@inetafrica/open-claudia 3.2.0 → 3.2.3

package/CHANGELOG.md

@@ -1,5 +1,34 @@
 # Changelog
 
+## v3.2.3 — No watch can end silently: every watch carries a timeout that fires as a wake-up
+
+- **The silent-failure hole in watches.** A watch whose check never exits 0 polled forever without a sound — if the watched thing hung, was misconfigured (the unauthenticated-`glab` watch from 2026-08-12 would never have fired), or simply never happened, the agent slept through it and the user had to notice the silence themselves. The working pattern was to pair every watch with a manual backup wakeup; that safety net is now built in.
+- **Every new watch gets a hard expiry.** `watch-add` grows `--timeout <duration|ISO>` (90m, 6h, 1d, or an ISO datetime), default **2h**, stamped as `expiresAt` on the job. On the first poll tick at or past the deadline where the check *still* fails, the watch FIRES anyway: the woken prompt opens with `[Watch expired ...]` plus an explicit "the watched condition did NOT happen — this is a deadline wake-up, not a trigger" brief, and the chat advisory reads `⏰ Watch "label" timed out without triggering — waking anyway`. A check that passes exactly on the deadline tick still reports as a normal trigger.
+- **Expiry ends the watch's window.** An expiry fire is one-shot even for `--repeat` watches (the woken agent re-arms if still wanted), and the expiry mark is persisted so a failed expiry fire retries with the same semantics across restarts — while a retry whose condition came true in the meantime reports as a real trigger, not an expiry. `watch-list` now shows each watch's expiry (or `EXPIRED (fires on next poll)`); the global `/watch off` master switch still pauses everything, expiry included, until re-enabled.
+- **Backward compatible by choice.** Watches persisted before this release carry no `expiresAt` and keep their old poll-forever semantics rather than being retro-expired on upgrade (a pre-upgrade watch older than the default would otherwise fire the instant the bot restarts). `watch-list` flags these as `no expiry (pre-timeout watch)`.
+- Regression coverage in `test-provider-scheduler.js`: future-expiry idle stays silent, lapsed-expiry fire (header, brief, advisory, removal despite `--repeat`), deadline-tick pass is a trigger, default and explicit expiry stamping, and static end-to-end wiring (scheduler default → loopback passthrough → CLI flag).
+
+## v3.2.2 — The chip thinks from first contact, keeps thinking through the tools, and the dedup gate actually runs
+
+- **The dead minute before the chip appeared.** The typing heartbeat only started inside `executeAdmittedRun` — but a turn-bound message first crosses the enforcer's inbound triage (an LLM call), and voice notes add a media download plus STT before that. All of it ran with zero presence: on a slow triage the chat sat silent looking ignored, then "thinking" popped up long after the work had begun. The router now starts the heartbeat the moment a turn-bound message arrives (`startPreTurnTyping` in all five inbound handlers — text, voice, audio, photo, document), covering triage, download, and transcription. Non-turn traffic (wizards, vault prompts, credential pastes, commands) never shows a false chip because the start sits after those gates.
+- **The chip decayed to a stale "typing" during tool work.** Any `tool_start` permanently cleared `thinkingPhase`, so from the first tool call onward every 4s tick sent a stateless `typing:start` — clients rendered "typing…" through minutes of tool execution, and "thinking" never came back within a turn. Terminal and text events (`text_delta`, `text_final`, `result`, `error`) still end the thinking phase, but `tool_start` now re-enters it: streaming text reads as "typing", tool stretches read as "thinking" — which is what they are. (Kazee mobile renders a stateless tick as "typing" and auto-clears 5s after the last tick, so the 4s cadence keeps the chip alive and the state accurate on old and new clients alike.)
+- **Handoff without a scramble.** Two starts can now coexist safely: `startTypingHeartbeat` is a singleton per chat state — a new start supersedes the old interval, and every stopper is ownership-aware, acting only while its own interval is current. The router's pre-turn heartbeat hands off to the run's own heartbeat at `executeAdmittedRun` with no gap and no double interval; a stale stopper (a router `finally` after handoff, a superseded run) is a structural no-op. `/stop`, which clears the interval directly and thereby orphans the run's stopper, now emits the explicit `typing:stop` itself in both branches. `test-typing-heartbeat.js` joins the release chain: immediate thinking tick, supersede/ownership semantics, no orphaned timers across a full tick window, and the event-steering contract pinned.
+- **The journal dedup gate never actually ran.** v3.2.0's write-time dedup adjudicator (A1) calls its utility with `purpose: "dedup"` — a purpose `utility-policy` never registered, so every invocation died at validation with `INVALID_UTILITY_PURPOSE` and failed open, silently, by design. Log-proven on the local install. "dedup" is now a first-class purpose riding the review pipeline: `MEMORY_PROVIDER` steers it and `PACK_DEDUP_MODEL` is honored as its model override (both the prefix and the legacy Claude alias, matching what the adjudicator already passes). Pinned in `test-utility-provider-policy.js`.
+- **Not changed, on purpose:** the 5× duplicate voice notes from 2026-08-09 were client multi-tap creating *distinct* messages (fixed client-side in kazee-chat-mobile v3.25.23's optimistic-upload guard); the router's existing `isDuplicate` LRU already covers true socket redeliveries by message id, so no bot-side dedup was added.
+
+## v3.2.1 — Speech as a general capability, sockets that survive rejection, and calls that greet back
+
+- **A rejected handshake no longer strands a bot forever.** socket.io-client permanently stops reconnecting when the *server* rejects a handshake (auth middleware `next(new Error())`): `connect_error` fires with `socket.active === false` and the manager never dials again. During the 2026-08-08 outage chat-central booted before Central's MongoDB and rejected every handshake for a few minutes — terminally stranding the whole bot fleet, pods "Running" but deaf until manually restarted. New `core/socket-reconnect.js` `wireTerminalReconnect()` watches for exactly that terminal state and drives a manual `connect()` with 2s→30s capped backoff; transport-level failures (where the manager retries on its own, `socket.active === true`) are left alone. A deliberate client-side `disconnect()` is intercepted — a wedged socket emits no event for it — and cancels retries until `connect()` re-arms them. Wired into both the kazee and spaces sockets; `test-socket-reconnect.js` joins the pretest chain.
+- **The bot can now place calls, both directions get a greeting, and the media leg works behind NAT.** Call-platform batch in the kazee channel, live-tested end to end on 2026-08-08:
+  - ICE servers now come from chat-central's `GET /webrtc/config` instead of a hardcoded STUN list, filtered to `stun:`/`turn:` URLs without `transport=tcp` (werift's ICE is UDP-only), falling back to defaults if the fetch fails. This fixes the zero-RTP calls where STUN alone couldn't punch through (diagnosed 2026-07-30).
+  - `outgoing({ chatId, toUserId })` places a bot-initiated call: the caller side owns room lifecycle, so the session creates the Janus room itself (mirroring the web client's params, tolerating 427 already-exists) and destroys it on close; `call:invite` goes out with a 60s ring timer — FCM's TTL is 60s and chat-central keeps ringing calls fresh for 90s, while the mobile app auto-ends its ring UI at 30s.
+  - That 30s device auto-end fires `call:end`, which previously tore down the room while a human was still walking to the phone — a late answer (44s in the live test) then joined a destroyed room and hung on "Connecting". `ended()` now ignores end events while the call is still ringing; the ring timer and `call:rejected` own that phase.
+  - Callers heard silence until they spoke first and read the call as dead. The session now speaks a greeting exactly once, when the first remote feed comes up — both directions ("Hey, it's Claudia…").
+  - Double-subscribe race fixed: the join response and the async publishers event both list the same feed, and while `attach()` was in flight the second frame passed the `has()` check and subscribed the feed twice, orphaning a PeerConnection (diagnosed 2026-07-30). The slot is now reserved before the first await.
+  - `call:accepted`/`call:rejected` are handled, and both call-test harnesses grew coverage (+45/+47 lines) for the outgoing flow, ring timeout, ignore-while-ringing, and greeting.
+- **Received videos and mobile uploads no longer save as `.bin`.** Telegram messages without a fileName (videos especially) and Kazee Media docs from mobile uploads (which often carry no fileName at all) fell through to the `.bin` fallback, so an mp4 landed on disk unplayable. Extension derivation is now tiered: fileName ext → transport hint (Telegram's `file_path`, which carries the real extension; Kazee's blob-URL pathname) → mimeType map (16 common types) → per-media-type default (video→.mp4, audio→.m4a/.ogg) → `.bin` only as the true last resort. Kazee documents that keep their original name get the derived extension appended when the name has none.
+- **TTS and STT become first-class agent capabilities, not just the voice-note reply path.** Fleet agents asked to produce a voice-over or transcribe a sent recording had nothing to reach for: they probed `open-claudia say --help` (which would have *spoken* "--help"), then tried direct gateway/vendor API calls and concluded "the key is missing" — correctly, because the provider subprocess is credential-stripped by design. Two new loopback verbs run in the credentialed bot process: `tts` (`open-claudia tts "<text>" --out <path> [--voice <id>]` — synthesize to a FILE without any chat send; extension picks the container, .ogg native / .mp3 / .wav transcoded; voice override reaches the gateway for cloned voices) and `transcribe` (`open-claudia transcribe <file>` — prints the transcript of any audio OR video file; `transcribeMedia` ffmpeg-normalizes to 16kHz mono wav first, which extracts video audio tracks and shrinks the gateway upload, then falls through the existing gateway → local-Whisper chain). No guardrail on `tts` because the artifact stays on local disk — the send verbs that could ship it carry their own R8 guard. A new "Speech services (TTS / STT)" system-prompt block — gated on real capability (`canSpeak()` / new `canTranscribe()`) — documents both plus `say`, and tells agents explicitly to never call the gateway or vendor APIs directly. `say`/`tts`/`transcribe` all answer `--help` now instead of synthesizing the flag. Regression chain: `test-speech-loopback.js` pins the loopback contract (empty text 400, no route 503, synth failure 500, relative/missing transcribe paths 400, empty transcript is a valid 200, auth 401) and the media mechanics (copy vs transcode by extension, mkdir -p, voice override in the gateway body, temp-wav cleanup, prompt-block presence). Verified live: a real gateway round-trip synthesized a sentence to mp3 and transcribed it back byte-identical.
+
 ## v3.2.0 — The employee batch: memory hygiene at write time, prospective memory, earned trust, and learning from the owner's judgment calls
 
 Three approved plans land together — memory adoption A1-A4 (from the TencentDB-Agent-Memory review), codegraph Phase 1, and employee capabilities C1-C6 — plus the Kazee group speaker-identity fix. Two rules hold throughout: **report-only where trust is involved** (nothing here grants, acts, or loosens an approval rule by itself), and **no new standing context cost** (everything injects only when already-matched content fires, or lands in the nightly dream summary).

package/bin/cli.js

@@ -278,6 +278,11 @@ switch (command) {
   }
 
   case "say": {
+    // Agents probe with --help before speaking; don't synthesize the flag.
+    if (args[1] === "--help" || args[1] === "-h") {
+      console.log('Usage: open-claudia say "<text>"\nSynthesize the text (TTS) and send it as a voice note to the current chat.\nTo synthesize to a file instead (voice-overs), use: open-claudia tts "<text>" --out <path>');
+      process.exit(0);
+    }
     const text = args.slice(1).join(" ").trim();
     if (!text) {
       console.error('Usage: open-claudia say "<text>"');
@@ -299,6 +304,90 @@ switch (command) {
     break;
   }
 
+  case "tts": {
+    if (args[1] === "--help" || args[1] === "-h") {
+      console.log('Usage: open-claudia tts "<text>" [--out <path>.ogg|.mp3|.wav] [--voice <id>]\nSynthesize speech to a FILE without sending it to chat (voice-overs, narration).\nThe extension picks the container; prints the final path. Omit --out for a temp .ogg.');
+      process.exit(0);
+    }
+    const rest = args.slice(1);
+    let out = null;
+    let voice = null;
+    const textParts = [];
+    for (let i = 0; i < rest.length; i++) {
+      if (rest[i] === "--out") out = rest[++i];
+      else if (rest[i] === "--voice") voice = rest[++i];
+      else textParts.push(rest[i]);
+    }
+    const text = textParts.join(" ").trim();
+    if (!text) {
+      console.error('Usage: open-claudia tts "<text>" [--out <path>.ogg|.mp3|.wav] [--voice <id>]');
+      process.exit(2);
+    }
+    (async () => {
+      // Like `say`, synthesis happens in the credentialed bot process — this CLI
+      // has no speech token. The bot writes the file and returns its path.
+      const { postJson } = require("./loopback-client");
+      try {
+        const res = await postJson("tts", {
+          text,
+          out: out ? path.resolve(out) : undefined,
+          voice: voice || undefined,
+        });
+        console.log(res.path);
+        process.exit(0);
+      } catch (e) {
+        console.error(e.message);
+        process.exit(1);
+      }
+    })();
+    break;
+  }
+
+  case "transcribe": {
+    if (args[1] === "--help" || args[1] === "-h") {
+      console.log("Usage: open-claudia transcribe <audio-or-video-file>\nSpeech-to-text: prints the transcript. Accepts audio (ogg/mp3/m4a/wav) and video\n(mp4/mkv — the audio track is extracted automatically).");
+      process.exit(0);
+    }
+    const filePath = String(args[1] || "").trim();
+    if (!filePath) {
+      console.error("Usage: open-claudia transcribe <audio-or-video-file>");
+      process.exit(2);
+    }
+    const abs = path.resolve(filePath);
+    if (!fs.existsSync(abs)) {
+      console.error(`File not found: ${abs}`);
+      process.exit(2);
+    }
+    (async () => {
+      const { postJson } = require("./loopback-client");
+      try {
+        const res = await postJson("transcribe", { path: abs });
+        console.log(res.text || "");
+        process.exit(0);
+      } catch (e) {
+        console.error(e.message);
+        process.exit(1);
+      }
+    })();
+    break;
+  }
+
+  case "call": {
+    (async () => {
+      const { postJson } = require("./loopback-client");
+      try {
+        const toUserId = String(args[1] || "").trim();
+        const res = await postJson("call", toUserId ? { toUserId } : {});
+        console.log(`Calling: room=${res.roomId} chat=${res.chatId} to=${res.toUserId}`);
+        process.exit(0);
+      } catch (e) {
+        console.error(e.message);
+        process.exit(1);
+      }
+    })();
+    break;
+  }
+
   case "tw":
   case "transcript-window": {
     require("./transcript-window").run(args.slice(1));
@@ -474,6 +563,10 @@ Send tools (only work inside an active bot-spawned task):
   open-claudia send-photo <path> [caption]
   open-claudia send-voice <path>
   open-claudia say "<text>"          Synthesize the text (TTS) and send it as a voice note
+  open-claudia tts "<text>" --out <path>     Synthesize to a FILE without sending (voice-overs,
+                                             narration; ext picks format; --voice <id> optional)
+  open-claudia transcribe <file>     Speech-to-text: print the transcript of an audio/video file
+  open-claudia call [toUserId]       Place a live voice call on the current channel (kazee; owner-only)
 
 Memory tools:
   open-claudia transcript-search <query>     Ranked FTS5 search over indexed transcripts
@@ -495,7 +588,7 @@ Background work (only inside an active bot-spawned task):
   open-claudia cron-add "<sched>" "<prompt>"       Recurring; each fire uses your current provider/model selection
   open-claudia cron-list                           List all wakeups + crons on this channel
   open-claudia cron-remove <id>                    Remove a scheduled job
-  open-claudia watch-add "<check>" "<prompt>"      Silent monitor: poll a shell check, wake only when it exits 0
+  open-claudia watch-add "<check>" "<prompt>"      Silent monitor: poll a shell check, wake when it exits 0 or on --timeout expiry (default 2h)
   open-claudia watch-list                          List watches on this channel + master switch state
   open-claudia watch-remove <id>                   Remove a watch
   open-claudia watch-on | watch-off                Global master switch for all watches (owner)

package/bin/schedule.js

@@ -16,11 +16,15 @@ Crons (recurring):
   open-claudia cron-remove <id>                  # remove by id from cron-list
 
 Watches (silent background monitor — polls a shell check, wakes you only on a hit):
-  open-claudia watch-add "<check-cmd>" "<wake-prompt>" [--label "<label>"] [--every "<cron>"] [--repeat]
+  open-claudia watch-add "<check-cmd>" "<wake-prompt>" [--label "<label>"] [--every "<cron>"] [--repeat] [--timeout <when>]
     <check-cmd>: a shell command polled on a schedule (default every minute).
                  exit 0 = condition met → wake the agent with <wake-prompt>.
                  non-zero = still idle → nothing happens, nothing hits the chat.
     --repeat: keep polling after it fires (default: fire once, then remove).
+    --timeout: how long to keep polling — a duration (90m, 6h, 1d) or ISO
+               datetime. Default 2h. A watch that reaches its timeout without
+               the check ever passing FIRES anyway on the next poll, with the
+               prompt marked "Watch expired" — no watch can end silently.
   open-claudia watch-list                        # watches on this channel + master switch state
   open-claudia watch-remove <id>                 # remove a watch by id
   open-claudia watch-on / watch-off              # global master switch for ALL watches (owner)
@@ -141,18 +145,29 @@ async function runWatchAdd(args) {
   const label = takeFlag(rest, "label");
   const schedule = takeFlag(rest, "every");
   const project = takeFlag(rest, "project");
+  const timeout = takeFlag(rest, "timeout");
   const repeatIdx = rest.indexOf("--repeat");
   const repeat = repeatIdx >= 0;
   if (repeat) rest.splice(repeatIdx, 1);
+  let expiresAt = null;
+  if (timeout !== null) {
+    expiresAt = parseWhen(timeout);
+    if (!expiresAt) {
+      console.error(`Could not parse --timeout: "${timeout}". Use a duration (90m, 6h, 1d) or ISO datetime.`);
+      process.exit(2);
+    }
+  }
   const check = rest[0];
   const prompt = rest.slice(1).join(" ");
-  if (!check || !prompt) { console.error("Usage: watch-add \"<check-cmd>\" \"<wake-prompt>\" [--every \"<cron>\"] [--repeat]"); process.exit(2); }
+  if (!check || !prompt) { console.error("Usage: watch-add \"<check-cmd>\" \"<wake-prompt>\" [--every \"<cron>\"] [--repeat] [--timeout <when>]"); process.exit(2); }
   try {
     const request = { check, prompt, repeat, label: label || prompt.slice(0, 60) };
     if (schedule) request.schedule = schedule;
     if (project) request.project = project;
+    if (expiresAt) request.expiresAt = expiresAt;
     const res = await postJson("watch-add", request);
-    console.log(`Added watch ${res.job.id} (${repeat ? "repeating" : "one-shot"}, polls "${res.job.schedule}"). Silent until the check passes.`);
+    const expiry = res.job.expiresAt ? `, expires ${new Date(res.job.expiresAt).toISOString()}` : "";
+    console.log(`Added watch ${res.job.id} (${repeat ? "repeating" : "one-shot"}, polls "${res.job.schedule}"${expiry}). Silent until the check passes; fires as "Watch expired" if the timeout lapses first.`);
     process.exit(0);
   } catch (e) { console.error(e.message); process.exit(1); }
 }
@@ -165,7 +180,12 @@ async function runWatchList() {
     if (list.length === 0) { console.log("No watches on this channel."); process.exit(0); }
     for (const w of list) {
       const mode = w.repeat ? "repeating" : "one-shot";
-      console.log(`${w.id}  ${mode}  polls "${w.schedule}"  check: ${w.check}  → ${w.label || "(no label)"}`);
+      const expiry = Number(w.expiresAt) > 0
+        ? (Date.now() >= Number(w.expiresAt)
+          ? "  EXPIRED (fires on next poll)"
+          : `  expires ${new Date(Number(w.expiresAt)).toISOString()}`)
+        : "  no expiry (pre-timeout watch)";
+      console.log(`${w.id}  ${mode}  polls "${w.schedule}"${expiry}  check: ${w.check}  → ${w.label || "(no label)"}`);
     }
     process.exit(0);
   } catch (e) { console.error(e.message); process.exit(1); }

package/channels/kazee/adapter.js

@@ -23,6 +23,28 @@ const CONTEXT_MAX_MESSAGES = 40;
 const CONTEXT_BODY_LIMIT = 280;
 const COLD_START_WINDOW = 15;
 
+// Kazee Media docs from mobile uploads often carry no fileName, so the saved
+// extension must come from the mimeType (or the blob URL) — otherwise every
+// video/document lands on disk as ".bin".
+const MIME_EXT = {
+  "video/mp4": ".mp4",
+  "video/quicktime": ".mov",
+  "video/webm": ".webm",
+  "video/x-matroska": ".mkv",
+  "audio/mpeg": ".mp3",
+  "audio/mp4": ".m4a",
+  "audio/x-m4a": ".m4a",
+  "audio/aac": ".aac",
+  "audio/ogg": ".ogg",
+  "audio/wav": ".wav",
+  "image/jpeg": ".jpg",
+  "image/png": ".png",
+  "image/gif": ".gif",
+  "image/webp": ".webp",
+  "application/pdf": ".pdf",
+  "application/zip": ".zip",
+};
+
 class KazeeAdapter {
   constructor({ id = "kazee", url, token, ownerUserId, botUserId }) {
     this.id = id;
@@ -600,10 +622,22 @@ class KazeeAdapter {
   async downloadMedia(media) {
     if (!media || !media.fileId) return null;
     const url = media.fileId; // Kazee passes the cloud URL through fileId.
-    const ext = path.extname(media.fileName || "") || (media.type === "voice" ? ".ogg" : media.type === "photo" ? ".jpg" : ".bin");
+    let urlExt = "";
+    try { urlExt = path.extname(new URL(url).pathname); } catch (e) {}
+    const mime = (media.mimeType || "").toLowerCase().split(";")[0].trim();
+    const ext = path.extname(media.fileName || "")
+      || urlExt
+      || MIME_EXT[mime]
+      || (media.type === "voice" ? ".ogg"
+        : media.type === "photo" ? ".jpg"
+        : media.type === "video" ? ".mp4"
+        : media.type === "audio" ? ".m4a"
+        : ".bin");
     const baseDir = media.type === "document" ? FILES_DIR : TEMP_DIR;
-    const localPath = media.type === "document" && media.fileName
-      ? path.join(baseDir, media.fileName)
+    const keepName = media.type === "document" && media.fileName;
+    const nameSuffix = keepName && !path.extname(media.fileName) && ext !== ".bin" ? ext : "";
+    const localPath = keepName
+      ? path.join(baseDir, media.fileName + nameSuffix)
       : path.join(baseDir, `kz-${Date.now()}${ext}`);
     await this._downloadUrl(url, localPath);
     return localPath;

package/channels/kazee/call/manager.js

@@ -8,6 +8,16 @@ const DEFAULT_ICE_SERVERS = [
   { urls: "stun:coturn.kazee.africa:3478" },
   { urls: "stun:stun.l.google.com:19302" },
 ];
+// FCM push TTL is 60s and chat-central treats ringing logs as fresh for 90s.
+// Must comfortably outlast the mobile client's own 30s ring timeout: a callee
+// device auto-ends at 30s, the human then answers late, and chat-central
+// revives the CallLog — the room has to still exist when that answer lands
+// (first live outbound test 2026-08-08: end at 30s, real answer at 44s).
+const RING_TIMEOUT_MS = 60_000;
+const OUTGOING_GREETING = "Hey, it's Claudia. Can you hear me okay?";
+// Inbound must greet too: callers get silence until they speak first, which
+// reads as a dead call (live test 2026-08-08 — media was up, caller hung up).
+const INCOMING_GREETING = "Hey, it's Claudia — you're through. Can you hear me?";
 
 class KazeeCallManager {
   constructor({ adapter, SessionImpl = KazeeCallSession, janusUrl = process.env.KAZEE_JANUS_URL || DEFAULT_JANUS_URL,
@@ -17,12 +27,45 @@ class KazeeCallManager {
     this.janusUrl = janusUrl;
     this.iceServers = iceServers;
     this.session = null;
+    this._ringTimer = null;
   }
 
   wire(socket) {
     socket.on("call:incoming", (payload) => this.incoming(payload));
     socket.on("call:ended", (payload) => this.ended(payload));
-    socket.on("call:rejected", (payload) => this.ended(payload));
+    socket.on("call:rejected", (payload) => this.rejected(payload));
+    socket.on("call:accepted", (payload) => this.accepted(payload));
+    socket.on("call:ringing", (payload) => {
+      if (this.session) console.log(`Kazee call ringing: chat=${String(payload?.chatId || "")}`);
+    });
+  }
+
+  // Janus signalling always worked; the media leg never did — the hardcoded
+  // default is STUN-only, and behind NAT only a TURN relay yields a workable
+  // candidate pair (zero RTP ever arrived, 2026-07-30). chat-central mints
+  // TURN credentials at /webrtc/config — the same endpoint the web and mobile
+  // clients use. werift's ICE stack is UDP-only, so tcp/tls variants are
+  // filtered out before they can break candidate gathering.
+  async _fetchIceServers() {
+    if (typeof this.adapter?._request !== "function") return this.iceServers;
+    try {
+      const res = await this.adapter._request("GET", "/webrtc/config");
+      const fetched = Array.isArray(res?.config?.iceServers) ? res.config.iceServers : [];
+      const usable = fetched.filter((server) => {
+        const url = String(Array.isArray(server.urls) ? server.urls[0] : server.urls || "");
+        if (url.startsWith("stun:")) return true;
+        return url.startsWith("turn:") && !url.includes("transport=tcp");
+      });
+      const turns = usable.filter((s) => String(Array.isArray(s.urls) ? s.urls[0] : s.urls).startsWith("turn:")).length;
+      if (turns > 0) {
+        console.log(`Kazee call ICE config: ${usable.length} servers (${turns} TURN) from /webrtc/config`);
+        return usable;
+      }
+      console.warn("Kazee call ICE config: /webrtc/config returned no usable TURN entry, using defaults");
+    } catch (error) {
+      console.error(`Kazee call ICE config fetch failed, using defaults: ${error.message}`);
+    }
+    return this.iceServers;
   }
 
   async incoming(payload = {}) {
@@ -44,9 +87,10 @@ class KazeeCallManager {
     if (callType !== "audio") return reject("unsupported_media");
     if (this.session) return reject("busy");
 
+    const iceServers = await this._fetchIceServers();
     const session = new this.SessionImpl({
       roomId, chatId, callerId, botUserId: this.adapter.botUserId,
-      janusUrl: this.janusUrl, iceServers: this.iceServers,
+      janusUrl: this.janusUrl, iceServers, greeting: INCOMING_GREETING,
       onTranscript: (text, meta) => this._transcript(text, payload, meta),
       onEnded: () => { if (this.session === session) this.session = null; },
     });
@@ -65,6 +109,70 @@ class KazeeCallManager {
     }
   }
 
+  // Bot-initiated call. Mirrors what a human caller's client does: create the
+  // Janus room, publish into it, then emit call:invite so chat-central rings
+  // the callee (socket + FCM/VoIP push). The callee's publisher appearing in
+  // the room is what completes the media leg — the existing auto-subscribe in
+  // the session handles that, so acceptance needs no extra media work here.
+  async outgoing({ chatId, toUserId } = {}) {
+    const target = String(toUserId || this.adapter.ownerUserId || "");
+    const chat = String(chatId || "");
+    if (!target || !chat) throw new Error("missing chatId/toUserId");
+    if (this.session) throw new Error("busy: a call session is already active");
+    if (!this.adapter._socket?.connected) throw new Error("kazee socket is not connected");
+    const roomId = Math.floor(Math.random() * 1e9);
+    const iceServers = await this._fetchIceServers();
+    // _transcript() reads chatId/fromUserId/roomId off the inbound invite
+    // payload; for outbound the remote human is the "from" side.
+    const remote = { chatId: chat, fromUserId: target, roomId, fromUserName: "" };
+    const session = new this.SessionImpl({
+      roomId, chatId: chat, callerId: target, botUserId: this.adapter.botUserId,
+      janusUrl: this.janusUrl, iceServers, asCaller: true, greeting: OUTGOING_GREETING,
+      onTranscript: (text, meta) => this._transcript(text, remote, meta),
+      onEnded: () => {
+        this._clearRingTimer();
+        if (this.session === session) this.session = null;
+      },
+    });
+    this.session = session;
+    try {
+      await session.start();
+    } catch (error) {
+      this.session = null;
+      await session.close("connect-failed").catch(() => {});
+      throw error;
+    }
+    console.log(`Kazee call outgoing: room=${roomId} chat=${chat} to=${target}`);
+    this.adapter._socket.emit("call:invite", { toUserId: target, callType: "audio", chatId: chat, roomId });
+    this._ringTimer = setTimeout(() => {
+      this._ringTimer = null;
+      this._ringTimeout(target, chat, roomId).catch((error) => console.error("Kazee call ring timeout:", error.message));
+    }, RING_TIMEOUT_MS);
+    if (typeof this._ringTimer.unref === "function") this._ringTimer.unref();
+    return { roomId, chatId: chat, toUserId: target };
+  }
+
+  accepted(payload = {}) {
+    if (!this.session || !this._ringTimer) return;
+    console.log(`Kazee call answered: room=${this.session.roomId} chat=${String(payload.chatId || "")}`);
+    this._clearRingTimer();
+  }
+
+  async _ringTimeout(toUserId, chatId, roomId) {
+    const session = this.session;
+    if (!session || session.roomId !== roomId) return;
+    console.log(`Kazee call unanswered: room=${roomId} to=${toUserId}`);
+    // Caller hanging up while ringing: chat-central finalizes the CallLog as
+    // missed and dismisses the callee's ringing UI/push.
+    this.adapter._socket?.emit("call:end", { toUserId, chatId });
+    this.session = null;
+    await session.close("no-answer").catch(() => {});
+  }
+
+  _clearRingTimer() {
+    if (this._ringTimer) { clearTimeout(this._ringTimer); this._ringTimer = null; }
+  }
+
   _transcript(text, incoming, meta = {}) {
     const session = this.session;
     if (!session || !text) return;
@@ -106,11 +214,29 @@ class KazeeCallManager {
   async ended(payload = {}) {
     if (!this.session) return;
     if (payload.roomId != null && Number(payload.roomId) !== this.session.roomId) return;
+    // While our outbound ring is live, a call:ended is usually a callee DEVICE
+    // giving up (mobile auto-ends its ring at 30s), not the human declining.
+    // chat-central revives the CallLog if they answer late, so the caller must
+    // keep the room alive until its own ring timeout — tearing down here left
+    // the late answer joining a destroyed room, stuck on "Connecting" (2026-08-08).
+    // A deliberate decline arrives as call:rejected and still closes.
+    if (this._ringTimer) {
+      console.log(`Kazee call ignoring ended-while-ringing: room=${this.session.roomId}`);
+      return;
+    }
     const session = this.session;
     this.session = null;
     await session.close("remote-ended");
   }
 
+  async rejected(payload = {}) {
+    if (!this.session) return;
+    if (payload.roomId != null && Number(payload.roomId) !== this.session.roomId) return;
+    const session = this.session;
+    this.session = null;
+    await session.close("remote-rejected");
+  }
+
   async stop() {
     if (!this.session) return;
     const session = this.session;

package/channels/kazee/call/session.js

@@ -55,12 +55,16 @@ const THINK_TICK_PCM48 = tonePcm48([{ freq: 520, ms: 90 }], 0.045);
 
 class KazeeCallSession {
   constructor({ roomId, chatId, callerId, botUserId, janusUrl, iceServers = [], onTranscript, onEnded,
-    maxCallMs, idleMs, synthesize = synthesizePcm,
+    maxCallMs, idleMs, synthesize = synthesizePcm, asCaller = false, greeting = null,
     JanusClientImpl = JanusClient, PeerConnectionImpl = RTCPeerConnection, SpeechStreamImpl = SpeechStream } = {}) {
     this.roomId = Number(roomId);
     this.chatId = String(chatId);
     this.callerId = String(callerId);
     this.botUserId = String(botUserId);
+    this.asCaller = !!asCaller;
+    this.greeting = greeting ? String(greeting) : null;
+    this._greeted = false;
+    this._createdRoom = false;
     this.janus = new JanusClientImpl({ url: janusUrl });
     this.PeerConnectionImpl = PeerConnectionImpl;
     this.SpeechStreamImpl = SpeechStreamImpl;
@@ -97,6 +101,24 @@ class KazeeCallSession {
     await this.janus.connect();
     this.publisherHandle = await this.janus.attach();
     this.janus.onHandle(this.publisherHandle, (frame) => this._onPublisherEvent(frame));
+    if (this.asCaller) {
+      // Outbound: the caller side owns room lifecycle, mirroring the web
+      // client's create params (audio-only, so no videocodec).
+      const created = await this.janus.message(this.publisherHandle, {
+        request: "create", room: this.roomId, publishers: 6, audiocodec: "opus",
+        description: `Call room ${this.roomId}`, permanent: false,
+        // Hidden from videoroom "list": the control plane is internet-reachable,
+        // so a listable room is eavesdroppable. Join-by-roomId is unaffected.
+        is_private: true,
+      });
+      const cdata = created?.plugindata?.data || {};
+      const exists = Number(cdata.error_code) === 427 || /already exists/i.test(String(cdata.error || ""));
+      if (cdata.videoroom !== "created" && !exists) {
+        throw new Error(cdata.error || "Janus room create failed");
+      }
+      this._createdRoom = true;
+      clog(`Kazee call room created: room=${this.roomId}`);
+    }
     // The caller creates the Janus room during its own call setup, which can
     // land a beat after the invite reaches us — and a bot answers faster than
     // any human. Poll join through transient 426 "No such room" like the web
@@ -163,31 +185,47 @@ class KazeeCallSession {
   }
 
   async _subscribe(feedId, display) {
+    if (this.subscribers.has(feedId)) return;
+    // Reserve the slot before the first await: the join response and the async
+    // publishers event both list the same feed, and while attach() is in
+    // flight the second frame passes the caller's has() check and subscribes
+    // this feed twice, orphaning a PeerConnection (diagnosed 2026-07-30).
+    this.subscribers.set(feedId, null);
     clog(`Kazee call subscribing: feed=${feedId} display=${String(display || "")}`);
-    const handle = await this.janus.attach();
-    const pc = new this.PeerConnectionImpl({ iceServers: this.iceServers });
-    pc.iceConnectionStateChange?.subscribe?.((state) => clog(`Kazee call subscriber ICE: ${state} feed=${feedId}`));
-    const sub = {
-      handle,
-      pc,
-      display: String(display || ""),
-      // Opus decoders are stateful, so each feed needs its own.
-      codec: new OpusAudioCodec(),
-      vad: new TurnDetector({ thresholdDb: BASE_THRESHOLD_DB }),
-      stt: new this.SpeechStreamImpl({ onTranscript: (text) => this._onFeedTranscript(feedId, text) }),
-      prebuffer: [],
-    };
-    this.subscribers.set(feedId, sub);
-    pc.onTrack.subscribe((track) => {
-      if (track.kind === "audio") track.onReceiveRtp.subscribe((packet) => this._onFeedRtp(feedId, packet));
-    });
-    this.janus.onHandle(handle, (frame) => this._onSubscriberEvent(feedId, frame));
-    const attached = await this.janus.message(handle, { request: "join", ptype: "subscriber", room: this.roomId, feed: feedId });
-    await this._consumeSubscriberFrame(feedId, attached);
-    await sub.stt.connect().then(
-      () => clog(`Kazee call STT connected: feed=${feedId}`),
-      (error) => console.error("Kazee call STT connect:", error.message),
-    );
+    try {
+      const handle = await this.janus.attach();
+      const pc = new this.PeerConnectionImpl({ iceServers: this.iceServers });
+      pc.iceConnectionStateChange?.subscribe?.((state) => clog(`Kazee call subscriber ICE: ${state} feed=${feedId}`));
+      const sub = {
+        handle,
+        pc,
+        display: String(display || ""),
+        // Opus decoders are stateful, so each feed needs its own.
+        codec: new OpusAudioCodec(),
+        vad: new TurnDetector({ thresholdDb: BASE_THRESHOLD_DB }),
+        stt: new this.SpeechStreamImpl({ onTranscript: (text) => this._onFeedTranscript(feedId, text) }),
+        prebuffer: [],
+      };
+      this.subscribers.set(feedId, sub);
+      pc.onTrack.subscribe((track) => {
+        if (track.kind === "audio") track.onReceiveRtp.subscribe((packet) => this._onFeedRtp(feedId, packet));
+      });
+      this.janus.onHandle(handle, (frame) => this._onSubscriberEvent(feedId, frame));
+      const attached = await this.janus.message(handle, { request: "join", ptype: "subscriber", room: this.roomId, feed: feedId });
+      await this._consumeSubscriberFrame(feedId, attached);
+      await sub.stt.connect().then(
+        () => clog(`Kazee call STT connected: feed=${feedId}`),
+        (error) => console.error("Kazee call STT connect:", error.message),
+      );
+      // First remote feed up = both media legs established; greet exactly once.
+      if (this.greeting && !this._greeted) {
+        this._greeted = true;
+        this.speak(this.greeting).catch((error) => console.error("Kazee call greeting:", error.message));
+      }
+    } catch (error) {
+      if (this.subscribers.get(feedId) === null) this.subscribers.delete(feedId);
+      throw error;
+    }
   }
 
   async _onSubscriberEvent(feedId, frame) {
@@ -403,6 +441,9 @@ class KazeeCallSession {
     this._stopThinking();
     this.cancelSpeech();
     for (const feed of [...this.subscribers.keys()]) await this._removeSubscriber(feed);
+    if (this._createdRoom) {
+      try { await this.janus.message(this.publisherHandle, { request: "destroy", room: this.roomId }); } catch (_) {}
+    }
     try { await this.publisher?.pc?.close(); } catch (_) {}
     try { await this.janus.detach(this.publisherHandle); } catch (_) {}
     try { await this.janus.close(); } catch (_) {}

package/channels/kazee/socket.js

@@ -5,6 +5,8 @@ let io;
 try { io = require("socket.io-client").io; }
 catch (e) { io = null; }
 
+const { wireTerminalReconnect } = require("../../core/socket-reconnect");
+
 function createKazeeSocket({ url, token, userId, onConnect, onDisconnect, onError }) {
   if (!io) {
     throw new Error("socket.io-client is not installed. Run `npm install` to install dependencies.");
@@ -22,6 +24,7 @@ function createKazeeSocket({ url, token, userId, onConnect, onDisconnect, onErro
   socket.on("connect", () => { if (onConnect) onConnect(socket); });
   socket.on("disconnect", (reason) => { if (onDisconnect) onDisconnect(reason); });
   socket.on("connect_error", (err) => { if (onError) onError(err); });
+  wireTerminalReconnect(socket, { label: `kazee socket (${url})` });
   return socket;
 }
 

package/channels/spaces/socket.js

@@ -14,6 +14,8 @@ let io;
 try { io = require("socket.io-client").io; }
 catch (e) { io = null; }
 
+const { wireTerminalReconnect } = require("../../core/socket-reconnect");
+
 function createSpacesSocket({ url, token, onNotification, onConnect, onDisconnect, onError }) {
   if (!io) {
     throw new Error("socket.io-client is not installed. Run `npm install` to install dependencies.");
@@ -34,6 +36,7 @@ function createSpacesSocket({ url, token, onNotification, onConnect, onDisconnec
       catch (e) { console.error("spaces notification handler:", e.message); }
     }
   });
+  wireTerminalReconnect(socket, { label: `spaces socket (${url})` });
   return socket;
 }