@keychat-io/keychat 0.1.25 → 0.1.27

package/README.md

@@ -6,8 +6,6 @@ E2E encrypted AI agent communication via Keychat protocol.
 
 This plugin gives your OpenClaw agent a **sovereign identity** — a self-generated Public Key ID (Nostr keypair) — and enables **end-to-end encrypted communication** using the Signal Protocol over Nostr relays.
 
-Your agent becomes a full Keychat citizen: it can receive friend requests, establish Signal Protocol sessions, and exchange messages with Keychat app users. All messages are encrypted with forward and backward secrecy — not even relay operators can read them.
-
 ## Install
 
 ```bash
@@ -17,42 +15,22 @@ openclaw gateway restart
 
 That's it. The plugin automatically downloads the bridge binary and initializes the config on first load.
 
-Supported platforms: macOS (ARM/x64), Linux (x64/ARM64).
-
-### Security Warnings
-
-During installation, OpenClaw will show the following warning:
-
-```
-WARNING: Plugin "keychat" contains dangerous code patterns:
-  Shell command execution detected (child_process) (src/bridge-client.ts)
-  Shell command execution detected (child_process) (src/keychain.ts)
-```
-
-**Both are expected and required.** Here's why:
-
-| Warning | File | Why it's needed |
-|---------|------|----------------|
-| Shell command execution (child_process) | `bridge-client.ts` | Spawns the Rust sidecar process for Signal Protocol & MLS encryption. Keychat's cryptography runs in Rust and must be bridged to Node.js. |
-| Shell command execution (child_process) | `keychain.ts` | Stores the agent's identity mnemonic in the OS keychain (macOS Keychain / Linux libsecret) instead of plain-text files. |
-
-These warnings cannot be removed without sacrificing core functionality or security. The plugin does **not** execute arbitrary commands — it only spawns the bundled bridge binary and accesses the system keychain.
-
 Alternatively, install via shell script:
 
 ```bash
 curl -fsSL https://raw.githubusercontent.com/keychat-io/keychat-openclaw/main/scripts/install.sh | bash
 ```
 
+Supported platforms: macOS (ARM/x64), Linux (x64/ARM64).
+
 ### Security Warnings
 
-During installation, OpenClaw's security scanner may show three warnings. All are expected:
+During installation, OpenClaw's security scanner may show two warnings. Both are expected:
 
-| Warning                                    | Reason                                                                               |
-| ------------------------------------------ | ------------------------------------------------------------------------------------ |
-| Shell command execution (bridge-client.ts) | Spawns a Rust sidecar for Signal Protocol and MLS encryption.                        |
-| Shell command execution (keychain.ts)      | Stores identity mnemonics in the OS keychain (macOS Keychain / Linux libsecret).     |
-| Shell command execution (notify.ts)        | Notifies the agent on startup so it can send the Keychat ID and QR code to the user. |
+| Warning                                    | Reason                                                                           |
+| ------------------------------------------ | -------------------------------------------------------------------------------- |
+| Shell command execution (bridge-client.ts) | Spawns a Rust sidecar for Signal Protocol and MLS encryption.                    |
+| Shell command execution (keychain.ts)      | Stores identity mnemonics in the OS keychain (macOS Keychain / Linux libsecret). |
 
 Source code is fully open: [github.com/keychat-io/keychat-openclaw](https://github.com/keychat-io/keychat-openclaw)
 
@@ -61,7 +39,7 @@ Source code is fully open: [github.com/keychat-io/keychat-openclaw](https://gith
 Tell your agent "upgrade keychat" in any chat, or manually:
 
 ```bash
-openclaw plugins install @keychat-io/keychat@latest
+openclaw plugins update keychat
 openclaw gateway restart
 ```
 
@@ -77,15 +55,7 @@ After `openclaw gateway restart`, the agent will send you its **Keychat ID**, **
 
 Open the [Keychat app](https://keychat.io) → tap the link, paste the npub, or scan the QR code to add as contact. If `dmPolicy` is `open` (default after auto-init), the agent accepts immediately.
 
-**Can't find the public key?** Check your config file or gateway logs:
-
-```bash
-# View the agent's npub in config
-cat ~/.openclaw/openclaw.json | grep npub
-
-# Or watch the gateway logs for the Keychat ID
-openclaw logs --follow
-```
+**Can't find the public key?** Just ask your agent in chat: "What's your Keychat ID?"
 
 ## Configuration
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@keychat-io/keychat",
-  "version": "0.1.25",
+  "version": "0.1.27",
   "description": "Keychat — E2E encrypted chat + Lightning wallet for OpenClaw agents",
   "license": "AGPL-3.0",
   "repository": {

package/src/bridge-client.ts

@@ -306,8 +306,13 @@ export class KeychatBridgeClient {
       this.pending.set(id, { resolve, reject });
 
       const request = JSON.stringify({ id, method, params: params ?? {} });
-      this.process.stdin.write(request + "\n");
-
+     try {
+        this.process.stdin.write(request + '\n');
+      } catch (error) {
+        this.pending.delete(id);
+        reject(new Error(`Bridge write failed: ${error}`));
+        return;
+      }
       // Timeout after 30 seconds
       setTimeout(() => {
         if (this.pending.has(id)) {

package/src/channel.ts

@@ -17,6 +17,28 @@ import {
   formatPairingApproveHint,
   type ChannelPlugin,
 } from "openclaw/plugin-sdk";
+
+/**
+ * Strip "Reasoning:\n_..._" prefix that OpenClaw core prepends when
+ * reasoning display is enabled.  Keychat has no collapsible UI for it,
+ * so we silently drop it to keep messages clean.
+ */
+function stripReasoningPrefix(text: string): string {
+  // Strip reasoning in multiple formats:
+  // 1. "Reasoning:\n_line1_\n_line2_\n\nActual answer..."
+  // 2. Leading italic blocks: "_thinking text_\n_more thinking_\n\nActual answer..."
+  // 3. "**Heading**\n_thinking_\n\nActual answer..."
+  let result = text;
+
+  // Format 1: Explicit "Reasoning:" prefix
+  result = result.replace(/^Reasoning:\n(?:_[^\n]*_\n?)+\n*/s, "");
+
+  // Format 2: Leading italic lines (markdown _text_) at the start
+  // Keep stripping italic lines until we hit a non-italic line
+  result = result.replace(/^(?:_[^\n]*_\n*)+\n*/s, "");
+
+  return result.trim();
+}
 import { KeychatConfigSchema } from "./config-schema.js";
 import { getKeychatRuntime } from "./runtime.js";
 import {
@@ -35,6 +57,7 @@ import {
 } from "./bridge-client.js";
 import { storeMnemonic, retrieveMnemonic } from "./keychain.js";
 import { parseMediaUrl, downloadAndDecrypt, encryptAndUpload } from "./media.js";
+import { transcribe, type SttConfig } from "./stt.js";
 import { join } from "node:path";
 import { existsSync, mkdirSync } from "node:fs";
 import { signalDbPath, qrCodePath, WORKSPACE_KEYCHAT_DIR } from "./paths.js";
@@ -435,7 +458,7 @@ export const keychatPlugin: ChannelPlugin<ResolvedKeychatAccount> = {
         channel: "keychat",
         accountId: aid,
       });
-      const message = core.channel.text.convertMarkdownTables(text ?? "", tableMode);
+      const message = stripReasoningPrefix(core.channel.text.convertMarkdownTables(text ?? "", tableMode));
       const normalizedTo = normalizePubkey(to);
 
       // Handle /reset signal command — reset Signal session and re-send hello
@@ -1437,7 +1460,19 @@ async function handleMlsGroupMessage(
           try {
             mlsMediaPath = await downloadAndDecrypt(mlsMediaInfo);
             ctx.log?.info(`[${accountId}] MLS group media downloaded: ${mlsMediaInfo.kctype} → ${mlsMediaPath}`);
-            mlsDisplayText = `[${mlsMediaInfo.kctype}: ${mlsMediaInfo.sourceName || mlsMediaInfo.suffix}] (saved to ${mlsMediaPath})`;
+            if (mlsMediaInfo.isVoiceNote) {
+              try {
+                const sttConfig: SttConfig = { provider: "whisper-cpp", language: "auto" };
+                const transcription = await transcribe(mlsMediaPath!, sttConfig);
+                ctx.log?.info(`[${accountId}] MLS voice note transcribed: ${transcription.slice(0, 80)}...`);
+                mlsDisplayText = `[voice message, ${mlsMediaInfo.duration || '?'}s] ${transcription}`;
+              } catch (sttErr) {
+                ctx.log?.error(`[${accountId}] MLS voice note STT failed: ${sttErr}`);
+                mlsDisplayText = `[voice message — transcription failed, audio saved to ${mlsMediaPath}]`;
+              }
+            } else {
+              mlsDisplayText = `[${mlsMediaInfo.kctype}: ${mlsMediaInfo.sourceName || mlsMediaInfo.suffix}] (saved to ${mlsMediaPath})`;
+            }
           } catch (err) {
             ctx.log?.error(`[${accountId}] MLS group media download failed: ${err}`);
             mlsDisplayText = `[${mlsMediaInfo.kctype} message — download failed]`;
@@ -1690,7 +1725,7 @@ async function dispatchMlsGroupToAgent(
       ...prefixOptions,
       deliver: async (payload: { text?: string }) => {
         if (!payload.text) return;
-        const message = core.channel.text.convertMarkdownTables(payload.text, tableMode);
+        const message = stripReasoningPrefix(core.channel.text.convertMarkdownTables(payload.text, tableMode));
         deliverBuffer.push(message);
         if (deliverTimer) clearTimeout(deliverTimer);
         deliverTimer = setTimeout(() => { flushDeliverBuffer(); }, DELIVER_DEBOUNCE_MS);
@@ -2137,7 +2172,24 @@ async function handleEncryptedDM(
       const localPath = await downloadAndDecrypt(mediaInfo);
       mediaPath = localPath;
       ctx.log?.info(`[${accountId}] Downloaded ${mediaInfo.kctype}: ${localPath}`);
-      displayText = `[${mediaInfo.kctype}: ${mediaInfo.sourceName || mediaInfo.suffix}] (saved to ${localPath})`;
+      
+      // Voice note: transcribe to text via STT
+      if (mediaInfo.isVoiceNote) {
+        try {
+          const sttConfig: SttConfig = { 
+            provider: "whisper-cpp",
+            language: "auto",
+          };
+          const transcription = await transcribe(localPath, sttConfig);
+          ctx.log?.info(`[${accountId}] Voice note transcribed (${mediaInfo.duration || '?'}s): ${transcription.slice(0, 80)}...`);
+          displayText = `[voice message, ${mediaInfo.duration || '?'}s] ${transcription}`;
+        } catch (sttErr) {
+          ctx.log?.error(`[${accountId}] Voice note STT failed: ${sttErr}`);
+          displayText = `[voice message, ${mediaInfo.duration || '?'}s — transcription failed, audio saved to ${localPath}]`;
+        }
+      } else {
+        displayText = `[${mediaInfo.kctype}: ${mediaInfo.sourceName || mediaInfo.suffix}] (saved to ${localPath})`;
+      }
     } catch (err) {
       ctx.log?.error(`[${accountId}] Failed to download media: ${err}`);
       displayText = `[${mediaInfo.kctype} message — download failed]`;
@@ -2255,7 +2307,7 @@ async function dispatchToAgent(
       ...prefixOptions,
       deliver: async (payload: { text?: string }) => {
         if (!payload.text) return;
-        const message = core.channel.text.convertMarkdownTables(payload.text, tableMode);
+        const message = stripReasoningPrefix(core.channel.text.convertMarkdownTables(payload.text, tableMode));
         deliverBuffer.push(message);
         // Reset debounce timer — wait for more chunks before sending
         if (deliverTimer) clearTimeout(deliverTimer);
@@ -2378,7 +2430,7 @@ async function dispatchGroupToAgent(
       ...prefixOptions,
       deliver: async (payload: { text?: string }) => {
         if (!payload.text) return;
-        const message = core.channel.text.convertMarkdownTables(payload.text, tableMode);
+        const message = stripReasoningPrefix(core.channel.text.convertMarkdownTables(payload.text, tableMode));
         deliverBuffer.push(message);
         if (deliverTimer) clearTimeout(deliverTimer);
         deliverTimer = setTimeout(() => { flushDeliverBuffer(); }, DELIVER_DEBOUNCE_MS);

package/src/media.ts

@@ -12,6 +12,9 @@ export interface KeychatMediaInfo {
   size: number;
   hash?: string;
   sourceName?: string;
+  isVoiceNote?: boolean;
+  duration?: number;    // seconds
+  waveform?: string;    // base64 5-bit packed
 }
 
 export interface MediaUploadResult {
@@ -30,8 +33,11 @@ function resolveKctype(filePath: string, mimeType?: string): string {
   const imageExts = [".jpg", ".jpeg", ".png", ".gif", ".bmp", ".webp", ".tiff", ".svg"];
   const videoExts = [".mp4", ".avi", ".mov", ".mkv", ".webm", ".flv", ".wmv", ".m4v"];
 
+  const audioExts = [".ogg", ".opus", ".aac", ".m4a", ".mp3", ".wav"];
+
   if (mimeType?.startsWith("image/") || imageExts.includes(ext)) return "image";
   if (mimeType?.startsWith("video/") || videoExts.includes(ext)) return "video";
+  if (mimeType?.startsWith("audio/") || audioExts.includes(ext)) return "voiceNote";
   return "file";
 }
 
@@ -123,6 +129,7 @@ export async function encryptAndUpload(
   signEvent: (content: string, tags: string[][]) => Promise<string>,
   server?: string,
   mimeType?: string,
+  voiceNote?: { duration?: number; waveform?: string },
 ): Promise<MediaUploadResult> {
   const { encrypted, key, iv, hash, suffix, sourceName } = await encryptFile(filePath);
   const url = await uploadToBlossom(encrypted, hash, signEvent, server);
@@ -139,6 +146,12 @@ export async function encryptAndUpload(
   mediaUrl.searchParams.set("hash", hash);
   mediaUrl.searchParams.set("sourceName", sourceName);
 
+  if (voiceNote || kctype === "voiceNote") {
+    mediaUrl.searchParams.set("isVoiceNote", "1");
+    if (voiceNote?.duration) mediaUrl.searchParams.set("duration", voiceNote.duration.toString());
+    if (voiceNote?.waveform) mediaUrl.searchParams.set("waveform", voiceNote.waveform);
+  }
+
   return { mediaUrl: mediaUrl.toString(), kctype };
 }
 
@@ -166,6 +179,9 @@ export function parseMediaUrl(content: string): KeychatMediaInfo | null {
     size: parseInt(uri.searchParams.get("size") || "0", 10),
     hash: uri.searchParams.get("hash") || undefined,
     sourceName: uri.searchParams.get("sourceName") || undefined,
+    isVoiceNote: kctype === "voiceNote" || uri.searchParams.get("isVoiceNote") === "1",
+    duration: parseInt(uri.searchParams.get("duration") || "0", 10) || undefined,
+    waveform: uri.searchParams.get("waveform") || undefined,
   };
 }
 

package/src/stt.ts

@@ -0,0 +1,159 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+
+const execFileAsync = promisify(execFile);
+
+export interface SttConfig {
+  provider: "whisper-cpp" | "openai";
+  /** Path to whisper-cpp binary (default: auto-detect via which) */
+  whisperPath?: string;
+  /** Path to whisper model file */
+  modelPath?: string;
+  /** Model size for auto-download: tiny, base, small, medium */
+  modelSize?: string;
+  /** OpenAI API key (for openai provider) */
+  openaiApiKey?: string;
+  /** Language hint (e.g. "zh", "en", "auto") */
+  language?: string;
+}
+
+const DEFAULT_MODEL_SIZE = "small";
+
+/** Find whisper-cpp binary */
+async function findWhisperBinary(configPath?: string): Promise<string> {
+  if (configPath && existsSync(configPath)) return configPath;
+
+  // Try common locations
+  const candidates = [
+    "/opt/homebrew/bin/whisper-cpp",
+    "/usr/local/bin/whisper-cpp",
+    "/usr/bin/whisper-cpp",
+  ];
+
+  for (const c of candidates) {
+    if (existsSync(c)) return c;
+  }
+
+  // Try which
+  try {
+    const { stdout } = await execFileAsync("which", ["whisper-cpp"]);
+    const path = stdout.trim();
+    if (path && existsSync(path)) return path;
+  } catch {}
+
+  throw new Error("whisper-cpp not found. Install with: brew install whisper-cpp");
+}
+
+/** Find or download whisper model */
+async function findModel(configPath?: string, modelSize?: string): Promise<string> {
+  if (configPath && existsSync(configPath)) return configPath;
+
+  const size = modelSize || DEFAULT_MODEL_SIZE;
+
+  // Check common model locations
+  const candidates = [
+    join(process.env.HOME || "", `.cache/whisper/ggml-${size}.bin`),
+    `/opt/homebrew/share/whisper-cpp/models/ggml-${size}.bin`,
+    `/usr/local/share/whisper-cpp/models/ggml-${size}.bin`,
+    join(process.env.HOME || "", `whisper-models/ggml-${size}.bin`),
+  ];
+
+  for (const c of candidates) {
+    if (existsSync(c)) return c;
+  }
+
+  throw new Error(
+    `Whisper model ggml-${size}.bin not found. Download it:\n` +
+    `  mkdir -p ~/.cache/whisper && cd ~/.cache/whisper\n` +
+    `  curl -LO https://huggingface.co/ggerganov/whisper.cpp/resolve/main/ggml-${size}.bin`
+  );
+}
+
+/**
+ * Transcribe an audio file to text using whisper-cpp.
+ */
+export async function transcribeLocal(
+  audioPath: string,
+  config: SttConfig = { provider: "whisper-cpp" },
+): Promise<string> {
+  const binary = await findWhisperBinary(config.whisperPath);
+  const model = await findModel(config.modelPath, config.modelSize);
+
+  const args = [
+    "-m", model,
+    "-f", audioPath,
+    "--no-timestamps",
+    "--print-special", "false",
+    "-t", "4",  // threads
+  ];
+
+  if (config.language && config.language !== "auto") {
+    args.push("-l", config.language);
+  }
+
+  try {
+    const { stdout, stderr } = await execFileAsync(binary, args, {
+      timeout: 60000, // 60s timeout
+      maxBuffer: 10 * 1024 * 1024,
+    });
+
+    // whisper-cpp outputs text to stdout, strip whitespace
+    const text = stdout.trim();
+    if (!text) {
+      console.warn(`[stt] whisper-cpp produced no output. stderr: ${stderr}`);
+      return "[voice message - transcription empty]";
+    }
+    return text;
+  } catch (err: any) {
+    console.error(`[stt] whisper-cpp failed: ${err.message}`);
+    throw new Error(`Speech-to-text failed: ${err.message}`);
+  }
+}
+
+/**
+ * Transcribe using OpenAI Whisper API (fallback).
+ */
+export async function transcribeOpenAI(
+  audioPath: string,
+  apiKey: string,
+  language?: string,
+): Promise<string> {
+  const { readFile } = await import("node:fs/promises");
+  const audioData = await readFile(audioPath);
+  const blob = new Blob([audioData], { type: "audio/ogg" });
+
+  const form = new FormData();
+  form.append("file", blob, "voice.ogg");
+  form.append("model", "whisper-1");
+  if (language && language !== "auto") form.append("language", language);
+
+  const response = await fetch("https://api.openai.com/v1/audio/transcriptions", {
+    method: "POST",
+    headers: { Authorization: `Bearer ${apiKey}` },
+    body: form,
+  });
+
+  if (!response.ok) {
+    const body = await response.text().catch(() => "");
+    throw new Error(`OpenAI Whisper API failed (${response.status}): ${body}`);
+  }
+
+  const result = await response.json() as { text: string };
+  return result.text || "[voice message - transcription empty]";
+}
+
+/**
+ * Main transcribe function — picks provider from config.
+ */
+export async function transcribe(
+  audioPath: string,
+  config: SttConfig = { provider: "whisper-cpp" },
+): Promise<string> {
+  if (config.provider === "openai") {
+    if (!config.openaiApiKey) throw new Error("OpenAI API key required for openai STT provider");
+    return transcribeOpenAI(audioPath, config.openaiApiKey, config.language);
+  }
+  return transcribeLocal(audioPath, config);
+}

package/src/tts.ts

@@ -0,0 +1,103 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { existsSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+const execFileAsync = promisify(execFile);
+
+export interface TtsConfig {
+  provider: "say" | "piper" | "openai";
+  /** macOS 'say' voice name (e.g. "Tingting" for Chinese, "Samantha" for English) */
+  voice?: string;
+  /** Path to piper binary */
+  piperPath?: string;
+  /** Path to piper voice model */
+  piperModel?: string;
+  /** OpenAI API key */
+  openaiApiKey?: string;
+  /** OpenAI TTS voice */
+  openaiVoice?: string;
+}
+
+/**
+ * Generate speech from text using macOS 'say' command.
+ * Outputs AIFF, then converts to OGG via ffmpeg if available.
+ */
+async function ttsSay(text: string, config: TtsConfig): Promise<string> {
+  const outPath = join(tmpdir(), `tts_${Date.now()}.aiff`);
+  const args = ["-o", outPath];
+
+  if (config.voice) {
+    args.push("-v", config.voice);
+  }
+  args.push(text);
+
+  await execFileAsync("say", args, { timeout: 30000 });
+
+  // Try to convert to OGG with ffmpeg
+  const oggPath = outPath.replace(".aiff", ".ogg");
+  try {
+    await execFileAsync("ffmpeg", [
+      "-i", outPath,
+      "-c:a", "libopus",
+      "-b:a", "24k",
+      "-ar", "48000",
+      "-ac", "1",
+      "-y", oggPath,
+    ], { timeout: 30000 });
+    return oggPath;
+  } catch {
+    // ffmpeg not available, return AIFF
+    return outPath;
+  }
+}
+
+/**
+ * Generate speech using OpenAI TTS API.
+ */
+async function ttsOpenAI(text: string, config: TtsConfig): Promise<string> {
+  if (!config.openaiApiKey) throw new Error("OpenAI API key required");
+
+  const response = await fetch("https://api.openai.com/v1/audio/speech", {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${config.openaiApiKey}`,
+      "Content-Type": "application/json",
+    },
+    body: JSON.stringify({
+      model: "tts-1",
+      input: text,
+      voice: config.openaiVoice || "alloy",
+      response_format: "opus",
+    }),
+  });
+
+  if (!response.ok) {
+    const body = await response.text().catch(() => "");
+    throw new Error(`OpenAI TTS failed (${response.status}): ${body}`);
+  }
+
+  const { writeFile } = await import("node:fs/promises");
+  const audioData = Buffer.from(await response.arrayBuffer());
+  const outPath = join(tmpdir(), `tts_${Date.now()}.ogg`);
+  await writeFile(outPath, audioData);
+  return outPath;
+}
+
+/**
+ * Main TTS function — generate audio file from text.
+ * Returns path to audio file (OGG preferred).
+ */
+export async function synthesize(text: string, config: TtsConfig = { provider: "say" }): Promise<string> {
+  switch (config.provider) {
+    case "say":
+      return ttsSay(text, config);
+    case "openai":
+      return ttsOpenAI(text, config);
+    case "piper":
+      throw new Error("Piper TTS not yet implemented");
+    default:
+      throw new Error(`Unknown TTS provider: ${config.provider}`);
+  }
+}