@inetafrica/open-claudia 3.2.3 → 3.3.1

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## v3.3.1 — Message length can no longer kill the voice: chunked pocket TTS (re-cut carrying unpublished v3.3.0)
+
+- **Long voice notes died at 60 seconds of synthesis.** `pocketToVoice` sent the ENTIRE cleaned text to the speech gateway as one request under `AbortSignal.timeout(60000)`. A long reply blew that window, the pocket route returned null, and on pods the fallback chain has nowhere to go (no ElevenLabs key, no macOS `say`) — so `say` bounced with "no TTS route available" and agents improvised manual per-paragraph chunking (sales-bot, 2026-08-19). Long text is now sentence-packed into ≤450-char chunks (`chunkForTTS`; run-on sentences hard-split at word boundaries so nothing can recreate the timeout), each chunk synthesized in its own 120s window with one retry (a transient gateway blip no longer wastes the chunks already done), and the wavs concatenated via ffmpeg's concat demuxer into ONE ogg/opus. Short text keeps the exact single-request behavior. Benefits every consumer of `textToVoice`/`textToVoiceFile`: `say`, `tts`, and whole voice-note replies; the voice channel's streamed per-sentence path is untouched. Regression pinned in `test-speech-loopback.js`: multiple gateway calls each inside the pack limit, same voice across chunks, lossless reassembly, temp cleanup, and chunker unit coverage.
+- **Why this is 3.3.1 and not 3.3.0:** the v3.3.0 release commit bumped `package.json` but not the release-guard pin (and skipped this changelog), so the tag's build job failed its own `npm test` — npm still served 3.2.3 and no fleet image was adopted. Never retag a failed version — re-cut as +1, pin repaired here.
+- **Also ships (committed since 3.2.3):** the v3.3.0 verify-contact batch (below) and the Kazee calls batch — trickle ICE consumption (calls died with both legs stuck ICE-checking), streaming TTS playback (~3s faster to first byte) with per-voice greeting/goodbye PCM cache, hybrid word-guarded turn-end VAD, `call:ringing` on invite with publish deferred until the caller's feed is up, and werift ICE unhandled-rejection suppression.
+
+## v3.3.0 — Never published (build failed on a stale release-guard pin); content ships in v3.3.1
+
+- **An unverified contact stays unverified until the owner says otherwise.** `ensureContact` keeps minting fresh unverified stubs (never link-by-name — names are claimable); the owner gets the explicit act that closes the loop: a "Verify contact…" button on escalation cards and `/people verify [link <slug>]`, both living ONLY on chat-envelope surfaces the agent cannot forge. Verification settles identity, never trust — mandates and relationship upgrades stay separate owner grants; retired stubs rename to `.superseded`, not deleted.
+- **Three holes from the same audit, closed and pinned by tests:** `callerIsOwner` trusted the CLI's claimed canonicalUserId (forgeable env) → owner-gated loopback kinds now require a per-boot HMAC attest minted by the runner at spawn; `recent`-fetch let a guarded external turn read other channels' transcripts → default-deny; `relay-send` let a guarded turn message third parties as the bot → a guarded requester may relay only to the owner.
+
 ## v3.2.3 — No watch can end silently: every watch carries a timeout that fires as a wake-up
 
 - **The silent-failure hole in watches.** A watch whose check never exits 0 polled forever without a sound — if the watched thing hung, was misconfigured (the unauthenticated-`glab` watch from 2026-08-12 would never have fired), or simply never happened, the agent slept through it and the user had to notice the silence themselves. The working pattern was to pair every watch with a manual backup wakeup; that safety net is now built in.

package/bin/loopback-client.js

@@ -43,6 +43,9 @@ function context() {
     adapterId: process.env.OC_CHANNEL_ADAPTER,
     userId: process.env.OC_CHANNEL_USER_ID || null,
     canonicalUserId: process.env.OC_CANONICAL_USER_ID || null,
+    // Runner-minted HMAC binding canonicalUserId to what the bot stamped for
+    // this turn; the loopback's owner gates verify it (see core/speaker-attest).
+    speakerAttest: process.env.OC_SPEAKER_ATTEST || null,
     provider: process.env.OC_PROVIDER || null,
     providerSettings,
     project: process.env.OC_PROJECT || null,
@@ -76,6 +79,7 @@ function postJson(kind, body) {
     adapter: ctx.adapterId,
     userId: ctx.userId,
     canonicalUserId: ctx.canonicalUserId,
+    speakerAttest: ctx.speakerAttest,
     provider: ctx.provider,
     providerSettings: ctx.providerSettings,
     project: requestedProject,

package/bot.js

@@ -207,7 +207,16 @@ process.on("uncaughtException", (err) => {
   try { persist(); } catch (e) {}
   setTimeout(() => process.exit(1), 2000);
 });
-process.on("unhandledRejection", (reason) => notifyError("Unhandled rejection", reason));
+process.on("unhandledRejection", (reason) => {
+  // werift's TURN/ICE client rejects STUN error responses (e.g. coturn 403s)
+  // uncaught; benign for the call itself, so keep them out of Telegram.
+  const stack = typeof reason?.stack === "string" ? reason.stack : "";
+  if (stack.includes("werift/lib/ice") || stack.includes("werift\\lib\\ice")) {
+    console.error("Unhandled rejection (werift ice, suppressed):", stack.split("\n").slice(0, 2).join(" | "));
+    return;
+  }
+  notifyError("Unhandled rejection", reason);
+});
 
 // ── Update checker ─────────────────────────────────────────────────
 

package/channels/kazee/call/audio.js

@@ -120,6 +120,84 @@ class TurnDetector {
   }
 }
 
+// A fixed threshold breaks in a noisy room: background keeps every frame
+// "loud", the silence rule never fires, and the turn only ends at the 30s cap
+// — 30 seconds of dead air. Tracking the running noise floor and sitting a
+// fixed margin above it keeps the silence rule alive at any steady background
+// level (jig-measured to hold to ~14dB SNR; below that only the recogniser's
+// word timeline can end a turn, which the session layers on top).
+class AdaptiveTurnDetector {
+  constructor({ marginDb = 12, windowFrames = 100, onsetFrames = 3, silenceMs = 700,
+    maxTurnMs = 30000, minThresholdDb = -50, bootstrapFrames = 40 } = {}) {
+    this.marginDb = marginDb;
+    this.windowFrames = windowFrames;
+    this.onsetFrames = onsetFrames;
+    this.minThresholdDb = minThresholdDb;
+    this.bootstrapFrames = bootstrapFrames;
+    this.silenceFrames = Math.ceil(silenceMs / FRAME_MS);
+    this.maxFrames = Math.ceil(maxTurnMs / FRAME_MS);
+    this.recent = [];
+    this.frames = 0;
+    // While the bot is speaking, device echo leaks back through the caller's
+    // mic; the session raises this so only clearly-louder audio counts.
+    this.boostTo = null;
+    this.reset();
+  }
+
+  reset() {
+    this.active = false;
+    this.loudFrames = 0;
+    this.quietFrames = 0;
+    this.turnFrames = 0;
+  }
+
+  _baseThreshold() {
+    const sorted = this.recent.filter(Number.isFinite).sort((a, b) => a - b);
+    if (sorted.length < 10) return this.minThresholdDb;
+    const floor = sorted[Math.floor(sorted.length * 0.1)];
+    return Math.max(this.minThresholdDb, floor + this.marginDb);
+  }
+
+  get thresholdDb() {
+    const base = this._baseThreshold();
+    return this.boostTo === null ? base : Math.max(base, this.boostTo);
+  }
+
+  push(pcm48k) {
+    const db = rmsDbfs(pcm48k);
+    this.frames += 1;
+    const base = this._baseThreshold();
+    // Bootstrap the floor from the opening of the call (the room is audible
+    // before anyone speaks), then keep it honest by sampling only frames that
+    // look like background — sampling the caller's own voice would raise the
+    // threshold above them and cut them off mid-word. The gate uses the
+    // un-boosted threshold so echo never pollutes the floor estimate.
+    if (this.frames <= this.bootstrapFrames || db < base) {
+      this.recent.push(db);
+      if (this.recent.length > this.windowFrames) this.recent.shift();
+    }
+    const loud = db >= (this.boostTo === null ? base : Math.max(base, this.boostTo));
+    if (!this.active) {
+      this.loudFrames = loud ? this.loudFrames + 1 : 0;
+      if (this.loudFrames >= this.onsetFrames) {
+        this.active = true;
+        this.quietFrames = 0;
+        this.turnFrames = this.loudFrames;
+        return { type: "start" };
+      }
+      return null;
+    }
+    this.turnFrames += 1;
+    this.quietFrames = loud ? 0 : this.quietFrames + 1;
+    if (this.quietFrames >= this.silenceFrames || this.turnFrames >= this.maxFrames) {
+      const reason = this.turnFrames >= this.maxFrames ? "max-duration" : "silence";
+      this.reset();
+      return { type: "commit", reason };
+    }
+    return null;
+  }
+}
+
 module.exports = {
   FRAME_MS,
   STT_RATE,
@@ -127,6 +205,7 @@ module.exports = {
   WEBRTC_SAMPLES,
   OpusAudioCodec,
   TurnDetector,
+  AdaptiveTurnDetector,
   downsample48To16,
   rmsDbfs,
   upsampleTo48,

package/channels/kazee/call/manager.js

@@ -87,6 +87,12 @@ class KazeeCallManager {
     if (callType !== "audio") return reject("unsupported_media");
     if (this.session) return reject("busy");
 
+    // Human callee devices emit call:ringing as soon as they show the ring UI;
+    // chat-central relays it and the caller's client uses it to advance the
+    // status flow (calling -> ringing). Without it a web caller sits on
+    // "calling" with no feedback while we fetch ICE + join Janus (2026-08-16).
+    this.adapter._socket?.emit("call:ringing", { toUserId: callerId, chatId });
+
     const iceServers = await this._fetchIceServers();
     const session = new this.SessionImpl({
       roomId, chatId, callerId, botUserId: this.adapter.botUserId,