fix(notifications): fix CI and address speech narration review feedback

- Add enqueueSpeech to the cloud-task-update notification test harness deps
  so SessionService no longer throws "enqueueSpeech is not a function".
- Allowlist the host-resident ElevenLabs speech service (the API key stays
  in the host process, matching secure-store/encryption), fixing the host
  boundary check.
- composeUtterance: run the task-prefix guard before greeting injection so
  an already-prefixed agent line can't be double-prefixed when addressing by
  name; add a regression test.
- Key speakCalls by taskRunId so a session teardown drops any speak calls
  still mid-stream instead of leaking them until reset().

Generated-By: PostHog Code
Task-Id: 3553940c-2b6e-41dd-bc02-27f5df786a29

Author: jonmcwest

packages/core/src/sessions/cloudTaskUpdateNotifications.test.ts

@@ -125,6 +125,7 @@ function createHarness() {
   let onUpdate: ((update: CloudTaskUpdatePayload) => void) | undefined;
   const notifyPromptComplete = vi.fn();
   const notifyPermissionRequest = vi.fn();
+  const enqueueSpeech = vi.fn();
   const markActivity = vi.fn();
   const noopLog = {
     info: vi.fn(),
@@ -138,6 +139,7 @@ function createHarness() {
     log: noopLog,
     notifyPromptComplete,
     notifyPermissionRequest,
+    enqueueSpeech,
     taskViewedApi: { markActivity },
     getPersistedConfigOptions: () => undefined,
     setPersistedConfigOptions: vi.fn(),

packages/core/src/sessions/sessionService.ts

@@ -557,9 +557,12 @@ export class SessionService {
   // accumulate their latest args; enqueue once the call reaches a terminal
   // status (full text), then delete the entry — which also dedupes re-fires.
   // A `null` value means "identified as speak, args not streamed in yet".
+  // Keyed by taskRunId first so a session teardown can drop any of its
+  // still-streaming speak calls (see unsubscribeFromChannel); the inner map is
+  // keyed by toolCallId.
   private speakCalls = new Map<
     string,
-    { text: string; kind: SpeechKind } | null
+    Map<string, { text: string; kind: SpeechKind } | null>
   >();
   // When the agent last narrated `done`/`needs_input` per task run (event ts).
   // The deterministic completion/needs-input backstops compare this against the
@@ -1680,6 +1683,9 @@ export class SessionService {
     this.subscriptions.delete(taskRunId);
     this.liveTurnContent.delete(taskRunId);
     this.agentSpokeAt.delete(taskRunId);
+    // Drop any speak calls still mid-stream for this run (never reached a
+    // terminal status, so they were never enqueued or deleted above).
+    this.speakCalls.delete(taskRunId);
   }
 
   /**
@@ -2064,17 +2070,21 @@ export class SessionService {
         };
         const id = update.toolCallId;
         if (id) {
+          const speakCalls = this.speakCalls.get(taskRunId);
           // Only the top-level agent narrates. A `speak` from a sub-agent
           // (spawned via the Task tool) carries a parentToolCallId; ignoring
           // those prevents several sub-agents talking over each other.
           if (
             update._meta?.claudeCode?.toolName === SPEAK_TOOL_QUALIFIED_NAME &&
             !update._meta.claudeCode.parentToolCallId &&
-            !this.speakCalls.has(id)
+            !speakCalls?.has(id)
           ) {
-            this.speakCalls.set(id, null);
+            const calls = speakCalls ?? new Map();
+            calls.set(id, null);
+            this.speakCalls.set(taskRunId, calls);
           }
-          if (this.speakCalls.has(id)) {
+          const calls = this.speakCalls.get(taskRunId);
+          if (calls?.has(id)) {
             // Accumulate the latest args — text grows across streamed updates.
             const text = update.rawInput?.text;
             if (typeof text === "string" && text.trim().length > 0) {
@@ -2085,13 +2095,14 @@ export class SessionService {
                 rawKind === "progress"
                   ? rawKind
                   : "progress";
-              this.speakCalls.set(id, { text, kind });
+              calls.set(id, { text, kind });
             }
             // Speak only once the call is complete (full text). Deleting the
             // entry both frees it and dedupes any later terminal event.
-            const pending = this.speakCalls.get(id);
+            const pending = calls.get(id);
             if (isTerminalStatus(update.status) && pending) {
-              this.speakCalls.delete(id);
+              calls.delete(id);
+              if (calls.size === 0) this.speakCalls.delete(taskRunId);
               if (pending.kind !== "progress") {
                 const spoke = this.agentSpokeAt.get(taskRunId) ?? {
                   needs_input: 0,

packages/core/src/speech/composeUtterance.test.ts

@@ -76,6 +76,18 @@ describe("composeUtterance", () => {
     ).toBe("PostHog Code task 'x' — already prefixed");
   });
 
+  it("does not double-prefix even when addressing by name", () => {
+    expect(
+      composeUtterance({
+        text: "PostHog Code task 'x' — already prefixed",
+        taskTitle: "y",
+        needsUser: true,
+        addressByName: true,
+        firstName: "Jon",
+      }),
+    ).toBe("PostHog Code task 'x' — already prefixed");
+  });
+
   it("truncates a long task title", () => {
     const long = "a".repeat(60);
     const out = composeUtterance({ text: "hi", taskTitle: long });

packages/core/src/speech/composeUtterance.ts

@@ -39,15 +39,18 @@ export function composeUtterance({
 }: ComposeInput): string {
   let body = text.trim();
 
+  // Agent already prefixed with a task reference — return it verbatim. Checked
+  // before any greeting logic so the guard stays order-independent: injecting
+  // "Hey <name>," first would push the prefix past the start of the string and
+  // defeat this test, producing a double prefix.
+  if (/^\s*posthog code task/i.test(body)) return body;
+
   if (needsUser && addressByName && firstName) {
     // Normalize any leading greeting the agent added, then address by real name.
     body = body.replace(/^\s*hey\b[\s,]*/i, "").trimStart();
     body = `Hey ${firstName}, ${body}`;
   }
 
-  // Agent already prefixed with a task reference — don't double it.
-  if (/^\s*posthog code task/i.test(body)) return body;
-
   const title = taskTitle.trim();
   if (!title) return body;
   const shortTitle =

scripts/host-boundary-allowlist.json

@@ -34,6 +34,9 @@
     "apps/code/src/main/services/secure-store/service.ts": [
       "injectable-outside-host"
     ],
+    "apps/code/src/main/services/speech/service.ts": [
+      "injectable-outside-host"
+    ],
     "apps/code/src/main/services/workspace-server/service.ts": [
       "injectable-outside-host"
     ],