@inetafrica/open-claudia 3.4.7 → 3.4.11

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## 3.4.11
+
+- Verify timed-out guard processes from their parent, including forced termination and released concurrency, without racing a child-written receipt.
+- Retain the calling credential-renewal and scheduler fixes from the preceding release candidates.
+
+## 3.4.10
+
+- Include managed device ownership generations on bot call signals, reject stale refresh generations, and report local termination once.
+- Renew transport credentials before expiry on the existing Janus session.
+- Give the durable migration regression a bounded two-minute subprocess budget and report spawn errors; the CI probe exceeded its previous thirty-second limit.
+
+## 3.4.9
+
+- Keep concurrent Opus codecs valid when WebAssembly memory grows; test 100 simultaneous codecs and legacy packet interoperability.
+- Use the assigned Janus endpoint for managed calls and reject placement changes during credential refresh.
+- Route release builds through the dedicated VM runner after cluster runner startup failures.
+
+## v3.4.8 — Authenticated calling rooms and attempt-safe bot setup
+
+- Kazee calling: stage server-authorized room allocation and expiring room credentials, authenticate Janus frames and subscriber joins, preserve call attempt identity across signals, and cancel stale setup. Legacy calls remain supported while room enforcement is disabled. Owner-only audio calling policy is preserved.
+
 ## v3.4.7 — Keep scheduled follow-ups queued while the chat is busy
 
 - Scheduler: busy chats keep wakeups queued without consuming execution retries. Watch triggers and expiries are saved once, survive restart, and stop polling while delivery is pending. Concurrent callbacks cannot start overlapping runs; advisory notifications are attempted once per occurrence. Real execution failures retain bounded retries.

package/channels/kazee/call/access.js

@@ -0,0 +1,53 @@
+"use strict";
+const { randomUUID } = require("crypto");
+function validServer(value) {
+  if (value === undefined) return true;
+  if (typeof value !== 'string') return false;
+  try { const url = new URL(value); return url.protocol === 'wss:' && !!url.hostname && !url.username && !url.password && !url.hash; }
+  catch { return false; }
+}
+
+function publicCallIdentity(payload = {}) {
+  return {
+    ...(payload.callAttemptId ? { callAttemptId: payload.callAttemptId } : {}),
+    ...(payload.organizationId ? { organizationId: payload.organizationId } : {}),
+    ...(payload.roomId != null ? { roomId: Number(payload.roomId) } : {}),
+  };
+}
+
+function requestRoomAccess(socket, operation, input, { signal, timeoutMs = 10000 } = {}) {
+  if (!socket?.connected) return Promise.reject(new Error("Call socket unavailable"));
+  if (signal?.aborted) return Promise.reject(new Error("Call cancelled"));
+  const requestId = randomUUID();
+  const event = `call:${operation}-result`;
+  return new Promise((resolve, reject) => {
+    const cleanup = () => { clearTimeout(timer); socket.off(event, receive); signal?.removeEventListener("abort", abort); };
+    const fail = (message) => { cleanup(); reject(new Error(message)); };
+    const abort = () => fail("Call cancelled");
+    const receive = (reply = {}) => {
+      if (reply.requestId !== requestId) return;
+      if (!reply.ok) return fail("Call room access denied");
+      if (reply.protocolVersion !== 3 || typeof reply.callAttemptId !== "string" || !/^[\w-]{16,128}$/.test(reply.callAttemptId)
+        || typeof reply.organizationId !== "string" || !reply.organizationId || reply.deviceId !== input.deviceId
+        || !Number.isSafeInteger(reply.roomId) || reply.roomId <= 0 || !Number.isSafeInteger(reply.generation) || reply.generation < 0
+        || (input.callAttemptId && reply.callAttemptId !== input.callAttemptId)
+        || (input.organizationId && reply.organizationId !== input.organizationId)
+        || (input.roomId && reply.roomId !== Number(input.roomId)) || (input.chatId && reply.chatId !== input.chatId)
+        || !validServer(reply.server)
+        || (reply.janusTokenExpiresAt !== undefined && (!Number.isFinite(reply.janusTokenExpiresAt) || reply.janusTokenExpiresAt <= Date.now()))
+        || typeof reply.janusToken !== "string" || !reply.janusToken || typeof reply.roomToken !== "string" || !reply.roomToken
+        || (reply.leaseExpiresAt !== undefined && (!Number.isFinite(reply.leaseExpiresAt) || reply.leaseExpiresAt <= Date.now()))
+        || !Number.isFinite(reply.roomTokenExpiresAt) || reply.roomTokenExpiresAt <= Date.now()) return fail("Invalid call room access response");
+      cleanup();
+      resolve({ ...publicCallIdentity(reply), protocolVersion: 3, deviceId: reply.deviceId, generation: reply.generation,
+        ...(reply.janusTokenExpiresAt !== undefined ? {janusTokenExpiresAt: reply.janusTokenExpiresAt} : {}),
+        chatId: reply.chatId, nodeId: reply.nodeId, ...(reply.server !== undefined ? { server: reply.server } : {}), janusToken: reply.janusToken, roomToken: reply.roomToken, roomTokenExpiresAt: reply.roomTokenExpiresAt, ...(reply.leaseExpiresAt !== undefined ? { leaseExpiresAt: reply.leaseExpiresAt } : {}) });
+    };
+    const timer = setTimeout(() => fail("Call room access timed out"), timeoutMs);
+    socket.on(event, receive);
+    signal?.addEventListener("abort", abort, { once: true });
+    try { socket.emit(`call:${operation}`, { ...input, requestId }); }
+    catch (_) { fail("Call socket unavailable"); }
+  });
+}
+module.exports = { publicCallIdentity, requestRoomAccess };

package/channels/kazee/call/audio.js

@@ -1,6 +1,6 @@
 "use strict";
 
-const OpusScript = require("opusscript");
+const OpusScript = require("./opus-codec");
 
 const WEBRTC_RATE = 48000;
 const STT_RATE = 16000;

package/channels/kazee/call/janus-client.js

@@ -8,9 +8,10 @@ function transactionId() {
 }
 
 class JanusClient {
-  constructor({ url, WebSocketImpl = WebSocket, requestTimeoutMs = 10000, keepaliveMs = 25000 } = {}) {
+  constructor({ url, token, WebSocketImpl = WebSocket, requestTimeoutMs = 10000, keepaliveMs = 25000 } = {}) {
     if (!url) throw new Error("Janus URL is required");
     this.url = url;
+    this.token = token;
     this.WebSocketImpl = WebSocketImpl;
     this.requestTimeoutMs = requestTimeoutMs;
     this.keepaliveMs = keepaliveMs;
@@ -72,6 +73,7 @@ class JanusClient {
     const transaction = transactionId();
     const frame = {
       ...payload,
+      ...(this.token ? { token: this.token } : {}),
       ...(withSession && this.sessionId ? { session_id: this.sessionId } : {}),
       transaction,
     };

package/channels/kazee/call/lease.js

@@ -0,0 +1,70 @@
+// Same platform-neutral lease policy as the web/mobile call client.
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CallLeaseHeartbeat = void 0;
+/** Only measured, accepted media activates the server's managed-call lease. */
+class CallLeaseHeartbeat {
+    constructor(transport, identity, failed, initialLeaseExpiresAt, newRequestId = () => crypto.randomUUID()) {
+        this.transport = transport;
+        this.identity = identity;
+        this.failed = failed;
+        this.newRequestId = newRequestId;
+        this.requestId = null;
+        this.leaseExpiresAt = 0;
+        this.started = false;
+        this.closed = false;
+        if (Number.isFinite(initialLeaseExpiresAt))
+            this.leaseExpiresAt = initialLeaseExpiresAt;
+        this.unsubscribe = transport.on('call:heartbeat-result', data => {
+            if (this.closed || !this.requestId || data?.requestId !== this.requestId)
+                return;
+            this.requestId = null;
+            clearTimeout(this.timeout);
+            if (!data.ok || !Number.isFinite(data.leaseExpiresAt) || data.leaseExpiresAt <= Date.now()) {
+                this.close();
+                this.failed('denied');
+                return;
+            }
+            // A malformed distant lease must not remove the local outage bound.
+            this.leaseExpiresAt = Math.min(data.leaseExpiresAt, Date.now() + 120000);
+        });
+    }
+    activate() {
+        if (this.started || this.closed)
+            return;
+        this.started = true;
+        if (!this.leaseExpiresAt)
+            this.leaseExpiresAt = Date.now() + 120000;
+        this.interval = setInterval(() => this.beat(), 30000);
+        this.beat();
+    }
+    beat() {
+        if (this.closed)
+            return;
+        if (Date.now() >= this.leaseExpiresAt) {
+            this.close();
+            this.failed('expired');
+            return;
+        }
+        if (this.requestId)
+            return;
+        const requestId = this.newRequestId();
+        this.requestId = requestId;
+        this.timeout = setTimeout(() => { if (this.requestId === requestId)
+            this.requestId = null; }, 15000);
+        try {
+            this.transport.emit('call:heartbeat', { ...this.identity(), requestId, mediaReady: true });
+        }
+        catch { /* A transient transport failure consumes time from the same lease. */ }
+    }
+    close() {
+        if (this.closed)
+            return;
+        this.closed = true;
+        clearInterval(this.interval);
+        clearTimeout(this.timeout);
+        this.requestId = null;
+        this.unsubscribe();
+    }
+}
+exports.CallLeaseHeartbeat = CallLeaseHeartbeat;

package/channels/kazee/call/manager.js

@@ -1,5 +1,8 @@
 "use strict";
 
+const { randomUUID, randomInt } = require("crypto");
+const { CallLeaseHeartbeat } = require("./lease");
+const { publicCallIdentity, requestRoomAccess } = require("./access");
 const { canonicalForChannel } = require("../../../core/identity");
 const { KazeeCallSession } = require("./session");
 
@@ -9,10 +12,7 @@ const DEFAULT_ICE_SERVERS = [
   { urls: "stun:stun.l.google.com:19302" },
 ];
 // FCM push TTL is 60s and chat-central treats ringing logs as fresh for 90s.
-// Must comfortably outlast the mobile client's own 30s ring timeout: a callee
-// device auto-ends at 30s, the human then answers late, and chat-central
-// revives the CallLog — the room has to still exist when that answer lands
-// (first live outbound test 2026-08-08: end at 30s, real answer at 44s).
+// This is the outbound invitation deadline; terminal server events end it early.
 const RING_TIMEOUT_MS = 60_000;
 const OUTGOING_GREETING = "Hey, it's Claudia. Can you hear me okay?";
 // Inbound must greet too: callers get silence until they speak first, which
@@ -21,19 +21,21 @@ const INCOMING_GREETING = "Hey, it's Claudia — you're through. Can you hear me
 
 class KazeeCallManager {
   constructor({ adapter, SessionImpl = KazeeCallSession, janusUrl = process.env.KAZEE_JANUS_URL || DEFAULT_JANUS_URL,
-    iceServers = DEFAULT_ICE_SERVERS } = {}) {
+    iceServers = DEFAULT_ICE_SERVERS, deviceId = randomUUID() } = {}) {
     this.adapter = adapter;
     this.SessionImpl = SessionImpl;
     this.janusUrl = janusUrl;
     this.iceServers = iceServers;
     this.session = null;
+    this.deviceId = deviceId;
+    this._pending = null;
     this._ringTimer = null;
   }
 
   wire(socket) {
-    socket.on("call:incoming", (payload) => this.incoming(payload));
-    socket.on("call:ended", (payload) => this.ended(payload));
-    socket.on("call:rejected", (payload) => this.rejected(payload));
+    socket.on("call:incoming", (payload) => this.incoming(payload).catch(() => console.error("Kazee call incoming failed")));
+    socket.on("call:ended", (payload) => this.ended(payload).catch(() => console.error("Kazee call cleanup failed")));
+    socket.on("call:rejected", (payload) => this.rejected(payload).catch(() => console.error("Kazee call cleanup failed")));
     socket.on("call:accepted", (payload) => this.accepted(payload));
     socket.on("call:ringing", (payload) => {
       if (this.session) console.log(`Kazee call ringing: chat=${String(payload?.chatId || "")}`);
@@ -46,26 +48,72 @@ class KazeeCallManager {
   // TURN credentials at /webrtc/config — the same endpoint the web and mobile
   // clients use. werift's ICE stack is UDP-only, so tcp/tls variants are
   // filtered out before they can break candidate gathering.
-  async _fetchIceServers() {
-    if (typeof this.adapter?._request !== "function") return this.iceServers;
-    try {
-      const res = await this.adapter._request("GET", "/webrtc/config");
-      const fetched = Array.isArray(res?.config?.iceServers) ? res.config.iceServers : [];
-      const usable = fetched.filter((server) => {
-        const url = String(Array.isArray(server.urls) ? server.urls[0] : server.urls || "");
-        if (url.startsWith("stun:")) return true;
-        return url.startsWith("turn:") && !url.includes("transport=tcp");
-      });
-      const turns = usable.filter((s) => String(Array.isArray(s.urls) ? s.urls[0] : s.urls).startsWith("turn:")).length;
-      if (turns > 0) {
-        console.log(`Kazee call ICE config: ${usable.length} servers (${turns} TURN) from /webrtc/config`);
-        return usable;
-      }
-      console.warn("Kazee call ICE config: /webrtc/config returned no usable TURN entry, using defaults");
-    } catch (error) {
-      console.error(`Kazee call ICE config fetch failed, using defaults: ${error.message}`);
-    }
-    return this.iceServers;
+  async _fetchCallConfig() {
+    // Dependency-only test adapters may supply their own media configuration.
+    if (typeof this.adapter?._request !== "function") return { iceServers: this.iceServers, janusServer: this.janusUrl, roomAdmissionEnabled: false };
+    let res;
+    try { res = await this.adapter._request("GET", "/webrtc/config"); }
+    catch (_) { throw new Error("Call configuration unavailable"); }
+    const config = res?.config;
+    if (!config || !Array.isArray(config.iceServers)) throw new Error("Call configuration unavailable");
+    const usable = config.iceServers.flatMap(server => {
+      const urls = (Array.isArray(server.urls) ? server.urls : [server.urls]).filter(url => typeof url === "string" && (url.startsWith("stun:") || (url.startsWith("turn:") && !url.includes("transport=tcp"))));
+      return urls.length ? [{ ...server, urls }] : [];
+    });
+    if (!usable.some(server => server.urls.some(url => url.startsWith("turn:")))) throw new Error("Call configuration has no supported TURN route");
+    return { iceServers: usable, janusServer: config.janusServer || this.janusUrl, janusToken: config.janusToken,
+      roomAdmissionEnabled: config.roomAdmissionEnabled === true };
+  }
+
+  async _fetchIceServers() { return (await this._fetchCallConfig()).iceServers; }
+
+  _matches(payload, session = this.session) {
+    if (!session || (!payload.callAttemptId && payload.roomId == null && !payload.chatId)) return false;
+    const identity = session.callIdentity || {};
+    if (payload.callAttemptId && payload.callAttemptId !== identity.callAttemptId) return false;
+    if (payload.organizationId && identity.organizationId && payload.organizationId !== identity.organizationId) return false;
+    if (payload.roomId != null && Number(payload.roomId) !== session.roomId) return false;
+    if (payload.chatId && payload.chatId !== session.chatId) return false;
+    return true;
+  }
+
+  _sessionOptions(config, access, identity, signal) {
+    return { janusUrl: access?.server || config.janusServer, iceServers: config.iceServers, janusToken: access?.janusToken || config.janusToken,
+      janusTokenExpiresAt: access?.janusTokenExpiresAt, managedRoom: config.roomAdmissionEnabled, roomToken: access?.roomToken, roomTokenExpiresAt: access?.roomTokenExpiresAt,
+      refreshRoomAccess: config.roomAdmissionEnabled ? async () => {
+        const next = await requestRoomAccess(this.adapter._socket, "room-access", { ...identity, deviceId: this.deviceId }, { signal });
+        if (next.server !== access?.server || next.nodeId !== access?.nodeId || next.generation !== access?.generation) throw new Error('Call room placement changed');
+        return next;
+      } : undefined };
+  }
+
+  _sessionEnded(session, reason) {
+    if (this.session !== session) return;
+    this.session = null;
+    if (this.adapter._socket?.connected) this.adapter._socket.emit("call:end", {
+      ...session.callIdentity, chatId: session.chatId, toUserId: session.callerId, reason,
+    });
+  }
+
+  _manageLease(session, access) {
+    if (!access) return;
+    const socket = this.adapter._socket;
+    session._leaseHeartbeat = new CallLeaseHeartbeat({
+      emit: (event, payload) => socket.emit(event, payload),
+      on: (event, listener) => { socket.on(event, listener); return () => socket.off(event, listener); },
+    }, () => ({ ...session.callIdentity, deviceId: this.deviceId, generation: access.generation }), reason => {
+      if (this.session !== session || session.closed) return;
+      console.warn(`Kazee managed call lease ${reason}`);
+      socket.emit("call:end", { ...session.callIdentity, deviceId: this.deviceId, chatId: session.chatId, toUserId: session.callerId, reason: "network-timeout" });
+      this.session = null;
+      session.close(`lease-${reason}`).catch(() => console.error("Kazee call lease cleanup failed"));
+    }, access.leaseExpiresAt, randomUUID);
+  }
+
+  _mediaReady(session) {
+    if (!session || session.closed || this.session !== session) return;
+    session._mediaReady = true;
+    if (session._accepted) session._leaseHeartbeat?.activate();
   }
 
   async incoming(payload = {}) {
@@ -73,46 +121,43 @@ class KazeeCallManager {
     const chatId = String(payload.chatId || "");
     const roomId = Number(payload.roomId);
     const callType = String(payload.callType || "");
-    const owner = String(this.adapter.ownerUserId || "");
-    console.log(`Kazee call incoming: room=${roomId} chat=${chatId} from=${callerId} type=${callType}`);
-    const reject = (reason) => {
-      console.log(`Kazee call rejected: room=${roomId} from=${callerId} reason=${reason}`);
-      this.adapter._socket?.emit("call:reject", {
-        toUserId: callerId, callType, chatId, roomId, reason,
-      });
-    };
-
-    if (!callerId || !chatId || !Number.isSafeInteger(roomId)) return reject("invalid_call");
-    if (callerId !== owner) return reject("not_allowed");
+    const identity = publicCallIdentity(payload);
+    const reject = (reason) => this.adapter._socket?.emit("call:reject", { ...identity, ...(identity.callAttemptId ? { deviceId: this.deviceId, generation: Number.isSafeInteger(payload.generation) && payload.generation >= 0 ? payload.generation : 0 } : {}), toUserId: callerId, callType, chatId, roomId, reason });
+    if (!callerId || !chatId || !Number.isSafeInteger(roomId) || roomId <= 0) return reject("invalid_call");
+    if (callerId !== String(this.adapter.ownerUserId || "")) return reject("not_allowed");
     if (callType !== "audio") return reject("unsupported_media");
-    if (this.session) return reject("busy");
-
-    // Human callee devices emit call:ringing as soon as they show the ring UI;
-    // chat-central relays it and the caller's client uses it to advance the
-    // status flow (calling -> ringing). Without it a web caller sits on
-    // "calling" with no feedback while we fetch ICE + join Janus (2026-08-16).
-    this.adapter._socket?.emit("call:ringing", { toUserId: callerId, chatId });
-
-    const iceServers = await this._fetchIceServers();
-    const session = new this.SessionImpl({
-      roomId, chatId, callerId, botUserId: this.adapter.botUserId,
-      janusUrl: this.janusUrl, iceServers, greeting: INCOMING_GREETING,
-      onTranscript: (text, meta) => this._transcript(text, payload, meta),
-      onEnded: () => { if (this.session === session) this.session = null; },
-    });
-    this.session = session;
+    if (this.session || this._pending) return reject("busy");
+    const pending = { identity: { ...identity, chatId }, controller: new AbortController() };
+    this._pending = pending;
+    this.adapter._socket?.emit("call:ringing", { ...identity, toUserId: callerId, chatId });
+    let session;
     try {
-      await session.start();
-      console.log(`Kazee call accepted: room=${roomId} from=${callerId}`);
-      this.adapter._socket?.emit("call:accept", {
-        toUserId: callerId, callType: "audio", chatId, roomId,
+      const config = await this._fetchCallConfig();
+      if (config.roomAdmissionEnabled && !identity.callAttemptId) throw new Error("Call identity required");
+      const access = config.roomAdmissionEnabled ? await requestRoomAccess(this.adapter._socket, "room-access", { ...identity, chatId, deviceId: this.deviceId }, { signal: pending.controller.signal }) : null;
+      if (pending.controller.signal.aborted) return;
+      const boundIdentity = access ? { ...publicCallIdentity(access), deviceId: this.deviceId, generation: access.generation } : identity;
+      session = new this.SessionImpl({ roomId, chatId, callerId, botUserId: this.adapter.botUserId,
+        ...this._sessionOptions(config, access, boundIdentity, pending.controller.signal), greeting: INCOMING_GREETING,
+        onTranscript: (text, meta) => this._transcript(text, { ...payload, ...boundIdentity }, meta),
+        onMediaReady: () => this._mediaReady(session),
+        onEnded: reason => { session?._leaseHeartbeat?.close(); pending.controller.abort(); this._sessionEnded(session, reason); },
       });
-    } catch (error) {
-      console.error("Kazee call connect:", error.message);
-      this.session = null;
-      await session.close("connect-failed").catch(() => {});
-      reject("connection_failed");
-    }
+      session.callIdentity = boundIdentity;
+      session.chatId = chatId;
+      this.session = session;
+      this._manageLease(session, access);
+      await session.start();
+      if (this.session !== session || session.closed || pending.controller.signal.aborted) return;
+      this.adapter._socket?.emit("call:accept", { ...boundIdentity, toUserId: callerId, callType: "audio", chatId, roomId });
+      session._accepted = true;
+      if (session._mediaReady) session._leaseHeartbeat?.activate();
+    } catch (_) {
+      const cancelled = pending.controller.signal.aborted;
+      if (this.session === session) this.session = null;
+      if (session) await session.close("connect-failed").catch(() => {});
+      if (!cancelled) reject("connection_failed");
+    } finally { if (this._pending === pending) this._pending = null; }
   }
 
   // Bot-initiated call. Mirrors what a human caller's client does: create the
@@ -124,44 +169,49 @@ class KazeeCallManager {
     const target = String(toUserId || this.adapter.ownerUserId || "");
     const chat = String(chatId || "");
     if (!target || !chat) throw new Error("missing chatId/toUserId");
-    if (this.session) throw new Error("busy: a call session is already active");
+    if (target !== String(this.adapter.ownerUserId || "")) throw new Error("Calls are restricted to the owner");
+    if (this.session || this._pending) throw new Error("busy: a call session is already active");
     if (!this.adapter._socket?.connected) throw new Error("kazee socket is not connected");
-    const roomId = Math.floor(Math.random() * 1e9);
-    const iceServers = await this._fetchIceServers();
-    // _transcript() reads chatId/fromUserId/roomId off the inbound invite
-    // payload; for outbound the remote human is the "from" side.
-    const remote = { chatId: chat, fromUserId: target, roomId, fromUserName: "" };
-    const session = new this.SessionImpl({
-      roomId, chatId: chat, callerId: target, botUserId: this.adapter.botUserId,
-      janusUrl: this.janusUrl, iceServers, asCaller: true, greeting: OUTGOING_GREETING,
-      onTranscript: (text, meta) => this._transcript(text, remote, meta),
-      onEnded: () => {
-        this._clearRingTimer();
-        if (this.session === session) this.session = null;
-      },
-    });
-    this.session = session;
+    const pending = { identity: { chatId: chat }, controller: new AbortController() };
+    this._pending = pending;
+    let session;
     try {
+      const config = await this._fetchCallConfig();
+      const access = config.roomAdmissionEnabled ? await requestRoomAccess(this.adapter._socket, "allocate", { chatId: chat, participants: [target], callType: "audio", deviceId: this.deviceId }, { signal: pending.controller.signal }) : null;
+      if (pending.controller.signal.aborted) throw new Error("Call cancelled");
+      const identity = access ? { ...publicCallIdentity(access), deviceId: this.deviceId, generation: access.generation } : { callAttemptId: randomUUID(), roomId: randomInt(1000000, 2 ** 48 - 1) };
+      const roomId = identity.roomId;
+      pending.identity = { ...identity, chatId: chat };
+      const remote = { ...identity, chatId: chat, fromUserId: target, fromUserName: "" };
+      session = new this.SessionImpl({ roomId, chatId: chat, callerId: target, botUserId: this.adapter.botUserId,
+        ...this._sessionOptions(config, access, identity, pending.controller.signal), asCaller: true, greeting: OUTGOING_GREETING,
+        onTranscript: (text, meta) => this._transcript(text, remote, meta),
+        onMediaReady: () => this._mediaReady(session),
+        onEnded: reason => { session?._leaseHeartbeat?.close(); pending.controller.abort(); this._clearRingTimer(); this._sessionEnded(session, reason); },
+      });
+      session.callIdentity = identity;
+      session.chatId = chat;
+      this.session = session;
+      this._manageLease(session, access);
       await session.start();
+      if (this.session !== session || session.closed || pending.controller.signal.aborted) throw new Error("Call cancelled");
+      this.adapter._socket.emit("call:invite", { ...identity, toUserId: target, callType: "audio", chatId: chat });
+      this._ringTimer = setTimeout(() => { this._ringTimer = null; this._ringTimeout(target, chat, roomId).catch(() => console.error("Kazee call ring timeout failed")); }, RING_TIMEOUT_MS);
+      this._ringTimer.unref?.();
+      return { ...identity, chatId: chat, toUserId: target };
     } catch (error) {
-      this.session = null;
-      await session.close("connect-failed").catch(() => {});
+      if (this.session === session) this.session = null;
+      if (session) await session.close("connect-failed").catch(() => {});
       throw error;
-    }
-    console.log(`Kazee call outgoing: room=${roomId} chat=${chat} to=${target}`);
-    this.adapter._socket.emit("call:invite", { toUserId: target, callType: "audio", chatId: chat, roomId });
-    this._ringTimer = setTimeout(() => {
-      this._ringTimer = null;
-      this._ringTimeout(target, chat, roomId).catch((error) => console.error("Kazee call ring timeout:", error.message));
-    }, RING_TIMEOUT_MS);
-    if (typeof this._ringTimer.unref === "function") this._ringTimer.unref();
-    return { roomId, chatId: chat, toUserId: target };
+    } finally { if (this._pending === pending) this._pending = null; }
   }
 
   accepted(payload = {}) {
-    if (!this.session || !this._ringTimer) return;
+    if (!this.session || !this._matches(payload)) return;
     console.log(`Kazee call answered: room=${this.session.roomId} chat=${String(payload.chatId || "")}`);
     this._clearRingTimer();
+    this.session._accepted = true;
+    if (this.session._mediaReady) this.session._leaseHeartbeat?.activate();
   }
 
   async _ringTimeout(toUserId, chatId, roomId) {
@@ -170,7 +220,7 @@ class KazeeCallManager {
     console.log(`Kazee call unanswered: room=${roomId} to=${toUserId}`);
     // Caller hanging up while ringing: chat-central finalizes the CallLog as
     // missed and dismisses the callee's ringing UI/push.
-    this.adapter._socket?.emit("call:end", { toUserId, chatId });
+    this.adapter._socket?.emit("call:end", { ...session.callIdentity, toUserId, chatId });
     this.session = null;
     await session.close("no-answer").catch(() => {});
   }
@@ -218,25 +268,17 @@ class KazeeCallManager {
   }
 
   async ended(payload = {}) {
-    if (!this.session) return;
+    if (this._pending && (!payload.callAttemptId || payload.callAttemptId === this._pending.identity.callAttemptId) && (!payload.chatId || payload.chatId === this._pending.identity.chatId) && (payload.roomId == null || this._pending.identity.roomId == null || Number(payload.roomId) === this._pending.identity.roomId)) this._pending.controller.abort();
+    if (!this.session || !this._matches(payload)) return;
     if (payload.roomId != null && Number(payload.roomId) !== this.session.roomId) return;
-    // While our outbound ring is live, a call:ended is usually a callee DEVICE
-    // giving up (mobile auto-ends its ring at 30s), not the human declining.
-    // chat-central revives the CallLog if they answer late, so the caller must
-    // keep the room alive until its own ring timeout — tearing down here left
-    // the late answer joining a destroyed room, stuck on "Connecting" (2026-08-08).
-    // A deliberate decline arrives as call:rejected and still closes.
-    if (this._ringTimer) {
-      console.log(`Kazee call ignoring ended-while-ringing: room=${this.session.roomId}`);
-      return;
-    }
+    // Terminal server state is authoritative; ended attempts are never revived.
     const session = this.session;
     this.session = null;
     await session.close("remote-ended");
   }
 
   async rejected(payload = {}) {
-    if (!this.session) return;
+    if (!this.session || !this._matches(payload)) return;
     if (payload.roomId != null && Number(payload.roomId) !== this.session.roomId) return;
     const session = this.session;
     this.session = null;
@@ -244,6 +286,8 @@ class KazeeCallManager {
   }
 
   async stop() {
+    this._pending?.controller.abort();
+    this._clearRingTimer();
     if (!this.session) return;
     const session = this.session;
     this.session = null;

package/channels/kazee/call/opus-codec.js

@@ -0,0 +1,44 @@
+"use strict";
+
+// opusscript 0.1.1 caches typed-array views that detach when its shared WASM
+// memory grows. Use the same packaged native binding with fresh views for each
+// operation. Native _encode/_decode represent PCM bytes as uint16 elements.
+let native;
+class OpusCodec {
+  constructor(rate, channels, application) {
+    native ||= require("opusscript/build/opusscript_native_wasm.js")();
+    this.channels = channels;
+    this.handler = new native.OpusScriptHandler(rate, channels, application);
+    this.pcmElements = 5760 * channels;
+    this.packetBytes = 3828;
+    this.pcmInput = native._malloc(this.pcmElements * 2);
+    this.pcmOutput = native._malloc(this.pcmElements * 2);
+    this.packetInput = native._malloc(this.packetBytes);
+    this.packetOutput = native._malloc(this.packetBytes);
+  }
+  encode(bytes, samples) {
+    if (!this.handler) throw new Error("Opus codec closed");
+    if (bytes.length > this.pcmElements) throw new Error("Opus PCM exceeds frame limit");
+    native.HEAPU16.set(bytes, this.pcmInput / 2);
+    const length = this.handler._encode(this.pcmInput, bytes.length, this.packetOutput, samples);
+    if (length < 0 || length > this.packetBytes) throw new Error(`Opus encode failed (${length})`);
+    return Buffer.from(native.HEAPU8.subarray(this.packetOutput, this.packetOutput + length));
+  }
+  decode(bytes) {
+    if (!this.handler) throw new Error("Opus codec closed");
+    if (bytes.length > this.packetBytes) throw new Error("Opus packet exceeds size limit");
+    native.HEAPU8.set(bytes, this.packetInput);
+    const samples = this.handler._decode(this.packetInput, bytes.length, this.pcmOutput);
+    const length = samples * this.channels * 2;
+    if (samples < 0 || length > this.pcmElements) throw new Error(`Opus decode failed (${samples})`);
+    return Buffer.from(native.HEAPU16.subarray(this.pcmOutput / 2, this.pcmOutput / 2 + length));
+  }
+  delete() {
+    if (!this.handler) return;
+    native.OpusScriptHandler.destroy_handler(this.handler);
+    this.handler = null;
+    for (const pointer of [this.pcmInput,this.pcmOutput,this.packetInput,this.packetOutput]) native._free(pointer);
+  }
+}
+OpusCodec.Application = { VOIP: 2048 };
+module.exports = OpusCodec;

package/channels/kazee/call/session.js

@@ -73,7 +73,7 @@ const ACK_CHIME_PCM48 = tonePcm48([{ freq: 660, ms: 90 }, { freq: 990, ms: 110 }
 const THINK_TICK_PCM48 = tonePcm48([{ freq: 520, ms: 90 }], 0.045);
 
 class KazeeCallSession {
-  constructor({ roomId, chatId, callerId, botUserId, janusUrl, iceServers = [], onTranscript, onEnded,
+  constructor({ roomId, chatId, callerId, botUserId, janusUrl, janusToken, janusTokenExpiresAt, roomToken, roomTokenExpiresAt, managedRoom = false, refreshRoomAccess, iceServers = [], onTranscript, onEnded, onMediaReady,
     maxCallMs, idleMs, finalWaitMs, synthesize = synthesizePcm, synthesizeStream = null, asCaller = false, greeting = null,
     JanusClientImpl = JanusClient, PeerConnectionImpl = RTCPeerConnection, SpeechStreamImpl = SpeechStream } = {}) {
     this.roomId = Number(roomId);
@@ -81,18 +81,29 @@ class KazeeCallSession {
     this.callerId = String(callerId);
     this.botUserId = String(botUserId);
     this.asCaller = !!asCaller;
+    this.managedRoom = managedRoom;
+    this.janusTokenExpiresAt = janusTokenExpiresAt;
+    this.roomToken = roomToken;
+    this.roomTokenExpiresAt = roomTokenExpiresAt;
+    this.refreshRoomAccess = refreshRoomAccess;
+    this.privateId = null;
     this.greeting = greeting ? String(greeting) : null;
     this._greeted = false;
     this._publisherUp = false;
     this._createdRoom = false;
     this._joined = false;
     this._publishTimer = null;
-    this.janus = new JanusClientImpl({ url: janusUrl });
+    this.janus = new JanusClientImpl({ url: janusUrl, token: janusToken });
     this.PeerConnectionImpl = PeerConnectionImpl;
     this.SpeechStreamImpl = SpeechStreamImpl;
     this.iceServers = iceServers;
     this.onTranscript = onTranscript || (() => {});
     this.onEnded = onEnded || (() => {});
+    this.onMediaReady = onMediaReady || (() => {});
+    this._sentRtp = false;
+    this._receivedRtp = false;
+    this._reportedMediaReady = false;
+    this._roomRefresh = null;
     this.synthesize = synthesize;
     // Tests and the jig inject a custom synthesize; only pair the streaming
     // path with the service client it belongs to.
@@ -123,11 +134,32 @@ class KazeeCallSession {
     this.ssrc = Math.floor(Math.random() * 0xffffffff);
   }
 
+  async _roomAuth(force = false) {
+    if (!this.managedRoom) return this.roomToken ? { token: this.roomToken } : {};
+    if (force || !this.roomToken || this.roomTokenExpiresAt <= Date.now() + 10000) {
+      if (!this.refreshRoomAccess) throw new Error("Call room credentials expired");
+      if (!this._roomRefresh) {
+        this._roomRefresh = Promise.resolve().then(() => this.refreshRoomAccess()).then(access => {
+          if (this.closed) throw new Error("Call ended during credential refresh");
+          this.roomToken = access.roomToken;
+          this.roomTokenExpiresAt = access.roomTokenExpiresAt;
+          if (access.janusToken) this.janus.token = access.janusToken;
+          if (access.janusTokenExpiresAt !== undefined) this.janusTokenExpiresAt = access.janusTokenExpiresAt;
+        }).finally(() => { this._roomRefresh = null; });
+      }
+      await this._roomRefresh;
+    }
+    if (!this.roomToken || !Number.isFinite(this.roomTokenExpiresAt) || this.roomTokenExpiresAt <= Date.now()) throw new Error("Call room credentials unavailable");
+    return { token: this.roomToken };
+  }
+
   async start() {
     await this.janus.connect();
+    if (this.closed) { await this.janus.close(); throw new Error("Call ended during setup"); }
     this.publisherHandle = await this.janus.attach();
+    if (this.closed) { await this.janus.detach(this.publisherHandle); throw new Error("Call ended during setup"); }
     this.janus.onHandle(this.publisherHandle, (frame) => this._onPublisherEvent(frame));
-    if (this.asCaller) {
+    if (this.asCaller && !this.managedRoom) {
       // Outbound: the caller side owns room lifecycle, mirroring the web
       // client's create params (audio-only, so no videocodec).
       const created = await this.janus.message(this.publisherHandle, {
@@ -151,8 +183,9 @@ class KazeeCallSession {
     // receiver's retry loop in CallContext.startVideoRoom.
     let joined;
     for (let attempt = 0; ; attempt += 1) {
+      if (this.closed) throw new Error("Call ended during setup");
       joined = await this.janus.message(this.publisherHandle, {
-        request: "join", ptype: "publisher", room: this.roomId, display: `open-claudia:${this.botUserId}`,
+        ...(await this._roomAuth()), request: "join", ptype: "publisher", room: this.roomId, display: `open-claudia:${this.botUserId}`,
       });
       const data = joined?.plugindata?.data || {};
       const noRoom = Number(data.error_code) === 426 || /no such room/i.test(String(data.error || ""));
@@ -180,6 +213,7 @@ class KazeeCallSession {
       if (data.error_code != null) error.code = Number(data.error_code);
       throw error;
     }
+    if (data.videoroom === "joined") this.privateId = data.private_id ?? null;
     for (const publisher of data.publishers || []) {
       const feedId = Number(publisher.id);
       if (!this.subscribers.has(feedId) && !String(publisher.display || "").startsWith("open-claudia:")) {
@@ -291,6 +325,7 @@ class KazeeCallSession {
     clog(`Kazee call subscribing: feed=${feedId} display=${String(display || "")}`);
     try {
       const handle = await this.janus.attach();
+      if (this.closed) { await this.janus.detach(handle); this.subscribers.delete(feedId); return; }
       const pc = new this.PeerConnectionImpl({ iceServers: this.iceServers });
       pc.iceConnectionStateChange?.subscribe?.((state) => clog(`Kazee call subscriber ICE: ${state} feed=${feedId}`));
       const sub = {
@@ -322,7 +357,7 @@ class KazeeCallSession {
         if (track.kind === "audio") track.onReceiveRtp.subscribe((packet) => this._onFeedRtp(feedId, packet));
       });
       this.janus.onHandle(handle, (frame) => this._onSubscriberEvent(feedId, frame));
-      const attached = await this.janus.message(handle, { request: "join", ptype: "subscriber", room: this.roomId, feed: feedId });
+      const attached = await this.janus.message(handle, { ...(await this._roomAuth()), request: "join", ptype: "subscriber", room: this.roomId, feed: feedId, ...(this.privateId != null ? { private_id: this.privateId } : {}) });
       await this._consumeSubscriberFrame(feedId, attached);
       await sub.stt.connect().then(
         () => clog(`Kazee call STT connected: feed=${feedId}`),
@@ -470,7 +505,14 @@ class KazeeCallSession {
     });
   }
 
+  _reportMediaReady() {
+    if (this.closed || this._reportedMediaReady || !this._sentRtp || !this._receivedRtp) return;
+    this._reportedMediaReady = true;
+    this.onMediaReady();
+  }
+
   _writeFrame(frame) {
+    if (this.closed || !this.publisher?.track?.writeRtp) return;
     if (frame.length < WEBRTC_SAMPLES * 2) frame = Buffer.concat([frame, Buffer.alloc(WEBRTC_SAMPLES * 2 - frame.length)]);
     const opus = this.codec.encode(frame);
     const payloadType = this.publisher?.sender?.codec?.payloadType || 111;
@@ -478,6 +520,8 @@ class KazeeCallSession {
       payloadType, sequenceNumber: this.sequence++ & 0xffff, timestamp: this.timestamp >>> 0, ssrc: this.ssrc,
     }), opus));
     this.timestamp = (this.timestamp + WEBRTC_SAMPLES) >>> 0;
+    this._sentRtp = true;
+    this._reportMediaReady();
   }
 
   // Writes a short cue into the outbound track. Yields to real speech: the
@@ -512,6 +556,8 @@ class KazeeCallSession {
     if (this.closed || !packet?.payload?.length) return;
     const sub = this.subscribers.get(feedId);
     if (!sub) return;
+    this._receivedRtp = true;
+    this._reportMediaReady();
     if (!sub.firstRtpAt) {
       sub.firstRtpAt = Date.now();
       clog(`Kazee call first RTP: feed=${feedId}`);
@@ -712,6 +758,12 @@ class KazeeCallSession {
   async _enforceLimits() {
     if (this.closed || this._ending) return;
     const now = Date.now();
+    if (this.managedRoom && this.janusTokenExpiresAt !== undefined && this.janusTokenExpiresAt <= now + 60000) {
+      if (this.janusTokenExpiresAt <= now) { await this.close("credentials-expired"); return; }
+      // Uses the same single in-flight request as subscriber room-token refresh.
+      // The next limit tick still closes at expiry if this request stalls.
+      this._roomAuth(true).catch(() => {});
+    }
     const overMax = now - this._startedAt >= this.maxCallMs;
     // An audible thinking loop means a turn is still being worked on — that is
     // not idleness, or long provider turns would get hung up on mid-answer.
@@ -743,6 +795,7 @@ class KazeeCallSession {
   async close(reason = "ended") {
     if (this.closed) return;
     this.closed = true;
+    this._leaseHeartbeat?.close();
     console.log(`Kazee call session closed: room=${this.roomId} reason=${reason}`);
     if (this._limitTimer) { clearInterval(this._limitTimer); this._limitTimer = null; }
     this._clearPublishTimer();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inetafrica/open-claudia",
-  "version": "3.4.7",
+  "version": "3.4.11",
   "description": "An always-on, provider-agnostic coding-agent harness for Claude Code and OpenAI Codex via chat",
   "main": "bot.js",
   "bin": {
@@ -150,7 +150,7 @@
   "dependencies": {
     "node-cron": "^4.2.1",
     "node-telegram-bot-api": "^0.67.0",
-    "opusscript": "^0.1.1",
+    "opusscript": "0.1.1",
     "socket.io-client": "^4.7.5",
     "werift": "^0.23.0",
     "ws": "^8.21.1"

package/test-cursor-removal.js

@@ -116,11 +116,14 @@ function migrationOrderingAndRollbackProbe(migrationApi) {
         OPEN_CLAUDIA_TEST: "1",
       },
       encoding: "utf8",
-      timeout: 30000,
+      // This probes durable migration ordering, not a latency contract.
+      // Shared CI disks can take tens of seconds for the required fsyncs.
+      timeout: 120000,
     });
     fs.mkdirSync(path.join(temp, "home"), { recursive: true });
     fs.mkdirSync(path.join(temp, "workspace"), { recursive: true });
     const first = runUpgrade();
+    assert.ifError(first.error);
     assert.strictEqual(first.status, 0, first.stderr || first.stdout);
     const upgraded = JSON.parse(first.stdout);
     assert.strictEqual(upgraded.state.schemaVersion, 3);

package/test-kazee-call-audio.js

@@ -24,8 +24,30 @@ const packet = codec.encode(source);
 const decoded = codec.decode(packet);
 assert.strictEqual(decoded.length, source.length, "Opus round trip preserves the 20ms frame size");
 assert(rmsDbfs(decoded) > -20, "decoded tone has useful signal energy");
+const OriginalOpus=require('opusscript');
+const original=new OriginalOpus(48000,1,OriginalOpus.Application.VOIP);
+try {
+  assert(rmsDbfs(Buffer.from(original.decode(packet)))>-20,'original package decodes new wrapper');
+  assert(rmsDbfs(codec.decode(original.encode(source,WEBRTC_SAMPLES)))>-20,'new wrapper decodes original package');
+} finally {original.delete();}
 codec.close();
 
+// Force shared WASM growth after earlier instances cached their inputs/outputs.
+const many = [];
+try {
+  for (let i=0;i<100;i++) many.push(new OpusAudioCodec());
+  for (const active of many) {
+    const encoded=active.encode(source);
+    const audio=active.decode(encoded);
+    assert.equal(audio.length,source.length);
+    assert(rmsDbfs(audio)>-20);
+  }
+  // Keep the first codec alive while the others free/reallocate memory.
+  for (const active of many.slice(1)) active.close();
+  for (let i=0;i<100;i++) {const next=new OpusAudioCodec(); next.close();}
+  assert.equal(many[0].decode(many[0].encode(source)).length,source.length);
+} finally {for(const active of many)active.close();}
+
 const pcm16 = downsample48To16(source);
 assert.strictEqual(pcm16.length, 320 * 2, "48k→16k produces 320 samples for a 20ms frame");
 const pcm48 = upsampleTo48(pcm16, 16000);

package/test-kazee-call-janus.js

@@ -10,10 +10,12 @@ async function main() {
   await new Promise((resolve) => server.once("listening", resolve));
   const port = server.address().port;
   const seen = [];
+  let expectedToken = "root-test-token";
 
   server.on("connection", (socket) => socket.on("message", (raw) => {
     const frame = JSON.parse(raw.toString());
     seen.push(frame.janus);
+    assert.strictEqual(frame.token, expectedToken, "root authentication is present on every actual WebSocket request");
     if (frame.janus === "create") {
       socket.send(JSON.stringify({ janus: "success", transaction: frame.transaction, data: { id: 42 } }));
     } else if (frame.janus === "attach") {
@@ -32,7 +34,7 @@ async function main() {
     }
   }));
 
-  const client = new JanusClient({ url: `ws://127.0.0.1:${port}`, keepaliveMs: 60000 });
+  const client = new JanusClient({ url: `ws://127.0.0.1:${port}`, keepaliveMs: 60000, token: "root-test-token" });
   await client.connect();
   assert.strictEqual(client.sessionId, 42);
   const handle = await client.attach();
@@ -42,9 +44,12 @@ async function main() {
   const joined = await client.message(handle, { request: "join", ptype: "publisher", room: 7 });
   assert.strictEqual(joined.plugindata.data.videoroom, "joined", "ack is ignored until the plugin event arrives");
   assert.strictEqual(handleEvent?.sender, 84, "plugin event is also delivered to the handle listener");
+  expectedToken = client.token = "renewed-root-token";
+  await client.message(handle, { request: "configure", audio: true });
+  assert.strictEqual(client.sessionId, 42, "renewal retains the same live session");
   await client.close();
   await new Promise((resolve) => server.close(resolve));
-  assert.deepStrictEqual(seen.slice(0, 4), ["create", "attach", "message", "destroy"]);
+  assert.deepStrictEqual(seen, ["create", "attach", "message", "message", "destroy"]);
   console.log("kazee call Janus control plane: ok");
 }
 

package/test-kazee-call-manager.js

@@ -27,7 +27,7 @@ function fixture() {
   await f.manager.incoming({ fromUserId: "owner-1", fromUserName: "Owner", chatId: "chat", roomId: 12, callType: "audio" });
   // Ringing must go out first (caller UI feedback), then the accept.
   assert.strictEqual(f.events[0].name, "call:ringing");
-  assert.deepStrictEqual(f.events[0].payload, { toUserId: "owner-1", chatId: "chat" });
+  assert.deepStrictEqual(f.events[0].payload, { toUserId: "owner-1", chatId: "chat", roomId: 12 });
   assert.strictEqual(f.events[1].name, "call:accept");
   f.manager.session.options.onTranscript("What is on my agenda?");
   assert.strictEqual(f.inbound[0].payload.raw.ephemeralAudio, true);
@@ -49,12 +49,11 @@ function fixture() {
   assert.ok(outSession.options.greeting);
   assert.strictEqual(outSession.started, true);
   const invite = f.events.find((e) => e.name === "call:invite");
-  assert.deepStrictEqual(invite.payload, { toUserId: "owner-1", callType: "audio", chatId: "chat-2", roomId: res.roomId });
+  assert.deepStrictEqual(invite.payload, { toUserId: "owner-1", callType: "audio", chatId: "chat-2", roomId: res.roomId, callAttemptId: res.callAttemptId });
   assert.ok(f.manager._ringTimer);
-  // A callee device auto-ending its ring must NOT tear down the outbound call —
-  // chat-central revives the CallLog if the human answers late.
-  await f.manager.ended({ chatId: "chat-2" });
-  assert.ok(f.manager.session, "ended-while-ringing is ignored");
+  // A stale previous-attempt termination must not affect the active ring.
+  await f.manager.ended({ chatId: "chat-2", callAttemptId: "previous-attempt-123456" });
+  assert.ok(f.manager.session, "stale ended is ignored");
   f.manager.accepted({ chatId: "chat-2" });
   assert.strictEqual(f.manager._ringTimer, null);
   // Outbound transcripts dispatch with the remote human as the "from" side.
@@ -80,7 +79,137 @@ function fixture() {
   f.manager._clearRingTimer();
   await f.manager._ringTimeout("owner-1", "chat-3", res2.roomId);
   const end = f.events.find((e) => e.name === "call:end");
-  assert.deepStrictEqual(end.payload, { toUserId: "owner-1", chatId: "chat-3" });
+  assert.deepStrictEqual(end.payload, { toUserId: "owner-1", chatId: "chat-3", roomId: res2.roomId, callAttemptId: res2.callAttemptId });
   assert.strictEqual(f.manager.session, null);
+  // Managed allocation is completed before Session.start, and credentials stay off relays.
+  f = fixture();
+  const { EventEmitter } = require("events");
+  const socket = new EventEmitter();
+  socket.connected = true;
+  const emitted = [];
+  let replyPlacement = {nodeId: "secondary", server: "wss://assigned/janus"};
+  const originalEmit = socket.emit.bind(socket);
+  socket.emit = (name, payload) => {
+    emitted.push({ name, payload });
+    if (["call:allocate", "call:room-access"].includes(name)) {
+      setImmediate(() => originalEmit(`${name}-result`, { requestId: payload.requestId, ok: true, protocolVersion: 3,
+        callAttemptId: "managed-attempt-123456789", organizationId: "tenant-a", roomId: 100, chatId: "managed-chat",
+        deviceId: payload.deviceId, generation: 0, ...replyPlacement, janusToken: "root-token", roomToken: "room-token", roomTokenExpiresAt: Date.now() + 300000, leaseExpiresAt: Date.now() + 120000 }));
+    }
+    return originalEmit(name, payload);
+  };
+  f.manager.adapter._socket = socket;
+  f.manager.adapter._request = async () => ({ config: { roomAdmissionEnabled: true, janusServer: "wss://managed/janus", iceServers: [{ urls: ["turn:relay:3478", "turn:relay:3478?transport=tcp"], username: "test", credential: "test" }] } });
+  await f.manager.outgoing({ chatId: "managed-chat" });
+  assert.strictEqual(f.manager.session.options.managedRoom, true);
+  assert.strictEqual(f.manager.session.options.janusToken, "root-token");
+  assert.strictEqual(f.manager.session.options.roomToken, "room-token");
+  assert.strictEqual(f.manager.session.options.janusUrl, "wss://assigned/janus");
+  assert.deepStrictEqual(f.manager.session.options.iceServers[0].urls, ["turn:relay:3478"]);
+  const refreshed = await f.manager.session.options.refreshRoomAccess();
+  assert.strictEqual(refreshed.server, "wss://assigned/janus");
+  replyPlacement = {nodeId: "secondary", server: "wss://other/janus"};
+  await assert.rejects(f.manager.session.options.refreshRoomAccess(), /placement changed/);
+  replyPlacement = {nodeId: "secondary", server: "wss://assigned/janus", generation: 1};
+  await assert.rejects(f.manager.session.options.refreshRoomAccess(), /placement changed/);
+  replyPlacement = {nodeId: "other", server: "wss://assigned/janus"};
+  await assert.rejects(f.manager.session.options.refreshRoomAccess(), /placement changed/);
+  replyPlacement = {nodeId: "secondary", server: "wss://assigned/janus"};
+  assert.strictEqual(f.manager.session.callIdentity.deviceId, f.manager.deviceId);
+  const managedInvite = emitted.find(event => event.name === "call:invite").payload;
+  assert.strictEqual(managedInvite.callAttemptId, "managed-attempt-123456789");
+  assert.strictEqual(managedInvite.deviceId, f.manager.deviceId);
+  assert.strictEqual(managedInvite.generation, 0);
+  assert.strictEqual(managedInvite.janusToken, undefined);
+  assert.strictEqual(managedInvite.roomToken, undefined);
+  f.manager.accepted({ chatId: "managed-chat", callAttemptId: "stale-attempt-123456789" });
+  assert.ok(f.manager._ringTimer, "stale acceptance must not stop ring deadline");
+  const managedSession = f.manager.session;
+  managedSession.options.onMediaReady();
+  assert.strictEqual(emitted.filter(event => event.name === "call:heartbeat").length, 0, "unaccepted media cannot renew a lease");
+  f.manager.accepted({ chatId: "managed-chat", callAttemptId: managedInvite.callAttemptId });
+  const heartbeat = emitted.find(event => event.name === "call:heartbeat").payload;
+  assert.strictEqual(heartbeat.mediaReady, true);
+  assert.strictEqual(heartbeat.deviceId, f.manager.deviceId);
+  assert.strictEqual(heartbeat.callAttemptId, managedInvite.callAttemptId);
+  assert.strictEqual(heartbeat.roomToken, undefined);
+  originalEmit("call:heartbeat-result", { requestId: heartbeat.requestId, ok: true, leaseExpiresAt: Date.now() + 120000 });
+
+  await f.manager.ended({ chatId: "managed-chat", roomId: 100, callAttemptId: managedInvite.callAttemptId });
+  assert.strictEqual(f.manager.session, null, "authoritative end also ends an unanswered modern call");
+  assert.strictEqual(socket.listenerCount("call:allocate-result"), 0);
+  assert.strictEqual(socket.listenerCount("call:heartbeat-result"), 0, "ended manager session releases lease listener");
+  await f.manager.incoming({ fromUserId: "owner-1", chatId: "managed-chat", roomId: 100, callType: "audio", callAttemptId: managedInvite.callAttemptId, organizationId: "tenant-a" });
+  const incomingManaged = f.manager.session;
+  const managedAccept = emitted.filter(event => event.name === "call:accept").at(-1).payload;
+  assert.strictEqual(managedAccept.deviceId, f.manager.deviceId);
+  assert.strictEqual(managedAccept.generation, 0);
+  const previousBeats = emitted.filter(event => event.name === "call:heartbeat").length;
+  assert.strictEqual(incomingManaged._accepted, true);
+  incomingManaged.options.onMediaReady();
+  assert.strictEqual(emitted.filter(event => event.name === "call:heartbeat").length, previousBeats + 1);
+  const deniedBeat = emitted.filter(event => event.name === "call:heartbeat").at(-1).payload;
+  originalEmit("call:heartbeat-result", { requestId: deniedBeat.requestId, ok: false });
+  await new Promise(resolve => setImmediate(resolve));
+  assert.strictEqual(f.manager.session, null, "explicit lease denial closes the call");
+  assert.strictEqual(incomingManaged.closed, "lease-denied");
+  assert.strictEqual(socket.listenerCount("call:heartbeat-result"), 0);
+
+
+  f = fixture();
+  await f.manager.incoming({ fromUserId: "owner-1", chatId: "managed-chat", roomId: 100, callType: "video", callAttemptId: "managed-attempt-123456789", organizationId: "tenant-a", generation: 7 });
+  assert.strictEqual(f.events[0].payload.generation, 7, "pre-access decline preserves recipient reinvite generation");
+  assert.strictEqual(f.events[0].payload.deviceId, f.manager.deviceId);
+
+  f = fixture();
+  await f.manager.outgoing({ chatId: "local-end" });
+  const localSession = f.manager.session;
+  localSession.options.onEnded("max-duration");
+  localSession.options.onEnded("max-duration");
+  assert.strictEqual(f.events.filter(event => event.name === "call:end").length, 1);
+  assert.strictEqual(f.events.at(-1).payload.callAttemptId, localSession.callIdentity.callAttemptId);
+  assert.strictEqual(f.manager.session, null);
+
+  // Stop during configuration cancels setup; a late fetch cannot start media.
+  f = fixture();
+  let finishConfig;
+  f.manager.adapter._request = () => new Promise(resolve => { finishConfig = resolve; });
+  const incoming = f.manager.incoming({ fromUserId: "owner-1", chatId: "late", roomId: 80, callType: "audio" });
+  await f.manager.stop();
+  finishConfig({ config: { roomAdmissionEnabled: false, iceServers: [{ urls: "turn:relay:3478" }] } });
+  await incoming;
+  assert.strictEqual(f.manager.session, null);
+  assert.ok(!f.events.some(event => event.name === "call:accept"));
+
+  // Configuration errors never fall back to unauthenticated STUN-only media.
+  f = fixture();
+  f.manager.adapter._request = async () => { throw new Error("unavailable"); };
+  await f.manager.incoming({ fromUserId: "owner-1", chatId: "fail", roomId: 81, callType: "audio" });
+  assert.strictEqual(f.manager.session, null);
+  assert.strictEqual(f.events.at(-1).payload.reason, "connection_failed");
+  await assert.rejects(() => f.manager.outgoing({ chatId: "chat", toUserId: "stranger" }), /owner/);
+  // Correlated access requests reject expiry/mismatch and detach on cancellation.
+  const { requestRoomAccess } = require("./channels/kazee/call/access");
+  const accessSocket = new EventEmitter();
+  accessSocket.connected = true;
+  let requested;
+  accessSocket.on("call:allocate", payload => { requested = payload; });
+  const accessPromise = requestRoomAccess(accessSocket, "allocate", { deviceId: "device-1234567890", chatId: "chat" });
+  accessSocket.emit("call:allocate-result", { requestId: "other-request", ok: false });
+  assert.strictEqual(accessSocket.listenerCount("call:allocate-result"), 1);
+  accessSocket.emit("call:allocate-result", { requestId: requested.requestId, ok: true, protocolVersion: 3, callAttemptId: "attempt-1234567890", organizationId: "tenant-a", roomId: 20, chatId: "chat", deviceId: "different-device", generation: 0, janusToken: "t", roomToken: "t", roomTokenExpiresAt: Date.now() + 300000 });
+  await assert.rejects(accessPromise, /Invalid call room/);
+  assert.strictEqual(accessSocket.listenerCount("call:allocate-result"), 0);
+  for (const server of ["http://assigned/janus", "wss://user:password@assigned/janus", "wss://assigned/janus#fragment", 123]) {
+    const invalid = requestRoomAccess(accessSocket, "allocate", { deviceId: "device-1234567890", chatId: "chat" });
+    accessSocket.emit("call:allocate-result", { requestId: requested.requestId, ok: true, protocolVersion: 3, callAttemptId: "attempt-1234567890", organizationId: "tenant-a", roomId: 20, chatId: "chat", deviceId: "device-1234567890", generation: 0, server, janusToken: "t", roomToken: "t", roomTokenExpiresAt: Date.now() + 300000 });
+    await assert.rejects(invalid, /Invalid call room/);
+    assert.strictEqual(accessSocket.listenerCount("call:allocate-result"), 0);
+  }
+  const controller = new AbortController();
+  const cancelledAccess = requestRoomAccess(accessSocket, "allocate", { deviceId: "device-1234567890", chatId: "chat" }, { signal: controller.signal });
+  controller.abort();
+  await assert.rejects(cancelledAccess, /cancelled/);
+  assert.strictEqual(accessSocket.listenerCount("call:allocate-result"), 0);
   console.log("kazee call manager: ok");
 })().catch((error) => { console.error(error); process.exitCode = 1; });

package/test-kazee-call-session.js

@@ -79,6 +79,28 @@ async function testSpeakSerialization() {
   await session.close();
 }
 
+async function testMeasuredMediaReady() {
+  const { session } = makeSession();
+  let ready = 0, sent = 0;
+  session.onMediaReady = () => { ready++; };
+  await session._subscribe(901, "peer");
+  const codec = new OpusAudioCodec();
+  session._onFeedRtp(901, { payload: toneOpus(codec, 30) });
+  assert.strictEqual(ready, 0, "receive-only media is insufficient");
+  session._writeFrame(Buffer.alloc(WEBRTC_SAMPLES * 2));
+  assert.strictEqual(ready, 0, "missing publisher track cannot count as sent media");
+  session.publisher = { track: { writeRtp: () => { sent++; } }, sender: { codec: { payloadType: 111 } } };
+  session._writeFrame(Buffer.alloc(WEBRTC_SAMPLES * 2));
+  assert.strictEqual(ready, 1);
+  session._writeFrame(Buffer.alloc(WEBRTC_SAMPLES * 2));
+  session._onFeedRtp(901, { payload: toneOpus(codec, 30) });
+  assert.strictEqual(ready, 1, "media-ready is reported once per session");
+  await session.close();
+  session._writeFrame(Buffer.alloc(WEBRTC_SAMPLES * 2));
+  assert.strictEqual(sent, 2, "closed sessions cannot send or activate media");
+  codec.close();
+}
+
 async function testSpeakCancellation() {
   let frames = 0;
   const synthCalls = [];
@@ -421,9 +443,49 @@ async function testCloseResolvesSpeech() {
   assert.strictEqual(await session.speak("after"), false, "speak after close is a no-op");
 }
 
+async function testManagedRoomCredentials() {
+  class SignedJanus extends FakeJanus {
+    constructor(options) { super(); this.options = options; this.calls = []; }
+    async message(handle, body) {
+      this.calls.push(body);
+      if (body.request === "join" && body.ptype === "publisher") return { plugindata: { data: { videoroom: "joined", private_id: 999, publishers: [] } } };
+      return {};
+    }
+  }
+  let refreshes = 0;
+  const session = new KazeeCallSession({ roomId: 7, chatId: "chat", callerId: "owner", botUserId: "bot", janusUrl: "ws://test",
+    janusToken: "root-token", roomToken: "publisher-token", roomTokenExpiresAt: Date.now() + 300000, managedRoom: true, asCaller: true,
+    refreshRoomAccess: async () => { refreshes += 1; return { janusToken: "fresh-root", janusTokenExpiresAt: Date.now() + 86400000, roomToken: "subscriber-token", roomTokenExpiresAt: Date.now() + 300000 }; },
+    JanusClientImpl: SignedJanus, PeerConnectionImpl: FakePC, SpeechStreamImpl: FakeSpeechStream });
+  session._maybePublish = async () => {};
+  await session.start();
+  assert.strictEqual(session.janus.options.token, "root-token");
+  assert.strictEqual(session.janus.calls[0].token, "publisher-token");
+  session.roomTokenExpiresAt = Date.now() - 1;
+  await Promise.all([session._subscribe(17, "owner"), session._subscribe(18, "other")]);
+  const subJoin = session.janus.calls.find(body => body.ptype === "subscriber");
+  assert.strictEqual(subJoin.token, "subscriber-token");
+  assert.strictEqual(subJoin.private_id, 999);
+  assert.strictEqual(refreshes, 1, "simultaneous subscriber joins share one token refresh");
+  session.janusTokenExpiresAt = Date.now() + 50000;
+  const handlesBefore = session.janus.handles;
+  await session._enforceLimits();
+  await wait(0);
+  assert.strictEqual(session.janus.token, "fresh-root");
+  assert.strictEqual(refreshes, 2, "root renewal does not wait for a new subscriber");
+  assert.strictEqual(session.janus.handles, handlesBefore, "renewal keeps existing session and handles");
+  session.janusTokenExpiresAt = Date.now() - 1;
+  await session._enforceLimits();
+  assert.strictEqual(session.closed, true, "expired transport credentials close media");
+  await session.close();
+  assert.ok(!session.janus.calls.some(body => ["create", "destroy"].includes(body.request)), "server allocated room ownership never transfers to the bot");
+}
+
 (async () => {
+  await testManagedRoomCredentials();
   await testSpeakSerialization();
   await testSpeakCancellation();
+  await testMeasuredMediaReady();
   await testEchoGateAndBargeIn();
   await testPrebufferAndCommit();
   await testHoldForWords();

package/test-provider-enforcer.js

@@ -6,7 +6,8 @@ const assert = require("assert");
 const fs = require("fs");
 const os = require("os");
 const path = require("path");
-const { spawnSync } = require("child_process");
+const { spawn, spawnSync } = require("child_process");
+const { killProcessTree } = require("./core/process-tree");
 
 const RESULT_PREFIX = "__PROVIDER_ENFORCER_RESULT__";
 
@@ -73,7 +74,6 @@ function auditSink() {
 
 async function providerProbe(kind) {
   const root = isolate(kind);
-  const timeoutSignal = path.join(root, `${kind}-timeout-signal.json`);
   const controls = [
     { FAKE_AGENT_TEXT: '{"decision":"allow","reason":"inside mandate"}' },
     { FAKE_AGENT_TEXT: '{"decision":"block","reason":"outside mandate"}' },
@@ -82,16 +82,27 @@ async function providerProbe(kind) {
     // The guard-reliability fix retries ONCE on a transient timeout before
     // failing closed: BOTH attempts hang, so the verdict still escalates —
     // proving the retry is bounded and never fails open at the transport level.
-    { FAKE_AGENT_SCENARIO: "forced-termination", FAKE_AGENT_SIGNAL_CAPTURE: timeoutSignal },
     { FAKE_AGENT_SCENARIO: "forced-termination" },
+    { FAKE_AGENT_SCENARIO: "forced-termination", FAKE_AGENT_IGNORE_SIGTERM: "1" },
   ];
   const entry = makeProvider(kind, root, controls);
   const model = `${kind}-enforcer-exact`;
   const { createUtilityAgentService } = require("./core/utility-agent");
+  const children = [];
+  const terminations = [];
   const utility = createUtilityAgentService({
     registry: registry([entry]),
     env: { ENFORCER_PROVIDER: kind, [`ENFORCER_MODEL_${kind.toUpperCase()}`]: model },
     killGraceMs: 300,
+    spawnProcess(...args) {
+      const child = spawn(...args);
+      children.push(child);
+      return child;
+    },
+    killTree(pid, signal) {
+      terminations.push({ pid, signal });
+      return killProcessTree(pid, signal);
+    },
   });
   const enforcer = require("./core/enforcer");
   assert.strictEqual(typeof enforcer.createEnforcerService, "function", "enforcer exposes an injectable utility-provider service");
@@ -114,8 +125,8 @@ async function providerProbe(kind) {
     spawnUtilityAgent: utility.spawnUtilityAgent,
     audit,
     // Bounded (this deadline MUST fire — the child hangs by design), but with
-    // enough headroom for the hung child to boot on a loaded CI runner (write
-    // capture #5, arm its SIGTERM recorder) before the deadline kills it.
+    // enough headroom for the hung children to boot on a loaded CI runner
+    // before the deadline kills them; the retry deliberately ignores TERM.
     timeoutMs: 5000,
   });
   const timedOut = await timeoutService.vetReply(speaker, "timeout verdict fixture");
@@ -154,7 +165,19 @@ async function providerProbe(kind) {
     assert.ok(record.argv.includes(kind === "claude" ? "plan" : "read-only"));
     assert.ok(record.argv.includes(kind === "claude" ? "--json-schema" : "--output-schema"));
   }
-  assert.strictEqual(JSON.parse(fs.readFileSync(timeoutSignal, "utf8")).signal, "SIGTERM");
+  // Observe shutdown from the surviving parent. A child-written receipt can
+  // be truncated by SIGKILL during synchronous I/O (CI pipeline 12017), even
+  // though the guard correctly failed closed and waited for process close.
+  assert.strictEqual(children.length, 6);
+  for (const child of children.slice(4)) {
+    const signals = terminations.filter((entry) => entry.pid === child.pid).map((entry) => entry.signal);
+    assert.strictEqual(signals[0], "SIGTERM", "both timeout attempts first request graceful termination");
+    assert.ok(["SIGTERM", "SIGKILL"].includes(child.signalCode), "the timed-out child has exited by signal before the verdict settles");
+    assert.throws(() => process.kill(child.pid, 0), { code: "ESRCH" }, "the timed-out provider must not survive its verdict");
+  }
+  assert.ok(terminations.some((entry) => entry.pid === children[5].pid && entry.signal === "SIGKILL"), "the retry that ignores TERM is forcibly terminated after the grace period");
+  assert.strictEqual(children[5].signalCode, "SIGKILL");
+  assert.deepStrictEqual(utility.stats(), { activeGlobal: 0, activeByPurpose: {} }, "both timed-out attempts release their concurrency slots after close");
 
   return { kind, decisions: [allow.decision, block.decision, escalate.decision, malformed.decision, timedOut.decision] };
 }

package/test-provider-language.js

@@ -463,8 +463,8 @@ assert.match(pkg.description, /provider-agnostic coding-agent harness/i);
 // Codex turn. Live probe: unified-exec shell calls still reach PreToolUse as
 // tool_name "Bash" and the deny gate caught the probe, so the gate no longer
 // requires unified_exec off. Push approved by Sumeet before release.
-// 3.4.7: owner approved scheduler fix and push on 2026-09-05.
-assert.strictEqual(pkg.version, "3.4.7", "release version must remain unchanged without explicit approval");
+// 3.4.11: owner approved end-to-end calling rollout on 2026-09-05.
+assert.strictEqual(pkg.version, "3.4.11", "release version must remain unchanged without explicit approval");
 for (const keyword of ["claude", "codex", "coding-agent", "provider-agnostic"]) {
   assert.ok(pkg.keywords.includes(keyword), `package keyword missing: ${keyword}`);
 }