agentvibes 2.13.4 → 2.13.6

package/.claude/hooks/tts-queue-worker.sh

@@ -7,7 +7,27 @@
 
 set -euo pipefail
 
-QUEUE_DIR="/tmp/agentvibes-tts-queue"
+# Security: Use secure temp directory with restrictive permissions
+# Must match the logic in tts-queue.sh exactly
+if [[ -n "${XDG_RUNTIME_DIR:-}" ]] && [[ -d "$XDG_RUNTIME_DIR" ]]; then
+  QUEUE_DIR="$XDG_RUNTIME_DIR/agentvibes-tts-queue"
+else
+  # Fallback to user-specific temp directory
+  QUEUE_DIR="/tmp/agentvibes-tts-queue-$USER"
+fi
+
+# Security: Validate queue directory exists and has correct ownership
+if [[ ! -d "$QUEUE_DIR" ]]; then
+  echo "Error: Queue directory does not exist: $QUEUE_DIR" >&2
+  exit 1
+fi
+
+# Security: Verify we own the queue directory (prevent symlink attacks)
+if [[ "$(stat -c '%u' "$QUEUE_DIR" 2>/dev/null || stat -f '%u' "$QUEUE_DIR" 2>/dev/null)" != "$(id -u)" ]]; then
+  echo "Error: Queue directory not owned by current user" >&2
+  exit 1
+fi
+
 WORKER_PID_FILE="$QUEUE_DIR/worker.pid"
 IDLE_TIMEOUT=5  # Exit after 5 seconds of no new requests
 
@@ -32,7 +52,7 @@ elif [[ -f "$HOME/.claude/tts-speaker-delay.txt" ]]; then
 fi
 
 # Trap to clean up on exit
-trap "rm -f $WORKER_PID_FILE" EXIT
+trap 'rm -f "$WORKER_PID_FILE"' EXIT
 
 # Process queue items
 process_queue() {

package/package.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/package.json",
   "name": "agentvibes",
-  "version": "2.13.4",
+  "version": "2.13.6",
   "description": "Now your AI Agents can finally talk back! Professional TTS voice for Claude Code and Claude Desktop (via MCP) with multi-provider support.",
   "homepage": "https://agentvibes.org",
   "keywords": [