@inetafrica/open-claudia 3.2.1 → 3.3.1

package/CHANGELOG.md

@@ -1,5 +1,32 @@
 # Changelog
 
+## v3.3.1 — Message length can no longer kill the voice: chunked pocket TTS (re-cut carrying unpublished v3.3.0)
+
+- **Long voice notes died at 60 seconds of synthesis.** `pocketToVoice` sent the ENTIRE cleaned text to the speech gateway as one request under `AbortSignal.timeout(60000)`. A long reply blew that window, the pocket route returned null, and on pods the fallback chain has nowhere to go (no ElevenLabs key, no macOS `say`) — so `say` bounced with "no TTS route available" and agents improvised manual per-paragraph chunking (sales-bot, 2026-08-19). Long text is now sentence-packed into ≤450-char chunks (`chunkForTTS`; run-on sentences hard-split at word boundaries so nothing can recreate the timeout), each chunk synthesized in its own 120s window with one retry (a transient gateway blip no longer wastes the chunks already done), and the wavs concatenated via ffmpeg's concat demuxer into ONE ogg/opus. Short text keeps the exact single-request behavior. Benefits every consumer of `textToVoice`/`textToVoiceFile`: `say`, `tts`, and whole voice-note replies; the voice channel's streamed per-sentence path is untouched. Regression pinned in `test-speech-loopback.js`: multiple gateway calls each inside the pack limit, same voice across chunks, lossless reassembly, temp cleanup, and chunker unit coverage.
+- **Why this is 3.3.1 and not 3.3.0:** the v3.3.0 release commit bumped `package.json` but not the release-guard pin (and skipped this changelog), so the tag's build job failed its own `npm test` — npm still served 3.2.3 and no fleet image was adopted. Never retag a failed version — re-cut as +1, pin repaired here.
+- **Also ships (committed since 3.2.3):** the v3.3.0 verify-contact batch (below) and the Kazee calls batch — trickle ICE consumption (calls died with both legs stuck ICE-checking), streaming TTS playback (~3s faster to first byte) with per-voice greeting/goodbye PCM cache, hybrid word-guarded turn-end VAD, `call:ringing` on invite with publish deferred until the caller's feed is up, and werift ICE unhandled-rejection suppression.
+
+## v3.3.0 — Never published (build failed on a stale release-guard pin); content ships in v3.3.1
+
+- **An unverified contact stays unverified until the owner says otherwise.** `ensureContact` keeps minting fresh unverified stubs (never link-by-name — names are claimable); the owner gets the explicit act that closes the loop: a "Verify contact…" button on escalation cards and `/people verify [link <slug>]`, both living ONLY on chat-envelope surfaces the agent cannot forge. Verification settles identity, never trust — mandates and relationship upgrades stay separate owner grants; retired stubs rename to `.superseded`, not deleted.
+- **Three holes from the same audit, closed and pinned by tests:** `callerIsOwner` trusted the CLI's claimed canonicalUserId (forgeable env) → owner-gated loopback kinds now require a per-boot HMAC attest minted by the runner at spawn; `recent`-fetch let a guarded external turn read other channels' transcripts → default-deny; `relay-send` let a guarded turn message third parties as the bot → a guarded requester may relay only to the owner.
+
+## v3.2.3 — No watch can end silently: every watch carries a timeout that fires as a wake-up
+
+- **The silent-failure hole in watches.** A watch whose check never exits 0 polled forever without a sound — if the watched thing hung, was misconfigured (the unauthenticated-`glab` watch from 2026-08-12 would never have fired), or simply never happened, the agent slept through it and the user had to notice the silence themselves. The working pattern was to pair every watch with a manual backup wakeup; that safety net is now built in.
+- **Every new watch gets a hard expiry.** `watch-add` grows `--timeout <duration|ISO>` (90m, 6h, 1d, or an ISO datetime), default **2h**, stamped as `expiresAt` on the job. On the first poll tick at or past the deadline where the check *still* fails, the watch FIRES anyway: the woken prompt opens with `[Watch expired ...]` plus an explicit "the watched condition did NOT happen — this is a deadline wake-up, not a trigger" brief, and the chat advisory reads `⏰ Watch "label" timed out without triggering — waking anyway`. A check that passes exactly on the deadline tick still reports as a normal trigger.
+- **Expiry ends the watch's window.** An expiry fire is one-shot even for `--repeat` watches (the woken agent re-arms if still wanted), and the expiry mark is persisted so a failed expiry fire retries with the same semantics across restarts — while a retry whose condition came true in the meantime reports as a real trigger, not an expiry. `watch-list` now shows each watch's expiry (or `EXPIRED (fires on next poll)`); the global `/watch off` master switch still pauses everything, expiry included, until re-enabled.
+- **Backward compatible by choice.** Watches persisted before this release carry no `expiresAt` and keep their old poll-forever semantics rather than being retro-expired on upgrade (a pre-upgrade watch older than the default would otherwise fire the instant the bot restarts). `watch-list` flags these as `no expiry (pre-timeout watch)`.
+- Regression coverage in `test-provider-scheduler.js`: future-expiry idle stays silent, lapsed-expiry fire (header, brief, advisory, removal despite `--repeat`), deadline-tick pass is a trigger, default and explicit expiry stamping, and static end-to-end wiring (scheduler default → loopback passthrough → CLI flag).
+
+## v3.2.2 — The chip thinks from first contact, keeps thinking through the tools, and the dedup gate actually runs
+
+- **The dead minute before the chip appeared.** The typing heartbeat only started inside `executeAdmittedRun` — but a turn-bound message first crosses the enforcer's inbound triage (an LLM call), and voice notes add a media download plus STT before that. All of it ran with zero presence: on a slow triage the chat sat silent looking ignored, then "thinking" popped up long after the work had begun. The router now starts the heartbeat the moment a turn-bound message arrives (`startPreTurnTyping` in all five inbound handlers — text, voice, audio, photo, document), covering triage, download, and transcription. Non-turn traffic (wizards, vault prompts, credential pastes, commands) never shows a false chip because the start sits after those gates.
+- **The chip decayed to a stale "typing" during tool work.** Any `tool_start` permanently cleared `thinkingPhase`, so from the first tool call onward every 4s tick sent a stateless `typing:start` — clients rendered "typing…" through minutes of tool execution, and "thinking" never came back within a turn. Terminal and text events (`text_delta`, `text_final`, `result`, `error`) still end the thinking phase, but `tool_start` now re-enters it: streaming text reads as "typing", tool stretches read as "thinking" — which is what they are. (Kazee mobile renders a stateless tick as "typing" and auto-clears 5s after the last tick, so the 4s cadence keeps the chip alive and the state accurate on old and new clients alike.)
+- **Handoff without a scramble.** Two starts can now coexist safely: `startTypingHeartbeat` is a singleton per chat state — a new start supersedes the old interval, and every stopper is ownership-aware, acting only while its own interval is current. The router's pre-turn heartbeat hands off to the run's own heartbeat at `executeAdmittedRun` with no gap and no double interval; a stale stopper (a router `finally` after handoff, a superseded run) is a structural no-op. `/stop`, which clears the interval directly and thereby orphans the run's stopper, now emits the explicit `typing:stop` itself in both branches. `test-typing-heartbeat.js` joins the release chain: immediate thinking tick, supersede/ownership semantics, no orphaned timers across a full tick window, and the event-steering contract pinned.
+- **The journal dedup gate never actually ran.** v3.2.0's write-time dedup adjudicator (A1) calls its utility with `purpose: "dedup"` — a purpose `utility-policy` never registered, so every invocation died at validation with `INVALID_UTILITY_PURPOSE` and failed open, silently, by design. Log-proven on the local install. "dedup" is now a first-class purpose riding the review pipeline: `MEMORY_PROVIDER` steers it and `PACK_DEDUP_MODEL` is honored as its model override (both the prefix and the legacy Claude alias, matching what the adjudicator already passes). Pinned in `test-utility-provider-policy.js`.
+- **Not changed, on purpose:** the 5× duplicate voice notes from 2026-08-09 were client multi-tap creating *distinct* messages (fixed client-side in kazee-chat-mobile v3.25.23's optimistic-upload guard); the router's existing `isDuplicate` LRU already covers true socket redeliveries by message id, so no bot-side dedup was added.
+
 ## v3.2.1 — Speech as a general capability, sockets that survive rejection, and calls that greet back
 
 - **A rejected handshake no longer strands a bot forever.** socket.io-client permanently stops reconnecting when the *server* rejects a handshake (auth middleware `next(new Error())`): `connect_error` fires with `socket.active === false` and the manager never dials again. During the 2026-08-08 outage chat-central booted before Central's MongoDB and rejected every handshake for a few minutes — terminally stranding the whole bot fleet, pods "Running" but deaf until manually restarted. New `core/socket-reconnect.js` `wireTerminalReconnect()` watches for exactly that terminal state and drives a manual `connect()` with 2s→30s capped backoff; transport-level failures (where the manager retries on its own, `socket.active === true`) are left alone. A deliberate client-side `disconnect()` is intercepted — a wedged socket emits no event for it — and cancels retries until `connect()` re-arms them. Wired into both the kazee and spaces sockets; `test-socket-reconnect.js` joins the pretest chain.

package/bin/cli.js

@@ -588,7 +588,7 @@ Background work (only inside an active bot-spawned task):
   open-claudia cron-add "<sched>" "<prompt>"       Recurring; each fire uses your current provider/model selection
   open-claudia cron-list                           List all wakeups + crons on this channel
   open-claudia cron-remove <id>                    Remove a scheduled job
-  open-claudia watch-add "<check>" "<prompt>"      Silent monitor: poll a shell check, wake only when it exits 0
+  open-claudia watch-add "<check>" "<prompt>"      Silent monitor: poll a shell check, wake when it exits 0 or on --timeout expiry (default 2h)
   open-claudia watch-list                          List watches on this channel + master switch state
   open-claudia watch-remove <id>                   Remove a watch
   open-claudia watch-on | watch-off                Global master switch for all watches (owner)

package/bin/loopback-client.js

@@ -43,6 +43,9 @@ function context() {
     adapterId: process.env.OC_CHANNEL_ADAPTER,
     userId: process.env.OC_CHANNEL_USER_ID || null,
     canonicalUserId: process.env.OC_CANONICAL_USER_ID || null,
+    // Runner-minted HMAC binding canonicalUserId to what the bot stamped for
+    // this turn; the loopback's owner gates verify it (see core/speaker-attest).
+    speakerAttest: process.env.OC_SPEAKER_ATTEST || null,
     provider: process.env.OC_PROVIDER || null,
     providerSettings,
     project: process.env.OC_PROJECT || null,
@@ -76,6 +79,7 @@ function postJson(kind, body) {
     adapter: ctx.adapterId,
     userId: ctx.userId,
     canonicalUserId: ctx.canonicalUserId,
+    speakerAttest: ctx.speakerAttest,
     provider: ctx.provider,
     providerSettings: ctx.providerSettings,
     project: requestedProject,

package/bin/schedule.js

@@ -16,11 +16,15 @@ Crons (recurring):
   open-claudia cron-remove <id>                  # remove by id from cron-list
 
 Watches (silent background monitor — polls a shell check, wakes you only on a hit):
-  open-claudia watch-add "<check-cmd>" "<wake-prompt>" [--label "<label>"] [--every "<cron>"] [--repeat]
+  open-claudia watch-add "<check-cmd>" "<wake-prompt>" [--label "<label>"] [--every "<cron>"] [--repeat] [--timeout <when>]
     <check-cmd>: a shell command polled on a schedule (default every minute).
                  exit 0 = condition met → wake the agent with <wake-prompt>.
                  non-zero = still idle → nothing happens, nothing hits the chat.
     --repeat: keep polling after it fires (default: fire once, then remove).
+    --timeout: how long to keep polling — a duration (90m, 6h, 1d) or ISO
+               datetime. Default 2h. A watch that reaches its timeout without
+               the check ever passing FIRES anyway on the next poll, with the
+               prompt marked "Watch expired" — no watch can end silently.
   open-claudia watch-list                        # watches on this channel + master switch state
   open-claudia watch-remove <id>                 # remove a watch by id
   open-claudia watch-on / watch-off              # global master switch for ALL watches (owner)
@@ -141,18 +145,29 @@ async function runWatchAdd(args) {
   const label = takeFlag(rest, "label");
   const schedule = takeFlag(rest, "every");
   const project = takeFlag(rest, "project");
+  const timeout = takeFlag(rest, "timeout");
   const repeatIdx = rest.indexOf("--repeat");
   const repeat = repeatIdx >= 0;
   if (repeat) rest.splice(repeatIdx, 1);
+  let expiresAt = null;
+  if (timeout !== null) {
+    expiresAt = parseWhen(timeout);
+    if (!expiresAt) {
+      console.error(`Could not parse --timeout: "${timeout}". Use a duration (90m, 6h, 1d) or ISO datetime.`);
+      process.exit(2);
+    }
+  }
   const check = rest[0];
   const prompt = rest.slice(1).join(" ");
-  if (!check || !prompt) { console.error("Usage: watch-add \"<check-cmd>\" \"<wake-prompt>\" [--every \"<cron>\"] [--repeat]"); process.exit(2); }
+  if (!check || !prompt) { console.error("Usage: watch-add \"<check-cmd>\" \"<wake-prompt>\" [--every \"<cron>\"] [--repeat] [--timeout <when>]"); process.exit(2); }
   try {
     const request = { check, prompt, repeat, label: label || prompt.slice(0, 60) };
     if (schedule) request.schedule = schedule;
     if (project) request.project = project;
+    if (expiresAt) request.expiresAt = expiresAt;
     const res = await postJson("watch-add", request);
-    console.log(`Added watch ${res.job.id} (${repeat ? "repeating" : "one-shot"}, polls "${res.job.schedule}"). Silent until the check passes.`);
+    const expiry = res.job.expiresAt ? `, expires ${new Date(res.job.expiresAt).toISOString()}` : "";
+    console.log(`Added watch ${res.job.id} (${repeat ? "repeating" : "one-shot"}, polls "${res.job.schedule}"${expiry}). Silent until the check passes; fires as "Watch expired" if the timeout lapses first.`);
     process.exit(0);
   } catch (e) { console.error(e.message); process.exit(1); }
 }
@@ -165,7 +180,12 @@ async function runWatchList() {
     if (list.length === 0) { console.log("No watches on this channel."); process.exit(0); }
     for (const w of list) {
       const mode = w.repeat ? "repeating" : "one-shot";
-      console.log(`${w.id}  ${mode}  polls "${w.schedule}"  check: ${w.check}  → ${w.label || "(no label)"}`);
+      const expiry = Number(w.expiresAt) > 0
+        ? (Date.now() >= Number(w.expiresAt)
+          ? "  EXPIRED (fires on next poll)"
+          : `  expires ${new Date(Number(w.expiresAt)).toISOString()}`)
+        : "  no expiry (pre-timeout watch)";
+      console.log(`${w.id}  ${mode}  polls "${w.schedule}"${expiry}  check: ${w.check}  → ${w.label || "(no label)"}`);
     }
     process.exit(0);
   } catch (e) { console.error(e.message); process.exit(1); }

package/bot.js

@@ -207,7 +207,16 @@ process.on("uncaughtException", (err) => {
   try { persist(); } catch (e) {}
   setTimeout(() => process.exit(1), 2000);
 });
-process.on("unhandledRejection", (reason) => notifyError("Unhandled rejection", reason));
+process.on("unhandledRejection", (reason) => {
+  // werift's TURN/ICE client rejects STUN error responses (e.g. coturn 403s)
+  // uncaught; benign for the call itself, so keep them out of Telegram.
+  const stack = typeof reason?.stack === "string" ? reason.stack : "";
+  if (stack.includes("werift/lib/ice") || stack.includes("werift\\lib\\ice")) {
+    console.error("Unhandled rejection (werift ice, suppressed):", stack.split("\n").slice(0, 2).join(" | "));
+    return;
+  }
+  notifyError("Unhandled rejection", reason);
+});
 
 // ── Update checker ─────────────────────────────────────────────────
 

package/channels/kazee/call/audio.js

@@ -120,6 +120,84 @@ class TurnDetector {
   }
 }
 
+// A fixed threshold breaks in a noisy room: background keeps every frame
+// "loud", the silence rule never fires, and the turn only ends at the 30s cap
+// — 30 seconds of dead air. Tracking the running noise floor and sitting a
+// fixed margin above it keeps the silence rule alive at any steady background
+// level (jig-measured to hold to ~14dB SNR; below that only the recogniser's
+// word timeline can end a turn, which the session layers on top).
+class AdaptiveTurnDetector {
+  constructor({ marginDb = 12, windowFrames = 100, onsetFrames = 3, silenceMs = 700,
+    maxTurnMs = 30000, minThresholdDb = -50, bootstrapFrames = 40 } = {}) {
+    this.marginDb = marginDb;
+    this.windowFrames = windowFrames;
+    this.onsetFrames = onsetFrames;
+    this.minThresholdDb = minThresholdDb;
+    this.bootstrapFrames = bootstrapFrames;
+    this.silenceFrames = Math.ceil(silenceMs / FRAME_MS);
+    this.maxFrames = Math.ceil(maxTurnMs / FRAME_MS);
+    this.recent = [];
+    this.frames = 0;
+    // While the bot is speaking, device echo leaks back through the caller's
+    // mic; the session raises this so only clearly-louder audio counts.
+    this.boostTo = null;
+    this.reset();
+  }
+
+  reset() {
+    this.active = false;
+    this.loudFrames = 0;
+    this.quietFrames = 0;
+    this.turnFrames = 0;
+  }
+
+  _baseThreshold() {
+    const sorted = this.recent.filter(Number.isFinite).sort((a, b) => a - b);
+    if (sorted.length < 10) return this.minThresholdDb;
+    const floor = sorted[Math.floor(sorted.length * 0.1)];
+    return Math.max(this.minThresholdDb, floor + this.marginDb);
+  }
+
+  get thresholdDb() {
+    const base = this._baseThreshold();
+    return this.boostTo === null ? base : Math.max(base, this.boostTo);
+  }
+
+  push(pcm48k) {
+    const db = rmsDbfs(pcm48k);
+    this.frames += 1;
+    const base = this._baseThreshold();
+    // Bootstrap the floor from the opening of the call (the room is audible
+    // before anyone speaks), then keep it honest by sampling only frames that
+    // look like background — sampling the caller's own voice would raise the
+    // threshold above them and cut them off mid-word. The gate uses the
+    // un-boosted threshold so echo never pollutes the floor estimate.
+    if (this.frames <= this.bootstrapFrames || db < base) {
+      this.recent.push(db);
+      if (this.recent.length > this.windowFrames) this.recent.shift();
+    }
+    const loud = db >= (this.boostTo === null ? base : Math.max(base, this.boostTo));
+    if (!this.active) {
+      this.loudFrames = loud ? this.loudFrames + 1 : 0;
+      if (this.loudFrames >= this.onsetFrames) {
+        this.active = true;
+        this.quietFrames = 0;
+        this.turnFrames = this.loudFrames;
+        return { type: "start" };
+      }
+      return null;
+    }
+    this.turnFrames += 1;
+    this.quietFrames = loud ? 0 : this.quietFrames + 1;
+    if (this.quietFrames >= this.silenceFrames || this.turnFrames >= this.maxFrames) {
+      const reason = this.turnFrames >= this.maxFrames ? "max-duration" : "silence";
+      this.reset();
+      return { type: "commit", reason };
+    }
+    return null;
+  }
+}
+
 module.exports = {
   FRAME_MS,
   STT_RATE,
@@ -127,6 +205,7 @@ module.exports = {
   WEBRTC_SAMPLES,
   OpusAudioCodec,
   TurnDetector,
+  AdaptiveTurnDetector,
   downsample48To16,
   rmsDbfs,
   upsampleTo48,

package/channels/kazee/call/manager.js

@@ -87,6 +87,12 @@ class KazeeCallManager {
     if (callType !== "audio") return reject("unsupported_media");
     if (this.session) return reject("busy");
 
+    // Human callee devices emit call:ringing as soon as they show the ring UI;
+    // chat-central relays it and the caller's client uses it to advance the
+    // status flow (calling -> ringing). Without it a web caller sits on
+    // "calling" with no feedback while we fetch ICE + join Janus (2026-08-16).
+    this.adapter._socket?.emit("call:ringing", { toUserId: callerId, chatId });
+
     const iceServers = await this._fetchIceServers();
     const session = new this.SessionImpl({
       roomId, chatId, callerId, botUserId: this.adapter.botUserId,