jencryzthers · Oct 3, 2026 · Sep 15, 2026 · Sep 15, 2026 · Sep 15, 2026 · Sep 15, 2026
@@ -17,12 +17,14 @@ permissions:
   contents: read
 
 concurrency:
-  # A new PR push supersedes that PR's older checks. Every main commit gets
-  # its own group and finishes: when main pushes cancelled each other, no
-  # main run completed for a day and a release shipped with no verdict
-  # (release.yml now waits for this workflow's `CI` check on its commit).
-  # Merge-queue runs stay protected on their own refs.
-  group: ci-${{ github.event_name == 'merge_group' && github.event.merge_group.head_ref || github.event_name == 'push' && github.sha || github.ref }}
+  # A new PR push supersedes that PR's older checks. Main keeps one run going
+  # and one waiting: each merge replaces the waiting run, so a burst of
+  # merges costs two full runs, not one per merge (fifteen queued behind each
+  # other in October 2026). The running one always finishes. A release runs
+  # CI on its own commit in a release-ci/v<version> lane when main's run for
+  # it was replaced (scripts/release-ci.mjs). Merge-queue runs stay on their
+  # own refs.
+  group: ci-${{ github.event_name == 'merge_group' && github.event.merge_group.head_ref || github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
@@ -91,10 +93,9 @@ jobs:
         shard: [1, 2, 3, 4]
     runs-on: ${{ matrix.os }}
     # vitest splits by file count, not by duration, so the shard holding the
-    # heavy e2e files ran 13 minutes on macOS/Ubuntu and 19 on Windows with
-    # three shards; four keeps the heaviest near 10 and 15. The cap catches a
-    # hang, not normal growth: raise it with the suite, or add a shard.
-    timeout-minutes: ${{ matrix.os == 'windows-latest' && 25 || 20 }}
+    # heavy e2e files exceeds 20 minutes on macOS and 25 on Windows with
+    # tests still progressing. The cap catches a hang, not normal suite growth.
+    timeout-minutes: ${{ matrix.os == 'ubuntu-latest' && 20 || 35 }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: pnpm/action-setup@ff378ebe6b225b0680b81c1ad4498ae0d1d3a5e3 # v6.0.10
@@ -352,16 +353,32 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      # A repo without the secret (a fork, or before the token is created)
+      # skips the deploy with a warning instead of failing every main push.
+      - id: token
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+        run: |
+          if [ -n "$CLOUDFLARE_API_TOKEN" ]; then
+            echo "present=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "::warning title=Composio broker not deployed::CLOUDFLARE_API_TOKEN is not set, so the broker Worker was not deployed."
+          fi
+      - if: steps.token.outputs.present == 'true'
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: pnpm/action-setup@ff378ebe6b225b0680b81c1ad4498ae0d1d3a5e3 # v6.0.10
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - if: steps.token.outputs.present == 'true'
+        uses: pnpm/action-setup@ff378ebe6b225b0680b81c1ad4498ae0d1d3a5e3 # v6.0.10
+      - if: steps.token.outputs.present == 'true'
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
           cache: pnpm
-      - run: pnpm install --frozen-lockfile
+      - if: steps.token.outputs.present == 'true'
+        run: pnpm install --frozen-lockfile
       - name: Deploy the composio broker Worker via Wrangler
+        if: steps.token.outputs.present == 'true'
         uses: cloudflare/wrangler-action@v3
         with:
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}

@@ -105,48 +105,38 @@ jobs:
 
   ci:
     # Ship only a commit whose own `CI` check (ci.yml's gate) passed. The wait
-    # overlaps the platform builds, so a green commit costs no time; a red,
-    # cancelled or missing check stops the release before any draft exists.
-    # 0.1.79 and 0.1.90 shipped commits whose main runs never finished.
+    # overlaps the platform builds, so a green commit costs no time; a red or
+    # missing verdict stops the release before any draft exists. Main keeps
+    # one CI run going and one waiting, so a burst of merges can replace the
+    # release commit's own run: scripts/release-ci.mjs then runs CI on the
+    # commit in its own lane (a release-ci/v<version> branch no merge can
+    # touch) and deletes that branch afterwards.
     name: CI passed on the release commit
     needs: prepare
     if: needs.prepare.outputs.should_release == 'true'
     runs-on: ubuntu-24.04
     timeout-minutes: 180
     permissions:
-      actions: read
+      # read CI runs and start CI in the release lane
+      actions: write
+      # create and delete the release-ci/v<version> branch
+      contents: write
     steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          sparse-checkout: scripts/release-ci.mjs
+          sparse-checkout-cone-mode: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24
       - name: Wait for the CI check on the pinned commit
         if: ${{ !inputs.ship_without_ci }}
         env:
           GH_TOKEN: ${{ github.token }}
           SHA: ${{ needs.prepare.outputs.sha }}
-        run: |
-          # push = a merge on main; merge_group = the queue's commit that
-          # becomes main; workflow_dispatch = a manual CI run of this commit.
-          # A pull_request run tests a merge ref, not this exact commit.
-          started=$SECONDS
-          while :; do
-            run=$(gh api "repos/$GITHUB_REPOSITORY/actions/workflows/ci.yml/runs?head_sha=$SHA&per_page=50" \
-              --jq '[.workflow_runs[] | select(.event == "push" or .event == "merge_group" or .event == "workflow_dispatch")] | sort_by(.created_at) | last | select(. != null) | "\(.id) \(.status)"')
-            if [ -z "$run" ]; then
-              if [ $((SECONDS - started)) -gt 900 ]; then
-                echo "::error::No CI run exists for $SHA. Run CI on it (Actions → CI → Run workflow on main while main is at this commit), then re-run this job."
-                exit 1
-              fi
-            else
-              set -- $run
-              if [ "$2" = completed ]; then
-                gate=$(gh api "repos/$GITHUB_REPOSITORY/actions/runs/$1/jobs?per_page=100" --jq '.jobs[] | select(.name == "CI") | .conclusion')
-                echo "CI run $1 on $SHA: gate ${gate:-missing}"
-                [ "$gate" = success ] && exit 0
-                echo "::error::The CI check on $SHA did not pass (${gate:-no gate job}). Fix main or re-run CI ($GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$1), then re-run this job."
-                exit 1
-              fi
-              echo "CI run $1 on $SHA is $2; waiting"
-            fi
-            sleep 60
-          done
+          VERSION: ${{ needs.prepare.outputs.version }}
+        run: node scripts/release-ci.mjs
 
   mac:
     name: macOS arm64 + x64 (sign, notarize, staple)

diff --git a/AGENTS.md b/AGENTS.md
@@ -1118,8 +1118,8 @@ it after an upstream merge instead of renaming by hand.
 
 ## Upstream sync
 
-Last sync: 2026-10-01, upstream `milind-soni/OpenMausBot` main at
-`4ed952aa` (0.1.92) merged into Sagax; `baseVersion` follows it. To repeat:
+Last sync: 2026-10-03, upstream `milind-soni/OpenMausBot` main at
+`ff01be8a` (0.1.94) merged into Sagax; `baseVersion` follows it. To repeat:
 
 - Keep the `upstream` remote fetch-only (`git remote set-url --push
   upstream no_push`). Never push, open a pull request or file an issue

diff --git a/NOTICE b/NOTICE
@@ -19,6 +19,16 @@ directory was removed and none of its source or license check is included;
 files across the tree were modified. These changes are licensed under the
 PolyForm Noncommercial License 1.0.0, not the Apache License 2.0.
 
+The Android companion app bundles a prebuilt WebRTC library for Live calls
+(io.github.webrtc-sdk:android), built from the WebRTC project, Copyright (c)
+2011, The WebRTC project authors, used under the BSD 3-Clause License. WebRTC
+includes third-party components under their own licenses, listed with the
+library.
+
+Selected provider icon paths are from Simple Icons, used under CC0 1.0.
+The Cohere provider icon path is from Lobe Icons, Copyright 2023 LobeHub,
+used under the MIT License.
+
 The OpenMausBot name and mascot are trademarks of Milind Soni. This product
 does not use those marks as its name. Apache License 2.0 section 6 does not
 grant trademark rights.
@@ -31,3 +41,13 @@ quantized to int8 by Pulsatrix Technologies inc. Licenses are in
 third_party/onnxruntime-web, third_party/silero-vad, third_party/3d-speaker
 and third_party/sherpa-onnx; details and checksums in
 src/lib/voice-mode/models/NOTICE.txt.
+
+The browser desktop viewer bundles the unmodified noVNC 1.7.0 library,
+Copyright the noVNC authors, under MPL-2.0 and its accompanying licenses.
+Attribution, license terms and the corresponding source location are in
+public/novnc-NOTICE.txt (novnc-NOTICE.txt in the built UI).
+
+The iOS companion app bundles a prebuilt WebRTC library for Live calls
+(stasel/WebRTC), built from the WebRTC project, Copyright (c) 2011, The WebRTC
+project authors, used under the BSD 3-Clause License. WebRTC includes
+third-party components under their own licenses, listed with the library.
diff --git a/README.md b/README.md
@@ -278,13 +278,13 @@ server"). For a solo server on a VPS, see
 
 Most settings live in the app (Settings). The server also reads environment
 variables. Names start with `SAGAX_`; the old `OMB_*`, `OPENMAUSBOT_*` and
-`OPENMAUS_*` names are still read and moved onto `SAGAX_*` at start, for one
+`SAGAX_*` names are still read and moved onto `SAGAX_*` at start, for one
 release. Some deployment files (`.env.example`, `compose.yaml`, `deploy/`)
-still use the `OMB_*` names on purpose.
+still use the `SAGAX_*` names on purpose.
 
 | Variable | Default | What it does |
 |---|---|---|
-| `SAGAX_DATA_DIR` | `~/.sagax` | Where bots, conversations and settings live. An old `~/.openmausbot` moves there on first start. |
+| `SAGAX_DATA_DIR` | `~/.sagax` | Where bots, conversations and settings live. An old `~/.sagax` moves there on first start. |
 | `SAGAX_PORT` | `8799` | Port of the Sagax server (127.0.0.1). |
 | `SAGAX_WEBHOOK_PORT` | `SAGAX_PORT` + 1 | Port of the webhook receiver for routines. |
 | `SAGAX_PUBLIC_URL` | none | The server's public address, used in links and sign-in. |
@@ -362,11 +362,11 @@ bundling it, needs a license from Pulsatrix Technologies inc. See
 
 Sagax is based on OpenMausBot, Copyright 2026 Milind Soni and OpenMausBot
 contributors, under the [Apache License 2.0](LICENSE-APACHE). The parts that
-come unchanged from OpenMausBot stay under Apache 2.0; the changes and
+come unchanged from Sagax stay under Apache 2.0; the changes and
 additions made by Pulsatrix Technologies inc. are under the PolyForm
 Noncommercial License only. Copies published before 2026-10-02 under Apache
-2.0 keep that license. The OpenMausBot notices are kept in [NOTICE](NOTICE).
-The OpenMausBot name and mascot are trademarks of Milind Soni and are not this
+2.0 keep that license. The Sagax notices are kept in [NOTICE](NOTICE).
+The Sagax name and mascot are trademarks of Milind Soni and are not this
 product's name. The source-available `enterprise/` directory of the original
 project is not part of this tree.
 

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
@@ -205,6 +205,12 @@ kotlin {
 
 dependencies {
     implementation(project(":core"))
+    // Live calls: a prebuilt libwebrtc (BSD-3), the phone's own audio path to
+    // OpenAI GPT-Live. Only `audio/WebRtcLiveCallTransport.kt` may import
+    // `org.webrtc` (LiveCallNativeIsolationTest pins it), so the JVM suite
+    // never loads libjingle_peerconnection_so. Measured 2026-09-25: +53 MB on
+    // the universal debug APK (four ABIs); +12 MB on an arm64 phone.
+    implementation("io.github.webrtc-sdk:android:150.7871.01")
 
     val composeBom = platform("androidx.compose:compose-bom:2025.10.01")
     implementation(composeBom)

diff --git a/android/app/src/main/AndroidManifest.xml b/android/app/src/main/AndroidManifest.xml
@@ -30,11 +30,18 @@
         android:name="android.hardware.camera.autofocus"
         android:required="false" />
     <!--
-      Composer dictation only. Asked at the mic button, never at startup — the
-      app is fully usable without it, and the IME's own mic is not a substitute
-      for this lifecycle (frozen base, partials, teardown).
+      Composer dictation and Live calls. Asked at the mic button or when a
+      call starts, never at startup — the app is fully usable without it, and
+      the IME's own mic is not a substitute for this lifecycle (frozen base,
+      partials, teardown).
     -->
     <uses-permission android:name="android.permission.RECORD_AUDIO" />
+    <!--
+      Live calls route the voice to the speaker or the earpiece through
+      AudioManager (MODE_IN_COMMUNICATION, setCommunicationDevice). A normal
+      permission, granted at install; the WebRTC AAR declares none itself.
+    -->
+    <uses-permission android:name="android.permission.MODIFY_AUDIO_SETTINGS" />
     <uses-feature
         android:name="android.hardware.microphone"
         android:required="false" />

diff --git a/android/app/src/main/kotlin/com/openmausbot/companion/MainActivity.kt b/android/app/src/main/kotlin/com/openmausbot/companion/MainActivity.kt
@@ -179,6 +179,7 @@ class MainActivity : ComponentActivity() {
             avatars = app.avatars,
             voicePreview = app.voicePreview,
             voiceNotes = app.voiceNotes,
+            liveCalls = app.liveCalls,
             dictation = dictation,
             chatDrafts = chatDrafts,
             requestPermissions = { permissions -> permissionRequests.request(permissions) },

diff --git a/android/app/src/main/kotlin/com/openmausbot/companion/OpenMausApp.kt b/android/app/src/main/kotlin/com/openmausbot/companion/OpenMausApp.kt
@@ -2,6 +2,7 @@ package com.openmausbot.companion
 
 import android.app.Application
 import androidx.lifecycle.ProcessLifecycleOwner
+import com.openmausbot.companion.audio.LiveCallManager
 import com.openmausbot.companion.audio.VoicePreviewPlayer
 import com.openmausbot.companion.audio.VoiceNotePlayer
 import com.openmausbot.companion.avatar.AvatarImageStore
@@ -57,6 +58,8 @@ class OpenMausApp : Application() {
         private set
     lateinit var voiceNotes: VoiceNotePlayer
         private set
+    lateinit var liveCalls: LiveCallManager
+        private set
     lateinit var linger: SessionLingerController
         private set
     lateinit var shareInbox: ShareInbox
@@ -89,8 +92,18 @@ class OpenMausApp : Application() {
             notificationSink = notifications,
         )
         avatars = AvatarImageStore(fetch = session::avatarData)
-        voicePreview = VoicePreviewPlayer(this)
-        voiceNotes = VoiceNotePlayer(this)
+        // Live calls hold media across screens, and end when the process
+        // leaves the foreground — not when a rotation recreates the Activity —
+        // so the manager is app-scoped and observes the process lifecycle, as
+        // the linger controller below does.
+        liveCalls = LiveCallManager(this, session, appScope)
+        ProcessLifecycleOwner.get().lifecycle.addObserver(liveCalls)
+        // A voice note or a voice preview asks for the audio focus, and the
+        // call ends when it loses that focus: both players refuse while the
+        // call holds the audio, whatever asks them to play.
+        val liveCallHoldsAudio = { liveCalls.state.value.holdsMedia }
+        voicePreview = VoicePreviewPlayer(this, liveCallHoldsAudio = liveCallHoldsAudio)
+        voiceNotes = VoiceNotePlayer(this, liveCallHoldsAudio = liveCallHoldsAudio)
 
         // iOS resets the avatar cache inside signOut. Observe Unpaired here so
         // the platform cache cannot outlive the pairing that minted its URLs.

diff --git a/android/app/src/main/kotlin/com/openmausbot/companion/audio/LiveCallApi.kt b/android/app/src/main/kotlin/com/openmausbot/companion/audio/LiveCallApi.kt
@@ -0,0 +1,51 @@
+package com.openmausbot.companion.audio
+
+import com.openmausbot.companion.core.LiveCallStart
+import com.openmausbot.companion.core.LiveCallState
+import com.openmausbot.companion.core.Session
+import kotlinx.coroutines.flow.Flow
+import kotlinx.coroutines.flow.combine
+import kotlinx.coroutines.flow.distinctUntilChanged
+import kotlinx.coroutines.flow.map
+
+/** The two calls and the reports a Live call needs from the computer. [Session] in production, a fake in tests. */
+interface LiveCallApi {
+    suspend fun start(botId: String, threadId: String, sdp: String): LiveCallStart
+
+    suspend fun end(callId: String)
+
+    /** The computer's current call as the `live.call` frames and `GET /api/live/call` report it. */
+    val serverCall: Flow<LiveCallState?>
+
+    /**
+     * Which computer this phone follows, and whether its pairing still
+     * stands. A call belongs to the computer it started on: losing the
+     * pairing hangs it up, and switching computers leaves it behind.
+     */
+    val link: Flow<LiveCallLink>
+}
+
+/**
+ * [computerId] is the paired computer's connection id, null while none is
+ * selected; [signedIn] is false once the pairing is gone or its token is
+ * refused (`Session.Status.Unpaired` or `Unauthorized`).
+ */
+data class LiveCallLink(val computerId: String?, val signedIn: Boolean)
+
+internal class SessionLiveCallApi(private val session: Session) : LiveCallApi {
+    override suspend fun start(botId: String, threadId: String, sdp: String): LiveCallStart =
+        session.startLiveCall(botId, threadId, sdp)
+
+    override suspend fun end(callId: String) {
+        session.endLiveCall(callId)
+    }
+
+    override val serverCall: Flow<LiveCallState?> = session.state.map { it.liveCall }.distinctUntilChanged()
+
+    override val link: Flow<LiveCallLink> = combine(session.connection, session.status) { connection, status ->
+        LiveCallLink(
+            computerId = connection?.id,
+            signedIn = status !is Session.Status.Unpaired && status !is Session.Status.Unauthorized,
+        )
+    }.distinctUntilChanged()
+}