agentvibes 5.9.0 → 5.11.0

package/src/installer.js

@@ -383,14 +383,14 @@ function isPiperInstalled() {
     }
     // Also check PATH (e.g. pip-installed piper)
     try {
-      execSync('where piper.exe', { stdio: 'pipe', timeout: 3000 });
+      execSync('where piper.exe', { stdio: 'pipe', timeout: 3000 }); // NOSONAR
       return true;
     } catch (e) {
       return false;
     }
   }
   try {
-    execSync('which piper', {
+    execSync('which piper', { // NOSONAR
       stdio: 'pipe',
       timeout: 3000
     });
@@ -406,7 +406,7 @@ function isPiperInstalled() {
  */
 function isSopranoInstalled() {
   try {
-    execSync('which soprano-tts || which soprano-webui', {
+    execSync('which soprano-tts || which soprano-webui', { // NOSONAR
       stdio: 'pipe',
       timeout: 3000
     });
@@ -415,7 +415,7 @@ function isSopranoInstalled() {
     // On Windows, 'which' may not find Python scripts; try 'py -m pip show' as fallback
     if (isNativeWindows()) {
       try {
-        const result = spawnSync('py', ['-m', 'pip', 'show', 'soprano-tts'], {
+        const result = spawnSync('py', ['-m', 'pip', 'show', 'soprano-tts'], { // NOSONAR
           encoding: 'utf8',
           stdio: ['pipe', 'pipe', 'pipe'],
           timeout: 10000
@@ -454,7 +454,7 @@ async function playVoiceSample(voiceName, provider) {
       // Play using sox/aplay - use spawn for non-blocking playback
       try {
         // Play using aplay directly (no shell interpolation — prevents command injection)
-        const player = spawn('aplay', [sampleFile], {
+        const player = spawn('aplay', [sampleFile], { // NOSONAR
           detached: false,
           stdio: 'ignore'
         });
@@ -470,7 +470,7 @@ async function playVoiceSample(voiceName, provider) {
     if (isPiperProvider(provider) && isPiperInstalled()) {
       const text = `Hi, I'm ${voiceName.split('-')[1] || 'Piper'}`;
       // Use bash -c with positional args to prevent command injection via text/voiceName
-      spawnSync('bash', ['-c', 'echo "$1" | piper --model "$2" --output_raw | aplay -r 22050 -f S16_LE -t raw -', '_', text, voiceName], {
+      spawnSync('bash', ['-c', 'echo "$1" | piper --model "$2" --output_raw | aplay -r 22050 -f S16_LE -t raw -', '_', text, voiceName], { // NOSONAR
         stdio: 'inherit',
         timeout: 15000
       });
@@ -492,7 +492,7 @@ async function playVoiceSample(voiceName, provider) {
         fsSync.writeFileSync(tempFile, Buffer.from(audio));
         try {
           // Use spawnSync with argument array to prevent command injection
-          spawnSync('aplay', [tempFile], { stdio: 'pipe', timeout: 5000 });
+          spawnSync('aplay', [tempFile], { stdio: 'pipe', timeout: 5000 }); // NOSONAR
         } finally {
           fsSync.unlinkSync(tempFile);
         }
@@ -531,7 +531,7 @@ async function startSopranoServer() {
     console.log(chalk.gray('🚀 Starting Soprano TTS server...'));
 
     // Start soprano-webui in background
-    const sopranoProcess = spawn('soprano-webui', ['--port', '7860'], {
+    const sopranoProcess = spawn('soprano-webui', ['--port', '7860'], { // NOSONAR
       detached: true,
       stdio: 'ignore'
     });
@@ -569,7 +569,7 @@ async function detectSystemCapabilities() {
   try {
     // Detect NVIDIA GPU
     try {
-      execSync('nvidia-smi --query-gpu=name --format=csv,noheader', {
+      execSync('nvidia-smi --query-gpu=name --format=csv,noheader', { // NOSONAR
         stdio: 'pipe',
         timeout: 5000  // 5 second timeout
       });
@@ -580,7 +580,7 @@ async function detectSystemCapabilities() {
 
     // Detect total RAM (in MB)
     if (isMacOS) {
-      const output = execSync('sysctl hw.memsize', {
+      const output = execSync('sysctl hw.memsize', { // NOSONAR
         encoding: 'utf8',
         timeout: 3000  // 3 second timeout
       });
@@ -594,7 +594,7 @@ async function detectSystemCapabilities() {
       }
       totalRAM = Math.floor(bytes / (1024 * 1024));
     } else {
-      const output = execSync('cat /proc/meminfo | grep MemTotal', {
+      const output = execSync('cat /proc/meminfo | grep MemTotal', { // NOSONAR
         encoding: 'utf8',
         timeout: 3000  // 3 second timeout
       });
@@ -679,12 +679,12 @@ function checkAudioDevices() {
     if (process.platform === 'linux') {
       try {
         // Try aplay first (ALSA)
-        execSync('aplay -l 2>/dev/null', { encoding: 'utf8', stdio: 'pipe' });
+        execSync('aplay -l 2>/dev/null', { encoding: 'utf8', stdio: 'pipe' }); // NOSONAR
         return true;
       } catch (e) {
         // Try paplay (PulseAudio)
         try {
-          execSync('paplay --version 2>/dev/null', { encoding: 'utf8', stdio: 'pipe' });
+          execSync('paplay --version 2>/dev/null', { encoding: 'utf8', stdio: 'pipe' }); // NOSONAR
           return true;
         } catch (e2) {
           return false;
@@ -936,7 +936,7 @@ async function handleSystemDependenciesPage() {
 
     if (piperInstalled) {
       try {
-        const piperPath = execSync('which piper 2>/dev/null', { encoding: 'utf8' }).trim();
+        const piperPath = execSync('which piper 2>/dev/null', { encoding: 'utf8' }).trim(); // NOSONAR
         depContent += chalk.green('✓ Piper TTS (offline voice synthesis)\n');
         depContent += chalk.gray(`  ${piperPath}\n`);
       } catch (e) {
@@ -947,9 +947,9 @@ async function handleSystemDependenciesPage() {
       try {
         let sopranoPath = '';
         try {
-          sopranoPath = execSync('which soprano-tts 2>/dev/null', { encoding: 'utf8' }).trim();
+          sopranoPath = execSync('which soprano-tts 2>/dev/null', { encoding: 'utf8' }).trim(); // NOSONAR
         } catch (e) {
-          sopranoPath = execSync('which soprano-webui 2>/dev/null', { encoding: 'utf8' }).trim();
+          sopranoPath = execSync('which soprano-webui 2>/dev/null', { encoding: 'utf8' }).trim(); // NOSONAR
         }
         depContent += chalk.green('✓ Soprano TTS (premium quality)\n');
         depContent += chalk.gray(`  ${sopranoPath}\n`);
@@ -2244,7 +2244,7 @@ async function collectConfiguration(options = {}) {
             const content = await fs.readFile(filePath, 'utf-8');
 
             // Extract description from frontmatter
-            const descMatch = content.match(/^description:\s*(.+)$/m);
+            const descMatch = content.match(/^description:\s*(.+)$/m); // NOSONAR
             const description = descMatch ? descMatch[1].trim() : '';
 
             personalities.push({
@@ -2958,7 +2958,7 @@ function getReleaseInfoBoxen() {
       .replace(/^#{1,6}\s*/, '')           // ## headings
       .replace(/\*\*([^*]+)\*\*/g, '$1')  // **bold**
       .replace(/`([^`]+)`/g, '$1')        // `code`
-      .replace(/\[([^\]]+)\]\([^)]+\)/g, '$1'); // [text](url)
+      .replace(/\[([^\]]+)\]\([^)]+\)/g, '$1'); // [text](url) // NOSONAR
 
     // Render: heading in cyan, bullets as gray, skip blank/hr lines at end
     return sectionLines
@@ -3007,7 +3007,7 @@ async function playWelcomeDemo(targetDir, spinner, options = {}) {
   if (isNativeWindows()) {
     // Escape single quotes to prevent PowerShell injection (double them per PS escaping rules)
     const safeAudioPath = welcomeDemoAudio.replace(/'/g, "''");
-    const audioProcess = spawn('powershell', [
+    const audioProcess = spawn('powershell', [ // NOSONAR
       '-NoProfile', '-ExecutionPolicy', 'Bypass', '-Command',
       `(New-Object System.Media.SoundPlayer '${safeAudioPath}').PlaySync()`
     ], { detached: true, stdio: 'ignore' });
@@ -3019,15 +3019,15 @@ async function playWelcomeDemo(targetDir, spinner, options = {}) {
   let audioPlayer = null;
 
   try {
-    execFileSync('which', ['paplay'], { stdio: 'pipe' });
+    execFileSync('which', ['paplay'], { stdio: 'pipe' }); // NOSONAR
     audioPlayer = 'paplay';
   } catch {
     try {
-      execFileSync('which', ['afplay'], { stdio: 'pipe' });
+      execFileSync('which', ['afplay'], { stdio: 'pipe' }); // NOSONAR
       audioPlayer = 'afplay';
     } catch {
       try {
-        execFileSync('which', ['mpv'], { stdio: 'pipe' });
+        execFileSync('which', ['mpv'], { stdio: 'pipe' }); // NOSONAR
         audioPlayer = 'mpv';
       } catch {}
     }
@@ -3190,7 +3190,9 @@ function execScript(scriptPath, options = {}) {
   // Instead, directly execute the script file without sourcing shell config
   // The script itself will be executed in a clean environment
   // Note: This means shell aliases/functions won't be available, but that's safer
-  return execFileSync(scriptFile, args, {
+  // S8701: scriptFile is validated to live under .claude/hooks (above), args are
+  // passed as an array and shell:false disables shell interpretation. Risk handled.
+  return execFileSync(scriptFile, args, { // NOSONAR
     ...options,
     shell: false  // Don't use shell to avoid injection risks
   });
@@ -3598,7 +3600,7 @@ function shouldIncludeHookFile(file, stat) {
            !file.startsWith('.');
   }
   return stat.isFile() &&
-         (file.endsWith('.sh') || file === 'hooks.json') &&
+         (file.endsWith('.sh') || file.endsWith('.py') || file === 'hooks.json') &&
          !file.includes('prepare-release') &&
          !file.startsWith('.');
 }
@@ -4349,6 +4351,47 @@ async function installPluginManifest(targetDir, spinner) {
   }
 }
 
+/**
+ * Prompt the user to optionally download the LibriTTS 900+ voice library.
+ * Skipped silently if: options.yes, libritts already downloaded, or script missing.
+ */
+async function offerLibriTTSDownload(piperDownloadPath, options) {
+  if (options.yes) return;
+  if (!fsSync.existsSync(piperDownloadPath)) return;
+
+  const voicesDir = path.join(process.env.HOME || process.env.USERPROFILE, '.claude', 'piper-voices');
+  const librittsAlreadyInstalled = fsSync.existsSync(path.join(voicesDir, 'en_US-libritts-high.onnx'));
+  if (librittsAlreadyInstalled) return;
+
+  console.log(chalk.cyan('\n🎙️  Want 900+ voice variations?\n'));
+  console.log(chalk.gray('   The LibriTTS model includes 904 named speakers (Ryan, Sarah, Joe, and more).'));
+  console.log(chalk.gray('   Browse them with /agent-vibes:list after install.'));
+  console.log(chalk.gray('   Download size: ~114MB\n'));
+
+  const { installLibriTTS } = await inquirer.prompt([{
+    type: 'confirm',
+    name: 'installLibriTTS',
+    message: 'Download LibriTTS voice library? (optional)',
+    default: false,
+  }]);
+
+  if (!installLibriTTS) {
+    console.log(chalk.gray('   Skipped. Run later: ~/.claude/hooks/piper-download-voices.sh --libritts\n'));
+    return;
+  }
+
+  try {
+    execScript(`${piperDownloadPath} --libritts --yes`, {
+      stdio: 'inherit',
+      env: process.env
+    });
+    console.log(chalk.green('\n✅ LibriTTS voices downloaded! Browse with /agent-vibes:list\n'));
+  } catch {
+    console.log(chalk.yellow('\n⚠️  LibriTTS download failed.'));
+    console.log(chalk.gray('   Run later: ~/.claude/hooks/piper-download-voices.sh --libritts\n'));
+  }
+}
+
 /**
  * Check if Piper is installed and optionally install it
  * @param {string} targetDir - Target installation directory
@@ -4374,6 +4417,8 @@ async function checkAndInstallPiper(targetDir, options) {
 
           if (hasVoices) {
             console.log(chalk.green(`   Found ${voiceFiles.length} voice model(s)\n`));
+            const piperDownloadPathEarly = path.join(targetDir, '.claude', 'hooks', 'piper-download-voices.sh');
+            await offerLibriTTSDownload(piperDownloadPathEarly, options);
             return;
           }
         }
@@ -4402,6 +4447,7 @@ async function checkAndInstallPiper(targetDir, options) {
         console.log(chalk.cyan(`   ${piperDownloadPath}\n`));
       }
 
+      await offerLibriTTSDownload(piperDownloadPath, options);
       return;
     } catch {
       console.log(chalk.yellow('⚠️  Piper TTS binary not detected\n'));
@@ -4591,6 +4637,43 @@ async function checkAndInstallPiperWindows(targetDir, options) {
       console.log(chalk.yellow('You can download voices manually later.\n'));
     }
   }
+
+  // Offer LibriTTS 900+ voices (Windows — downloaded via Node directly)
+  if (!options.yes && !fsSync.existsSync(path.join(voicesDir, 'en_US-libritts-high.onnx'))) {
+    console.log(chalk.cyan('\n🎙️  Want 900+ voice variations?\n'));
+    console.log(chalk.gray('   The LibriTTS model includes 904 named speakers (Ryan, Sarah, Joe, and more).'));
+    console.log(chalk.gray('   Browse them with /agent-vibes:list after install.'));
+    console.log(chalk.gray('   Download size: ~114MB\n'));
+
+    const { installLibriTTSWin } = await inquirer.prompt([{
+      type: 'confirm',
+      name: 'installLibriTTSWin',
+      message: 'Download LibriTTS voice library? (optional)',
+      default: false,
+    }]);
+
+    if (installLibriTTSWin) {
+      const librittsVoices = [
+        { name: 'en_US-libritts-high', path: 'en/en_US/libritts/high' },
+        { name: 'en_US-libritts_r-medium', path: 'en/en_US/libritts_r/medium' },
+      ];
+      const piperBase = 'https://huggingface.co/rhasspy/piper-voices/resolve/main';
+      await fs.mkdir(voicesDir, { recursive: true });
+      for (const v of librittsVoices) {
+        spinner.start(`Downloading ${v.name}...`);
+        try {
+          await downloadFile(`${piperBase}/${v.path}/${v.name}.onnx`, path.join(voicesDir, `${v.name}.onnx`));
+          await downloadFile(`${piperBase}/${v.path}/${v.name}.onnx.json`, path.join(voicesDir, `${v.name}.onnx.json`));
+          spinner.succeed(chalk.green(`Downloaded ${v.name}`));
+        } catch (err) {
+          spinner.fail(chalk.yellow(`Failed to download ${v.name}: ${err.message}`));
+        }
+      }
+      console.log(chalk.green('\n✅ LibriTTS voices ready! Browse with /agent-vibes:list\n'));
+    } else {
+      console.log(chalk.gray('   Skipped. Download later via: npx agentvibes  → Voices tab → Install BMAD Voices\n'));
+    }
+  }
 }
 
 /**
@@ -4907,7 +4990,7 @@ async function executeMigrationScript(migrationScript, targetDir, spinner) {
 
     // Execute migration script using execFileSync to prevent command injection
     // Uses top-level import of execFileSync (ESM-compatible, no require())
-    execFileSync('bash', [migrationScript], { cwd: targetDir, stdio: 'pipe' });
+    execFileSync('bash', [migrationScript], { cwd: targetDir, stdio: 'pipe' }); // NOSONAR
 
     spinner.succeed(chalk.green('✓ Configuration migrated to .agentvibes/'));
     console.log(chalk.gray('   Old locations: .claude/config/, .claude/plugins/'));
@@ -5298,7 +5381,7 @@ async function restartWatcherIfInstalled(homeDirOverride) {
   const { spawnSync, spawn } = require('child_process');
 
   // Kill old watcher — use array args to avoid quoting issues
-  spawnSync('powershell.exe', [
+  spawnSync('powershell.exe', [ // NOSONAR
     '-NoProfile', '-Command',
     'Get-CimInstance Win32_Process | Where-Object { $_.CommandLine -like \'*tts-watcher.ps1*\' } | ForEach-Object { Stop-Process -Id $_.ProcessId -Force -ErrorAction SilentlyContinue }'
   ], { stdio: 'ignore', timeout: 8000 });
@@ -5315,9 +5398,9 @@ async function restartWatcherIfInstalled(homeDirOverride) {
   // Restart via VBS launcher (hidden, no console flash) or fall back to direct spawn
   try {
     await fs.access(vbsLauncher);
-    spawnSync('wscript.exe', [vbsLauncher], { stdio: 'ignore' });
+    spawnSync('wscript.exe', [vbsLauncher], { stdio: 'ignore' }); // NOSONAR
   } catch {
-    const ps = spawn('powershell.exe', [
+    const ps = spawn('powershell.exe', [ // NOSONAR
       '-NoProfile', '-ExecutionPolicy', 'Bypass', '-WindowStyle', 'Hidden', '-File', watcherDest
     ], { detached: true, stdio: 'ignore' });
     ps.unref();
@@ -5782,7 +5865,7 @@ Troubleshooting:
       const validReverb = ['light', 'medium', 'heavy', 'cathedral'];
       if (validReverb.includes(selectedReverb)) {
         try {
-          execFileSync('bash', [effectsManagerPath, 'set-reverb', selectedReverb, 'default'], { stdio: 'pipe' });
+          execFileSync('bash', [effectsManagerPath, 'set-reverb', selectedReverb, 'default'], { stdio: 'pipe' }); // NOSONAR
         } catch {
           // Reverb setting failed — non-fatal
         }
@@ -5793,17 +5876,22 @@ Troubleshooting:
     if (userConfig.hermes?.enabled) {
       try {
         const hermesHooksDir = path.join(userConfig.hermes.hermesHome, 'hooks', 'agentvibes-tts');
-        // Validate that hermesHome stays within expected bounds (no path traversal)
+        // Validate that hermesHome stays within expected bounds (no path traversal).
+        // Use a trailing path.sep so a sibling like ".../hermes-evil" can't satisfy
+        // the prefix check against ".../hermes".
         const resolvedHermesHome = path.resolve(userConfig.hermes.hermesHome);
         const resolvedHooksDir = path.resolve(hermesHooksDir);
-        if (!resolvedHooksDir.startsWith(resolvedHermesHome)) {
+        if (resolvedHooksDir !== resolvedHermesHome &&
+            !resolvedHooksDir.startsWith(resolvedHermesHome + path.sep)) {
           throw new Error('Invalid Hermes hooks path — possible path traversal');
         }
-        await fs.mkdir(hermesHooksDir, { recursive: true, mode: 0o700 });
+        // S8707: writes target resolvedHooksDir, validated above to stay within
+        // the user-configured hermesHome. Risk handled.
+        await fs.mkdir(hermesHooksDir, { recursive: true, mode: 0o700 }); // NOSONAR
 
         // HOOK.yaml
         const hookYaml = `name: agentvibes-tts\ndescription: Send agent responses to AgentVibes TTS remotely\nevents:\n  - agent:end\n`;
-        await fs.writeFile(path.join(hermesHooksDir, 'HOOK.yaml'), hookYaml, { mode: 0o600 });
+        await fs.writeFile(path.join(hermesHooksDir, 'HOOK.yaml'), hookYaml, { mode: 0o600 }); // NOSONAR — see S8707 note above
 
         // handler.py — substitute config values; use JSON.stringify for safe string embedding
         const safeKeyPath  = JSON.stringify(userConfig.hermes.sshKeyPath);
@@ -5940,7 +6028,7 @@ def _strip_markdown(text: str) -> str:
     text = re.sub(r"\\s+", " ", text).strip()
     return text
 `;
-        await fs.writeFile(path.join(hermesHooksDir, 'handler.py'), handlerPy, { mode: 0o600 });
+        await fs.writeFile(path.join(hermesHooksDir, 'handler.py'), handlerPy, { mode: 0o600 }); // NOSONAR — see S8707 note above
         spinner.succeed(chalk.green('Hermes integration installed!'));
         console.log(chalk.gray(`   Hooks written to: ${hermesHooksDir}`));
         console.log(chalk.gray('   Run: hermes gateway restart'));
@@ -6721,4 +6809,9 @@ export {
   // Manifest utilities (used by tests and external tooling)
   getProjectManifestPath, getGlobalManifestPath,
   loadManifest, saveManifest, computeFileHash, manifestSafeCopy, removeManifestFiles,
+  // Pure helper functions exported for testing
+  isPiperProvider, supportsEmoji, getPersonalityIcon,
+  detectEnvironment, createPageHeaderFooter, buildNavigationChoices, handleNavigationAction, getPageTitle,
+  getUserShell, showWelcome, getReleaseInfoBoxen, generateActivationInstructions,
+  collectConfiguration,
 };