@inetafrica/open-claudia 3.1.28 → 3.2.1

package/CHANGELOG.md

@@ -1,5 +1,36 @@
 # Changelog
 
+## v3.2.1 — Speech as a general capability, sockets that survive rejection, and calls that greet back
+
+- **A rejected handshake no longer strands a bot forever.** socket.io-client permanently stops reconnecting when the *server* rejects a handshake (auth middleware `next(new Error())`): `connect_error` fires with `socket.active === false` and the manager never dials again. During the 2026-08-08 outage chat-central booted before Central's MongoDB and rejected every handshake for a few minutes — terminally stranding the whole bot fleet, pods "Running" but deaf until manually restarted. New `core/socket-reconnect.js` `wireTerminalReconnect()` watches for exactly that terminal state and drives a manual `connect()` with 2s→30s capped backoff; transport-level failures (where the manager retries on its own, `socket.active === true`) are left alone. A deliberate client-side `disconnect()` is intercepted — a wedged socket emits no event for it — and cancels retries until `connect()` re-arms them. Wired into both the kazee and spaces sockets; `test-socket-reconnect.js` joins the pretest chain.
+- **The bot can now place calls, both directions get a greeting, and the media leg works behind NAT.** Call-platform batch in the kazee channel, live-tested end to end on 2026-08-08:
+  - ICE servers now come from chat-central's `GET /webrtc/config` instead of a hardcoded STUN list, filtered to `stun:`/`turn:` URLs without `transport=tcp` (werift's ICE is UDP-only), falling back to defaults if the fetch fails. This fixes the zero-RTP calls where STUN alone couldn't punch through (diagnosed 2026-07-30).
+  - `outgoing({ chatId, toUserId })` places a bot-initiated call: the caller side owns room lifecycle, so the session creates the Janus room itself (mirroring the web client's params, tolerating 427 already-exists) and destroys it on close; `call:invite` goes out with a 60s ring timer — FCM's TTL is 60s and chat-central keeps ringing calls fresh for 90s, while the mobile app auto-ends its ring UI at 30s.
+  - That 30s device auto-end fires `call:end`, which previously tore down the room while a human was still walking to the phone — a late answer (44s in the live test) then joined a destroyed room and hung on "Connecting". `ended()` now ignores end events while the call is still ringing; the ring timer and `call:rejected` own that phase.
+  - Callers heard silence until they spoke first and read the call as dead. The session now speaks a greeting exactly once, when the first remote feed comes up — both directions ("Hey, it's Claudia…").
+  - Double-subscribe race fixed: the join response and the async publishers event both list the same feed, and while `attach()` was in flight the second frame passed the `has()` check and subscribed the feed twice, orphaning a PeerConnection (diagnosed 2026-07-30). The slot is now reserved before the first await.
+  - `call:accepted`/`call:rejected` are handled, and both call-test harnesses grew coverage (+45/+47 lines) for the outgoing flow, ring timeout, ignore-while-ringing, and greeting.
+- **Received videos and mobile uploads no longer save as `.bin`.** Telegram messages without a fileName (videos especially) and Kazee Media docs from mobile uploads (which often carry no fileName at all) fell through to the `.bin` fallback, so an mp4 landed on disk unplayable. Extension derivation is now tiered: fileName ext → transport hint (Telegram's `file_path`, which carries the real extension; Kazee's blob-URL pathname) → mimeType map (16 common types) → per-media-type default (video→.mp4, audio→.m4a/.ogg) → `.bin` only as the true last resort. Kazee documents that keep their original name get the derived extension appended when the name has none.
+- **TTS and STT become first-class agent capabilities, not just the voice-note reply path.** Fleet agents asked to produce a voice-over or transcribe a sent recording had nothing to reach for: they probed `open-claudia say --help` (which would have *spoken* "--help"), then tried direct gateway/vendor API calls and concluded "the key is missing" — correctly, because the provider subprocess is credential-stripped by design. Two new loopback verbs run in the credentialed bot process: `tts` (`open-claudia tts "<text>" --out <path> [--voice <id>]` — synthesize to a FILE without any chat send; extension picks the container, .ogg native / .mp3 / .wav transcoded; voice override reaches the gateway for cloned voices) and `transcribe` (`open-claudia transcribe <file>` — prints the transcript of any audio OR video file; `transcribeMedia` ffmpeg-normalizes to 16kHz mono wav first, which extracts video audio tracks and shrinks the gateway upload, then falls through the existing gateway → local-Whisper chain). No guardrail on `tts` because the artifact stays on local disk — the send verbs that could ship it carry their own R8 guard. A new "Speech services (TTS / STT)" system-prompt block — gated on real capability (`canSpeak()` / new `canTranscribe()`) — documents both plus `say`, and tells agents explicitly to never call the gateway or vendor APIs directly. `say`/`tts`/`transcribe` all answer `--help` now instead of synthesizing the flag. Regression chain: `test-speech-loopback.js` pins the loopback contract (empty text 400, no route 503, synth failure 500, relative/missing transcribe paths 400, empty transcript is a valid 200, auth 401) and the media mechanics (copy vs transcode by extension, mkdir -p, voice override in the gateway body, temp-wav cleanup, prompt-block presence). Verified live: a real gateway round-trip synthesized a sentence to mp3 and transcribed it back byte-identical.
+
+## v3.2.0 — The employee batch: memory hygiene at write time, prospective memory, earned trust, and learning from the owner's judgment calls
+
+Three approved plans land together — memory adoption A1-A4 (from the TencentDB-Agent-Memory review), codegraph Phase 1, and employee capabilities C1-C6 — plus the Kazee group speaker-identity fix. Two rules hold throughout: **report-only where trust is involved** (nothing here grants, acts, or loosens an approval rule by itself), and **no new standing context cost** (everything injects only when already-matched content fires, or lands in the nightly dream summary).
+
+- **A1 — write-time dedup adjudicator, gated (the only hot-path item).** The post-turn reviewer's journal facts used to append unconditionally; duplicates accumulated all day for the one nightly pass that can lose things (merge) to clean up. Now cheap extractive recall checks each proposed fact against existing journal lines first. The gate keeps the hot path free: no candidates → zero LLM cost, store as proposed; exact-normalized duplicates auto-skip mechanically; only the fuzzy remainder goes to ONE batched low-tier call returning per-fact `store | update | merge | skip`. Fail-open everywhere — any error, timeout, or malformed judgement stores facts as proposed, because dedup failure must never make memory worse than append-only.
+- **A2 — merges keep the absorbed packs' history.** Dream merges used to delete the absorbed pack's entire Journal (surviving only in the backup dir); a merged pack read younger and thinner than the history it represents. Absorbed Journal lines now carry into the survivor — normalized-exact dedup only (never fuzzy: similar-but-distinct events must both survive), date-ascending, the cap keeps newest and drops undated lines first.
+- **A3 — substitutability stamps.** The reviewer self-rates each journal line 0-10 for how fully its wording substitutes for the turn's original words — a checkable claim about the text, not a guess about future importance. The score rides the stored line as a trailing `⟨s:N⟩` marker (announcements stay clean, near-dup similarity ignores it) and protects low-scored, verbatim-precious lines from the dream's journal collapse.
+- **A4 — section budgets are enforced, not requested.** "Keep State under ~150 words" was prose; States drifted. LLM-edited sections now have mechanical ceilings: pack State trims at the cap with a visible cut marker + flag, entity Notes and persona sections trim at theirs, and the review prompt measures State against the target so over-budget turns the reviewer's job into an edit, not an append. Mandate (owner-set policy) and user-origin writes are never trimmed.
+- **codegraph — code-structure queries as a reusable read-only tool (Phase 1).** Machine-side `codegraph` tool wrapping `@colbymchenry/codegraph`, pinned exactly 1.5.0 (native binaries from a solo author — upgrades are deliberate, reviewed events, never `^` drift), `CODEGRAPH_TELEMETRY=0` baked into every invocation, 12 read-only verbs with query verbs auto-syncing the index first. TOOL.md carries the graded trust model: `explore`/`node`/`search`/`files` are high-trust retrieval; `callers`/`impact`/`affected` are **advisory, positive-signal only** (verified misses: CJS namespace calls, some TS class-method sites) — grep remains the completeness check for destructive refactors. Two-week usage evaluation follows; MCP exposure was dropped against the token-efficiency goal.
+- **C1 — prospective memory.** "Next time X comes up, mention Y" — reminders bound to a TOPIC (pack or entity), not a time; crons and watches already own time and condition. They fire as a `📌 Pending:` line when the target surfaces in recall injection or is opened with `pack show`/`entity show`, and are consumed ONLY at commit points — a dropped render can never eat a reminder. One-shot by default with a fired ledger; `--sticky` survives; the dream GCs expired and orphaned entries. New `open-claudia remind` CLI.
+- **C2 — recall misses become permanent tests.** `open-claudia recall-case add "<query>" --expect <slug>` saves a case whenever a miss is corrected; the dream re-grades the suite nightly against the deterministic recall floor (matchPacks + matchEntities — the candidate stage every engine builds on) so the suite runs, and means the same thing, on nights the providers are down. Capped with oldest-first rotation; orphaned cases drop; pass-rate + delta land in the dream's memory-health section. "It feels degraded" is now a number.
+- **C3 — skill certification: trust is earned per verb, and granting stays human.** Tools already log per-verb runs in state.json; a certification tier is now derived from that telemetry — `certified` at ≥5 clean runs with no recent failure, `probation` for 7 days after a failure (only clean runs SINCE the failure re-certify, read from history), `learning` otherwise. `tool show` renders the tier per verb, labeled informational — nothing in the run gate consults it. The dream proposes at most 2 certified gated-tier verbs per night as Always-allow candidates; read-only verbs need no grant, and no auto-grant exists, ever.
+- **C4 — apprenticeship radar: it asks to be taught.** A deterministic 7-day transcript scan spots repeated manual work — the same ad-hoc command re-derived by the agent (inline code + `$`-lines; its own CLI excluded) or the owner asking for the same thing again — at ≥3 occurrences across ≥2 distinct days. The dream's introspection report offers at most 2 as `/learn` candidates with the counts as evidence. Report-only: `/learn` stays owner-triggered, and no evidence means no section, no standing cost.
+- **C5 — denied-approval mining: trained by the owner's judgment calls.** Every Deny tap was training data we dropped. Recently DENIED approval records (never approvals — an approve confirms, it corrects nothing) now feed the post-turn reviewer as fenced DATA with explicit never-instructions framing, on owner-turn reviews only — deny content can never surface via an external speaker's turn. Each deny is fed exactly once (stamped after a parseable decision; parse failure re-feeds). Forge-proof by structure: a deny-sourced lesson's trigger must cite a real record with status denied — the model cannot invent a refusal, and an approved id confers nothing.
+- **C6 — weekly cost self-report.** The dream summary gains a cost section: rolling 7-day totals over the existing per-turn usage log, top burns by project, week-over-week delta, and ONE concrete suggested cut picked by deterministic heuristics. Pure arithmetic — no model call, no new logging surface.
+- **Kazee groups: the Speaker block now knows the env-configured owner.** The prompt's Speaker block resolved identity ONLY through `people.findByHandle`, so an env-configured owner (`KAZEE_OWNER_USER_ID` — no people record, because auto-contact skips owners by design) and any not-yet-recorded group member spoke anonymously, and in group chats the model refused to attribute their messages (the "Ok go" incident, 2026-08-03). The block now falls back to the canonical owner check and the transport-reported display name — without a name ever conferring owner standing (R1 intact).
+- **Eleven new release-chain tests** (chain now 67): journal union, substitutability stamps, section budgets, dedup adjudicator, prospective memory, recall regressions, cost report, speaker context, approval mining, tool certification, apprenticeship radar. The 360° dangling-pathway pass found and closed one real gap pre-release: the C5 deny-feed originally fired on ALL reviewed turns, including external speakers' — now owner-gated with tests proving external turns see nothing and records stay un-mined.
+
 ## v3.1.28 — The Telegram reboot loop was self-inflicted: the heal kept tearing down its own recovery
 
 - **Symptom.** v3.1.27 shipped to all four Telegram pods and the loop continued (euvy: 6 restarts in 3h). Its fix was real but addressed a different failure — the dominant one never enters `_enterOutagePause` at all (zero "Telegram unreachable" lines in the crash logs). The decisive observation was that the bot reproduced it identically on a laptop — 155 self-exits in a local `bot.log` — which retired the cluster-network and conntrack theories outright. The shape is bursts: healthy for 2.7–4.2h, then ~10 minutes of failed heals, then `process.exit(1)`, repeat.

package/bin/cli.js

@@ -278,6 +278,11 @@ switch (command) {
   }
 
   case "say": {
+    // Agents probe with --help before speaking; don't synthesize the flag.
+    if (args[1] === "--help" || args[1] === "-h") {
+      console.log('Usage: open-claudia say "<text>"\nSynthesize the text (TTS) and send it as a voice note to the current chat.\nTo synthesize to a file instead (voice-overs), use: open-claudia tts "<text>" --out <path>');
+      process.exit(0);
+    }
     const text = args.slice(1).join(" ").trim();
     if (!text) {
       console.error('Usage: open-claudia say "<text>"');
@@ -299,6 +304,90 @@ switch (command) {
     break;
   }
 
+  case "tts": {
+    if (args[1] === "--help" || args[1] === "-h") {
+      console.log('Usage: open-claudia tts "<text>" [--out <path>.ogg|.mp3|.wav] [--voice <id>]\nSynthesize speech to a FILE without sending it to chat (voice-overs, narration).\nThe extension picks the container; prints the final path. Omit --out for a temp .ogg.');
+      process.exit(0);
+    }
+    const rest = args.slice(1);
+    let out = null;
+    let voice = null;
+    const textParts = [];
+    for (let i = 0; i < rest.length; i++) {
+      if (rest[i] === "--out") out = rest[++i];
+      else if (rest[i] === "--voice") voice = rest[++i];
+      else textParts.push(rest[i]);
+    }
+    const text = textParts.join(" ").trim();
+    if (!text) {
+      console.error('Usage: open-claudia tts "<text>" [--out <path>.ogg|.mp3|.wav] [--voice <id>]');
+      process.exit(2);
+    }
+    (async () => {
+      // Like `say`, synthesis happens in the credentialed bot process — this CLI
+      // has no speech token. The bot writes the file and returns its path.
+      const { postJson } = require("./loopback-client");
+      try {
+        const res = await postJson("tts", {
+          text,
+          out: out ? path.resolve(out) : undefined,
+          voice: voice || undefined,
+        });
+        console.log(res.path);
+        process.exit(0);
+      } catch (e) {
+        console.error(e.message);
+        process.exit(1);
+      }
+    })();
+    break;
+  }
+
+  case "transcribe": {
+    if (args[1] === "--help" || args[1] === "-h") {
+      console.log("Usage: open-claudia transcribe <audio-or-video-file>\nSpeech-to-text: prints the transcript. Accepts audio (ogg/mp3/m4a/wav) and video\n(mp4/mkv — the audio track is extracted automatically).");
+      process.exit(0);
+    }
+    const filePath = String(args[1] || "").trim();
+    if (!filePath) {
+      console.error("Usage: open-claudia transcribe <audio-or-video-file>");
+      process.exit(2);
+    }
+    const abs = path.resolve(filePath);
+    if (!fs.existsSync(abs)) {
+      console.error(`File not found: ${abs}`);
+      process.exit(2);
+    }
+    (async () => {
+      const { postJson } = require("./loopback-client");
+      try {
+        const res = await postJson("transcribe", { path: abs });
+        console.log(res.text || "");
+        process.exit(0);
+      } catch (e) {
+        console.error(e.message);
+        process.exit(1);
+      }
+    })();
+    break;
+  }
+
+  case "call": {
+    (async () => {
+      const { postJson } = require("./loopback-client");
+      try {
+        const toUserId = String(args[1] || "").trim();
+        const res = await postJson("call", toUserId ? { toUserId } : {});
+        console.log(`Calling: room=${res.roomId} chat=${res.chatId} to=${res.toUserId}`);
+        process.exit(0);
+      } catch (e) {
+        console.error(e.message);
+        process.exit(1);
+      }
+    })();
+    break;
+  }
+
   case "tw":
   case "transcript-window": {
     require("./transcript-window").run(args.slice(1));
@@ -375,6 +464,16 @@ switch (command) {
     break;
   }
 
+  case "remind": {
+    require("./remind").run(args.slice(1));
+    break;
+  }
+
+  case "recall-case": {
+    require("./recall-case").run(args.slice(1));
+    break;
+  }
+
   case "lessons": {
     require("./lessons").run(args.slice(1));
     break;
@@ -464,6 +563,10 @@ Send tools (only work inside an active bot-spawned task):
   open-claudia send-photo <path> [caption]
   open-claudia send-voice <path>
   open-claudia say "<text>"          Synthesize the text (TTS) and send it as a voice note
+  open-claudia tts "<text>" --out <path>     Synthesize to a FILE without sending (voice-overs,
+                                             narration; ext picks format; --voice <id> optional)
+  open-claudia transcribe <file>     Speech-to-text: print the transcript of an audio/video file
+  open-claudia call [toUserId]       Place a live voice call on the current channel (kazee; owner-only)
 
 Memory tools:
   open-claudia transcript-search <query>     Ranked FTS5 search over indexed transcripts
@@ -473,6 +576,8 @@ Memory tools:
   open-claudia pack list|show|match|archive|restore|archived  Context packs: living topic docs (skills + memory)
   open-claudia tool list|search|show|scaffold|add|set|note|edit|run|migrate|remove  Reusable tools: git-tracked dirs (exec + TOOL.md + telemetry), risk-gated runs
   open-claudia entity list|show|match|note   Entity notes: people/places/projects memory
+  open-claudia remind "<note>" --pack <dir>|--entity <slug>  Prospective memory: fires when that topic next comes up (remind list|remove <id>)
+  open-claudia recall-case add "<query>" --expect <slug>     Memory regression suite: corrected recall misses become nightly-graded tests (list|run|remove)
   open-claudia lessons list|add|remove|show  Always-loaded learned rules (cross-cutting, promoted after a miss)
   open-claudia ideas list|add|remove|show    Self-improvement backlog (captured by the nightly dream)
   open-claudia keyring list|get|set|remove   Operational creds the agent can reuse (plaintext; vault for secrets)

package/bin/entity.js

@@ -31,6 +31,15 @@ function run(args) {
       const e = entities.findEntity(rest.join(" "));
       if (!e) { console.error(`No entity: ${rest.join(" ")}`); process.exitCode = 1; return; }
       console.log(fs.readFileSync(path.join(entities.ENTITIES_DIR, e.slug + ".md"), "utf-8"));
+      // C1: topic-bound reminders fire when the target is explicitly opened.
+      try {
+        const prospective = require("../core/prospective");
+        const pending = prospective.pendingFor("entity", e.slug);
+        if (pending.length) {
+          console.log("\n" + prospective.renderPendingLines(pending));
+          prospective.fire(pending, "entity show");
+        }
+      } catch (err) { /* reminders optional */ }
       break;
     }
 

package/bin/pack.js

@@ -113,6 +113,16 @@ function run(args) {
           for (const t of linked) console.log(`#   ${t.name} — ${t.description || "(no description)"}`);
         }
       } catch (e) { /* tools optional */ }
+      // C1: topic-bound reminders also fire when their target is explicitly
+      // opened — the show output IS the surface, so consuming here is safe.
+      try {
+        const prospective = require("../core/prospective");
+        const pending = prospective.pendingFor("pack", p.dir);
+        if (pending.length) {
+          console.log("\n" + prospective.renderPendingLines(pending));
+          prospective.fire(pending, "pack show");
+        }
+      } catch (e) { /* reminders optional */ }
       break;
     }
 

package/bin/recall-case.js

@@ -0,0 +1,90 @@
+// CLI: memory regression suite — corrected recall misses become permanent
+// test cases, re-graded nightly by the dream (deterministic, no LLM).
+//   open-claudia recall-case add "<query>" --expect <slug> [--expect <slug2>] [--source live-miss|manual] [--note "..."]
+//   open-claudia recall-case list
+//   open-claudia recall-case run [--cap N]     — grade now and print per-case results
+//   open-claudia recall-case remove <id>
+// Add a case the moment a recall miss gets corrected in chat — same moment a
+// lesson forms. The query should be the user's original phrasing; the expected
+// slug is the pack dir / entity slug that SHOULD have surfaced.
+
+const regressions = require("../core/recall-regressions");
+
+function usage() {
+  console.error('Usage: open-claudia recall-case add "<query>" --expect <slug> [--expect <slug2>] [--source live-miss|manual] [--note "..."]');
+  console.error("       open-claudia recall-case list | run [--cap N] | remove <id>");
+  process.exitCode = 1;
+}
+
+function run(args) {
+  const cmd = (args[0] || "").toLowerCase();
+
+  if (cmd === "" || cmd === "help" || cmd === "--help") return usage();
+
+  if (cmd === "list") {
+    const all = regressions.listCases();
+    if (all.length === 0) return console.log("No regression cases yet. Add one with: open-claudia recall-case add \"<query>\" --expect <slug>");
+    for (const c of all) {
+      const state = c.lastResult ? `${c.lastResult}${c.lastRunAt ? ` @ ${String(c.lastRunAt).slice(0, 10)}` : ""}` : "never run";
+      console.log(`${c.id}  [${state}] (${c.source})\n    query:  ${c.query}\n    expect: ${c.expectSlugs.join(", ")}${c.note ? `\n    note:   ${c.note}` : ""}`);
+    }
+    return;
+  }
+
+  if (cmd === "remove") {
+    const id = args[1];
+    if (!id) return usage();
+    if (!regressions.removeCase(id)) { console.error(`No case: ${id} (open-claudia recall-case list)`); process.exitCode = 1; return; }
+    console.log(`Removed case ${id}.`);
+    return;
+  }
+
+  if (cmd === "run") {
+    let cap;
+    const capIdx = args.indexOf("--cap");
+    if (capIdx !== -1) cap = Math.max(1, parseInt(args[capIdx + 1], 10) || regressions.NIGHTLY_CAP);
+    const before = regressions.listCases();
+    if (before.length === 0) return console.log("No regression cases to run.");
+    const res = regressions.runSuite(cap ? { cap } : {});
+    for (const c of regressions.listCases()) {
+      if (!c.lastResult) continue;
+      console.log(`${c.lastResult === "pass" ? "✅" : "❌"} ${c.id}  ${c.query.slice(0, 60)}${c.lastResult === "fail" ? "  (expected: " + c.expectSlugs.join(", ") + ")" : ""}`);
+    }
+    const rate = res.ran > 0 ? Math.round((res.passed / res.ran) * 100) : 0;
+    console.log(`\n${res.passed}/${res.ran} passing (${rate}%)${res.orphaned ? `, ${res.orphaned} orphaned case(s) dropped` : ""}${res.total > res.ran ? `, ${res.total - res.ran} deferred to next rotation` : ""}.`);
+    return;
+  }
+
+  if (cmd === "add") {
+    const rest = args.slice(1);
+    const expect = [];
+    let source = "manual", note = "";
+    for (let i = 0; i < rest.length; i++) {
+      if (rest[i] === "--expect") { expect.push(rest[++i]); continue; }
+      if (rest[i] === "--source") { source = rest[++i]; continue; }
+      if (rest[i] === "--note") { note = rest[++i] || ""; continue; }
+    }
+    const query = rest.filter((a, i) => {
+      if (a === "--expect" || a === "--source" || a === "--note") return false;
+      if (i > 0 && ["--expect", "--source", "--note"].includes(rest[i - 1])) return false;
+      return true;
+    }).join(" ").trim();
+    if (!query || expect.length === 0) return usage();
+    // Warn (don't refuse) on an unknown slug — the pack may be created next.
+    const packs = require("../core/packs");
+    const entities = require("../core/entities");
+    for (const s of expect) {
+      let known = false;
+      try { known = !!packs.readPack(s); } catch (e) {}
+      if (!known) { try { known = !!entities.readEntity(s); } catch (e) {} }
+      if (!known) console.log(`⚠️  ${s} is not a known pack dir or entity slug right now — the case will grade as orphaned until it exists.`);
+    }
+    const entry = regressions.addCase({ query, expectSlugs: expect, source, note });
+    console.log(`🧪 Case ${entry.id} added — nightly recall must surface ${expect.join(", ")} for: "${query}"`);
+    return;
+  }
+
+  usage();
+}
+
+module.exports = { run };

package/bin/remind.js

@@ -0,0 +1,82 @@
+// CLI: prospective memory — "next time X comes up, mention Y".
+//   open-claudia remind "<note>" --pack <dir> | --entity <slug> [--sticky] [--expires <YYYY-MM-DD>]
+//   open-claudia remind list
+//   open-claudia remind remove <id>
+// Reminders are topic-bound, not time-bound: they fire when the target pack/
+// entity next surfaces in recall injection or is opened with pack show /
+// entity show. Time-based reminding belongs to schedule-wakeup / cron-add;
+// condition-based reminding belongs to watch-add.
+
+const prospective = require("../core/prospective");
+
+function usage() {
+  console.error('Usage: open-claudia remind "<note>" --pack <dir> | --entity <slug> [--sticky] [--expires <YYYY-MM-DD>]');
+  console.error("       open-claudia remind list | remove <id>");
+  process.exitCode = 1;
+}
+
+function run(args) {
+  const cmd = (args[0] || "").toLowerCase();
+
+  if (cmd === "" || cmd === "help" || cmd === "--help") return usage();
+
+  if (cmd === "list") {
+    const all = prospective.listReminders();
+    if (all.length === 0) return console.log("No pending reminders.");
+    for (const r of all) {
+      const extras = [r.sticky ? "sticky" : "one-shot", r.expiresAt ? `expires ${String(r.expiresAt).slice(0, 10)}` : ""].filter(Boolean).join(", ");
+      console.log(`${r.id}  [${r.targetType}:${r.targetSlug}] (${extras}, asked ${String(r.createdAt).slice(0, 10)})\n    ${r.note}`);
+    }
+    return;
+  }
+
+  if (cmd === "remove") {
+    const id = args[1];
+    if (!id) return usage();
+    if (!prospective.removeReminder(id)) { console.error(`No reminder: ${id} (open-claudia remind list)`); process.exitCode = 1; return; }
+    console.log(`Removed reminder ${id}.`);
+    return;
+  }
+
+  // Default verb: add. The note is everything that isn't a flag.
+  const rest = args.slice();
+  const takeFlag = (flag, hasValue = true) => {
+    const i = rest.indexOf(flag);
+    if (i === -1) return null;
+    const v = hasValue ? rest[i + 1] : true;
+    rest.splice(i, hasValue ? 2 : 1);
+    return v == null ? "" : v;
+  };
+  const packArg = takeFlag("--pack");
+  const entityArg = takeFlag("--entity");
+  const sticky = takeFlag("--sticky", false) === true;
+  const expires = takeFlag("--expires");
+  const note = rest.join(" ").trim();
+
+  if (!note || (!packArg && !entityArg) || (packArg && entityArg)) return usage();
+
+  // Resolve the target now so a typo surfaces immediately, not as a reminder
+  // that silently never fires (dream GC would drop it as an orphan).
+  let targetType, targetSlug, targetName;
+  if (packArg) {
+    const p = require("../core/packs").findPack(packArg);
+    if (!p) { console.error(`No pack: ${packArg} (open-claudia pack list)`); process.exitCode = 1; return; }
+    targetType = "pack"; targetSlug = p.dir; targetName = p.name || p.dir;
+  } else {
+    const e = require("../core/entities").findEntity(entityArg);
+    if (!e) { console.error(`No entity: ${entityArg} (open-claudia entity list)`); process.exitCode = 1; return; }
+    targetType = "entity"; targetSlug = e.slug; targetName = e.name || e.slug;
+  }
+
+  let expiresAt = null;
+  if (expires) {
+    const t = Date.parse(expires);
+    if (!Number.isFinite(t)) { console.error(`Bad --expires date: ${expires} (use ISO, e.g. 2026-09-01)`); process.exitCode = 1; return; }
+    expiresAt = new Date(t).toISOString();
+  }
+
+  const entry = prospective.addReminder({ note, targetType, targetSlug, sticky, expiresAt });
+  console.log(`📌 Reminder ${entry.id} armed — fires when ${targetType} "${targetName}" next comes up${sticky ? " (sticky: repeats until removed)" : " (one-shot)"}${expiresAt ? `, expires ${expiresAt.slice(0, 10)}` : ""}.`);
+}
+
+module.exports = { run };

package/bin/tool.js

@@ -214,9 +214,14 @@ async function run(args) {
         console.log(`Runs: ${t.runCount}${t.lastUsed ? ` · last used ${t.lastUsed.slice(0, 16).replace("T", " ")}` : ""}${exit}`);
       }
       if (t.verbs && Object.keys(t.verbs).length) {
-        const rows = Object.entries(t.verbs).map(([v, s]) =>
-          `  • ${v}: ${s.runs} run(s), last exit ${s.lastExit}${s.lastSuccess ? `, last success ${s.lastSuccess.slice(0, 10)}` : ""}`);
-        console.log("Verbs:\n" + rows.join("\n"));
+        let certs = {};
+        try { certs = tools.certificationForState({ verbs: t.verbs, history: t.history }); } catch (e) {}
+        const rows = Object.entries(t.verbs).map(([v, s]) => {
+          const c = certs[v];
+          const cert = c ? ` · ${c.tier}${c.tier === "certified" ? "" : ` (${c.cleanRuns}/${tools.CERTIFY_CLEAN_RUNS} clean)`}` : "";
+          return `  • ${v}: ${s.runs} run(s), last exit ${s.lastExit}${s.lastSuccess ? `, last success ${s.lastSuccess.slice(0, 10)}` : ""}${cert}`;
+        });
+        console.log("Verbs (certification is earned trust, informational only):\n" + rows.join("\n"));
       }
       try {
         const log = repo.toolLog(t.name, 5);

package/channels/kazee/adapter.js

@@ -23,6 +23,28 @@ const CONTEXT_MAX_MESSAGES = 40;
 const CONTEXT_BODY_LIMIT = 280;
 const COLD_START_WINDOW = 15;
 
+// Kazee Media docs from mobile uploads often carry no fileName, so the saved
+// extension must come from the mimeType (or the blob URL) — otherwise every
+// video/document lands on disk as ".bin".
+const MIME_EXT = {
+  "video/mp4": ".mp4",
+  "video/quicktime": ".mov",
+  "video/webm": ".webm",
+  "video/x-matroska": ".mkv",
+  "audio/mpeg": ".mp3",
+  "audio/mp4": ".m4a",
+  "audio/x-m4a": ".m4a",
+  "audio/aac": ".aac",
+  "audio/ogg": ".ogg",
+  "audio/wav": ".wav",
+  "image/jpeg": ".jpg",
+  "image/png": ".png",
+  "image/gif": ".gif",
+  "image/webp": ".webp",
+  "application/pdf": ".pdf",
+  "application/zip": ".zip",
+};
+
 class KazeeAdapter {
   constructor({ id = "kazee", url, token, ownerUserId, botUserId }) {
     this.id = id;
@@ -600,10 +622,22 @@ class KazeeAdapter {
   async downloadMedia(media) {
     if (!media || !media.fileId) return null;
     const url = media.fileId; // Kazee passes the cloud URL through fileId.
-    const ext = path.extname(media.fileName || "") || (media.type === "voice" ? ".ogg" : media.type === "photo" ? ".jpg" : ".bin");
+    let urlExt = "";
+    try { urlExt = path.extname(new URL(url).pathname); } catch (e) {}
+    const mime = (media.mimeType || "").toLowerCase().split(";")[0].trim();
+    const ext = path.extname(media.fileName || "")
+      || urlExt
+      || MIME_EXT[mime]
+      || (media.type === "voice" ? ".ogg"
+        : media.type === "photo" ? ".jpg"
+        : media.type === "video" ? ".mp4"
+        : media.type === "audio" ? ".m4a"
+        : ".bin");
     const baseDir = media.type === "document" ? FILES_DIR : TEMP_DIR;
-    const localPath = media.type === "document" && media.fileName
-      ? path.join(baseDir, media.fileName)
+    const keepName = media.type === "document" && media.fileName;
+    const nameSuffix = keepName && !path.extname(media.fileName) && ext !== ".bin" ? ext : "";
+    const localPath = keepName
+      ? path.join(baseDir, media.fileName + nameSuffix)
       : path.join(baseDir, `kz-${Date.now()}${ext}`);
     await this._downloadUrl(url, localPath);
     return localPath;

package/channels/kazee/call/manager.js

@@ -8,6 +8,16 @@ const DEFAULT_ICE_SERVERS = [
   { urls: "stun:coturn.kazee.africa:3478" },
   { urls: "stun:stun.l.google.com:19302" },
 ];
+// FCM push TTL is 60s and chat-central treats ringing logs as fresh for 90s.
+// Must comfortably outlast the mobile client's own 30s ring timeout: a callee
+// device auto-ends at 30s, the human then answers late, and chat-central
+// revives the CallLog — the room has to still exist when that answer lands
+// (first live outbound test 2026-08-08: end at 30s, real answer at 44s).
+const RING_TIMEOUT_MS = 60_000;
+const OUTGOING_GREETING = "Hey, it's Claudia. Can you hear me okay?";
+// Inbound must greet too: callers get silence until they speak first, which
+// reads as a dead call (live test 2026-08-08 — media was up, caller hung up).
+const INCOMING_GREETING = "Hey, it's Claudia — you're through. Can you hear me?";
 
 class KazeeCallManager {
   constructor({ adapter, SessionImpl = KazeeCallSession, janusUrl = process.env.KAZEE_JANUS_URL || DEFAULT_JANUS_URL,
@@ -17,12 +27,45 @@ class KazeeCallManager {
     this.janusUrl = janusUrl;
     this.iceServers = iceServers;
     this.session = null;
+    this._ringTimer = null;
   }
 
   wire(socket) {
     socket.on("call:incoming", (payload) => this.incoming(payload));
     socket.on("call:ended", (payload) => this.ended(payload));
-    socket.on("call:rejected", (payload) => this.ended(payload));
+    socket.on("call:rejected", (payload) => this.rejected(payload));
+    socket.on("call:accepted", (payload) => this.accepted(payload));
+    socket.on("call:ringing", (payload) => {
+      if (this.session) console.log(`Kazee call ringing: chat=${String(payload?.chatId || "")}`);
+    });
+  }
+
+  // Janus signalling always worked; the media leg never did — the hardcoded
+  // default is STUN-only, and behind NAT only a TURN relay yields a workable
+  // candidate pair (zero RTP ever arrived, 2026-07-30). chat-central mints
+  // TURN credentials at /webrtc/config — the same endpoint the web and mobile
+  // clients use. werift's ICE stack is UDP-only, so tcp/tls variants are
+  // filtered out before they can break candidate gathering.
+  async _fetchIceServers() {
+    if (typeof this.adapter?._request !== "function") return this.iceServers;
+    try {
+      const res = await this.adapter._request("GET", "/webrtc/config");
+      const fetched = Array.isArray(res?.config?.iceServers) ? res.config.iceServers : [];
+      const usable = fetched.filter((server) => {
+        const url = String(Array.isArray(server.urls) ? server.urls[0] : server.urls || "");
+        if (url.startsWith("stun:")) return true;
+        return url.startsWith("turn:") && !url.includes("transport=tcp");
+      });
+      const turns = usable.filter((s) => String(Array.isArray(s.urls) ? s.urls[0] : s.urls).startsWith("turn:")).length;
+      if (turns > 0) {
+        console.log(`Kazee call ICE config: ${usable.length} servers (${turns} TURN) from /webrtc/config`);
+        return usable;
+      }
+      console.warn("Kazee call ICE config: /webrtc/config returned no usable TURN entry, using defaults");
+    } catch (error) {
+      console.error(`Kazee call ICE config fetch failed, using defaults: ${error.message}`);
+    }
+    return this.iceServers;
   }
 
   async incoming(payload = {}) {
@@ -44,9 +87,10 @@ class KazeeCallManager {
     if (callType !== "audio") return reject("unsupported_media");
     if (this.session) return reject("busy");
 
+    const iceServers = await this._fetchIceServers();
     const session = new this.SessionImpl({
       roomId, chatId, callerId, botUserId: this.adapter.botUserId,
-      janusUrl: this.janusUrl, iceServers: this.iceServers,
+      janusUrl: this.janusUrl, iceServers, greeting: INCOMING_GREETING,
       onTranscript: (text, meta) => this._transcript(text, payload, meta),
       onEnded: () => { if (this.session === session) this.session = null; },
     });
@@ -65,6 +109,70 @@ class KazeeCallManager {
     }
   }
 
+  // Bot-initiated call. Mirrors what a human caller's client does: create the
+  // Janus room, publish into it, then emit call:invite so chat-central rings
+  // the callee (socket + FCM/VoIP push). The callee's publisher appearing in
+  // the room is what completes the media leg — the existing auto-subscribe in
+  // the session handles that, so acceptance needs no extra media work here.
+  async outgoing({ chatId, toUserId } = {}) {
+    const target = String(toUserId || this.adapter.ownerUserId || "");
+    const chat = String(chatId || "");
+    if (!target || !chat) throw new Error("missing chatId/toUserId");
+    if (this.session) throw new Error("busy: a call session is already active");
+    if (!this.adapter._socket?.connected) throw new Error("kazee socket is not connected");
+    const roomId = Math.floor(Math.random() * 1e9);
+    const iceServers = await this._fetchIceServers();
+    // _transcript() reads chatId/fromUserId/roomId off the inbound invite
+    // payload; for outbound the remote human is the "from" side.
+    const remote = { chatId: chat, fromUserId: target, roomId, fromUserName: "" };
+    const session = new this.SessionImpl({
+      roomId, chatId: chat, callerId: target, botUserId: this.adapter.botUserId,
+      janusUrl: this.janusUrl, iceServers, asCaller: true, greeting: OUTGOING_GREETING,
+      onTranscript: (text, meta) => this._transcript(text, remote, meta),
+      onEnded: () => {
+        this._clearRingTimer();
+        if (this.session === session) this.session = null;
+      },
+    });
+    this.session = session;
+    try {
+      await session.start();
+    } catch (error) {
+      this.session = null;
+      await session.close("connect-failed").catch(() => {});
+      throw error;
+    }
+    console.log(`Kazee call outgoing: room=${roomId} chat=${chat} to=${target}`);
+    this.adapter._socket.emit("call:invite", { toUserId: target, callType: "audio", chatId: chat, roomId });
+    this._ringTimer = setTimeout(() => {
+      this._ringTimer = null;
+      this._ringTimeout(target, chat, roomId).catch((error) => console.error("Kazee call ring timeout:", error.message));
+    }, RING_TIMEOUT_MS);
+    if (typeof this._ringTimer.unref === "function") this._ringTimer.unref();
+    return { roomId, chatId: chat, toUserId: target };
+  }
+
+  accepted(payload = {}) {
+    if (!this.session || !this._ringTimer) return;
+    console.log(`Kazee call answered: room=${this.session.roomId} chat=${String(payload.chatId || "")}`);
+    this._clearRingTimer();
+  }
+
+  async _ringTimeout(toUserId, chatId, roomId) {
+    const session = this.session;
+    if (!session || session.roomId !== roomId) return;
+    console.log(`Kazee call unanswered: room=${roomId} to=${toUserId}`);
+    // Caller hanging up while ringing: chat-central finalizes the CallLog as
+    // missed and dismisses the callee's ringing UI/push.
+    this.adapter._socket?.emit("call:end", { toUserId, chatId });
+    this.session = null;
+    await session.close("no-answer").catch(() => {});
+  }
+
+  _clearRingTimer() {
+    if (this._ringTimer) { clearTimeout(this._ringTimer); this._ringTimer = null; }
+  }
+
   _transcript(text, incoming, meta = {}) {
     const session = this.session;
     if (!session || !text) return;
@@ -106,11 +214,29 @@ class KazeeCallManager {
   async ended(payload = {}) {
     if (!this.session) return;
     if (payload.roomId != null && Number(payload.roomId) !== this.session.roomId) return;
+    // While our outbound ring is live, a call:ended is usually a callee DEVICE
+    // giving up (mobile auto-ends its ring at 30s), not the human declining.
+    // chat-central revives the CallLog if they answer late, so the caller must
+    // keep the room alive until its own ring timeout — tearing down here left
+    // the late answer joining a destroyed room, stuck on "Connecting" (2026-08-08).
+    // A deliberate decline arrives as call:rejected and still closes.
+    if (this._ringTimer) {
+      console.log(`Kazee call ignoring ended-while-ringing: room=${this.session.roomId}`);
+      return;
+    }
     const session = this.session;
     this.session = null;
     await session.close("remote-ended");
   }
 
+  async rejected(payload = {}) {
+    if (!this.session) return;
+    if (payload.roomId != null && Number(payload.roomId) !== this.session.roomId) return;
+    const session = this.session;
+    this.session = null;
+    await session.close("remote-rejected");
+  }
+
   async stop() {
     if (!this.session) return;
     const session = this.session;