@phuetz/code-buddy 2.0.0 → 2.1.0

package/dist/scheduler/job-notepad.js

@@ -0,0 +1,339 @@
+/**
+ * Per-job bounded continuity store (Hermes-inspired cron notepad).
+ *
+ * Isolated JSON files under `<cron-root>/notepads/<jobId>.json`, written
+ * atomically (0600): 16 KiB per value, 128-char keys, 64 KiB per serialized
+ * record. Mutations use an exclusive per-job lock across local processes.
+ * Contention requires retry; abandoned locks require operator inspection and
+ * are never stolen. Invalid/corrupt records are preserved for inspection.
+ */
+import { promises as fs } from 'node:fs';
+import { homedir } from 'node:os';
+import * as path from 'node:path';
+import { writeJsonAtomic } from '../utils/atomic-write.js';
+import { logger } from '../utils/logger.js';
+export const MAX_VALUE_BYTES = 16 * 1024;
+export const MAX_KEY_CHARS = 128;
+export const MAX_JOB_TOTAL_BYTES = 64 * 1024;
+export const MAX_LAST_OUTPUT_BYTES = 16 * 1024;
+export class JobNotepadBusyError extends Error {
+    constructor() {
+        super('Job notepad mutation locked; retry. An abandoned lock requires operator inspection.');
+        this.name = 'JobNotepadBusyError';
+    }
+}
+function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value)
+        && (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null);
+}
+/** Validate operator/tool input before changing jobs or writing any notes. */
+export function validateContinuity(value) {
+    if (typeof value === 'boolean')
+        return value;
+    if (!isRecord(value) || Object.keys(value).some(key => key !== 'enabled' && key !== 'notes')
+        || (value.enabled !== undefined && typeof value.enabled !== 'boolean')) {
+        throw new Error('Invalid continuity: expected a boolean or an object with enabled and notes');
+    }
+    if (value.notes !== undefined)
+        assertNotesWithinCaps(value.notes);
+    return {
+        ...(value.enabled !== undefined ? { enabled: value.enabled } : {}),
+        ...(value.notes !== undefined ? { notes: { ...value.notes } } : {}),
+    };
+}
+export function isContinuityEnabled(continuity) {
+    if (!isRecord(continuity)) {
+        return continuity === true;
+    }
+    return continuity.enabled !== false;
+}
+/** Persist the opt-in flag only — notes live in the notepad file, not jobs.json. */
+export function persistableContinuity(continuity) {
+    if (continuity === undefined)
+        return undefined;
+    continuity = validateContinuity(continuity);
+    if (typeof continuity === 'boolean')
+        return continuity;
+    return { enabled: continuity.enabled !== false };
+}
+export function defaultNotepadDir() {
+    const root = process.env.CODEBUDDY_CRON_HOME
+        ? path.resolve(process.env.CODEBUDDY_CRON_HOME)
+        : path.join(homedir(), '.codebuddy', 'cron');
+    return path.join(root, 'notepads');
+}
+export function utf8ByteLength(value) {
+    return Buffer.byteLength(value, 'utf8');
+}
+export function sanitizeJobId(jobId) {
+    if (typeof jobId !== 'string' || !jobId || jobId.length > 128 || !/^[A-Za-z0-9._-]+$/.test(jobId)) {
+        throw new Error('invalid job id');
+    }
+    return jobId;
+}
+export function truncateUtf8(value, maxBytes) {
+    if (maxBytes <= 0)
+        return '';
+    const buf = Buffer.from(value, 'utf8');
+    if (buf.length <= maxBytes)
+        return value;
+    let end = maxBytes;
+    while (end > 0 && ((buf[end] ?? 0) & 0xc0) === 0x80)
+        end -= 1;
+    return buf.subarray(0, end).toString('utf8');
+}
+export function notesByteTotal(notes) {
+    let total = 0;
+    for (const [key, value] of Object.entries(notes)) {
+        total += utf8ByteLength(key) + utf8ByteLength(value);
+    }
+    return total;
+}
+export function assertNotesWithinCaps(notes) {
+    if (!isRecord(notes))
+        throw new Error('notes must be an object of strings');
+    let total = 0;
+    for (const [key, value] of Object.entries(notes)) {
+        if (!key)
+            throw new Error('key must be non-empty');
+        if (key.length > MAX_KEY_CHARS) {
+            throw new Error(`key too long (max ${MAX_KEY_CHARS} characters)`);
+        }
+        if (typeof value !== 'string') {
+            throw new Error(`note '${key}' must be a string`);
+        }
+        const valueBytes = utf8ByteLength(value);
+        if (valueBytes > MAX_VALUE_BYTES) {
+            throw new Error(`value too large (max ${MAX_VALUE_BYTES} bytes per key)`);
+        }
+        total += utf8ByteLength(key) + valueBytes;
+        if (total > MAX_JOB_TOTAL_BYTES) {
+            throw new Error(`notepad full: would exceed ${MAX_JOB_TOTAL_BYTES} bytes total`);
+        }
+    }
+    assertRecordSize({ ...emptyRecord(), notes: notes });
+}
+function assertNotepadRecord(value) {
+    if (!isRecord(value) || Object.keys(value).some(key => !['notes', 'updatedAt', 'lastSuccessfulOutput'].includes(key))
+        || typeof value.updatedAt !== 'string' || !Number.isFinite(Date.parse(value.updatedAt))) {
+        throw new Error('Invalid notepad record');
+    }
+    assertNotesWithinCaps(value.notes);
+    if (value.lastSuccessfulOutput !== undefined && (typeof value.lastSuccessfulOutput !== 'string'
+        || utf8ByteLength(value.lastSuccessfulOutput) > MAX_LAST_OUTPUT_BYTES))
+        throw new Error('Invalid last successful output');
+    assertRecordSize(value);
+}
+function emptyRecord() {
+    return { notes: {}, updatedAt: new Date().toISOString() };
+}
+function serializedBytes(record) {
+    // Match writeJsonAtomic's indentation and final newline, including escaping.
+    return utf8ByteLength(`${JSON.stringify(record, null, 2)}\n`);
+}
+function assertRecordSize(record) {
+    if (serializedBytes(record) > MAX_JOB_TOTAL_BYTES) {
+        throw new Error(`notepad full: would exceed ${MAX_JOB_TOTAL_BYTES} serialized bytes total`);
+    }
+}
+export class JobNotepadStore {
+    dir;
+    constructor(dir = defaultNotepadDir()) {
+        this.dir = dir;
+    }
+    fileFor(jobId) {
+        const safe = sanitizeJobId(jobId);
+        const root = path.resolve(this.dir);
+        const file = path.resolve(root, `${safe}.json`);
+        const prefix = root.endsWith(path.sep) ? root : root + path.sep;
+        if (file !== path.join(root, `${safe}.json`) && !file.startsWith(prefix)) {
+            throw new Error('invalid job id');
+        }
+        return file;
+    }
+    async load(jobId) {
+        let handle;
+        try {
+            handle = await fs.open(this.fileFor(jobId), 'r');
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return emptyRecord();
+            throw error;
+        }
+        try {
+            const stat = await handle.stat();
+            if (!stat.isFile())
+                throw new Error('Notepad must be a regular file');
+            if (stat.size > MAX_JOB_TOTAL_BYTES)
+                throw new Error('Notepad record exceeds size limit');
+            const buffer = Buffer.alloc(MAX_JOB_TOTAL_BYTES + 1);
+            let length = 0;
+            while (length < buffer.length) {
+                const { bytesRead } = await handle.read(buffer, length, buffer.length - length, length);
+                if (bytesRead === 0)
+                    break;
+                length += bytesRead;
+            }
+            if (length > MAX_JOB_TOTAL_BYTES)
+                throw new Error('Notepad record exceeds size limit');
+            const loaded = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(buffer.subarray(0, length)));
+            assertNotepadRecord(loaded);
+            return loaded;
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    async setNote(jobId, key, value) {
+        assertNotesWithinCaps({ [key]: value });
+        return this.withMutationLock(jobId, async () => {
+            const current = await this.load(jobId);
+            return this.commitNotes(jobId, current, { ...current.notes, [key]: value });
+        });
+    }
+    async replaceNotes(jobId, notes) {
+        assertNotesWithinCaps(notes);
+        const snapshot = { ...notes };
+        return this.withMutationLock(jobId, async () => this.commitNotes(jobId, await this.load(jobId), snapshot));
+    }
+    async getNote(jobId, key) {
+        const current = await this.load(jobId);
+        return Object.hasOwn(current.notes, key) ? current.notes[key] : undefined;
+    }
+    async deleteNote(jobId, key) {
+        return this.withMutationLock(jobId, async () => {
+            const current = await this.load(jobId);
+            if (!Object.hasOwn(current.notes, key))
+                return false;
+            const nextNotes = { ...current.notes };
+            delete nextNotes[key];
+            await this.commitNotes(jobId, current, nextNotes);
+            return true;
+        });
+    }
+    async listNotes(jobId) {
+        const current = await this.load(jobId);
+        return Object.keys(current.notes)
+            .sort()
+            .map((key) => ({ key, value: current.notes[key] ?? '' }));
+    }
+    /**
+     * Record the last *successful* job output. Truncates to the per-value and
+     * serialized per-job caps. Storage errors are reported to the caller.
+     * Empty output leaves the previous non-empty successful output in place.
+     */
+    async saveLastSuccessfulOutput(jobId, output) {
+        if (typeof output !== 'string' || output.length === 0)
+            return;
+        await this.withMutationLock(jobId, async () => {
+            const current = await this.load(jobId);
+            const capped = truncateUtf8(output, MAX_LAST_OUTPUT_BYTES);
+            const next = { ...current, lastSuccessfulOutput: capped, updatedAt: new Date().toISOString() };
+            let low = 0;
+            let high = utf8ByteLength(capped);
+            let best = '';
+            while (low <= high) {
+                const middle = Math.floor((low + high) / 2);
+                const candidate = truncateUtf8(capped, middle);
+                if (serializedBytes({ ...next, lastSuccessfulOutput: candidate }) <= MAX_JOB_TOTAL_BYTES) {
+                    best = candidate;
+                    low = middle + 1;
+                }
+                else
+                    high = middle - 1;
+            }
+            if (!best)
+                throw new Error('notepad full: no room for the latest successful output');
+            await this.write(jobId, { ...next, lastSuccessfulOutput: best });
+        });
+    }
+    /** Missing files are a no-op; existing files share writer exclusion. */
+    async clear(jobId) {
+        try {
+            await fs.lstat(this.fileFor(jobId));
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return;
+            throw error;
+        }
+        await this.withMutationLock(jobId, async () => {
+            try {
+                await fs.unlink(this.fileFor(jobId));
+            }
+            catch (error) {
+                if (error.code !== 'ENOENT')
+                    throw error;
+            }
+        });
+    }
+    /**
+     * Prompt section for this job. Empty notepad MUST return '' so jobs that
+     * never use continuity keep a byte-identical agent prompt.
+     */
+    async renderSection(jobId) {
+        try {
+            const rec = await this.load(jobId);
+            const keys = Object.keys(rec.notes).sort();
+            const hasNotes = keys.length > 0;
+            const last = rec.lastSuccessfulOutput;
+            const hasOutput = typeof last === 'string' && last.length > 0;
+            if (!hasNotes && !hasOutput)
+                return '';
+            const parts = [];
+            if (hasNotes) {
+                const lines = keys.map((key) => `- ${key}: ${rec.notes[key] ?? ''}`);
+                parts.push('## Job notepad (persistent across runs)\n'
+                    + 'This durable scratchpad survives between scheduled runs of this job.\n\n'
+                    + lines.join('\n'));
+            }
+            if (hasOutput) {
+                parts.push(`## Last successful output (last non-empty result)\n${last}`);
+            }
+            return `${parts.join('\n\n')}\n`;
+        }
+        catch (error) {
+            logger.warn('Cron continuity could not be loaded; proceeding without stored context', { jobId, error: String(error) });
+            return '';
+        }
+    }
+    async commitNotes(jobId, current, nextNotes) {
+        const next = {
+            notes: nextNotes,
+            updatedAt: new Date().toISOString(),
+            ...(current.lastSuccessfulOutput !== undefined
+                ? { lastSuccessfulOutput: current.lastSuccessfulOutput }
+                : {}),
+        };
+        await this.write(jobId, next);
+        return next;
+    }
+    async write(jobId, record) {
+        assertNotepadRecord(record);
+        await writeJsonAtomic(this.fileFor(jobId), record, { mode: 0o600 });
+    }
+    async withMutationLock(jobId, action) {
+        const file = this.fileFor(jobId);
+        await fs.mkdir(path.dirname(file), { recursive: true, mode: 0o700 });
+        const lock = `${file}.lock`;
+        let handle;
+        try {
+            handle = await fs.open(lock, 'wx', 0o600);
+        }
+        catch (error) {
+            if (error.code === 'EEXIST')
+                throw new JobNotepadBusyError();
+            throw error;
+        }
+        try {
+            await handle.writeFile(JSON.stringify({ pid: process.pid, createdAt: new Date().toISOString() }));
+            return await action();
+        }
+        finally {
+            await handle.close();
+            await fs.unlink(lock);
+        }
+    }
+}
+//# sourceMappingURL=job-notepad.js.map

package/dist/security/audit-logger.d.ts

@@ -5,7 +5,7 @@
  * for code generation operations. Provides a persistent audit trail
  * that can be reviewed for compliance and debugging.
  */
-export type AuditAction = 'code_validation' | 'command_validation' | 'file_write' | 'file_edit' | 'file_delete' | 'patch_apply' | 'bash_execute' | 'confirmation_requested' | 'confirmation_granted' | 'confirmation_denied' | 'checkpoint_created' | 'checkpoint_restored' | 'sandbox_execute' | 'pattern_matched' | 'tool_execution' | 'self_improvement';
+export type AuditAction = 'code_validation' | 'command_validation' | 'file_write' | 'file_edit' | 'file_delete' | 'patch_apply' | 'bash_execute' | 'confirmation_requested' | 'confirmation_granted' | 'confirmation_denied' | 'checkpoint_created' | 'checkpoint_restored' | 'sandbox_execute' | 'pattern_matched' | 'tool_execution' | 'self_improvement' | 'device_register' | 'device_verify' | 'device_revoke';
 export type AuditDecision = 'allow' | 'block' | 'warn' | 'confirm';
 export interface AuditEntry {
     /** Unique entry ID */

package/dist/security/compute-confinement.d.ts

@@ -0,0 +1,4 @@
+export declare function confineComputeInvocation(command: string, args: string[], root: string): {
+    command: string;
+    args: string[];
+};

package/dist/security/compute-confinement.js

@@ -0,0 +1,89 @@
+/** Kernel-enforced compute sandbox. Fail closed if the required Linux facilities are absent. */
+import { realpathSync } from 'node:fs';
+// Bootstrap is trusted, runs before user code, and applies restrictions inherited across exec.
+// Landlock restricts file content access; seccomp denies networking and cross-process access.
+const BOOTSTRAP = String.raw `
+import ctypes, errno, os, platform, resource, sys
+libc = ctypes.CDLL(None, use_errno=True)
+def check(value):
+    if value < 0: raise OSError(ctypes.get_errno(), 'compute confinement unavailable')
+    return value
+arch = platform.machine()
+if arch not in ('x86_64', 'aarch64'): raise RuntimeError('unsupported compute sandbox architecture')
+abi = check(libc.syscall(444, 0, 0, 1))
+if abi < 3: raise RuntimeError('compute sandbox requires Landlock ABI 3 or newer')
+root, executable = sys.argv[1:3]
+class Rules(ctypes.Structure):
+    _fields_ = [('access', ctypes.c_uint64)]
+class PathRule(ctypes.Structure):
+    _pack_ = 1
+    _fields_ = [('access', ctypes.c_uint64), ('fd', ctypes.c_int32)]
+rights = (1 << 15) - 1
+rules = Rules(rights)
+fd = check(libc.syscall(444, ctypes.byref(rules), ctypes.sizeof(rules), 0))
+def allow(p, access):
+    if not os.path.exists(p): return
+    p = os.path.realpath(p)
+    if not os.path.isdir(p): access &= (1 | 2 | 4 | (1 << 14))
+    handle = os.open(p, os.O_PATH | os.O_CLOEXEC)
+    try:
+        rule = PathRule(access, handle)
+        check(libc.syscall(445, fd, 1, ctypes.byref(rule), 0))
+    finally: os.close(handle)
+# Runtime libraries are readable, never writable or executable as programs.
+for p in ('/usr/lib', '/usr/lib64', '/usr/local/lib', '/usr/share/nodejs', '/usr/share/zoneinfo', '/lib', '/lib64', '/etc/ld.so.cache', '/dev/null', '/dev/urandom'):
+    allow(p, 4 | 8)
+allow(root, rights & ~(1 | (1 << 6) | (1 << 9) | (1 << 10) | (1 << 11) | (1 << 12)))
+allow(executable, 1 | 4)
+allow('/lib64/ld-linux-x86-64.so.2' if arch == 'x86_64' else '/lib/ld-linux-aarch64.so.1', 1 | 4)
+# Drop inherited capabilities as well (the host may itself run as root).
+class CapHeader(ctypes.Structure):
+    _fields_ = [('version',ctypes.c_uint32),('pid',ctypes.c_int)]
+class CapData(ctypes.Structure):
+    _fields_ = [('effective',ctypes.c_uint32),('permitted',ctypes.c_uint32),('inheritable',ctypes.c_uint32)]
+cap_header, cap_data = CapHeader(0x20080522, 0), (CapData * 2)()
+check(libc.capset(ctypes.byref(cap_header), ctypes.byref(cap_data)))
+check(libc.prctl(38, 1, 0, 0, 0)) # PR_SET_NO_NEW_PRIVS
+check(libc.syscall(446, fd, 0))
+os.close(fd)
+class Filter(ctypes.Structure):
+    _fields_ = [('code',ctypes.c_ushort),('jt',ctypes.c_ubyte),('jf',ctypes.c_ubyte),('k',ctypes.c_uint32)]
+class Program(ctypes.Structure):
+    _fields_ = [('len',ctypes.c_ushort),('filter',ctypes.POINTER(Filter))]
+# Check audit architecture, deny x32 ABI, then block sockets, ptrace, process_vm,
+# pidfd, io_uring, signals to other processes and namespace/mount manipulation.
+expected = 0xc000003e if arch == 'x86_64' else 0xc00000b7
+denied = ([41,42,43,44,45,46,47,49,50,53,288,101,310,311,424,425,426,434,438,62,200,234,57,58,165,166,272,308]
+          if arch == 'x86_64' else [198,203,202,206,207,211,212,200,201,199,242,117,270,271,424,425,426,434,438,129,130,131,40,39,97,268])
+ops = [Filter(0x20,0,0,4), Filter(0x15,1,0,expected), Filter(0x06,0,0,0x80000000), Filter(0x20,0,0,0)]
+if arch == 'x86_64': ops += [Filter(0x45,0,1,0x40000000), Filter(0x06,0,0,0x80000000)]
+# Deny process creation, while allowing CLONE_THREAD for interpreter worker threads.
+clone = 56 if arch == 'x86_64' else 220
+ops += [Filter(0x15,0,4,clone), Filter(0x20,0,0,16), Filter(0x45,1,0,0x10000), Filter(0x06,0,0,0x00050000 | errno.EPERM), Filter(0x06,0,0,0x7fff0000)]
+# libc retries clone() when clone3 reports ENOSYS.
+ops += [Filter(0x15,0,1,435), Filter(0x06,0,0,0x00050000 | errno.ENOSYS)]
+for nr in denied: ops += [Filter(0x15,0,1,nr),Filter(0x06,0,0,0x00050000 | errno.EPERM)]
+ops += [Filter(0x06,0,0,0x7fff0000)]
+filters = (Filter * len(ops))(*ops)
+program = Program(len(ops), filters)
+check(libc.prctl(22, 2, ctypes.byref(program), 0, 0)) # SECCOMP_MODE_FILTER
+resource.setrlimit(resource.RLIMIT_CORE, (0,0))
+resource.setrlimit(resource.RLIMIT_DATA, (536870912,536870912))
+resource.setrlimit(resource.RLIMIT_FSIZE, (2097152,2097152))
+resource.setrlimit(resource.RLIMIT_NOFILE, (128,128))
+resource.setrlimit(resource.RLIMIT_CPU, (30,30))
+os.environ['OPENSSL_CONF'] = '/dev/null'
+for key in ('TMPDIR','TMP','TEMP'): os.environ[key] = root
+os.environ.pop('NODE_PATH', None)
+os.environ.pop('NODE_OPTIONS', None)
+args = sys.argv[3:]
+if os.path.basename(executable) == 'node': args = ['--jitless', '--max-old-space-size=96'] + args
+os.execv(executable, [executable] + args)
+`;
+export function confineComputeInvocation(command, args, root) {
+    if (process.platform !== 'linux')
+        throw new Error('Compute confinement requires Linux Landlock/seccomp; refusing unrestricted execution');
+    const executable = realpathSync(command === 'python3' ? '/usr/bin/python3' : command);
+    return { command: '/usr/bin/python3', args: ['-I', '-c', BOOTSTRAP, realpathSync(root), executable, ...args] };
+}
+//# sourceMappingURL=compute-confinement.js.map

package/dist/security/session-encryption.d.ts

@@ -25,6 +25,8 @@ export interface EncryptionConfig {
     usePassword?: boolean;
     /** Enable encryption (can be disabled for performance) */
     enabled?: boolean;
+    /** Refuse volatile/machine-derived fallback for durable session storage. */
+    requirePersistentKey?: boolean;
 }
 /**
  * Session encryption manager
@@ -38,6 +40,8 @@ export declare class SessionEncryption {
      * Initialize encryption with machine-generated key
      */
     initialize(): Promise<void>;
+    /** Read existing key only: decrypting must never generate a replacement key. */
+    initializeForRead(): void;
     /**
      * Initialize with password-based key
      */

package/dist/security/session-encryption.js

@@ -8,6 +8,8 @@
  */
 import * as crypto from 'crypto';
 import fs from 'fs-extra';
+import { readFileSync } from 'node:fs';
+import { withSessionLock } from '../persistence/session-lock.js';
 import * as path from 'path';
 import * as os from 'os';
 import { logger } from '../utils/logger.js';
@@ -39,6 +41,7 @@ export class SessionEncryption {
             keyPath: config.keyPath ?? DEFAULT_CONFIG.keyPath,
             usePassword: config.usePassword ?? DEFAULT_CONFIG.usePassword,
             enabled: config.enabled ?? DEFAULT_CONFIG.enabled,
+            requirePersistentKey: config.requirePersistentKey ?? false,
         };
     }
     /**
@@ -48,6 +51,26 @@ export class SessionEncryption {
         if (this.initialized || !this.config.enabled) {
             return;
         }
+        if (this.config.requirePersistentKey) {
+            await fs.ensureDir(path.dirname(this.config.keyPath));
+            await withSessionLock(this.config.keyPath, async () => {
+                let key;
+                try {
+                    key = await fs.readFile(this.config.keyPath);
+                }
+                catch (error) {
+                    if (error.code !== 'ENOENT')
+                        throw error;
+                    key = crypto.randomBytes(KEY_LENGTH);
+                    await writeFileAtomic(this.config.keyPath, key, { mode: 0o600 });
+                }
+                if (key.length !== KEY_LENGTH)
+                    throw new Error('Invalid session encryption key');
+                this.key = key;
+                this.initialized = true;
+            });
+            return;
+        }
         try {
             // Try to load existing key
             if (await fs.pathExists(this.config.keyPath)) {
@@ -69,6 +92,14 @@ export class SessionEncryption {
             this.initialized = true;
         }
     }
+    /** Read existing key only: decrypting must never generate a replacement key. */
+    initializeForRead() {
+        const key = readFileSync(this.config.keyPath);
+        if (key.length !== KEY_LENGTH)
+            throw new Error('Invalid session encryption key');
+        this.key = key;
+        this.initialized = true;
+    }
     /**
      * Initialize with password-based key
      */

package/dist/sensory/voice-loop.d.ts

@@ -22,6 +22,7 @@ import { type LocalTtsEngine } from '../voice/local-tts.js';
 import { type TwoSpeedTtsRouteHint } from '../voice/two-speed-voice.js';
 export type { TwoSpeedTtsRouteHint } from '../voice/two-speed-voice.js';
 import type { PermissionMode } from '../security/permission-modes.js';
+import { type ResponseDecider } from './respond-decider.js';
 import { type VoiceDeliveryProfile, type VoiceTurnContext } from './voice-entrainment.js';
 import { type VisualGroundingFn } from '../companion/visual-grounding.js';
 import type { CameraShareOptions, CameraShareResult } from '../companion/camera-share.js';
@@ -89,6 +90,15 @@ export interface VoiceStepOptions {
     shortFirst?: VoiceShortFirstConfig;
     /** Tell the outer audio pipeline that the fast route accepted the short-first contract. */
     onShortFirstReady?: (config: VoiceShortFirstConfig) => void;
+    /** Decision from respond-decider if already evaluated */
+    respondDecision?: {
+        respond: boolean;
+        reason: string;
+    };
+    /** Injected response decider for conversational continuity */
+    responseDecider?: ResponseDecider;
+    /** Explicit override for whether the robot was named or in engagement window */
+    robotNamed?: boolean;
 }
 export interface VoiceShortFirstConfig {
     /** Total number of spoken answer sentences, including the first useful sentence. */
@@ -500,6 +510,13 @@ export declare function rewriteRepeatedVoiceOpener(text: string, recentOpeners?:
  * can be proven without starting a model.
  */
 export declare function buildSpokenPromptAugmentation(heard: string, history?: VoiceHistoryTurn[], spokenPrefix?: string, delivery?: VoiceDeliveryProfile, options?: SpokenPromptAugmentationOptions): Promise<string>;
+export declare function getVoiceResponseDecider(): ResponseDecider;
+export declare function setVoiceResponseDecider(decider: ResponseDecider | undefined): void;
+/**
+ * Determine if the utterance addresses the robot by name or takes place inside
+ * an active engagement window, consulting the respond-decider.
+ */
+export declare function resolveVoiceRobotNamed(heard: string, replyOpts?: VoiceStepOptions): Promise<boolean>;
 export declare function defaultReply(heard: string, history?: VoiceHistoryTurn[], replyOpts?: VoiceStepOptions): Promise<string>;
 /**
  * Fast first proposition for an eligible developed/deliberative turn. Eligibility and

package/dist/sensory/voice-loop.js

@@ -45,6 +45,7 @@ import { resolveElevenLabsCacheVoice, resolveElevenLabsFallbackEngine, resolveTt
 import { resolveKyutaiCacheVoice } from '../voice/kyutai-local-voice.js';
 import { selectTwoSpeedTtsRoute, twoSpeedTtsEnabled, } from '../voice/two-speed-voice.js';
 import { resolveVoiceboxConfig } from '../voice/voicebox-tts.js';
+import { createResponseDecider } from './respond-decider.js';
 import { applyLimitsContract, avoidOpenersGuidance, detectEmotion, emotionalContinuityGuidance, emotionGuidance, expressiveTextGuidance, immediateEmotionAcknowledgement, IMMEDIATE_EMOTION_ACKNOWLEDGEMENTS, limitsContractGuidance, openerKey, pushOpener, } from '../companion/reply-augment.js';
 import { crisisGuidanceFor } from '../companion/crisis-safety.js';
 import { evolveRelationshipFromUtterance } from '../companion/relationship-evolution.js';
@@ -1263,6 +1264,32 @@ async function prepareSpokenTurn(heard, history = [], spokenPrefix, delivery, re
         ...(cognitiveLease ? { cognitiveLease } : {}),
     };
 }
+let sharedVoiceResponseDecider;
+export function getVoiceResponseDecider() {
+    if (!sharedVoiceResponseDecider) {
+        sharedVoiceResponseDecider = createResponseDecider();
+    }
+    return sharedVoiceResponseDecider;
+}
+export function setVoiceResponseDecider(decider) {
+    sharedVoiceResponseDecider = decider;
+}
+/**
+ * Determine if the utterance addresses the robot by name or takes place inside
+ * an active engagement window, consulting the respond-decider.
+ */
+export async function resolveVoiceRobotNamed(heard, replyOpts) {
+    if (typeof replyOpts?.robotNamed === 'boolean') {
+        return replyOpts.robotNamed;
+    }
+    if (replyOpts?.respondDecision) {
+        const reason = replyOpts.respondDecision.reason;
+        return reason === 'addressed' || reason === 'engaged';
+    }
+    const decider = replyOpts?.responseDecider ?? getVoiceResponseDecider();
+    const decision = await decider.decide(heard);
+    return decision.reason === 'addressed' || decision.reason === 'engaged';
+}
 export async function defaultReply(heard, history = [], replyOpts) {
     const fast = fastCompanionReply(heard);
     if (fast) {
@@ -1331,21 +1358,51 @@ export async function defaultReply(heard, history = [], replyOpts) {
         cognitiveLease = prepared.cognitiveLease;
         replyOpts?.onProviderResolved?.(route);
         logger.debug(`[voice] reply model: ${route.model} — ${route.reason}`);
-        const client = new CodeBuddyClient(route.apiKey, route.model, route.baseURL);
-        const resp = await client.chat([
-            { role: 'system', content: systemPrompt },
-            ...history,
-            { role: 'user', content: heard },
-        ], [], 
-        // Additive: thread the barge-in signal so an interrupt aborts the in-flight
-        // LLM call. Undefined when not interruptible → the call is unchanged.
-        {
-            temperature: voiceTemperature(),
-            maxTokens: voiceMaxTokens(heard, history),
-            ...(replyOpts?.signal ? { signal: replyOpts.signal } : {}),
-        });
-        reportReplyTimingPhase(replyOpts, replyOpts?.spokenPrefix ? 'continuation_generation_complete' : 'generation_complete');
-        const reply = (resp?.choices?.[0]?.message?.content ?? '').trim();
+        let reply = '';
+        const { isCompanionToolsEnabled } = await import('../companion/companion-toolset.js');
+        if (isCompanionToolsEnabled(process.env)) {
+            const { resolveCompanionIdentity } = await import('../companion/companion-identity.js');
+            const { runCompanionChannelTurn } = await import('../channels/companion-channel-turn.js');
+            const robotNamed = await resolveVoiceRobotNamed(heard, replyOpts);
+            const identity = resolveCompanionIdentity({
+                channel: 'voice',
+                isVoicePresence: true,
+                robotNamed,
+                env: process.env,
+            });
+            const turnResult = await runCompanionChannelTurn({
+                apiKey: route.apiKey,
+                baseUrl: route.baseURL,
+                model: route.model,
+                messages: [
+                    { role: 'system', content: systemPrompt },
+                    ...history,
+                    { role: 'user', content: heard },
+                ],
+                identity,
+                surface: 'voice',
+                env: process.env,
+                signal: replyOpts?.signal,
+                maxTokens: voiceMaxTokens(heard, history),
+            });
+            reply = turnResult.text.trim();
+        }
+        else {
+            const client = new CodeBuddyClient(route.apiKey, route.model, route.baseURL);
+            const resp = await client.chat([
+                { role: 'system', content: systemPrompt },
+                ...history,
+                { role: 'user', content: heard },
+            ], [], 
+            // Additive: thread the barge-in signal so an interrupt aborts the in-flight
+            // LLM call. Undefined when not interruptible → the call is unchanged.
+            {
+                temperature: voiceTemperature(),
+                maxTokens: voiceMaxTokens(heard, history),
+                ...(replyOpts?.signal ? { signal: replyOpts.signal } : {}),
+            });
+            reply = (resp?.choices?.[0]?.message?.content ?? '').trim();
+        }
         if (reply && !replyOpts?.signal?.aborted)
             cognitiveLease?.commit();
         else