voicecc 1.2.8 → 1.2.10

package/dashboard/dashboard-auth.test.ts

@@ -0,0 +1,88 @@
+/**
+ * Tests that dashboard password protection (HTTP Basic Auth) works correctly.
+ *
+ * Uses Hono's in-memory app.request() -- no real HTTP server needed.
+ *
+ * Run: npx tsx --test dashboard/dashboard-auth.test.ts
+ */
+
+import { test, describe, beforeEach } from "node:test";
+import { strict as assert } from "node:assert";
+
+import { createApp } from "./server.js";
+
+// ============================================================================
+// CONSTANTS
+// ============================================================================
+
+const TEST_PASSWORD = "test-secret-123";
+const TEST_ENDPOINT = "/api/status";
+
+/**
+ * Encode credentials as a Basic Auth header value.
+ */
+function basicAuthHeader(username: string, password: string): string {
+  return "Basic " + Buffer.from(`${username}:${password}`).toString("base64");
+}
+
+// ============================================================================
+// TESTS
+// ============================================================================
+
+describe("dashboard password protection", () => {
+  beforeEach(() => {
+    delete process.env.DASHBOARD_PASSWORD;
+  });
+
+  test("no password set -- requests succeed without credentials", async () => {
+    const app = createApp();
+    const res = await app.request(TEST_ENDPOINT);
+    assert.equal(res.status, 200);
+  });
+
+  test("password set, no credentials -- returns 401", async () => {
+    process.env.DASHBOARD_PASSWORD = TEST_PASSWORD;
+    const app = createApp();
+    const res = await app.request(TEST_ENDPOINT);
+    assert.equal(res.status, 401);
+  });
+
+  test("password set, wrong credentials -- returns 401", async () => {
+    process.env.DASHBOARD_PASSWORD = TEST_PASSWORD;
+    const app = createApp();
+    const res = await app.request(TEST_ENDPOINT, {
+      headers: { Authorization: basicAuthHeader("admin", "wrong-password") },
+    });
+    assert.equal(res.status, 401);
+  });
+
+  test("password set, correct credentials -- returns 200", async () => {
+    process.env.DASHBOARD_PASSWORD = TEST_PASSWORD;
+    const app = createApp();
+    const res = await app.request(TEST_ENDPOINT, {
+      headers: { Authorization: basicAuthHeader("admin", TEST_PASSWORD) },
+    });
+    assert.equal(res.status, 200);
+  });
+
+  test("password set, /chat bypasses basic auth", async () => {
+    process.env.DASHBOARD_PASSWORD = TEST_PASSWORD;
+    const app = createApp();
+    const res = await app.request("/chat");
+    assert.notEqual(res.status, 401);
+  });
+
+  test("password set, /api/chat/* bypasses basic auth", async () => {
+    process.env.DASHBOARD_PASSWORD = TEST_PASSWORD;
+    const app = createApp();
+    const res = await app.request("/api/chat/send", { method: "POST" });
+    assert.notEqual(res.status, 401);
+  });
+
+  test("password set, /api/webrtc/* bypasses basic auth", async () => {
+    process.env.DASHBOARD_PASSWORD = TEST_PASSWORD;
+    const app = createApp();
+    const res = await app.request("/api/webrtc/validate");
+    assert.notEqual(res.status, 401);
+  });
+});

package/dashboard/vite.config.ts

@@ -0,0 +1,28 @@
+/**
+ * Vite configuration for the Claude Voice dashboard frontend.
+ *
+ * - Uses @vitejs/plugin-react for JSX transform
+ * - Proxies /api requests to the Hono backend server during development
+ * - Outputs production build to dashboard/dist/
+ */
+
+import { defineConfig } from "vite";
+import react from "@vitejs/plugin-react";
+
+// ============================================================================
+// CONFIG
+// ============================================================================
+
+const API_PROXY_TARGET = "http://localhost:3456";
+
+export default defineConfig({
+  plugins: [react()],
+  server: {
+    proxy: {
+      "/api": API_PROXY_TARGET,
+    },
+  },
+  build: {
+    outDir: "dist",
+  },
+});

package/dashboard/ws-proxy-frames.test.ts

@@ -0,0 +1,117 @@
+/**
+ * Tests that the WebSocket proxy preserves frame types (text vs binary).
+ *
+ * Twilio sends and expects JSON as text frames. If the proxy silently converts
+ * text→binary, Twilio ignores outbound audio and the caller hears nothing.
+ *
+ * Run: npx tsx --test dashboard/ws-proxy-frames.test.ts
+ */
+
+import { test, describe, after } from "node:test";
+import { strict as assert } from "node:assert";
+import { WebSocketServer, WebSocket } from "ws";
+import http from "node:http";
+
+import { attachMediaProxy } from "./ws-proxy.js";
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+function listen(server: http.Server): Promise<number> {
+  return new Promise((resolve) => {
+    server.listen(0, "127.0.0.1", () => {
+      const addr = server.address();
+      resolve(typeof addr === "object" ? addr!.port : 0);
+    });
+  });
+}
+
+function connect(url: string): Promise<WebSocket> {
+  return new Promise((resolve, reject) => {
+    const ws = new WebSocket(url);
+    ws.on("open", () => resolve(ws));
+    ws.on("error", reject);
+  });
+}
+
+function nextMessage(ws: WebSocket): Promise<{ data: Buffer; isBinary: boolean }> {
+  return new Promise((resolve) => {
+    ws.once("message", (data, isBinary) => {
+      resolve({ data: data as Buffer, isBinary });
+    });
+  });
+}
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+describe("WebSocket proxy frame types", () => {
+  const servers: http.Server[] = [];
+  const sockets: WebSocket[] = [];
+
+  after(() => {
+    for (const ws of sockets) ws.close();
+    for (const srv of servers) srv.close();
+  });
+
+  async function setup() {
+    // Mock upstream (stands in for Python voice server)
+    const upstreamServer = http.createServer();
+    const upstreamWss = new WebSocketServer({ server: upstreamServer });
+    servers.push(upstreamServer);
+    const upstreamPort = await listen(upstreamServer);
+
+    // Proxy server using real attachMediaProxy from application code
+    const proxyServer = http.createServer();
+    attachMediaProxy(proxyServer, `http://127.0.0.1:${upstreamPort}`);
+    servers.push(proxyServer);
+    const proxyPort = await listen(proxyServer);
+
+    // Wait for both sides to connect
+    const upstreamClientP = new Promise<WebSocket>((resolve) => {
+      upstreamWss.once("connection", resolve);
+    });
+    const client = await connect(`ws://127.0.0.1:${proxyPort}/media/aabbccdd-1234-5678-9900-aabbccddeeff`);
+    const upstreamClient = await upstreamClientP;
+    sockets.push(client, upstreamClient);
+
+    return { client, upstreamClient };
+  }
+
+  test("client→upstream: text frame arrives as text, not binary", async () => {
+    const { client, upstreamClient } = await setup();
+    const msg = JSON.stringify({ event: "media", streamSid: "MZ123", media: { payload: "AQID" } });
+
+    const received = nextMessage(upstreamClient);
+    client.send(msg); // string → text frame
+    const { data, isBinary } = await received;
+
+    assert.equal(isBinary, false, "upstream should receive a text frame");
+    assert.equal(data.toString("utf-8"), msg);
+  });
+
+  test("upstream→client: text frame arrives as text, not binary", async () => {
+    const { client, upstreamClient } = await setup();
+    const msg = JSON.stringify({ event: "media", streamSid: "MZ123", media: { payload: "AQID" } });
+
+    const received = nextMessage(client);
+    upstreamClient.send(msg); // string → text frame
+    const { data, isBinary } = await received;
+
+    assert.equal(isBinary, false, "client should receive a text frame");
+    assert.equal(data.toString("utf-8"), msg);
+  });
+
+  test("binary frames stay binary through the proxy", async () => {
+    const { client, upstreamClient } = await setup();
+    const buf = Buffer.from([0x01, 0x02, 0x03, 0x04]);
+
+    const received = nextMessage(upstreamClient);
+    client.send(buf); // Buffer → binary frame
+    const { isBinary } = await received;
+
+    assert.equal(isBinary, true, "upstream should receive a binary frame");
+  });
+});

package/dashboard/ws-proxy-integration.test.ts

@@ -0,0 +1,189 @@
+/**
+ * Integration test for the Twilio ↔ Python WebSocket media proxy.
+ *
+ * Spins up a mock "Python voice server", attaches the real attachMediaProxy
+ * from ws-proxy.ts to an HTTP server, then connects a mock "Twilio" client.
+ * Verifies that Twilio media JSON round-trips correctly in both directions
+ * and that connections tear down cleanly.
+ *
+ * Run: npx tsx --test dashboard/ws-proxy-integration.test.ts
+ */
+
+import { test, describe, after } from "node:test";
+import { strict as assert } from "node:assert";
+import { WebSocketServer, WebSocket } from "ws";
+import http from "node:http";
+
+import { attachMediaProxy } from "./ws-proxy.js";
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+function listen(server: http.Server): Promise<number> {
+  return new Promise((resolve) => {
+    server.listen(0, "127.0.0.1", () => {
+      const addr = server.address();
+      resolve(typeof addr === "object" ? addr!.port : 0);
+    });
+  });
+}
+
+function connect(url: string): Promise<WebSocket> {
+  return new Promise((resolve, reject) => {
+    const ws = new WebSocket(url);
+    ws.on("open", () => resolve(ws));
+    ws.on("error", reject);
+  });
+}
+
+function nextMessage(ws: WebSocket): Promise<{ data: Buffer; isBinary: boolean }> {
+  return new Promise((resolve) => {
+    ws.once("message", (data, isBinary) => {
+      resolve({ data: data as Buffer, isBinary });
+    });
+  });
+}
+
+function waitForClose(ws: WebSocket): Promise<void> {
+  return new Promise((resolve) => {
+    if (ws.readyState === WebSocket.CLOSED) return resolve();
+    ws.once("close", () => resolve());
+  });
+}
+
+// A realistic Twilio media message
+const TWILIO_MEDIA_MSG = JSON.stringify({
+  event: "media",
+  streamSid: "MZ0b4ca5d9cfd2658e5b0934ed835c66d8",
+  media: { payload: "PCUgJCIdJlGsrL9ELiooJSY12a+s" },
+});
+
+const TWILIO_START_MSG = JSON.stringify({
+  event: "start",
+  streamSid: "MZ0b4ca5d9cfd2658e5b0934ed835c66d8",
+  start: { callSid: "CA123", streamSid: "MZ0b4ca5d9cfd2658e5b0934ed835c66d8" },
+});
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+describe("Twilio media proxy (integration)", () => {
+  const servers: http.Server[] = [];
+  const sockets: WebSocket[] = [];
+
+  after(() => {
+    for (const ws of sockets) ws.close();
+    for (const srv of servers) srv.close();
+  });
+
+  /** Set up mock Python server + proxy + mock Twilio client */
+  async function setup() {
+    // 1. Mock Python voice server (accepts WebSocket connections)
+    const pythonServer = http.createServer();
+    const pythonWss = new WebSocketServer({ server: pythonServer });
+    servers.push(pythonServer);
+    const pythonPort = await listen(pythonServer);
+
+    // 2. Proxy server using the real attachMediaProxy
+    const proxyServer = http.createServer();
+    attachMediaProxy(proxyServer, `http://127.0.0.1:${pythonPort}`);
+    servers.push(proxyServer);
+    const proxyPort = await listen(proxyServer);
+
+    // 3. Connect mock Twilio client to the proxy (must match /media/<token>)
+    const pythonClientP = new Promise<WebSocket>((resolve) => {
+      pythonWss.once("connection", resolve);
+    });
+    const twilioClient = await connect(`ws://127.0.0.1:${proxyPort}/media/aabbccdd-1234-5678-9900-aabbccddeeff`);
+    const pythonClient = await pythonClientP;
+    sockets.push(twilioClient, pythonClient);
+
+    return { twilioClient, pythonClient };
+  }
+
+  test("Twilio start event reaches Python as parseable JSON text", async () => {
+    const { twilioClient, pythonClient } = await setup();
+
+    const received = nextMessage(pythonClient);
+    twilioClient.send(TWILIO_START_MSG);
+    const { data, isBinary } = await received;
+
+    assert.equal(isBinary, false, "start event must arrive as text frame");
+    const parsed = JSON.parse(data.toString("utf-8"));
+    assert.equal(parsed.event, "start");
+    assert.equal(parsed.start.callSid, "CA123");
+  });
+
+  test("Twilio media reaches Python as JSON text with intact payload", async () => {
+    const { twilioClient, pythonClient } = await setup();
+
+    const received = nextMessage(pythonClient);
+    twilioClient.send(TWILIO_MEDIA_MSG);
+    const { data, isBinary } = await received;
+
+    assert.equal(isBinary, false, "media must arrive as text frame");
+    const parsed = JSON.parse(data.toString("utf-8"));
+    assert.equal(parsed.event, "media");
+    assert.equal(parsed.media.payload, "PCUgJCIdJlGsrL9ELiooJSY12a+s");
+  });
+
+  test("Python response media reaches Twilio as JSON text", async () => {
+    const { twilioClient, pythonClient } = await setup();
+    const responseMsg = JSON.stringify({
+      event: "media",
+      streamSid: "MZ0b4ca5d9cfd2658e5b0934ed835c66d8",
+      media: { payload: "Yu/d7OlyenN0+mrt+ubecGdbYO7f" },
+    });
+
+    const received = nextMessage(twilioClient);
+    pythonClient.send(responseMsg);
+    const { data, isBinary } = await received;
+
+    assert.equal(isBinary, false, "response media must arrive as text frame");
+    const parsed = JSON.parse(data.toString("utf-8"));
+    assert.equal(parsed.event, "media");
+    assert.equal(parsed.media.payload, "Yu/d7OlyenN0+mrt+ubecGdbYO7f");
+  });
+
+  test("closing Twilio side tears down Python connection", async () => {
+    const { twilioClient, pythonClient } = await setup();
+
+    const pythonClosed = waitForClose(pythonClient);
+    twilioClient.close();
+    await pythonClosed;
+
+    assert.equal(pythonClient.readyState, WebSocket.CLOSED);
+  });
+
+  test("multiple messages round-trip without corruption", async () => {
+    const { twilioClient, pythonClient } = await setup();
+    const messages = Array.from({ length: 10 }, (_, i) =>
+      JSON.stringify({
+        event: "media",
+        streamSid: "MZ123",
+        media: { payload: `chunk${i}_` + "A".repeat(200) },
+      })
+    );
+
+    // Send all from Twilio, collect on Python side
+    const allReceived: string[] = [];
+    const done = new Promise<void>((resolve) => {
+      pythonClient.on("message", (data) => {
+        allReceived.push((data as Buffer).toString("utf-8"));
+        if (allReceived.length === messages.length) resolve();
+      });
+    });
+
+    for (const msg of messages) {
+      twilioClient.send(msg);
+    }
+    await done;
+
+    assert.equal(allReceived.length, messages.length);
+    for (let i = 0; i < messages.length; i++) {
+      assert.equal(allReceived[i], messages[i], `message ${i} should match`);
+    }
+  });
+});

package/dashboard/ws-proxy.ts

@@ -0,0 +1,70 @@
+/**
+ * Twilio ↔ Python WebSocket proxy utilities.
+ *
+ * The `ws` library always delivers message data as a Buffer, even for text
+ * frames. If you forward that Buffer via ws.send(Buffer), it emits a binary
+ * frame — silently changing the frame type. Twilio ignores binary frames for
+ * JSON media messages, so the caller hears nothing.
+ *
+ * wsForward checks the isBinary flag and converts to string when needed
+ * so that text frames stay text and binary frames stay binary.
+ */
+
+import { WebSocket, WebSocketServer } from "ws";
+import type http from "node:http";
+import type { Duplex } from "node:stream";
+
+export function wsForward(
+  dest: WebSocket,
+  data: Buffer | ArrayBuffer | Buffer[],
+  isBinary: boolean,
+): void {
+  if (dest.readyState !== WebSocket.OPEN) return;
+  dest.send(isBinary ? data : (data as Buffer).toString("utf-8"));
+}
+
+/**
+ * Attach a Twilio media WebSocket proxy to an HTTP server.
+ *
+ * Intercepts upgrade requests matching /media/<token> and proxies them
+ * bidirectionally to the given upstream URL, preserving frame types.
+ */
+export function attachMediaProxy(
+  server: http.Server,
+  upstreamBaseUrl: string,
+): void {
+  const wss = new WebSocketServer({ noServer: true });
+
+  server.on("upgrade", (req: http.IncomingMessage, socket: Duplex, head: Buffer) => {
+    const url = req.url ?? "";
+    const match = url.match(/^\/media\/([a-f0-9-]+)(?:\?.*)?$/);
+    if (!match) return;
+
+    const targetWsUrl = upstreamBaseUrl.replace(/^http/, "ws") + url;
+    const upstream = new WebSocket(targetWsUrl);
+
+    let proxyMsgCount = { fromClient: 0, fromUpstream: 0 };
+    upstream.on("open", () => {
+      wss.handleUpgrade(req, socket, head, (clientWs) => {
+        clientWs.on("message", (data, isBinary) => {
+          proxyMsgCount.fromClient++;
+          wsForward(upstream, data as Buffer, isBinary);
+        });
+        upstream.on("message", (data, isBinary) => {
+          proxyMsgCount.fromUpstream++;
+          wsForward(clientWs, data as Buffer, isBinary);
+        });
+
+        clientWs.on("close", () => upstream.close());
+        upstream.on("close", () => clientWs.close());
+        clientWs.on("error", (e) => { console.error(`[ws-proxy] Twilio WS error: ${e.message}`); upstream.close(); });
+        upstream.on("error", (e) => { console.error(`[ws-proxy] Python WS error: ${e.message}`); clientWs.close(); });
+      });
+    });
+
+    upstream.on("error", (err) => {
+      console.error(`[dashboard] Twilio WS proxy error: ${err.message}`);
+      socket.destroy();
+    });
+  });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "voicecc",
-  "version": "1.2.8",
+  "version": "1.2.10",
   "description": "Voice Agent Platform running on Claude Code -- create and deploy conversational voice agents with ElevenLabs STT/TTS and VAD",
   "repository": {
     "type": "git",
@@ -25,8 +25,8 @@
     "bin/",
     "server/",
     "voice-server/",
+    "dashboard/*.ts",
     "dashboard/dist/",
-    "dashboard/server.ts",
     "dashboard/routes/",
     "init/",
     "tsconfig.json"

package/voice-server/claude_llm_service.py

@@ -234,6 +234,7 @@ class ClaudeLLMService(LLMService):
                 permission_mode="bypassPermissions",
                 include_partial_messages=True,
                 max_thinking_tokens=0,
+                setting_sources=["user", "project", "local"],
             )
             self._client = ClaudeSDKClient(options=options)
 

package/voice-server/claude_session.py

@@ -138,6 +138,7 @@ async def get_or_create_session(session_key: str, agent_id: str | None = None) -
         permission_mode="bypassPermissions",
         include_partial_messages=True,
         max_thinking_tokens=10000,
+        setting_sources=["user", "project", "local"],
     )
 
     client = ClaudeSDKClient(options=options)

package/voice-server/heartbeat.py

@@ -315,6 +315,7 @@ async def _run_heartbeat_session(
         permission_mode="bypassPermissions",
         include_partial_messages=True,
         max_thinking_tokens=0,
+        setting_sources=["user", "project", "local"],
     )
     client = ClaudeSDKClient(options=options)
     await client.connect()