5dc693aeaf
Huddle audio was embedded in the v0 desktop client, forcing other clients to duplicate its protocol and codec behavior. This extracts `buzz-audio-client` so v1 can depend on a pinned library revision without building the v0 application. The crate owns the bounded v2 audio handshake, roster parsing, wire format, Opus sender, and per-peer NetEQ jitter buffer. The v0 human and agent senders use it, and the desktop retains room admission, identity/signing, TLS policy, device routing, mute, and teardown. Receive decoding preserves v1's support for 120 ms Opus packets. No relay protocol changes, speech models, or model downloads are included. Docker builder stages include CMake because cargo-chef compiles the workspace dependency graph. Dependency security: Opus 0.4 replaces the unmaintained `audiopus_sys` backend with `opusic-sys`. NetEQ is pinned exactly to 0.8.3 because its published Rust sources never reference its declared ringbuf dependency. RUSTSEC-2026-0293 is documented as unreachable for this audited source, and a wrapper restriction rejects every other consumer of vulnerable ringbuf versions. Independent review confirmed the scope; re-audit/remove the exception when changing NetEQ. NetEQ 0.9.1 still declares ringbuf 0.3, so a version bump alone does not remove it. Local `cargo deny check` passes with this constrained exception. Validation: - All 21 shared-crate tests pass, including real loopback WebSocket authentication/cancellation, real Opus-to-NetEQ playback, malformed input, and 120 ms decoding. These tests are included in `just test-unit`. - Shared-crate, root workspace, and desktop Tauri Clippy pass; `just desktop-tauri-check` passes. - The desktop Tauri test workspace passes; native two-person listening/device checks remain separate. - All mandatory push checks pass at `d06bac5dc`, including the complete Rust unit gate and desktop workspace checks. Existing agent timing and relay log-capture tests failed under concurrent load, passed separately, and passed in the full serial test run; no tests or hooks were skipped. - One test-only fixture change allows cold Perl startup before the escaped-process test's inner timeout (2 seconds instead of 300 ms). Its independent 5-second watchdog, 300-second surviving pipe writer, and all assertions remain intact. All eight process-helper tests pass; independent review confirmed this still tests bounded drain completion. - Dependency inspection confirms the library brings in no desktop application, Tauri, identity store, relay server, or speech-model crates. - Independent source review found no correctness blockers. Draft: a native two-person call, mute/leave/cancellation, and microphone/speaker switching still need a runtime tryout and human review. Full `just ci` was stopped during the unrelated mobile toolchain download because of disk pressure; it is not a passing gate. Consumer integration is tracked in block/buzz-app#489. --------- Signed-off-by: kenny lopez <klopez4212@gmail.com>
Shared Huddle audio client
buzz-audio-client contains the Huddle v2 audio handshake, wire format, Opus
sender, and per-peer NetEQ jitter buffer used by Buzz desktop clients. It does
not depend on Tauri, the v0 desktop application, a relay server, identity stores,
or speech models. A consumer can select this package from a pinned block/buzz
Git revision without building the rest of the workspace.
The host validates the destination and supplies an asynchronous NIP-42 signer
to connection::connect. The crate bounds connection and admission, validates
the initial roster, and returns a socket owned by the host. Dropping the pending
future or socket releases it; the crate creates no detached tasks. Hosts retain
room creation, membership checks, mute, device routing, connection supervision,
and application teardown. Audio admission alone does not grant chat access.
AudioEncoder accepts up to 960 finite mono samples at 48 kHz and produces a
20 ms v2 packet. PeerJitterBuffer consumes the sequence/timestamp/Opus fields
from wire::parse_relay_frame and produces 480 samples per 10 ms playout tick.
Hosts maintain one receiver per peer, discard its state on leave or roster
reassignment, bound playback queues, and stop idle peers after buffered audio
drains. V2 has no occupancy epoch in media, so a delayed packet from a previous
occupant cannot be distinguished after index reuse.
The default native-roots feature selects system TLS trust. Hosts that use
WebPKI roots select default-features = false, features = ["webpki-roots"];
hosts can also pass their configured TLS connector. Signing and trust policy
remain host-owned.
Opus 0.4 uses the maintained opusic-sys backend. NetEQ is pinned to 0.8.3:
its published source does not use its declared ringbuf dependency, which has
advisory RUSTSEC-2026-0293. The root security policy documents that unreachable
path and forbids other consumers of vulnerable ringbuf versions. Re-audit or
remove that exception when updating NetEQ; 0.9.1 still declares the old ringbuf.
Run cargo test -p buzz-audio-client and
cargo clippy -p buzz-audio-client --all-targets -- -D warnings from the root
with Hermit active. Tests use real loopback WebSockets and Opus audio, without a
live community or microphone. Client integration still requires a native
two-person call, mute, leave, cancellation, and device-switching tryout.
STT/TTS providers, model installation, and speech HTTP endpoints are intentionally outside this transport crate.