@ouro.bot/cli 0.1.0-alpha.561 → 0.1.0-alpha.563

package/README.md

@@ -105,7 +105,7 @@ Task docs do not live in this repo anymore. Planning and doing docs live in the
 - Human TTY commands share one CLI surface family: bare `ouro` opens the home deck, `ouro up` uses the boot checklist, `ouro connect`/`ouro auth verify`/`ouro repair` agree on provider and vault truth, and `ouro help`/`ouro whoami`/`ouro versions`/`ouro hatch` render through the same Ouro-branded wizard/guide language instead of raw transcript walls. Orientation commands such as root `ouro connect` may use shorter live probes, while startup and verification commands own durable readiness updates.
 - Human-facing CLI commands that can wait on browser auth, vault IO, daemon startup, daemon restart, provider checks, or connector setup use a shared progress checklist. If a cursor may blink for more than a few seconds, the command should print or animate the current step instead of going quiet.
 - CLI commands that mutate bundle config, such as vault setup or `ouro connect bluebubbles`, run bundle sync after the change when `sync.enabled` is true and report a compact `bundle sync:` line.
-- Voice is transcript-first: voice sessions use the ordinary `state/sessions/<friend>/voice/<key>.json` session path and appear in Ouro Mailbox as text transcripts. ElevenLabs API credentials live in portable `runtime/config` at `integrations.elevenLabsApiKey`; Whisper.cpp CLI/model paths live in the machine runtime item at `voice.whisperCliPath` and `voice.whisperModelPath`.
+- Voice is transcript-first: voice sessions use the ordinary `state/sessions/<friend>/voice/<key>.json` session path and appear in Ouro Mailbox as text transcripts. ElevenLabs API credentials live in portable `runtime/config` at `integrations.elevenLabsApiKey` and `integrations.elevenLabsVoiceId`; Whisper.cpp CLI/model paths live in the machine runtime item at `voice.whisperCliPath` and `voice.whisperModelPath`. Phone calls, browser meetings, and local microphone capture are transports under the single `voice` sense, not separate senses; the Twilio phone transport uses Twilio Record -> Whisper.cpp -> voice session -> ElevenLabs -> Twilio Play.
 - The daemon discovers bundles dynamically from `~/AgentBundles`.
 - `ouro status` reports version, last-updated time, discovered agents, senses, and workers.
 - `bundle-meta.json` tracks the runtime version that last touched a bundle.

package/changelog.json

@@ -1,6 +1,22 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.563",
+      "changes": [
+        "The default agent credential vault host now points at the work-substrate Vaultwarden endpoint `https://vault.ouro.bot`.",
+        "Vault config normalization keeps `https://vault.ouroboros.bot` and the underlying Azure Container Apps hostname as legacy unlock-source candidates during the hostname migration.",
+        "Vault config and unlock tests now cover the `vault.ouro.bot` canonical host while preserving side-effect-free fallback lookup for legacy local unlock material."
+      ]
+    },
+    {
+      "version": "0.1.0-alpha.562",
+      "changes": [
+        "BlueBubbles outbound delivery now blocks narrow internal/meta markers such as `[surfaced from inner dialog]`, `[pending from ...]:`, routing-control prompt sections, and `<think>` tags before they can reach iMessage.",
+        "The guard fails closed across surface, proactive BlueBubbles sends, pending-drain retries, normal flush, and speak/flushNow paths so blocked internal text is logged instead of queued for later delivery.",
+        "Regression coverage now keeps ordinary user-facing prose about inner-dialog concepts deliverable while preventing the reported internal surfaced-thought leakage path."
+      ]
+    },
     {
       "version": "0.1.0-alpha.561",
       "changes": [

package/dist/heart/daemon/cli-exec.js

@@ -2540,6 +2540,10 @@ async function buildConnectMenu(agent, deps, onProgress) {
     const elevenLabsApiKey = runtimeConfig.ok
         ? readRuntimeConfigString(runtimeConfig.config, "integrations.elevenLabsApiKey")
         : null;
+    const elevenLabsVoiceId = runtimeConfig.ok
+        ? readRuntimeConfigString(runtimeConfig.config, "integrations.elevenLabsVoiceId")
+            ?? readRuntimeConfigString(runtimeConfig.config, "voice.elevenLabsVoiceId")
+        : null;
     const shouldVerifyPerplexity = runtimeConfig.ok && !!perplexityApiKey;
     const shouldVerifyEmbeddings = runtimeConfig.ok && !!embeddingsApiKey;
     let perplexityVerification;
@@ -2613,6 +2617,7 @@ async function buildConnectMenu(agent, deps, onProgress) {
     const voiceStatus = runtimeConfig.ok
         ? machineRuntime.ok
             ? elevenLabsApiKey
+                && elevenLabsVoiceId
                 && hasRuntimeConfigValue(machineRuntime.config, "voice.whisperCliPath")
                 && hasRuntimeConfigValue(machineRuntime.config, "voice.whisperModelPath")
                 && voiceEnabled
@@ -2719,6 +2724,7 @@ async function buildConnectMenu(agent, deps, onProgress) {
             detailLines: runtimeConfig.ok && machineRuntime.ok
                 ? [
                     elevenLabsApiKey ? "ElevenLabs API key saved in portable runtime config" : "missing integrations.elevenLabsApiKey",
+                    elevenLabsVoiceId ? "ElevenLabs voice ID saved in portable runtime config" : "missing integrations.elevenLabsVoiceId",
                     hasRuntimeConfigValue(machineRuntime.config, "voice.whisperCliPath") ? "Whisper.cpp CLI path saved for this machine" : "missing voice.whisperCliPath",
                     hasRuntimeConfigValue(machineRuntime.config, "voice.whisperModelPath") ? "Whisper.cpp model path saved for this machine" : "missing voice.whisperModelPath",
                 ]
@@ -4270,13 +4276,22 @@ function connectMenuTarget(answer) {
 async function executeConnectVoice(agent, deps) {
     const message = [
         `Voice foundation for ${agent}`,
-        "Configure the portable ElevenLabs API key with:",
+        "Configure portable ElevenLabs settings with:",
         `  ouro vault config set --agent ${agent} --key integrations.elevenLabsApiKey`,
+        `  ouro vault config set --agent ${agent} --key integrations.elevenLabsVoiceId`,
         "Configure this machine's Whisper.cpp attachment with:",
         `  ouro vault config set --agent ${agent} --scope machine --key voice.whisperCliPath`,
         `  ouro vault config set --agent ${agent} --scope machine --key voice.whisperModelPath`,
+        "Optional Twilio phone testing setup:",
+        `  ouro vault config set --agent ${agent} --key voice.twilioAccountSid`,
+        `  ouro vault config set --agent ${agent} --key voice.twilioAuthToken`,
+        `  ouro vault config set --agent ${agent} --scope machine --key voice.twilioPublicUrl`,
+        `  ouro vault config set --agent ${agent} --scope machine --key voice.twilioPort --value 18910`,
+        `  ouro vault config set --agent ${agent} --scope machine --key voice.twilioDefaultFriendId --value ari`,
+        `  node dist/senses/voice-twilio-entry.js --agent ${agent} --port 18910 --public-url https://<cloudflare-tunnel>`,
+        `Set the Twilio number's Voice webhook to POST https://<cloudflare-tunnel>/voice/twilio/incoming.`,
         "Then enable agent.json: senses.voice.enabled = true and restart with `ouro up`.",
-        "Meeting links use URL intake plus BlackHole/Multi-Output readiness checks. Live browser join/injection is a handoff edge until provider automation lands.",
+        "Meeting links use URL intake plus BlackHole/Multi-Output readiness checks. Phone testing uses Twilio Record -> Whisper.cpp -> voice session -> ElevenLabs -> Twilio Play.",
     ].join("\n");
     deps.writeStdout(message);
     return message;

package/dist/heart/daemon/sense-manager.js

@@ -197,6 +197,9 @@ function senseFactsFromRuntimeConfig(agent, senses, runtimeConfig, machineRuntim
         const missing = [];
         if (!textField(integrations, "elevenLabsApiKey"))
             missing.push("integrations.elevenLabsApiKey");
+        if (!textField(integrations, "elevenLabsVoiceId") && !textField(payload.voice, "elevenLabsVoiceId")) {
+            missing.push("integrations.elevenLabsVoiceId");
+        }
         if (!textField(voice, "whisperCliPath"))
             missing.push("voice.whisperCliPath");
         if (!textField(voice, "whisperModelPath"))

package/dist/heart/identity.js

@@ -79,9 +79,9 @@ exports.DEFAULT_AGENT_PHRASES = {
     tool: ["running tool"],
     followup: ["processing"],
 };
-exports.DEFAULT_VAULT_SERVER_URL = "https://vault.ouroboros.bot";
+exports.DEFAULT_VAULT_SERVER_URL = "https://vault.ouro.bot";
 exports.LEGACY_VAULT_SERVER_URL_ALIASES = [
-    "https://vault.ouro.bot",
+    "https://vault.ouroboros.bot",
     "https://ouro-vault.gentleflower-74452a1e.eastus2.azurecontainerapps.io",
 ];
 function normalizeVaultServerUrl(serverUrl) {

package/dist/heart/turn-context.js

@@ -165,6 +165,7 @@ function readSenseStatusLines() {
     const bluebubbles = recordOrUndefined(machinePayload.bluebubbles) ?? recordOrUndefined(payload.bluebubbles);
     const mailroom = recordOrUndefined(runtimePayload.mailroom) ?? recordOrUndefined(payload.mailroom);
     const voice = recordOrUndefined(machinePayload.voice) ?? recordOrUndefined(payload.voice);
+    const portableVoice = recordOrUndefined(runtimePayload.voice) ?? recordOrUndefined(payload.voice);
     const integrations = recordOrUndefined(runtimePayload.integrations) ?? recordOrUndefined(payload.integrations);
     const privateKeys = mailroom?.privateKeys;
     const configured = {
@@ -172,7 +173,10 @@ function readSenseStatusLines() {
         teams: hasTextField(teams, "clientId") && hasTextField(teams, "clientSecret") && hasTextField(teams, "tenantId"),
         bluebubbles: hasTextField(bluebubbles, "serverUrl") && hasTextField(bluebubbles, "password"),
         mail: hasTextField(mailroom, "mailboxAddress") && !!privateKeys && typeof privateKeys === "object" && !Array.isArray(privateKeys),
-        voice: hasTextField(integrations, "elevenLabsApiKey") && hasTextField(voice, "whisperCliPath") && hasTextField(voice, "whisperModelPath"),
+        voice: hasTextField(integrations, "elevenLabsApiKey")
+            && (hasTextField(integrations, "elevenLabsVoiceId") || hasTextField(portableVoice, "elevenLabsVoiceId"))
+            && hasTextField(voice, "whisperCliPath")
+            && hasTextField(voice, "whisperModelPath"),
     };
     const rows = [
         { label: "CLI", status: "interactive" },

package/dist/mind/prompt.js

@@ -441,6 +441,7 @@ function localSenseStatusLines() {
     const bluebubbles = recordOrUndefined(machinePayload.bluebubbles) ?? recordOrUndefined(payload.bluebubbles);
     const mailroom = recordOrUndefined(runtimePayload.mailroom) ?? recordOrUndefined(payload.mailroom);
     const voice = recordOrUndefined(machinePayload.voice) ?? recordOrUndefined(payload.voice);
+    const portableVoice = recordOrUndefined(runtimePayload.voice) ?? recordOrUndefined(payload.voice);
     const integrations = recordOrUndefined(runtimePayload.integrations) ?? recordOrUndefined(payload.integrations);
     const privateKeys = mailroom?.privateKeys;
     const configured = {
@@ -448,7 +449,10 @@ function localSenseStatusLines() {
         teams: hasTextField(teams, "clientId") && hasTextField(teams, "clientSecret") && hasTextField(teams, "tenantId"),
         bluebubbles: hasTextField(bluebubbles, "serverUrl") && hasTextField(bluebubbles, "password"),
         mail: hasTextField(mailroom, "mailboxAddress") && !!privateKeys && typeof privateKeys === "object" && !Array.isArray(privateKeys),
-        voice: hasTextField(integrations, "elevenLabsApiKey") && hasTextField(voice, "whisperCliPath") && hasTextField(voice, "whisperModelPath"),
+        voice: hasTextField(integrations, "elevenLabsApiKey")
+            && (hasTextField(integrations, "elevenLabsVoiceId") || hasTextField(portableVoice, "elevenLabsVoiceId"))
+            && hasTextField(voice, "whisperCliPath")
+            && hasTextField(voice, "whisperModelPath"),
     };
     const rows = [
         { label: "CLI", status: "interactive" },
@@ -502,7 +506,7 @@ function senseRuntimeGuidance(channel, preReadStatusLines) {
     lines.push("mail validation diagnostics: health checks, bounded mail tools, access logs, and UI inspection can support validation, but they are evidence inside those paths, not additional paths. If asked to name golden paths, do not include diagnostic commands, tool names, or status checks in the answer.");
     lines.push("mail diagnostic naming: `ouro doctor` is installation-wide; do not invent `ouro doctor --agent <agent>`.");
     lines.push("mail setup boundaries: do not invent `ouro auth verify --provider mail`, HEY OAuth, HEY IMAP, `ouro mcp call mail ...`, policy flags, autonomous sending, destructive mail actions, or production MX/DNS/forwarding changes. HEY export, HEY forwarding, DNS, MX cutover, sending, and destructive actions require explicit human confirmation.");
-    lines.push("voice setup truth: voice sessions are transcript-first local sessions. ElevenLabs credentials belong in portable runtime/config at `integrations.elevenLabsApiKey`; Whisper.cpp CLI/model paths belong in the machine runtime item under `voice.whisperCliPath` and `voice.whisperModelPath`. Meeting links now have URL intake and local BlackHole/Multi-Output readiness checks; live browser join/injection remains an explicit handoff edge until provider automation lands.");
+    lines.push("voice setup truth: voice sessions are transcript-first local sessions. ElevenLabs credentials belong in portable runtime/config at `integrations.elevenLabsApiKey` and `integrations.elevenLabsVoiceId`; Whisper.cpp CLI/model paths belong in the machine runtime item under `voice.whisperCliPath` and `voice.whisperModelPath`. Meeting links have URL intake and local BlackHole/Multi-Output readiness checks; phone testing uses Twilio Record -> Whisper.cpp -> voice session -> ElevenLabs -> Twilio Play. Live browser join/injection remains an explicit handoff edge until provider automation lands.");
     if (channel === "cli") {
         lines.push("cli is interactive: it is available when the user opens it, not something `ouro up` daemonizes.");
     }

package/dist/repertoire/tools-session.js

@@ -656,6 +656,12 @@ exports.sessionToolDefinitions = [
                                 detail: "bluebubbles could not resolve a routable target for that session",
                             };
                         }
+                        if (result.reason === "blocked_meta_content") {
+                            return {
+                                status: "blocked",
+                                detail: "blocked: contains internal meta markers",
+                            };
+                        }
                         if (result.reason === "send_error") {
                             return {
                                 status: "failed",

package/dist/repertoire/tools-surface.js

@@ -39,6 +39,8 @@ const identity_1 = require("../heart/identity");
 const surface_tool_1 = require("../senses/surface-tool");
 const obligations_1 = require("../arc/obligations");
 const session_activity_1 = require("../heart/session-activity");
+const bluebubbles_meta_guard_1 = require("../senses/bluebubbles-meta-guard");
+const runtime_1 = require("../nerves/runtime");
 const path = __importStar(require("path"));
 // Surface tool schema — canonical home. Handler lives in senses/surface-tool.ts.
 exports.surfaceToolDef = {
@@ -71,6 +73,21 @@ exports.surfaceToolDef = {
 exports.surfaceToolDefinition = {
     tool: exports.surfaceToolDef,
     handler: async (args, ctx) => {
+        const rawContent = args.content ?? "";
+        if ((0, bluebubbles_meta_guard_1.containsInternalMetaMarkers)(rawContent)) {
+            (0, runtime_1.emitNervesEvent)({
+                level: "warn",
+                component: "repertoire",
+                event: "tools.surface_meta_blocked",
+                message: "surface tool blocked: internal meta markers in content",
+                meta: {
+                    hasDelegationId: Boolean(args.delegationId),
+                    hasFriendId: Boolean(args.friendId),
+                    contentLength: rawContent.length,
+                },
+            });
+            return "failed — blocked: contains internal meta markers";
+        }
         const queue = ctx?.delegatedOrigins ?? [];
         const agentName = (() => { try {
             return (0, identity_1.getAgentName)();

package/dist/senses/bluebubbles/index.js

@@ -69,6 +69,7 @@ const prompt_1 = require("../../mind/prompt");
 const mcp_manager_1 = require("../../repertoire/mcp-manager");
 const runtime_1 = require("../../nerves/runtime");
 const proactive_content_guard_1 = require("../proactive-content-guard");
+const bluebubbles_meta_guard_1 = require("../bluebubbles-meta-guard");
 const model_1 = require("./model");
 const client_1 = require("./client");
 const inbound_log_1 = require("./inbound-log");
@@ -616,6 +617,17 @@ function createBlueBubblesCallbacks(client, chat, replyTarget, isGroupChat, onVi
             if (!trimmed)
                 return;
             textBuffer = "";
+            if ((0, bluebubbles_meta_guard_1.containsInternalMetaMarkers)(trimmed)) {
+                (0, bluebubbles_meta_guard_1.emitBluebubblesMetaBlocked)({
+                    site: "flushNow",
+                    message: "bluebubbles speak text blocked: internal meta markers",
+                    meta: {
+                        chatGuid: chat.chatGuid ?? null,
+                        messageLength: trimmed.length,
+                    },
+                });
+                return;
+            }
             await client.sendText({
                 chat,
                 text: trimmed,
@@ -650,6 +662,17 @@ function createBlueBubblesCallbacks(client, chat, replyTarget, isGroupChat, onVi
                 enqueue("typing_stop", async () => { await client.setTyping(chat, false); });
                 await queue;
             }
+            if ((0, bluebubbles_meta_guard_1.containsInternalMetaMarkers)(trimmed)) {
+                (0, bluebubbles_meta_guard_1.emitBluebubblesMetaBlocked)({
+                    site: "flush",
+                    message: "bluebubbles outbound text blocked: internal meta markers",
+                    meta: {
+                        chatGuid: chat.chatGuid ?? null,
+                        messageLength: trimmed.length,
+                    },
+                });
+                return;
+            }
             await client.sendText({
                 chat,
                 text: trimmed,
@@ -1925,6 +1948,17 @@ function buildChatRefForSessionKey(friend, sessionKey) {
     };
 }
 async function sendProactiveBlueBubblesMessageToSession(params, deps = {}) {
+    if ((0, bluebubbles_meta_guard_1.containsInternalMetaMarkers)(params.text)) {
+        (0, bluebubbles_meta_guard_1.emitBluebubblesMetaBlocked)({
+            site: "proactive",
+            message: "bluebubbles proactive send blocked: internal meta markers",
+            meta: {
+                friendId: params.friendId,
+                sessionKey: params.sessionKey,
+            },
+        });
+        return { delivered: false, reason: "blocked_meta_content" };
+    }
     const resolvedDeps = { ...defaultDeps, ...deps };
     const client = resolvedDeps.createClient();
     const store = resolvedDeps.createFriendStore();
@@ -2131,6 +2165,22 @@ async function drainAndSendPendingBlueBubbles(deps = {}, pendingRoot) {
             catch { /* ignore */ }
             continue;
         }
+        if ((0, bluebubbles_meta_guard_1.containsInternalMetaMarkers)(messageText)) {
+            result.skipped++;
+            try {
+                fs.unlinkSync(filePath);
+            }
+            catch { /* ignore */ }
+            (0, bluebubbles_meta_guard_1.emitBluebubblesMetaBlocked)({
+                site: "drain",
+                message: "bluebubbles drain blocked: internal meta markers",
+                meta: {
+                    friendId,
+                    filePath,
+                },
+            });
+            continue;
+        }
         const internalBlockReason = (0, proactive_content_guard_1.getProactiveInternalContentBlockReason)(messageText);
         if (internalBlockReason) {
             result.skipped++;

package/dist/senses/bluebubbles-meta-guard.js

@@ -0,0 +1,40 @@
+"use strict";
+// Outbound BlueBubbles meta-content guard.
+//
+// Blocks accidental delivery of internal/meta text — pipeline section markers,
+// surfacing-mechanics prefixes, reasoning tags — to the live iMessage channel.
+// Failure mode is "drop and log", never queue for later delivery.
+//
+// Patterns are deliberately narrow: bracketed system markers and angle-bracket
+// reasoning tags. Plain prose mentioning "inner dialog" or "attention queue"
+// is NOT blocked, so user-facing replies that legitimately discuss those
+// concepts still pass.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.containsInternalMetaMarkers = containsInternalMetaMarkers;
+exports.emitBluebubblesMetaBlocked = emitBluebubblesMetaBlocked;
+const runtime_1 = require("../nerves/runtime");
+const META_CONTENT_PATTERNS = [
+    /\[surfaced from inner dialog\]/i,
+    /\[pending from [^\]]+\]:/i,
+    /\[conversation scope:/i,
+    /\[recent active lanes\]/i,
+    /\[routing control:/i,
+    /<\/?think>/i,
+];
+function containsInternalMetaMarkers(text) {
+    if (!text)
+        return false;
+    return META_CONTENT_PATTERNS.some((pattern) => pattern.test(text));
+}
+function emitBluebubblesMetaBlocked(options) {
+    (0, runtime_1.emitNervesEvent)({
+        level: "warn",
+        component: "senses",
+        event: "senses.bluebubbles_meta_blocked",
+        message: options.message,
+        meta: {
+            site: options.site,
+            ...options.meta,
+        },
+    });
+}

package/dist/senses/voice/index.js

@@ -24,3 +24,4 @@ __exportStar(require("./meeting"), exports);
 __exportStar(require("./audio-routing"), exports);
 __exportStar(require("./playback"), exports);
 __exportStar(require("./golden-path"), exports);
+__exportStar(require("./twilio-phone"), exports);

package/dist/senses/voice/twilio-phone.js

@@ -0,0 +1,462 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TWILIO_PHONE_WEBHOOK_BASE_PATH = exports.DEFAULT_TWILIO_RECORD_MAX_LENGTH_SECONDS = exports.DEFAULT_TWILIO_RECORD_TIMEOUT_SECONDS = exports.DEFAULT_TWILIO_PHONE_PORT = void 0;
+exports.computeTwilioSignature = computeTwilioSignature;
+exports.validateTwilioSignature = validateTwilioSignature;
+exports.twilioRecordingMediaUrl = twilioRecordingMediaUrl;
+exports.defaultTwilioRecordingDownloader = defaultTwilioRecordingDownloader;
+exports.createTwilioPhoneBridge = createTwilioPhoneBridge;
+exports.startTwilioPhoneBridgeServer = startTwilioPhoneBridgeServer;
+const crypto = __importStar(require("node:crypto"));
+const fs = __importStar(require("fs/promises"));
+const http = __importStar(require("http"));
+const path = __importStar(require("path"));
+const runtime_1 = require("../../nerves/runtime");
+const playback_1 = require("./playback");
+const turn_1 = require("./turn");
+exports.DEFAULT_TWILIO_PHONE_PORT = 18910;
+exports.DEFAULT_TWILIO_RECORD_TIMEOUT_SECONDS = 2;
+exports.DEFAULT_TWILIO_RECORD_MAX_LENGTH_SECONDS = 30;
+exports.TWILIO_PHONE_WEBHOOK_BASE_PATH = "/voice/twilio";
+function bodyText(body) {
+    if (body === undefined)
+        return "";
+    if (typeof body === "string")
+        return body;
+    return Buffer.from(body).toString("utf8");
+}
+function formParams(rawBody) {
+    const parsed = new URLSearchParams(rawBody);
+    const params = {};
+    for (const [key, value] of parsed) {
+        params[key] = value;
+    }
+    return params;
+}
+function headerValue(headers, name) {
+    const wanted = name.toLowerCase();
+    for (const [key, value] of Object.entries(headers)) {
+        if (key.toLowerCase() !== wanted)
+            continue;
+        if (Array.isArray(value))
+            return value[0] ?? "";
+        return value ?? "";
+    }
+    return "";
+}
+function xmlResponse(body) {
+    return {
+        statusCode: 200,
+        headers: { "content-type": "text/xml; charset=utf-8" },
+        body: `<?xml version="1.0" encoding="UTF-8"?><Response>${body}</Response>`,
+    };
+}
+function textResponse(statusCode, body) {
+    return {
+        statusCode,
+        headers: { "content-type": "text/plain; charset=utf-8" },
+        body,
+    };
+}
+function binaryResponse(body, contentType) {
+    return {
+        statusCode: 200,
+        headers: {
+            "content-type": contentType,
+            "cache-control": "private, max-age=300",
+        },
+        body,
+    };
+}
+function escapeXml(input) {
+    return input
+        .replace(/&/g, "&amp;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;")
+        .replace(/'/g, "&apos;");
+}
+function routeUrl(publicBaseUrl, route) {
+    return new URL(route, publicBaseUrl).toString();
+}
+function requestPublicUrl(publicBaseUrl, requestPath) {
+    return routeUrl(publicBaseUrl, requestPath);
+}
+function recordTwiml(options) {
+    return `<Record action="${escapeXml(routeUrl(options.publicBaseUrl, `${exports.TWILIO_PHONE_WEBHOOK_BASE_PATH}/recording`))}" method="POST" playBeep="false" timeout="${options.timeoutSeconds}" maxLength="${options.maxLengthSeconds}" trim="trim-silence" />`;
+}
+function redirectTwiml(publicBaseUrl) {
+    return `<Redirect method="POST">${escapeXml(routeUrl(publicBaseUrl, `${exports.TWILIO_PHONE_WEBHOOK_BASE_PATH}/listen`))}</Redirect>`;
+}
+function sayTwiml(message) {
+    return `<Say>${escapeXml(message)}</Say>`;
+}
+function playTwiml(url) {
+    return `<Play>${escapeXml(url)}</Play>`;
+}
+function safeSegment(input) {
+    const cleaned = input.trim().replace(/[^A-Za-z0-9._-]+/g, "-").replace(/^-+|-+$/g, "");
+    return cleaned || "unknown";
+}
+function decodeSafeSegment(input) {
+    try {
+        const decoded = decodeURIComponent(input);
+        if (!/^[A-Za-z0-9._-]+$/.test(decoded))
+            return null;
+        if (decoded === "." || decoded === "..")
+            return null;
+        return decoded;
+    }
+    catch {
+        return null;
+    }
+}
+function contentTypeForAudio(fileName) {
+    const ext = path.extname(fileName).toLowerCase();
+    if (ext === ".mp3")
+        return "audio/mpeg";
+    if (ext === ".wav")
+        return "audio/wav";
+    if (ext === ".pcm")
+        return "audio/pcm";
+    return "application/octet-stream";
+}
+function friendIdFromCaller(from, callSid) {
+    const phoneish = from.replace(/[^0-9A-Za-z]+/g, "");
+    return phoneish ? `twilio-${phoneish}` : `twilio-${safeSegment(callSid)}`;
+}
+function parseRecordingParams(params) {
+    const callSid = params.CallSid?.trim();
+    const recordingSid = params.RecordingSid?.trim();
+    const recordingUrl = params.RecordingUrl?.trim();
+    if (!callSid || !recordingSid || !recordingUrl)
+        return null;
+    return {
+        callSid,
+        recordingSid,
+        recordingUrl,
+        from: params.From?.trim() ?? "",
+    };
+}
+function recordAgainResponse(publicBaseUrl, message) {
+    return xmlResponse(`${sayTwiml(message)}${recordTwiml({
+        publicBaseUrl,
+        timeoutSeconds: exports.DEFAULT_TWILIO_RECORD_TIMEOUT_SECONDS,
+        maxLengthSeconds: exports.DEFAULT_TWILIO_RECORD_MAX_LENGTH_SECONDS,
+    })}`);
+}
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+function computeTwilioSignature(input) {
+    const payload = input.url + Object.keys(input.params)
+        .sort()
+        .map((key) => `${key}${input.params[key]}`)
+        .join("");
+    return crypto.createHmac("sha1", input.authToken).update(payload).digest("base64");
+}
+function validateTwilioSignature(input) {
+    if (!input.authToken.trim())
+        return true;
+    if (!input.signature.trim())
+        return false;
+    const expected = Buffer.from(computeTwilioSignature(input));
+    const actual = Buffer.from(input.signature);
+    return actual.length === expected.length && crypto.timingSafeEqual(actual, expected);
+}
+function twilioRecordingMediaUrl(recordingUrl) {
+    const url = new URL(recordingUrl);
+    if (!/\.[A-Za-z0-9]+$/.test(url.pathname)) {
+        url.pathname = `${url.pathname}.wav`;
+    }
+    return url.toString();
+}
+async function defaultTwilioRecordingDownloader(request) {
+    const headers = {};
+    if (request.accountSid && request.authToken) {
+        headers.Authorization = `Basic ${Buffer.from(`${request.accountSid}:${request.authToken}`).toString("base64")}`;
+    }
+    const response = await fetch(request.recordingUrl, { headers });
+    if (!response.ok) {
+        throw new Error(`Twilio recording download failed: ${response.status} ${response.statusText}`.trim());
+    }
+    return Buffer.from(await response.arrayBuffer());
+}
+function verifyRequest(options, request, params) {
+    const authToken = options.twilioAuthToken?.trim();
+    if (!authToken)
+        return true;
+    return validateTwilioSignature({
+        authToken,
+        url: requestPublicUrl(options.publicBaseUrl, request.path),
+        params,
+        signature: headerValue(request.headers, "x-twilio-signature"),
+    });
+}
+async function handleIncoming(options) {
+    const greeting = options.greetingText ?? "Connected to Ouro voice. Speak after the prompt.";
+    (0, runtime_1.emitNervesEvent)({
+        component: "senses",
+        event: "senses.voice_twilio_incoming",
+        message: "Twilio voice call connected",
+        meta: { agentName: options.agentName },
+    });
+    return xmlResponse(`${sayTwiml(greeting)}${recordTwiml({
+        publicBaseUrl: options.publicBaseUrl,
+        timeoutSeconds: options.recordTimeoutSeconds ?? exports.DEFAULT_TWILIO_RECORD_TIMEOUT_SECONDS,
+        maxLengthSeconds: options.recordMaxLengthSeconds ?? exports.DEFAULT_TWILIO_RECORD_MAX_LENGTH_SECONDS,
+    })}`);
+}
+async function handleListen(options) {
+    return xmlResponse(recordTwiml({
+        publicBaseUrl: options.publicBaseUrl,
+        timeoutSeconds: options.recordTimeoutSeconds ?? exports.DEFAULT_TWILIO_RECORD_TIMEOUT_SECONDS,
+        maxLengthSeconds: options.recordMaxLengthSeconds ?? exports.DEFAULT_TWILIO_RECORD_MAX_LENGTH_SECONDS,
+    }));
+}
+async function handleRecording(options, params) {
+    const recording = parseRecordingParams(params);
+    if (!recording) {
+        (0, runtime_1.emitNervesEvent)({
+            level: "warn",
+            component: "senses",
+            event: "senses.voice_twilio_recording_rejected",
+            message: "Twilio recording callback was missing required fields",
+            meta: { agentName: options.agentName },
+        });
+        return recordAgainResponse(options.publicBaseUrl, "I did not receive audio. Please try again.");
+    }
+    const safeCallSid = safeSegment(recording.callSid);
+    const safeRecordingSid = safeSegment(recording.recordingSid);
+    const callDir = path.join(options.outputDir, safeCallSid);
+    const inputPath = path.join(callDir, `${safeRecordingSid}.wav`);
+    const utteranceId = `twilio-${safeCallSid}-${safeRecordingSid}`;
+    const downloadRecording = options.downloadRecording ?? defaultTwilioRecordingDownloader;
+    (0, runtime_1.emitNervesEvent)({
+        component: "senses",
+        event: "senses.voice_twilio_turn_start",
+        message: "starting Twilio voice turn",
+        meta: { agentName: options.agentName, callSid: safeCallSid, recordingSid: safeRecordingSid },
+    });
+    try {
+        await fs.mkdir(callDir, { recursive: true });
+        const mediaUrl = twilioRecordingMediaUrl(recording.recordingUrl);
+        const audio = await downloadRecording({
+            recordingUrl: mediaUrl,
+            accountSid: options.twilioAccountSid?.trim() || undefined,
+            authToken: options.twilioAuthToken?.trim() || undefined,
+        });
+        await fs.writeFile(inputPath, audio);
+        const transcript = await options.transcriber.transcribe({
+            utteranceId,
+            audioPath: inputPath,
+        });
+        const turn = await (0, turn_1.runVoiceLoopbackTurn)({
+            agentName: options.agentName,
+            friendId: options.defaultFriendId?.trim() || friendIdFromCaller(recording.from, recording.callSid),
+            sessionKey: `twilio-${safeCallSid}`,
+            transcript,
+            tts: options.tts,
+            runSenseTurn: options.runSenseTurn,
+        });
+        if (turn.tts.status !== "delivered") {
+            return xmlResponse(`${sayTwiml("voice output failed after the text response was captured.")}${redirectTwiml(options.publicBaseUrl)}`);
+        }
+        const playback = await (0, playback_1.writeVoicePlaybackArtifact)({
+            utteranceId,
+            delivery: turn.tts,
+            outputDir: callDir,
+        });
+        const audioUrl = routeUrl(options.publicBaseUrl, `${exports.TWILIO_PHONE_WEBHOOK_BASE_PATH}/audio/${encodeURIComponent(safeCallSid)}/${encodeURIComponent(path.basename(playback.audioPath))}`);
+        (0, runtime_1.emitNervesEvent)({
+            component: "senses",
+            event: "senses.voice_twilio_turn_end",
+            message: "finished Twilio voice turn",
+            meta: { agentName: options.agentName, callSid: safeCallSid, recordingSid: safeRecordingSid, audioPath: playback.audioPath },
+        });
+        return xmlResponse(`${playTwiml(audioUrl)}${redirectTwiml(options.publicBaseUrl)}`);
+    }
+    catch (error) {
+        (0, runtime_1.emitNervesEvent)({
+            level: "error",
+            component: "senses",
+            event: "senses.voice_twilio_turn_error",
+            message: "Twilio voice turn failed",
+            meta: {
+                agentName: options.agentName,
+                callSid: safeCallSid,
+                recordingSid: safeRecordingSid,
+                error: errorMessage(error),
+            },
+        });
+        return xmlResponse(`${sayTwiml("I could not process that audio. Please try again.")}${redirectTwiml(options.publicBaseUrl)}`);
+    }
+}
+async function handleAudio(options, requestPath) {
+    const prefix = `${exports.TWILIO_PHONE_WEBHOOK_BASE_PATH}/audio/`;
+    const pathOnly = requestPath.split("?")[0];
+    const rest = pathOnly.slice(prefix.length);
+    const parts = rest.split("/");
+    if (parts.length !== 2)
+        return textResponse(404, "not found");
+    const [callSidPart, fileNamePart] = parts;
+    const callSid = decodeSafeSegment(callSidPart);
+    const fileName = decodeSafeSegment(fileNamePart);
+    if (!callSid || !fileName)
+        return textResponse(404, "not found");
+    const baseDir = path.resolve(options.outputDir, callSid);
+    const audioPath = path.resolve(baseDir, fileName);
+    try {
+        const audio = await fs.readFile(audioPath);
+        (0, runtime_1.emitNervesEvent)({
+            component: "senses",
+            event: "senses.voice_twilio_audio_served",
+            message: "served Twilio voice audio artifact",
+            meta: { agentName: options.agentName, callSid, fileName },
+        });
+        return binaryResponse(audio, contentTypeForAudio(fileName));
+    }
+    catch {
+        return textResponse(404, "not found");
+    }
+}
+function createTwilioPhoneBridge(options) {
+    new URL(options.publicBaseUrl);
+    return {
+        async handle(request) {
+            const method = request.method.toUpperCase();
+            const requestPath = request.path.startsWith("/") ? request.path : `/${request.path}`;
+            const routePath = requestPath.split("?")[0];
+            if (method === "GET" && requestPath.startsWith(`${exports.TWILIO_PHONE_WEBHOOK_BASE_PATH}/audio/`)) {
+                return handleAudio(options, requestPath);
+            }
+            if (method === "GET" && routePath === `${exports.TWILIO_PHONE_WEBHOOK_BASE_PATH}/health`) {
+                return textResponse(200, "ok");
+            }
+            if (method !== "POST")
+                return textResponse(405, "method not allowed");
+            const params = formParams(bodyText(request.body));
+            if (!verifyRequest(options, { ...request, path: requestPath }, params)) {
+                (0, runtime_1.emitNervesEvent)({
+                    level: "warn",
+                    component: "senses",
+                    event: "senses.voice_twilio_signature_rejected",
+                    message: "rejected Twilio webhook with invalid signature",
+                    meta: { agentName: options.agentName, path: requestPath },
+                });
+                return textResponse(403, "invalid Twilio signature");
+            }
+            if (routePath === `${exports.TWILIO_PHONE_WEBHOOK_BASE_PATH}/incoming`)
+                return handleIncoming(options);
+            if (routePath === `${exports.TWILIO_PHONE_WEBHOOK_BASE_PATH}/listen`)
+                return handleListen(options);
+            if (routePath === `${exports.TWILIO_PHONE_WEBHOOK_BASE_PATH}/recording`)
+                return handleRecording(options, params);
+            return textResponse(404, "not found");
+        },
+    };
+}
+function readRequestBody(req, limitBytes = 1_000_000) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        let byteLength = 0;
+        req.on("data", (chunk) => {
+            byteLength += chunk.byteLength;
+            if (byteLength > limitBytes) {
+                reject(new Error("request body too large"));
+                req.destroy();
+                return;
+            }
+            chunks.push(chunk);
+        });
+        req.on("end", () => resolve(Buffer.concat(chunks)));
+        req.on("error", reject);
+    });
+}
+async function startTwilioPhoneBridgeServer(options) {
+    const port = options.port ?? exports.DEFAULT_TWILIO_PHONE_PORT;
+    const host = options.host ?? "127.0.0.1";
+    const bridge = createTwilioPhoneBridge(options);
+    const server = http.createServer(async (req, res) => {
+        try {
+            const body = await readRequestBody(req);
+            const response = await bridge.handle({
+                method: req.method,
+                path: req.url,
+                headers: req.headers,
+                body,
+            });
+            res.writeHead(response.statusCode, response.headers);
+            res.end(response.body);
+        }
+        catch (error) {
+            (0, runtime_1.emitNervesEvent)({
+                level: "error",
+                component: "senses",
+                event: "senses.voice_twilio_server_error",
+                message: "Twilio voice bridge server failed a request",
+                meta: { agentName: options.agentName, error: errorMessage(error) },
+            });
+            res.writeHead(500, { "content-type": "text/plain; charset=utf-8" });
+            res.end("internal server error");
+        }
+    });
+    await new Promise((resolve, reject) => {
+        const onError = (error) => {
+            server.off("listening", onListening);
+            reject(error);
+        };
+        const onListening = () => {
+            server.off("error", onError);
+            resolve();
+        };
+        server.once("error", onError);
+        server.once("listening", onListening);
+        server.listen(port, host);
+    });
+    (0, runtime_1.emitNervesEvent)({
+        component: "senses",
+        event: "senses.voice_twilio_server_start",
+        message: "Twilio voice bridge server started",
+        meta: { agentName: options.agentName, host, port, publicBaseUrl: options.publicBaseUrl },
+    });
+    const actualPort = server.address().port;
+    return {
+        bridge,
+        server,
+        localUrl: `http://${host}:${actualPort}`,
+    };
+}

package/dist/senses/voice-twilio-entry.js

@@ -0,0 +1,216 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+function readRequiredAgentName() {
+    const agentArgIndex = process.argv.indexOf("--agent");
+    const value = agentArgIndex >= 0 ? process.argv[agentArgIndex + 1] : undefined;
+    if (value)
+        return value;
+    process.stderr.write("Missing required --agent <name> argument.\nUsage: node dist/senses/voice-twilio-entry.js --agent ouroboros --public-url https://<tunnel>\n");
+    process.exit(1);
+}
+const agentName = readRequiredAgentName();
+const path = __importStar(require("path"));
+const identity_1 = require("../heart/identity");
+const machine_identity_1 = require("../heart/machine-identity");
+const runtime_logging_1 = require("../heart/daemon/runtime-logging");
+const provider_credentials_1 = require("../heart/provider-credentials");
+const runtime_credentials_1 = require("../heart/runtime-credentials");
+const runtime_1 = require("../nerves/runtime");
+const elevenlabs_1 = require("./voice/elevenlabs");
+const whisper_1 = require("./voice/whisper");
+const twilio_phone_1 = require("./voice/twilio-phone");
+function argValue(name) {
+    const index = process.argv.indexOf(name);
+    if (index < 0)
+        return undefined;
+    const value = process.argv[index + 1];
+    return value && !value.startsWith("--") ? value : undefined;
+}
+function asRecord(value) {
+    return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function configString(config, dottedPath) {
+    let cursor = config;
+    for (const segment of dottedPath.split(".")) {
+        const record = asRecord(cursor);
+        if (!record)
+            return undefined;
+        cursor = record[segment];
+    }
+    return typeof cursor === "string" && cursor.trim() ? cursor.trim() : undefined;
+}
+function configNumber(config, dottedPath) {
+    let cursor = config;
+    for (const segment of dottedPath.split(".")) {
+        const record = asRecord(cursor);
+        if (!record)
+            return undefined;
+        cursor = record[segment];
+    }
+    if (typeof cursor === "number" && Number.isFinite(cursor))
+        return cursor;
+    if (typeof cursor === "string" && cursor.trim()) {
+        const parsed = Number(cursor);
+        return Number.isFinite(parsed) ? parsed : undefined;
+    }
+    return undefined;
+}
+function requireConfig(result, label) {
+    if (result.ok)
+        return result.config;
+    throw new Error(`${label} unavailable: ${result.error}`);
+}
+function required(value, guidance) {
+    if (value)
+        return value;
+    throw new Error(guidance);
+}
+function numberArg(name) {
+    const raw = argValue(name);
+    if (!raw)
+        return undefined;
+    const parsed = Number(raw);
+    if (!Number.isFinite(parsed))
+        throw new Error(`${name} must be a number`);
+    return parsed;
+}
+function selectedAgentProviders(config) {
+    const providers = new Set();
+    providers.add(config.humanFacing.provider);
+    providers.add(config.agentFacing.provider);
+    if (config.provider)
+        providers.add(config.provider);
+    return [...providers];
+}
+async function cacheSelectedProviderCredentials(agentName) {
+    const providers = selectedAgentProviders((0, identity_1.loadAgentConfig)());
+    const pool = await (0, provider_credentials_1.refreshProviderCredentialPool)(agentName, { providers });
+    if (!pool.ok) {
+        throw new Error(`provider credentials unavailable for phone voice: ${pool.error}`);
+    }
+    const missing = providers.filter((provider) => !pool.pool.providers[provider]);
+    if (missing.length > 0) {
+        throw new Error(`missing provider credentials for phone voice: ${missing.join(", ")}`);
+    }
+}
+function writeReadyInstructions(localUrl, publicBaseUrl) {
+    process.stdout.write([
+        "Twilio phone voice bridge ready.",
+        `local: ${localUrl}`,
+        `public: ${publicBaseUrl}`,
+        `Twilio Voice webhook: POST ${new URL(`${twilio_phone_1.TWILIO_PHONE_WEBHOOK_BASE_PATH}/incoming`, publicBaseUrl).toString()}`,
+        "",
+    ].join("\n"));
+}
+(0, runtime_logging_1.configureDaemonRuntimeLogger)("voice");
+(0, runtime_1.emitNervesEvent)({
+    component: "senses",
+    event: "senses.entry_boot",
+    message: "booting Twilio Voice entrypoint",
+    meta: { entry: "voice-twilio", agentName },
+});
+async function main() {
+    await (0, runtime_credentials_1.waitForRuntimeCredentialBootstrap)(agentName);
+    const machine = (0, machine_identity_1.loadOrCreateMachineIdentity)();
+    await Promise.all([
+        (0, runtime_credentials_1.refreshRuntimeCredentialConfig)(agentName, { preserveCachedOnFailure: true }).catch(() => undefined),
+        (0, runtime_credentials_1.refreshMachineRuntimeCredentialConfig)(agentName, machine.machineId, { preserveCachedOnFailure: true }).catch(() => undefined),
+    ]);
+    await cacheSelectedProviderCredentials(agentName);
+    const runtimeConfig = requireConfig((0, runtime_credentials_1.readRuntimeCredentialConfig)(agentName), "portable runtime/config");
+    const machineConfig = requireConfig((0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(agentName), "machine runtime config");
+    const port = numberArg("--port")
+        ?? configNumber(machineConfig, "voice.twilioPort")
+        ?? twilio_phone_1.DEFAULT_TWILIO_PHONE_PORT;
+    const host = argValue("--host")
+        ?? configString(machineConfig, "voice.twilioHost")
+        ?? "127.0.0.1";
+    const publicBaseUrl = required(argValue("--public-url") ?? configString(machineConfig, "voice.twilioPublicUrl"), `missing public URL; run 'cloudflared tunnel --url http://127.0.0.1:${port}' and restart with --public-url https://<tunnel>`);
+    const elevenLabsApiKey = required(configString(runtimeConfig, "integrations.elevenLabsApiKey"), "missing integrations.elevenLabsApiKey; run 'ouro connect voice --agent <agent>' for setup guidance");
+    const elevenLabsVoiceId = required(argValue("--elevenlabs-voice-id")
+        ?? configString(runtimeConfig, "integrations.elevenLabsVoiceId")
+        ?? configString(runtimeConfig, "voice.elevenLabsVoiceId"), "missing integrations.elevenLabsVoiceId; save the ElevenLabs voice ID before starting phone voice");
+    const whisperCliPath = required(configString(machineConfig, "voice.whisperCliPath"), "missing voice.whisperCliPath in this machine's runtime config");
+    const whisperModelPath = required(configString(machineConfig, "voice.whisperModelPath"), "missing voice.whisperModelPath in this machine's runtime config");
+    const outputDir = argValue("--output-dir")
+        ?? configString(machineConfig, "voice.twilioOutputDir")
+        ?? path.join((0, identity_1.getAgentRoot)(agentName), "state", "voice", "twilio-phone");
+    const defaultFriendId = argValue("--friend")
+        ?? configString(machineConfig, "voice.twilioDefaultFriendId");
+    const twilioAccountSid = configString(runtimeConfig, "voice.twilioAccountSid");
+    const twilioAuthToken = configString(runtimeConfig, "voice.twilioAuthToken");
+    const recordTimeoutSeconds = numberArg("--record-timeout")
+        ?? configNumber(machineConfig, "voice.twilioRecordTimeoutSeconds")
+        ?? twilio_phone_1.DEFAULT_TWILIO_RECORD_TIMEOUT_SECONDS;
+    const recordMaxLengthSeconds = numberArg("--record-max-length")
+        ?? configNumber(machineConfig, "voice.twilioRecordMaxLengthSeconds")
+        ?? twilio_phone_1.DEFAULT_TWILIO_RECORD_MAX_LENGTH_SECONDS;
+    const transcriber = (0, whisper_1.createWhisperCppTranscriber)({
+        whisperCliPath,
+        modelPath: whisperModelPath,
+    });
+    const tts = (0, elevenlabs_1.createElevenLabsTtsClient)({
+        apiKey: elevenLabsApiKey,
+        voiceId: elevenLabsVoiceId,
+        outputFormat: "mp3_44100_128",
+    });
+    const bridge = await (0, twilio_phone_1.startTwilioPhoneBridgeServer)({
+        agentName,
+        publicBaseUrl,
+        outputDir,
+        transcriber,
+        tts,
+        port,
+        host,
+        twilioAccountSid,
+        twilioAuthToken,
+        defaultFriendId,
+        recordTimeoutSeconds,
+        recordMaxLengthSeconds,
+    });
+    writeReadyInstructions(bridge.localUrl, publicBaseUrl);
+}
+main().catch((error) => {
+    (0, runtime_1.emitNervesEvent)({
+        level: "error",
+        component: "senses",
+        event: "senses.entry_error",
+        message: "Twilio Voice entrypoint failed",
+        meta: { entry: "voice-twilio", agentName, error: error instanceof Error ? error.message : String(error) },
+    });
+    process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+    process.exit(1);
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.561",
+  "version": "0.1.0-alpha.563",
   "main": "dist/heart/daemon/ouro-entry.js",
   "bin": {
     "cli": "dist/heart/daemon/ouro-bot-entry.js",