@inetafrica/open-claudia 3.2.3 → 3.3.2

package/core/actions.js

@@ -89,7 +89,21 @@ function appendMandate(rec, line) {
 function appendMandateLine(rec, lineText, log, opts) {
   const entities = require("./entities");
   const mandates = require("./mandates");
-  const ent = rec.entitySlug ? entities.readEntity(rec.entitySlug) : null;
+  // Strictly slug-keyed: resolve through the record's entitySlug, else through
+  // the person record by id. NEVER name-keyed — a display name is spoofable,
+  // and a name-keyed upsert can land security text on a same-named OTHER
+  // person's note (the exact escalation the hashed auto-contact slugs exist
+  // to prevent).
+  let slug = String(rec.entitySlug || "").trim();
+  if (!slug && rec.personId) {
+    try {
+      const people = require("./people");
+      const person = people.findById(String(rec.personId));
+      slug = String((person && people.resolveEntitySlug(person)) || "").trim();
+    } catch (e) { slug = ""; }
+  }
+  if (!slug) return { ok: false, reason: "no linked contact record to hold the grant" };
+  const ent = entities.readEntity(slug);
   const name = (ent && ent.name) || rec.personName;
   if (!name) return { ok: false, reason: "no contact record" };
   const coreText = mandates.splitExpiry(String(lineText || "")).text;
@@ -121,14 +135,12 @@ function appendMandateLine(rec, lineText, log, opts) {
     return { ok: false, reason: "their mandate is full — trim it with /guardrails" };
   }
   const up = entities.upsertEntity({
-    slug: (ent && ent.slug) || rec.entitySlug || undefined,
+    slug,
     name,
     relationship: (ent && ent.relationship) || "external",
     mandate,
     log,
   });
-  // id is slug-scoped, so derive it from the entity the write actually landed
-  // on (legacy name-keyed upserts can resolve to a pre-existing slug).
   const res = { ok: true, id: mandates.lineId(up.entity.slug, coreText), expiresAt: expiresAt || null };
   if (refreshed) res.refreshed = true;
   return res;
@@ -753,6 +765,86 @@ async function handleAction(envelope) {
     await send(`Type the rule to apply to ${target}.\nFor example: “may share our office hours and address”, or “never discuss pricing”.\n\nOr send /cancel to skip.`);
     return;
   }
+  if (d.startsWith("vfy:")) {
+    // "Verify contact…" on an approval card for an unverified auto-added
+    // speaker. Owner-only (transport-gated on the callback envelope — the one
+    // surface the agent can't forge). Offers the same-name candidate notes as
+    // buttons; the actual state change happens in the vfl: pick handler via
+    // core/verify-contact, which re-validates everything.
+    if (!isChatOwner(envelope.channelId)) return send("Owner only — contact verification is restricted.");
+    const id = d.split(":")[1];
+    const approvals = require("./approvals");
+    const rec = approvals.read(id);
+    if (!rec || !rec.personId) return send("That request expired — nothing to verify from it.");
+    const people = require("./people");
+    const person = people.findById(rec.personId);
+    if (!person) return send("I no longer have a contact record for them.");
+    if (!person.autoCreated) return send(`${person.name} is already verified.`);
+    const candidates = require("./verify-contact").candidateEntitiesFor(person).slice(0, 6);
+    // Button payloads are INDEX-based: Telegram caps callback_data at 64
+    // bytes and slugs alone can be 60 — the picked index resolves against
+    // this snapshot, so a changed entity set can't shift what a tap means.
+    state.pendingVerify = {
+      aprId: rec.id,
+      personId: person.id,
+      personName: person.name,
+      candidates: candidates.map((c) => ({ slug: c.slug, name: c.name })),
+      armedAt: Date.now(),
+    };
+    saveState();
+    const rows = candidates.map((c, i) => ([{ text: `🔗 Link to ${c.slug}`.slice(0, 60), callback_data: `vfl:${rec.id}:${i}` }]));
+    rows.push([{ text: "✅ Just verify — this is a new contact", callback_data: `vfl:${rec.id}:self` }]);
+    rows.push([{ text: "✖️ Cancel", callback_data: `vfl:${rec.id}:x` }]);
+    await send(
+      `🪪 Verify ${person.name}?\n` +
+        (candidates.length
+          ? `They share a name with ${candidates.length === 1 ? "an existing note" : `${candidates.length} existing notes`} — link them if this is the same person, or keep them separate.\n`
+          : `No existing note matches their name — verifying keeps their current note as canonical.\n`) +
+        `Verifying settles WHO they are. It grants no permissions — use “Make a rule” or /guardrails for that.`,
+      { keyboard: { inline_keyboard: rows } }
+    );
+    return;
+  }
+  if (d.startsWith("vfl:")) {
+    // Verification pick. Owner-only; one-shot against the armed snapshot with
+    // the same 5-minute TTL as rule authoring. verifyContact() re-validates
+    // the person and target at execution time, so a stale snapshot can only
+    // refuse — never mislink.
+    if (!isChatOwner(envelope.channelId)) return send("Owner only — contact verification is restricted.");
+    const parts = d.split(":");
+    const id = parts[1];
+    const pick = parts[2];
+    const pend = state.pendingVerify;
+    const VERIFY_TTL_MS = 5 * 60 * 1000;
+    if (!pend || pend.aprId !== id || (pend.armedAt && Date.now() - pend.armedAt > VERIFY_TTL_MS)) {
+      state.pendingVerify = null; saveState();
+      return send("That verify prompt is stale — tap “Verify contact…” on the card again.");
+    }
+    state.pendingVerify = null; saveState();
+    if (pick === "x") return send("Okay — left unverified.");
+    let linkSlug = null;
+    if (pick !== "self") {
+      const chosen = pend.candidates[parseInt(pick, 10)];
+      if (!chosen) return send("That button is stale — tap “Verify contact…” on the card again.");
+      linkSlug = chosen.slug;
+    }
+    const result = require("./verify-contact").verifyContact({
+      personId: pend.personId,
+      linkSlug,
+      by: String(envelope.channelId),
+      via: "approval-card",
+    });
+    if (!result.ok) {
+      return send(result.already
+        ? `${pend.personName} is already verified.`
+        : `Couldn't verify: ${result.reason}`);
+    }
+    return send(
+      `🪪 Verified ${pend.personName}` +
+        (linkSlug ? ` — linked to ${result.slug}${result.superseded ? ` (auto-stub ${result.superseded} retired)` : ""}.` : ` — their note is now canonical.`) +
+        `\nVerification settles identity only; permissions still come from mandates and rules.`
+    );
+  }
   if (d.startsWith("grd:")) {
     // Guardrail capture buttons (Track C). Owner-only: standing rules layer
     // above lessons and are never editable by an external speaker.

package/core/enforcer.js

@@ -336,7 +336,7 @@ function esc(s) {
 // Framing: the owner is deciding whether the bot should ACT on a request from
 // this person — the card leads with WHO is asking WHAT, then what the bot
 // proposes to do about it, never with the bot's output as the headline.
-async function postOwnerButtons(rec, owner, { kind, summary, reason }) {
+async function postOwnerButtons(rec, owner, { kind, summary, reason, strandedMandate = "" }) {
   const adapter = adapterFor(owner.adapter);
   if (!adapter) return false;
   const who = rec.personName || "An external contact";
@@ -360,7 +360,28 @@ async function postOwnerButtons(rec, owner, { kind, summary, reason }) {
       `<pre>${esc(String(rec.command || ""))}</pre>`,
     ];
   }
-  const lines = [head, ``, ...askBlock, ...body, reason ? `\nWhy I'm checking: ${esc(reason)}` : ``];
+  // Unverified auto-added speaker → the card carries a one-tap way for the
+  // owner to settle WHO this is (link to an existing note, or bless the stub).
+  // Computed live from the people record — after verification the row (and
+  // the warning line) disappear from subsequent cards on their own.
+  let unverifiedLine = "";
+  let verifyRow = null;
+  try {
+    if (rec.personId) {
+      const person = require("./people").findById(rec.personId);
+      if (person && person.autoCreated && !person.isOwner) {
+        const candidates = require("./verify-contact").candidateEntitiesFor(person);
+        unverifiedLine = candidates.length
+          ? `⚠️ Unverified auto-added contact. Possible existing note: <b>${esc(candidates[0].slug)}</b> — NOT linked until you verify.`
+          : `⚠️ Unverified auto-added contact — I only know them from this chat.`;
+        verifyRow = [{ text: "🪪 Verify contact…", callback_data: `vfy:${rec.id}` }];
+      }
+    }
+  } catch (e) { /* card still posts without the verify affordance */ }
+  const lines = [head, ``, ...askBlock, ...body,
+    unverifiedLine ? `\n${unverifiedLine}` : ``,
+    strandedMandate ? `\n⚠️ ${esc(strandedMandate)}` : ``,
+    reason ? `\nWhy I'm checking: ${esc(reason)}` : ``];
   const yes = kind === "triage" ? "✅ Yes, handle it" : "✅ Approve once";
   const no = kind === "triage" ? "⛔ No, decline" : "⛔ Deny";
   const keyboard = { inline_keyboard: [
@@ -370,6 +391,7 @@ async function postOwnerButtons(rec, owner, { kind, summary, reason }) {
     ],
     [
       { text: "📝 Make a rule…", callback_data: `apr:${rec.id}:rule` },
+      ...(verifyRow || []),
     ],
   ] };
   try {
@@ -429,6 +451,33 @@ async function escalate({
       channelLabel = String((await originAdapter.channelLabel(String(speaker.channelId))) || "").trim();
     }
   } catch (e) {}
+  // Dual-file trap detection: a mandate granted on the name-obvious note while
+  // the enforcer reads this person's (hashed) record slug silently does
+  // nothing. Detect it at the moment it bites — the escalation the owner
+  // thought a grant had already prevented — and say where the grant actually
+  // lives. Detection only: the stranded text is NEVER applied (names are
+  // spoofable; only the owner links the two, via verify).
+  let strandedMandate = "";
+  try {
+    if (speaker && speaker.person && speaker.slug && !String(speaker.mandate || "").trim()) {
+      const entities = require("./entities");
+      const sibling = entities.slugify(speaker.person.name || "");
+      if (sibling && sibling !== speaker.slug) {
+        const other = entities.readEntity(sibling);
+        const text = other && other.type === "person"
+          ? require("./mandates").activeMandateText(String((other.sections && other.sections.Mandate) || "")).trim()
+          : "";
+        if (text) {
+          const people = require("./people");
+          const holder = people.list().find((p) => p.id !== speaker.person.id && people.resolveEntitySlug(p) === sibling);
+          if (!holder) {
+            strandedMandate = `A mandate exists on ${sibling}.md, but ${speaker.person.name}'s record reads ${speaker.slug}.md — those grants have NO effect. Merge them with the Verify button (or /people verify), or re-add via Make a rule.`;
+            if (audit) audit.log("enforcer.stranded-mandate", { personId: speaker.person.id, slug: speaker.slug, sibling });
+          }
+        }
+      }
+    }
+  } catch (e) { strandedMandate = ""; }
   const rec = approvals.create({
     tool: kind === "reply" ? "external-reply" : kind === "triage" ? "external-triage" : "external-action",
     verb: "",
@@ -459,7 +508,7 @@ async function escalate({
     inboundText,
     channelLabel,
   });
-  const posted = await postOwnerButtons(rec, owner, { kind, summary, reason });
+  const posted = await postOwnerButtons(rec, owner, { kind, summary, reason, strandedMandate });
   if (!posted) {
     approvals.decide(rec.id, "denied", "owner-unreachable");
     if (audit) audit.log("enforcer.escalate.failed", { reason: "could not post to owner", id: rec.id });

package/core/handlers.js

@@ -2466,7 +2466,7 @@ function formatPersonShort(p) {
 }
 
 register({
-  name: "people", description: "Manage team members", args: "[show|note|link|unlink|set-primary|add|remove ...]",
+  name: "people", description: "Manage team members", args: "[show|note|link|unlink|set-primary|add|remove|verify ...]",
   handler: async (env, { tail }) => {
     if (!authorized(env)) return;
     if (!tail || tail === "list") {
@@ -2552,7 +2552,51 @@ register({
       for (const h of handles) { const r = accessStore.revokeChat(h.channelId); if (r.ok) revokedCount += 1; }
       return send(`Removed ${person.name}. Deauthed ${revokedCount} chat${revokedCount === 1 ? "" : "s"}.`);
     }
-    send("Usage: /people | /people show <name> | /people note <name> <text> | /people add|link|unlink|set-primary|remove ... (owner)");
+    // Verify an auto-added contact: settle their identity, optionally binding
+    // them to an existing note. Owner-only and chat-surface-only by design —
+    // there is deliberately no CLI/loopback equivalent, so identity decisions
+    // can never ride agent-forgeable input. Grants no permissions.
+    const verifyMatch = tail.match(/^verify\s+(.+?)(?:\s+link\s+(\S+))?$/i);
+    if (verifyMatch) {
+      const person = peopleStore.findById(verifyMatch[1].trim()) || peopleStore.findByName(verifyMatch[1].trim());
+      if (!person) return send(`Not found: ${verifyMatch[1].trim()}`);
+      const vc = require("./verify-contact");
+      if (person.autoCreated && !verifyMatch[2]) {
+        const candidates = vc.candidateEntitiesFor(person);
+        if (candidates.length) {
+          return send(
+            `${person.name} shares a name with ${candidates.length === 1 ? "an existing note" : `${candidates.length} existing notes`}:\n` +
+              candidates.map((c) => `  ${c.slug}`).join("\n") +
+              `\n\nLink with /people verify ${person.name} link <slug>, or /people verify-new ${person.name} to keep them separate.`
+          );
+        }
+      }
+      const result = vc.verifyContact({
+        personId: person.id,
+        linkSlug: verifyMatch[2] || null,
+        by: env.canonicalUserId || String(env.channelId),
+        via: "slash-command",
+      });
+      if (!result.ok) return send(result.already ? `${person.name} is already verified.` : `Couldn't verify: ${result.reason}`);
+      return send(
+        `🪪 Verified ${person.name}` +
+          (verifyMatch[2] ? ` — linked to ${result.slug}${result.superseded ? ` (auto-stub ${result.superseded} retired)` : ""}.` : ` — their note is now canonical.`) +
+          `\nVerification settles identity only; permissions still come from mandates and rules.`
+      );
+    }
+    const verifyNewMatch = tail.match(/^verify-new\s+(.+)$/i);
+    if (verifyNewMatch) {
+      const person = peopleStore.findById(verifyNewMatch[1].trim()) || peopleStore.findByName(verifyNewMatch[1].trim());
+      if (!person) return send(`Not found: ${verifyNewMatch[1].trim()}`);
+      const result = require("./verify-contact").verifyContact({
+        personId: person.id,
+        by: env.canonicalUserId || String(env.channelId),
+        via: "slash-command",
+      });
+      if (!result.ok) return send(result.already ? `${person.name} is already verified.` : `Couldn't verify: ${result.reason}`);
+      return send(`🪪 Verified ${person.name} — their note is now canonical.\nVerification settles identity only; permissions still come from mandates and rules.`);
+    }
+    send("Usage: /people | /people show <name> | /people note <name> <text> | /people add|link|unlink|set-primary|remove|verify ... (owner)");
   },
 });
 

package/core/intro-flow.js

@@ -98,11 +98,80 @@ async function notifyOwnerAboutIntro(intro) {
   }
 }
 
+// Legacy auth.json entry for a channel, created — or upgraded in place — so
+// isChatAuthorized/isChatOwner agree with the people record. isOwner flows
+// from people.isOwner: dropping it here is what demoted owners approved onto
+// a second channel (isChatOwner reads this file, not the person).
+function ensureAuthEntry(channelId, { name = null, username = null, isOwner = false } = {}) {
+  const auth = loadAuth();
+  const id = String(channelId);
+  const existing = auth.authorized.find((a) => String(a.chatId) === id);
+  if (existing) {
+    if (isOwner && existing.isOwner !== true) {
+      existing.isOwner = true;
+      saveAuth(auth);
+    }
+    return auth;
+  }
+  auth.authorized.push({
+    chatId: id,
+    name: name || "",
+    username: username || null,
+    isOwner: !!isOwner,
+    authorizedAt: new Date().toISOString(),
+  });
+  saveAuth(auth);
+  return auth;
+}
+
+// A sender whose transport user id already maps to a person is never
+// interrogated: the id is adapter-attested (the same trust level as the
+// KAZEE_OWNER_USER_ID owner match) — unlike display names, which are
+// spoofable and are never matched. Only 1:1 conversations are adopted: the
+// adapter must attest surface "dm", because auth.json and isChatOwner are
+// per-CHANNEL, so adopting a multi-party room would hand every member the
+// sender's standing. No attestation, no adoption (fail closed).
+function adoptKnownSender(envelope, adapter, channelId) {
+  if (envelope.surface !== "dm") return null;
+  const senderId = envelope.userId != null ? String(envelope.userId) : "";
+  if (!senderId || senderId === channelId) return null;
+  const person = people.findByHandle(adapter, senderId);
+  if (!person) return null;
+  try {
+    people.linkHandle(person.id, {
+      adapter, channelId,
+      displayName: displayNameFromEnvelope(envelope),
+      approvedBy: "auto:transport-id",
+    });
+  } catch (e) {
+    return null; // handle conflict — leave the channel to the normal intro flow
+  }
+  ensureAuthEntry(channelId, {
+    name: person.name || displayNameFromEnvelope(envelope),
+    username: usernameFromEnvelope(envelope),
+    isOwner: person.isOwner === true,
+  });
+  const pending = intros.activeForChannel(adapter, channelId);
+  if (pending) intros.remove(pending.id);
+  audit.log("intro.auto-adopted", {
+    personId: person.id, adapter, channelId, senderId,
+    isOwner: person.isOwner === true,
+    resolvedIntroId: pending ? pending.id : null,
+  });
+  return person;
+}
+
+// Returns true when the intro flow consumed the message (the router must not
+// process it further); false ONLY when the sender was recognised by transport
+// id and the channel auto-adopted — the router then handles the turn normally.
 async function handleInbound(envelope, sendFn) {
   intros.sweep();
   const adapter = envAdapterType(envelope);
   const channelId = String(envelope.channelId);
-  if (!adapter) return false;
+  if (!adapter) return true;
+
+  const known = adoptKnownSender(envelope, adapter, channelId);
+  if (known) return false;
 
   let intro = intros.activeForChannel(adapter, channelId);
   const text = String(envelope.text || "").trim();
@@ -200,7 +269,7 @@ async function handleInbound(envelope, sendFn) {
     return true;
   }
 
-  return false;
+  return true;
 }
 
 async function applyApproval(intro, by) {
@@ -227,20 +296,16 @@ async function applyApproval(intro, by) {
   } else {
     throw new Error("intro has no claim — owner approved a half-finished intro");
   }
-  // Also write into auth.json so legacy isChatAuthorized + isChatOwner still work.
-  const auth = loadAuth();
-  if (!auth.authorized.some((a) => String(a.chatId) === String(intro.channelId))) {
-    auth.authorized.push({
-      chatId: String(intro.channelId),
-      name: intro.displayName || person.name,
-      username: intro.username || null,
-      isOwner: false,
-      authorizedAt: new Date().toISOString(),
-    });
-    saveAuth(auth);
-    if (intro.adapter === "telegram") {
-      try { updateAuthorizedChatEnv(auth); } catch (e) {}
-    }
+  // Also write into auth.json so legacy isChatAuthorized + isChatOwner still
+  // work. isOwner mirrors the person record: an owner approved onto a new
+  // channel keeps owner status there (hardcoding false demoted Kazee owners).
+  const auth = ensureAuthEntry(intro.channelId, {
+    name: intro.displayName || person.name,
+    username: intro.username,
+    isOwner: person.isOwner === true,
+  });
+  if (intro.adapter === "telegram") {
+    try { updateAuthorizedChatEnv(auth); } catch (e) {}
   }
   intros.approve(intro.id, by);
   audit.log("intro.approved", { introId: intro.id, personId: person.id, by });

package/core/loopback.js

@@ -25,6 +25,7 @@ const introFlow = require("./intro-flow");
 const relay = require("./relay");
 const audit = require("./audit");
 const access = require("./access");
+const speakerAttest = require("./speaker-attest");
 const fs2 = require("fs");
 const path2 = require("path");
 const { TRANSCRIPTS_DIR } = require("./config");
@@ -85,9 +86,17 @@ const JSON_KINDS = new Set([
   "say", "call", "tts", "transcribe",
 ]);
 
+// Owner gate for identity-sensitive kinds. The claimed canonicalUserId comes
+// from the CLI's env, which the agent's shell can rewrite — so the claim only
+// counts when it carries the runner-minted attestation (an HMAC over the id
+// with a per-boot, memory-only secret; see core/speaker-attest). No attest,
+// a wrong attest, or an attest for a different id all fail closed: forging
+// `OC_CANONICAL_USER_ID=<owner-id>` from a guarded external turn no longer
+// reaches the people/auth/intros mutations the relationship guard depends on.
 function callerIsOwner(payload) {
   const caller = payload?.canonicalUserId;
   if (!caller) return false;
+  if (!speakerAttest.verify(caller, payload?.speakerAttest)) return false;
   const person = peopleStore.findByCanonicalUserId(caller);
   return !!(person && person.isOwner);
 }
@@ -602,6 +611,24 @@ async function handleJson(req, res, url, kind) {
 
   if (kind === "relay-send") {
     if (!payload.text) return reply(res, 400, { error: "missing text" });
+    // A guarded (external) requester may pass a message TO THE OWNER — that is
+    // the "tell them for me" flow — but never use the bot as a relay to third
+    // parties: sending as the bot to anyone else is impersonation surface.
+    try {
+      const relationship = require("./relationship");
+      const speaker = relationship.speakerFor(adapter.type, channelId, userId);
+      if (relationship.guardActive(speaker)) {
+        const target =
+          (payload.targetPersonId && peopleStore.findById(payload.targetPersonId)) ||
+          (payload.targetPersonName && peopleStore.findByName(payload.targetPersonName)) ||
+          (payload.targetCanonicalUserId && peopleStore.findByCanonicalUserId(payload.targetCanonicalUserId)) ||
+          (payload.targetAdapter && payload.targetChannelId && peopleStore.findByHandle(payload.targetAdapter, payload.targetChannelId)) ||
+          null;
+        if (!target || !target.isOwner) {
+          return reply(res, 403, { error: "relay from an external contact can only go to the owner — messages to anyone else are owner-only" });
+        }
+      }
+    } catch (e) { /* classification failure → fall through; owner-scoped in practice */ }
     try {
       const result = await relay.send({
         text: payload.text,
@@ -620,6 +647,16 @@ async function handleJson(req, res, url, kind) {
   }
 
   if (kind === "recent-fetch") {
+    // Transcript reads are owner-side memory. A guarded (external, non-owner)
+    // requester must not pull other channels' conversations through the CLI —
+    // same default-deny as file/voice egress, same fail direction.
+    try {
+      const relationship = require("./relationship");
+      const speaker = relationship.speakerFor(adapter.type, channelId, userId);
+      if (relationship.guardActive(speaker)) {
+        return reply(res, 403, { error: "transcript access is owner-only — an external contact cannot read other conversations" });
+      }
+    } catch (e) { /* classification failure → fall through; owner-scoped in practice */ }
     const limit = Math.max(1, Math.min(parseInt(payload.limit || 20, 10) || 20, 200));
     try {
       let targetAdapter = payload.adapter;

package/core/media.js

@@ -99,34 +99,87 @@ async function elevenLabsToVoice(clean) {
   }
 }
 
+// Pack already-cleaned text into gateway-sized pieces. Long inputs used to go
+// to the gateway as ONE request and blow its synthesis window (the abort was
+// the binding limit, not any transport) — sentence-packed chunks keep every
+// request comfortably inside it. Oversized single sentences are hard-split at
+// word boundaries so one run-on sentence can't recreate the timeout.
+const TTS_CHUNK_MAX = 450;
+function chunkForTTS(clean, maxLen = TTS_CHUNK_MAX) {
+  if (clean.length <= maxLen) return [clean];
+  const sentences = clean.match(/[^.!?]+[.!?]+|\S[^.!?]*$/g) || [clean];
+  const chunks = [];
+  let buf = "";
+  const flush = () => { if (buf) { chunks.push(buf); buf = ""; } };
+  for (let piece of sentences) {
+    piece = piece.trim();
+    if (!piece) continue;
+    while (piece.length > maxLen) {
+      flush();
+      let cut = piece.lastIndexOf(" ", maxLen);
+      if (cut < maxLen / 2) cut = maxLen;
+      chunks.push(piece.slice(0, cut).trim());
+      piece = piece.slice(cut).trim();
+    }
+    if (buf && buf.length + piece.length + 1 > maxLen) flush();
+    buf = buf ? `${buf} ${piece}` : piece;
+  }
+  flush();
+  return chunks.filter(Boolean);
+}
+
+async function pocketFetchWav(input, voice, token) {
+  const res = await fetch(`${SPEECH_SERVICE_URL.replace(/\/$/, "")}/v1/audio/speech`, {
+    method: "POST",
+    headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
+    body: JSON.stringify({ input, voice, response_format: "wav" }),
+    signal: AbortSignal.timeout(120000),
+  });
+  if (!res.ok) throw new Error(`HTTP ${res.status}`);
+  return Buffer.from(await res.arrayBuffer());
+}
+
 // Pocket TTS through the Agent Space speech gateway. The gateway returns WAV;
-// Telegram and voice transports receive a compact Ogg/Opus file.
+// Telegram and voice transports receive a compact Ogg/Opus file. Long text is
+// synthesized chunk-by-chunk and concatenated, so message length can no longer
+// abort the request mid-synthesis.
 async function pocketToVoice(clean, voiceOverride) {
   const token = speechBearerToken();
   if (TTS_PROVIDER === "elevenlabs" || !token || !SPEECH_SERVICE_URL || !FFMPEG) return null;
-  let wavPath = null;
+  const voice = voiceOverride || ttsVoice.getVoice();
+  const stem = `tts-pocket-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+  const oggPath = path.join(TEMP_DIR, `${stem}.ogg`);
+  const wavPaths = [];
+  let listPath = null;
   try {
-    const res = await fetch(`${SPEECH_SERVICE_URL.replace(/\/$/, "")}/v1/audio/speech`, {
-      method: "POST",
-      headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
-      body: JSON.stringify({ input: clean, voice: voiceOverride || ttsVoice.getVoice(), response_format: "wav" }),
-      signal: AbortSignal.timeout(60000),
-    });
-    if (!res.ok) {
-      console.error(`Pocket TTS failed: HTTP ${res.status}`);
-      return null;
+    const chunks = chunkForTTS(clean);
+    for (let i = 0; i < chunks.length; i++) {
+      let buf;
+      try {
+        buf = await pocketFetchWav(chunks[i], voice, token);
+      } catch (e) {
+        // one retry: a transient gateway blip shouldn't waste the chunks
+        // already synthesized before it
+        buf = await pocketFetchWav(chunks[i], voice, token);
+      }
+      const wavPath = path.join(TEMP_DIR, `${stem}-${i}.wav`);
+      fs.writeFileSync(wavPath, buf);
+      wavPaths.push(wavPath);
+    }
+    if (wavPaths.length === 1) {
+      execSync(`"${FFMPEG}" -i "${wavPaths[0]}" -c:a libopus -y "${oggPath}" 2>/dev/null`, { timeout: 30000 });
+    } else {
+      listPath = path.join(TEMP_DIR, `${stem}-list.txt`);
+      fs.writeFileSync(listPath, wavPaths.map((p) => `file '${p}'`).join("\n"));
+      execSync(`"${FFMPEG}" -f concat -safe 0 -i "${listPath}" -c:a libopus -y "${oggPath}" 2>/dev/null`, { timeout: 120000 });
     }
-    const stem = `tts-pocket-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
-    wavPath = path.join(TEMP_DIR, `${stem}.wav`);
-    const oggPath = path.join(TEMP_DIR, `${stem}.ogg`);
-    fs.writeFileSync(wavPath, Buffer.from(await res.arrayBuffer()));
-    execSync(`"${FFMPEG}" -i "${wavPath}" -c:a libopus -y "${oggPath}" 2>/dev/null`, { timeout: 30000 });
     return oggPath;
   } catch (e) {
     console.error("Pocket TTS error:", e.message);
     return null;
   } finally {
-    if (wavPath) { try { fs.unlinkSync(wavPath); } catch (e) {} }
+    for (const p of wavPaths) { try { fs.unlinkSync(p); } catch (e) {} }
+    if (listPath) { try { fs.unlinkSync(listPath); } catch (e) {} }
   }
 }
 
@@ -303,4 +356,4 @@ async function synthSentenceMp3(text) {
   }
 }
 
-module.exports = { transcribeAudio, transcribeAudioLocal, transcribeMedia, canTranscribe, textToVoice, textToVoiceFile, splitSentences, synthSentenceMp3, pocketToVoice, cloneVoiceFromClip, speechBearerToken, canSpeak, TTS_CMD };
+module.exports = { transcribeAudio, transcribeAudioLocal, transcribeMedia, canTranscribe, textToVoice, textToVoiceFile, splitSentences, synthSentenceMp3, pocketToVoice, chunkForTTS, cloneVoiceFromClip, speechBearerToken, canSpeak, TTS_CMD };

package/core/pack-review.js

@@ -388,7 +388,25 @@ function applyAction(a, activeSet = null) {
 
 function applyEntityAction(e) {
   if (!e || typeof e !== "object" || !String(e.name || "").trim()) return null;
+  // Slug-key through the people roster: name-keyed upserts land on the
+  // alphabetically-first same-named entity, but the relationship guard reads
+  // the file the person RECORD points at (auto-added contacts get a suffixed
+  // stub precisely so they can't shadow an existing note). A unique name
+  // match routes the write to the guard-read file; an ambiguous one (two
+  // tracked people sharing a name) is skipped outright — enriching the wrong
+  // identity's note is worse than writing nothing.
+  let slug = "";
+  try {
+    const people = require("./people");
+    const wanted = String(e.name || "").trim().toLowerCase();
+    const matches = people.list().filter((p) => (p.name || "").trim().toLowerCase() === wanted);
+    if (matches.length === 1) slug = people.resolveEntitySlug(matches[0]) || "";
+    else if (matches.length > 1) {
+      return { kind: "skip", slug: "", name: e.name, type: e.type || "", note: "ambiguous: multiple tracked people share this name — not writing to either note" };
+    }
+  } catch (err) { /* roster unavailable → name-keyed fallback below */ }
   const { entity, created } = entities.upsertEntity({
+    slug: slug || undefined,
     name: e.name,
     type: e.type,
     aliases: Array.isArray(e.aliases) ? e.aliases.slice(0, 5) : [],

package/core/relationship.js

@@ -253,10 +253,26 @@ function ensureContact(envelope) {
     const suffix = crypto.createHash("sha1").update(`${adapterType}:${userId}`).digest("hex").slice(0, 6);
     const slug = `${entities.slugify(displayName).slice(0, 48) || "contact"}-${suffix}`;
     people.setEntitySlug(person.id, slug);
+
+    // If a same-named person note already exists, surface it as a HINT only.
+    // Deliberately not linked (see invariants above): a name is spoofable, so
+    // absorbing the note here would hand the speaker that identity's history.
+    // Only the owner can link, via the approval card or /people verify.
+    let hint = "";
+    try {
+      const fresh = people.findById(person.id) || person;
+      const candidates = require("./verify-contact").candidateEntitiesFor(fresh);
+      if (candidates.length) hint = candidates.map((c) => c.slug).slice(0, 3).join(", ");
+    } catch (e) { /* hint is best-effort — the stub is safe without it */ }
+
     entities.upsertEntity({
       slug, name: displayName, type: "person", relationship: "external",
-      description: `Auto-added contact (unverified) — first seen in ${label}`,
-      log: `auto-added as a contact from ${label}`,
+      description: hint
+        ? `Auto-added contact (unverified) — first seen in ${label}. Possible existing note: ${hint} — NOT linked; only the owner can verify.`
+        : `Auto-added contact (unverified) — first seen in ${label}`,
+      log: hint
+        ? `auto-added as a contact from ${label}; same-named note detected (${hint}) — not linked pending owner verification`
+        : `auto-added as a contact from ${label}`,
     });
 
     try { require("./audit").log("auto-contact", { personId: person.id, name: displayName, adapter: adapterType, userId, channelId, entitySlug: slug }); } catch (e) {}