@inetafrica/open-claudia 3.4.11 → 3.4.12

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 3.4.12
+
+- Keep incoming calls on their per-attempt admission policy when the organization canary setting changes; managed access supplies the assigned gateway and TURN configuration. Owner-only audio calling remains enforced.
+- Flatten ICE server URLs for Werift, whose installed parser silently omits TURN when given browser-style URL arrays. Verify actual peer-connection TURN configuration in the tests.
+- Refresh Janus grants and relay credentials for future peer connections. Existing Werift TURN allocations keep their original credentials and expiry, so the bot closes before the earliest active allocation deadline. It does not hot-swap existing allocation authentication; the default one-hour TURN lifetime exceeds the bot's thirty-minute call limit.
+- Exclude the bot's own publisher by its Janus-assigned feed ID, including when the gateway replaces display names with canonical email. Keep the legacy bot display-prefix exclusion.
+
 ## 3.4.11
 
 - Verify timed-out guard processes from their parent, including forced termination and released concurrency, without racing a child-written receipt.

package/channels/kazee/call/access.js

@@ -1,12 +1,40 @@
 "use strict";
 const { randomUUID } = require("crypto");
 function validServer(value) {
-  if (value === undefined) return true;
+  if (value === undefined) return false;
   if (typeof value !== 'string') return false;
-  try { const url = new URL(value); return url.protocol === 'wss:' && !!url.hostname && !url.username && !url.password && !url.hash; }
+  try { const url = new URL(value); return url.protocol === 'wss:' && !!url.hostname && !url.username && !url.password && !url.hash && !url.search; }
   catch { return false; }
 }
 
+function projectAssignedIce(reply, now = Date.now()) {
+  if (!Array.isArray(reply.iceServers) || !reply.iceServers.length || reply.iceServers.length > 12
+    || !Number.isFinite(reply.iceCredentialsExpiresAt) || reply.iceCredentialsExpiresAt <= now) throw new Error("Invalid assigned call relay");
+  const iceServers = reply.iceServers.map(server => {
+    if (!server || typeof server !== 'object') throw new Error("Invalid assigned call relay");
+    const urls = Array.isArray(server.urls) ? server.urls : [server.urls];
+    if (!urls.length || urls.length > 12 || urls.some(url => typeof url !== 'string' || url.length > 1024
+      || !/^(stun|turn|turns):[^\s@?#]+(?:\?transport=(udp|tcp))?$/.test(url))) throw new Error("Invalid assigned call relay");
+    if (urls.some(url => /^turns?:/.test(url)) && (typeof server.username !== 'string' || !server.username || server.username.length > 2048
+      || typeof server.credential !== 'string' || !server.credential || server.credential.length > 2048)) throw new Error("Invalid assigned call relay");
+    return { urls: [...urls], ...(server.username === undefined ? {} : { username: server.username }), ...(server.credential === undefined ? {} : { credential: server.credential }) };
+  });
+  if (!iceServers.some(server => server.urls.some(url => /^turns?:/.test(url)))) throw new Error("Assigned call relay is unavailable");
+  return { iceServers, iceCredentialsExpiresAt: reply.iceCredentialsExpiresAt };
+}
+
+/** The bot's media adapter supports UDP TURN. TLS-only assignment fails closed. */
+function supportedIceServers(iceServers) {
+  const usable = iceServers.flatMap(server => {
+    const urls = (Array.isArray(server.urls) ? server.urls : [server.urls]).filter(url => typeof url === 'string' && (url.startsWith('stun:') || (url.startsWith('turn:') && !url.includes('transport=tcp'))));
+    // Werift's parser accepts one string URL per entry; arrays silently lose
+    // their TURN address/username despite matching the browser ICE shape.
+    return urls.map(url => ({ ...server, urls: url }));
+  });
+  if (!usable.some(server => server.urls.startsWith('turn:'))) throw new Error('Call configuration has no supported TURN route');
+  return usable;
+}
+
 function publicCallIdentity(payload = {}) {
   return {
     ...(payload.callAttemptId ? { callAttemptId: payload.callAttemptId } : {}),
@@ -28,6 +56,8 @@ function requestRoomAccess(socket, operation, input, { signal, timeoutMs = 10000
       if (reply.requestId !== requestId) return;
       if (!reply.ok) return fail("Call room access denied");
       if (reply.protocolVersion !== 3 || typeof reply.callAttemptId !== "string" || !/^[\w-]{16,128}$/.test(reply.callAttemptId)
+        || reply.roomAdmissionRequired !== true
+        || typeof reply.nodeId !== 'string' || !/^[\w-]{1,64}$/.test(reply.nodeId)
         || typeof reply.organizationId !== "string" || !reply.organizationId || reply.deviceId !== input.deviceId
         || !Number.isSafeInteger(reply.roomId) || reply.roomId <= 0 || !Number.isSafeInteger(reply.generation) || reply.generation < 0
         || (input.callAttemptId && reply.callAttemptId !== input.callAttemptId)
@@ -38,8 +68,11 @@ function requestRoomAccess(socket, operation, input, { signal, timeoutMs = 10000
         || typeof reply.janusToken !== "string" || !reply.janusToken || typeof reply.roomToken !== "string" || !reply.roomToken
         || (reply.leaseExpiresAt !== undefined && (!Number.isFinite(reply.leaseExpiresAt) || reply.leaseExpiresAt <= Date.now()))
         || !Number.isFinite(reply.roomTokenExpiresAt) || reply.roomTokenExpiresAt <= Date.now()) return fail("Invalid call room access response");
+      let assignedIce;
+      try { assignedIce = projectAssignedIce(reply); } catch (_) { return fail("Invalid call room access response"); }
       cleanup();
       resolve({ ...publicCallIdentity(reply), protocolVersion: 3, deviceId: reply.deviceId, generation: reply.generation,
+        roomAdmissionRequired: true, ...assignedIce,
         ...(reply.janusTokenExpiresAt !== undefined ? {janusTokenExpiresAt: reply.janusTokenExpiresAt} : {}),
         chatId: reply.chatId, nodeId: reply.nodeId, ...(reply.server !== undefined ? { server: reply.server } : {}), janusToken: reply.janusToken, roomToken: reply.roomToken, roomTokenExpiresAt: reply.roomTokenExpiresAt, ...(reply.leaseExpiresAt !== undefined ? { leaseExpiresAt: reply.leaseExpiresAt } : {}) });
     };
@@ -50,4 +83,4 @@ function requestRoomAccess(socket, operation, input, { signal, timeoutMs = 10000
     catch (_) { fail("Call socket unavailable"); }
   });
 }
-module.exports = { publicCallIdentity, requestRoomAccess };
+module.exports = { publicCallIdentity, requestRoomAccess, projectAssignedIce, supportedIceServers };

package/channels/kazee/call/manager.js

@@ -2,7 +2,7 @@
 
 const { randomUUID, randomInt } = require("crypto");
 const { CallLeaseHeartbeat } = require("./lease");
-const { publicCallIdentity, requestRoomAccess } = require("./access");
+const { publicCallIdentity, requestRoomAccess, supportedIceServers } = require("./access");
 const { canonicalForChannel } = require("../../../core/identity");
 const { KazeeCallSession } = require("./session");
 
@@ -56,12 +56,9 @@ class KazeeCallManager {
     catch (_) { throw new Error("Call configuration unavailable"); }
     const config = res?.config;
     if (!config || !Array.isArray(config.iceServers)) throw new Error("Call configuration unavailable");
-    const usable = config.iceServers.flatMap(server => {
-      const urls = (Array.isArray(server.urls) ? server.urls : [server.urls]).filter(url => typeof url === "string" && (url.startsWith("stun:") || (url.startsWith("turn:") && !url.includes("transport=tcp"))));
-      return urls.length ? [{ ...server, urls }] : [];
-    });
-    if (!usable.some(server => server.urls.some(url => url.startsWith("turn:")))) throw new Error("Call configuration has no supported TURN route");
+    const usable = supportedIceServers(config.iceServers);
     return { iceServers: usable, janusServer: config.janusServer || this.janusUrl, janusToken: config.janusToken,
+      iceCredentialsExpiresAt: config.iceCredentialsExpiresAt,
       roomAdmissionEnabled: config.roomAdmissionEnabled === true };
   }
 
@@ -78,12 +75,13 @@ class KazeeCallManager {
   }
 
   _sessionOptions(config, access, identity, signal) {
-    return { janusUrl: access?.server || config.janusServer, iceServers: config.iceServers, janusToken: access?.janusToken || config.janusToken,
-      janusTokenExpiresAt: access?.janusTokenExpiresAt, managedRoom: config.roomAdmissionEnabled, roomToken: access?.roomToken, roomTokenExpiresAt: access?.roomTokenExpiresAt,
-      refreshRoomAccess: config.roomAdmissionEnabled ? async () => {
+    return { janusUrl: access?.server || config.janusServer, iceServers: access ? supportedIceServers(access.iceServers) : config.iceServers, janusToken: access?.janusToken || config.janusToken,
+      iceCredentialsExpiresAt: access?.iceCredentialsExpiresAt ?? config.iceCredentialsExpiresAt,
+      janusTokenExpiresAt: access?.janusTokenExpiresAt, managedRoom: !!access, roomToken: access?.roomToken, roomTokenExpiresAt: access?.roomTokenExpiresAt,
+      refreshRoomAccess: access ? async () => {
         const next = await requestRoomAccess(this.adapter._socket, "room-access", { ...identity, deviceId: this.deviceId }, { signal });
         if (next.server !== access?.server || next.nodeId !== access?.nodeId || next.generation !== access?.generation) throw new Error('Call room placement changed');
-        return next;
+        return { ...next, iceServers: supportedIceServers(next.iceServers) };
       } : undefined };
   }
 
@@ -124,6 +122,7 @@ class KazeeCallManager {
     const identity = publicCallIdentity(payload);
     const reject = (reason) => this.adapter._socket?.emit("call:reject", { ...identity, ...(identity.callAttemptId ? { deviceId: this.deviceId, generation: Number.isSafeInteger(payload.generation) && payload.generation >= 0 ? payload.generation : 0 } : {}), toUserId: callerId, callType, chatId, roomId, reason });
     if (!callerId || !chatId || !Number.isSafeInteger(roomId) || roomId <= 0) return reject("invalid_call");
+    if (payload.roomAdmissionRequired !== undefined && typeof payload.roomAdmissionRequired !== 'boolean') return reject("invalid_call");
     if (callerId !== String(this.adapter.ownerUserId || "")) return reject("not_allowed");
     if (callType !== "audio") return reject("unsupported_media");
     if (this.session || this._pending) return reject("busy");
@@ -133,8 +132,11 @@ class KazeeCallManager {
     let session;
     try {
       const config = await this._fetchCallConfig();
-      if (config.roomAdmissionEnabled && !identity.callAttemptId) throw new Error("Call identity required");
-      const access = config.roomAdmissionEnabled ? await requestRoomAccess(this.adapter._socket, "room-access", { ...identity, chatId, deviceId: this.deviceId }, { signal: pending.controller.signal }) : null;
+      // Server event metadata belongs to this attempt. The latest org flag only
+      // controls new outgoing allocation, never an existing call's admission.
+      const managed = payload.roomAdmissionRequired === true;
+      if (managed && !identity.callAttemptId) throw new Error("Call identity required");
+      const access = managed ? await requestRoomAccess(this.adapter._socket, "room-access", { ...identity, chatId, deviceId: this.deviceId }, { signal: pending.controller.signal }) : null;
       if (pending.controller.signal.aborted) return;
       const boundIdentity = access ? { ...publicCallIdentity(access), deviceId: this.deviceId, generation: access.generation } : identity;
       session = new this.SessionImpl({ roomId, chatId, callerId, botUserId: this.adapter.botUserId,

package/channels/kazee/call/session.js

@@ -2,6 +2,7 @@
 
 const { MediaStreamTrack, RTCPeerConnection, RtpHeader, RtpPacket } = require("werift");
 const { JanusClient } = require("./janus-client");
+const { projectAssignedIce, supportedIceServers } = require("./access");
 const { AdaptiveTurnDetector, OpusAudioCodec, WEBRTC_SAMPLES, downsample48To16, upsampleTo48 } = require("./audio");
 const { SpeechStream, synthesizePcm, synthesizeStream: synthesizeStreamPcm } = require("./speech-client");
 const ttsVoice = require("../../../core/tts-voice");
@@ -73,7 +74,7 @@ const ACK_CHIME_PCM48 = tonePcm48([{ freq: 660, ms: 90 }, { freq: 990, ms: 110 }
 const THINK_TICK_PCM48 = tonePcm48([{ freq: 520, ms: 90 }], 0.045);
 
 class KazeeCallSession {
-  constructor({ roomId, chatId, callerId, botUserId, janusUrl, janusToken, janusTokenExpiresAt, roomToken, roomTokenExpiresAt, managedRoom = false, refreshRoomAccess, iceServers = [], onTranscript, onEnded, onMediaReady,
+  constructor({ roomId, chatId, callerId, botUserId, janusUrl, janusToken, janusTokenExpiresAt, roomToken, roomTokenExpiresAt, managedRoom = false, refreshRoomAccess, iceServers = [], iceCredentialsExpiresAt, onTranscript, onEnded, onMediaReady,
     maxCallMs, idleMs, finalWaitMs, synthesize = synthesizePcm, synthesizeStream = null, asCaller = false, greeting = null,
     JanusClientImpl = JanusClient, PeerConnectionImpl = RTCPeerConnection, SpeechStreamImpl = SpeechStream } = {}) {
     this.roomId = Number(roomId);
@@ -87,6 +88,7 @@ class KazeeCallSession {
     this.roomTokenExpiresAt = roomTokenExpiresAt;
     this.refreshRoomAccess = refreshRoomAccess;
     this.privateId = null;
+    this.publisherId = null;
     this.greeting = greeting ? String(greeting) : null;
     this._greeted = false;
     this._publisherUp = false;
@@ -97,6 +99,9 @@ class KazeeCallSession {
     this.PeerConnectionImpl = PeerConnectionImpl;
     this.SpeechStreamImpl = SpeechStreamImpl;
     this.iceServers = iceServers;
+    this.iceCredentialsExpiresAt = iceCredentialsExpiresAt;
+    this._transportIceExpiry = new Map();
+    this._transportExpiryTimer = null;
     this.onTranscript = onTranscript || (() => {});
     this.onEnded = onEnded || (() => {});
     this.onMediaReady = onMediaReady || (() => {});
@@ -136,15 +141,22 @@ class KazeeCallSession {
 
   async _roomAuth(force = false) {
     if (!this.managedRoom) return this.roomToken ? { token: this.roomToken } : {};
-    if (force || !this.roomToken || this.roomTokenExpiresAt <= Date.now() + 10000) {
+    if (force || !this.roomToken || this.roomTokenExpiresAt <= Date.now() + 10000 || this.iceCredentialsExpiresAt <= Date.now() + 60000) {
       if (!this.refreshRoomAccess) throw new Error("Call room credentials expired");
       if (!this._roomRefresh) {
         this._roomRefresh = Promise.resolve().then(() => this.refreshRoomAccess()).then(access => {
           if (this.closed) throw new Error("Call ended during credential refresh");
+          const assigned = projectAssignedIce(access);
+          const iceServers = supportedIceServers(assigned.iceServers);
           this.roomToken = access.roomToken;
           this.roomTokenExpiresAt = access.roomTokenExpiresAt;
           if (access.janusToken) this.janus.token = access.janusToken;
           if (access.janusTokenExpiresAt !== undefined) this.janusTokenExpiresAt = access.janusTokenExpiresAt;
+          // Werift captures TURN auth when each ICE transport is constructed.
+          // New credentials apply to future peers, never extend an existing
+          // allocation's immutable deadline or mutate its authentication.
+          this.iceServers = iceServers;
+          this.iceCredentialsExpiresAt = assigned.iceCredentialsExpiresAt;
         }).finally(() => { this._roomRefresh = null; });
       }
       await this._roomRefresh;
@@ -153,6 +165,29 @@ class KazeeCallSession {
     return { token: this.roomToken };
   }
 
+  _newPeerConnection() {
+    const expiresAt = this.iceCredentialsExpiresAt;
+    if (this.managedRoom && (!Number.isFinite(expiresAt) || expiresAt <= Date.now() + 1000)) throw new Error("Call relay credentials unavailable");
+    const pc = new this.PeerConnectionImpl({ iceServers: this.iceServers });
+    if (Number.isFinite(expiresAt)) {
+      this._transportIceExpiry.set(pc, expiresAt);
+      this._armTransportExpiry();
+    }
+    return pc;
+  }
+
+  _armTransportExpiry() {
+    if (this._transportExpiryTimer) clearTimeout(this._transportExpiryTimer);
+    this._transportExpiryTimer = null;
+    if (this.closed || !this._transportIceExpiry.size) return;
+    const deadline = Math.min(...this._transportIceExpiry.values());
+    this._transportExpiryTimer = setTimeout(() => {
+      this._transportExpiryTimer = null;
+      this.close("relay-credentials-expired").catch(() => console.error("Kazee call relay cleanup failed"));
+    }, Math.max(0, deadline - Date.now() - 1000));
+    this._transportExpiryTimer.unref?.();
+  }
+
   async start() {
     await this.janus.connect();
     if (this.closed) { await this.janus.close(); throw new Error("Call ended during setup"); }
@@ -213,10 +248,15 @@ class KazeeCallSession {
       if (data.error_code != null) error.code = Number(data.error_code);
       throw error;
     }
-    if (data.videoroom === "joined") this.privateId = data.private_id ?? null;
+    if (data.videoroom === "joined") {
+      this.privateId = data.private_id ?? null;
+      const publisherId = Number(data.id);
+      if (Number.isSafeInteger(publisherId) && publisherId > 0) this.publisherId = publisherId;
+      else if (this.managedRoom) throw new Error("Managed publisher identity unavailable");
+    }
     for (const publisher of data.publishers || []) {
       const feedId = Number(publisher.id);
-      if (!this.subscribers.has(feedId) && !String(publisher.display || "").startsWith("open-claudia:")) {
+      if (Number.isSafeInteger(feedId) && feedId > 0 && feedId !== this.publisherId && !this.subscribers.has(feedId) && !String(publisher.display || "").startsWith("open-claudia:")) {
         await this._subscribe(feedId, publisher.display);
       }
     }
@@ -264,7 +304,9 @@ class KazeeCallSession {
 
   async _publish() {
     if (this.publisher) return;
-    const pc = new this.PeerConnectionImpl({ iceServers: this.iceServers });
+    await this._roomAuth();
+    if (this.closed || this.publisher) return;
+    const pc = this._newPeerConnection();
     pc.iceConnectionStateChange?.subscribe?.((state) => {
       clog(`Kazee call publisher ICE: ${state} room=${this.roomId}`);
       if (state === "connected" || state === "completed") {
@@ -324,9 +366,10 @@ class KazeeCallSession {
     this.subscribers.set(feedId, null);
     clog(`Kazee call subscribing: feed=${feedId} display=${String(display || "")}`);
     try {
+      const roomAuth = await this._roomAuth();
       const handle = await this.janus.attach();
       if (this.closed) { await this.janus.detach(handle); this.subscribers.delete(feedId); return; }
-      const pc = new this.PeerConnectionImpl({ iceServers: this.iceServers });
+      const pc = this._newPeerConnection();
       pc.iceConnectionStateChange?.subscribe?.((state) => clog(`Kazee call subscriber ICE: ${state} feed=${feedId}`));
       const sub = {
         handle,
@@ -357,7 +400,7 @@ class KazeeCallSession {
         if (track.kind === "audio") track.onReceiveRtp.subscribe((packet) => this._onFeedRtp(feedId, packet));
       });
       this.janus.onHandle(handle, (frame) => this._onSubscriberEvent(feedId, frame));
-      const attached = await this.janus.message(handle, { ...(await this._roomAuth()), request: "join", ptype: "subscriber", room: this.roomId, feed: feedId, ...(this.privateId != null ? { private_id: this.privateId } : {}) });
+      const attached = await this.janus.message(handle, { ...roomAuth, request: "join", ptype: "subscriber", room: this.roomId, feed: feedId, ...(this.privateId != null ? { private_id: this.privateId } : {}) });
       await this._consumeSubscriberFrame(feedId, attached);
       await sub.stt.connect().then(
         () => clog(`Kazee call STT connected: feed=${feedId}`),
@@ -758,8 +801,8 @@ class KazeeCallSession {
   async _enforceLimits() {
     if (this.closed || this._ending) return;
     const now = Date.now();
-    if (this.managedRoom && this.janusTokenExpiresAt !== undefined && this.janusTokenExpiresAt <= now + 60000) {
-      if (this.janusTokenExpiresAt <= now) { await this.close("credentials-expired"); return; }
+    if (this.managedRoom && [this.janusTokenExpiresAt, this.roomTokenExpiresAt, this.iceCredentialsExpiresAt].some(expiry => expiry !== undefined && expiry <= now + 60000)) {
+      if ([this.janusTokenExpiresAt, this.roomTokenExpiresAt, this.iceCredentialsExpiresAt].some(expiry => expiry !== undefined && expiry <= now)) { await this.close("credentials-expired"); return; }
       // Uses the same single in-flight request as subscriber room-token refresh.
       // The next limit tick still closes at expiry if this request stalls.
       this._roomAuth(true).catch(() => {});
@@ -785,6 +828,8 @@ class KazeeCallSession {
     const sub = this.subscribers.get(feedId);
     if (!sub) return;
     this.subscribers.delete(feedId);
+    this._transportIceExpiry.delete(sub.pc);
+    this._armTransportExpiry();
     if (sub.finalTimer) clearTimeout(sub.finalTimer);
     try { sub.stt.close(); } catch (_) {}
     try { sub.codec.close(); } catch (_) {}
@@ -795,6 +840,10 @@ class KazeeCallSession {
   async close(reason = "ended") {
     if (this.closed) return;
     this.closed = true;
+    if (this._transportExpiryTimer) clearTimeout(this._transportExpiryTimer);
+    this._transportExpiryTimer = null;
+    const trackedPeers = [...this._transportIceExpiry.keys()];
+    this._transportIceExpiry.clear();
     this._leaseHeartbeat?.close();
     console.log(`Kazee call session closed: room=${this.roomId} reason=${reason}`);
     if (this._limitTimer) { clearInterval(this._limitTimer); this._limitTimer = null; }
@@ -806,6 +855,7 @@ class KazeeCallSession {
       try { await this.janus.message(this.publisherHandle, { request: "destroy", room: this.roomId }); } catch (_) {}
     }
     try { await this.publisher?.pc?.close(); } catch (_) {}
+    for (const pc of trackedPeers) { try { await pc.close(); } catch (_) {} }
     try { await this.janus.detach(this.publisherHandle); } catch (_) {}
     try { await this.janus.close(); } catch (_) {}
     this.codec.close();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inetafrica/open-claudia",
-  "version": "3.4.11",
+  "version": "3.4.12",
   "description": "An always-on, provider-agnostic coding-agent harness for Claude Code and OpenAI Codex via chat",
   "main": "bot.js",
   "bin": {

package/test-kazee-call-manager.js

@@ -94,7 +94,7 @@ function fixture() {
     if (["call:allocate", "call:room-access"].includes(name)) {
       setImmediate(() => originalEmit(`${name}-result`, { requestId: payload.requestId, ok: true, protocolVersion: 3,
         callAttemptId: "managed-attempt-123456789", organizationId: "tenant-a", roomId: 100, chatId: "managed-chat",
-        deviceId: payload.deviceId, generation: 0, ...replyPlacement, janusToken: "root-token", roomToken: "room-token", roomTokenExpiresAt: Date.now() + 300000, leaseExpiresAt: Date.now() + 120000 }));
+        deviceId: payload.deviceId, generation: 0, roomAdmissionRequired: true, iceServers: [{ urls: ["turn:secondary:3478", "turns:secondary:5349"], username: "assigned", credential: "assigned" }], iceCredentialsExpiresAt: Date.now() + 3600000, ...replyPlacement, janusToken: "root-token", roomToken: "room-token", roomTokenExpiresAt: Date.now() + 300000, leaseExpiresAt: Date.now() + 120000 }));
     }
     return originalEmit(name, payload);
   };
@@ -105,7 +105,8 @@ function fixture() {
   assert.strictEqual(f.manager.session.options.janusToken, "root-token");
   assert.strictEqual(f.manager.session.options.roomToken, "room-token");
   assert.strictEqual(f.manager.session.options.janusUrl, "wss://assigned/janus");
-  assert.deepStrictEqual(f.manager.session.options.iceServers[0].urls, ["turn:relay:3478"]);
+  assert.strictEqual(f.manager.session.options.iceServers[0].urls, "turn:secondary:3478");
+  assert.ok(f.manager.session.options.iceCredentialsExpiresAt > Date.now());
   const refreshed = await f.manager.session.options.refreshRoomAccess();
   assert.strictEqual(refreshed.server, "wss://assigned/janus");
   replyPlacement = {nodeId: "secondary", server: "wss://other/janus"};
@@ -139,8 +140,12 @@ function fixture() {
   assert.strictEqual(f.manager.session, null, "authoritative end also ends an unanswered modern call");
   assert.strictEqual(socket.listenerCount("call:allocate-result"), 0);
   assert.strictEqual(socket.listenerCount("call:heartbeat-result"), 0, "ended manager session releases lease listener");
-  await f.manager.incoming({ fromUserId: "owner-1", chatId: "managed-chat", roomId: 100, callType: "audio", callAttemptId: managedInvite.callAttemptId, organizationId: "tenant-a" });
+  f.manager.adapter._request = async () => ({ config: { roomAdmissionEnabled: false, janusServer: "wss://legacy/janus", iceServers: [{ urls: "turn:legacy:3478", username: "legacy", credential: "legacy" }] } });
+  await f.manager.incoming({ fromUserId: "owner-1", chatId: "managed-chat", roomId: 100, callType: "audio", callAttemptId: managedInvite.callAttemptId, organizationId: "tenant-a", roomAdmissionRequired: true });
   const incomingManaged = f.manager.session;
+  assert.strictEqual(incomingManaged.options.managedRoom, true);
+  assert.strictEqual(incomingManaged.options.janusUrl, "wss://assigned/janus");
+  assert.strictEqual(incomingManaged.options.iceServers[0].urls, "turn:secondary:3478");
   const managedAccept = emitted.filter(event => event.name === "call:accept").at(-1).payload;
   assert.strictEqual(managedAccept.deviceId, f.manager.deviceId);
   assert.strictEqual(managedAccept.generation, 0);
@@ -156,6 +161,19 @@ function fixture() {
   assert.strictEqual(socket.listenerCount("call:heartbeat-result"), 0);
 
 
+  // Legacy attempts, including those with modern attempt IDs, keep baseline
+  // transport even when the organization now enables new managed allocations.
+  for (const roomAdmissionRequired of [undefined, false]) {
+    f = fixture();
+    f.manager.adapter._request = async () => ({ config: { roomAdmissionEnabled: true, janusServer: "wss://legacy/janus", iceServers: [{ urls: "turn:legacy:3478", username: "legacy", credential: "legacy" }] } });
+    await f.manager.incoming({ fromUserId: "owner-1", chatId: "legacy", roomId: 99, callType: "audio", callAttemptId: "legacy-attempt-123456789", roomAdmissionRequired });
+    assert.strictEqual(f.manager.session.options.managedRoom, false);
+    assert.strictEqual(f.manager.session.options.janusUrl, "wss://legacy/janus");
+    assert.strictEqual(f.manager.session.options.refreshRoomAccess, undefined);
+    assert.ok(!f.events.some(event => event.name === "call:room-access"));
+    await f.manager.stop();
+  }
+
   f = fixture();
   await f.manager.incoming({ fromUserId: "owner-1", chatId: "managed-chat", roomId: 100, callType: "video", callAttemptId: "managed-attempt-123456789", organizationId: "tenant-a", generation: 7 });
   assert.strictEqual(f.events[0].payload.generation, 7, "pre-access decline preserves recipient reinvite generation");
@@ -200,12 +218,23 @@ function fixture() {
   accessSocket.emit("call:allocate-result", { requestId: requested.requestId, ok: true, protocolVersion: 3, callAttemptId: "attempt-1234567890", organizationId: "tenant-a", roomId: 20, chatId: "chat", deviceId: "different-device", generation: 0, janusToken: "t", roomToken: "t", roomTokenExpiresAt: Date.now() + 300000 });
   await assert.rejects(accessPromise, /Invalid call room/);
   assert.strictEqual(accessSocket.listenerCount("call:allocate-result"), 0);
-  for (const server of ["http://assigned/janus", "wss://user:password@assigned/janus", "wss://assigned/janus#fragment", 123]) {
+  for (const server of ["http://assigned/janus", "wss://user:password@assigned/janus", "wss://assigned/janus#fragment", "wss://assigned/janus?token=bad", 123]) {
     const invalid = requestRoomAccess(accessSocket, "allocate", { deviceId: "device-1234567890", chatId: "chat" });
     accessSocket.emit("call:allocate-result", { requestId: requested.requestId, ok: true, protocolVersion: 3, callAttemptId: "attempt-1234567890", organizationId: "tenant-a", roomId: 20, chatId: "chat", deviceId: "device-1234567890", generation: 0, server, janusToken: "t", roomToken: "t", roomTokenExpiresAt: Date.now() + 300000 });
     await assert.rejects(invalid, /Invalid call room/);
     assert.strictEqual(accessSocket.listenerCount("call:allocate-result"), 0);
   }
+  for (const malformed of [
+    { roomAdmissionRequired: undefined }, { roomAdmissionRequired: false },
+    { iceServers: undefined }, { iceServers: [] }, { iceCredentialsExpiresAt: Date.now() - 1 },
+    { iceServers: [{ urls: 'turn:user:secret@relay:3478', username: 'u', credential: 'p' }] },
+    { iceServers: [{ urls: 'turn:relay:3478' }] },
+  ]) {
+    const invalid = requestRoomAccess(accessSocket, "allocate", { deviceId: "device-1234567890", chatId: "chat" });
+    accessSocket.emit("call:allocate-result", { requestId: requested.requestId, ok: true, protocolVersion: 3, callAttemptId: "attempt-1234567890", organizationId: "tenant-a", roomId: 20, chatId: "chat", deviceId: "device-1234567890", generation: 0, server: "wss://assigned/janus", nodeId: "secondary", roomAdmissionRequired: true, iceServers: [{ urls: 'turn:relay:3478', username: 'u', credential: 'p' }], iceCredentialsExpiresAt: Date.now() + 3600000, janusToken: "t", roomToken: "t", roomTokenExpiresAt: Date.now() + 300000, ...malformed });
+    await assert.rejects(invalid, /Invalid call room/);
+    assert.strictEqual(accessSocket.listenerCount("call:allocate-result"), 0);
+  }
   const controller = new AbortController();
   const cancelledAccess = requestRoomAccess(accessSocket, "allocate", { deviceId: "device-1234567890", chatId: "chat" }, { signal: controller.signal });
   controller.abort();

package/test-kazee-call-session.js

@@ -19,7 +19,7 @@ class FakeJanus {
 }
 
 class FakePC {
-  constructor() { this.onTrack = { subscribe: () => {} }; }
+  constructor(options) { this.options = options; this.onTrack = { subscribe: () => {} }; }
   addTrack() { return { codec: { payloadType: 111 } }; }
   async createOffer() { return {}; }
   async setLocalDescription() {}
@@ -448,19 +448,22 @@ async function testManagedRoomCredentials() {
     constructor(options) { super(); this.options = options; this.calls = []; }
     async message(handle, body) {
       this.calls.push(body);
-      if (body.request === "join" && body.ptype === "publisher") return { plugindata: { data: { videoroom: "joined", private_id: 999, publishers: [] } } };
+      if (body.request === "join" && body.ptype === "publisher") return { plugindata: { data: { videoroom: "joined", id: 41, private_id: 999, publishers: [] } } };
       return {};
     }
   }
   let refreshes = 0;
   const session = new KazeeCallSession({ roomId: 7, chatId: "chat", callerId: "owner", botUserId: "bot", janusUrl: "ws://test",
-    janusToken: "root-token", roomToken: "publisher-token", roomTokenExpiresAt: Date.now() + 300000, managedRoom: true, asCaller: true,
-    refreshRoomAccess: async () => { refreshes += 1; return { janusToken: "fresh-root", janusTokenExpiresAt: Date.now() + 86400000, roomToken: "subscriber-token", roomTokenExpiresAt: Date.now() + 300000 }; },
+    janusToken: "root-token", roomToken: "publisher-token", roomTokenExpiresAt: Date.now() + 300000, managedRoom: true, asCaller: true, iceServers: [{ urls: "turn:relay:3478", username: "fixture", credential: "fixture" }], iceCredentialsExpiresAt: Date.now() + 3600000,
+    refreshRoomAccess: async () => { refreshes += 1; return { iceServers: [{ urls: "turn:relay:3478", username: "fresh", credential: "fresh" }], iceCredentialsExpiresAt: Date.now() + 3600000, janusToken: "fresh-root", janusTokenExpiresAt: Date.now() + 86400000, roomToken: "subscriber-token", roomTokenExpiresAt: Date.now() + 300000 }; },
     JanusClientImpl: SignedJanus, PeerConnectionImpl: FakePC, SpeechStreamImpl: FakeSpeechStream });
   session._maybePublish = async () => {};
   await session.start();
   assert.strictEqual(session.janus.options.token, "root-token");
   assert.strictEqual(session.janus.calls[0].token, "publisher-token");
+  await session._consumePublisherFrame({ plugindata: { data: { publishers: [{ id: 41, display: 'canonical-bot@calling.invalid' }, { id: 42, display: 'open-claudia:legacy-bot' }] } } });
+  assert.strictEqual(session.subscribers.size, 0, 'own joined publisher ID is excluded independently of canonical display; legacy bot exclusion remains');
+
   session.roomTokenExpiresAt = Date.now() - 1;
   await Promise.all([session._subscribe(17, "owner"), session._subscribe(18, "other")]);
   const subJoin = session.janus.calls.find(body => body.ptype === "subscriber");
@@ -481,7 +484,61 @@ async function testManagedRoomCredentials() {
   assert.ok(!session.janus.calls.some(body => ["create", "destroy"].includes(body.request)), "server allocated room ownership never transfers to the bot");
 }
 
+async function testAssignedRelayTransportLifetime() {
+  const { RTCPeerConnection } = require('werift');
+  const originalExpiry = Date.now() + 3600000;
+  const assigned = (username, expiresAt) => ({ iceServers: [{ urls: 'turn:127.0.0.1:3478', username, credential: username + '-password' }], iceCredentialsExpiresAt: expiresAt });
+  const session = new KazeeCallSession({ roomId: 7, chatId: 'chat', callerId: 'owner', botUserId: 'bot', managedRoom: true,
+    ...assigned('original-fixture', originalExpiry), roomToken: 'room', roomTokenExpiresAt: Date.now() + 300000,
+    refreshRoomAccess: async () => ({ ...assigned('renewed-fixture', originalExpiry + 3600000), roomToken: 'renewed-room', roomTokenExpiresAt: Date.now() + 300000, janusToken: 'renewed-root', janusTokenExpiresAt: Date.now() + 300000 }),
+    JanusClientImpl: FakeJanus, PeerConnectionImpl: RTCPeerConnection, SpeechStreamImpl: FakeSpeechStream });
+  try {
+    const old = session._newPeerConnection(); old.addTransceiver('audio');
+    assert.strictEqual(old.iceTransports[0].connection.options.turnUsername, 'original-fixture');
+    // Calling Werift's public setter cannot refresh an already-created ICE
+    // transport. Verify the installed implementation, without network gathering.
+    old.setConfiguration({ iceServers: assigned('setter-fixture', originalExpiry).iceServers });
+    assert.strictEqual(old.getConfiguration().iceServers[0].username, 'setter-fixture');
+    assert.strictEqual(old.iceTransports[0].connection.options.turnUsername, 'original-fixture');
+    await session._roomAuth(true);
+    assert.strictEqual(session._transportIceExpiry.get(old), originalExpiry, 'new access never extends an existing allocation deadline');
+    assert.strictEqual(old.iceTransports[0].connection.options.turnUsername, 'original-fixture');
+    const fresh = session._newPeerConnection(); fresh.addTransceiver('audio');
+    assert.strictEqual(fresh.iceTransports[0].connection.options.turnUsername, 'renewed-fixture');
+    assert.strictEqual(session._transportIceExpiry.get(fresh), originalExpiry + 3600000);
+  } finally { await session.close(); }
+  assert.strictEqual(session._transportExpiryTimer, null);
+  assert.strictEqual(session._transportIceExpiry.size, 0);
+
+  let ended;
+  const bounded = new KazeeCallSession({ roomId: 7, chatId: 'chat', callerId: 'owner', botUserId: 'bot', managedRoom: true,
+    ...assigned('short-fixture', Date.now() + 1500), roomToken: 'room', roomTokenExpiresAt: Date.now() + 300000,
+    refreshRoomAccess: async () => ({ ...assigned('fresh-fixture', Date.now() + 3600000), roomToken: 'fresh', roomTokenExpiresAt: Date.now() + 300000 }),
+    onEnded: reason => { ended = reason; }, JanusClientImpl: FakeJanus, PeerConnectionImpl: FakePC, SpeechStreamImpl: FakeSpeechStream });
+  try {
+    const old = bounded._newPeerConnection();
+    const deadline = bounded._transportIceExpiry.get(old);
+    await bounded._roomAuth(true);
+    assert.strictEqual(bounded._transportIceExpiry.get(old), deadline);
+    const until = Date.now() + 2000;
+    while (!bounded.closed && Date.now() < until) await wait(25);
+    assert.strictEqual(ended, 'relay-credentials-expired', 'existing transport closes on its original expiry despite successful refresh');
+  } finally { await bounded.close(); }
+
+  let publications = 0;
+  class PublishingPC extends FakePC { constructor(options) { super(options); publications += 1; } }
+  class PublishingJanus extends FakeJanus { async message() { return { jsep: { type: 'answer', sdp: 'fixture' } }; } }
+  const concurrent = new KazeeCallSession({ roomId: 7, chatId: 'chat', callerId: 'owner', botUserId: 'bot', managedRoom: true,
+    ...assigned('original-fixture', Date.now() + 3600000), roomToken: 'room', roomTokenExpiresAt: Date.now() + 300000,
+    JanusClientImpl: PublishingJanus, PeerConnectionImpl: PublishingPC });
+  try { await Promise.all([concurrent._publish(), concurrent._publish()]); assert.strictEqual(publications, 1, 'concurrent publisher events cannot race across async room authorization'); } finally { await concurrent.close(); }
+
+  const missing = new KazeeCallSession({ roomId: 7, chatId: 'chat', callerId: 'owner', botUserId: 'bot', managedRoom: true, JanusClientImpl: FakeJanus, PeerConnectionImpl: FakePC });
+  try { assert.throws(() => missing._newPeerConnection(), /relay credentials unavailable/); } finally { await missing.close(); }
+}
+
 (async () => {
+  await testAssignedRelayTransportLifetime();
   await testManagedRoomCredentials();
   await testSpeakSerialization();
   await testSpeakCancellation();

package/test-provider-language.js

@@ -463,8 +463,8 @@ assert.match(pkg.description, /provider-agnostic coding-agent harness/i);
 // Codex turn. Live probe: unified-exec shell calls still reach PreToolUse as
 // tool_name "Bash" and the deny gate caught the probe, so the gate no longer
 // requires unified_exec off. Push approved by Sumeet before release.
-// 3.4.11: owner approved end-to-end calling rollout on 2026-09-05.
-assert.strictEqual(pkg.version, "3.4.11", "release version must remain unchanged without explicit approval");
+// 3.4.12: Sumeet approved the full calling rollout on 2026-09-05; preserve assigned media configuration across canary changes.
+assert.strictEqual(pkg.version, "3.4.12", "release version must remain unchanged without explicit approval");
 for (const keyword of ["claude", "codex", "coding-agent", "provider-agnostic"]) {
   assert.ok(pkg.keywords.includes(keyword), `package keyword missing: ${keyword}`);
 }