@inetafrica/open-claudia 3.2.3 → 3.3.2

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## v3.3.2 — Known people are recognized by transport id, approved owners stay owners, and a mandate can no longer land on the wrong note
+
+- **Every known person got interrogated on a fresh Kazee DM.** The intro flow matched inbound chats only by `(adapter, channelId)` — but Kazee DMs key the envelope's channelId by the conversation *document* id while people handles store the sender's *user* id, so nothing ever matched: known teammates, and the owner on pods without `KAZEE_OWNER_USER_ID`, all got "who are you" (the Coders Africa incident, 2026-08-19/20). Now a sender whose transport user id already maps to a person is silently **adopted**: the DM channel is linked to their record, an auth entry is written, any stale pending intro is resolved, and `handleInbound` returns false so the router falls through and handles the turn normally. Adoption is gated on adapter-attested `surface: "dm"` — the Kazee adapter sets it only on a positive chat-meta read (`isGroupChat: false`); a failed meta read attests nothing (fail closed) — because auth.json standing is per-CHANNEL and adopting a room would hand every member the sender's standing. Display names are never matched; only the transport id, the same trust level as the env owner match.
+- **Approving an owner onto a second channel demoted them there.** `applyApproval` hardcoded `isOwner: false` into the auth entry while `isChatOwner` reads exactly that file. The entry now mirrors `person.isOwner`, and a stale `false` entry from the bug era is upgraded in place on the next approval.
+- **The mandate writer can no longer be steered by a display name.** `appendMandateLine`'s legacy fallback upserted by `personName` when the record carried no slug — a spoofable transport display name could land owner-authored security text on a same-named OTHER person's note (reachable from telegram-group externals, where there is no person record). Writes are now strictly slug-keyed: `entitySlug`, else the person REGISTRY (`personId` → `resolveEntitySlug`), else **refused** — never the name. The router's rule-capture path passes `personId` so per-person rules keep landing after the fallback's removal.
+- **Stranded grants are surfaced the moment they bite.** The dual-file trap — a mandate granted on the name-obvious note (`rahil-malde.md`) while the enforcer reads the person's hashed record slug — made grants silently do nothing. Escalation cards now carry a ⚠️ hint naming the file holding the dead grant and pointing at Verify / Make-a-rule, whenever the speaker's live mandate is empty but a same-named sibling note (that no other person owns) holds one. Detection only: the stranded text is never applied and never quoted.
+- **Router plumbing for the fall-through:** the cross-channel dedup check is memoized per envelope object, so the adopted first message isn't swallowed by `handleText`'s re-check while true redeliveries (fresh envelope, same message id) still dedup globally.
+- Regression coverage: `test-intro-adoption.js` joins the chain (adoption unit + through-the-router integration, fail-closed attestation, approval owner-mirror and in-place repair); `test-mandate-hygiene.js` pins the name-fallback refusal and personId resolution; `test-kazee-group-gate.js` pins the dm attestation and its fail-closed absence; `test-enforcer.js` pins the stranded-mandate hint and that the stranded text never reaches the live mandate.
+
+## v3.3.1 — Message length can no longer kill the voice: chunked pocket TTS (re-cut carrying unpublished v3.3.0)
+
+- **Long voice notes died at 60 seconds of synthesis.** `pocketToVoice` sent the ENTIRE cleaned text to the speech gateway as one request under `AbortSignal.timeout(60000)`. A long reply blew that window, the pocket route returned null, and on pods the fallback chain has nowhere to go (no ElevenLabs key, no macOS `say`) — so `say` bounced with "no TTS route available" and agents improvised manual per-paragraph chunking (sales-bot, 2026-08-19). Long text is now sentence-packed into ≤450-char chunks (`chunkForTTS`; run-on sentences hard-split at word boundaries so nothing can recreate the timeout), each chunk synthesized in its own 120s window with one retry (a transient gateway blip no longer wastes the chunks already done), and the wavs concatenated via ffmpeg's concat demuxer into ONE ogg/opus. Short text keeps the exact single-request behavior. Benefits every consumer of `textToVoice`/`textToVoiceFile`: `say`, `tts`, and whole voice-note replies; the voice channel's streamed per-sentence path is untouched. Regression pinned in `test-speech-loopback.js`: multiple gateway calls each inside the pack limit, same voice across chunks, lossless reassembly, temp cleanup, and chunker unit coverage.
+- **Why this is 3.3.1 and not 3.3.0:** the v3.3.0 release commit bumped `package.json` but not the release-guard pin (and skipped this changelog), so the tag's build job failed its own `npm test` — npm still served 3.2.3 and no fleet image was adopted. Never retag a failed version — re-cut as +1, pin repaired here.
+- **Also ships (committed since 3.2.3):** the v3.3.0 verify-contact batch (below) and the Kazee calls batch — trickle ICE consumption (calls died with both legs stuck ICE-checking), streaming TTS playback (~3s faster to first byte) with per-voice greeting/goodbye PCM cache, hybrid word-guarded turn-end VAD, `call:ringing` on invite with publish deferred until the caller's feed is up, and werift ICE unhandled-rejection suppression.
+
+## v3.3.0 — Never published (build failed on a stale release-guard pin); content ships in v3.3.1
+
+- **An unverified contact stays unverified until the owner says otherwise.** `ensureContact` keeps minting fresh unverified stubs (never link-by-name — names are claimable); the owner gets the explicit act that closes the loop: a "Verify contact…" button on escalation cards and `/people verify [link <slug>]`, both living ONLY on chat-envelope surfaces the agent cannot forge. Verification settles identity, never trust — mandates and relationship upgrades stay separate owner grants; retired stubs rename to `.superseded`, not deleted.
+- **Three holes from the same audit, closed and pinned by tests:** `callerIsOwner` trusted the CLI's claimed canonicalUserId (forgeable env) → owner-gated loopback kinds now require a per-boot HMAC attest minted by the runner at spawn; `recent`-fetch let a guarded external turn read other channels' transcripts → default-deny; `relay-send` let a guarded turn message third parties as the bot → a guarded requester may relay only to the owner.
+
 ## v3.2.3 — No watch can end silently: every watch carries a timeout that fires as a wake-up
 
 - **The silent-failure hole in watches.** A watch whose check never exits 0 polled forever without a sound — if the watched thing hung, was misconfigured (the unauthenticated-`glab` watch from 2026-08-12 would never have fired), or simply never happened, the agent slept through it and the user had to notice the silence themselves. The working pattern was to pair every watch with a manual backup wakeup; that safety net is now built in.

package/bin/loopback-client.js

@@ -43,6 +43,9 @@ function context() {
     adapterId: process.env.OC_CHANNEL_ADAPTER,
     userId: process.env.OC_CHANNEL_USER_ID || null,
     canonicalUserId: process.env.OC_CANONICAL_USER_ID || null,
+    // Runner-minted HMAC binding canonicalUserId to what the bot stamped for
+    // this turn; the loopback's owner gates verify it (see core/speaker-attest).
+    speakerAttest: process.env.OC_SPEAKER_ATTEST || null,
     provider: process.env.OC_PROVIDER || null,
     providerSettings,
     project: process.env.OC_PROJECT || null,
@@ -76,6 +79,7 @@ function postJson(kind, body) {
     adapter: ctx.adapterId,
     userId: ctx.userId,
     canonicalUserId: ctx.canonicalUserId,
+    speakerAttest: ctx.speakerAttest,
     provider: ctx.provider,
     providerSettings: ctx.providerSettings,
     project: requestedProject,

package/bot.js

@@ -207,7 +207,16 @@ process.on("uncaughtException", (err) => {
   try { persist(); } catch (e) {}
   setTimeout(() => process.exit(1), 2000);
 });
-process.on("unhandledRejection", (reason) => notifyError("Unhandled rejection", reason));
+process.on("unhandledRejection", (reason) => {
+  // werift's TURN/ICE client rejects STUN error responses (e.g. coturn 403s)
+  // uncaught; benign for the call itself, so keep them out of Telegram.
+  const stack = typeof reason?.stack === "string" ? reason.stack : "";
+  if (stack.includes("werift/lib/ice") || stack.includes("werift\\lib\\ice")) {
+    console.error("Unhandled rejection (werift ice, suppressed):", stack.split("\n").slice(0, 2).join(" | "));
+    return;
+  }
+  notifyError("Unhandled rejection", reason);
+});
 
 // ── Update checker ─────────────────────────────────────────────────
 

package/channels/kazee/adapter.js

@@ -301,6 +301,11 @@ class KazeeAdapter {
         }
         envelope.engaged = true;
         envelope.surface = "group";
+      } else if (meta) {
+        // Adapter-attested 1:1 conversation — required before intro-flow may
+        // auto-adopt the chat for a known sender. Set only on a positive meta
+        // read: an unresolvable chat stays unattested (fail closed).
+        envelope.surface = "dm";
       }
     }
 

package/channels/kazee/call/audio.js

@@ -120,6 +120,84 @@ class TurnDetector {
   }
 }
 
+// A fixed threshold breaks in a noisy room: background keeps every frame
+// "loud", the silence rule never fires, and the turn only ends at the 30s cap
+// — 30 seconds of dead air. Tracking the running noise floor and sitting a
+// fixed margin above it keeps the silence rule alive at any steady background
+// level (jig-measured to hold to ~14dB SNR; below that only the recogniser's
+// word timeline can end a turn, which the session layers on top).
+class AdaptiveTurnDetector {
+  constructor({ marginDb = 12, windowFrames = 100, onsetFrames = 3, silenceMs = 700,
+    maxTurnMs = 30000, minThresholdDb = -50, bootstrapFrames = 40 } = {}) {
+    this.marginDb = marginDb;
+    this.windowFrames = windowFrames;
+    this.onsetFrames = onsetFrames;
+    this.minThresholdDb = minThresholdDb;
+    this.bootstrapFrames = bootstrapFrames;
+    this.silenceFrames = Math.ceil(silenceMs / FRAME_MS);
+    this.maxFrames = Math.ceil(maxTurnMs / FRAME_MS);
+    this.recent = [];
+    this.frames = 0;
+    // While the bot is speaking, device echo leaks back through the caller's
+    // mic; the session raises this so only clearly-louder audio counts.
+    this.boostTo = null;
+    this.reset();
+  }
+
+  reset() {
+    this.active = false;
+    this.loudFrames = 0;
+    this.quietFrames = 0;
+    this.turnFrames = 0;
+  }
+
+  _baseThreshold() {
+    const sorted = this.recent.filter(Number.isFinite).sort((a, b) => a - b);
+    if (sorted.length < 10) return this.minThresholdDb;
+    const floor = sorted[Math.floor(sorted.length * 0.1)];
+    return Math.max(this.minThresholdDb, floor + this.marginDb);
+  }
+
+  get thresholdDb() {
+    const base = this._baseThreshold();
+    return this.boostTo === null ? base : Math.max(base, this.boostTo);
+  }
+
+  push(pcm48k) {
+    const db = rmsDbfs(pcm48k);
+    this.frames += 1;
+    const base = this._baseThreshold();
+    // Bootstrap the floor from the opening of the call (the room is audible
+    // before anyone speaks), then keep it honest by sampling only frames that
+    // look like background — sampling the caller's own voice would raise the
+    // threshold above them and cut them off mid-word. The gate uses the
+    // un-boosted threshold so echo never pollutes the floor estimate.
+    if (this.frames <= this.bootstrapFrames || db < base) {
+      this.recent.push(db);
+      if (this.recent.length > this.windowFrames) this.recent.shift();
+    }
+    const loud = db >= (this.boostTo === null ? base : Math.max(base, this.boostTo));
+    if (!this.active) {
+      this.loudFrames = loud ? this.loudFrames + 1 : 0;
+      if (this.loudFrames >= this.onsetFrames) {
+        this.active = true;
+        this.quietFrames = 0;
+        this.turnFrames = this.loudFrames;
+        return { type: "start" };
+      }
+      return null;
+    }
+    this.turnFrames += 1;
+    this.quietFrames = loud ? 0 : this.quietFrames + 1;
+    if (this.quietFrames >= this.silenceFrames || this.turnFrames >= this.maxFrames) {
+      const reason = this.turnFrames >= this.maxFrames ? "max-duration" : "silence";
+      this.reset();
+      return { type: "commit", reason };
+    }
+    return null;
+  }
+}
+
 module.exports = {
   FRAME_MS,
   STT_RATE,
@@ -127,6 +205,7 @@ module.exports = {
   WEBRTC_SAMPLES,
   OpusAudioCodec,
   TurnDetector,
+  AdaptiveTurnDetector,
   downsample48To16,
   rmsDbfs,
   upsampleTo48,

package/channels/kazee/call/manager.js

@@ -87,6 +87,12 @@ class KazeeCallManager {
     if (callType !== "audio") return reject("unsupported_media");
     if (this.session) return reject("busy");
 
+    // Human callee devices emit call:ringing as soon as they show the ring UI;
+    // chat-central relays it and the caller's client uses it to advance the
+    // status flow (calling -> ringing). Without it a web caller sits on
+    // "calling" with no feedback while we fetch ICE + join Janus (2026-08-16).
+    this.adapter._socket?.emit("call:ringing", { toUserId: callerId, chatId });
+
     const iceServers = await this._fetchIceServers();
     const session = new this.SessionImpl({
       roomId, chatId, callerId, botUserId: this.adapter.botUserId,