@inetafrica/open-claudia 3.2.1 → 3.3.1

package/core/actions.js

@@ -753,6 +753,86 @@ async function handleAction(envelope) {
     await send(`Type the rule to apply to ${target}.\nFor example: “may share our office hours and address”, or “never discuss pricing”.\n\nOr send /cancel to skip.`);
     return;
   }
+  if (d.startsWith("vfy:")) {
+    // "Verify contact…" on an approval card for an unverified auto-added
+    // speaker. Owner-only (transport-gated on the callback envelope — the one
+    // surface the agent can't forge). Offers the same-name candidate notes as
+    // buttons; the actual state change happens in the vfl: pick handler via
+    // core/verify-contact, which re-validates everything.
+    if (!isChatOwner(envelope.channelId)) return send("Owner only — contact verification is restricted.");
+    const id = d.split(":")[1];
+    const approvals = require("./approvals");
+    const rec = approvals.read(id);
+    if (!rec || !rec.personId) return send("That request expired — nothing to verify from it.");
+    const people = require("./people");
+    const person = people.findById(rec.personId);
+    if (!person) return send("I no longer have a contact record for them.");
+    if (!person.autoCreated) return send(`${person.name} is already verified.`);
+    const candidates = require("./verify-contact").candidateEntitiesFor(person).slice(0, 6);
+    // Button payloads are INDEX-based: Telegram caps callback_data at 64
+    // bytes and slugs alone can be 60 — the picked index resolves against
+    // this snapshot, so a changed entity set can't shift what a tap means.
+    state.pendingVerify = {
+      aprId: rec.id,
+      personId: person.id,
+      personName: person.name,
+      candidates: candidates.map((c) => ({ slug: c.slug, name: c.name })),
+      armedAt: Date.now(),
+    };
+    saveState();
+    const rows = candidates.map((c, i) => ([{ text: `🔗 Link to ${c.slug}`.slice(0, 60), callback_data: `vfl:${rec.id}:${i}` }]));
+    rows.push([{ text: "✅ Just verify — this is a new contact", callback_data: `vfl:${rec.id}:self` }]);
+    rows.push([{ text: "✖️ Cancel", callback_data: `vfl:${rec.id}:x` }]);
+    await send(
+      `🪪 Verify ${person.name}?\n` +
+        (candidates.length
+          ? `They share a name with ${candidates.length === 1 ? "an existing note" : `${candidates.length} existing notes`} — link them if this is the same person, or keep them separate.\n`
+          : `No existing note matches their name — verifying keeps their current note as canonical.\n`) +
+        `Verifying settles WHO they are. It grants no permissions — use “Make a rule” or /guardrails for that.`,
+      { keyboard: { inline_keyboard: rows } }
+    );
+    return;
+  }
+  if (d.startsWith("vfl:")) {
+    // Verification pick. Owner-only; one-shot against the armed snapshot with
+    // the same 5-minute TTL as rule authoring. verifyContact() re-validates
+    // the person and target at execution time, so a stale snapshot can only
+    // refuse — never mislink.
+    if (!isChatOwner(envelope.channelId)) return send("Owner only — contact verification is restricted.");
+    const parts = d.split(":");
+    const id = parts[1];
+    const pick = parts[2];
+    const pend = state.pendingVerify;
+    const VERIFY_TTL_MS = 5 * 60 * 1000;
+    if (!pend || pend.aprId !== id || (pend.armedAt && Date.now() - pend.armedAt > VERIFY_TTL_MS)) {
+      state.pendingVerify = null; saveState();
+      return send("That verify prompt is stale — tap “Verify contact…” on the card again.");
+    }
+    state.pendingVerify = null; saveState();
+    if (pick === "x") return send("Okay — left unverified.");
+    let linkSlug = null;
+    if (pick !== "self") {
+      const chosen = pend.candidates[parseInt(pick, 10)];
+      if (!chosen) return send("That button is stale — tap “Verify contact…” on the card again.");
+      linkSlug = chosen.slug;
+    }
+    const result = require("./verify-contact").verifyContact({
+      personId: pend.personId,
+      linkSlug,
+      by: String(envelope.channelId),
+      via: "approval-card",
+    });
+    if (!result.ok) {
+      return send(result.already
+        ? `${pend.personName} is already verified.`
+        : `Couldn't verify: ${result.reason}`);
+    }
+    return send(
+      `🪪 Verified ${pend.personName}` +
+        (linkSlug ? ` — linked to ${result.slug}${result.superseded ? ` (auto-stub ${result.superseded} retired)` : ""}.` : ` — their note is now canonical.`) +
+        `\nVerification settles identity only; permissions still come from mandates and rules.`
+    );
+  }
   if (d.startsWith("grd:")) {
     // Guardrail capture buttons (Track C). Owner-only: standing rules layer
     // above lessons and are never editable by an external speaker.

package/core/enforcer.js

@@ -360,7 +360,27 @@ async function postOwnerButtons(rec, owner, { kind, summary, reason }) {
       `<pre>${esc(String(rec.command || ""))}</pre>`,
     ];
   }
-  const lines = [head, ``, ...askBlock, ...body, reason ? `\nWhy I'm checking: ${esc(reason)}` : ``];
+  // Unverified auto-added speaker → the card carries a one-tap way for the
+  // owner to settle WHO this is (link to an existing note, or bless the stub).
+  // Computed live from the people record — after verification the row (and
+  // the warning line) disappear from subsequent cards on their own.
+  let unverifiedLine = "";
+  let verifyRow = null;
+  try {
+    if (rec.personId) {
+      const person = require("./people").findById(rec.personId);
+      if (person && person.autoCreated && !person.isOwner) {
+        const candidates = require("./verify-contact").candidateEntitiesFor(person);
+        unverifiedLine = candidates.length
+          ? `⚠️ Unverified auto-added contact. Possible existing note: <b>${esc(candidates[0].slug)}</b> — NOT linked until you verify.`
+          : `⚠️ Unverified auto-added contact — I only know them from this chat.`;
+        verifyRow = [{ text: "🪪 Verify contact…", callback_data: `vfy:${rec.id}` }];
+      }
+    }
+  } catch (e) { /* card still posts without the verify affordance */ }
+  const lines = [head, ``, ...askBlock, ...body,
+    unverifiedLine ? `\n${unverifiedLine}` : ``,
+    reason ? `\nWhy I'm checking: ${esc(reason)}` : ``];
   const yes = kind === "triage" ? "✅ Yes, handle it" : "✅ Approve once";
   const no = kind === "triage" ? "⛔ No, decline" : "⛔ Deny";
   const keyboard = { inline_keyboard: [
@@ -370,6 +390,7 @@ async function postOwnerButtons(rec, owner, { kind, summary, reason }) {
     ],
     [
       { text: "📝 Make a rule…", callback_data: `apr:${rec.id}:rule` },
+      ...(verifyRow || []),
     ],
   ] };
   try {

package/core/handlers.js

@@ -1611,14 +1611,18 @@ register({
       // Stop pending preview flushes but keep statusMessageId/Channel: the
       // killed run's delivery unwind edits the preview to drop its footer.
       if (state.streamInterval) { clearTimeout(state.streamInterval); state.streamInterval = null; }
-      if (state.typingHeartbeat) { clearInterval(state.typingHeartbeat); state.typingHeartbeat = null; }
+      // Clearing the interval here orphans the run's own stopper (ownership
+      // check makes it a no-op), so the explicit typing:stop must go out now.
+      if (state.typingHeartbeat) { clearInterval(state.typingHeartbeat); state.typingHeartbeat = null; state.thinkingPhase = false; }
+      try { currentAdapter()?.typingStop?.(currentChannelId()); } catch (_) {}
       await sideCancellation;
       await send(`Cancelled.${queuedNote()}`);
     } else if (state.preparingRun) {
       // Turn is mid-recall/prompt-build — no process to kill yet. Flag it so
       // the runner's pre-spawn shouldAbort checkpoint bails before spawning.
       state.cancelRequested = true;
-      if (state.typingHeartbeat) { clearInterval(state.typingHeartbeat); state.typingHeartbeat = null; }
+      if (state.typingHeartbeat) { clearInterval(state.typingHeartbeat); state.typingHeartbeat = null; state.thinkingPhase = false; }
+      try { currentAdapter()?.typingStop?.(currentChannelId()); } catch (_) {}
       await sideCancellation;
       await send(`Cancelled.${queuedNote()}`);
     } else if (await sideCancellation) await send("Cancelled side response.");
@@ -2462,7 +2466,7 @@ function formatPersonShort(p) {
 }
 
 register({
-  name: "people", description: "Manage team members", args: "[show|note|link|unlink|set-primary|add|remove ...]",
+  name: "people", description: "Manage team members", args: "[show|note|link|unlink|set-primary|add|remove|verify ...]",
   handler: async (env, { tail }) => {
     if (!authorized(env)) return;
     if (!tail || tail === "list") {
@@ -2548,7 +2552,51 @@ register({
       for (const h of handles) { const r = accessStore.revokeChat(h.channelId); if (r.ok) revokedCount += 1; }
       return send(`Removed ${person.name}. Deauthed ${revokedCount} chat${revokedCount === 1 ? "" : "s"}.`);
     }
-    send("Usage: /people | /people show <name> | /people note <name> <text> | /people add|link|unlink|set-primary|remove ... (owner)");
+    // Verify an auto-added contact: settle their identity, optionally binding
+    // them to an existing note. Owner-only and chat-surface-only by design —
+    // there is deliberately no CLI/loopback equivalent, so identity decisions
+    // can never ride agent-forgeable input. Grants no permissions.
+    const verifyMatch = tail.match(/^verify\s+(.+?)(?:\s+link\s+(\S+))?$/i);
+    if (verifyMatch) {
+      const person = peopleStore.findById(verifyMatch[1].trim()) || peopleStore.findByName(verifyMatch[1].trim());
+      if (!person) return send(`Not found: ${verifyMatch[1].trim()}`);
+      const vc = require("./verify-contact");
+      if (person.autoCreated && !verifyMatch[2]) {
+        const candidates = vc.candidateEntitiesFor(person);
+        if (candidates.length) {
+          return send(
+            `${person.name} shares a name with ${candidates.length === 1 ? "an existing note" : `${candidates.length} existing notes`}:\n` +
+              candidates.map((c) => `  ${c.slug}`).join("\n") +
+              `\n\nLink with /people verify ${person.name} link <slug>, or /people verify-new ${person.name} to keep them separate.`
+          );
+        }
+      }
+      const result = vc.verifyContact({
+        personId: person.id,
+        linkSlug: verifyMatch[2] || null,
+        by: env.canonicalUserId || String(env.channelId),
+        via: "slash-command",
+      });
+      if (!result.ok) return send(result.already ? `${person.name} is already verified.` : `Couldn't verify: ${result.reason}`);
+      return send(
+        `🪪 Verified ${person.name}` +
+          (verifyMatch[2] ? ` — linked to ${result.slug}${result.superseded ? ` (auto-stub ${result.superseded} retired)` : ""}.` : ` — their note is now canonical.`) +
+          `\nVerification settles identity only; permissions still come from mandates and rules.`
+      );
+    }
+    const verifyNewMatch = tail.match(/^verify-new\s+(.+)$/i);
+    if (verifyNewMatch) {
+      const person = peopleStore.findById(verifyNewMatch[1].trim()) || peopleStore.findByName(verifyNewMatch[1].trim());
+      if (!person) return send(`Not found: ${verifyNewMatch[1].trim()}`);
+      const result = require("./verify-contact").verifyContact({
+        personId: person.id,
+        by: env.canonicalUserId || String(env.channelId),
+        via: "slash-command",
+      });
+      if (!result.ok) return send(result.already ? `${person.name} is already verified.` : `Couldn't verify: ${result.reason}`);
+      return send(`🪪 Verified ${person.name} — their note is now canonical.\nVerification settles identity only; permissions still come from mandates and rules.`);
+    }
+    send("Usage: /people | /people show <name> | /people note <name> <text> | /people add|link|unlink|set-primary|remove|verify ... (owner)");
   },
 });
 

package/core/loopback.js

@@ -25,6 +25,7 @@ const introFlow = require("./intro-flow");
 const relay = require("./relay");
 const audit = require("./audit");
 const access = require("./access");
+const speakerAttest = require("./speaker-attest");
 const fs2 = require("fs");
 const path2 = require("path");
 const { TRANSCRIPTS_DIR } = require("./config");
@@ -85,9 +86,17 @@ const JSON_KINDS = new Set([
   "say", "call", "tts", "transcribe",
 ]);
 
+// Owner gate for identity-sensitive kinds. The claimed canonicalUserId comes
+// from the CLI's env, which the agent's shell can rewrite — so the claim only
+// counts when it carries the runner-minted attestation (an HMAC over the id
+// with a per-boot, memory-only secret; see core/speaker-attest). No attest,
+// a wrong attest, or an attest for a different id all fail closed: forging
+// `OC_CANONICAL_USER_ID=<owner-id>` from a guarded external turn no longer
+// reaches the people/auth/intros mutations the relationship guard depends on.
 function callerIsOwner(payload) {
   const caller = payload?.canonicalUserId;
   if (!caller) return false;
+  if (!speakerAttest.verify(caller, payload?.speakerAttest)) return false;
   const person = peopleStore.findByCanonicalUserId(caller);
   return !!(person && person.isOwner);
 }
@@ -347,6 +356,10 @@ async function handleJson(req, res, url, kind) {
       label: String(payload.label || payload.prompt).slice(0, 60),
       schedule: payload.schedule ? String(payload.schedule) : undefined,
       repeat: !!payload.repeat,
+      // Absent/invalid → the scheduler stamps its default watch timeout.
+      expiresAt: Number.isFinite(Number(payload.expiresAt)) && Number(payload.expiresAt) > 0
+        ? Number(payload.expiresAt)
+        : undefined,
       source: payload.source || "agent",
       sessionId: payload.sessionId || null,
       previousSessionId: payload.previousSessionId || null,
@@ -598,6 +611,24 @@ async function handleJson(req, res, url, kind) {
 
   if (kind === "relay-send") {
     if (!payload.text) return reply(res, 400, { error: "missing text" });
+    // A guarded (external) requester may pass a message TO THE OWNER — that is
+    // the "tell them for me" flow — but never use the bot as a relay to third
+    // parties: sending as the bot to anyone else is impersonation surface.
+    try {
+      const relationship = require("./relationship");
+      const speaker = relationship.speakerFor(adapter.type, channelId, userId);
+      if (relationship.guardActive(speaker)) {
+        const target =
+          (payload.targetPersonId && peopleStore.findById(payload.targetPersonId)) ||
+          (payload.targetPersonName && peopleStore.findByName(payload.targetPersonName)) ||
+          (payload.targetCanonicalUserId && peopleStore.findByCanonicalUserId(payload.targetCanonicalUserId)) ||
+          (payload.targetAdapter && payload.targetChannelId && peopleStore.findByHandle(payload.targetAdapter, payload.targetChannelId)) ||
+          null;
+        if (!target || !target.isOwner) {
+          return reply(res, 403, { error: "relay from an external contact can only go to the owner — messages to anyone else are owner-only" });
+        }
+      }
+    } catch (e) { /* classification failure → fall through; owner-scoped in practice */ }
     try {
       const result = await relay.send({
         text: payload.text,
@@ -616,6 +647,16 @@ async function handleJson(req, res, url, kind) {
   }
 
   if (kind === "recent-fetch") {
+    // Transcript reads are owner-side memory. A guarded (external, non-owner)
+    // requester must not pull other channels' conversations through the CLI —
+    // same default-deny as file/voice egress, same fail direction.
+    try {
+      const relationship = require("./relationship");
+      const speaker = relationship.speakerFor(adapter.type, channelId, userId);
+      if (relationship.guardActive(speaker)) {
+        return reply(res, 403, { error: "transcript access is owner-only — an external contact cannot read other conversations" });
+      }
+    } catch (e) { /* classification failure → fall through; owner-scoped in practice */ }
     const limit = Math.max(1, Math.min(parseInt(payload.limit || 20, 10) || 20, 200));
     try {
       let targetAdapter = payload.adapter;

package/core/media.js

@@ -99,34 +99,87 @@ async function elevenLabsToVoice(clean) {
   }
 }
 
+// Pack already-cleaned text into gateway-sized pieces. Long inputs used to go
+// to the gateway as ONE request and blow its synthesis window (the abort was
+// the binding limit, not any transport) — sentence-packed chunks keep every
+// request comfortably inside it. Oversized single sentences are hard-split at
+// word boundaries so one run-on sentence can't recreate the timeout.
+const TTS_CHUNK_MAX = 450;
+function chunkForTTS(clean, maxLen = TTS_CHUNK_MAX) {
+  if (clean.length <= maxLen) return [clean];
+  const sentences = clean.match(/[^.!?]+[.!?]+|\S[^.!?]*$/g) || [clean];
+  const chunks = [];
+  let buf = "";
+  const flush = () => { if (buf) { chunks.push(buf); buf = ""; } };
+  for (let piece of sentences) {
+    piece = piece.trim();
+    if (!piece) continue;
+    while (piece.length > maxLen) {
+      flush();
+      let cut = piece.lastIndexOf(" ", maxLen);
+      if (cut < maxLen / 2) cut = maxLen;
+      chunks.push(piece.slice(0, cut).trim());
+      piece = piece.slice(cut).trim();
+    }
+    if (buf && buf.length + piece.length + 1 > maxLen) flush();
+    buf = buf ? `${buf} ${piece}` : piece;
+  }
+  flush();
+  return chunks.filter(Boolean);
+}
+
+async function pocketFetchWav(input, voice, token) {
+  const res = await fetch(`${SPEECH_SERVICE_URL.replace(/\/$/, "")}/v1/audio/speech`, {
+    method: "POST",
+    headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
+    body: JSON.stringify({ input, voice, response_format: "wav" }),
+    signal: AbortSignal.timeout(120000),
+  });
+  if (!res.ok) throw new Error(`HTTP ${res.status}`);
+  return Buffer.from(await res.arrayBuffer());
+}
+
 // Pocket TTS through the Agent Space speech gateway. The gateway returns WAV;
-// Telegram and voice transports receive a compact Ogg/Opus file.
+// Telegram and voice transports receive a compact Ogg/Opus file. Long text is
+// synthesized chunk-by-chunk and concatenated, so message length can no longer
+// abort the request mid-synthesis.
 async function pocketToVoice(clean, voiceOverride) {
   const token = speechBearerToken();
   if (TTS_PROVIDER === "elevenlabs" || !token || !SPEECH_SERVICE_URL || !FFMPEG) return null;
-  let wavPath = null;
+  const voice = voiceOverride || ttsVoice.getVoice();
+  const stem = `tts-pocket-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+  const oggPath = path.join(TEMP_DIR, `${stem}.ogg`);
+  const wavPaths = [];
+  let listPath = null;
   try {
-    const res = await fetch(`${SPEECH_SERVICE_URL.replace(/\/$/, "")}/v1/audio/speech`, {
-      method: "POST",
-      headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
-      body: JSON.stringify({ input: clean, voice: voiceOverride || ttsVoice.getVoice(), response_format: "wav" }),
-      signal: AbortSignal.timeout(60000),
-    });
-    if (!res.ok) {
-      console.error(`Pocket TTS failed: HTTP ${res.status}`);
-      return null;
+    const chunks = chunkForTTS(clean);
+    for (let i = 0; i < chunks.length; i++) {
+      let buf;
+      try {
+        buf = await pocketFetchWav(chunks[i], voice, token);
+      } catch (e) {
+        // one retry: a transient gateway blip shouldn't waste the chunks
+        // already synthesized before it
+        buf = await pocketFetchWav(chunks[i], voice, token);
+      }
+      const wavPath = path.join(TEMP_DIR, `${stem}-${i}.wav`);
+      fs.writeFileSync(wavPath, buf);
+      wavPaths.push(wavPath);
+    }
+    if (wavPaths.length === 1) {
+      execSync(`"${FFMPEG}" -i "${wavPaths[0]}" -c:a libopus -y "${oggPath}" 2>/dev/null`, { timeout: 30000 });
+    } else {
+      listPath = path.join(TEMP_DIR, `${stem}-list.txt`);
+      fs.writeFileSync(listPath, wavPaths.map((p) => `file '${p}'`).join("\n"));
+      execSync(`"${FFMPEG}" -f concat -safe 0 -i "${listPath}" -c:a libopus -y "${oggPath}" 2>/dev/null`, { timeout: 120000 });
     }
-    const stem = `tts-pocket-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
-    wavPath = path.join(TEMP_DIR, `${stem}.wav`);
-    const oggPath = path.join(TEMP_DIR, `${stem}.ogg`);
-    fs.writeFileSync(wavPath, Buffer.from(await res.arrayBuffer()));
-    execSync(`"${FFMPEG}" -i "${wavPath}" -c:a libopus -y "${oggPath}" 2>/dev/null`, { timeout: 30000 });
     return oggPath;
   } catch (e) {
     console.error("Pocket TTS error:", e.message);
     return null;
   } finally {
-    if (wavPath) { try { fs.unlinkSync(wavPath); } catch (e) {} }
+    for (const p of wavPaths) { try { fs.unlinkSync(p); } catch (e) {} }
+    if (listPath) { try { fs.unlinkSync(listPath); } catch (e) {} }
   }
 }
 
@@ -303,4 +356,4 @@ async function synthSentenceMp3(text) {
   }
 }
 
-module.exports = { transcribeAudio, transcribeAudioLocal, transcribeMedia, canTranscribe, textToVoice, textToVoiceFile, splitSentences, synthSentenceMp3, pocketToVoice, cloneVoiceFromClip, speechBearerToken, canSpeak, TTS_CMD };
+module.exports = { transcribeAudio, transcribeAudioLocal, transcribeMedia, canTranscribe, textToVoice, textToVoiceFile, splitSentences, synthSentenceMp3, pocketToVoice, chunkForTTS, cloneVoiceFromClip, speechBearerToken, canSpeak, TTS_CMD };

package/core/pack-review.js

@@ -388,7 +388,25 @@ function applyAction(a, activeSet = null) {
 
 function applyEntityAction(e) {
   if (!e || typeof e !== "object" || !String(e.name || "").trim()) return null;
+  // Slug-key through the people roster: name-keyed upserts land on the
+  // alphabetically-first same-named entity, but the relationship guard reads
+  // the file the person RECORD points at (auto-added contacts get a suffixed
+  // stub precisely so they can't shadow an existing note). A unique name
+  // match routes the write to the guard-read file; an ambiguous one (two
+  // tracked people sharing a name) is skipped outright — enriching the wrong
+  // identity's note is worse than writing nothing.
+  let slug = "";
+  try {
+    const people = require("./people");
+    const wanted = String(e.name || "").trim().toLowerCase();
+    const matches = people.list().filter((p) => (p.name || "").trim().toLowerCase() === wanted);
+    if (matches.length === 1) slug = people.resolveEntitySlug(matches[0]) || "";
+    else if (matches.length > 1) {
+      return { kind: "skip", slug: "", name: e.name, type: e.type || "", note: "ambiguous: multiple tracked people share this name — not writing to either note" };
+    }
+  } catch (err) { /* roster unavailable → name-keyed fallback below */ }
   const { entity, created } = entities.upsertEntity({
+    slug: slug || undefined,
     name: e.name,
     type: e.type,
     aliases: Array.isArray(e.aliases) ? e.aliases.slice(0, 5) : [],

package/core/providers/utility-policy.js

@@ -4,7 +4,7 @@ const config = require("../config");
 
 const PROVIDER_IDS = Object.freeze(["claude", "codex"]);
 const PROVIDER_ID_SET = new Set(PROVIDER_IDS);
-const PURPOSES = Object.freeze(["subagent", "recall", "review", "dream", "introspection", "enforcer"]);
+const PURPOSES = Object.freeze(["subagent", "recall", "review", "dedup", "dream", "introspection", "enforcer"]);
 const PURPOSE_SET = new Set(PURPOSES);
 const TIERS = Object.freeze(["low", "medium", "high"]);
 const TIER_SET = new Set(TIERS);
@@ -12,6 +12,7 @@ const PURPOSE_PROVIDER_ENV = Object.freeze({
   subagent: "SUBAGENT_PROVIDER",
   recall: "RECALL_PROVIDER",
   review: "MEMORY_PROVIDER",
+  dedup: "MEMORY_PROVIDER",
   dream: "DREAM_PROVIDER",
   introspection: "DREAM_PROVIDER",
   enforcer: "ENFORCER_PROVIDER",
@@ -20,12 +21,14 @@ const PURPOSE_MODEL_PREFIX = Object.freeze({
   subagent: "SUBAGENT_MODEL",
   recall: "RECALL_MODEL",
   review: "PACK_REVIEW_MODEL",
+  dedup: "PACK_DEDUP_MODEL",
   dream: "DREAM_MODEL",
   introspection: "DREAM_MODEL",
   enforcer: "ENFORCER_MODEL",
 });
 const LEGACY_CLAUDE_MODEL_ENV = Object.freeze({
   review: "PACK_REVIEW_MODEL",
+  dedup: "PACK_DEDUP_MODEL",
   dream: "DREAM_MODEL",
   introspection: "DREAM_MODEL",
   enforcer: "ENFORCER_MODEL",

package/core/relationship.js

@@ -253,10 +253,26 @@ function ensureContact(envelope) {
     const suffix = crypto.createHash("sha1").update(`${adapterType}:${userId}`).digest("hex").slice(0, 6);
     const slug = `${entities.slugify(displayName).slice(0, 48) || "contact"}-${suffix}`;
     people.setEntitySlug(person.id, slug);
+
+    // If a same-named person note already exists, surface it as a HINT only.
+    // Deliberately not linked (see invariants above): a name is spoofable, so
+    // absorbing the note here would hand the speaker that identity's history.
+    // Only the owner can link, via the approval card or /people verify.
+    let hint = "";
+    try {
+      const fresh = people.findById(person.id) || person;
+      const candidates = require("./verify-contact").candidateEntitiesFor(fresh);
+      if (candidates.length) hint = candidates.map((c) => c.slug).slice(0, 3).join(", ");
+    } catch (e) { /* hint is best-effort — the stub is safe without it */ }
+
     entities.upsertEntity({
       slug, name: displayName, type: "person", relationship: "external",
-      description: `Auto-added contact (unverified) — first seen in ${label}`,
-      log: `auto-added as a contact from ${label}`,
+      description: hint
+        ? `Auto-added contact (unverified) — first seen in ${label}. Possible existing note: ${hint} — NOT linked; only the owner can verify.`
+        : `Auto-added contact (unverified) — first seen in ${label}`,
+      log: hint
+        ? `auto-added as a contact from ${label}; same-named note detected (${hint}) — not linked pending owner verification`
+        : `auto-added as a contact from ${label}`,
     });
 
     try { require("./audit").log("auto-contact", { personId: person.id, name: displayName, adapter: adapterType, userId, channelId, entitySlug: slug }); } catch (e) {}

package/core/router.js

@@ -12,7 +12,7 @@ const { isChatAuthorized } = require("./access");
 const introFlow = require("./intro-flow");
 const { send, deleteMessage } = require("./io");
 const { currentState, saveState, autoLinkOwnerChannel, getActiveProvider, getProjectKey } = require("./state");
-const { admitRunContext, runAgent } = require("./runner");
+const { admitRunContext, runAgent, startTypingHeartbeat } = require("./runner");
 const { transcribeAudio, cloneVoiceFromClip } = require("./media");
 const { vault } = require("./vault-store");
 const { isOnboarded, handleOnboarding } = require("./onboarding");
@@ -203,9 +203,20 @@ async function admitGuardedTurn(askText, envelope, state = currentState()) {
   return !(triage && triage.held);
 }
 
+// Chip-on-receipt: enforcer triage, media download, and STT all run before
+// runAgent — many seconds with no feedback. Start the "thinking" heartbeat as
+// soon as a turn-bound message arrives; the run's own heartbeat supersedes it
+// at executeAdmittedRun, after which this stopper is a no-op. Skipped while a
+// run is active — the chip is already owned by that turn.
+function startPreTurnTyping(state) {
+  if (state.runningProcess || state.preparingRun) return () => {};
+  try { return startTypingHeartbeat(state); } catch (_) { return () => {}; }
+}
+
 async function handleVoice(envelope) {
   if (isDuplicate(envelope)) return;
   const state = currentState();
+  let stopPreTurnTyping = () => {};
   try {
     const media = envelope.media?.[0];
     if (!media) return;
@@ -223,7 +234,7 @@ async function handleVoice(envelope) {
       purpose: "foreground",
       attachments: [{ type: "voice", mimeType: media.mimeType || "audio/ogg", fileName: media.fileName || null }],
     });
-    envelope.adapter.typing(envelope.channelId).catch(() => {});
+    stopPreTurnTyping = startPreTurnTyping(state);
     const tStart = Date.now();
     const oggPath = await envelope.adapter.downloadMedia(media);
     const tAfterDownload = Date.now();
@@ -243,11 +254,13 @@ async function handleVoice(envelope) {
       voiceStream: envelope.adapter?.type === "voice",
     });
   } catch (err) { await send(`Voice failed: ${err.message}`); }
+  finally { stopPreTurnTyping(); }
 }
 
 async function handleAudio(envelope) {
   if (isDuplicate(envelope)) return;
   const state = currentState();
+  let stopPreTurnTyping = () => {};
   try {
     const media = envelope.media?.[0];
     if (!media) return;
@@ -260,7 +273,7 @@ async function handleAudio(envelope) {
       purpose: "foreground",
       attachments: [{ type: "audio", mimeType: media.mimeType || null, fileName: media.fileName || null }],
     });
-    envelope.adapter.typing(envelope.channelId).catch(() => {});
+    stopPreTurnTyping = startPreTurnTyping(state);
     const p = await envelope.adapter.downloadMedia(media);
     const t = await transcribeAudio(p);
     try { fs.unlinkSync(p); } catch (e) {}
@@ -272,6 +285,7 @@ async function handleAudio(envelope) {
       attachments: [{ type: "audio", path: p, mimeType: media.mimeType || null, fileName: media.fileName || null }],
     });
   } catch (err) { await send(`Audio failed: ${err.message}`); }
+  finally { stopPreTurnTyping(); }
 }
 
 // A clip the owner sent right after /voice clone. Upload it to the speech
@@ -297,6 +311,7 @@ async function captureVoiceClone(envelope, media) {
 async function handlePhoto(envelope) {
   if (isDuplicate(envelope)) return;
   const state = currentState();
+  let stopPreTurnTyping = () => {};
   try {
     const items = envelope.media || [];
     if (!items.length) return;
@@ -304,6 +319,7 @@ async function handlePhoto(envelope) {
       purpose: "foreground",
       attachments: items.map((item) => ({ type: "image", mimeType: item.mimeType || "image/*", fileName: item.fileName || null })),
     });
+    stopPreTurnTyping = startPreTurnTyping(state);
     const paths = [];
     for (const m of items) paths.push(await envelope.adapter.downloadMedia(m));
     const caption = envelope.caption || "Describe this image. If code/UI/error — explain and fix.";
@@ -327,11 +343,13 @@ async function handlePhoto(envelope) {
       })),
     });
   } catch (err) { await send(`Image failed: ${err.message}`); }
+  finally { stopPreTurnTyping(); }
 }
 
 async function handleDocument(envelope) {
   if (isDuplicate(envelope)) return;
   const state = currentState();
+  let stopPreTurnTyping = () => {};
   try {
     const media = envelope.media?.[0];
     if (!media) return;
@@ -342,6 +360,7 @@ async function handleDocument(envelope) {
       purpose: "foreground",
       attachments: [{ type: "document", mimeType: media.mimeType || null, fileName: media.fileName || null }],
     });
+    stopPreTurnTyping = startPreTurnTyping(state);
     const savePath = await envelope.adapter.downloadMedia(media);
     const fileName = media.fileName || path.basename(savePath);
     const mime = media.mimeType || "";
@@ -361,6 +380,7 @@ async function handleDocument(envelope) {
       attachments: [{ type: isImage ? "image" : "document", path: savePath, mimeType: mime, fileName }],
     });
   } catch (err) { await send(`Failed: ${err.message}`); }
+  finally { stopPreTurnTyping(); }
 }
 
 // Provider-agnostic capture of a credential pasted into chat with no auth
@@ -605,7 +625,11 @@ async function handleText(envelope) {
   // stop, instead of forwarding a secret to the model (Codex refuses those).
   if (await captureLooseCredential(text.trim(), envelope)) return;
 
-  if (!(await admitGuardedTurn(text, envelope, state))) return;
+  const stopPreTurnTyping = startPreTurnTyping(state);
+  let admitted;
+  try { admitted = await admitGuardedTurn(text, envelope, state); }
+  catch (e) { stopPreTurnTyping(); throw e; }
+  if (!admitted) { stopPreTurnTyping(); return; }
 
   const runContext = admitRunContext(text, state.currentSession.dir, envelope.messageId, { purpose: "foreground" });
   const attachments = [];