agentvibes 5.13.1 → 5.15.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (84) hide show
  1. package/.claude/audio/ui/CREDITS.txt +16 -16
  2. package/.claude/commands/agent-vibes-bmad-voices.md +117 -117
  3. package/.claude/commands/agent-vibes-rdp.md +24 -24
  4. package/.claude/config/audio-effects.cfg.sample +52 -52
  5. package/.claude/docs/TERMUX_SETUP.md +408 -408
  6. package/.claude/github-star-reminder.txt +1 -1
  7. package/.claude/hooks/kokoro-server.py +219 -219
  8. package/.claude/hooks/kokoro-tts.py +141 -141
  9. package/.claude/hooks/party-stage-roster.py +328 -328
  10. package/.claude/hooks/play-tts-kokoro.sh +7 -2
  11. package/.claude/hooks/play-tts-ssh-remote.sh +38 -3
  12. package/.claude/hooks/requirements.txt +6 -6
  13. package/.claude/hooks/soprano-gradio-synth.py +139 -139
  14. package/.claude/hooks/translator.py +237 -237
  15. package/.claude/hooks-windows/agentvibes-session-id.ps1 +83 -0
  16. package/.claude/hooks-windows/kokoro-server.py +219 -219
  17. package/.claude/hooks-windows/kokoro-tts.py +107 -107
  18. package/.claude/hooks-windows/play-tts.ps1 +112 -1
  19. package/.claude/hooks-windows/session-start-tts.ps1 +36 -0
  20. package/.claude/hooks-windows/soprano-gradio-synth.py +153 -153
  21. package/.claude/verbosity.txt +1 -1
  22. package/.clawdbot/README.md +105 -105
  23. package/CLAUDE.md +84 -176
  24. package/README.md +35 -2
  25. package/RELEASE_NOTES.md +139 -0
  26. package/WINDOWS-SETUP.md +208 -208
  27. package/bin/agent-vibes +39 -39
  28. package/bin/mcp-server.js +121 -121
  29. package/bin/test-bmad-pr +78 -78
  30. package/mcp-server/QUICK_START.md +203 -203
  31. package/mcp-server/README.md +345 -345
  32. package/mcp-server/examples/claude_desktop_config.json +11 -11
  33. package/mcp-server/examples/claude_desktop_config_piper.json +9 -9
  34. package/mcp-server/examples/custom_instructions.md +169 -169
  35. package/mcp-server/install-deps.js +12 -2
  36. package/mcp-server/server.py +2111 -2085
  37. package/mcp-server/test_mcp_correctness.py +504 -504
  38. package/mcp-server/test_windows_script_parity.py +339 -339
  39. package/package.json +6 -3
  40. package/setup-ssh-receiver.ps1 +259 -0
  41. package/setup-windows.ps1 +39 -29
  42. package/src/cli/list-personalities.js +110 -110
  43. package/src/commands/bmad-voices.js +394 -394
  44. package/src/console/brand-colors.js +13 -13
  45. package/src/console/constants/personalities.js +44 -44
  46. package/src/console/tabs/agents-tab.js +14 -4
  47. package/src/console/tabs/help-tab.js +314 -314
  48. package/src/console/tabs/readme-tab.js +272 -272
  49. package/src/console/tabs/settings-tab.js +31 -6
  50. package/src/console/tabs/setup-tab.js +154 -32
  51. package/src/console/tabs/voices-tab.js +48 -6
  52. package/src/console/widgets/destroy-list.js +25 -25
  53. package/src/console/widgets/notice.js +55 -55
  54. package/src/installer/language-screen.js +31 -31
  55. package/src/installer/music-file-input.js +304 -304
  56. package/src/installer.js +98 -37
  57. package/src/services/language-service.js +47 -47
  58. package/src/services/llm-provider-service.js +4 -1
  59. package/src/services/provider-voice-catalog.js +9 -5
  60. package/src/utils/audio-format-validator.js +277 -277
  61. package/src/utils/dependency-checker.js +469 -469
  62. package/src/utils/file-ownership-verifier.js +358 -358
  63. package/src/utils/music-file-validator.js +285 -285
  64. package/src/utils/preview-list-prompt.js +144 -144
  65. package/src/utils/secure-music-storage.js +412 -412
  66. package/templates/agentvibes-receiver.ps1 +311 -0
  67. package/templates/agentvibes-receiver.sh +297 -297
  68. package/voice-assignments.json +8244 -8244
  69. package/.agentvibes/config.json +0 -17
  70. package/.agentvibes/install-manifest.json +0 -362
  71. package/.claude/config/audio-effects.cfg +0 -7
  72. package/.claude/config/audio-effects.cfg.bak-kokoro +0 -7
  73. package/.claude/config/background-music-enabled.txt +0 -1
  74. package/.claude/config/background-music-position.txt +0 -27
  75. package/.claude/config/background-music-volume.txt +0 -1
  76. package/.claude/config/background-music.cfg +0 -1
  77. package/.claude/config/background-music.txt +0 -1
  78. package/.claude/config/language.txt +0 -1
  79. package/.claude/config/personality.txt +0 -1
  80. package/.claude/config/reverb-level.txt +0 -1
  81. package/.claude/config/tts-speech-rate.txt +0 -1
  82. package/.claude/config/tts-verbosity.txt +0 -1
  83. package/.claude/hooks-windows/audio-cache-utils.ps1.user.bak +0 -119
  84. package/.claude/hooks-windows/soprano-gradio-synth.py.user.bak +0 -153
@@ -1,105 +1,105 @@
1
- # Clawdbot Integration
2
-
3
- AgentVibes TTS integration for Clawdbot - the AI assistant framework.
4
-
5
- ## What is Clawdbot?
6
-
7
- Clawdbot is a powerful AI assistant framework that connects Claude AI to messaging platforms (WhatsApp, Telegram, Discord, etc.) and provides extensible skills.
8
-
9
- **Website**: https://clawd.bot
10
- **GitHub**: https://github.com/clawdbot/clawdbot
11
-
12
- ## AgentVibes + Clawdbot
13
-
14
- This integration provides Clawdbot with professional TTS capabilities using AgentVibes:
15
-
16
- - **Free & Offline**: No API costs, works without internet
17
- - **50+ Voices**: Professional AI voices in 30+ languages
18
- - **Remote SSH Support**: Audio tunnels from server to local machine
19
- - **Zero Setup**: Automatic when AgentVibes is installed
20
-
21
- ## Installation
22
-
23
- ```bash
24
- npx agentvibes install
25
- ```
26
-
27
- That's it! AgentVibes is ready to use.
28
-
29
- ## Usage from Clawdbot
30
-
31
- Once installed, use AgentVibes for TTS:
32
-
33
- ```bash
34
- npx agentvibes speak "Hello from Clawdbot"
35
- ```
36
-
37
- ## Features
38
-
39
- - **Automatic Detection**: Clawdbot automatically uses AgentVibes when available
40
- - **Voice Selection**: 50+ voices across 30+ languages
41
- - **SSH Tunneling**: Audio plays on local machine from remote servers
42
- - **Zero Config**: Works out of the box once AgentVibes is installed
43
-
44
- ## Remote SSH Audio
45
-
46
- When running Clawdbot on a remote server, set up PulseAudio tunneling so audio plays on your local machine:
47
-
48
- **Quick Setup:**
49
-
50
- 1. **Remote server** (`~/.bashrc`):
51
- ```bash
52
- export PULSE_SERVER=tcp:localhost:14713
53
- ```
54
-
55
- 2. **Local machine** (`~/.ssh/config`):
56
- ```
57
- Host your-server
58
- RemoteForward 14713 localhost:14713
59
- ```
60
-
61
- 3. **Connect and test**:
62
- ```bash
63
- ssh your-server
64
- agentvibes speak "Testing remote audio"
65
- ```
66
-
67
- **Full guide**: https://github.com/paulpreibisch/AgentVibes/blob/master/docs/remote-audio-setup.md
68
-
69
- ## Documentation
70
-
71
- - **Skill Documentation**: [skill/SKILL.md](skill/SKILL.md)
72
- - **AgentVibes Docs**: https://agentvibes.org
73
- - **Clawdbot Docs**: https://docs.clawd.bot
74
-
75
- ## Architecture
76
-
77
- ```
78
- Clawdbot Request
79
-
80
- AgentVibes Skill (this)
81
-
82
- AgentVibes CLI (agentvibes speak)
83
-
84
- Piper TTS Engine
85
-
86
- PulseAudio → SSH Tunnel → Local Speakers
87
- ```
88
-
89
- ## Development
90
-
91
- The skill is automatically packaged with AgentVibes npm releases. To update:
92
-
93
- 1. Edit `skill/SKILL.md`
94
- 2. Test with Clawdbot
95
- 3. Commit to AgentVibes repo
96
- 4. Publish new AgentVibes version
97
-
98
- ## Support
99
-
100
- - **AgentVibes Issues**: https://github.com/paulpreibisch/AgentVibes/issues
101
- - **Clawdbot Issues**: https://github.com/clawdbot/clawdbot/issues
102
-
103
- ## License
104
-
105
- Apache 2.0 - Same as AgentVibes
1
+ # Clawdbot Integration
2
+
3
+ AgentVibes TTS integration for Clawdbot - the AI assistant framework.
4
+
5
+ ## What is Clawdbot?
6
+
7
+ Clawdbot is a powerful AI assistant framework that connects Claude AI to messaging platforms (WhatsApp, Telegram, Discord, etc.) and provides extensible skills.
8
+
9
+ **Website**: https://clawd.bot
10
+ **GitHub**: https://github.com/clawdbot/clawdbot
11
+
12
+ ## AgentVibes + Clawdbot
13
+
14
+ This integration provides Clawdbot with professional TTS capabilities using AgentVibes:
15
+
16
+ - **Free & Offline**: No API costs, works without internet
17
+ - **50+ Voices**: Professional AI voices in 30+ languages
18
+ - **Remote SSH Support**: Audio tunnels from server to local machine
19
+ - **Zero Setup**: Automatic when AgentVibes is installed
20
+
21
+ ## Installation
22
+
23
+ ```bash
24
+ npx agentvibes install
25
+ ```
26
+
27
+ That's it! AgentVibes is ready to use.
28
+
29
+ ## Usage from Clawdbot
30
+
31
+ Once installed, use AgentVibes for TTS:
32
+
33
+ ```bash
34
+ npx agentvibes speak "Hello from Clawdbot"
35
+ ```
36
+
37
+ ## Features
38
+
39
+ - **Automatic Detection**: Clawdbot automatically uses AgentVibes when available
40
+ - **Voice Selection**: 50+ voices across 30+ languages
41
+ - **SSH Tunneling**: Audio plays on local machine from remote servers
42
+ - **Zero Config**: Works out of the box once AgentVibes is installed
43
+
44
+ ## Remote SSH Audio
45
+
46
+ When running Clawdbot on a remote server, set up PulseAudio tunneling so audio plays on your local machine:
47
+
48
+ **Quick Setup:**
49
+
50
+ 1. **Remote server** (`~/.bashrc`):
51
+ ```bash
52
+ export PULSE_SERVER=tcp:localhost:14713
53
+ ```
54
+
55
+ 2. **Local machine** (`~/.ssh/config`):
56
+ ```
57
+ Host your-server
58
+ RemoteForward 14713 localhost:14713
59
+ ```
60
+
61
+ 3. **Connect and test**:
62
+ ```bash
63
+ ssh your-server
64
+ agentvibes speak "Testing remote audio"
65
+ ```
66
+
67
+ **Full guide**: https://github.com/paulpreibisch/AgentVibes/blob/master/docs/remote-audio-setup.md
68
+
69
+ ## Documentation
70
+
71
+ - **Skill Documentation**: [skill/SKILL.md](skill/SKILL.md)
72
+ - **AgentVibes Docs**: https://agentvibes.org
73
+ - **Clawdbot Docs**: https://docs.clawd.bot
74
+
75
+ ## Architecture
76
+
77
+ ```
78
+ Clawdbot Request
79
+
80
+ AgentVibes Skill (this)
81
+
82
+ AgentVibes CLI (agentvibes speak)
83
+
84
+ Piper TTS Engine
85
+
86
+ PulseAudio → SSH Tunnel → Local Speakers
87
+ ```
88
+
89
+ ## Development
90
+
91
+ The skill is automatically packaged with AgentVibes npm releases. To update:
92
+
93
+ 1. Edit `skill/SKILL.md`
94
+ 2. Test with Clawdbot
95
+ 3. Commit to AgentVibes repo
96
+ 4. Publish new AgentVibes version
97
+
98
+ ## Support
99
+
100
+ - **AgentVibes Issues**: https://github.com/paulpreibisch/AgentVibes/issues
101
+ - **Clawdbot Issues**: https://github.com/clawdbot/clawdbot/issues
102
+
103
+ ## License
104
+
105
+ Apache 2.0 - Same as AgentVibes
package/CLAUDE.md CHANGED
@@ -1,179 +1,87 @@
1
- # AgentVibes Development Guidelines
2
-
3
- **Version:** 3.0
4
- **Updated:** 2026-02-15
5
- **Status:** Active (Using BMAD Methodology)
6
-
7
- ## Overview
8
-
9
- AgentVibes is a Text-to-Speech system for AI assistants with personality support.
10
-
11
- ### Project Uses BMAD Methodology
12
-
13
- This project follows **BMAD (BMM - Business Model Methodology)** for all story development:
14
- - Use `/sprint-planning` to initialize sprint tracking
15
- - Use `/dev-story` for each story implementation (NOT manual commits)
16
- - `/dev-story` handles: implementation testing code review auto-fixes status updates
17
- - All stories tracked in `docs/implementation-artifacts/sprint-status.yaml`
18
- - Status updates: `ready-for-dev` `in-progress` → `complete`
19
-
20
- **Required Reading:** See `BMAD-STORY-DEVELOPMENT.md` for complete workflow.
21
-
22
- ## Critical Rules
23
-
24
- ### MANDATORY: Use BMAD Workflow
25
- 1. **Initialize sprint:** Run `/sprint-planning` once per sprint
26
- 2. **Develop each story:** Run `/dev-story` (NOT manual coding)
27
- 3. **Never skip workflow steps** - Workflow enforces quality gates
28
- 4. **Update sprint-status.yaml** automatically via `/dev-story`
29
- 5. **Code review included** - Built into `/dev-story` workflow
30
-
31
- ### Non-Destructive Configuration Rule (MANDATORY)
32
- All code that reads, writes, or modifies user configuration MUST be non-destructive:
33
- 1. **Never delete or overwrite** existing user `.claude/` or `~/.claude/` config files (settings, voices, personalities, audio-effects.cfg) unless the user explicitly requested it
34
- 2. **Copy new files; never remove existing ones**installer adds missing files only
35
- 3. **Write hooks only when absent** — `configureSessionStartHook` and similar functions check for existing hooks before writing
36
- 4. **Preserve custom entries** — e.g. `audio-effects.cfg` user rows must survive an `agentvibes update`
37
- 5. **Creating directories is fine** — `mkdir -p` / `{ recursive: true }` is always safe
38
- 6. Any function that could overwrite user data must have a test asserting idempotency
39
-
40
- ### Git Workflow (ONLY Outside BMAD)
41
- For changes outside story development:
42
- 1. Describe changes before acting
43
- 2. Get explicit user approval before commits/pushes
44
- 3. Test locally before pushing
45
- 4. Exception: Changes made by `/dev-story` auto-commit
46
-
47
- ## Security Requirements (SonarCloud Compliance)
48
-
49
- ### Core Security Rules (NO EXCEPTIONS)
50
- 1. **No hardcoded credentials** - Never commit API keys, passwords, tokens
51
- 2. **Validate all external input** - User input, files, environment variables
52
- 3. **Secure temp directories** - Use `$XDG_RUNTIME_DIR` or user-specific `/tmp`
53
- 4. **Verify file ownership** - Check before processing external files (uid check)
54
- 5. **Prevent path traversal** - Validate paths stay within expected directories (use `path.resolve()`)
55
- 6. **Never log sensitive data** - Mask credentials in logs
56
-
57
- ### Bash/Shell Security
58
- ```bash
59
- set -euo pipefail # REQUIRED: Always use strict mode
60
-
61
- # Secure temp with proper permissions
62
- TEMP_DIR="${XDG_RUNTIME_DIR:-/tmp}/agentvibes-$RANDOM"
63
- mkdir -p "$TEMP_DIR"; chmod 700 "$TEMP_DIR"
64
-
65
- # Verify file ownership before processing
66
- [[ $(stat -c '%u' "$file" 2>/dev/null || stat -f '%u' "$file" 2>/dev/null) == $(id -u) ]] || exit 1
67
-
68
- trap 'rm -f "$TEMP_FILE"' EXIT # Clean up: use single quotes for deferred expansion
69
-
70
- # Validate input
71
- [[ "$VALUE" =~ ^[0-9]+$ ]] || exit 1 # Only allow numbers
72
-
73
- echo "$VARIABLE" # GOOD: Quoted
74
- echo $VARIABLE # BAD: Vulnerable to word splitting
75
- ```
76
-
77
- ### JavaScript/Node.js Security
78
- ```javascript
79
- // Path safety: ALWAYS use path.resolve()
80
- const safePath = path.resolve(userInput);
81
- function isPathSafe(target, base) {
82
- const r = path.resolve(target), b = path.resolve(base);
83
- return r === b || r.startsWith(b + path.sep);
84
- }
85
-
86
- // Never log credentials - ALWAYS mask
87
- console.log('Key: ' + apiKey.substring(0, 3) + '...'); // Good
88
- console.log(`Key: ${apiKey}`); // BAD
89
-
90
- // Resource cleanup with try-finally
91
- let proc;
92
- try {
93
- proc = spawn(...);
94
- } finally {
95
- if (proc && !proc.killed) proc.kill();
96
- }
97
- ```
98
-
99
- ### Python Security
100
- ```python
101
- # Resource cleanup
102
- process = None
103
- try:
104
- process = subprocess.Popen(...)
105
- finally:
106
- if process and process.poll() is None:
107
- process.kill()
108
-
109
- # Graceful error handling
110
- try:
111
- content = path.read_text()
112
- except (PermissionError, UnicodeDecodeError, OSError) as e:
113
- print(f"Warning: {e}", file=sys.stderr)
114
- return default_value
115
- ```
116
-
117
- ## Code Quality Standards
118
-
119
- - ✅ **Error handling:** No silent failures - always handle errors explicitly
120
- - ✅ **Defensive programming:** Check preconditions and validate inputs
121
- - ✅ **Resource cleanup:** Always clean up files, processes, connections
122
- - ✅ **Race conditions:** Use file locking for shared resources
123
- - ✅ **Comments:** Security-critical code only (explain WHY, not WHAT)
124
- - ✅ **Single responsibility:** Keep functions focused and testable
125
-
126
- ## Testing Requirements
127
-
128
- - Run `npm test` before committing (REQUIRED)
129
- - Write tests for: input validation, path handling, edge cases
130
- - Code review via `/dev-story` includes test validation
131
- - Target: 80%+ code coverage for new features
132
-
133
- ## Definition of Done (Checked by /dev-story)
134
-
135
- - [ ] All tests pass (`npm test`)
136
- - [ ] No Sonar security hotspots
137
- - [ ] Code follows project patterns (project-context.md)
138
- - [ ] Credentials masked in logs
139
- - [ ] Paths validated (no traversal)
140
- - [ ] File operations safe (ownership checked)
141
- - [ ] Shell scripts use strict mode
142
- - [ ] Resources properly cleaned up
143
- - [ ] Acceptance criteria satisfied
144
-
145
- ## Story Development Workflow (REQUIRED)
146
-
147
- ### For Each Sprint:
148
- 1. Run `/sprint-planning` to initialize sprint-status.yaml
149
- 2. For each story, run `/dev-story` (handles everything)
150
- 3. Check progress anytime with `/sprint-status`
151
-
152
- ### What /dev-story Does:
153
- - Finds next ready-for-dev story
154
- - Loads story file with acceptance criteria
155
- - Implements tasks with code + tests
156
- - **Runs adversarial code review** (finds 3-10 issues)
157
- - **Auto-fixes HIGH and MEDIUM severity issues**
158
- - Validates against project-context.md
159
- - Updates sprint-status.yaml automatically
160
- - Marks story complete when all ACs satisfied
161
-
162
- **Never bypass the workflow** - it enforces all quality gates.
163
-
164
- ## Important Files
1
+ # AgentVibes Development Guidelines
2
+
3
+ **Updated:** 2026-07-06 (v5.12.x era)
4
+
5
+ ## What this is
6
+
7
+ AgentVibes (`agentvibes` on npm) gives AI coding agents a spoken voice: Claude Code hooks + MCP server + interactive TUI, with Piper/Kokoro/ElevenLabs providers, background music, per-agent BMAD voices, a remote SSH receiver, and avatar rendering. Node ESM core with **parallel bash and PowerShell runtimes** and a Python MCP server.
8
+
9
+ ## Repo map
10
+
11
+ | Path | What it is |
12
+ |------|-----------|
13
+ | `src/installer.js` + `src/installer/` | npx installer (manifest-based, non-destructive) |
14
+ | `src/console/` | blessed TUI (tabs, modals, widgets) |
15
+ | `src/services/` | config-service, provider services, **utterance-resolver.js** (single source of truth for playback plans) |
16
+ | `.claude/hooks/` + `.claude/hooks-windows/` | **Shipped product code** bash/PS1 runtime (`play-tts.sh`, `audio-processor.sh`, `bmad-speak.sh`, …) installed into user projects |
17
+ | `mcp-server/` | Python MCP server (`server.py`, pytest suite) |
18
+ | `templates/` | Remote receiver scripts (`agentvibes-receiver.sh`/`.ps1`) |
19
+ | `bin/` | CLI entry points (`agentvibes.js`, `resolve-utterance.js`, `mcp-server.js`) |
20
+ | `test/unit/` | node:test `.test.js` + bats `.bats` suites |
21
+ | `docs/implementation-artifacts/` | BMAD story files + `sprint-status.yaml` |
22
+ | `docs/architecture/` | Provider/system architecture docs |
23
+
24
+ **Everything under the repo's `.claude/` (hooks, personalities, commands, config) is the npm package payload.** Editing a hook here is a product change: it must pass tests, keep bash/PowerShell parity, and reach real installs via the installer (`manifestSafeCopy`) — not just the dev checkout. The remote receiver additionally needs an in-place redeploy to `~/.agentvibes/` + watcher restart.
25
+
26
+ ## Architecture invariants (hard-won do not regress)
27
+
28
+ 1. **The utterance resolver is the single source of truth.** `src/services/utterance-resolver.js` reads all config once and emits a flat plan (voice, engine, transport, effects, music, speed, volume). Players consume the plan; they must NOT re-read config files directly. New playback behavior goes in the resolver + precedence table, not in a player script.
29
+ 2. **Volume defaults are 20% (`0.20`), never 70%.** Regression-tested; covered in bash, PS, and JS.
30
+ 3. **Never select TTS output by "most recent file."** Providers emit an `AV_OUTPUT:` sentinel on stdout; capture the exact filename and fail loudly on synthesis failure. The `ls -t` heuristic is retired.
31
+ 4. **Kokoro voices force the kokoro engine** (an `af_*`/`am_*` voice with a piper ENGINE column = silence). The resolver encodes this; keep it.
32
+ 5. **Bash/PowerShell parity.** Any change to `play-tts.sh` needs the mirror change in `play-tts.ps1` (and vice versa), plus the contract-test matrix (`AVI-S8.7`) kept green. Note the historical env-flag split: bash reads `AGENTVIBES_NO_PLAYBACK`, PS reads `AGENTVIBES_NO_PLAY` — set both.
33
+ 6. **Receiver settings are keyed by project** (TTS `--project-dir` basename namespaces scene/avatar/voice). Don't wipe `glb-scenes.json` it holds calibration.
34
+ 7. **SSH senders must never force `-p 22`**it overrides `~/.ssh/config` alias ports and silently drops TTS.
35
+
36
+ ## Non-Destructive Configuration Rule (MANDATORY)
37
+
38
+ All code touching user `.claude/` or `~/.claude/` config must be non-destructive. This is enforced by real machinery — use it:
39
+
40
+ - `manifestSafeCopy()` in `src/installer.js` copies via an install manifest and refuses to clobber user-modified files. New installed files go through it.
41
+ - `configureSessionStartHook()` and friends write hooks **only when absent**.
42
+ - Never delete/overwrite user settings, voices, personalities, or `audio-effects.cfg`; custom entries must survive `agentvibes update`. A settings.json parse error must not wipe the file.
43
+ - Any function that could overwrite user data needs an idempotency test (see `test/unit/installer-config-safety.test.js`, `install-manifest.test.js`).
44
+
45
+ ## Development workflow
46
+
47
+ Hybrid, in practice:
48
+
49
+ - **BMAD for planning and tracking.** Epics/stories live in `docs/implementation-artifacts/` with `sprint-status.yaml` actively maintained. Use `/sprint-planning`, `/create-story`, `/dev-story` for story-shaped work; update `sprint-status.yaml` when a story changes state.
50
+ - **Implementation happens on feature branches and git worktrees** (many active: `feat/*`, `fix/*`, worktrees like `AgentVibes-musetalk`, `AgentVibes-outfit-swap`), merged to `master`. Direct fixes, agent-driven implementation, and adversarial code-review passes are all normal — `/dev-story` is a tool, not a gate on every commit.
51
+ - **Adversarial code review before merging significant work** (see the `fix(review): …` commits); HIGH/MEDIUM findings get fixed, not deferred.
52
+ - Get explicit user approval before commits/pushes for non-story work. Paul doesn't code — do the work end-to-end via scripts; give estimates in AI time.
53
+
54
+ ## Testing
55
+
56
+ - `npm test` → `scripts/run-tests.sh`: syntax check → bats suite → `node --test` with c8 coverage. **Required before committing.**
57
+ - The runner suppresses TTS audio globally (marker file `~/.agentvibes-tests-running` + `AGENTVIBES_SUPPRESS_AUDIO` + both no-play flags). Opt in to audio with `AGENTVIBES_TEST_AUDIO=true`.
58
+ - Python: `pytest` in `mcp-server/` (`test_server.py`, `test_mcp_correctness.py`, `test_windows_script_parity.py`).
59
+ - CI: `test.yml`, `test-windows.yml`, `test-macos*.yml`, `sonarcloud.yml`, `codeql.yml`, `publish.yml`.
60
+ - New regressions become permanent tests (contract-test matrix pattern) — a bug fixed without a test will come back.
61
+
62
+ ## Releases — use the `/release` skill
63
+
64
+ `/release` runs the managed workflow with human checkpoints: pre-flight (coverage must pass, secret scan), version-bump recommendation, drafted RELEASE_NOTES.md + README "NEW IN" section + 8-language translations (`docs/i18n/`), then `npm version` → push → `gh release create` → optional `npm publish`, each gated on explicit approval.
65
+
66
+ - **`package.json` is the single source of truth for version.** The README badge is auto-updated by `scripts/sync-readme-version.js` via the npm `version` hook — never hand-edit it.
67
+ - **`npm publish` packs the working tree, not the git tag.** Run the pack-contents test (`test/unit/npm-pack-contents.test.js`) and never publish from a dirty tree.
68
+ - Alpha flow is normal: ship `x.y.z-alpha.N` while iterating, then promote to stable.
69
+
70
+ ## Security (project-specific, enforced by tests)
71
+
72
+ - **User-supplied file paths** (custom music, config) go through the validator chain: `path.resolve()`, containment check, magic-number format validation, UID ownership check (see `audio-format-validator`, `file-ownership-verifier` and the 180-case traversal suite).
73
+ - **Hooks/shell scripts use `set -euo pipefail`**, quoted expansions, and `trap` cleanup of temp files.
74
+ - **Never display or log secrets** — no API keys/tokens in chat, logs, commits, or example data (real SSH ports/aliases were once scrubbed from tests; don't reintroduce them). Mask credentials (`key.substring(0,3) + '...'`).
75
+ - Clean up spawned processes (`try/finally` kill in JS, `finally: process.kill()` in Python) — the TUI spawns preview processes constantly.
76
+ - SonarCloud runs on CI after push; it can't run locally.
77
+
78
+ ## Key references
165
79
 
166
80
  | File | Purpose |
167
81
  |------|---------|
168
- | `CLAUDE.md` | Development standards (this file) |
169
- | `BMAD-STORY-DEVELOPMENT.md` | How to use BMAD methodology |
170
- | `project-context.md` | Project-specific patterns (if exists) |
171
- | `docs/epics.md` | All epics and stories |
172
- | `docs/implementation-artifacts/sprint-status.yaml` | Sprint progress tracking |
173
- | `_bmad/core/tasks/workflow.xml` | BMAD execution engine (read-only) |
174
-
175
- ## References
176
-
177
- - **BMAD Methodology:** See `/sprint-planning`, `/dev-story`, `/sprint-status` workflows
178
- - **Security Standards:** [SonarCloud Rules](https://rules.sonarsource.com/javascript/type/Security_Hotspot), [OWASP Top 10](https://owasp.org/www-project-top-ten/)
179
- - **Bash Best Practices:** [Shellharden](https://github.com/anordal/shellharden/blob/master/how_to_do_things_safely_in_bash.md)
82
+ | `docs/implementation-artifacts/sprint-status.yaml` | Live sprint/story state |
83
+ | `docs/architecture/provider-system.md` | Provider architecture |
84
+ | `BMAD-STORY-DEVELOPMENT.md` | BMAD story workflow reference |
85
+ | `AGENTS.md` | TTS protocol for AI agents using AgentVibes |
86
+ | `.claude/skills/release/SKILL.md` | Release workflow |
87
+ | `docs/feature-platform-matrix.md` | What works on which platform |
package/README.md CHANGED
@@ -58,7 +58,25 @@ New here? The [**Quick Start guide**](docs/quick-start.md) walks you through you
58
58
 
59
59
  ---
60
60
 
61
- ## 🆕 Your voices everywhere (v5.13.0)
61
+ ## 🆕 Multi-session control on Windows (v5.15.0)
62
+
63
+ - **Sessions stay quiet unless you enable them** — a session speaks only in a project you've turned on; others add no instructions and no token cost.
64
+ - **`/agent-vibes:mute` now works on Windows** — it previously had no effect there. Both project and global mute are honoured on every platform.
65
+ - **Sessions can introduce themselves on Windows** — `{{session}}` announces "Claude on my-app in Windows Terminal", once per session.
66
+ - **Self-introductions now reach global installs** — the script behind them was never delivered by the updater on any platform.
67
+ - **Note for global Windows installs:** sessions are off by default after this update — enable with `/agent-vibes:unmute`.
68
+
69
+ ### v5.14.0 — Reliable setup and complete audio previews
70
+
71
+ Includes all changes from 5.13.2, which was not published to npm.
72
+
73
+ - **Setup completes on macOS and Linux** — installing Piper and downloading voices now runs correctly on a fresh machine, resolving a long-standing first-install issue.
74
+ - **Preview plays your complete mix** — voice, reverb/effects and background music together, so previews reflect how your agent will actually sound.
75
+ - **Updates preserve your customisations** — edited hook scripts are backed up with a timestamp before any file is replaced.
76
+ - **Clearer audio destination** — Settings shows **Local** in green and **Remote** in red.
77
+ - **Correct preview engine** — previews use the selected voice's own engine and identify it; Windows and macOS voices work over remote previews.
78
+
79
+ ### v5.13.0 — Your voices everywhere
62
80
 
63
81
  Pick the voices built into **Windows** or **Mac** and hear them wherever you're listening — even when your agents run on another computer. Plus a friendly heads-up chime so you always know sound is coming.
64
82
 
@@ -215,6 +233,21 @@ Running a full BMAD agent team? **Every agent gets its own distinct voice**, aut
215
233
 
216
234
  ---
217
235
 
236
+ ## 🔬 Reserved for future enhancements
237
+
238
+ You may notice a few dormant hooks in `.claude/hooks/` (`forward-to-avatar.sh`) and small
239
+ gated blocks inside `play-tts.sh` / `play-tts.ps1` referencing a "TalkingHead avatar" and a
240
+ `config/talking-head-enabled.txt` flag. These are **not an active feature** — there's no
241
+ avatar UI shipped in this package. They're scaffolding for an in-development, browser-based
242
+ avatar receiver that isn't merged yet, checked in early so that project has a stable
243
+ client-side delivery contract to build against.
244
+
245
+ Everything about this is inert by default: the enable-flag file doesn't exist until you
246
+ create it yourself, and every code path is short-circuited behind that check before it does
247
+ anything (no new network calls, no behavior change) for every current install.
248
+
249
+ ---
250
+
218
251
  ## 📚 Documentation
219
252
 
220
253
  | Guide | |
@@ -233,7 +266,7 @@ Running a full BMAD agent team? **Every agent gets its own distinct voice**, aut
233
266
 
234
267
  ## About
235
268
 
236
- **AgentVibes** · v5.13.1 · Licensed under [Apache-2.0](LICENSE)
269
+ **AgentVibes** · v5.15.0 · Licensed under [Apache-2.0](LICENSE)
237
270
 
238
271
  Built by **Paul Preibisch** — [@997Fire on X](https://x.com/997Fire) · [agentvibes.org](https://agentvibes.org) · [github.com/paulpreibisch/AgentVibes](https://github.com/paulpreibisch/AgentVibes)
239
272