agentvibes 4.0.0 → 4.2.0

package/bin/agentvibes-voice-browser.js

@@ -242,12 +242,15 @@ class AgentVibesVoiceBrowser {
       for (const line of lines) {
         try {
           const voice = JSON.parse(line);
-          voices.push({
-            name: voice.Name,
-            gender: voice.Gender?.toLowerCase() || 'unknown',
-            language: voice.Culture || 'en-US',
-            provider: 'windows-sapi'
-          });
+          // SECURITY: Validate expected schema from PowerShell output (#133)
+          if (voice && typeof voice.Name === 'string' && voice.Name.length > 0) {
+            voices.push({
+              name: voice.Name,
+              gender: typeof voice.Gender === 'string' ? voice.Gender.toLowerCase() : 'unknown',
+              language: typeof voice.Culture === 'string' ? voice.Culture : 'en-US',
+              provider: 'windows-sapi'
+            });
+          }
         } catch {}
       }
       return voices;
@@ -1309,7 +1312,8 @@ class AgentVibesVoiceBrowser {
 
     for (const player of players) {
       try {
-        await execAsync(`which ${player.cmd} 2>/dev/null`);
+        // SECURITY: Use spawnSync instead of shell string (#126)
+          if (spawnSync('which', [player.cmd], { stdio: 'ignore' }).status !== 0) throw new Error('not found');
 
         const audioProcess = spawn(player.cmd, player.args, { stdio: 'ignore' });
         this.currentAudioProcess = audioProcess;
@@ -1508,7 +1512,10 @@ class AgentVibesVoiceBrowser {
 
   async playWindowsSAPIVoice(row, sampleText) {
     try {
-      const psScript = `Add-Type -AssemblyName System.Speech; $synth = New-Object System.Speech.Synthesis.SpeechSynthesizer; $synth.SelectVoice('${row.name}'); $synth.Speak('${sampleText.replace(/'/g, "''")}')`;
+      // SECURITY: Escape row.name and sampleText for PowerShell single-quote context (#124)
+      const safeName = row.name.replace(/'/g, "''");
+      const safeText = sampleText.replace(/'/g, "''");
+      const psScript = `Add-Type -AssemblyName System.Speech; $synth = New-Object System.Speech.Synthesis.SpeechSynthesizer; $synth.SelectVoice('${safeName}'); $synth.Speak('${safeText}')`;
       const process = spawn('powershell', ['-Command', psScript], { stdio: 'ignore' });
       this.currentAudioProcess = process;
 
@@ -1547,9 +1554,18 @@ class AgentVibesVoiceBrowser {
       };
       await fs.writeFile(payloadFile, JSON.stringify(payload));
 
-      // Call Soprano API to generate audio (OpenAI format)
-      const curlCmd = `curl -s -m 10 -X POST http://127.0.0.1:7860/v1/audio/speech -H "Content-Type: application/json" -d @${payloadFile} -o ${outputFile}`;
-      await execAsync(curlCmd);
+      // SECURITY: Use spawn with argument array instead of shell string (#125)
+      await new Promise((resolve, reject) => {
+        const curlProc = spawn('curl', [
+          '-s', '-m', '10', '-X', 'POST',
+          'http://127.0.0.1:7860/v1/audio/speech',
+          '-H', 'Content-Type: application/json',
+          '-d', `@${payloadFile}`,
+          '-o', outputFile
+        ], { stdio: 'ignore' });
+        curlProc.on('close', (code) => code === 0 ? resolve() : reject(new Error(`curl exited ${code}`)));
+        curlProc.on('error', reject);
+      });
 
       // Clean up payload file
       try {
@@ -1565,7 +1581,8 @@ class AgentVibesVoiceBrowser {
 
       for (const player of players) {
         try {
-          await execAsync(`which ${player.cmd} 2>/dev/null`);
+          // SECURITY: Use spawnSync instead of shell string (#126)
+          if (spawnSync('which', [player.cmd], { stdio: 'ignore' }).status !== 0) throw new Error('not found');
 
           const audioProcess = spawn(player.cmd, player.args, { stdio: 'ignore' });
           this.currentAudioProcess = audioProcess;
@@ -1630,10 +1647,8 @@ class AgentVibesVoiceBrowser {
       }
 
       const modelPath = path.join(CONFIG.PIPER_VOICES_DIR, `${safeModel}.onnx`);
-      try {
-        await fs.access(outputFile);
-      } catch {
-        // Use spawn instead of execAsync to prevent command injection
+      // SECURITY: Always regenerate instead of TOCTOU check (#132)
+      {
         const piperProcess = spawn(CONFIG.PIPER_PATH, [
           '--model', modelPath,
           '--output_file', outputFile
@@ -1666,10 +1681,8 @@ class AgentVibesVoiceBrowser {
         return;
       }
 
-      try {
-        await fs.access(outputFile);
-      } catch {
-        // Use spawn instead of execAsync to prevent command injection
+      // SECURITY: Always regenerate instead of TOCTOU check (#132)
+      {
         const piperProcess = spawn(CONFIG.PIPER_PATH, [
           '--model', CONFIG.MODEL_PATH,
           '--speaker', row.id.toString(),
@@ -1694,7 +1707,8 @@ class AgentVibesVoiceBrowser {
 
     for (const player of players) {
       try {
-        await execAsync(`which ${player.cmd} 2>/dev/null`);
+        // SECURITY: Use spawnSync instead of shell string (#126)
+          if (spawnSync('which', [player.cmd], { stdio: 'ignore' }).status !== 0) throw new Error('not found');
 
         // SECURITY: Store process immediately to prevent leak
         const audioProcess = spawn(player.cmd, player.args, { stdio: 'ignore' });

package/mcp-server/server.py

@@ -821,6 +821,42 @@ class AgentVibesServer:
         result = await self._run_script("clean-audio-cache.sh", [])
         return result if result else "❌ Failed to clean audio cache"
 
+    async def set_banner(self, enabled: bool) -> str:
+        """
+        Enable or disable the TTS output banner (voice info, file path, cache size).
+
+        Args:
+            enabled: True to show banner, False to hide it
+
+        Returns:
+            Confirmation message
+        """
+        banner_file = Path.home() / ".agentvibes" / "banner-disabled"
+        if enabled:
+            # Remove the disable flag
+            try:
+                banner_file.unlink(missing_ok=True)
+            except Exception:
+                pass
+            return "✅ TTS banner enabled — voice info will show after each speech"
+        else:
+            # Create the disable flag
+            banner_file.parent.mkdir(parents=True, exist_ok=True)
+            banner_file.touch()
+            return "🔇 TTS banner disabled — speech will play without output info"
+
+    async def get_banner(self) -> str:
+        """
+        Check if the TTS output banner is enabled or disabled.
+
+        Returns:
+            Current banner status
+        """
+        banner_file = Path.home() / ".agentvibes" / "banner-disabled"
+        if banner_file.exists():
+            return "🔇 TTS banner: **disabled**\n\nSay: \"Turn on banner\" to re-enable"
+        return "✅ TTS banner: **enabled**\n\nSay: \"Turn off banner\" to disable"
+
     # Helper methods
     def _build_script_env(self) -> dict:
         """Build environment dict for script execution (shared by all script runners)"""

package/package.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/package.json",
   "name": "agentvibes",
-  "version": "4.0.0",
+  "version": "4.2.0",
   "description": "Now your AI Agents can finally talk back! Professional TTS voice for Claude Code, Claude Desktop (via MCP), and Clawdbot with multi-provider support.",
   "homepage": "https://agentvibes.org",
   "keywords": [
@@ -89,7 +89,6 @@
   },
   "dependencies": {
     "@inquirer/search": "^3.1.3",
-    "agentvibes": "^3.5.9",
     "blessed": "^0.1.81",
     "boxen": "^7.0.0",
     "chalk": "^5.0.0",
@@ -106,7 +105,6 @@
     "access": "public"
   },
   "devDependencies": {
-    "bats": "^1.13.0",
     "c8": "^10.1.3"
   }
 }

package/src/console/app.js

@@ -14,7 +14,7 @@ import { fileURLToPath } from 'node:url';
 import { spawnSync, execFileSync } from 'node:child_process';
 import { NavigationService, TAB_ORDER } from '../services/navigation-service.js';
 import { setupNavigation } from './navigation.js';
-import { createPlaceholderTab, TAB_DISPLAY_LABELS } from './tabs/placeholder-tab.js';
+import { createPlaceholderTab, TAB_DISPLAY_LABELS, TAB_SHORTCUT_KEYS } from './tabs/placeholder-tab.js';
 import { FOOTER_CONFIG, DEFAULT_FOOTER_COLOR } from './footer-config.js';
 import { createModalOverlay } from './modals/modal-overlay.js';
 import { BRAND_PINK } from './brand-colors.js';
@@ -24,6 +24,8 @@ import { createMusicTab } from './tabs/music-tab.js';
 import { createInstallTab } from './tabs/install-tab.js';
 import { createHelpTab } from './tabs/help-tab.js';
 import { createReadmeTab } from './tabs/readme-tab.js';
+import { createReceiverTab } from './tabs/receiver-tab.js';
+import { createAgentsTab } from './tabs/agents-tab.js';
 import { ConfigService } from '../services/config-service.js';
 import { ProviderService } from '../services/provider-service.js';
 
@@ -112,7 +114,7 @@ export class AgentVibesConsole {
     // Screen options stored as property so tests can verify correct configuration
     // without needing to intercept the blessed.screen() call (ESM mock limitation).
     this._screenOptions = {
-      smartCSR: false,
+      smartCSR: true,
       mouse: true,
       fullUnicode: true,
       title: `AgentVibes v${APP_VERSION} TUI Console`,
@@ -292,7 +294,8 @@ export class AgentVibesConsole {
     let xOffset = 1;
     for (const id of TAB_ORDER) {
       const label = TAB_DISPLAY_LABELS[id];
-      const text = ` [${label[0]}] ${label} `;
+      const shortcutKey = TAB_SHORTCUT_KEYS[id] || label[0];
+      const text = ` [${shortcutKey}] ${label} `;
       const el = blessed.box({
         parent: this.screen,
         top: 3,
@@ -478,10 +481,11 @@ export class AgentVibesConsole {
   _renderTabBarContent(activeTabId) {
     return TAB_ORDER.map(id => {
       const label = TAB_DISPLAY_LABELS[id];
+      const shortcutKey = TAB_SHORTCUT_KEYS[id] || label[0];
       if (id === activeTabId) {
-        return `{bold}{white-fg}[${label[0]}] ${label}{/white-fg}{/bold}`;
+        return `{bold}{white-fg}[${shortcutKey}] ${label}{/white-fg}{/bold}`;
       }
-      return `{#82b1ff-fg}[${label[0]}] ${label}{/#82b1ff-fg}`;
+      return `{#82b1ff-fg}[${shortcutKey}] ${label}{/#82b1ff-fg}`;
     }).join('  ');
   }
 
@@ -657,6 +661,20 @@ export class AgentVibesConsole {
     }
     this.tabs['help'] = createHelpTab(this.screen, services);
 
+    // Destroy agents placeholder and mount real agents tab
+    const agentsPlaceholder = this.tabs['agents'];
+    if (agentsPlaceholder && typeof agentsPlaceholder.destroy === 'function') {
+      agentsPlaceholder.destroy();
+    }
+    this.tabs['agents'] = createAgentsTab(this.screen, services);
+
+    // Destroy receiver placeholder and mount real receiver tab
+    const receiverPlaceholder = this.tabs['receiver'];
+    if (receiverPlaceholder && typeof receiverPlaceholder.destroy === 'function') {
+      receiverPlaceholder.destroy();
+    }
+    this.tabs['receiver'] = createReceiverTab(this.screen, services);
+
     const readmePlaceholder = this.tabs['readme'];
     if (readmePlaceholder && typeof readmePlaceholder.destroy === 'function') {
       readmePlaceholder.destroy();

package/src/console/constants/personalities.js

@@ -0,0 +1,44 @@
+/**
+ * AgentVibes — Canonical personality constants.
+ *
+ * Single source of truth for personality names and their associated emoji
+ * glyphs.  All TUI modules (settings-tab, agents-tab, personality-picker …)
+ * import from here; src/installer.js maintains its own copy because it
+ * predates the TUI and uses a different module-load path.
+ *
+ * Exported:
+ *   PERSONALITY_EMOJIS  — Map of personality name → emoji string
+ *   PERSONALITIES       — Ordered array of personality names (canonical order
+ *                         used for picker lists)
+ */
+
+export const PERSONALITY_EMOJIS = Object.freeze({
+  angry:        '😠',
+  annoying:     '😤',
+  crass:        '🤬',
+  dramatic:     '🎭',
+  'dry-humor':  '😐',
+  flirty:       '😘',
+  funny:        '😂',
+  grandpa:      '👴',
+  millennial:   '🙄',
+  moody:        '😒',
+  none:         '😊',
+  normal:       '😊',
+  pirate:       '⚓',
+  poetic:       '📜',
+  professional: '👔',
+  rapper:       '🎤',
+  robot:        '🤖',
+  sarcastic:    '😏',
+  sassy:        '💁',
+  'surfer-dude':'🏄',
+  zen:          '🧘',
+});
+
+export const PERSONALITIES = Object.freeze([
+  'none', 'angry', 'annoying', 'crass', 'dramatic', 'dry-humor',
+  'flirty', 'funny', 'grandpa', 'millennial', 'moody', 'normal',
+  'pirate', 'poetic', 'professional', 'rapper', 'robot', 'sarcastic',
+  'sassy', 'surfer-dude', 'zen',
+]);

package/src/console/footer-config.js

@@ -35,6 +35,14 @@ export const FOOTER_CONFIG = {
     color: '#607d8b',
     text: ` ${key('↑↓')} Scroll  ${key('Q')} Quit`,
   },
+  agents: {
+    color: '#9c27b0',
+    text: ` ${key('↑↓')} Navigate  ${key('Enter')} Edit Agent  ${key('Space')} Sample  ${key('R')} Reset`,
+  },
+  receiver: {
+    color: '#00897b',
+    text: ` ${key('E')} Enable  ${key('D')} Details  ${key('C')} Clear Log`,
+  },
   install: {
     color: '#1a237e',
     text: ` ${key('↑↓')} Navigate  ${key('Enter')} Select  ${key('Esc')} Back`,

package/src/console/navigation.js

@@ -3,7 +3,7 @@
  * Story 6.2: Tab Bar & Global Keyboard Navigation
  *
  * Registers all global key bindings on the Blessed screen.
- * Tab shortcuts (S/V/M/A/R/H/I) are blocked when a modal is open.
+ * Tab shortcuts (S/V/M/X/R/H/I) are blocked when a modal is open.
  */
 
 /** Map of key → tab ID for global tab shortcut keys */
@@ -11,6 +11,8 @@ const KEY_TO_TAB = {
   's': 'settings', 'S': 'settings',
   'v': 'voices',   'V': 'voices',
   'm': 'music',    'M': 'music',
+  'b': 'agents',   'B': 'agents',
+  'x': 'receiver', 'X': 'receiver',
   'r': 'readme',   'R': 'readme',
   'h': 'help',     'H': 'help',
   'i': 'install',  'I': 'install',