agentvibes 5.2.1 → 5.4.0

package/.claude/hooks/clawdbot-receiver-SECURE.sh

@@ -26,19 +26,20 @@ VOICE="${2:-en_US-lessac-medium}"
 ENCODED_AGENT="${3:-}"
 ENCODED_INTRO="${4:-}"
 
+# SECURITY: Whitelist of allowed voice names
+ALLOWED_VOICES="en_US-amy-medium|en_US-lessac-medium|es_ES-mls_9972-low|es_ES-davefx-medium|en_US-joe-medium"
+
 # Validate inputs
 if [[ -z "$ENCODED_TEXT" ]]; then
-  echo "Error: No encoded text provided" >&2
+  echo "❌ No encoded text provided" >&2
   echo "Usage: $0 <base64_text> <voice> <base64_agent_name> [base64_intro]" >&2
   exit 1
 fi
 
-# SECURITY: Validate base64 format (reject shell metacharacters)
-[[ "$ENCODED_TEXT" =~ ^[A-Za-z0-9+/=]+$ ]] || { echo "Error: invalid base64 text" >&2; exit 1; }
-
-# SECURITY: Validate VOICE parameter format (alphanumeric, hyphens, underscores only)
-if [[ ! "$VOICE" =~ ^[a-zA-Z0-9_-]+$ ]]; then
-  echo "Error: Invalid voice name format: $VOICE" >&2
+# SECURITY: Validate VOICE parameter against whitelist
+if ! [[ "$VOICE" =~ ^($ALLOWED_VOICES)$ ]]; then
+  echo "❌ Invalid voice name: $VOICE" >&2
+  echo "Allowed voices: $(echo "$ALLOWED_VOICES" | tr '|' ', ')" >&2
   exit 1
 fi
 
@@ -57,30 +58,31 @@ fi
 
 DECODED_AGENT="default"
 if [[ -n "$ENCODED_AGENT" ]]; then
-  # SECURITY: Validate base64 format before decoding
-  [[ "$ENCODED_AGENT" =~ ^[A-Za-z0-9+/=]+$ ]] || ENCODED_AGENT=""
-  if [[ -n "$ENCODED_AGENT" ]]; then
-    DECODED_AGENT=$(echo -n "$ENCODED_AGENT" | base64 -d 2>/dev/null) || DECODED_AGENT="default"
-  fi
-
+  DECODED_AGENT=$(echo -n "$ENCODED_AGENT" | base64 -d 2>/dev/null) || DECODED_AGENT="default"
+  
   # SECURITY: Validate agent name format (alphanumeric, dash, underscore only)
-  [[ "$DECODED_AGENT" =~ ^[a-zA-Z0-9_-]+$ ]] || DECODED_AGENT="default"
-
+  if ! [[ "$DECODED_AGENT" =~ ^[a-zA-Z0-9_-]+$ ]]; then
+    echo "⚠️  Invalid agent name format, using 'default'" >&2
+    DECODED_AGENT="default"
+  fi
+  
   # SECURITY: Enforce length limit on agent name
-  [[ ${#DECODED_AGENT} -le 50 ]] || DECODED_AGENT="default"
+  if [[ ${#DECODED_AGENT} -gt 50 ]]; then
+    echo "⚠️  Agent name too long, using 'default'" >&2
+    DECODED_AGENT="default"
+  fi
 fi
 
 # Decode and prepend intro if provided
 DECODED_INTRO=""
 if [[ -n "$ENCODED_INTRO" ]]; then
-  # SECURITY: Validate base64 format before decoding
-  [[ "$ENCODED_INTRO" =~ ^[A-Za-z0-9+/=]+$ ]] || ENCODED_INTRO=""
-  if [[ -n "$ENCODED_INTRO" ]]; then
-    DECODED_INTRO=$(echo -n "$ENCODED_INTRO" | base64 -d 2>/dev/null) || DECODED_INTRO=""
-  fi
-
+  DECODED_INTRO=$(echo -n "$ENCODED_INTRO" | base64 -d 2>/dev/null) || DECODED_INTRO=""
+  
   # SECURITY: Enforce length limit on intro message
-  [[ ${#DECODED_INTRO} -le 200 ]] || DECODED_INTRO="${DECODED_INTRO:0:200}"
+  if [[ ${#DECODED_INTRO} -gt 200 ]]; then
+    echo "⚠️  Intro message too long, truncating" >&2
+    DECODED_INTRO="${DECODED_INTRO:0:200}"
+  fi
 fi
 
 # Prepend intro to text if configured

package/.claude/hooks/clawdbot-receiver.sh

@@ -30,50 +30,26 @@ ENCODED_INTRO="${4:-}"
 
 # Validate inputs
 if [[ -z "$ENCODED_TEXT" ]]; then
-  echo "Error: No encoded text provided" >&2
+  echo "❌ No encoded text provided" >&2
   echo "Usage: $0 <base64_text> <voice> <base64_agent_name> [base64_intro]" >&2
   exit 1
 fi
 
-# SECURITY: Validate base64 format (reject shell metacharacters)
-[[ "$ENCODED_TEXT" =~ ^[A-Za-z0-9+/=]+$ ]] || { echo "Error: invalid base64 text" >&2; exit 1; }
-
-# SECURITY: Validate voice name format (alphanumeric, hyphens, underscores only)
-[[ "$VOICE" =~ ^[a-zA-Z0-9_-]+$ ]] || { echo "Error: invalid voice format" >&2; exit 1; }
-
 # SECURITY: Decode base64 safely
 DECODED_TEXT=$(echo -n "$ENCODED_TEXT" | base64 -d 2>/dev/null) || {
-  echo "Error: Failed to decode text (invalid base64)" >&2
+  echo "❌ Failed to decode text (invalid base64)" >&2
   exit 1
 }
 
-# SECURITY: Enforce length limit on decoded text (10KB max)
-if [[ ${#DECODED_TEXT} -gt 10000 ]]; then
-  echo "Error: Decoded text too long (${#DECODED_TEXT} chars, max 10000)" >&2
-  exit 1
-fi
-
 DECODED_AGENT="default"
 if [[ -n "$ENCODED_AGENT" ]]; then
-  [[ "$ENCODED_AGENT" =~ ^[A-Za-z0-9+/=]+$ ]] || ENCODED_AGENT=""
-  if [[ -n "$ENCODED_AGENT" ]]; then
-    DECODED_AGENT=$(echo -n "$ENCODED_AGENT" | base64 -d 2>/dev/null) || DECODED_AGENT="default"
-  fi
-  # Validate agent name format (alphanumeric, dash, underscore only)
-  [[ "$DECODED_AGENT" =~ ^[a-zA-Z0-9_-]+$ ]] || DECODED_AGENT="default"
-  # Enforce length limit
-  [[ ${#DECODED_AGENT} -le 50 ]] || DECODED_AGENT="default"
+  DECODED_AGENT=$(echo -n "$ENCODED_AGENT" | base64 -d 2>/dev/null) || DECODED_AGENT="default"
 fi
 
 # Decode and prepend intro if provided
 DECODED_INTRO=""
 if [[ -n "$ENCODED_INTRO" ]]; then
-  [[ "$ENCODED_INTRO" =~ ^[A-Za-z0-9+/=]+$ ]] || ENCODED_INTRO=""
-  if [[ -n "$ENCODED_INTRO" ]]; then
-    DECODED_INTRO=$(echo -n "$ENCODED_INTRO" | base64 -d 2>/dev/null) || DECODED_INTRO=""
-  fi
-  # Enforce length limit on intro (200 chars max)
-  [[ ${#DECODED_INTRO} -le 200 ]] || DECODED_INTRO="${DECODED_INTRO:0:200}"
+  DECODED_INTRO=$(echo -n "$ENCODED_INTRO" | base64 -d 2>/dev/null) || DECODED_INTRO=""
 fi
 
 # Prepend intro to text if configured

package/.claude/hooks/piper-installer.sh

@@ -67,7 +67,7 @@ if [[ -d "/data/data/com.termux" ]]; then
   echo ""
   SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
   if [[ -f "$SCRIPT_DIR/termux-installer.sh" ]]; then
-    exec bash "$SCRIPT_DIR/termux-installer.sh" "$@"
+    exec "$SCRIPT_DIR/termux-installer.sh" "$@"
   else
     echo "❌ Error: termux-installer.sh not found"
     echo "   Please download it from the AgentVibes repository"

package/.claude/hooks/play-tts-macos.sh

@@ -48,18 +48,12 @@ fi
 TEXT="$1"
 VOICE_OVERRIDE="$2"  # Optional: voice name (e.g., "Samantha", "Daniel")
 
-# Strip emojis, asterisks, and markdown formatting
-TEXT=$(printf '%s' "$TEXT" | perl -CSD -pe '
-  s/[\x{1F300}-\x{1F9FF}]//g;
-  s/[\x{2600}-\x{27BF}]//g;
-  s/[\x{FE00}-\x{FE0F}]//g;
-  s/[\x{200D}]//g;
-  s/[\x{2500}-\x{257F}]//g;
-  s/[\x{2580}-\x{259F}]//g;
-  s/\*+//g; s/#+\s*//g; s/`//g; s/~+//g; s/^\s*[-]\s*//g;
-')
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# Use readlink -f to handle symlinks correctly
+SCRIPT_PATH="$(readlink -f "${BASH_SOURCE[0]}")"
+SCRIPT_DIR="$(dirname "$SCRIPT_PATH")"
+
+# Source audio cache utilities
+source "$SCRIPT_DIR/audio-cache-utils.sh"
 
 # Source audio cache utilities
 source "$SCRIPT_DIR/audio-cache-utils.sh"

package/.claude/hooks/play-tts-piper.sh

@@ -74,7 +74,9 @@ TEXT=$(printf '%s' "$TEXT" | perl -CSD -pe '
 ')
 
 # Source voice manager and language manager
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# Use readlink -f to handle symlinks correctly
+SCRIPT_PATH="$(readlink -f "${BASH_SOURCE[0]}")"
+SCRIPT_DIR="$(dirname "$SCRIPT_PATH")"
 source "$SCRIPT_DIR/piper-voice-manager.sh"
 source "$SCRIPT_DIR/language-manager.sh"
 source "$SCRIPT_DIR/audio-cache-utils.sh"
@@ -518,10 +520,14 @@ fi
 touch "$LOCK_FILE"
 
 # Create write lock file in audio directory to signal file is in-use (prevents race condition in cleanup)
-_TEMP_DIR="${TEMP_FILE%/*}"
-WRITE_LOCK_FILE="$_TEMP_DIR/$(basename "$TEMP_FILE" .wav).lock"
+AUDIO_DIR="${TEMP_FILE%/*}"
+WRITE_LOCK_FILE="$AUDIO_DIR/$(basename "$TEMP_FILE" .wav).lock"
 touch "$WRITE_LOCK_FILE"
-_CLEANUP_FILES+=("$LOCK_FILE" "$WRITE_LOCK_FILE")
+
+# Get audio duration for proper lock timing
+DURATION=$(ffprobe -v error -show_entries format=duration -of default=noprint_wrappers=1:nokey=1 "$TEMP_FILE" 2>/dev/null)
+DURATION=${DURATION%.*}  # Round to integer
+DURATION=${DURATION:-1}   # Default to 1 second if detection fails
 
 # Get audio duration for proper lock timing
 DURATION=$(ffprobe -v error -show_entries format=duration -of default=noprint_wrappers=1:nokey=1 "$TEMP_FILE" 2>/dev/null || true)
@@ -558,95 +564,65 @@ disown
 # Get audio cache path
 AUDIO_DIR_PATH=$(get_audio_dir)
 
-# Color codes (safe to use — WAV path is passed via AGENTVIBES_WAV_OUTPATH, not parsed from stdout)
+# Color codes
 BLUE='\033[0;34m'
 YELLOW='\033[1;33m'
 PURPLE='\033[0;35m'
+LIGHT_PURPLE='\033[1;35m'
 RED='\033[0;31m'
 GREEN='\033[0;32m'
 ORANGE='\033[0;33m'
 WHITE='\033[1;37m'
+MAGENTA='\033[0;35m'
 CYAN='\033[0;36m'
 GOLD='\033[38;5;226m'
 NC='\033[0m'
 
-# Check if banner is enabled (default: on)
-_BANNER_ENABLED=true
-if [[ -f "$HOME/.agentvibes/banner-disabled" ]]; then
-  _BANNER_ENABLED=false
-elif [[ -f "${PROJECT_ROOT:-/nonexistent}/.agentvibes/banner-disabled" ]]; then
-  _BANNER_ENABLED=false
-fi
-
-# Run auto-cleanup off the critical path: only every 10th call, in background after playback starts.
-# Counter file lives in the secure lock dir (user-specific, already created above).
+# CRITICAL: Run auto-cleanup FIRST (before calculating size)
+# This ensures we display the POST-cleanup size, not pre-cleanup size
 AUTO_CLEAN_THRESHOLD=$(get_auto_clean_threshold)
-_CALL_COUNTER_FILE="$_LOCK_DIR/agentvibes-tts-call-count"
-_CALL_COUNT=$(cat "$_CALL_COUNTER_FILE" 2>/dev/null || echo "0")
-# SECURITY: Validate counter is numeric before arithmetic
-if ! [[ "$_CALL_COUNT" =~ ^[0-9]+$ ]]; then _CALL_COUNT=0; fi
-_CALL_COUNT=$((_CALL_COUNT + 1))
-echo "$_CALL_COUNT" > "$_CALL_COUNTER_FILE"
-
-if (( _CALL_COUNT % 10 == 0 )); then
-  # Capture values needed inside the subshell before forking
-  _CLEANUP_AUDIO_DIR="$AUDIO_DIR_PATH"
-  _CLEANUP_THRESHOLD="$AUTO_CLEAN_THRESHOLD"
-  _CLEANUP_BANNER="$_BANNER_ENABLED"
-  # Source the utils inside the subshell (functions are not exported)
-  _CLEANUP_UTILS="$SCRIPT_DIR/audio-cache-utils.sh"
-  (
-    source "$_CLEANUP_UTILS" 2>/dev/null || exit 0
-    _INITIAL_SIZE=$(calculate_tts_size_bytes "$_CLEANUP_AUDIO_DIR")
-    if [[ $_INITIAL_SIZE -gt $((_CLEANUP_THRESHOLD * 1048576)) ]]; then
-      _DELETED=$(auto_clean_old_files "$_CLEANUP_AUDIO_DIR" "$_CLEANUP_THRESHOLD")
-      if [[ ${_DELETED:-0} -gt 0 ]] && [[ "$_CLEANUP_BANNER" == "true" ]]; then
-        echo -e "\033[0;33m🧹 Auto-cleaned $_DELETED old files\033[0m"
-      fi
-    fi
-  ) &
-  disown
+INITIAL_SIZE=$(calculate_tts_size_bytes "$AUDIO_DIR_PATH")
+if [[ $INITIAL_SIZE -gt $((AUTO_CLEAN_THRESHOLD * 1048576)) ]]; then
+  DELETED=$(auto_clean_old_files "$AUDIO_DIR_PATH" "$AUTO_CLEAN_THRESHOLD")
+  if [[ $DELETED -gt 0 ]]; then
+    echo -e "${ORANGE}🧹 Auto-cleaned $DELETED old files${NC}"
+  fi
 fi
 
-# Write output path for play-tts-enhanced.sh (avoids stdout parsing — colors are safe)
-if [[ -n "${AGENTVIBES_WAV_OUTPATH:-}" ]]; then
-  echo "$TEMP_FILE" > "$AGENTVIBES_WAV_OUTPATH"
+# NOW calculate cache stats after cleanup
+FILE_COUNT=$(count_tts_files "$AUDIO_DIR_PATH")
+SIZE_BYTES=$(calculate_tts_size_bytes "$AUDIO_DIR_PATH")
+SIZE_HUMAN=$(bytes_to_human "$SIZE_BYTES")
+
+# Dynamic color coding based on cache size
+# Green: < 500MB (small)
+# Yellow: 500MB - 3GB (lots)
+# Red: > 3GB (extreme)
+CACHE_COLOR=$GREEN
+if [[ $SIZE_BYTES -gt 3221225472 ]]; then  # > 3GB
+  CACHE_COLOR=$RED
+elif [[ $SIZE_BYTES -gt 524288000 ]]; then  # > 500MB
+  CACHE_COLOR=$YELLOW
 fi
 
-if [[ "$_BANNER_ENABLED" == "true" ]]; then
-  FILE_COUNT=$(count_tts_files "$AUDIO_DIR_PATH")
-  SIZE_BYTES=$(calculate_tts_size_bytes "$AUDIO_DIR_PATH")
-  SIZE_HUMAN=$(bytes_to_human "$SIZE_BYTES")
-
-  # Dynamic color coding based on cache size
-  CACHE_COLOR=$GREEN
-  if [[ $SIZE_BYTES -gt 3221225472 ]]; then
-    CACHE_COLOR=$RED
-  elif [[ $SIZE_BYTES -gt 524288000 ]]; then
-    CACHE_COLOR=$YELLOW
-  fi
+# Display with file count (now showing accurate post-cleanup size)
+echo -e "${WHITE}💾 Saved to:${NC} ${CYAN}$TEMP_FILE${NC} ${YELLOW}$FILE_COUNT${NC} ${WHITE}🗄️${NC} ${CACHE_COLOR}$SIZE_HUMAN${NC} ${WHITE}🧹${NC}${GOLD}[${AUTO_CLEAN_THRESHOLD}mb]${NC}"
 
-  echo -e "${WHITE}💾 Saved to:${NC} ${CYAN}$TEMP_FILE${NC} ${YELLOW}$FILE_COUNT${NC} ${WHITE}🗄️${NC} ${CACHE_COLOR}$SIZE_HUMAN${NC} ${WHITE}🧹${NC}${GOLD}[${AUTO_CLEAN_THRESHOLD}mb]${NC}"
-
-  if [[ -n "$BACKGROUND_MUSIC" ]]; then
-    echo -e "${WHITE}🎵 Background music:${NC} ${PURPLE}$(basename "$BACKGROUND_MUSIC")${NC}"
-  fi
-  if [[ -n "${SPEAKER_ID:-}" ]] && [[ -n "${FILE_VOICE:-}" ]]; then
-    echo -e "${WHITE}🎤 Voice used:${NC} ${BLUE}$FILE_VOICE${NC} ${WHITE}(Piper TTS)${NC}"
-  else
-    echo -e "${WHITE}🎤 Voice used:${NC} ${BLUE}$VOICE_MODEL${NC} ${WHITE}(Piper TTS)${NC}"
-  fi
-
-  PERSONALITY=$(cat "${PROJECT_ROOT:-/nonexistent}/.claude/tts-personality.txt" 2>/dev/null || cat "$HOME/.claude/tts-personality.txt" 2>/dev/null || echo "")
-  if [[ -n "$PERSONALITY" ]] && [[ "$PERSONALITY" != "none" ]] && [[ "$PERSONALITY" != "normal" ]]; then
-    echo -e "${WHITE}💫 Personality:${NC} ${YELLOW}$PERSONALITY${NC}"
-  fi
+if [[ -n "$BACKGROUND_MUSIC" ]]; then
+  # Extract just the filename to save space
+  MUSIC_FILENAME=$(basename "$BACKGROUND_MUSIC")
+  echo -e "${WHITE}🎵 Background music:${NC} ${PURPLE}$MUSIC_FILENAME${NC}"
+fi
+echo -e "${WHITE}🎤 Voice used:${NC} ${BLUE}$VOICE_MODEL${NC} ${WHITE}(Piper TTS)${NC}"
 
-  echo -e "\033[38;5;240mSay: \"Turn off banner\" to hide this output\033[0m"
+# Show personality if configured
+PERSONALITY=$(cat "$PROJECT_ROOT/.claude/tts-personality.txt" 2>/dev/null || cat "$HOME/.claude/tts-personality.txt" 2>/dev/null || echo "")
+if [[ -n "$PERSONALITY" ]] && [[ "$PERSONALITY" != "none" ]] && [[ "$PERSONALITY" != "normal" ]]; then
+  echo -e "${WHITE}💫 Personality:${NC} ${YELLOW}$PERSONALITY${NC}"
 fi
 
 # Check audio folder size and warn if getting large
-if [[ "$_BANNER_ENABLED" == "true" ]] && [[ -d "$AUDIO_DIR_PATH" ]]; then
+if [[ -d "$AUDIO_DIR_PATH" ]]; then
   AUDIO_SIZE=$(du -sm "$AUDIO_DIR_PATH" 2>/dev/null | cut -f1)
   if [[ -n "$AUDIO_SIZE" ]] && [[ "$AUDIO_SIZE" -gt 100 ]]; then
     echo -e "\033[0;31m⚠️  Audio cache is ${AUDIO_SIZE}MB - Run: /agent-vibes:cleanup\033[0m"
@@ -673,14 +649,9 @@ fi
 if [[ -z "$BACKGROUND_MUSIC" ]]; then
   _bg_enabled=false
   if [[ -f "$BACKGROUND_ENABLED_FILE" ]] && grep -q "true" "$BACKGROUND_ENABLED_FILE" 2>/dev/null; then
-    _bg_enabled=true
-  elif [[ -f "$GLOBAL_BACKGROUND_ENABLED_FILE" ]] && grep -q "true" "$GLOBAL_BACKGROUND_ENABLED_FILE" 2>/dev/null; then
-    _bg_enabled=true
-  fi
-  if [[ "$_bg_enabled" == "true" ]]; then
-    echo "🎵 Background music: Enabled but not playing (check config)"
+    echo -e "${WHITE}🎵 Background music:${NC} ${PURPLE}Enabled but not playing (check config)${NC}"
   else
-    echo "🎵 Background music: Disabled"
+    echo -e "${WHITE}🎵 Background music:${NC} ${PURPLE}Disabled${NC}"
   fi
 fi
 

package/.claude/hooks/play-tts-soprano.sh

@@ -50,18 +50,9 @@ export LC_ALL=C
 TEXT="$1"
 VOICE_OVERRIDE="$2"  # Ignored — Soprano has a single voice, kept for provider contract
 
-# Strip emojis, asterisks, and markdown formatting
-TEXT=$(printf '%s' "$TEXT" | perl -CSD -pe '
-  s/[\x{1F300}-\x{1F9FF}]//g;
-  s/[\x{2600}-\x{27BF}]//g;
-  s/[\x{FE00}-\x{FE0F}]//g;
-  s/[\x{200D}]//g;
-  s/[\x{2500}-\x{257F}]//g;
-  s/[\x{2580}-\x{259F}]//g;
-  s/\*+//g; s/#+\s*//g; s/`//g; s/~+//g; s/^\s*[-]\s*//g;
-')
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# Use readlink -f to handle symlinks correctly
+SCRIPT_PATH="$(readlink -f "${BASH_SOURCE[0]}")"
+SCRIPT_DIR="$(dirname "$SCRIPT_PATH")"
 source "$SCRIPT_DIR/audio-cache-utils.sh"
 
 SOPRANO_PORT="${SOPRANO_PORT:-7860}"
@@ -114,11 +105,7 @@ fi
 # @intent Find appropriate directory for audio file storage
 # @why Supports project-local and global storage
 # @returns Sets $AUDIO_DIR global variable
-# SECURITY: Canonicalize path to prevent traversal (#128)
-if [[ -n "${CLAUDE_PROJECT_DIR:-}" ]]; then
-  CLAUDE_PROJECT_DIR=$(cd "${CLAUDE_PROJECT_DIR}" 2>/dev/null && pwd -P) || CLAUDE_PROJECT_DIR=""
-fi
-if [[ -n "${CLAUDE_PROJECT_DIR:-}" ]]; then
+if [[ -n "$CLAUDE_PROJECT_DIR" ]]; then
   AUDIO_DIR="$CLAUDE_PROJECT_DIR/.claude/audio"
 else
   CURRENT_DIR="$PWD"
@@ -135,8 +122,7 @@ else
 fi
 
 mkdir -p "$AUDIO_DIR"
-# SECURITY: Use mktemp for unpredictable filenames (#130)
-_tmp=$(mktemp "$AUDIO_DIR/tts-XXXXXX"); TEMP_FILE="${_tmp}.wav"; mv "$_tmp" "$TEMP_FILE"
+TEMP_FILE="$AUDIO_DIR/tts-$(date +%s).wav"
 
 # @function synthesize_speech
 # @intent Generate speech using best available Soprano mode
@@ -153,12 +139,9 @@ if check_webui_server; then
 elif check_api_server; then
   # OpenAI-compatible API mode — direct curl
   SYNTH_MODE="api"
-  # SECURITY: Use proper JSON encoding to prevent injection (#133)
-  _JSON_PAYLOAD=$(printf '%s' "$TEXT" | python3 -c 'import sys,json; print(json.dumps({"input":sys.stdin.read()}))' 2>/dev/null) || \
-    _JSON_PAYLOAD=$(printf '{"input":"%s"}' "$(printf '%s' "$TEXT" | sed 's/\\/\\\\/g; s/"/\\"/g; s/\t/\\t/g')")
   curl -sf "http://127.0.0.1:${SOPRANO_PORT}/v1/audio/speech" \
     -H "Content-Type: application/json" \
-    -d "$_JSON_PAYLOAD" \
+    -d "$(printf '{"input":"%s"}' "$(echo "$TEXT" | sed 's/"/\\"/g')")" \
     --output "$TEMP_FILE" 2>/dev/null
 else
   # CLI fallback — reloads model each call (slowest)
@@ -187,7 +170,7 @@ fi
 # @intent Compress TTS audio for remote sessions (SSH/RDP)
 # @why Reduces bandwidth and prevents choppy playback
 if [[ "${AGENTVIBES_RDP_MODE:-false}" == "true" ]] && command -v ffmpeg &>/dev/null; then
-  _tmp=$(mktemp "$AUDIO_DIR/tts-compressed-XXXXXX"); COMPRESSED_FILE="${_tmp}.wav"; mv "$_tmp" "$COMPRESSED_FILE"
+  COMPRESSED_FILE="$AUDIO_DIR/tts-compressed-$(date +%s).wav"
   ffmpeg -i "$TEMP_FILE" -ac 1 -ar 22050 -b:a 64k -y "$COMPRESSED_FILE" 2>/dev/null
   if [[ -f "$COMPRESSED_FILE" ]]; then
     rm -f "$TEMP_FILE"
@@ -199,7 +182,7 @@ fi
 # @intent Add silence to prevent WSL audio static
 # @why WSL audio subsystem cuts off first ~200ms
 if command -v ffmpeg &>/dev/null; then
-  _tmp=$(mktemp "$AUDIO_DIR/tts-padded-XXXXXX"); PADDED_FILE="${_tmp}.wav"; mv "$_tmp" "$PADDED_FILE"
+  PADDED_FILE="$AUDIO_DIR/tts-padded-$(date +%s).wav"
   ffmpeg -f lavfi -i anullsrc=r=44100:cl=stereo:d=0.2 -i "$TEMP_FILE" \
     -filter_complex "[0:a][1:a]concat=n=2:v=0:a=1[out]" \
     -map "[out]" -y "$PADDED_FILE" 2>/dev/null
@@ -231,24 +214,7 @@ fi
 # @function play_audio
 # @intent Play generated audio using available player with sequential playback
 # @why Support multiple audio players and prevent overlapping audio
-# SECURITY: Use user-isolated lock directory (#129)
-_LOCK_DIR="${XDG_RUNTIME_DIR:-/tmp/agentvibes-$(id -u)}"
-mkdir -p "$_LOCK_DIR"
-chmod 700 "$_LOCK_DIR"
-LOCK_FILE="$_LOCK_DIR/agentvibes-audio.lock"
-
-# Auto-remove stale lock files (older than 30 seconds)
-if [ -f "$LOCK_FILE" ]; then
-  if [[ "$(uname)" == "Darwin" ]]; then
-    _lock_mtime=$(stat -f %m "$LOCK_FILE" 2>/dev/null || echo 0)
-  else
-    _lock_mtime=$(stat -c %Y "$LOCK_FILE" 2>/dev/null || echo 0)
-  fi
-  _lock_age=$(( $(date +%s) - _lock_mtime ))
-  if [[ $_lock_age -gt 30 ]]; then
-    rm -f "$LOCK_FILE"
-  fi
-fi
+LOCK_FILE="/tmp/agentvibes-audio.lock"
 
 for i in {1..4}; do
   if [ ! -f "$LOCK_FILE" ]; then