mod_earshot 0.3.0

Security hardening of the agent control channel, a concurrency fix that keeps audio smooth under load, and a batch of reliability + robustness fixes.

⚠️ Security — control channel. If you use the opt-in control channel (commands=), upgrade: this release closes a command-injection → RCE class. Default deployments (no commands=) were never exposed.

Security

• Control-channel argument validation (es_cmdguard): rejects FreeSWITCH's app::args exec form, the inline dialplan, .. path traversal, whitespace positional-injection, and exec-triggering variables; blocked attempts are recorded in the earshot::command audit.
• Per-action commands= allowlist (commands=play,hangup) — enabling one action no longer grants transfer/setvar/record.
• setvar is fail-closed behind a setvars=<name,...> name allowlist (nothing settable by default).

Changed

• Control-channel commands run on a worker pool, not the WebSocket service thread — a blocking uuid_transfer/bridge/record/broadcast no longer stalls audio for other calls sharing that thread. A call's commands keep their submission order.

Fixed

• Use-after-free racing the command result-echo against media-bug teardown (per-stream lock + fresh session relocation).
• WebSocket receive path now gates on suppress_events, closing an orphan-teardown window where a late frame could touch a freed play buffer.
• Negative reconnect jitter (unsigned modulo).
• Mark-queue leak when the 64-deep queue is full.

Added

• Start-option robustness — ES_MAX_ARGV 16 → 48 so the full documented option set parses (a list past the 13th option was silently mis-parsed), plus a token-limit warning.
• Warnings on unrecognized start options (key only, never the value) and on unsupported stereo/mixed audio_stream mix-types.
• Memory & capacity guidance in docs/ARCHITECTURE.md (per-stream play buffer ≤ 2 MB, per-session greeting PCM ≤ ~1.4 MB).

Build / CI

• Module now compiles against real FreeSWITCH on same-repo PRs; the .deb/module build job fixed; malformed-input fuzzing for es_proto_on_text.

Artifacts: mod_earshot.so + mod-earshot_0.3.0_amd64.deb for FreeSWITCH 1.10 and 1.11.

Full details in CHANGELOG.md.