agentvibes 5.12.0 → 5.13.0

package/.claude/hooks/play-tts-elevenlabs.sh

@@ -16,7 +16,8 @@
 # @related play-tts.sh, provider-manager.sh, language-manager.sh
 #
 # Voice can be a name (e.g. "Rachel") or a raw ElevenLabs voice ID.
-# Set ELEVENLABS_API_KEY in your shell profile or via Infisical.
+# Set ELEVENLABS_API_KEY in your shell profile, or store it in
+# ~/.agentvibes/elevenlabs-key.txt (chmod 600).
 # Default voice: Rachel (English, warm female)
 #
 
@@ -31,6 +32,7 @@ SCRIPT_PATH="$(readlink -f "${BASH_SOURCE[0]}")"
 SCRIPT_DIR="$(dirname "$SCRIPT_PATH")"
 
 source "$SCRIPT_DIR/audio-cache-utils.sh"
+source "$SCRIPT_DIR/python-resolver.sh"
 source "$SCRIPT_DIR/language-manager.sh"
 
 if [[ -z "$TEXT" ]]; then
@@ -44,58 +46,7 @@ if [[ ${#TEXT} -gt 2000 ]]; then
 fi
 
 # ---------------------------------------------------------------------------
-# Optional: fetch the key from Infisical on demand, so no key is stored on disk.
-# Opt-in via ~/.agentvibes/infisical.env, which sets (env vars take precedence):
-#   INFISICAL_SECRET_NAME   name of the secret in Infisical (e.g. ELEVEN_LABS)
-#   INFISICAL_PROJECT_ID    project/workspace id
-#   INFISICAL_ENV           environment slug         (default: prod)
-#   INFISICAL_DOMAIN        API base URL             (default: http://127.0.0.1:8200/api)
-#   INFISICAL_BOOTSTRAP     universal-auth creds file (default: ~/.palace-bootstrap)
-# Requires the infisical CLI + python3. Fails soft: prints nothing and returns
-# non-zero when unconfigured or unreachable, so the normal error path still runs.
-# The fetched value is never printed.
-_fetch_key_from_infisical() {
-  local cfg="${HOME}/.agentvibes/infisical.env"
-  if [[ -f "$cfg" ]]; then
-    set -o allexport; source "$cfg"; set +o allexport
-  fi
-
-  local secret_name="${INFISICAL_SECRET_NAME:-}"
-  local project_id="${INFISICAL_PROJECT_ID:-}"
-  local env_name="${INFISICAL_ENV:-prod}"
-  local domain="${INFISICAL_DOMAIN:-http://127.0.0.1:8200/api}"
-  local bootstrap="${INFISICAL_BOOTSTRAP:-${HOME}/.palace-bootstrap}"
-
-  [[ -n "$secret_name" && -n "$project_id" ]] || return 1
-  command -v infisical >/dev/null 2>&1 || return 1
-  command -v python3   >/dev/null 2>&1 || return 1
-
-  # Obtain an access token: reuse an exported INFISICAL_TOKEN, else exchange the
-  # universal-auth client credentials from the bootstrap file (creds via env only).
-  local token="${INFISICAL_TOKEN:-}"
-  if [[ -z "$token" ]]; then
-    [[ -f "$bootstrap" ]] || return 1
-    set -o allexport; source "$bootstrap"; set +o allexport
-    [[ -n "${INFISICAL_UNIVERSAL_AUTH_CLIENT_ID:-}" && -n "${INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET:-}" ]] || return 1
-    token="$(_AV_DOMAIN="$domain" python3 -c '
-import os, json, urllib.request
-d = os.environ["_AV_DOMAIN"].rstrip("/")
-req = urllib.request.Request(d + "/v1/auth/universal-auth/login",
-    data=json.dumps({"clientId": os.environ["INFISICAL_UNIVERSAL_AUTH_CLIENT_ID"],
-                     "clientSecret": os.environ["INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET"]}).encode(),
-    headers={"Content-Type": "application/json"})
-print(json.loads(urllib.request.urlopen(req, timeout=10).read())["accessToken"])
-' 2>/dev/null || true)"
-  fi
-  [[ -n "$token" ]] || return 1
-
-  INFISICAL_TOKEN="$token" infisical secrets get "$secret_name" \
-    --projectId "$project_id" --env "$env_name" --domain "$domain" \
-    --plain 2>/dev/null | head -1
-}
-
-# ---------------------------------------------------------------------------
-# API key — env var (only if it looks valid), then key file, then Infisical.
+# API key — env var (only if it looks valid), then key file.
 # A malformed/truncated ELEVENLABS_API_KEY (e.g. a half-pasted key) is ignored so
 # it can't silently shadow a good key file — a common foot-gun that yields
 # confusing "API key fail" errors despite a valid key on disk.
@@ -122,91 +73,55 @@ if [[ -z "$API_KEY" ]]; then
     API_KEY="$(tr -d '[:space:]' < "$_key_file")"
   fi
 fi
-if [[ -z "$API_KEY" ]]; then
-  API_KEY="$(_fetch_key_from_infisical || true)"
-  API_KEY="$(printf '%s' "$API_KEY" | tr -d '[:space:]')"
-fi
 
 if [[ -z "$API_KEY" ]]; then
   echo "❌ ElevenLabs API key not set." >&2
-  echo "   Set it one of three ways:" >&2
+  echo "   Set it one of two ways:" >&2
   echo "   1. export ELEVENLABS_API_KEY=your_key  (add to ~/.bashrc or ~/.zshrc)" >&2
   echo "   2. echo 'your_key' > ~/.agentvibes/elevenlabs-key.txt && chmod 600 ~/.agentvibes/elevenlabs-key.txt" >&2
-  echo "   3. Configure Infisical in ~/.agentvibes/infisical.env (INFISICAL_SECRET_NAME + INFISICAL_PROJECT_ID)" >&2
   echo "   Get a free key at: https://elevenlabs.io" >&2
   exit 2
 fi
 
 # ---------------------------------------------------------------------------
-# Inline voice name → ID map (covers common built-in ElevenLabs voices)
-declare -A VOICE_IDS
-VOICE_IDS["Rachel"]="21m00Tcm4TlvDq8ikWAM"
-VOICE_IDS["Adam"]="pNInz6obpgDQGcFmaJgB"
-VOICE_IDS["Antoni"]="ErXwobaYiN019PkySvjV"
-VOICE_IDS["Arnold"]="VR6AewLTigWG4xSOukaG"
-VOICE_IDS["Bella"]="EXAVITQu4vr4xnSDxMaL"
-VOICE_IDS["Callum"]="N2lVS1w4EtoT3dr4eOWO"
-VOICE_IDS["Charlie"]="IKne3meq5aSn9XLyUdCD"
-VOICE_IDS["Charlotte"]="XB0fDUnXU5powFXDhCwa"
-VOICE_IDS["Clyde"]="2EiwWnXFnvU5JabPnv8n"
-VOICE_IDS["Daniel"]="onwK4e9ZLuTAKqWW03F9"
-VOICE_IDS["Dave"]="CYw3kZ02Hs0563khs1Fj"
-VOICE_IDS["Dorothy"]="ThT5KcBeYPX3keUQqHPh"
-VOICE_IDS["Domi"]="AZnzlk1XvdvUeBnXmlld"
-VOICE_IDS["Drew"]="29vD33N1CtxCmqQRPOHJ"
-VOICE_IDS["Emily"]="LcfcDJNUP1GQjkzn1xUU"
-VOICE_IDS["Ethan"]="g5CIjZEefAph4nQFvHAz"
-VOICE_IDS["Fin"]="D38z5RcWu1voky8WS1ja"
-VOICE_IDS["Freya"]="jsCqWAovK2LkecY7zXl4"
-VOICE_IDS["Gigi"]="jBpfuIE2acCO8z3wKNLl"
-VOICE_IDS["Giovanni"]="zcAOhNBS3c14rBihAFp1"
-VOICE_IDS["Glinda"]="z9fAnlkpzviPz146aGWa"
-VOICE_IDS["Grace"]="oWAxZDx7w5VEj9dCyTzz"
-VOICE_IDS["Harry"]="SOYHLrjzK2X1ezoPC6cr"
-VOICE_IDS["James"]="ZQe5CZNOzWyzPSCn5a3c"
-VOICE_IDS["Jessie"]="t0jbNlBVZ17f02VDIeMI"
-VOICE_IDS["Josh"]="TxGEqnHWrfWFTfGW9XjX"
-VOICE_IDS["Liam"]="TX3LPaxmHKxFdv7VOQHJ"
-VOICE_IDS["Lily"]="pFZP5JQG7iQjIQuC4Bku"
-VOICE_IDS["Matilda"]="XrExE9yKIg1WjnnlVkGX"
-VOICE_IDS["Michael"]="flq6f7yk4E4fJM5XTYuZ"
-VOICE_IDS["Mimi"]="zrHiDhphv9ZnVXBqCLjz"
-VOICE_IDS["Nicole"]="piTKgcLEGmPE4e6mEKli"
-VOICE_IDS["Patrick"]="ODq5zmih8GrVes37Dizd"
-VOICE_IDS["Paul"]="5Q0t7uMcjvnagumLfvZi"
-VOICE_IDS["Sam"]="yoZ06aMxZJJ28mfd3POQ"
-VOICE_IDS["Sarah"]="EXAVITQu4vr4xnSDxMaL"
-VOICE_IDS["Serena"]="pMsXgVXv3BLzUgSXRplE"
-VOICE_IDS["Thomas"]="GBv7mTt0atIp3Br8iCZE"
-
-DEFAULT_VOICE_ID="${VOICE_IDS[Rachel]}"
+# ElevenLabs voice catalog — single source of truth (shared with voice-manager.sh).
+# Provides ELEVENLABS_DEFAULT_VOICE, elevenlabs_resolve_voice(), elevenlabs_voice_names().
+if [[ -f "$SCRIPT_DIR/elevenlabs-voices.sh" ]]; then
+  # shellcheck source=/dev/null
+  source "$SCRIPT_DIR/elevenlabs-voices.sh"
+else
+  # Minimal fallback so speech still works if the catalog file is missing.
+  # bash-3.2-safe: no associative array, case-statement resolver.
+  ELEVENLABS_DEFAULT_VOICE="Sarah"
+  elevenlabs_resolve_voice() {
+    local q="${1:-}"; [[ -z "$q" ]] && return 1
+    case "$(printf '%s' "$q" | tr '[:upper:]' '[:lower:]')" in
+      sarah) printf %s "EXAVITQu4vr4xnSDxMaL"; return 0 ;;
+    esac
+    [[ "$q" =~ ^[A-Za-z0-9]{20}$ ]] && { printf %s "$q"; return 0; }
+    return 1
+  }
+fi
+DEFAULT_VOICE_ID="$(elevenlabs_resolve_voice "$ELEVENLABS_DEFAULT_VOICE")"
 
 # ---------------------------------------------------------------------------
 # Resolve voice ID from override or config
 VOICE_ID=""
 
 if [[ -n "$VOICE_OVERRIDE" ]]; then
-  if [[ -n "${VOICE_IDS[$VOICE_OVERRIDE]:-}" ]]; then
-    VOICE_ID="${VOICE_IDS[$VOICE_OVERRIDE]}"
-  elif [[ "$VOICE_OVERRIDE" =~ ^[a-zA-Z0-9]{10,40}$ ]]; then
-    # Looks like a raw voice ID
-    VOICE_ID="$VOICE_OVERRIDE"
-  else
-    echo "⚠️  Unknown ElevenLabs voice '$VOICE_OVERRIDE', using Rachel" >&2
+  VOICE_ID="$(elevenlabs_resolve_voice "$VOICE_OVERRIDE")" || {
+    echo "[WARN] Unknown ElevenLabs voice '$VOICE_OVERRIDE', using $ELEVENLABS_DEFAULT_VOICE" >&2
     VOICE_ID="$DEFAULT_VOICE_ID"
-  fi
+  }
 else
-  # Check voice manager for configured voice
+  # Config path: read the voice saved by /agent-vibes:switch (a raw voice_id or
+  # a friendly name) and resolve it the same way — this is what hook-driven
+  # speech uses, so a switched voice actually plays (not a silent default).
   VOICE_NAME=""
   if [[ -f "$SCRIPT_DIR/voice-manager.sh" ]]; then
     VOICE_NAME="$("$SCRIPT_DIR/voice-manager.sh" get 2>/dev/null || true)"
   fi
-
-  if [[ -n "$VOICE_NAME" && -n "${VOICE_IDS[$VOICE_NAME]:-}" ]]; then
-    VOICE_ID="${VOICE_IDS[$VOICE_NAME]}"
-  else
-    VOICE_ID="$DEFAULT_VOICE_ID"
-  fi
+  VOICE_ID="$(elevenlabs_resolve_voice "$VOICE_NAME")" || VOICE_ID="$DEFAULT_VOICE_ID"
 fi
 
 # ---------------------------------------------------------------------------
@@ -246,7 +161,12 @@ trap 'rm -f "${TEMP_FILE:-}" "${BODY_FILE:-}" 2>/dev/null || true' EXIT
 # ---------------------------------------------------------------------------
 # Build the JSON request body with python so all escaping is handled correctly
 # (text is passed via env, never interpolated into a shell-quoted payload).
-if ! TTS_TEXT="$TEXT" TTS_MODEL="$MODEL_ID" TTS_LANG="$LANGUAGE_CODE" python3 -c '
+if [[ -z "$PYTHON_BIN" ]]; then
+  echo "❌ ElevenLabs needs Python 3, but none was found." >&2
+  echo "   Install Python 3, or set AGENTVIBES_PYTHON=/path/to/python." >&2
+  exit 3
+fi
+if ! TTS_TEXT="$TEXT" TTS_MODEL="$MODEL_ID" TTS_LANG="$LANGUAGE_CODE" "$PYTHON_BIN" -c '
 import os, json
 print(json.dumps({
     "text": os.environ["TTS_TEXT"],
@@ -254,7 +174,7 @@ print(json.dumps({
     "language_code": os.environ["TTS_LANG"],
     "voice_settings": {"stability": 0.5, "similarity_boost": 0.75},
 }))' > "$BODY_FILE" 2>/dev/null; then
-  echo "❌ Failed to build ElevenLabs request body (python3 required)" >&2
+  echo "❌ Failed to build ElevenLabs request body ($PYTHON_BIN required)" >&2
   exit 3
 fi
 

package/.claude/hooks/play-tts-kokoro.sh

@@ -31,28 +31,55 @@ SCRIPT_PATH="$(readlink -f "${BASH_SOURCE[0]}")"
 SCRIPT_DIR="$(dirname "$SCRIPT_PATH")"
 
 source "$SCRIPT_DIR/audio-cache-utils.sh"
+source "$SCRIPT_DIR/python-resolver.sh"
 
 if [[ -z "$TEXT" ]]; then
   echo "Usage: $0 \"text to speak\" [voice]" >&2
   exit 1
 fi
 
+# Distinguish "no Python at all" from "Python present but kokoro module missing"
+# — the old check conflated them, so a Windows box where python3 simply wasn't on
+# PATH wrongly reported "Kokoro not installed" (see python-resolver.sh).
+if [[ -z "$PYTHON_BIN" ]]; then
+  echo "❌ No Python 3 interpreter found." >&2
+  echo "   Kokoro needs Python 3. Install it (Windows: https://python.org, or 'py')," >&2
+  echo "   or set AGENTVIBES_PYTHON=/path/to/python.exe if it's installed elsewhere." >&2
+  exit 2
+fi
 # Check kokoro is installed (use find_spec to avoid slow torch import)
-if ! python3 -c "import importlib.util; exit(0 if importlib.util.find_spec('kokoro') else 1)" 2>/dev/null; then
-  echo "❌ Kokoro TTS not installed." >&2
+if ! "$PYTHON_BIN" -c "import importlib.util; exit(0 if importlib.util.find_spec('kokoro') else 1)" 2>/dev/null; then
+  echo "❌ Kokoro TTS module not installed for: $PYTHON_BIN" >&2
   echo "   Install with: ${SCRIPT_DIR}/kokoro-installer.sh" >&2
-  echo "   Or manually:  pip install kokoro-onnx soundfile numpy" >&2
+  echo "   Or manually:  \"$PYTHON_BIN\" -m pip install kokoro soundfile numpy" >&2
   exit 2
 fi
 
 # ---------------------------------------------------------------------------
 # Resolve voice
+# Default voice sourced from the generated Provider Catalog (SSOT) when present.
+# FAIL-SAFE: keep the literal fallback for installed-tree skew (mirrors play-tts.sh
+# PLAN_OK) — synth never breaks on a missing catalog.
 DEFAULT_VOICE="af_heart"
+if [[ -f "$SCRIPT_DIR/provider-catalog.sh" ]]; then
+  # shellcheck source=/dev/null
+  source "$SCRIPT_DIR/provider-catalog.sh" 2>/dev/null || true
+  if type catalog_default_voice >/dev/null 2>&1; then
+    _CATALOG_DEFAULT="$(catalog_default_voice kokoro 2>/dev/null || true)"
+    [[ -n "$_CATALOG_DEFAULT" ]] && DEFAULT_VOICE="$_CATALOG_DEFAULT"
+  fi
+fi
+
+# Synth-time shape check (LENIENT per design §3.3): a voice from a NEWER kokoro
+# model that the shipped catalog doesn't know must still degrade audibly, not
+# brick — so this stays a shape check + loud-warning fallback, NOT membership.
+# One literal, reused at both call sites below.
+KOKORO_SHAPE_RE='^[a-z]{2}_[a-z0-9_]+$'
 
 if [[ -n "$VOICE_OVERRIDE" ]]; then
   # Accept kokoro-style voice IDs (2-letter prefix + underscore + name)
   # e.g. af_heart, am_adam, bf_emma, bm_george
-  if [[ "$VOICE_OVERRIDE" =~ ^[a-z]{2}_[a-z0-9_]+$ ]]; then
+  if [[ "$VOICE_OVERRIDE" =~ $KOKORO_SHAPE_RE ]]; then
     VOICE="$VOICE_OVERRIDE"
   else
     echo "⚠️  Unrecognized kokoro voice '$VOICE_OVERRIDE', using $DEFAULT_VOICE" >&2
@@ -62,7 +89,7 @@ else
   # Check voice manager
   if [[ -f "$SCRIPT_DIR/voice-manager.sh" ]]; then
     _CONFIGURED="$("$SCRIPT_DIR/voice-manager.sh" get 2>/dev/null || true)"
-    if [[ "$_CONFIGURED" =~ ^[a-z]{2}_[a-z0-9_]+$ ]]; then
+    if [[ "$_CONFIGURED" =~ $KOKORO_SHAPE_RE ]]; then
       VOICE="$_CONFIGURED"
     else
       VOICE="$DEFAULT_VOICE"
@@ -103,7 +130,7 @@ if [[ "${AGENTVIBES_TEST_MODE:-false}" == "true" ]]; then
 fi
 
 # Run synthesis — output path printed to stdout
-RESULT=$(python3 "$SYNTH_SCRIPT" "$TEXT" "$VOICE" "$TEMP_WAV" "$SPEED" 2>&1) || {
+RESULT=$("$PYTHON_BIN" "$SYNTH_SCRIPT" "$TEXT" "$VOICE" "$TEMP_WAV" "$SPEED" 2>&1) || {
   echo "❌ Kokoro synthesis failed: $RESULT" >&2
   exit 3
 }

package/.claude/hooks/play-tts-soprano.sh

@@ -54,6 +54,7 @@ VOICE_OVERRIDE="$2"  # Ignored — Soprano has a single voice, kept for provider
 SCRIPT_PATH="$(readlink -f "${BASH_SOURCE[0]}")"
 SCRIPT_DIR="$(dirname "$SCRIPT_PATH")"
 source "$SCRIPT_DIR/audio-cache-utils.sh"
+source "$SCRIPT_DIR/python-resolver.sh"
 
 SOPRANO_PORT="${SOPRANO_PORT:-7860}"
 SOPRANO_DEVICE="${SOPRANO_DEVICE:-auto}"
@@ -135,7 +136,7 @@ SYNTH_MODE=""
 if check_webui_server; then
   # Gradio WebUI mode — use Python helper for SSE protocol
   SYNTH_MODE="webui"
-  python3 "$SCRIPT_DIR/soprano-gradio-synth.py" "$TEXT" "$TEMP_FILE" "$SOPRANO_PORT" 2>/dev/null
+  "$PYTHON_BIN" "$SCRIPT_DIR/soprano-gradio-synth.py" "$TEXT" "$TEMP_FILE" "$SOPRANO_PORT" 2>/dev/null
 elif check_api_server; then
   # OpenAI-compatible API mode — direct curl
   SYNTH_MODE="api"
@@ -151,7 +152,7 @@ fi
 
 if [[ ! -f "$TEMP_FILE" ]] || [[ ! -s "$TEMP_FILE" ]]; then
   echo "❌ Failed to synthesize speech with Soprano ($SYNTH_MODE mode)"
-  [[ "$SYNTH_MODE" == "webui" ]] && echo "   Try: python3 $SCRIPT_DIR/soprano-gradio-synth.py \"test\" /tmp/test.wav $SOPRANO_PORT"
+  [[ "$SYNTH_MODE" == "webui" ]] && echo "   Try: $PYTHON_BIN $SCRIPT_DIR/soprano-gradio-synth.py \"test\" /tmp/test.wav $SOPRANO_PORT"
   exit 4
 fi
 

package/.claude/hooks/play-tts-ssh-remote.sh

@@ -47,7 +47,9 @@ if [[ -n "${AGENTVIBES_MUSIC_STOP:-}" ]]; then
 elif [[ -n "${AGENTVIBES_MUSIC_ONLY:-}" ]]; then
   # Only a bare .mp3 filename is allowed (no path separators, no leading dash) —
   # the receiver resolves it against its own tracks dir, so reject path-like input.
-  if [[ "$AGENTVIBES_MUSIC_ONLY" =~ ^[A-Za-z0-9._][A-Za-z0-9._-]*\.mp3$ ]]; then
+  # Spaces ARE allowed (many track names contain them, e.g. "Late Night Hip Hop.mp3");
+  # the name travels as a jq --arg-escaped JSON string, so a space is not injectable.
+  if [[ "$AGENTVIBES_MUSIC_ONLY" =~ ^[A-Za-z0-9._][A-Za-z0-9._\ -]*\.mp3$ ]]; then
     PAYLOAD_KIND="music"
     MUSIC_ONLY_TRACK="$AGENTVIBES_MUSIC_ONLY"
   else
@@ -66,13 +68,26 @@ fi
 
 # Get script directory and project root
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$SCRIPT_DIR/python-resolver.sh"
+source "$SCRIPT_DIR/session-id.sh"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
 
-# Derive project name from directory
-PROJECT_NAME=$(basename "$PROJECT_ROOT")
-# Absolute path, forwarded so the receiver-side avatar can show/learn the real
-# remote folder (mirrors the local forward-to-avatar.sh's projectPath field).
-PROJECT_PATH="$PROJECT_ROOT"
+# Canonical routing session id. The receiver multiplexes forwarded TTS by this
+# id, so it MUST derive from CLAUDE_PROJECT_DIR (the real user project injected
+# via --project-dir), NOT basename(PROJECT_ROOT) — for a global install that
+# basename collapses to the HOME dir name and merges every project into one
+# session. Fallback (CLAUDE_PROJECT_DIR unset) is PROJECT_ROOT, preserving the
+# legacy value for the no-project case.
+SESSION_ID="$(av_session_id "$PROJECT_ROOT")"
+# PROJECT_NAME is kept for receiver back-compat (the receiver reads "project");
+# set it to the SAME corrected session id so both fields agree.
+PROJECT_NAME="$SESSION_ID"
+# Absolute path, forwarded so the receiver can show/learn the real remote folder.
+if [[ -n "${CLAUDE_PROJECT_DIR:-}" ]]; then
+  PROJECT_PATH="$CLAUDE_PROJECT_DIR"
+else
+  PROJECT_PATH="$PROJECT_ROOT"
+fi
 
 # ---------------------------------------------------------------------------
 # Get SSH connection details from config
@@ -93,10 +108,10 @@ fi
 # Priority 2: ~/.agentvibes/transport-config.json (ssh-remote section)
 if [[ -z "$SSH_HOST" ]]; then
   _TRANSPORT_CFG="$HOME/.agentvibes/transport-config.json"
-  if [[ -f "$_TRANSPORT_CFG" ]] && command -v python3 &>/dev/null; then
-    SSH_HOST=$(python3 -c "import json,sys; d=json.load(open('$_TRANSPORT_CFG')); p=d.get('ssh-remote',{}); print(p.get('host',''))" 2>/dev/null || echo "")
-    SSH_KEY=$(python3  -c "import json,sys; d=json.load(open('$_TRANSPORT_CFG')); p=d.get('ssh-remote',{}); print(p.get('sshKey',''))" 2>/dev/null || echo "")
-    SSH_PORT=$(python3 -c "import json,sys; d=json.load(open('$_TRANSPORT_CFG')); p=d.get('ssh-remote',{}); print(p.get('port',''))" 2>/dev/null || echo "")
+  if [[ -f "$_TRANSPORT_CFG" ]] && [[ -n "$PYTHON_BIN" ]]; then
+    SSH_HOST=$("$PYTHON_BIN" -c "import json,sys; d=json.load(open('$_TRANSPORT_CFG')); p=d.get('ssh-remote',{}); print(p.get('host',''))" 2>/dev/null || echo "")
+    SSH_KEY=$("$PYTHON_BIN"  -c "import json,sys; d=json.load(open('$_TRANSPORT_CFG')); p=d.get('ssh-remote',{}); print(p.get('sshKey',''))" 2>/dev/null || echo "")
+    SSH_PORT=$("$PYTHON_BIN" -c "import json,sys; d=json.load(open('$_TRANSPORT_CFG')); p=d.get('ssh-remote',{}); print(p.get('port',''))" 2>/dev/null || echo "")
   fi
 fi
 
@@ -104,8 +119,8 @@ fi
 # (config keyed by LLM name rather than 'ssh-remote', e.g. 'claude-code')
 if [[ -z "$SSH_HOST" ]]; then
   _TRANSPORT_CFG="$HOME/.agentvibes/transport-config.json"
-  if [[ -f "$_TRANSPORT_CFG" ]] && command -v python3 &>/dev/null; then
-    _remote_data=$(python3 -c "
+  if [[ -f "$_TRANSPORT_CFG" ]] && [[ -n "$PYTHON_BIN" ]]; then
+    _remote_data=$("$PYTHON_BIN" -c "
 import json, sys
 try:
     d = json.load(open('$_TRANSPORT_CFG'))
@@ -156,10 +171,11 @@ if [[ -n "$SSH_PORT" ]] && [[ ! "$SSH_PORT" =~ ^[0-9]+$ ]]; then
 fi
 
 # SECURITY: Validate VOICE
-# Allow letters, digits, underscore, hyphen, period, colon (for :: multi-speaker separator), slash.
+# Allow letters, digits, underscore, hyphen, period, colon (for :: multi-speaker separator),
+# slash, and SPACES (Windows SAPI voice names like "Microsoft David Desktop").
 # Voice is passed to the remote via base64-encoded JSON (jq --arg safely escapes it),
-# so shell metacharacters are the only real risk.
-if [[ ! "$VOICE" =~ ^[a-zA-Z0-9_.:\/-]+$ ]]; then
+# so shell metacharacters are the only real risk — a space is not injectable.
+if [[ ! "$VOICE" =~ ^[a-zA-Z0-9_.:\/\ -]+$ ]]; then
   echo "Invalid voice format: $VOICE" >&2
   exit 1
 fi
@@ -343,9 +359,7 @@ fi
 
 # ---------------------------------------------------------------------------
 # Resolve LANGUAGE to forward (map §D 'language | Forward on SSH', R18).
-# Precedence mirrors the local chain (learn-manager.sh / language-manager.sh):
-#   learning-mode target (tts-target-language.txt when tts-learn-mode.txt=="ON")
-#   > tts-language.txt.
+# Source: tts-language.txt (set by language-manager.sh).
 # Forwarded as a DEFAULT only — the receiver stays authoritative and its own
 # language config (if any) wins. language-manager.sh stores tts-language.txt at
 # the .claude/ root; the resolver contract tests use the .claude/config/ subdir,
@@ -353,14 +367,7 @@ fi
 # ---------------------------------------------------------------------------
 LANGUAGE=""
 for _cdir in "$_RESOLVE_PROJECT_DIR/.claude" "$HOME/.claude"; do
-  # Priority 1: learning-mode target language (only when learn mode is ON).
-  if [[ -z "$LANGUAGE" && -f "$_cdir/tts-learn-mode.txt" ]]; then
-    if [[ "$(cat "$_cdir/tts-learn-mode.txt" 2>/dev/null || true)" == "ON" ]]; then
-      [[ -f "$_cdir/tts-target-language.txt" ]] && \
-        LANGUAGE=$(cat "$_cdir/tts-target-language.txt" 2>/dev/null || true)
-    fi
-  fi
-  # Priority 2: tts-language.txt (root or config/ subdir).
+  # tts-language.txt (root or config/ subdir).
   if [[ -z "$LANGUAGE" && -f "$_cdir/tts-language.txt" ]]; then
     LANGUAGE=$(cat "$_cdir/tts-language.txt" 2>/dev/null || true)
   fi
@@ -391,6 +398,7 @@ build_json_payload() {
       --arg effects "$SOX_EFFECTS" \
       --arg music "$BG_FILE" \
       --arg volume "$BG_VOLUME" \
+      --arg session "$SESSION_ID" \
       --arg project "$PROJECT_NAME" \
       --arg projectPath "$PROJECT_PATH" \
       --arg pretext "$PRETEXT" \
@@ -400,7 +408,7 @@ build_json_payload() {
       --arg mute "$MUTE" \
       --arg language "$LANGUAGE" \
       --arg kind "$PAYLOAD_KIND" \
-      '{text: $text, voice: $voice, effects: $effects, music: $music, volume: $volume, project: $project, projectPath: $projectPath, pretext: $pretext, speed: $speed, provider: $provider, llm: $llm, mute: $mute, language: $language, kind: $kind}'
+      '{text: $text, voice: $voice, effects: $effects, music: $music, volume: $volume, session: $session, project: $project, projectPath: $projectPath, pretext: $pretext, speed: $speed, provider: $provider, llm: $llm, mute: $mute, language: $language, kind: $kind}'
   else
     # Manual JSON — escape backslashes, quotes, control chars
     local escaped_text
@@ -409,8 +417,8 @@ build_json_payload() {
     escaped_pretext=$(printf '%s' "$PRETEXT" | sed 's/\\/\\\\/g; s/"/\\"/g')
     local escaped_project_path
     escaped_project_path=$(printf '%s' "$PROJECT_PATH" | sed 's/\\/\\\\/g; s/"/\\"/g')
-    printf '{"text":"%s","voice":"%s","effects":"%s","music":"%s","volume":"%s","project":"%s","projectPath":"%s","pretext":"%s","speed":"%s","provider":"%s","llm":"%s","mute":"%s","language":"%s","kind":"%s"}' \
-      "$escaped_text" "$VOICE" "$SOX_EFFECTS" "$BG_FILE" "$BG_VOLUME" "$PROJECT_NAME" "$escaped_project_path" "$escaped_pretext" "$SPEED" "$PROVIDER" "$LLM_NAME" "$MUTE" "$LANGUAGE" "$PAYLOAD_KIND"
+    printf '{"text":"%s","voice":"%s","effects":"%s","music":"%s","volume":"%s","session":"%s","project":"%s","projectPath":"%s","pretext":"%s","speed":"%s","provider":"%s","llm":"%s","mute":"%s","language":"%s","kind":"%s"}' \
+      "$escaped_text" "$VOICE" "$SOX_EFFECTS" "$BG_FILE" "$BG_VOLUME" "$SESSION_ID" "$PROJECT_NAME" "$escaped_project_path" "$escaped_pretext" "$SPEED" "$PROVIDER" "$LLM_NAME" "$MUTE" "$LANGUAGE" "$PAYLOAD_KIND"
   fi
 }
 

package/.claude/hooks/play-tts-termux-ssh.sh

@@ -68,6 +68,7 @@ VOICE_OVERRIDE="$2"  # Not used for termux-ssh, but kept for interface compatibi
 
 # Script directory
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$SCRIPT_DIR/python-resolver.sh"
 
 # @function get_ssh_host
 # @intent Determine SSH host alias for Android device
@@ -119,10 +120,10 @@ SSH_KEY=""
 SSH_PORT=""
 
 _TRANSPORT_CFG="$HOME/.agentvibes/transport-config.json"
-if [[ -f "$_TRANSPORT_CFG" ]] && command -v python3 &>/dev/null; then
-  _CFG_HOST=$(python3 -c "import json; d=json.load(open('$_TRANSPORT_CFG')); p=d.get('termux-ssh',{}); print(p.get('host',''))" 2>/dev/null || echo "")
-  SSH_KEY=$(python3    -c "import json; d=json.load(open('$_TRANSPORT_CFG')); p=d.get('termux-ssh',{}); print(p.get('sshKey',''))" 2>/dev/null || echo "")
-  SSH_PORT=$(python3   -c "import json; d=json.load(open('$_TRANSPORT_CFG')); p=d.get('termux-ssh',{}); print(p.get('port',''))" 2>/dev/null || echo "")
+if [[ -f "$_TRANSPORT_CFG" ]] && [[ -n "$PYTHON_BIN" ]]; then
+  _CFG_HOST=$("$PYTHON_BIN" -c "import json; d=json.load(open('$_TRANSPORT_CFG')); p=d.get('termux-ssh',{}); print(p.get('host',''))" 2>/dev/null || echo "")
+  SSH_KEY=$("$PYTHON_BIN"    -c "import json; d=json.load(open('$_TRANSPORT_CFG')); p=d.get('termux-ssh',{}); print(p.get('sshKey',''))" 2>/dev/null || echo "")
+  SSH_PORT=$("$PYTHON_BIN"   -c "import json; d=json.load(open('$_TRANSPORT_CFG')); p=d.get('termux-ssh',{}); print(p.get('port',''))" 2>/dev/null || echo "")
 fi
 
 if [[ -n "${_CFG_HOST:-}" ]]; then