agentvibes 2.12.4 → 2.12.5

package/.claude/hooks/play-tts.sh

@@ -46,6 +46,18 @@ export LC_ALL=C
 TEXT="$1"
 VOICE_OVERRIDE="$2"  # Optional: voice name or ID
 
+# Security: Validate inputs
+if [[ -z "$TEXT" ]]; then
+  echo "Error: No text provided" >&2
+  exit 1
+fi
+
+# Security: Validate voice override doesn't contain dangerous characters
+if [[ -n "$VOICE_OVERRIDE" ]] && [[ "$VOICE_OVERRIDE" =~ [';|&$`<>(){}'] ]]; then
+  echo "Error: Invalid characters in voice parameter" >&2
+  exit 1
+fi
+
 # Remove backslash escaping that Claude might add for special chars like ! and $
 # In single quotes these don't need escaping, but Claude sometimes adds \! anyway
 TEXT="${TEXT//\\!/!}"

package/.claude/hooks/tts-queue.sh

@@ -8,15 +8,26 @@
 
 set -euo pipefail
 
-QUEUE_DIR="/tmp/agentvibes-tts-queue"
+# Security: Use secure temp directory with restrictive permissions
+# Check if XDG_RUNTIME_DIR is available (more secure than /tmp)
+if [[ -n "${XDG_RUNTIME_DIR:-}" ]] && [[ -d "$XDG_RUNTIME_DIR" ]]; then
+  QUEUE_DIR="$XDG_RUNTIME_DIR/agentvibes-tts-queue"
+else
+  # Fallback to user-specific temp directory
+  QUEUE_DIR="/tmp/agentvibes-tts-queue-$USER"
+fi
+
 QUEUE_LOCK="$QUEUE_DIR/queue.lock"
 WORKER_PID_FILE="$QUEUE_DIR/worker.pid"
 
 # Get script directory
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
-# Initialize queue directory
-mkdir -p "$QUEUE_DIR"
+# Initialize queue directory with restrictive permissions
+if [[ ! -d "$QUEUE_DIR" ]]; then
+  mkdir -p "$QUEUE_DIR"
+  chmod 700 "$QUEUE_DIR"  # Only owner can read/write/execute
+fi
 
 # @function add_to_queue
 # @intent Add a TTS request to the queue for sequential playback
@@ -43,18 +54,35 @@ EOF
 # @function start_worker_if_needed
 # @intent Start the queue worker process if it's not already running
 start_worker_if_needed() {
-  # Check if worker is already running
+  # Security: Use file locking to prevent race condition
+  # Open file descriptor 200 for locking
+  exec 200>"$QUEUE_LOCK"
+
+  # Acquire exclusive lock (flock -x) with timeout
+  if ! flock -x -w 5 200; then
+    echo "Warning: Could not acquire queue lock" >&2
+    return 1
+  fi
+
+  # Check if worker is already running (within lock)
   if [[ -f "$WORKER_PID_FILE" ]]; then
     local pid=$(cat "$WORKER_PID_FILE")
     if kill -0 "$pid" 2>/dev/null; then
-      # Worker is running
+      # Worker is running, release lock and return
+      flock -u 200
+      exec 200>&-
       return 0
     fi
   fi
 
   # Start worker in background
   "$SCRIPT_DIR/tts-queue-worker.sh" &
-  echo $! > "$WORKER_PID_FILE"
+  local worker_pid=$!
+  echo $worker_pid > "$WORKER_PID_FILE"
+
+  # Release lock
+  flock -u 200
+  exec 200>&-
 }
 
 # @function clear_queue

package/README.md

@@ -11,7 +11,7 @@
 [![Publish](https://github.com/paulpreibisch/AgentVibes/actions/workflows/publish.yml/badge.svg)](https://github.com/paulpreibisch/AgentVibes/actions/workflows/publish.yml)
 [![License](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)
 
-**Author**: Paul Preibisch ([@997Fire](https://x.com/997Fire)) | **Version**: v2.11.0
+**Author**: Paul Preibisch ([@997Fire](https://x.com/997Fire)) | **Version**: v2.12.5
 
 ---
 
@@ -94,17 +94,19 @@ Whether you're coding in Claude Code, chatting in Claude Desktop, or using Warp
 
 ## 📰 Latest Release
 
-**[v2.12.0 - .agentvibes/ Directory Migration](https://github.com/paulpreibisch/AgentVibes/releases/tag/v2.11.0)** 🎉
+**[v2.12.5 - Code Quality Improvements](https://github.com/paulpreibisch/AgentVibes/releases/tag/v2.12.5)** 🎉
 
-AgentVibes v2.12.0 introduces a comprehensive directory reorganization, migrating all AgentVibes-specific configuration from `.claude/config/` and `.claude/plugins/` to a dedicated `.agentvibes/` directory. This eliminates namespace confusion with Claude Code's official directories and provides a clear, predictable location for all AgentVibes state. Migration is fully automatic during upgrade—users simply run `npx agentvibes@latest update` and their configuration is seamlessly moved.
+AgentVibes v2.12.5 improves code quality by upgrading Sonar quality gates and implementing best practices identified through static analysis. This release includes enhanced input validation, improved shell command handling, better file locking for atomic operations, and secure temporary directory management while maintaining 100% backward compatibility.
 
-**Key highlights:**
-- 📁 **Dedicated .agentvibes/ Directory** - Clear namespace separation from Claude Code
-- 🔄 **Automatic Migration** - Seamless upgrade from .claude/config/ and .claude/plugins/
-- ✅ **100% Backward Compatible** - No manual intervention required
-- 🧪 **32 Passing Tests** - Comprehensive test suite validates all migration scenarios
-- 🎭 **npx test-bmad-pr** - New one-line command for BMAD PR testing
-- 🎤 **Enhanced Voice Installation** - Better Piper voice detection and status display
+**Key Highlights:**
+- ✅ **Sonar Quality Gates Upgraded** - Enhanced code quality standards across the codebase
+- 🔒 **18 Code Improvements** - Better input validation, command handling, and file operations
+- 🧪 **110/110 Tests Passing** - All functionality verified and working
+- 🔄 **Zero Breaking Changes** - Fully backward compatible with existing installations
+- 📊 **162 Lines Enhanced** - Code quality improvements across 8 files
+- 💡 **Best Practices** - Improved error handling and validation
+
+💡 **Tip:** If `npx agentvibes` shows an older version or missing commands, clear your npm cache: `npm cache clean --force && npx agentvibes@latest --help`
 
 [→ View All Releases](https://github.com/paulpreibisch/AgentVibes/releases)
 
@@ -153,6 +155,11 @@ macOS ships with bash 3.2 (from 2007) which lacks modern bash features AgentVibe
 
 Get AgentVibes running in 3 steps: **Install** → **Choose Provider** (Piper/ElevenLabs) → **Enable Voice**
 
+**Quick Install:**
+```bash
+npx agentvibes install
+```
+
 **[→ View Complete Quick Start Guide](docs/quick-start.md)** - Full installation options, provider setup, and activation steps
 
 [↑ Back to top](#-table-of-contents)