
+      this.replayOffset = offset + FRAME_BYTES
       this.timer = setTimeout(tick, FRAME_MS)
     }
     tick()

package/src/cli.ts

@@ -45,6 +45,7 @@ import { selfInstall } from './selfInstall.ts'
 import { parseWakeWords, runSelfConfig } from './selfConfig.ts'
 import { writeJsonAtomic } from './fsAtomic.ts'
 import { VoiceSession } from './voiceSession.ts'
+import { cliNativeVoice, nativeVoiceTargets } from './nativeVoice.ts'
 import { voiceHealth } from './voiceConnect.ts'
 import { listInputDevices, resolveInputDevice } from './audio.ts'
 import { buildAddressBook, unresolvedWakeWords, wakeEntries, type VoicetalkBinding } from './wake.ts'
@@ -163,7 +164,7 @@ function usage(): string {
   ${BIN_NAME}                                   # self-install (npx contract): bin on PATH + manifest
   ${BIN_NAME} self-install                      # explicit self-install (idempotent)
   ${BIN_NAME} self-config                       # per-peer self-config hook (foundation-invoked)
-  ${BIN_NAME} interface --wake-words «дарвин=darwin,борис=boris» [--default-target <peer>] [--device <d>]
+  ${BIN_NAME} interface --wake-words «дарвин=darwin,борис=boris» [--default-target <peer>] [--device <d>] [--native-voice darwin]
                                                 # set this peer's voicetalk binding (wake map)
   ${BIN_NAME} run                               # router loop: live mic ↔ speaker (VOICETALK_AUDIO=0 → text only)
   ${BIN_NAME} say --peer <personality> <text…>  # inject an utterance without the mic (debug seam)
@@ -400,6 +401,7 @@ function setVoicetalkInterface(cwd: string, patch: VoicetalkInterface): Record<s
   if (patch.wake_words !== undefined) voicetalk.wake_words = patch.wake_words
   if (patch.default_target !== undefined) voicetalk.default_target = patch.default_target
   if (patch.device !== undefined) voicetalk.device = patch.device
+  if (patch.native_voice !== undefined) voicetalk.native_voice = patch.native_voice
   ;(interfaces as Record<string, unknown>).voicetalk = voicetalk
   const merged = { ...raw, interfaces }
   writeJsonAtomic(path, merged)
@@ -972,6 +974,11 @@ async function runCommand(extraArgs: string[]): Promise<void> {
       deliver: (target, text) => deliverUtterance(ctx, target, text),
       log: logEvt,
       tmpDir: join(globalVoicetalkRoot(), 'tmp'),
+      // Native voice is opt-in per target; with no target configured the door is not
+      // even built, so the STT path is untouched for everyone.
+      ...(nativeVoiceTargets(binding).size
+        ? { nativeVoice: cliNativeVoice({ bin: ctx.iapBin, env: iapEnv(owner), cwd: ctx.cwd }) }
+        : {}),
     })
     try {
       const started = await candidate.start()
@@ -1013,6 +1020,7 @@ async function runCommand(extraArgs: string[]): Promise<void> {
     owner: owner.personality,
     wake_words: wakeEntries(binding).map(([w]) => w),
     device: binding.device ?? null,
+    native_voice: [...nativeVoiceTargets(binding)],
     iapBin: ctx.iapBin,
     inbound_socket: inboundSocketPath(owner.personality),
     audio: session ? { live: true, ...audio } : { live: false, ...audio },
@@ -1115,9 +1123,17 @@ async function interfaceCommand(args: string[]): Promise<void> {
   const wakeWords = parseWakeWords(stringFlag(flags, 'wake-words'))
   const defaultTarget = stringFlag(flags, 'default-target')
   const device = stringFlag(flags, 'device')
-  if (wakeWord === undefined && wakeWords === undefined && defaultTarget === undefined && device === undefined) {
+  const nativeFlag = stringFlag(flags, 'native-voice')
+  const nativeVoice = nativeFlag === undefined ? undefined : nativeFlag.split(',').map(v => v.trim()).filter(Boolean)
+  if (
+    wakeWord === undefined &&
+    wakeWords === undefined &&
+    defaultTarget === undefined &&
+    device === undefined &&
+    nativeVoice === undefined
+  ) {
     throw new VoicetalkRuntimeError(
-      'interface requires --wake-words <«слово=пир,…»>, --default-target <peer>, --wake-word <w> and/or --device <d>',
+      'interface requires --wake-words <«слово=пир,…»>, --default-target <peer>, --wake-word <w>, --device <d> and/or --native-voice <peers>',
     )
   }
   ensureCurrentProfile() // assert the profile exists before patching
@@ -1126,6 +1142,7 @@ async function interfaceCommand(args: string[]): Promise<void> {
     ...(wakeWords !== undefined ? { wake_words: wakeWords } : {}),
     ...(defaultTarget !== undefined ? { default_target: defaultTarget } : {}),
     ...(device !== undefined ? { device } : {}),
+    ...(nativeVoice !== undefined ? { native_voice: nativeVoice } : {}),
   })
   process.stdout.write(`${peerProfilePath(process.cwd())}\n`)
   printJson(merged)
@@ -1141,6 +1158,7 @@ async function selfInstallCommand(): Promise<void> {
   const r = selfInstall({ env: process.env, sourceEntry: import.meta.path })
   process.stdout.write(`${BIN_NAME} self-install (idempotent)\n`)
   process.stdout.write(`  bin:      ${r.binPath}  (${r.binMode})\n`)
+  process.stdout.write(`  signature: ${r.signature}\n`)
   process.stdout.write(`  manifest: ${r.manifestPath}\n`)
   process.stdout.write(`  root:     ${r.root}\n`)
   process.stdout.write(`  docs:     ${r.docs.copied ? r.docs.dest : `skipped (${r.docs.reason ?? 'unknown'})`}\n`)
@@ -1148,6 +1166,7 @@ async function selfInstallCommand(): Promise<void> {
     bin: r.binPath,
     manifest: r.manifestPath,
     binMode: r.binMode,
+    signature: r.signature,
     root: r.root,
     docs: r.docs,
   })

package/src/installPair.ts

@@ -0,0 +1,67 @@
+import { randomUUID } from 'crypto'
+import { linkSync, lstatSync, mkdirSync, readlinkSync, renameSync, rmSync, symlinkSync, writeFileSync } from 'fs'
+import { dirname } from 'path'
+import { runtimeManifestPath, type RuntimeManifest } from './manifest.ts'
+
+/** Publish an already signature-verified executable and its manifest.
+ * All preparation is fallible BEFORE publication. If the manifest rename fails,
+ * restore the old binary inode/signature (or symlink), or remove a first install.
+ * Two paths are NOT crash-atomic: no power-loss/SIGKILL or concurrent-writer claim.
+ * No lifecycle operations belong here; running processes keep their old inode. */
+export function publishInstallPair(
+  stagedBin: string,
+  binPath: string,
+  manifest: RuntimeManifest,
+  env: NodeJS.ProcessEnv,
+  // Narrow test seam; production always calls the real synchronous rename.
+  rename: typeof renameSync = renameSync,
+): string {
+  const manifestPath = runtimeManifestPath(env)
+  const suffix = `${process.pid}.${randomUUID()}`
+  const stagedManifest = `${manifestPath}.${suffix}.tmp`
+  const backupBin = `${binPath}.${suffix}.rollback`
+  let hadBin = false
+  let publishedBin = false
+  let retainBackup = false
+  // Cleanup cannot turn a completed new pair into a reported publication failure.
+  // If cleanup itself is denied, an unused uniquely named file can remain.
+  const cleanup = (path: string) => { try { rmSync(path, { force: true }) } catch {} }
+  try {
+    mkdirSync(dirname(manifestPath), { recursive: true, mode: 0o755 })
+    writeFileSync(stagedManifest, `${JSON.stringify(manifest, null, 2)}\n`, { mode: 0o644, flag: 'wx' })
+    let symlink = false
+    try {
+      const stat = lstatSync(binPath)
+      if (!stat.isFile() && !stat.isSymbolicLink()) throw new Error(`self-install: binary is not a file or symlink: ${binPath}`)
+      symlink = stat.isSymbolicLink()
+      hadBin = true
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error
+    }
+    if (hadBin) {
+      // macOS link(2) follows symlinks. Preserve link text explicitly, including
+      // dangling/relative links. Hard-link regular files: no copy or re-signing.
+      if (symlink) symlinkSync(readlinkSync(binPath), backupBin)
+      else linkSync(binPath, backupBin)
+    }
+    rename(stagedBin, binPath)
+    publishedBin = true
+    rename(stagedManifest, manifestPath)
+    return manifestPath // no fallible contract operation after the second rename
+  } catch (error) {
+    if (publishedBin) {
+      try {
+        if (hadBin) rename(backupBin, binPath)
+        else rmSync(binPath)
+      } catch (rollbackError) {
+        retainBackup = true
+        throw new AggregateError([error, rollbackError],
+          `self-install: pair publication AND rollback failed; ${hadBin ? `previous binary retained at ${backupBin}` : `could not remove first-install binary ${binPath}`}`)
+      }
+    }
+    throw error
+  } finally {
+    cleanup(stagedManifest)
+    if (!retainBackup) cleanup(backupBin)
+  }
+}

package/src/installSignature.ts

@@ -0,0 +1,58 @@
+// File-scoped macOS install gate. Verify the staged executable BEFORE publishing
+// it; preserve valid signatures (and their TCC identity). No keychain operations.
+import { spawnSync } from 'child_process'
+
+export interface InstallCommandResult {
+  status: number | null
+  stdout?: string
+  stderr?: string
+  error?: Error
+}
+
+/** Injectable for sandbox tests; commands use argv, never a shell or PATH codesign. */
+export type InstallCommandRunner = (
+  command: string,
+  args: string[],
+  env: NodeJS.ProcessEnv,
+) => InstallCommandResult
+
+export const runInstallCommand: InstallCommandRunner = (command, args, env) =>
+  spawnSync(command, args, { encoding: 'utf8', env, timeout: 120_000 })
+
+export interface ExecutableSignatureOptions {
+  env?: NodeJS.ProcessEnv
+  platform?: NodeJS.Platform
+  runner?: InstallCommandRunner
+}
+
+export type ExecutableSignatureState = 'verified' | 'repaired' | 'skipped-platform'
+
+function failed(stage: string, r: InstallCommandResult): Error {
+  const detail = (r.error?.message || r.stderr || r.stdout || `exit ${r.status}`).trim()
+  return new Error(`self-install: codesign ${stage} failed: ${detail}`)
+}
+
+/**
+ * Runtime-package contract: strict verify → repair only an invalid signature →
+ * strict verify again. Any command failure throws; callers must retain the old
+ * binary/manifest and remove the staging file. Sandbox is NOT a skip flag: tests
+ * inject a runner, while real sandbox installs verify their own staged binary.
+ */
+export function ensureExecutableSignature(
+  stagedPath: string,
+  opts: ExecutableSignatureOptions = {},
+): ExecutableSignatureState {
+  if ((opts.platform ?? process.platform) !== 'darwin') return 'skipped-platform'
+  const run = opts.runner ?? runInstallCommand
+  const env = opts.env ?? process.env
+  const verifyArgs = ['--verify', '--deep', '--strict', stagedPath]
+  const initial = run('/usr/bin/codesign', verifyArgs, env)
+  if (initial.error || initial.status === null) throw failed('initial verify', initial)
+  if (initial.status === 0) return 'verified'
+
+  const sign = run('/usr/bin/codesign', ['--force', '--sign', '-', stagedPath], env)
+  if (sign.error || sign.status !== 0) throw failed('ad-hoc repair', sign)
+  const verified = run('/usr/bin/codesign', verifyArgs, env)
+  if (verified.error || verified.status !== 0) throw failed('post-repair verify', verified)
+  return 'repaired'
+}

package/src/nativeVoice.ts

@@ -0,0 +1,119 @@
+// nativeVoice.ts — the door to a peer's NATIVE voice mode (Codex CLI `/voice`).
+//
+// For a configured target the spoken wake word does not start STT → envelope → TTS; it
+// hands the conversation to the peer's own realtime voice inside its live session. The
+// session belongs to iapeer (the pty supervisor), so voicetalk only REQUESTS and OBSERVES
+// over a small CLI contract agreed with the iapeer Implementer (topic codex-voice-wake):
+//
+//   iapeer voice open   <peer> --json → {"ok":true,"state":"open","session":"…","already":bool}
+//   iapeer voice status <peer> --json → {"state":"open|opening|closing|closed","session":…,"reason"?:…}
+//   iapeer voice close  <peer> --json → {"ok":true,"state":"closed"}
+//
+// open returns only once the realtime session is confirmed started, close once it is
+// confirmed closed; status is what the listener polls before it takes the microphone back.
+// Idle-close lives in iapeer — voicetalk never decides a conversation is over, it only
+// waits for the confirmation that it is.
+
+import { spawn } from 'child_process'
+
+export type NativeVoiceState = 'open' | 'opening' | 'closing' | 'closed' | 'unknown'
+
+export type NativeVoiceReceipt = {
+  ok: boolean
+  state: NativeVoiceState
+  session?: string | null
+  already?: boolean
+  reason?: string
+  error?: string
+  /** Raw stdout/stderr tail for the log when the answer did not parse. */
+  raw?: string
+}
+
+export type NativeVoiceControl = {
+  open(peer: string): Promise<NativeVoiceReceipt>
+  status(peer: string): Promise<NativeVoiceReceipt>
+  close(peer: string): Promise<NativeVoiceReceipt>
+}
+
+const STATES = new Set(['open', 'opening', 'closing', 'closed'])
+
+/** Parse the LAST JSON object line of a contract answer. Anything else is not a receipt:
+ *  a confirmation that cannot be read is treated as no confirmation. */
+export function parseVoiceReceipt(stdout: string, stderr: string, exitCode: number | null): NativeVoiceReceipt {
+  const lines = `${stdout}`.split(/\r?\n/).map(l => l.trim()).filter(l => l.startsWith('{') && l.endsWith('}'))
+  for (const line of lines.reverse()) {
+    try {
+      const obj = JSON.parse(line) as Record<string, unknown>
+      const state = typeof obj.state === 'string' && STATES.has(obj.state) ? (obj.state as NativeVoiceState) : 'unknown'
+      const errorText = [obj.error, obj.err, obj.detail].find(v => typeof v === 'string') as string | undefined
+      return {
+        ok: obj.ok === false ? false : exitCode === 0,
+        state,
+        session: typeof obj.session === 'string' ? obj.session : null,
+        already: obj.already === true,
+        reason: typeof obj.reason === 'string' ? obj.reason : undefined,
+        error: exitCode === 0 && obj.ok !== false ? undefined : (errorText ?? `exit ${exitCode}`),
+      }
+    } catch {}
+  }
+  const raw = `${stdout}\n${stderr}`.trim().slice(-300)
+  return { ok: false, state: 'unknown', error: raw || `exit ${exitCode}`, raw }
+}
+
+/** The CLI implementation of the contract. Never throws; a timeout is a failed receipt. */
+export function cliNativeVoice(opts: {
+  bin: string
+  env?: NodeJS.ProcessEnv
+  cwd?: string
+  openTimeoutMs?: number
+  statusTimeoutMs?: number
+  closeTimeoutMs?: number
+}): NativeVoiceControl {
+  const run = (verb: string, peer: string, timeoutMs: number) =>
+    new Promise<NativeVoiceReceipt>(resolve => {
+      let stdout = ''
+      let stderr = ''
+      let settled = false
+      const finish = (r: NativeVoiceReceipt) => {
+        if (settled) return
+        settled = true
+        clearTimeout(timer)
+        resolve(r)
+      }
+      let child: ReturnType<typeof spawn>
+      try {
+        child = spawn(opts.bin, ['voice', verb, peer, '--json'], {
+          cwd: opts.cwd,
+          env: opts.env ?? process.env,
+          stdio: ['ignore', 'pipe', 'pipe'],
+        })
+      } catch (err) {
+        resolve({ ok: false, state: 'unknown', error: err instanceof Error ? err.message : String(err) })
+        return
+      }
+      const timer = setTimeout(() => {
+        try {
+          child.kill('SIGKILL')
+        } catch {}
+        finish({ ok: false, state: 'unknown', error: `voice ${verb} timed out after ${Math.ceil(timeoutMs / 1000)}s` })
+      }, timeoutMs)
+      child.stdout?.on('data', d => (stdout += String(d)))
+      child.stderr?.on('data', d => (stderr += String(d)))
+      child.on('error', err => finish({ ok: false, state: 'unknown', error: err.message }))
+      child.on('close', code => finish(parseVoiceReceipt(stdout, stderr, code)))
+    })
+  return {
+    open: peer => run('open', peer, opts.openTimeoutMs ?? 20_000),
+    status: peer => run('status', peer, opts.statusTimeoutMs ?? 5_000),
+    close: peer => run('close', peer, opts.closeTimeoutMs ?? 15_000),
+  }
+}
+
+/** Which targets are answered in native voice: the passport's `native_voice` list, or the
+ *  `VOICETALK_NATIVE_VOICE` override (comma list; empty string disables). */
+export function nativeVoiceTargets(binding: { native_voice?: unknown }, env = process.env): Set<string> {
+  const override = env.VOICETALK_NATIVE_VOICE
+  const source: unknown = override !== undefined ? override.split(',') : binding.native_voice
+  const list = Array.isArray(source) ? source : typeof source === 'string' ? source.split(',') : []
+  return new Set(list.map(v => String(v).trim()).filter(Boolean))
+}