agentvibes 2.12.4 → 2.12.6

package/.claude/hooks/bmad-voice-manager.sh

@@ -59,8 +59,12 @@ ENABLED_FLAG="$CONFIG_DIR/bmad-voices-enabled.flag"
 # @calledby auto_enable_if_bmad_detected, get_bmad_config_path
 # @calls None
 detect_bmad_version() {
-    if [[ -f "bmad/_cfg/manifest.yaml" ]]; then
-        # v6 detected
+    if [[ -f ".bmad/_cfg/manifest.yaml" ]]; then
+        # v6 detected (standard path with dot prefix)
+        echo "6"
+        return 0
+    elif [[ -f "bmad/_cfg/manifest.yaml" ]]; then
+        # v6 detected (alternative path without dot prefix)
         echo "6"
         return 0
     elif [[ -f ".bmad-core/install-manifest.yaml" ]]; then
@@ -88,7 +92,12 @@ get_bmad_config_path() {
     local version=$(detect_bmad_version)
 
     if [[ "$version" == "6" ]]; then
-        echo "bmad/core/config.yaml"
+        # Check both possible v6 paths
+        if [[ -f ".bmad/core/config.yaml" ]]; then
+            echo ".bmad/core/config.yaml"
+        else
+            echo "bmad/core/config.yaml"
+        fi
         return 0
     elif [[ "$version" == "4" ]]; then
         echo ".bmad-core/config.yaml"
@@ -138,8 +147,15 @@ get_agent_voice() {
 
     # Check for BMAD v6 CSV file first (preferred, loose coupling)
     # If this exists, use it directly without requiring plugin enable flag
-    local bmad_voice_map=".bmad/_cfg/agent-voice-map.csv"
-    if [[ -f "$bmad_voice_map" ]]; then
+    # Support both .bmad (standard) and bmad (alternative) paths
+    local bmad_voice_map=""
+    if [[ -f ".bmad/_cfg/agent-voice-map.csv" ]]; then
+        bmad_voice_map=".bmad/_cfg/agent-voice-map.csv"
+    elif [[ -f "bmad/_cfg/agent-voice-map.csv" ]]; then
+        bmad_voice_map="bmad/_cfg/agent-voice-map.csv"
+    fi
+
+    if [[ -n "$bmad_voice_map" ]]; then
         # Read from BMAD's standard _cfg directory
         # CSV format: agent_id,voice_name
         local voice=$(grep "^$agent_id," "$bmad_voice_map" | cut -d',' -f2)

package/.claude/hooks/play-tts.sh

@@ -46,6 +46,18 @@ export LC_ALL=C
 TEXT="$1"
 VOICE_OVERRIDE="$2"  # Optional: voice name or ID
 
+# Security: Validate inputs
+if [[ -z "$TEXT" ]]; then
+  echo "Error: No text provided" >&2
+  exit 1
+fi
+
+# Security: Validate voice override doesn't contain dangerous characters
+if [[ -n "$VOICE_OVERRIDE" ]] && [[ "$VOICE_OVERRIDE" =~ [';|&$`<>(){}'] ]]; then
+  echo "Error: Invalid characters in voice parameter" >&2
+  exit 1
+fi
+
 # Remove backslash escaping that Claude might add for special chars like ! and $
 # In single quotes these don't need escaping, but Claude sometimes adds \! anyway
 TEXT="${TEXT//\\!/!}"

package/.claude/hooks/tts-queue.sh

@@ -8,15 +8,26 @@
 
 set -euo pipefail
 
-QUEUE_DIR="/tmp/agentvibes-tts-queue"
+# Security: Use secure temp directory with restrictive permissions
+# Check if XDG_RUNTIME_DIR is available (more secure than /tmp)
+if [[ -n "${XDG_RUNTIME_DIR:-}" ]] && [[ -d "$XDG_RUNTIME_DIR" ]]; then
+  QUEUE_DIR="$XDG_RUNTIME_DIR/agentvibes-tts-queue"
+else
+  # Fallback to user-specific temp directory
+  QUEUE_DIR="/tmp/agentvibes-tts-queue-$USER"
+fi
+
 QUEUE_LOCK="$QUEUE_DIR/queue.lock"
 WORKER_PID_FILE="$QUEUE_DIR/worker.pid"
 
 # Get script directory
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
-# Initialize queue directory
-mkdir -p "$QUEUE_DIR"
+# Initialize queue directory with restrictive permissions
+if [[ ! -d "$QUEUE_DIR" ]]; then
+  mkdir -p "$QUEUE_DIR"
+  chmod 700 "$QUEUE_DIR"  # Only owner can read/write/execute
+fi
 
 # @function add_to_queue
 # @intent Add a TTS request to the queue for sequential playback
@@ -43,18 +54,35 @@ EOF
 # @function start_worker_if_needed
 # @intent Start the queue worker process if it's not already running
 start_worker_if_needed() {
-  # Check if worker is already running
+  # Security: Use file locking to prevent race condition
+  # Open file descriptor 200 for locking
+  exec 200>"$QUEUE_LOCK"
+
+  # Acquire exclusive lock (flock -x) with timeout
+  if ! flock -x -w 5 200; then
+    echo "Warning: Could not acquire queue lock" >&2
+    return 1
+  fi
+
+  # Check if worker is already running (within lock)
   if [[ -f "$WORKER_PID_FILE" ]]; then
     local pid=$(cat "$WORKER_PID_FILE")
     if kill -0 "$pid" 2>/dev/null; then
-      # Worker is running
+      # Worker is running, release lock and return
+      flock -u 200
+      exec 200>&-
       return 0
     fi
   fi
 
   # Start worker in background
   "$SCRIPT_DIR/tts-queue-worker.sh" &
-  echo $! > "$WORKER_PID_FILE"
+  local worker_pid=$!
+  echo $worker_pid > "$WORKER_PID_FILE"
+
+  # Release lock
+  flock -u 200
+  exec 200>&-
 }
 
 # @function clear_queue

package/README.md

@@ -11,7 +11,7 @@
 [![Publish](https://github.com/paulpreibisch/AgentVibes/actions/workflows/publish.yml/badge.svg)](https://github.com/paulpreibisch/AgentVibes/actions/workflows/publish.yml)
 [![License](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)
 
-**Author**: Paul Preibisch ([@997Fire](https://x.com/997Fire)) | **Version**: v2.11.0
+**Author**: Paul Preibisch ([@997Fire](https://x.com/997Fire)) | **Version**: v2.12.6
 
 ---
 
@@ -94,17 +94,19 @@ Whether you're coding in Claude Code, chatting in Claude Desktop, or using Warp
 
 ## 📰 Latest Release
 
-**[v2.12.0 - .agentvibes/ Directory Migration](https://github.com/paulpreibisch/AgentVibes/releases/tag/v2.11.0)** 🎉
+**[v2.12.6 - Security & Reliability Improvements](https://github.com/paulpreibisch/AgentVibes/releases/tag/v2.12.6)** 🎉
 
-AgentVibes v2.12.0 introduces a comprehensive directory reorganization, migrating all AgentVibes-specific configuration from `.claude/config/` and `.claude/plugins/` to a dedicated `.agentvibes/` directory. This eliminates namespace confusion with Claude Code's official directories and provides a clear, predictable location for all AgentVibes state. Migration is fully automatic during upgrade—users simply run `npx agentvibes@latest update` and their configuration is seamlessly moved.
+AgentVibes v2.12.6 brings quality improvements based on SonarCloud analysis and enhances BMAD party mode. This release improves API key privacy in terminal output, adds better cleanup for long-running sessions, includes more robust error handling, and ensures BMAD agents each get their unique voice. All improvements maintain 100% backward compatibility.
 
-**Key highlights:**
-- 📁 **Dedicated .agentvibes/ Directory** - Clear namespace separation from Claude Code
-- 🔄 **Automatic Migration** - Seamless upgrade from .claude/config/ and .claude/plugins/
-- ✅ **100% Backward Compatible** - No manual intervention required
-- 🧪 **32 Passing Tests** - Comprehensive test suite validates all migration scenarios
-- 🎭 **npx test-bmad-pr** - New one-line command for BMAD PR testing
-- 🎤 **Enhanced Voice Installation** - Better Piper voice detection and status display
+**Key Highlights:**
+- 🔒 **API Key Privacy** - Masked display prevents credential leaks in terminal history
+- 🛡️ **Resource Cleanup** - Better subprocess management for long-running stability
+- ⚡ **Error Handling** - Graceful degradation instead of crashes on file operations
+- 🎭 **BMAD Voice Detection** - Party mode supports multiple directory paths
+- ✅ **110/110 Tests Passing** - All functionality verified and working
+- 🔄 **Zero Breaking Changes** - Fully backward compatible with v2.12.5
+
+💡 **Tip:** If `npx agentvibes` shows an older version or missing commands, clear your npm cache: `npm cache clean --force && npx agentvibes@latest --help`
 
 [→ View All Releases](https://github.com/paulpreibisch/AgentVibes/releases)
 
@@ -153,6 +155,11 @@ macOS ships with bash 3.2 (from 2007) which lacks modern bash features AgentVibe
 
 Get AgentVibes running in 3 steps: **Install** → **Choose Provider** (Piper/ElevenLabs) → **Enable Voice**
 
+**Quick Install:**
+```bash
+npx agentvibes install
+```
+
 **[→ View Complete Quick Start Guide](docs/quick-start.md)** - Full installation options, provider setup, and activation steps
 
 [↑ Back to top](#-table-of-contents)