The pcap route awaited homer with no timeout and no tie to the client
connection, then used stream.pipe(res). If the client gave up (nginx 499)
before homer answered, the homer response body was piped into a closed
response, pipe() detached without destroying it, and the unread body kept
its socket and buffers referenced by the global undici pool forever.
With homer slow, this leaked roughly one socket per abandoned request:
~1,300 open fds and +200 MB RSS per api-server worker within four hours.
- abort the homer auth and pcap fetches when the response closes or after 30s
- use stream.pipeline() so the homer stream is destroyed if the client leaves
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
- add inworld-tts-2 and inworld-tts-2-flash to the Inworld model list
- both return word timestamps; flash is the low-latency/low-cost variant
- model_id is passed through unchanged, so no other wiring is needed
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
The speechmatics branch of the /test route destructured only api_key out of the
decrypted credential, so testSpeechmaticsStt() passed realtimeUrl: undefined to
the sdk. ConnectionConfigFull only applies an override when the value is truthy,
so every credential was silently tested against wss://eu2.rt.speechmatics.com/v2
no matter which region was stored - a neu or wus key was judged by whatever eu2
happened to answer.
- pass speechmatics_stt_uri through from the route
- normalize it before handing it to the sdk. The field holds a bare hostname,
which the sdk cannot use as-is: it appends the language, yielding
"eu2.rt.speechmatics.com/en" and ERR_INVALID_URL. At call time the same value
goes to mod_speechmatics_transcribe as SPEECHMATICS_HOST, which always
connects over wss on port 443 with a path of /v2, so build exactly that url.
Anything else - a full ws url, a port - now fails the test with an actionable
message rather than passing against an endpoint only the test can reach, and a
credential that has lost the field fails too: the feature server omits
SPEECHMATICS_HOST when it is unset and the module refuses the session, so
defaulting to a hosted region here would show a green check on a dead
credential.
- record the speechmatics STT result with sttTestResult(), not ttsTestResult(),
which is what every other STT vendor in this file does; the tts column was
being stamped for an STT-only vendor
Adds coverage for the url building to the main test suite - it is the part of
this that can be exercised without an api key.
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
- Add precondition support to decorate.js retrieve function
- Fix google-custom-voices.js typo and add delete precondition
- Check ownership via speech_credential for google-custom-voices
- Add retrieve/delete preconditions to lcr-carrier-set-entries.js
- Add retrieve precondition to sip-gateways.js and smpp-gateways.js
- Add scope check to lcr-routes.js custom GET handler
- Add full authorization to tenants.js for all CRUD operations
- Add scoped query methods to tenant model
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Added media_path to the list of allowed properties for call updates via REST API.
Includes validation to ensure media_path values are one of: no-media, partial-media, or full-media.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
