From 282c0ffa9c2c9eba0f3299513b8dc2befdab1194 Mon Sep 17 00:00:00 2001
From: James Ketrenos <james_git@ketrenos.com>
Date: Mon, 1 Sep 2025 13:18:17 -0700
Subject: [PATCH] Worked once

---
 Dockerfile.voicebot               |   46 ++
 client/src/App.tsx                |   21 +-
 client/src/MediaControl.tsx       |   55 +-
 client/src/UserList.tsx           |   13 +-
 docker-compose.yml                |    6 +-
 server/main.py                    |  406 ++++++++--
 voicebot/entrypoint.sh            |   17 +-
 voicebot/logger.py                |  124 ++++
 voicebot/main.py                  | 1149 ++++++++++++++++++++++++-----
 voicebot/pyproject.toml           |   20 +
 voicebot/scripts/reload_runner.py |  161 ++++
 11 files changed, 1753 insertions(+), 265 deletions(-)
 create mode 100644 Dockerfile.voicebot
 create mode 100644 voicebot/logger.py
 create mode 100644 voicebot/pyproject.toml
 create mode 100644 voicebot/scripts/reload_runner.py

diff --git a/Dockerfile.voicebot b/Dockerfile.voicebot
new file mode 100644
index 0000000..d705d9d
--- /dev/null
+++ b/Dockerfile.voicebot
@@ -0,0 +1,46 @@
+FROM ubuntu:plucky
+
+# Install some utilities frequently used
+RUN apt-get update \
+    && DEBIAN_FRONTEND=noninteractive apt-get install -y \
+    curl \
+    gpg \
+    iputils-ping \
+    jq \
+    nano \
+    rsync \ 
+    wget \
+    python3 \
+    python3-pip \
+    # python3-venv \
+    # python3-dev \
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/{apt,dpkg,cache,log}
+
+# Install packages required for voicebot
+RUN apt-get update \
+    && DEBIAN_FRONTEND=noninteractive apt-get install -y \
+    libgl1 \
+    libglib2.0-0t64 \
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/{apt,dpkg,cache,log}
+
+
+# Install uv using the official Astral script
+RUN curl -Ls https://astral.sh/uv/install.sh | bash
+ENV PATH=/root/.local/bin:$PATH
+
+WORKDIR /voicebot
+
+# Copy code and entrypoint
+COPY ./voicebot /voicebot
+COPY ./voicebot/entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
+
+# Set environment variable for production mode (default: development)
+ENV PRODUCTION=false
+
+# the cache and target directories are on different filesystems, hardlinking may not be supported.
+ENV UV_LINK_MODE=copy
+
+ENTRYPOINT ["/entrypoint.sh"]
diff --git a/client/src/App.tsx b/client/src/App.tsx
index 07648a1..5bd0d01 100644
--- a/client/src/App.tsx
+++ b/client/src/App.tsx
@@ -5,7 +5,7 @@ import { Session } from "./GlobalContext";
 import { UserList } from "./UserList";
 import "./App.css";
 import { ws_base, base } from "./Common";
-import { Box, Button } from "@mui/material";
+import { Box, Button, Tooltip } from "@mui/material";
 import { BrowserRouter as Router, Route, Routes, useParams } from "react-router-dom";
 import useWebSocket, { ReadyState } from "react-use-websocket";
 
@@ -28,9 +28,10 @@ const LobbyView: React.FC<LobbyProps> = (props: LobbyProps) => {
   const { lobbyName = "default" } = useParams<{ lobbyName: string }>();
   const [lobby, setLobby] = useState<Lobby | null>(null);
   const [editName, setEditName] = useState<string>("");
+  const [editPassword, setEditPassword] = useState<string>("");
   const [socketUrl, setSocketUrl] = useState<string | null>(null);
   const [creatingLobby, setCreatingLobby] = useState<boolean>(false);
-  
+
   const socket = useWebSocket(socketUrl, {
     onOpen: () => console.log("app - WebSocket connection opened."),
     onClose: () => console.log("app - WebSocket connection closed."),
@@ -125,7 +126,7 @@ const LobbyView: React.FC<LobbyProps> = (props: LobbyProps) => {
   const setName = (name: string) => {
     sendJsonMessage({
       type: "set_name",
-      data: { name },
+      data: { name, password: editPassword ? editPassword : undefined },
     });
   };
 
@@ -156,6 +157,10 @@ const LobbyView: React.FC<LobbyProps> = (props: LobbyProps) => {
               {!session.name && (
                 <Box sx={{ gap: 1, display: "flex", flexDirection: "column", alignItems: "flex-start" }}>
                   <Typography>Enter your name to join:</Typography>
+                  <Typography variant="caption">
+                    You can optionally set a password to reserve this name; supply it again to takeover the name from
+                    another client.
+                  </Typography>
                   <Box sx={{ display: "flex", gap: 1, width: "100%" }}>
                     <Input
                       type="text"
@@ -166,11 +171,21 @@ const LobbyView: React.FC<LobbyProps> = (props: LobbyProps) => {
                       onKeyDown={handleKeyDown}
                       placeholder="Your name"
                     />
+                    <Input
+                      type="password"
+                      value={editPassword}
+                      onChange={(e): void => setEditPassword(e.target.value)}
+                      placeholder="Optional password"
+                    />
+                    <Tooltip title="Optional: choose a short password to reserve this name. Keep it secret.">
+                      <span />
+                    </Tooltip>
                     <Button
                       variant="contained"
                       onClick={() => {
                         setName(editName);
                         setEditName("");
+                        setEditPassword("");
                       }}
                       disabled={!editName.trim()}
                     >
diff --git a/client/src/MediaControl.tsx b/client/src/MediaControl.tsx
index 11d5ad4..20c9a6b 100644
--- a/client/src/MediaControl.tsx
+++ b/client/src/MediaControl.tsx
@@ -13,6 +13,8 @@ import useWebSocket, { ReadyState } from "react-use-websocket";
 import { Session } from "./GlobalContext";
 
 const debug = true;
+// When true, do not send host candidates to the signaling server. Keeps TURN relays preferred.
+const FILTER_HOST_CANDIDATES = true;
 
 /* ---------- Synthetic Tracks Helpers ---------- */
 
@@ -426,9 +428,9 @@ const MediaAgent = (props: MediaAgentProps) => {
 
       // Create RTCPeerConnection
       const connection = new RTCPeerConnection({
+        iceTransportPolicy: "relay",
         iceServers: [
-          { urls: "stun:stun.l.google.com:19302" },
-          { urls: "stun:stun1.l.google.com:19302" },
+          { urls: "stun:ketrenos.com:3478" },
           {
             urls: "turns:ketrenos.com:5349",
             username: "ketra",
@@ -528,9 +530,22 @@ const MediaAgent = (props: MediaAgentProps) => {
 
       connection.addEventListener("icecandidateerror", (event: Event) => {
         const evt = event as RTCPeerConnectionIceErrorEvent;
-        if (evt.errorCode === 701) {
-          console.error(`media-agent - addPeer:${peer.peer_name} ICE candidate error for ${peer.peer_name}:`, evt);
-        }
+        // Try to extract candidate type from the hostCandidate string if present
+        const hostCand = (evt as any).hostCandidate || null;
+        const parseType = (candStr: string | null) => {
+          if (!candStr) return "unknown";
+          const m = /\btyp\s+(host|srflx|relay|prflx)\b/.exec(candStr);
+          return m ? m[1] : "unknown";
+        };
+        const hostType = parseType(hostCand);
+        console.error(`media-agent - addPeer:${peer.peer_name} ICE candidate error for ${peer.peer_name}:`, {
+          evt,
+          hostCandidate: hostCand,
+          hostType,
+          address: (evt as any).address,
+          port: (evt as any).port,
+          url: (evt as any).url,
+        });
       });
 
       connection.addEventListener("track", (event) => {
@@ -556,13 +571,29 @@ const MediaAgent = (props: MediaAgentProps) => {
         }, 1000);
       });
 
+      const _parseCandidateType = (candStr: string | null) => {
+        if (!candStr) return "eoc"; // end of candidates
+        const m = /\btyp\s+(host|srflx|relay|prflx)\b/.exec(candStr);
+        return m ? m[1] : "unknown";
+      };
+
       connection.onicecandidate = (event: RTCPeerConnectionIceEvent) => {
         if (!event.candidate) {
           console.log(`media-agent - addPeer:${peer.peer_name} ICE gathering complete: ${connection.connectionState}`);
           return;
         }
 
-        console.log(`media-agent - addPeer:${peer.peer_name} onicecandidate - `, event.candidate);
+        const raw = event.candidate?.candidate || null;
+        const candType = _parseCandidateType(raw);
+        console.log(`media-agent - addPeer:${peer.peer_name} onicecandidate - type=${candType}`, event.candidate);
+
+        // Optionally filter host candidates so we prefer TURN relays.
+        if (FILTER_HOST_CANDIDATES && candType === "host") {
+          console.log(`media-agent - addPeer:${peer.peer_name} onicecandidate - skipping host candidate`);
+          return;
+        }
+
+        // Send candidate to signaling server
         sendJsonMessage({
           type: "relayICECandidate",
           data: {
@@ -795,7 +826,17 @@ const MediaAgent = (props: MediaAgentProps) => {
     async (props: IceCandidateData) => {
       const { peer_id, peer_name, candidate } = props;
       const peer = peers[peer_id];
-      console.log(`media-agent - iceCandidate:${peer_name} - `, { peer_id, candidate, peer });
+      const parse = (candStr: string | null) => {
+        if (!candStr) return "eoc";
+        const m = /\btyp\s+(host|srflx|relay|prflx)\b/.exec(candStr);
+        return m ? m[1] : "unknown";
+      };
+      console.log(`media-agent - iceCandidate:${peer_name} - `, {
+        peer_id,
+        candidate,
+        peer,
+        candidateType: parse(candidate?.candidate || null),
+      });
 
       if (!peer?.connection) {
         console.error(`media-agent - iceCandidate:${peer_name} - No peer connection for ${peer_id}`);
diff --git a/client/src/UserList.tsx b/client/src/UserList.tsx
index 1453794..a5da1bc 100644
--- a/client/src/UserList.tsx
+++ b/client/src/UserList.tsx
@@ -12,6 +12,7 @@ type User = {
   session_id: string;
   live: boolean;
   local: boolean /* Client side variable */;
+  protected?: boolean;
 };
 
 type UserListProps = {
@@ -102,7 +103,17 @@ const UserList: React.FC<UserListProps> = (props: UserListProps) => {
             className={`UserEntry ${user.local ? "UserSelf" : ""}`}
           >
             <div>
-              <div className="Name">{user.name ? user.name : user.session_id}</div>
+              <div style={{ display: "flex", alignItems: "center" }}>
+                <div className="Name">{user.name ? user.name : user.session_id}</div>
+                {user.protected && (
+                  <div
+                    style={{ marginLeft: 8, fontSize: "0.8em", color: "#a00" }}
+                    title="This name is protected with a password"
+                  >
+                    🔒
+                  </div>
+                )}
+              </div>
               {user.name && !user.live && <div className="NoNetwork"></div>}
             </div>
             {user.name && user.live && peers[user.session_id] ? (
diff --git a/docker-compose.yml b/docker-compose.yml
index d86dd22..4e56c6d 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -50,11 +50,13 @@ services:
     environment:
       - PRODUCTION=${PRODUCTION:-false}
     restart: always
+    network_mode: host
     volumes:
       - ./voicebot:/voicebot:rw
       - ./voicebot/.venv:/voicebot/.venv:rw
-    networks:
-      - ai-voicebot-net
+#    network_mode: host
+#    networks:
+#      - ai-voicebot-net
 
 
 networks:
diff --git a/server/main.py b/server/main.py
index a1f1350..6f70861 100644
--- a/server/main.py
+++ b/server/main.py
@@ -15,11 +15,100 @@ import secrets
 import os
 import httpx
 import json
+import hashlib
+import binascii
 
 from pydantic import BaseModel
-
+from pydantic import ValidationError
 from logger import logger
 
+
+# Pydantic models for persisted data (sessions.json)
+class NamePasswordRecord(BaseModel):
+    salt: str
+    hash: str
+
+
+class LobbySaved(BaseModel):
+    id: str
+    name: str
+    private: bool = False
+
+
+class SessionSaved(BaseModel):
+    id: str
+    name: str = ""
+    lobbies: list[LobbySaved] = []
+
+
+class SessionsPayload(BaseModel):
+    sessions: list[SessionSaved] = []
+    name_passwords: dict[str, NamePasswordRecord] = {}
+
+
+# Response models for API endpoints
+class AdminNamesResponse(BaseModel):
+    name_passwords: dict[str, NamePasswordRecord]
+
+
+class AdminActionResponse(BaseModel):
+    status: Literal["ok", "not_found"]
+    name: str
+
+
+class HealthResponse(BaseModel):
+    status: str
+
+
+class LobbyListItem(BaseModel):
+    id: str
+    name: str
+
+
+class LobbiesResponse(BaseModel):
+    lobbies: list[LobbyListItem]
+
+
+class LobbyResponseModel(BaseModel):
+    id: str
+    name: str
+    private: bool
+
+
+class SessionResponse(BaseModel):
+    id: str
+    name: str
+    lobbies: list[LobbyResponseModel]
+
+
+class LobbyCreatedData(BaseModel):
+    id: str
+    name: str
+    private: bool
+
+
+class LobbyCreatedResponse(BaseModel):
+    type: Literal["lobby_created"]
+    data: LobbyCreatedData
+
+
+# Mapping of reserved names to password records (lowercased name -> {salt:..., hash:...})
+name_passwords: dict[str, dict[str, str]] = {}
+
+
+def _hash_password(password: str, salt_hex: str | None = None) -> tuple[str, str]:
+    """Return (salt_hex, hash_hex) for the given password. If salt_hex is provided
+    it is used; otherwise a new salt is generated."""
+    if salt_hex:
+        salt = binascii.unhexlify(salt_hex)
+    else:
+        salt = secrets.token_bytes(16)
+        salt_hex = binascii.hexlify(salt).decode()
+    dk = hashlib.pbkdf2_hmac("sha256", password.encode("utf-8"), salt, 100000)
+    hash_hex = binascii.hexlify(dk).decode()
+    return salt_hex, hash_hex
+
+
 public_url = os.getenv("PUBLIC_URL", "/")
 if not public_url.endswith("/"):
     public_url += "/"
@@ -28,6 +117,55 @@ app = FastAPI()
 
 logger.info(f"Starting server with public URL: {public_url}")
 
+# Optional admin token to protect admin endpoints
+ADMIN_TOKEN = os.getenv("ADMIN_TOKEN", None)
+
+
+def _require_admin(request: Request) -> bool:
+    if not ADMIN_TOKEN:
+        return True
+    token = request.headers.get("X-Admin-Token")
+    return token == ADMIN_TOKEN
+
+
+@app.get(public_url + "api/admin/names", response_model=AdminNamesResponse)
+def admin_list_names(request: Request):
+    if not _require_admin(request):
+        return Response(status_code=403)
+    return {"name_passwords": name_passwords}
+
+
+class AdminSetPassword(BaseModel):
+    name: str
+    password: str
+
+
+@app.post(public_url + "api/admin/set_password", response_model=AdminActionResponse)
+def admin_set_password(request: Request, payload: AdminSetPassword = Body(...)):
+    if not _require_admin(request):
+        return Response(status_code=403)
+    lname = payload.name.lower()
+    salt, hash_hex = _hash_password(payload.password)
+    name_passwords[lname] = {"salt": salt, "hash": hash_hex}
+    Session.save()
+    return {"status": "ok", "name": payload.name}
+
+
+class AdminClearPassword(BaseModel):
+    name: str
+
+
+@app.post(public_url + "api/admin/clear_password", response_model=AdminActionResponse)
+def admin_clear_password(request: Request, payload: AdminClearPassword = Body(...)):
+    if not _require_admin(request):
+        return Response(status_code=403)
+    lname = payload.name.lower()
+    if lname in name_passwords:
+        del name_passwords[lname]
+        Session.save()
+        return {"status": "ok", "name": payload.name}
+    return {"status": "not_found", "name": payload.name}
+
 
 class LobbyResponse(TypedDict):
     id: str
@@ -55,20 +193,30 @@ class Session:
 
     @classmethod
     def save(cls):
-        data: list[dict[str, str | list[LobbyResponse]]] = [
-            {
-                "id": s.id,
-                "name": s.name,
-                "lobbies": [
-                    {"id": lobby.id, "name": lobby.name, "private": lobby.private}
-                    for lobby in s.lobbies
-                ],
-            }
-            for s in cls._instances
-        ]
+        sessions_list: list[SessionSaved] = []
+        for s in cls._instances:
+            lobbies_list: list[LobbySaved] = [
+                LobbySaved(id=lobby.id, name=lobby.name, private=lobby.private)
+                for lobby in s.lobbies
+            ]
+            sessions_list.append(
+                SessionSaved(id=s.id, name=s.name or "", lobbies=lobbies_list)
+            )
+        # Prepare name password store for persistence (salt+hash). Only structured records are supported.
+        saved_pw: dict[str, NamePasswordRecord] = {
+            name: NamePasswordRecord(**record)
+            for name, record in name_passwords.items()
+        }
+
+        payload_model = SessionsPayload(sessions=sessions_list, name_passwords=saved_pw)
+        payload = payload_model.model_dump()
+
         with open(cls._save_file, "w") as f:
-            json.dump(data, f, indent=2)
-        logger.info(f"Saved {len(data)} sessions to {cls._save_file}")
+            json.dump(payload, f, indent=2)
+
+        logger.info(
+            f"Saved {len(sessions_list)} sessions and {len(saved_pw)} name passwords to {cls._save_file}"
+        )
 
     @classmethod
     def load(cls):
@@ -76,16 +224,29 @@ class Session:
             logger.info(f"No session save file found: {cls._save_file}")
             return
         with open(cls._save_file, "r") as f:
-            data = json.load(f)
-        for sdata in data:
-            session = Session(sdata["id"])
-            session.name = sdata["name"]
-            for lobby in sdata.get("lobbies", []):
+            raw = json.load(f)
+
+        try:
+            payload = SessionsPayload.model_validate(raw)
+        except ValidationError as e:
+            logger.exception(f"Failed to validate sessions payload: {e}")
+            return
+
+        # Populate in-memory structures from payload (no backwards compatibility code)
+        name_passwords.clear()
+        for name, rec in payload.name_passwords.items():
+            # rec is a NamePasswordRecord
+            name_passwords[name] = {"salt": rec.salt, "hash": rec.hash}
+
+        for s_saved in payload.sessions:
+            session = Session(s_saved.id)
+            session.name = s_saved.name or ""
+            for lobby_saved in s_saved.lobbies:
                 session.lobbies.append(
                     Lobby(
-                        name=lobby.get("name"),
-                        id=lobby.get("id"),
-                        private=lobby.get("private", False),
+                        name=lobby_saved.name,
+                        id=lobby_saved.id,
+                        private=lobby_saved.private,
                     )
                 )
             logger.info(
@@ -95,7 +256,10 @@ class Session:
                 lobbies[lobby.id] = Lobby(
                     name=lobby.name, id=lobby.id
                 )  # Ensure lobby exists
-        logger.info(f"Loaded {len(data)} sessions from {cls._save_file}")
+
+        logger.info(
+            f"Loaded {len(payload.sessions)} sessions and {len(name_passwords)} name passwords from {cls._save_file}"
+        )
 
     @classmethod
     def getSession(cls, id: str) -> Session | None:
@@ -117,6 +281,16 @@ class Session:
                 return False
         return True
 
+    @classmethod
+    def getSessionByName(cls, name: str) -> Optional["Session"]:
+        if not name:
+            return None
+        lname = name.lower()
+        for s in cls._instances:
+            if s.name and s.name.lower() == lname:
+                return s
+        return None
+
     def getName(self) -> str:
         return f"{self.short}:{self.name if self.name else unset_label}"
 
@@ -274,7 +448,14 @@ class Lobby:
 
     async def update_state(self, requesting_session: Session | None = None):
         users: list[dict[str, str | bool]] = [
-            {"name": s.name, "live": True if s.ws else False, "session_id": s.id}
+            {
+                "name": s.name,
+                "live": True if s.ws else False,
+                "session_id": s.id,
+                "protected": True
+                if s.name and s.name.lower() in name_passwords
+                else False,
+            }
             for s in self.sessions.values()
             if s.name
         ]
@@ -345,7 +526,7 @@ def getLobbyByName(lobby_name: str) -> Lobby | None:
 
 
 # API endpoints
-@app.get(f"{public_url}api/health")
+@app.get(f"{public_url}api/health", response_model=HealthResponse)
 def health():
     logger.info("Health check endpoint called.")
     return {
@@ -357,16 +538,20 @@ def health():
 # A user can be in multiple lobbies, but a session is unique to a single user.
 # A user can change their name, but the session ID remains the same and the name
 # updates for all lobbies.
-@app.get(f"{public_url}api/session")
+@app.get(f"{public_url}api/session", response_model=SessionResponse)
 async def session(
     request: Request, response: Response, session_id: str | None = Cookie(default=None)
-) -> dict[str, str | list[LobbyResponse]]:
+) -> Response | SessionResponse:
     if session_id is None:
         session_id = secrets.token_hex(16)
         response.set_cookie(key="session_id", value=session_id)
     # Validate that session_id is a hex string of length 32
     elif len(session_id) != 32 or not all(c in "0123456789abcdef" for c in session_id):
-        return {"error": "Invalid session_id"}
+        return Response(
+            content=json.dumps({"error": "Invalid session_id"}),
+            status_code=400,
+            media_type="application/json",
+        )
 
     print(f"[{session_id[:8]}]: Browser hand-shake achieved.")
 
@@ -388,25 +573,25 @@ async def session(
                 continue
             await session.part(lobby)
 
-    return {
-        "id": session_id,
-        "name": session.name if session.name else "",
-        "lobbies": [
-            {"id": lobby.id, "name": lobby.name, "private": lobby.private}
+    return SessionResponse(
+        id=session_id,
+        name=session.name if session.name else "",
+        lobbies=[
+            LobbyResponseModel(id=lobby.id, name=lobby.name, private=lobby.private)
             for lobby in session.lobbies
         ],
-    }
+    )
 
 
-@app.get(public_url + "api/lobby")
-async def get_lobbies(request: Request, response: Response):
-    return {
-        "lobbies": [
-            {"id": lobby.id, "name": lobby.name}
+@app.get(public_url + "api/lobby", response_model=LobbiesResponse)
+async def get_lobbies(request: Request, response: Response) -> LobbiesResponse:
+    return LobbiesResponse(
+        lobbies=[
+            LobbyListItem(id=lobby.id, name=lobby.name)
             for lobby in lobbies.values()
             if not lobby.private
         ]
-    }
+    )
 
 
 class LobbyCreateData(BaseModel):
@@ -419,20 +604,24 @@ class LobbyCreateRequest(BaseModel):
     data: LobbyCreateData
 
 
-@app.post(public_url + "api/lobby/{session_id}")
+@app.post(public_url + "api/lobby/{session_id}", response_model=LobbyCreatedResponse)
 async def lobby_create(
     request: Request,
     response: Response,
     session_id: str = Path(...),
     create_request: LobbyCreateRequest = Body(...),
-) -> dict[str, str | dict[str, str | bool | int]]:
+) -> Response | LobbyCreatedResponse:
     if create_request.type != "lobby_create":
         return {"error": "Invalid request type"}
 
     data = create_request.data
     session = getSession(session_id)
     if not session:
-        return {"error": f"Session not found ({session_id})"}
+        return Response(
+            content=json.dumps({"error": f"Session not found ({session_id})"}),
+            status_code=404,
+            media_type="application/json",
+        )
     logger.info(
         f"{session.getName()} lobby_create: {data.name} (private={data.private})"
     )
@@ -446,14 +635,10 @@ async def lobby_create(
         lobbies[lobby.id] = lobby
         logger.info(f"{session.getName()} <- lobby_create({lobby.short}:{lobby.name})")
 
-    return {
-        "type": "lobby_created",
-        "data": {
-            "id": lobby.id,
-            "name": lobby.name,
-            "private": lobby.private,
-        },
-    }
+    return LobbyCreatedResponse(
+        type="lobby_created",
+        data=LobbyCreatedData(id=lobby.id, name=lobby.name, private=lobby.private),
+    )
 
 
 all_label = "[   all  ]"
@@ -547,6 +732,7 @@ async def lobby_join(
                         )
                         continue
                     name = data.get("name")
+                    password = data.get("password")
                     logger.info(f"{session.getName()} <- set_name({name})")
                     if not name:
                         logger.error(f"{session.getName()} - Name required")
@@ -554,18 +740,124 @@ async def lobby_join(
                             {"type": "error", "error": "Name required"}
                         )
                         continue
-                    # Check for duplicate name
-                    if not Session.isUniqueName(name):
-                        logger.warning(f"{session.getName()} - Name already taken")
+                    # Name takeover / password logic
+                    lname = name.lower()
+
+                    # If name is unused, allow and optionally save password
+                    if Session.isUniqueName(name):
+                        # If a password was provided, save it (hash+salt) for this name
+                        if password:
+                            salt, hash_hex = _hash_password(password)
+                            name_passwords[lname] = {"salt": salt, "hash": hash_hex}
+                        session.setName(name)
+                        logger.info(f"{session.getName()}: -> update('name', {name})")
+                        await websocket.send_json(
+                            {
+                                "type": "update",
+                                "name": name,
+                                "protected": True
+                                if name.lower() in name_passwords
+                                else False,
+                            }
+                        )
+                        # For any clients in any lobby with this session, update their user lists
+                        await lobby.update_state()
+                        continue
+
+                    # Name is taken. Check if a password exists for the name and matches.
+                    saved_pw = name_passwords.get(lname)
+                    if not saved_pw:
+                        logger.warning(
+                            f"{session.getName()} - Name already taken (no password set)"
+                        )
                         await websocket.send_json(
                             {"type": "error", "error": "Name already taken"}
                         )
                         continue
 
+                    # Expect structured record with salt+hash only
+                    match_password = False
+                    # saved_pw should be a dict[str,str] with 'salt' and 'hash'
+                    salt = saved_pw.get("salt")
+                    _, candidate_hash = _hash_password(
+                        password if password else "", salt_hex=salt
+                    )
+                    if candidate_hash == saved_pw.get("hash"):
+                        match_password = True
+                    else:
+                        # No structured password record available
+                        match_password = False
+
+                    if not match_password:
+                        logger.warning(
+                            f"{session.getName()} - Name takeover attempted with wrong or missing password"
+                        )
+                        await websocket.send_json(
+                            {
+                                "type": "error",
+                                "error": "Invalid password for name takeover",
+                            }
+                        )
+                        continue
+
+                    # Password matches: perform takeover. Find the current session holding the name.
+                    # Find the currently existing session (if any) with that name
+                    displaced = Session.getSessionByName(name)
+                    if displaced and displaced.id == session.id:
+                        displaced = None
+
+                    # If found, change displaced session to a unique fallback name and notify peers
+                    if displaced:
+                        # Create a unique fallback name
+                        fallback = f"{displaced.name}-{displaced.short}"
+                        # Ensure uniqueness
+                        if not Session.isUniqueName(fallback):
+                            # append random suffix until unique
+                            while not Session.isUniqueName(fallback):
+                                fallback = f"{displaced.name}-{secrets.token_hex(3)}"
+
+                        displaced.setName(fallback)
+                        logger.info(
+                            f"{displaced.getName()} <- displaced by takeover, new name {fallback}"
+                        )
+                        # Notify displaced session (if connected)
+                        if displaced.ws:
+                            try:
+                                await displaced.ws.send_json(
+                                    {
+                                        "type": "update",
+                                        "name": fallback,
+                                        "protected": False,
+                                    }
+                                )
+                            except Exception:
+                                logger.exception(
+                                    "Failed to notify displaced session websocket"
+                                )
+                        # Update all lobbies the displaced session was in
+                        for d_lobby in list(displaced.lobbies):
+                            try:
+                                await d_lobby.update_state()
+                            except Exception:
+                                logger.exception(
+                                    "Failed to update lobby state for displaced session"
+                                )
+
+                    # Now assign the requested name to the current session
                     session.setName(name)
-                    logger.info(f"{session.getName()}: -> update('name', {name})")
-                    await websocket.send_json({"type": "update", "name": name})
-                    # For any clients in any lobby with this session, update their user lists
+                    logger.info(
+                        f"{session.getName()}: -> update('name', {name}) (takeover)"
+                    )
+                    await websocket.send_json(
+                        {
+                            "type": "update",
+                            "name": name,
+                            "protected": True
+                            if name.lower() in name_passwords
+                            else False,
+                        }
+                    )
+                    # Notify lobbies for this session
                     await lobby.update_state()
 
                 case "list_users":
diff --git a/voicebot/entrypoint.sh b/voicebot/entrypoint.sh
index f02f6f0..36a0bfc 100644
--- a/voicebot/entrypoint.sh
+++ b/voicebot/entrypoint.sh
@@ -19,4 +19,19 @@ export VIRTUAL_ENV=/voicebot/.venv
 export PATH="$VIRTUAL_ENV/bin:$PATH"
 
 # Launch voicebot in production or development mode
-exec uv run main.py
+if [ "$PRODUCTION" != "true" ]; then
+    echo "Starting voicebot in development mode with auto-reload..."
+    python3 scripts/reload_runner.py --watch . -- uv run main.py \
+        --insecure \
+        --server-url https://ketrenos.com/ai-voicebot \
+        --lobby default \
+        --session-name "Python Voicebot" \
+        --password "v01c3b0t"
+else
+    echo "Starting voicebot in production mode..."
+    exec uv run main.py \
+        --server-url https://ai-voicebot.ketrenos.com \
+        --lobby default \
+        --session-name "Python Voicebot" \
+        --password "v01c3b0t"
+fi
diff --git a/voicebot/logger.py b/voicebot/logger.py
new file mode 100644
index 0000000..54546a6
--- /dev/null
+++ b/voicebot/logger.py
@@ -0,0 +1,124 @@
+import os
+import warnings
+import logging
+import time
+from typing import Optional, Tuple
+
+logging_level = os.getenv("LOGGING_LEVEL", "INFO").upper()
+
+
+class RelativePathFormatter(logging.Formatter):
+    def __init__(
+        self,
+        fmt: Optional[str] = None,
+        datefmt: Optional[str] = None,
+        remove_prefix: Optional[str] = None,
+    ) -> None:
+        super().__init__(fmt, datefmt)
+        self.remove_prefix = remove_prefix or os.getcwd()
+        # Ensure the prefix ends with a separator
+        if not self.remove_prefix.endswith(os.sep):
+            self.remove_prefix += os.sep
+
+    def format(self, record: logging.LogRecord) -> str:
+        """Create a shallow copy of the record and rewrite the pathname
+        to be relative to the configured prefix. Defensive checks are used
+        to satisfy static type checkers.
+        """
+        # Make a copy of the record dict so we don't mutate the caller's record
+        record_dict = record.__dict__.copy()
+        new_record = logging.makeLogRecord(record_dict)
+
+        # Remove the prefix from pathname if present
+        pathname = getattr(new_record, "pathname", "")
+        if pathname.startswith(self.remove_prefix):
+            new_record.pathname = pathname[len(self.remove_prefix) :]
+
+        return super().format(new_record)
+
+
+def _setup_logging(level: str=logging_level) -> logging.Logger:
+    os.environ["TORCH_CPP_LOG_LEVEL"] = "ERROR"
+    warnings.filterwarnings(
+        "ignore", message="Overriding a previously registered kernel"
+    )
+    warnings.filterwarnings("ignore", message="Warning only once for all operators")
+    warnings.filterwarnings("ignore", message=".*Couldn't find ffmpeg or avconv.*")
+    warnings.filterwarnings("ignore", message="'force_all_finite' was renamed to")
+    warnings.filterwarnings("ignore", message="n_jobs value 1 overridden")
+    warnings.filterwarnings("ignore", message=".*websocket.*is deprecated")
+
+    logging.getLogger("aiortc").setLevel(logging.DEBUG)
+    logging.getLogger("aioice").setLevel(logging.DEBUG)
+    logging.getLogger("asyncio").setLevel(logging.DEBUG)
+
+    numeric_level = getattr(logging, level.upper(), None)
+    if not isinstance(numeric_level, int):
+        raise ValueError(f"Invalid log level: {level}")
+
+    # Create a custom formatter
+    formatter = RelativePathFormatter(
+        fmt="%(levelname)s - %(pathname)s:%(lineno)d - %(message)s",
+        datefmt="%Y-%m-%d %H:%M:%S",
+    )
+
+    # Create a handler (e.g., StreamHandler for console output)
+    handler = logging.StreamHandler()
+    handler.setFormatter(formatter)
+
+    # Simple repeat-suppression filter: if the exact same message (level+text)
+    # appears repeatedly within a short window, drop duplicates. This keeps
+    # the first occurrence for diagnostics but avoids log flooding from
+    # recurring asyncio/aioice stack traces.
+    class _RepeatFilter(logging.Filter):
+        def __init__(self, interval: float = 5.0) -> None:
+            super().__init__()
+            self._interval = interval
+            self._last: Optional[Tuple[int, str]] = None
+            self._last_time: float = 0.0
+
+        def filter(self, record: logging.LogRecord) -> bool:
+            try:
+                msg = record.getMessage()
+            except Exception:
+                # Fallback to a string representation if getMessage fails
+                msg = str(record)
+
+            key: Tuple[int, str] = (getattr(record, "levelno", 0), msg)
+            now = time.time()
+            if self._last == key and (now - self._last_time) < self._interval:
+                return False
+            self._last = key
+            self._last_time = now
+            return True
+
+    handler.addFilter(_RepeatFilter())
+
+    # Configure root logger
+    logging.basicConfig(
+        level=numeric_level,
+        handlers=[handler],  # Use only your handler
+        force=True,
+    )
+
+    # Set levels for noisy loggers
+    for noisy_logger in (
+        "uvicorn",
+        "uvicorn.error",
+        "uvicorn.access",
+        "fastapi",
+        "starlette",
+    ):
+        logger = logging.getLogger(noisy_logger)
+        logger.setLevel(logging.WARNING)
+        logger.handlers = []  # Remove default handlers
+        logger.addHandler(handler)  # Add your custom handler
+
+    logger = logging.getLogger(__name__)
+    return logger
+
+
+logger = _setup_logging(level=logging_level)
+logger.debug(f"Logging initialized with level: {logging_level}")
+
+
diff --git a/voicebot/main.py b/voicebot/main.py
index 12ccccc..ee75d4a 100644
--- a/voicebot/main.py
+++ b/voicebot/main.py
@@ -9,17 +9,148 @@ from __future__ import annotations
 
 import asyncio
 import json
-import logging
 import websockets
 import numpy as np
 import cv2
 import fractions
-from typing import Dict, Optional, Callable, Awaitable, TypedDict, Protocol, AsyncIterator, cast
+from typing import (
+    Dict,
+    Optional,
+    Callable,
+    Awaitable,
+    TypedDict,
+    Protocol,
+    AsyncIterator,
+    cast,
+    List,
+)
 
 from dataclasses import dataclass, field
-from aiortc import RTCPeerConnection, RTCSessionDescription, RTCIceCandidate, MediaStreamTrack
+from pydantic import BaseModel, ValidationError
+
+# types.SimpleNamespace removed — not used anymore after parsing candidates via aiortc.sdp
+import argparse
+import urllib.request
+import urllib.error
+import urllib.parse
+import ssl
+from aiortc import (
+    RTCPeerConnection,
+    RTCSessionDescription,
+    RTCIceCandidate,
+    MediaStreamTrack,
+)
 from av import VideoFrame, AudioFrame
 import time
+from logger import logger
+
+# Defensive monkeypatch: aioice Transaction.__retry may run after the
+# underlying datagram transport or loop was torn down which results in
+# AttributeError being raised and flooding logs. Wrap the original
+# implementation to catch and suppress AttributeError while preserving
+# other exceptions. This is a temporary mitigation to keep logs readable
+# while we investigate/upstream a proper fix or upgrade aioice.
+try:
+    import aioice.stun as _aioice_stun  # type: ignore
+
+    # The method is defined with a double-underscore name (__retry) which
+    # gets name-mangled. Detect the actual attribute name robustly.
+    retry_attr_name = None
+    for name in dir(_aioice_stun.Transaction):
+        if name.endswith("retry"):
+            obj = getattr(_aioice_stun.Transaction, name)
+            if callable(obj):
+                retry_attr_name = name
+                _orig_retry = obj
+                break
+
+    if retry_attr_name is not None:
+        # Simple in-process dedupe cache so we only log the same AttributeError
+        # once per interval. This prevents flooding the logs when many
+        # transactions race to run after shutdown.
+        _MONKEYPATCH_LOG_CACHE: dict[str, float] = {}
+        _MONKEYPATCH_LOG_SUPPRESSION_INTERVAL = 5.0
+
+        def _should_log_once(key: str) -> bool:
+            now = time.time()
+            last = _MONKEYPATCH_LOG_CACHE.get(key)
+            if last is None or (now - last) > _MONKEYPATCH_LOG_SUPPRESSION_INTERVAL:
+                _MONKEYPATCH_LOG_CACHE[key] = now
+                return True
+            return False
+
+        def _safe_transaction_retry(self, *args, **kwargs):  # type: ignore
+            try:
+                return _orig_retry(self, *args, **kwargs)  # type: ignore
+            except AttributeError as e:  # type: ignore
+                # Transport or event-loop already closed; log once per key
+                key = f"Transaction.{retry_attr_name}:{e}"
+                if _should_log_once(key):
+                    logger.warning(
+                        "aioice Transaction.%s AttributeError suppressed: %s",
+                        retry_attr_name,
+                        e,
+                    )
+            except Exception:  # type: ignore
+                # Preserve visibility for other unexpected exceptions
+                logger.exception(
+                    "aioice Transaction.%s raised an unexpected exception",
+                    retry_attr_name,
+                )
+
+        setattr(_aioice_stun.Transaction, retry_attr_name, _safe_transaction_retry)  # type: ignore
+        logger.info("Applied safe aioice Transaction.%s monkeypatch", retry_attr_name)
+    else:
+        logger.warning("aioice Transaction.__retry not found; skipping monkeypatch")
+except Exception as e:
+    logger.exception("Failed to apply aioice Transaction.__retry monkeypatch: %s", e)
+
+# Additional defensive patch: wrap the protocol-level send_stun implementation
+# (e.g. StunProtocol.send_stun) which ultimately calls the datagram transport's
+# sendto. If the transport or its loop is already torn down, sendto can raise
+# AttributeError which then triggers asyncio's fatal error path (calling a None
+# loop). Wrapping here prevents the flood of selector_events/_fatal_error
+# AttributeError traces.
+try:
+    import aioice.ice as _aioice_ice  # type: ignore
+
+    # Prefer to patch StunProtocol.send_stun which is used by the ICE code.
+    send_attr_name = None
+    if hasattr(_aioice_ice, "StunProtocol"):
+        proto_cls = getattr(_aioice_ice, "StunProtocol")
+        for name in dir(proto_cls):
+            if name.endswith("send_stun"):
+                attr = getattr(proto_cls, name)
+                if callable(attr):
+                    send_attr_name = name
+                    _orig_send_stun = attr
+                    break
+
+    if send_attr_name is not None:
+
+        def _safe_send_stun(self, message, addr):  # type: ignore
+            try:
+                return _orig_send_stun(self, message, addr)  # type: ignore
+            except AttributeError as e:  # type: ignore
+                # Likely transport._sock or transport._loop is None; log once
+                key = f"StunProtocol.{send_attr_name}:{e}"
+                if _should_log_once(key):
+                    logger.warning(
+                        "aioice StunProtocol.%s AttributeError suppressed: %s",
+                        send_attr_name,
+                        e,
+                    )
+            except Exception:  # type: ignore
+                logger.exception(
+                    "aioice StunProtocol.%s raised unexpected exception", send_attr_name
+                )
+
+        setattr(proto_cls, send_attr_name, _safe_send_stun)  # type: ignore
+        logger.info("Applied safe aioice StunProtocol.%s monkeypatch", send_attr_name)
+    else:
+        logger.warning("aioice StunProtocol.send_stun not found; skipping monkeypatch")
+except Exception as e:
+    logger.exception("Failed to apply aioice StunProtocol.send_stun monkeypatch: %s", e)
 
 # TypedDict for ICE candidate payloads received from signalling
 class ICECandidateDict(TypedDict, total=False):
@@ -27,6 +158,7 @@ class ICECandidateDict(TypedDict, total=False):
     sdpMid: Optional[str]
     sdpMLineIndex: Optional[int]
 
+
 # Generic message payload type
 MessageData = dict[str, object]
 
@@ -65,24 +197,73 @@ class IceCandidatePayload(TypedDict):
     candidate: ICECandidateDict
 
 
+# Pydantic models for server responses (validate shapes returned by FastAPI)
+class LobbyModel(BaseModel):
+    id: str
+    name: str
+    private: bool = False
+
+
+class SessionModel(BaseModel):
+    id: str
+    name: str = ""
+    lobbies: List[LobbyModel] = []
+
+
+class LobbyCreateResponse(BaseModel):
+    type: str
+    data: LobbyModel
+
+
+# Pydantic models for signaling payloads (incoming websocket messages)
+class ICECandidateDictModel(BaseModel):
+    candidate: Optional[str] = None
+    sdpMid: Optional[str] = None
+    sdpMLineIndex: Optional[int] = None
+
+
+class AddPeerModel(BaseModel):
+    peer_id: str
+    peer_name: str
+    should_create_offer: bool = False
+
+
+class RemovePeerModel(BaseModel):
+    peer_id: str
+    peer_name: str
+
+
+class SessionDescriptionTypedModel(BaseModel):
+    type: str
+    sdp: str
+
+
+class SessionDescriptionModel(BaseModel):
+    peer_id: str
+    peer_name: str
+    session_description: SessionDescriptionTypedModel
+
+
+class IceCandidateModel(BaseModel):
+    peer_id: str
+    peer_name: str
+    candidate: ICECandidateDictModel
+
+
 class WebSocketProtocol(Protocol):
     def send(self, message: object, text: Optional[bool] = None) -> Awaitable[None]: ...
     def close(self, code: int = 1000, reason: str = "") -> Awaitable[None]: ...
     def __aiter__(self) -> AsyncIterator[str]: ...
 
- # (imports moved to top)
-
-# Configure logging
-logging.basicConfig(level=logging.INFO)
-logger = logging.getLogger(__name__)
-
 
 def _default_attributes() -> Dict[str, object]:
     return {}
 
+
 @dataclass
 class Peer:
     """Represents a WebRTC peer in the session"""
+
     session_id: str
     peer_name: str
     # Generic attributes bag. Values can be tracks or simple metadata.
@@ -93,39 +274,43 @@ class Peer:
     dead: bool = False
     connection: Optional[RTCPeerConnection] = None
 
+
 class AnimatedVideoTrack(MediaStreamTrack):
     async def next_timestamp(self):
         # Returns (pts, time_base) for 15 FPS video
-        pts = int(self.frame_count * (1/15) * 90000)
-        time_base = 1/90000
+        pts = int(self.frame_count * (1 / 15) * 90000)
+        time_base = 1 / 90000
         return pts, time_base
+
     """
     Synthetic video track that generates animated content with a bouncing ball.
     Ported from JavaScript createAnimatedVideoTrack function.
     """
     kind = "video"
-    
+
     def __init__(self, width: int = 320, height: int = 240, name: str = ""):
         super().__init__()
         self.width = width
         self.height = height
         self.name = name
-        
+
         # Generate color from name hash (similar to JavaScript nameToColor)
-        self.ball_color = self._name_to_color(name) if name else (0, 255, 136)  # Default green
-        
+        self.ball_color = (
+            self._name_to_color(name) if name else (0, 255, 136)
+        )  # Default green
+
         # Ball properties
         self.ball = {
-            'x': width / 2,
-            'y': height / 2,
-            'radius': min(width, height) * 0.06,
-            'dx': 3.0,
-            'dy': 2.0
+            "x": width / 2,
+            "y": height / 2,
+            "radius": min(width, height) * 0.06,
+            "dx": 3.0,
+            "dy": 2.0,
         }
-        
+
         self.frame_count = 0
         self._start_time = time.time()
-        
+
     def _name_to_color(self, name: str) -> tuple[int, int, int]:
         """Convert name to HSL color, then to RGB tuple"""
         # Simple hash function (djb2)
@@ -147,21 +332,25 @@ class AnimatedVideoTrack(MediaStreamTrack):
         x = c * (1 - abs((h * 6) % 2 - 1))
         m = lightness - c / 2
 
-        if h < 1/6:
+        if h < 1 / 6:
             r, g, b = c, x, 0
-        elif h < 2/6:
+        elif h < 2 / 6:
             r, g, b = x, c, 0
-        elif h < 3/6:
+        elif h < 3 / 6:
             r, g, b = 0, c, x
-        elif h < 4/6:
+        elif h < 4 / 6:
             r, g, b = 0, x, c
-        elif h < 5/6:
+        elif h < 5 / 6:
             r, g, b = x, 0, c
         else:
             r, g, b = c, 0, x
 
-        return (int((b + m) * 255), int((g + m) * 255), int((r + m) * 255))  # BGR for OpenCV
-    
+        return (
+            int((b + m) * 255),
+            int((g + m) * 255),
+            int((r + m) * 255),
+        )  # BGR for OpenCV
+
     async def recv(self):
         """Generate video frames at 15 FPS"""
         pts, time_base = await self.next_timestamp()
@@ -171,30 +360,40 @@ class AnimatedVideoTrack(MediaStreamTrack):
 
         # Update ball position
         ball = self.ball
-        ball['x'] += ball['dx']
-        ball['y'] += ball['dy']
+        ball["x"] += ball["dx"]
+        ball["y"] += ball["dy"]
 
         # Bounce off walls
-        if ball['x'] + ball['radius'] >= self.width or ball['x'] - ball['radius'] <= 0:
-            ball['dx'] = -ball['dx']
-        if ball['y'] + ball['radius'] >= self.height or ball['y'] - ball['radius'] <= 0:
-            ball['dy'] = -ball['dy']
+        if ball["x"] + ball["radius"] >= self.width or ball["x"] - ball["radius"] <= 0:
+            ball["dx"] = -ball["dx"]
+        if ball["y"] + ball["radius"] >= self.height or ball["y"] - ball["radius"] <= 0:
+            ball["dy"] = -ball["dy"]
 
         # Keep ball in bounds
-        ball['x'] = max(ball['radius'], min(self.width - ball['radius'], ball['x']))
-        ball['y'] = max(ball['radius'], min(self.height - ball['radius'], ball['y']))
+        ball["x"] = max(ball["radius"], min(self.width - ball["radius"], ball["x"]))
+        ball["y"] = max(ball["radius"], min(self.height - ball["radius"], ball["y"]))
 
         # Draw ball
-        cv2.circle(frame_array,
-                  (int(ball['x']), int(ball['y'])),
-                  int(ball['radius']),
-                  self.ball_color,
-                  -1)
+        cv2.circle(
+            frame_array,
+            (int(ball["x"]), int(ball["y"])),
+            int(ball["radius"]),
+            self.ball_color,
+            -1,
+        )
 
         # Add frame counter text
         frame_text = f"Frame: {int(time.time() * 1000) % 10000}"
-        cv2.putText(frame_array, frame_text, (10, 20),
-                   cv2.FONT_HERSHEY_SIMPLEX, 0.5, (255, 255, 255), 1)
+        logger.info(frame_text)
+        cv2.putText(
+            frame_array,
+            frame_text,
+            (10, 20),
+            cv2.FONT_HERSHEY_SIMPLEX,
+            0.5,
+            (255, 255, 255),
+            1,
+        )
 
         # Convert to VideoFrame
         frame = VideoFrame.from_ndarray(frame_array, format="bgr24")
@@ -204,23 +403,25 @@ class AnimatedVideoTrack(MediaStreamTrack):
         self.frame_count += 1
         return frame
 
+
 class SilentAudioTrack(MediaStreamTrack):
     async def next_timestamp(self):
         # Returns (pts, time_base) for 20ms audio frames at 48kHz
         pts = int(time.time() * self.sample_rate)
-        time_base = 1/self.sample_rate
+        time_base = 1 / self.sample_rate
         return pts, time_base
+
     """
     Synthetic audio track that generates silence.
     Ported from JavaScript createSilentAudioTrack function.
     """
     kind = "audio"
-    
+
     def __init__(self):
         super().__init__()
         self.sample_rate = 48000
         self.samples_per_frame = 960  # 20ms at 48kHz
-        
+
     async def recv(self):
         """Generate silent audio frames"""
         pts, time_base = await self.next_timestamp()
@@ -229,28 +430,42 @@ class SilentAudioTrack(MediaStreamTrack):
         samples = np.zeros((self.samples_per_frame,), dtype=np.float32)
 
         # Convert to AudioFrame
-        frame = AudioFrame.from_ndarray(samples.reshape(1, -1), format="flt", layout="mono")
+        frame = AudioFrame.from_ndarray(
+            samples.reshape(1, -1), format="flt", layout="mono"
+        )
         frame.sample_rate = self.sample_rate
         frame.pts = pts
         frame.time_base = fractions.Fraction(time_base).limit_denominator(1000000)
 
         return frame
 
+
 class WebRTCSignalingClient:
     """
     WebRTC signaling client that communicates with the FastAPI signaling server.
     Handles peer-to-peer connection establishment and media streaming.
     """
-    
-    def __init__(self, server_url: str, lobby_id: str, session_id: str, session_name: str):
+
+    def __init__(
+        self,
+        server_url: str,
+        lobby_id: str,
+        session_id: str,
+        session_name: str,
+        insecure: bool = False,
+    ):
         self.server_url = server_url
         self.lobby_id = lobby_id
         self.session_id = session_id
         self.session_name = session_name
+        self.insecure = insecure
 
         # WebSocket client protocol instance (typed as object to avoid Any)
         self.websocket: Optional[object] = None
 
+        # Optional password to register or takeover a name
+        self.name_password: Optional[str] = None
+
         self.peers: dict[str, Peer] = {}
         self.peer_connections: dict[str, RTCPeerConnection] = {}
         self.local_tracks: dict[str, MediaStreamTrack] = {}
@@ -264,69 +479,107 @@ class WebRTCSignalingClient:
         # Event callbacks
         self.on_peer_added: Optional[Callable[[Peer], Awaitable[None]]] = None
         self.on_peer_removed: Optional[Callable[[Peer], Awaitable[None]]] = None
-        self.on_track_received: Optional[Callable[[Peer, MediaStreamTrack], Awaitable[None]]] = None
-        
+        self.on_track_received: Optional[
+            Callable[[Peer, MediaStreamTrack], Awaitable[None]]
+        ] = None
+
     async def connect(self):
         """Connect to the signaling server"""
         ws_url = f"{self.server_url}/ws/lobby/{self.lobby_id}/{self.session_id}"
         logger.info(f"Connecting to signaling server: {ws_url}")
-        
+
+        # Log network information for debugging
         try:
-            self.websocket = await websockets.connect(ws_url)
+            import socket
+
+            hostname = socket.gethostname()
+            local_ip = socket.gethostbyname(hostname)
+            logger.info(f"Container hostname: {hostname}, local IP: {local_ip}")
+
+            # Get all network interfaces
+            import subprocess
+
+            result = subprocess.run(
+                ["ip", "addr", "show"], capture_output=True, text=True
+            )
+            logger.info(f"Network interfaces:\n{result.stdout}")
+        except Exception as e:
+            logger.warning(f"Could not get network info: {e}")
+
+        try:
+            # If insecure (self-signed certs), create an SSL context for the websocket
+            ws_ssl = None
+            if self.insecure:
+                ws_ssl = ssl.create_default_context()
+                ws_ssl.check_hostname = False
+                ws_ssl.verify_mode = ssl.CERT_NONE
+
+            logger.info(
+                f"Attempting websocket connection to {ws_url} with ssl={bool(ws_ssl)}"
+            )
+            self.websocket = await websockets.connect(ws_url, ssl=ws_ssl)
             logger.info("Connected to signaling server")
-            
+
             # Set up local media
             await self._setup_local_media()
-            
+
             # Set name and join lobby
-            await self._send_message("set_name", {"name": self.session_name})
+            name_payload: MessageData = {"name": self.session_name}
+            if self.name_password:
+                name_payload["password"] = self.name_password
+            logger.info(f"Sending set_name: {name_payload}")
+            await self._send_message("set_name", name_payload)
+            logger.info("Sending join message")
             await self._send_message("join", {})
-            
+
             # Start message handling
+            logger.info("Starting message handler loop")
             await self._handle_messages()
-            
+
         except Exception as e:
-            logger.error(f"Failed to connect to signaling server: {e}")
+            logger.error(f"Failed to connect to signaling server: {e}", exc_info=True)
             raise
-    
+
     async def disconnect(self):
         """Disconnect from signaling server and cleanup"""
         if self.websocket:
             ws = cast(WebSocketProtocol, self.websocket)
             await ws.close()
-        
+
         # Close all peer connections
         for pc in self.peer_connections.values():
             await pc.close()
-        
+
         # Stop local tracks
         for track in self.local_tracks.values():
             track.stop()
-        
+
         logger.info("Disconnected from signaling server")
-    
+
     async def _setup_local_media(self):
         """Create local synthetic media tracks"""
         # Create synthetic video track
         video_track = AnimatedVideoTrack(name=self.session_name)
         self.local_tracks["video"] = video_track
-        
+
         # Create synthetic audio track
         audio_track = SilentAudioTrack()
         self.local_tracks["audio"] = audio_track
-        
+
         # Add local peer to peers dict
         local_peer = Peer(
             session_id=self.session_id,
             peer_name=self.session_name,
             local=True,
-            attributes={"tracks": self.local_tracks}
+            attributes={"tracks": self.local_tracks},
         )
         self.peers[self.session_id] = local_peer
-        
+
         logger.info("Local synthetic media tracks created")
-    
-    async def _send_message(self, message_type: str, data: Optional[MessageData] = None):
+
+    async def _send_message(
+        self, message_type: str, data: Optional[MessageData] = None
+    ):
         """Send message to signaling server"""
         if not self.websocket:
             logger.error("No websocket connection")
@@ -337,280 +590,788 @@ class WebRTCSignalingClient:
             message["data"] = data
 
         ws = cast(WebSocketProtocol, self.websocket)
-        await ws.send(json.dumps(message))
-        logger.debug(f"Sent message: {message_type}")
-    
+        try:
+            logger.info(f"_send_message: Sending {message_type} with data: {data}")
+            await ws.send(json.dumps(message))
+            logger.info(f"_send_message: Sent message: {message_type}")
+        except Exception as e:
+            logger.error(
+                f"_send_message: Failed to send {message_type}: {e}", exc_info=True
+            )
+
     async def _handle_messages(self):
         """Handle incoming messages from signaling server"""
         try:
             ws = cast(WebSocketProtocol, self.websocket)
             async for message in ws:
-                data = cast(MessageData, json.loads(message))
+                logger.info(f"_handle_messages: Received raw message: {message}")
+                try:
+                    data = cast(MessageData, json.loads(message))
+                except Exception as e:
+                    logger.error(
+                        f"_handle_messages: Failed to parse message: {e}", exc_info=True
+                    )
+                    continue
                 await self._process_message(data)
-        except websockets.exceptions.ConnectionClosed:
-            logger.info("WebSocket connection closed")
+        except websockets.exceptions.ConnectionClosed as e:
+            logger.info(f"WebSocket connection closed: {e}")
         except Exception as e:
-            logger.error(f"Error handling messages: {e}")
-    
+            logger.error(f"Error handling messages: {e}", exc_info=True)
+
     async def _process_message(self, message: MessageData):
         """Process incoming signaling messages"""
         msg_type = message.get("type")
         data = message.get("data", {})
-        
-        logger.debug(f"Received message: {msg_type}")
-        
+
+        logger.info(
+            f"_process_message: Received message type: {msg_type} with data: {data}"
+        )
+
         if msg_type == "addPeer":
-            await self._handle_add_peer(cast(AddPeerPayload, data))
+            try:
+                validated = AddPeerModel.model_validate(data)
+            except ValidationError as e:
+                logger.error(f"Invalid addPeer payload: {e}", exc_info=True)
+                return
+            await self._handle_add_peer(validated)
         elif msg_type == "removePeer":
-            await self._handle_remove_peer(cast(RemovePeerPayload, data))
+            try:
+                validated = RemovePeerModel.model_validate(data)
+            except ValidationError as e:
+                logger.error(f"Invalid removePeer payload: {e}", exc_info=True)
+                return
+            await self._handle_remove_peer(validated)
         elif msg_type == "sessionDescription":
-            await self._handle_session_description(cast(SessionDescriptionPayload, data))
+            try:
+                validated = SessionDescriptionModel.model_validate(data)
+            except ValidationError as e:
+                logger.error(f"Invalid sessionDescription payload: {e}", exc_info=True)
+                return
+            await self._handle_session_description(validated)
         elif msg_type == "iceCandidate":
-            await self._handle_ice_candidate(cast(IceCandidatePayload, data))
+            try:
+                validated = IceCandidateModel.model_validate(data)
+            except ValidationError as e:
+                logger.error(f"Invalid iceCandidate payload: {e}", exc_info=True)
+                return
+            await self._handle_ice_candidate(validated)
         elif msg_type == "join_status":
             dd = cast(MessageData, data)
             logger.info(f"Join status: {dd.get('status')} - {dd.get('message', '')}")
+        elif msg_type == "user_joined":
+            dd = cast(MessageData, data)
+            logger.info(
+                f"User joined: {dd.get('name')} (session: {dd.get('session_id')})"
+            )
+        elif msg_type == "lobby_state":
+            dd = cast(MessageData, data)
+            participants = dd.get("participants", [])
+            if isinstance(participants, list):
+                logger.info(f"Lobby state updated: {len(participants)} participants")
+            else:
+                logger.info("Lobby state updated: participants data received")
+        elif msg_type == "update":
+            dd = cast(MessageData, data)
+            logger.info(f"Received update message: {dd}")
         else:
-            logger.debug(f"Unhandled message type: {msg_type}")
-    
-    async def _handle_add_peer(self, data: AddPeerPayload):
-        """Handle addPeer message - create new peer connection"""
-        peer_id = data["peer_id"]
-        peer_name = data["peer_name"]
-        should_create_offer = data.get("should_create_offer", False)
+            logger.info(f"Unhandled message type: {msg_type} with data: {data}")
+
+    async def _handle_add_peer(self, data: AddPeerModel):
+        """Handle addPeer message - create new peer connection"""
+        peer_id = data.peer_id
+        peer_name = data.peer_name
+        should_create_offer = data.should_create_offer
+
+        logger.info(
+            f"Adding peer: {peer_name} (should_create_offer: {should_create_offer})"
+        )
+        logger.info(
+            f"_handle_add_peer: peer_id={peer_id}, peer_name={peer_name}, should_create_offer={should_create_offer}"
+        )
 
-        logger.info(f"Adding peer: {peer_name} (should_create_offer: {should_create_offer})")
-        
         # Check if peer already exists
         if peer_id in self.peer_connections:
             pc = self.peer_connections[peer_id]
+            logger.info(
+                f"_handle_add_peer: Existing connection state: {pc.connectionState}"
+            )
             if pc.connectionState in ["new", "connected", "connecting"]:
                 logger.info(f"Peer connection already exists for {peer_name}")
                 return
             else:
                 # Clean up stale connection
+                logger.info(
+                    f"_handle_add_peer: Closing stale connection for {peer_name}"
+                )
                 await pc.close()
                 del self.peer_connections[peer_id]
-        
+
         # Create new peer
-        peer = Peer(
-            session_id=peer_id,
-            peer_name=peer_name,
-            local=False
-        )
+        peer = Peer(session_id=peer_id, peer_name=peer_name, local=False)
         self.peers[peer_id] = peer
-        
+
         # Create RTCPeerConnection
         from aiortc.rtcconfiguration import RTCConfiguration, RTCIceServer
-        config = RTCConfiguration(iceServers=[
-            RTCIceServer(urls="stun:stun.l.google.com:19302"),
-            RTCIceServer(urls="stun:stun1.l.google.com:19302"),
-            RTCIceServer(urls="turns:ketrenos.com:5349", username="ketra", credential="ketran")
-        ])
+
+        config = RTCConfiguration(
+            iceServers=[
+                RTCIceServer(urls="stun:ketrenos.com:3478"),
+                RTCIceServer(
+                    urls="turns:ketrenos.com:5349",
+                    username="ketra",
+                    credential="ketran",
+                ),
+                # Add Google's public STUN server as fallback
+                RTCIceServer(urls="stun:stun.l.google.com:19302"),
+            ],
+        )
+        logger.info(
+            f"_handle_add_peer: Creating RTCPeerConnection for {peer_name} with config: {config}"
+        )
         pc = RTCPeerConnection(configuration=config)
-        
+
+        # Add ICE gathering state change handler (explicit registration to satisfy static analyzers)
+        def on_ice_gathering_state_change() -> None:
+            logger.info(f"ICE gathering state: {pc.iceGatheringState}")
+            # Debug: Check if we have any local candidates when gathering is complete
+            if pc.iceGatheringState == "complete":
+                logger.info(f"ICE gathering complete for {peer_name} - checking if candidates were generated...")
+
+        pc.on("icegatheringstatechange")(on_ice_gathering_state_change)
+
+        # Add connection state change handler (explicit registration to satisfy static analyzers)
+        def on_connection_state_change() -> None:
+            logger.info(f"Connection state: {pc.connectionState}")
+
+        pc.on("connectionstatechange")(on_connection_state_change)
+
         self.peer_connections[peer_id] = pc
         peer.connection = pc
-        
+
         # Set up event handlers
         def on_track(track: MediaStreamTrack) -> None:
             logger.info(f"Received {track.kind} track from {peer_name}")
+            logger.info(f"on_track: {track.kind} from {peer_name}, track={track}")
             peer.attributes[f"{track.kind}_track"] = track
             if self.on_track_received:
                 asyncio.ensure_future(self.on_track_received(peer, track))
 
         pc.on("track")(on_track)
-        
+
         def on_ice_candidate(candidate: Optional[RTCIceCandidate]) -> None:
-            if candidate:
-                candidate_dict: MessageData = {
-                    "candidate": getattr(candidate, "candidate", None),
-                    "sdpMid": getattr(candidate, "sdpMid", None),
-                    "sdpMLineIndex": getattr(candidate, "sdpMLineIndex", None),
-                }
-                payload: MessageData = {"peer_id": peer_id, "candidate": candidate_dict}
-                asyncio.ensure_future(self._send_message("relayICECandidate", payload))
+            logger.info(f"on_ice_candidate: {candidate}")
+            logger.info(f"on_ice_candidate CALLED for {peer_name}: candidate={candidate}")
+            if not candidate:
+                logger.info(f"on_ice_candidate: End of candidates signal for {peer_name}")
+                return
+
+            # Raw SDP fragment for the candidate
+            raw = getattr(candidate, "candidate", None)
+
+            # Try to infer candidate type from the SDP string (host/srflx/relay/prflx)
+            def _parse_type(s: Optional[str]) -> str:
+                if not s:
+                    return "eoc"
+                import re
+
+                m = re.search(r"\btyp\s+(host|srflx|relay|prflx)\b", s)
+                return m.group(1) if m else "unknown"
+
+            cand_type = _parse_type(raw)
+            protocol = getattr(candidate, "protocol", "unknown")
+            logger.info(
+                f"ICE candidate outgoing for {peer_name}: type={cand_type} protocol={protocol} sdp={raw}"
+            )
+
+            candidate_dict: MessageData = {
+                "candidate": raw,
+                "sdpMid": getattr(candidate, "sdpMid", None),
+                "sdpMLineIndex": getattr(candidate, "sdpMLineIndex", None),
+            }
+            payload: MessageData = {"peer_id": peer_id, "candidate": candidate_dict}
+            logger.info(
+                f"on_ice_candidate: Sending relayICECandidate for {peer_name}: {candidate_dict}"
+            )
+            asyncio.ensure_future(self._send_message("relayICECandidate", payload))
 
         pc.on("icecandidate")(on_ice_candidate)
-        
+
         # Add local tracks
         for track in self.local_tracks.values():
+            logger.info(
+                f"_handle_add_peer: Adding local track {track.kind} to {peer_name}"
+            )
             pc.addTrack(track)
-        
+
         # Create offer if needed
         if should_create_offer:
             self.initiated_offer.add(peer_id)
             self.making_offer[peer_id] = True
             self.is_negotiating[peer_id] = True
-            
+
             try:
+                logger.info(f"_handle_add_peer: Creating offer for {peer_name}")
                 offer = await pc.createOffer()
+                logger.info(f"_handle_add_peer: Offer created for {peer_name}: {offer}")
                 await pc.setLocalDescription(offer)
+                logger.info(f"_handle_add_peer: Local description set for {peer_name}")
                 
-                await self._send_message("relaySessionDescription", {
-                    "peer_id": peer_id,
-                    "session_description": {
-                        "type": offer.type,
-                        "sdp": offer.sdp
-                    }
-                })
+                # WORKAROUND for aiortc icecandidate event not firing (GitHub issue #1344)
+                # Use Method 2: Complete SDP approach to extract ICE candidates
+                logger.info(f"_handle_add_peer: Waiting for ICE gathering to complete for {peer_name}")
+                while pc.iceGatheringState != "complete":
+                    await asyncio.sleep(0.1)
                 
+                logger.info(f"_handle_add_peer: ICE gathering complete, extracting candidates from SDP for {peer_name}")
+                
+                # Parse ICE candidates from the local SDP
+                sdp_lines = pc.localDescription.sdp.split('\n')
+                candidate_lines = [line for line in sdp_lines if line.startswith('a=candidate:')]
+                
+                # Track which media section we're in to determine sdpMid and sdpMLineIndex
+                current_media_index = -1
+                current_mid = None
+                
+                for line in sdp_lines:
+                    if line.startswith('m='):  # Media section
+                        current_media_index += 1
+                    elif line.startswith('a=mid:'):  # Media ID
+                        current_mid = line.split(':', 1)[1].strip()
+                    elif line.startswith('a=candidate:'):
+                        candidate_sdp = line[2:]  # Remove 'a=' prefix
+                        
+                        candidate_dict: MessageData = {
+                            "candidate": candidate_sdp,
+                            "sdpMid": current_mid,
+                            "sdpMLineIndex": current_media_index,
+                        }
+                        payload_candidate: MessageData = {
+                            "peer_id": peer_id, 
+                            "candidate": candidate_dict
+                        }
+                        
+                        logger.info(f"_handle_add_peer: Sending extracted ICE candidate for {peer_name}: {candidate_sdp[:60]}...")
+                        await self._send_message("relayICECandidate", payload_candidate)
+                
+                # Send end-of-candidates signal (empty candidate)
+                end_candidate_dict: MessageData = {
+                    "candidate": "",
+                    "sdpMid": None,
+                    "sdpMLineIndex": None,
+                }
+                payload_end: MessageData = {
+                    "peer_id": peer_id, 
+                    "candidate": end_candidate_dict
+                }
+                logger.info(f"_handle_add_peer: Sending end-of-candidates signal for {peer_name}")
+                await self._send_message("relayICECandidate", payload_end)
+                
+                logger.info(f"_handle_add_peer: Sent {len(candidate_lines)} ICE candidates to {peer_name}")
+
+                await self._send_message(
+                    "relaySessionDescription",
+                    {
+                        "peer_id": peer_id,
+                        "session_description": {"type": offer.type, "sdp": offer.sdp},
+                    },
+                )
+
                 logger.info(f"Offer sent to {peer_name}")
             except Exception as e:
-                logger.error(f"Failed to create/send offer to {peer_name}: {e}")
+                logger.error(
+                    f"Failed to create/send offer to {peer_name}: {e}", exc_info=True
+                )
             finally:
                 self.making_offer[peer_id] = False
-        
+
         if self.on_peer_added:
             await self.on_peer_added(peer)
-    
-    async def _handle_remove_peer(self, data: RemovePeerPayload):
+
+    async def _handle_remove_peer(self, data: RemovePeerModel):
         """Handle removePeer message"""
-        peer_id = data["peer_id"]
-        peer_name = data["peer_name"]
+        peer_id = data.peer_id
+        peer_name = data.peer_name
 
         logger.info(f"Removing peer: {peer_name}")
-        
+
         # Close peer connection
         if peer_id in self.peer_connections:
             pc = self.peer_connections[peer_id]
             await pc.close()
             del self.peer_connections[peer_id]
-        
+
         # Clean up state
         self.is_negotiating.pop(peer_id, None)
         self.making_offer.pop(peer_id, None)
         self.initiated_offer.discard(peer_id)
         self.pending_ice_candidates.pop(peer_id, None)
-        
+
         # Remove peer
         peer = self.peers.pop(peer_id, None)
         if peer and self.on_peer_removed:
             await self.on_peer_removed(peer)
-    
-    async def _handle_session_description(self, data: SessionDescriptionPayload):
+
+    async def _handle_session_description(self, data: SessionDescriptionModel):
         """Handle sessionDescription message"""
-        peer_id = data["peer_id"]
-        peer_name = data["peer_name"]
-        session_description = data["session_description"]
+        peer_id = data.peer_id
+        peer_name = data.peer_name
+        session_description = data.session_description.model_dump()
 
         logger.info(f"Received {session_description['type']} from {peer_name}")
-        
+
         pc = self.peer_connections.get(peer_id)
         if not pc:
             logger.error(f"No peer connection for {peer_name}")
             return
-        
-        desc = RTCSessionDescription(sdp=session_description["sdp"], type=session_description["type"])
-        
+
+        desc = RTCSessionDescription(
+            sdp=session_description["sdp"], type=session_description["type"]
+        )
+
         # Handle offer collision (polite peer pattern)
         making_offer = self.making_offer.get(peer_id, False)
-        offer_collision = desc.type == "offer" and (making_offer or pc.signalingState != "stable")
+        offer_collision = desc.type == "offer" and (
+            making_offer or pc.signalingState != "stable"
+        )
         we_initiated = peer_id in self.initiated_offer
         ignore_offer = we_initiated and offer_collision
-        
+
         if ignore_offer:
             logger.info(f"Ignoring offer from {peer_name} due to collision")
             return
-        
+
         try:
             await pc.setRemoteDescription(desc)
             self.is_negotiating[peer_id] = False
             logger.info(f"Remote description set for {peer_name}")
-            
+
             # Process queued ICE candidates
             pending_candidates = self.pending_ice_candidates.pop(peer_id, [])
+            from aiortc.sdp import candidate_from_sdp
+
             for candidate_data in pending_candidates:
-                # pass through the dict received from signaling server
-                await pc.addIceCandidate(cast(RTCIceCandidate, candidate_data))
-                logger.info(f"Added queued ICE candidate for {peer_name}")
-            
+                # candidate_data is a dict-like ICECandidateDict; convert SDP string
+                cand = candidate_data.get("candidate")
+                # handle end-of-candidates marker
+                if not cand:
+                    await pc.addIceCandidate(None)
+                    logger.info(f"Added queued end-of-candidates for {peer_name}")
+                    continue
+
+                # cand may be the full "candidate:..." string or the inner SDP part
+                if cand and cand.startswith("candidate:"):
+                    sdp_part = cand.split(":", 1)[1]
+                else:
+                    sdp_part = cand
+
+                try:
+                    rtc_candidate = candidate_from_sdp(sdp_part)
+                    rtc_candidate.sdpMid = candidate_data.get("sdpMid")
+                    rtc_candidate.sdpMLineIndex = candidate_data.get("sdpMLineIndex")
+                    await pc.addIceCandidate(rtc_candidate)
+                    logger.info(f"Added queued ICE candidate for {peer_name}")
+                except Exception as e:
+                    logger.error(
+                        f"Failed to add queued ICE candidate for {peer_name}: {e}"
+                    )
+
         except Exception as e:
             logger.error(f"Failed to set remote description for {peer_name}: {e}")
             return
-        
+
         # Create answer if this was an offer
         if session_description["type"] == "offer":
             try:
                 answer = await pc.createAnswer()
                 await pc.setLocalDescription(answer)
                 
-                await self._send_message("relaySessionDescription", {
-                    "peer_id": peer_id,
-                    "session_description": {
-                        "type": answer.type,
-                        "sdp": answer.sdp
-                    }
-                })
+                # WORKAROUND for aiortc icecandidate event not firing (GitHub issue #1344)
+                # Use Method 2: Complete SDP approach to extract ICE candidates
+                logger.info(f"_handle_session_description: Waiting for ICE gathering to complete for {peer_name} (answer)")
+                while pc.iceGatheringState != "complete":
+                    await asyncio.sleep(0.1)
                 
+                logger.info(f"_handle_session_description: ICE gathering complete, extracting candidates from SDP for {peer_name} (answer)")
+                
+                # Parse ICE candidates from the local SDP
+                sdp_lines = pc.localDescription.sdp.split('\n')
+                candidate_lines = [line for line in sdp_lines if line.startswith('a=candidate:')]
+                
+                # Track which media section we're in to determine sdpMid and sdpMLineIndex
+                current_media_index = -1
+                current_mid = None
+                
+                for line in sdp_lines:
+                    if line.startswith('m='):  # Media section
+                        current_media_index += 1
+                    elif line.startswith('a=mid:'):  # Media ID
+                        current_mid = line.split(':', 1)[1].strip()
+                    elif line.startswith('a=candidate:'):
+                        candidate_sdp = line[2:]  # Remove 'a=' prefix
+                        
+                        candidate_dict: MessageData = {
+                            "candidate": candidate_sdp,
+                            "sdpMid": current_mid,
+                            "sdpMLineIndex": current_media_index,
+                        }
+                        payload_candidate: MessageData = {
+                            "peer_id": peer_id, 
+                            "candidate": candidate_dict
+                        }
+                        
+                        logger.info(f"_handle_session_description: Sending extracted ICE candidate for {peer_name} (answer): {candidate_sdp[:60]}...")
+                        await self._send_message("relayICECandidate", payload_candidate)
+                
+                # Send end-of-candidates signal (empty candidate)
+                end_candidate_dict: MessageData = {
+                    "candidate": "",
+                    "sdpMid": None,
+                    "sdpMLineIndex": None,
+                }
+                payload_end: MessageData = {
+                    "peer_id": peer_id, 
+                    "candidate": end_candidate_dict
+                }
+                logger.info(f"_handle_session_description: Sending end-of-candidates signal for {peer_name} (answer)")
+                await self._send_message("relayICECandidate", payload_end)
+                
+                logger.info(f"_handle_session_description: Sent {len(candidate_lines)} ICE candidates to {peer_name} (answer)")
+
+                await self._send_message(
+                    "relaySessionDescription",
+                    {
+                        "peer_id": peer_id,
+                        "session_description": {"type": answer.type, "sdp": answer.sdp},
+                    },
+                )
+
                 logger.info(f"Answer sent to {peer_name}")
             except Exception as e:
                 logger.error(f"Failed to create/send answer to {peer_name}: {e}")
-    
-    async def _handle_ice_candidate(self, data: IceCandidatePayload):
-        """Handle iceCandidate message"""
-        peer_id = data["peer_id"]
-        peer_name = data["peer_name"]
-        candidate_data = data["candidate"]
 
-        logger.debug(f"Received ICE candidate from {peer_name}")
-        
+    async def _handle_ice_candidate(self, data: IceCandidateModel):
+        """Handle iceCandidate message"""
+        peer_id = data.peer_id
+        peer_name = data.peer_name
+        candidate_data = data.candidate.model_dump()
+
+        logger.info(f"Received ICE candidate from {peer_name}")
+
         pc = self.peer_connections.get(peer_id)
         if not pc:
             logger.error(f"No peer connection for {peer_name}")
             return
-        
+
         # Queue candidate if remote description not set
         if not pc.remoteDescription:
-            logger.info(f"Remote description not set, queuing ICE candidate for {peer_name}")
+            logger.info(
+                f"Remote description not set, queuing ICE candidate for {peer_name}"
+            )
             if peer_id not in self.pending_ice_candidates:
                 self.pending_ice_candidates[peer_id] = []
-            self.pending_ice_candidates[peer_id].append(candidate_data)
+            # candidate_data is a dict from Pydantic model; cast to the TypedDict
+            self.pending_ice_candidates[peer_id].append(
+                cast(ICECandidateDict, candidate_data)
+            )
             return
-        
+
         try:
-            await pc.addIceCandidate(cast(RTCIceCandidate, candidate_data))
-            logger.debug(f"ICE candidate added for {peer_name}")
+            from aiortc.sdp import candidate_from_sdp
+
+            cand = candidate_data.get("candidate")
+            if not cand:
+                # end-of-candidates
+                await pc.addIceCandidate(None)
+                logger.info(f"End-of-candidates added for {peer_name}")
+                return
+
+            if cand and cand.startswith("candidate:"):
+                sdp_part = cand.split(":", 1)[1]
+            else:
+                sdp_part = cand
+
+            # Detect type for logging
+            try:
+                import re
+
+                m = re.search(r"\btyp\s+(host|srflx|relay|prflx)\b", sdp_part)
+                cand_type = m.group(1) if m else "unknown"
+            except Exception:
+                cand_type = "unknown"
+
+            try:
+                rtc_candidate = candidate_from_sdp(sdp_part)
+                rtc_candidate.sdpMid = candidate_data.get("sdpMid")
+                rtc_candidate.sdpMLineIndex = candidate_data.get("sdpMLineIndex")
+
+                # aiortc expects an object with attributes (RTCIceCandidate)
+                await pc.addIceCandidate(rtc_candidate)
+                logger.info(f"ICE candidate added for {peer_name}: type={cand_type}")
+            except Exception as e:
+                logger.error(
+                    f"Failed to add ICE candidate for {peer_name}: type={cand_type} error={e} sdp='{sdp_part}'",
+                    exc_info=True,
+                )
         except Exception as e:
-            logger.error(f"Failed to add ICE candidate for {peer_name}: {e}")
+            logger.error(
+                f"Unexpected error handling ICE candidate for {peer_name}: {e}",
+                exc_info=True,
+            )
+
+    async def _handle_ice_connection_failure(self, peer_id: str, peer_name: str):
+        """Handle ICE connection failure by logging details"""
+        logger.info(f"ICE connection failure detected for {peer_name}")
+
+        pc = self.peer_connections.get(peer_id)
+        if not pc:
+            logger.error(
+                f"No peer connection found for {peer_name} during ICE failure recovery"
+            )
+            return
+
+        logger.error(
+            f"ICE connection failed for {peer_name}. Connection state: {pc.connectionState}, ICE state: {pc.iceConnectionState}"
+        )
+        # In a real implementation, you might want to notify the user or attempt reconnection
+
+    async def _schedule_ice_timeout(self, peer_id: str, peer_name: str):
+        """Schedule a timeout for ICE connection checking"""
+        await asyncio.sleep(30)  # Wait 30 seconds
+
+        pc = self.peer_connections.get(peer_id)
+        if not pc:
+            return
+
+        if pc.iceConnectionState == "checking":
+            logger.warning(
+                f"ICE connection timeout for {peer_name} - still in checking state after 30 seconds"
+            )
+            logger.warning(
+                f"Final connection state: {pc.connectionState}, ICE state: {pc.iceConnectionState}"
+            )
+            logger.warning(
+                "This might be due to network connectivity issues between the browser and Docker container"
+            )
+            logger.warning(
+                "Consider checking: 1) Port forwarding 2) TURN server config 3) Docker network mode"
+            )
+        elif pc.iceConnectionState in ["failed", "closed"]:
+            logger.info(
+                f"ICE connection for {peer_name} resolved to: {pc.iceConnectionState}"
+            )
+        else:
+            logger.info(
+                f"ICE connection for {peer_name} established: {pc.iceConnectionState}"
+            )
+
 
 # Example usage
+def _http_base_url(server_url: str) -> str:
+    # Convert ws:// or wss:// to http(s) and ensure no trailing slash
+    if server_url.startswith("ws://"):
+        return "http://" + server_url[len("ws://") :].rstrip("/")
+    if server_url.startswith("wss://"):
+        return "https://" + server_url[len("wss://") :].rstrip("/")
+    return server_url.rstrip("/")
+
+
+def _ws_url(server_url: str) -> str:
+    # Convert http(s) to ws(s) if needed
+    if server_url.startswith("http://"):
+        return "ws://" + server_url[len("http://") :].rstrip("/")
+    if server_url.startswith("https://"):
+        return "wss://" + server_url[len("https://") :].rstrip("/")
+    return server_url.rstrip("/")
+
+
+def create_or_get_session(
+    server_url: str, session_id: str | None = None, insecure: bool = False
+) -> str:
+    """Call GET /api/session to obtain a session_id (unless one was provided).
+
+    Uses urllib so no extra runtime deps are required.
+    """
+    if session_id:
+        return session_id
+
+    http_base = _http_base_url(server_url)
+    url = f"{http_base}/api/session"
+    req = urllib.request.Request(url, method="GET")
+    # Prepare SSL context if requested (accept self-signed certs)
+    ssl_ctx = None
+    if insecure:
+        ssl_ctx = ssl.create_default_context()
+        ssl_ctx.check_hostname = False
+        ssl_ctx.verify_mode = ssl.CERT_NONE
+
+    try:
+        with urllib.request.urlopen(req, timeout=10, context=ssl_ctx) as resp:
+            body = resp.read()
+            data = json.loads(body)
+
+        # Validate response shape using Pydantic
+        try:
+            session = SessionModel.model_validate(data)
+        except ValidationError as e:
+            raise RuntimeError(f"Invalid session response from {url}: {e}")
+
+        sid = session.id
+        if not sid:
+            raise RuntimeError(f"No session id returned from {url}: {data}")
+        return sid
+    except urllib.error.HTTPError as e:
+        raise RuntimeError(f"HTTP error getting session: {e}")
+    except Exception as e:
+        raise RuntimeError(f"Error getting session: {e}")
+
+
+def create_or_get_lobby(
+    server_url: str,
+    session_id: str,
+    lobby_name: str,
+    private: bool = False,
+    insecure: bool = False,
+) -> str:
+    """Call POST /api/lobby/{session_id} to create or lookup a lobby by name.
+
+    Returns the lobby id.
+    """
+    http_base = _http_base_url(server_url)
+    url = f"{http_base}/api/lobby/{urllib.parse.quote(session_id)}"
+    payload = json.dumps(
+        {
+            "type": "lobby_create",
+            "data": {"name": lobby_name, "private": private},
+        }
+    ).encode("utf-8")
+    req = urllib.request.Request(
+        url, data=payload, headers={"Content-Type": "application/json"}, method="POST"
+    )
+    # Prepare SSL context if requested (accept self-signed certs)
+    ssl_ctx = None
+    if insecure:
+        ssl_ctx = ssl.create_default_context()
+        ssl_ctx.check_hostname = False
+        ssl_ctx.verify_mode = ssl.CERT_NONE
+
+    try:
+        with urllib.request.urlopen(req, timeout=10, context=ssl_ctx) as resp:
+            body = resp.read()
+            data = json.loads(body)
+            # Expect shape: { "type": "lobby_created", "data": {"id":..., ...}}
+            try:
+                lobby_resp = LobbyCreateResponse.model_validate(data)
+            except ValidationError as e:
+                raise RuntimeError(f"Invalid lobby response from {url}: {e}")
+
+            lobby_id = lobby_resp.data.id
+            if not lobby_id:
+                raise RuntimeError(f"No lobby id returned from {url}: {data}")
+            return lobby_id
+    except urllib.error.HTTPError as e:
+        # Try to include response body for.infoging
+        try:
+            body = e.read()
+            msg = body.decode("utf-8", errors="ignore")
+        except Exception:
+            msg = str(e)
+        raise RuntimeError(f"HTTP error creating lobby: {msg}")
+    except Exception as e:
+        raise RuntimeError(f"Error creating lobby: {e}")
+
+
 async def main():
-    """Example usage of the WebRTC signaling client"""
-    
-    # Configuration
-    SERVER_URL = "ws://localhost:8000"  # Adjust to your server
-    LOBBY_ID = "test-lobby"
-    SESSION_ID = "python-client-001"
-    SESSION_NAME = "Python Bot"
-    
-    client = WebRTCSignalingClient(SERVER_URL, LOBBY_ID, SESSION_ID, SESSION_NAME)
-    
+    """Example usage of the WebRTC signaling client with CLI options to create session and lobby."""
+    parser = argparse.ArgumentParser(description="Python WebRTC voicebot client")
+    parser.add_argument(
+        "--server-url",
+        default="http://localhost:8000/ai-voicebot",
+        help="AI-Voicebot lobby and signaling server base URL (http:// or https://)",
+    )
+    parser.add_argument(
+        "--lobby", default="default", help="Lobby name to create or join"
+    )
+    parser.add_argument(
+        "--session-name", default="Python Bot", help="Session (user) display name"
+    )
+    parser.add_argument(
+        "--session-id", default=None, help="Optional existing session id to reuse"
+    )
+    parser.add_argument(
+        "--password",
+        default=None,
+        help="Optional password to register or takeover a name",
+    )
+    parser.add_argument(
+        "--private", action="store_true", help="Create the lobby as private"
+    )
+    parser.add_argument(
+        "--insecure",
+        action="store_true",
+        help="Allow insecure server connections when using SSL (accept self-signed certs)",
+    )
+    args = parser.parse_args()
+
+    # Resolve session id (create if needed)
+    try:
+        session_id = create_or_get_session(
+            args.server_url, args.session_id, insecure=args.insecure
+        )
+        print(f"Using session id: {session_id}")
+    except Exception as e:
+        print(f"Failed to get/create session: {e}")
+        return
+
+    # Create or get lobby id
+    try:
+        lobby_id = create_or_get_lobby(
+            args.server_url,
+            session_id,
+            args.lobby,
+            args.private,
+            insecure=args.insecure,
+        )
+        print(f"Using lobby id: {lobby_id} (name={args.lobby})")
+    except Exception as e:
+        print(f"Failed to create/get lobby: {e}")
+        return
+
+    # Build websocket base URL (ws:// or wss://) from server_url and pass to client so
+    # it constructs the final websocket path (/ws/lobby/{lobby}/{session}) itself.
+    ws_base = _ws_url(args.server_url)
+
+    client = WebRTCSignalingClient(
+        ws_base, lobby_id, session_id, args.session_name, insecure=args.insecure
+    )
+
     # Set up event handlers
     async def on_peer_added(peer: Peer):
         print(f"Peer added: {peer.peer_name}")
-    
+
     async def on_peer_removed(peer: Peer):
         print(f"Peer removed: {peer.peer_name}")
-    
+
     async def on_track_received(peer: Peer, track: MediaStreamTrack):
         print(f"Received {track.kind} track from {peer.peer_name}")
-        # You could save/process the received media here
-    
+
     client.on_peer_added = on_peer_added
     client.on_peer_removed = on_peer_removed
     client.on_track_received = on_track_received
-    
+
     try:
         # Connect and run
+        # If a password was provided on the CLI, store it on the client for use when setting name
+        if args.password:
+            client.name_password = args.password
         await client.connect()
     except KeyboardInterrupt:
         print("Shutting down...")
     finally:
         await client.disconnect()
 
+
 if __name__ == "__main__":
     # Install required packages:
     # pip install aiortc websockets opencv-python numpy
-    
-    asyncio.run(main())
\ No newline at end of file
+
+    asyncio.run(main())
diff --git a/voicebot/pyproject.toml b/voicebot/pyproject.toml
new file mode 100644
index 0000000..02fb2c4
--- /dev/null
+++ b/voicebot/pyproject.toml
@@ -0,0 +1,20 @@
+[project]
+name = "ai-voicebot-agent"
+version = "0.1.0"
+description = "AI Voicebot Environment"
+readme = "README.md"
+requires-python = ">=3.13"
+dependencies = [
+    "aiortc>=1.13.0",
+    "brotli>=1.1.0",
+    "fastapi>=0.116.1",
+    "logging>=0.4.9.6",
+    "mypy>=1.17.1",
+    "numpy>=2.3.2",
+    "openai>=1.102.0",
+    "opencv-python>=4.11.0.86",
+    "python-dotenv>=1.1.1",
+    "ruff>=0.12.11",
+    "uvicorn>=0.35.0",
+    "websockets>=15.0.1",
+]
diff --git a/voicebot/scripts/reload_runner.py b/voicebot/scripts/reload_runner.py
new file mode 100644
index 0000000..a48cfde
--- /dev/null
+++ b/voicebot/scripts/reload_runner.py
@@ -0,0 +1,161 @@
+#!/usr/bin/env python3
+"""
+Simple file-watcher that restarts a command when Python source files change.
+
+Usage:
+  python scripts/reload_runner.py --watch voicebot -- python voicebot/main.py
+
+This is intentionally dependency-free so it works in minimal dev environments
+and inside containers without installing extra packages.
+"""
+from __future__ import annotations
+
+import argparse
+import os
+import signal
+import subprocess
+import sys
+import time
+from typing import Dict, List, Optional
+from types import FrameType
+
+
+def scan_py_mtimes(paths: List[str]) -> Dict[str, float]:
+    mtimes: Dict[str, float] = {}
+    for p in paths:
+        if os.path.isfile(p) and p.endswith('.py'):
+            try:
+                mtimes[p] = os.path.getmtime(p)
+            except OSError:
+                pass
+            continue
+
+        for root, _, files in os.walk(p):
+            for f in files:
+                if not f.endswith('.py'):
+                    continue
+                fp = os.path.join(root, f)
+                try:
+                    mtimes[fp] = os.path.getmtime(fp)
+                except OSError:
+                    # file might disappear between walk and stat
+                    pass
+    return mtimes
+
+
+def start_process(cmd: List[str]) -> subprocess.Popen[bytes]:
+    print("Starting:", " ".join(cmd))
+    return subprocess.Popen(cmd)
+
+
+def terminate_process(p: subprocess.Popen[bytes], timeout: float = 5.0) -> None:
+    if p.poll() is not None:
+        return
+    try:
+        p.terminate()
+        waited = 0.0
+        while p.poll() is None and waited < timeout:
+            time.sleep(0.1)
+            waited += 0.1
+        if p.poll() is None:
+            p.kill()
+    except Exception as e:
+        print("Error terminating process:", e)
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description="Restart a command when .py files change")
+    parser.add_argument("--watch", "-w", nargs="+", default=["."], help="Directories or files to watch")
+    parser.add_argument("--interval", "-i", type=float, default=1.0, help="Polling interval in seconds")
+    parser.add_argument("--delay-restart", type=float, default=0.1, help="Delay after change before restarting")
+    parser.add_argument("--no-restart-on-exit", action="store_true", help="Don't restart if the process exits on its own")
+    parser.add_argument("--pass-sigterm", action="store_true", help="Forward SIGTERM to child and exit when received")
+    # Accept the command to run as a positional "remainder" so callers can
+    # separate options with `--` and have everything after it treated as the
+    # command. Defining an option named "--" doesn't work reliably with
+    # argparse; use a positional argument instead.
+    parser.add_argument("cmd", nargs=argparse.REMAINDER, help="Command to run (required)")
+    args = parser.parse_args()
+
+    # args.cmd is the remainder of the command-line. Users typically call this
+    # script like: `reload_runner.py --watch . -- mycmd arg1 arg2`.
+    # argparse will include a literal leading '--' in the remainder list, so
+    # strip it if present.
+    raw_cmd = args.cmd
+    if raw_cmd and raw_cmd[0] == "--":
+        cmd = raw_cmd[1:]
+    else:
+        cmd = raw_cmd
+
+    if not cmd:
+        parser.error("Missing command to run. Put `--` before the command. See help.")
+
+    watch_paths = args.watch
+
+    last_mtimes = scan_py_mtimes(watch_paths)
+
+    child = start_process(cmd)
+
+    def handle_sigterm(signum: int, frame: Optional[FrameType]) -> None:
+        if args.pass_sigterm:
+            try:
+                child.send_signal(signum)
+            except Exception:
+                pass
+        print("Received signal, stopping watcher.")
+        try:
+            terminate_process(child)
+        finally:
+            sys.exit(0)
+
+    signal.signal(signal.SIGINT, handle_sigterm)
+    signal.signal(signal.SIGTERM, handle_sigterm)
+
+    try:
+        while True:
+            # Sleep in small increments so Ctrl-C is responsive
+            time.sleep(args.interval)
+
+            # If the child exited on its own
+            if child.poll() is not None:
+                rc = child.returncode
+                print(f"Process exited with code {rc}.")
+                if args.no_restart_on_exit:
+                    return rc
+                # else restart immediately
+                child = start_process(cmd)
+                last_mtimes = scan_py_mtimes(watch_paths)
+                continue
+
+            # Check for source changes
+            current = scan_py_mtimes(watch_paths)
+            changed = False
+            # Check for new or changed files
+            for fp, m in current.items():
+                if fp not in last_mtimes or last_mtimes.get(fp) != m:
+                    print("Detected change in:", fp)
+                    changed = True
+                    break
+            # Check for deleted files
+            if not changed:
+                for fp in list(last_mtimes.keys()):
+                    if fp not in current:
+                        print("Detected deleted file:", fp)
+                        changed = True
+                        break
+
+            if changed:
+                # Small debounce
+                time.sleep(args.delay_restart)
+                terminate_process(child)
+                child = start_process(cmd)
+                last_mtimes = scan_py_mtimes(watch_paths)
+
+    except KeyboardInterrupt:
+        print("Interrupted, shutting down.")
+        terminate_process(child)
+        return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())