agentvibes 5.9.0 → 5.11.0

package/src/console/app.js

@@ -9,7 +9,8 @@
 
 import blessed from 'blessed';
 import path from 'node:path';
-import { readFileSync } from 'node:fs';
+import { readFileSync, existsSync } from 'node:fs';
+import os from 'node:os';
 import { fileURLToPath } from 'node:url';
 import { spawnSync, execFileSync } from 'node:child_process';
 import { NavigationService, TAB_ORDER } from '../services/navigation-service.js';
@@ -238,9 +239,9 @@ export class AgentVibesConsole {
     // Right-aligned: git remote + branch when available, else AgentVibes repo link
     let topRightContent = `{${BRAND_PINK}-fg}github.com/preibisch/agentvibes{/${BRAND_PINK}-fg}`;
     try {
-      const branchResult = spawnSync('git', ['rev-parse', '--abbrev-ref', 'HEAD'],
+      const branchResult = spawnSync('git', ['rev-parse', '--abbrev-ref', 'HEAD'], // NOSONAR
         { encoding: 'utf8', timeout: 2000, cwd });
-      const remoteResult = spawnSync('git', ['remote', 'get-url', 'origin'],
+      const remoteResult = spawnSync('git', ['remote', 'get-url', 'origin'], // NOSONAR
         { encoding: 'utf8', timeout: 2000, cwd });
       if (branchResult.status === 0 && remoteResult.status === 0) {
         const branch = branchResult.stdout.trim();
@@ -627,24 +628,39 @@ export class AgentVibesConsole {
   _createFooter() {
     // Detect installed providers inline (same logic as ProviderService)
     const _has = (bin) => {
-      try { execFileSync('which', [bin], { stdio: 'ignore', timeout: 2000 }); return true; }
+      try { execFileSync('which', [bin], { stdio: 'ignore', timeout: 2000 }); return true; } // NOSONAR
       catch { return false; }
     };
+    const _pyHas = (mod) => {
+      try { execFileSync('python3', ['-c', `import ${mod}`], { stdio: 'ignore', timeout: 3000 }); return true; } // NOSONAR
+      catch { return false; }
+    };
+    const _elKeySet = () => {
+      if (process.env.ELEVENLABS_API_KEY) return true;
+      try {
+        const kf = path.join(os.homedir(), '.agentvibes', 'elevenlabs-key.txt');
+        return existsSync(kf) && readFileSync(kf, 'utf8').trim().length > 0;
+      } catch { return false; }
+    };
     const detected = {
-      piper:   _has('piper'),
-      soprano: _has('soprano'),
-      sapi:    process.platform === 'win32',
-      macos:   process.platform === 'darwin' && _has('say'),
+      piper:       _has('piper'),
+      kokoro:      _pyHas('kokoro'),
+      elevenlabs:  _elKeySet(),
+      soprano:     _has('soprano'),
+      sapi:        process.platform === 'win32',
+      macos:       process.platform === 'darwin' && _has('say'),
     };
 
     // Build provider status badges:  ● Name  (green if detected, grey if not)
     const on  = (label) => `{green-fg}●{/green-fg} ${label}`;
     const off = (label) => `{#546e7a-fg}● ${label}{/#546e7a-fg}`;
     const badges = [
-      detected.piper   ? on('Piper')        : off('Piper'),
-      detected.soprano ? on('Soprano')      : off('Soprano'),
-      detected.sapi    ? on('Windows SAPI') : off('Windows SAPI'),
-      detected.macos   ? on('Mac Say')      : off('Mac Say'),
+      detected.piper       ? on('Piper')       : off('Piper'),
+      detected.kokoro      ? on('Kokoro')       : off('Kokoro'),
+      detected.elevenlabs  ? on('ElevenLabs')   : off('ElevenLabs'),
+      detected.soprano     ? on('Soprano')      : off('Soprano'),
+      detected.sapi        ? on('Windows SAPI') : off('Windows SAPI'),
+      detected.macos       ? on('Mac Say')      : off('Mac Say'),
     ].join('  ');
 
     const footer = blessed.box({

package/src/console/audio-env.js

@@ -8,7 +8,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import os from 'node:os';
-import { spawnSync } from 'node:child_process';
+import { spawn, spawnSync } from 'node:child_process';
 
 /**
  * Build a spawn environment with correct PULSE_SERVER handling.
@@ -151,6 +151,90 @@ export function detectMp3Player(env) {
   return _detect(MP3_PLAYERS, env);
 }
 
+/**
+ * Returns true when running headless with PulseAudio over TCP.
+ * SDL2-based players (ffplay) fail in this configuration with exit 123.
+ */
+function _isHeadlessPulse(env) {
+  return !env.DISPLAY && typeof env.PULSE_SERVER === 'string' && env.PULSE_SERVER.startsWith('tcp:');
+}
+
+/**
+ * Spawn an MP3 player for the given track path.
+ *
+ * On headless servers with PulseAudio TCP, SDL2-based players (ffplay) fail
+ * because DISPLAY is not set. In that case uses ffmpeg→pacat pipe.
+ *
+ * Returns a process-like object with:
+ *   .pid    — primary process PID
+ *   .kill() — stops playback, killing all spawned processes
+ *   .on(event, cb) — supports 'exit' and 'error'
+ *
+ * Returns null if no suitable player or required binaries are unavailable.
+ *
+ * @param {string} trackPath - Absolute path to the MP3 file
+ * @param {Object} [env]     - Environment (defaults to buildAudioEnv())
+ * @returns {{ pid: number, kill: Function, on: Function }|null}
+ */
+export function spawnMp3Player(trackPath, env) {
+  env = env ?? buildAudioEnv();
+
+  if (_isHeadlessPulse(env)) {
+    // Check required binaries are present.
+    // S4036: standard system media tools resolved via the user's local PATH on
+    // their own machine — no untrusted PATH, absolute paths aren't portable
+    // across distros/Homebrew/Nix. Risk accepted.
+    if (spawnSync('which', ['ffmpeg'], { stdio: 'ignore', env }).status !== 0) return null; // NOSONAR
+    if (spawnSync('which', ['pacat'],  { stdio: 'ignore', env }).status !== 0) return null; // NOSONAR
+
+    const ff = spawn('ffmpeg', // NOSONAR — see S4036 note above
+      ['-i', trackPath, '-f', 's16le', '-ac', '2', '-ar', '44100', 'pipe:1', '-loglevel', 'quiet'],
+      { stdio: ['ignore', 'pipe', 'ignore'], env },
+    );
+    const pa = spawn('pacat', // NOSONAR — see S4036 note above
+      ['--playback', '--format=s16le', '--channels=2', '--rate=44100'],
+      { stdio: ['pipe', 'ignore', 'ignore'], env },
+    );
+    ff.stdout.on('error', () => {});
+    pa.stdin.on('error', () => {});
+    ff.stdout.pipe(pa.stdin);
+
+    const _listeners = { exit: [], error: [] };
+    pa.on('exit', (code, sig) => _listeners.exit.forEach(cb => cb(code, sig)));
+    ff.on('error', err => _listeners.error.forEach(cb => cb(err)));
+    pa.on('error', err => _listeners.error.forEach(cb => cb(err)));
+
+    return {
+      pid: ff.pid,
+      kill() { try { ff.kill(); } catch {} try { pa.kill(); } catch {} },
+      on(event, cb) { if (_listeners[event]) _listeners[event].push(cb); },
+    };
+  }
+
+  const player = detectMp3Player(env);
+  if (!player) return null;
+
+  const isWin = process.platform === 'win32' && !process.env.WSL_DISTRO_NAME;
+  const proc = spawn(player.bin, player.args(trackPath), {
+    stdio: 'ignore', detached: !isWin, windowsHide: true, env,
+  });
+
+  return {
+    pid: proc.pid,
+    kill() {
+      try {
+        if (isWin) {
+          spawn('taskkill', ['/F', '/T', '/PID', String(proc.pid)], // NOSONAR
+            { stdio: 'ignore', windowsHide: true });
+        } else {
+          process.kill(-proc.pid, 'SIGTERM');
+        }
+      } catch (e) { if (e.code !== 'ESRCH') { /* ignore */ } }
+    },
+    on(event, cb) { proc.on(event, cb); },
+  };
+}
+
 /**
  * Detect the best available WAV player.
  * On Windows, uses PowerShell SoundPlayer as built-in fallback.

package/src/console/navigation.js

@@ -40,8 +40,12 @@ const KEY_TO_TAB = {
 export function setupNavigation(screen, navigationService, focusMainTabBar) {
   // Tab switching shortcuts — one handler per key (both cases)
   // When a modal is open, force-close all modals then switch tabs.
+  // Exception: if already on the target tab, pressing its shortcut is a no-op —
+  // the user is trying to do something within the tab (e.g. 'I' in setup means
+  // "install", not "re-navigate to setup and close all my pickers").
   for (const [key, tabId] of Object.entries(KEY_TO_TAB)) {
     screen.key([key], () => {
+      if (navigationService.getActiveTab() === tabId) return;
       if (navigationService.isModalOpen()) {
         navigationService.forceCloseAll();
         setTimeout(() => navigationService.switchTab(tabId), 0);

package/src/console/tabs/agents-tab.js

@@ -20,6 +20,7 @@ import {
   getFavorites, getThumbsDown, toggleThumbsUp, toggleThumbsDown,
 } from './voices-tab.js';
 import { buildAudioEnv, detectWavPlayer, detectRemoteLlm } from '../audio-env.js';
+import { voicesForProvider } from '../../services/provider-voice-catalog.js';
 import { destroyList } from '../widgets/destroy-list.js';
 import { BRAND_PINK } from '../brand-colors.js';
 import { t } from '../../i18n/strings.js';
@@ -642,7 +643,7 @@ ${_tl('bmadDesc')}
     const FIELDS = [
       { key: 'voice',        label: 'Voice',       getValue: () => draft.voice || '(global default)' },
       { key: 'pretext',      label: 'Pretext',     getValue: () => draft.pretext || '(default)' },
-      { key: 'reverbPreset', label: 'Reverb',      getValue: () => formatReverbState(draft.reverbPreset) },
+      { key: 'reverbPreset', label: 'Audio Effects', getValue: () => formatReverbState(draft.reverbPreset) },
       { key: 'personality',  label: 'Personality', getValue: () => {
         const p = draft.personality;
         const emoji = PERSONALITY_EMOJIS[p] || '';
@@ -1061,7 +1062,7 @@ ${_tl('bmadDesc')}
         if (!fs.existsSync(playTtsScript)) return;
         _previewVoiceId = voiceId;
         if (!_vpClosed) { vpPreviewLine.setContent(`{bright-cyan-fg}♪ Playing: ${voiceId}...{/bright-cyan-fg}`); _refreshVP(); }
-        _previewProc = spawn('powershell', [
+        _previewProc = spawn('powershell', [ // NOSONAR
           '-NoProfile', '-ExecutionPolicy', 'Bypass', '-File', playTtsScript, phrase, voiceId,
         ], { stdio: 'ignore', detached: false, windowsHide: true, env: _spawnEnv });
         _previewProc.on('exit', () => {
@@ -1079,7 +1080,7 @@ ${_tl('bmadDesc')}
       const args = [playTtsScript, phrase, voiceId];
       if (remoteLlm) args.push('--llm', remoteLlm);
 
-      _previewProc = spawn('bash', args, {
+      _previewProc = spawn('bash', args, { // NOSONAR
         stdio: 'ignore', detached: true,
         env: { ..._spawnEnv, CLAUDE_PROJECT_DIR: _projectRoot },
         cwd: _projectRoot,
@@ -1277,7 +1278,7 @@ ${_tl('bmadDesc')}
 
     const voiceId = profile.voice || '';
     const pretext = profile.pretext || AgentVoiceStore.getDefaultPretext(agent.displayName, agent.title);
-    const phrase = `${pretext} ${SAMPLE_PHRASES[Math.floor(Math.random() * SAMPLE_PHRASES.length)]}`;
+    const phrase = `${pretext} ${SAMPLE_PHRASES[Math.floor(Math.random() * SAMPLE_PHRASES.length)]}`; // NOSONAR
 
     const isWindows = process.platform === 'win32' && !process.env.WSL_DISTRO_NAME;
 
@@ -1295,7 +1296,7 @@ ${_tl('bmadDesc')}
       if (voiceId) args.push(voiceId);
       if (remoteLlm) args.push('--llm', remoteLlm);
 
-      const proc = spawn('bash', args, {
+      const proc = spawn('bash', args, { // NOSONAR
         stdio: ['ignore', 'ignore', 'ignore'],
         detached: true,
         env: { ..._spawnEnv },
@@ -1434,7 +1435,7 @@ ${_tl('bmadDesc')}
     const psArgs  = ['-NoProfile', '-ExecutionPolicy', 'Bypass', '-File', playTts, phrase];
     if (voiceId) psArgs.push(voiceId);
 
-    const proc = spawn('powershell', psArgs, {
+    const proc = spawn('powershell', psArgs, { // NOSONAR
       stdio: 'ignore', detached: false, windowsHide: true, env: spawnEnv,
     });
     _playingProcess = proc;
@@ -1457,7 +1458,7 @@ ${_tl('bmadDesc')}
   function _shuffleArray(arr) {
     const a = [...arr];
     for (let i = a.length - 1; i > 0; i--) {
-      const j = Math.floor(Math.random() * (i + 1));
+      const j = Math.floor(Math.random() * (i + 1)); // NOSONAR
       [a[i], a[j]] = [a[j], a[i]];
     }
     return a;
@@ -1494,13 +1495,18 @@ ${_tl('bmadDesc')}
   }
 
   function _autoAssignVoices() {
-    const installed = scanInstalledVoices();
+    // Pull the pool from whichever provider is currently active, not always Piper.
+    // Agent profiles store only a voice id (the active provider is global), so
+    // switching the provider and re-running auto-assign rebinds every agent to a
+    // voice from that provider (Kokoro, ElevenLabs, soprano, …).
+    const provider = providerService?.getActiveProvider?.() ?? 'piper';
+    const installed = voicesForProvider(provider, { scanInstalledVoices, getVoiceMeta });
     if (installed.length === 0) return false;
 
-    // Separate voices by gender
-    const femaleVoices = _shuffleArray(installed.filter(v => getVoiceMeta(v).gender === 'Female'));
-    const maleVoices   = _shuffleArray(installed.filter(v => getVoiceMeta(v).gender === 'Male'));
-    const otherVoices  = _shuffleArray(installed.filter(v => !['Male', 'Female'].includes(getVoiceMeta(v).gender)));
+    // installed is [{ id, gender }] — separate the ids by gender.
+    const femaleVoices = _shuffleArray(installed.filter(v => v.gender === 'Female').map(v => v.id));
+    const maleVoices   = _shuffleArray(installed.filter(v => v.gender === 'Male').map(v => v.id));
+    const otherVoices  = _shuffleArray(installed.filter(v => !['Male', 'Female'].includes(v.gender)).map(v => v.id));
 
     // Separate agents by gender
     const femaleAgents = _agents.filter(a => _inferAgentGender(a) === 'Female');

package/src/console/tabs/music-tab.js

@@ -13,8 +13,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import os from 'node:os';
 import { fileURLToPath } from 'node:url';
-import { spawn } from 'node:child_process';
-import { buildAudioEnv, detectMp3Player } from '../audio-env.js';
+import { buildAudioEnv, spawnMp3Player } from '../audio-env.js';
 import { t } from '../../i18n/strings.js';
 
 // Package-relative tracks dir — used as fallback when cwd has no .claude/audio/tracks/
@@ -542,28 +541,14 @@ export function createMusicTab(screen, services) {
   let _playingProcess = null;
   let _playingTrackId = null;
 
-  // Kill the entire process group so child audio processes (ffplay, play, mpg123) all die
   function _killPlayingProcess() {
     if (_playingProcess) {
-      const _isWin = process.platform === 'win32' && !process.env.WSL_DISTRO_NAME;
-      try {
-        if (_isWin) {
-          // Windows: kill the process tree via taskkill (process group kill doesn't work)
-          spawn('taskkill', ['/F', '/T', '/PID', String(_playingProcess.pid)], {
-            stdio: 'ignore', windowsHide: true,
-          });
-        } else {
-          process.kill(-_playingProcess.pid, 'SIGTERM');
-        }
-      } catch (e) {
-        if (e.code !== 'ESRCH') { /* ignore */ }
-      }
+      _playingProcess.kill();
       _playingProcess = null;
     }
   }
 
   const _spawnEnv = buildAudioEnv();
-  const _detectedPlayer = detectMp3Player(_spawnEnv);
 
   process.on('exit', () => { _killPlayingProcess(); });
 
@@ -594,7 +579,8 @@ export function createMusicTab(screen, services) {
     _killPlayingProcess();
     _playingTrackId = null;
 
-    if (!_detectedPlayer) {
+    const proc = spawnMp3Player(trackPath, _spawnEnv);
+    if (!proc) {
       const installHint = process.platform === 'win32'
         ? 'No MP3 player found. Install ffmpeg: winget install ffmpeg'
         : 'No MP3 player found. Install ffmpeg: sudo apt install ffmpeg';
@@ -604,18 +590,14 @@ export function createMusicTab(screen, services) {
       return;
     }
 
-    const _isWin = process.platform === 'win32' && !process.env.WSL_DISTRO_NAME;
-    // Spawn the detected player directly (no sh -c chain — avoids VLC/cvlc stderr issues)
-    _playingProcess = spawn(_detectedPlayer.bin, _detectedPlayer.args(trackPath), {
-      stdio: 'ignore', detached: !_isWin, windowsHide: true, env: _spawnEnv,
-    });
+    _playingProcess = proc;
     _playingTrackId = trackId;
 
     const label = _allTracks.find(t => t.id === trackId)?.label ?? formatTrackLabel(trackId);
     previewLine.setContent(`{${COLORS.playingFg}-fg}♪ Previewing: ${label}  (Space again to stop){/${COLORS.playingFg}-fg}`);
     screen.render();
 
-    _playingProcess.on('exit', () => {
+    proc.on('exit', () => {
       if (_playingTrackId === trackId) {
         _playingTrackId = null;
         _playingProcess = null;
@@ -624,7 +606,7 @@ export function createMusicTab(screen, services) {
       }
     });
 
-    _playingProcess.on('error', () => {
+    proc.on('error', () => {
       if (_playingTrackId === trackId) {
         _killPlayingProcess();
         _playingTrackId = null;

package/src/console/tabs/receiver-tab.js

@@ -73,10 +73,10 @@ function _getNetworkInfo() {
   try {
     if (isWin) {
       // Use PowerShell to get local IP on Windows
-      localIp = execSync('powershell -NoProfile -Command "(Get-NetIPAddress -AddressFamily IPv4 | Where-Object { $_.InterfaceAlias -notmatch \'Loopback\' } | Select-Object -First 1).IPAddress"',
+      localIp = execSync('powershell -NoProfile -Command "(Get-NetIPAddress -AddressFamily IPv4 | Where-Object { $_.InterfaceAlias -notmatch \'Loopback\' } | Select-Object -First 1).IPAddress"', // NOSONAR
         { timeout: 5000, stdio: 'pipe' }).toString().trim();
     } else {
-      localIp = execSync("hostname -I 2>/dev/null | awk '{print $1}'", { timeout: 3000, stdio: 'pipe' }).toString().trim();
+      localIp = execSync("hostname -I 2>/dev/null | awk '{print $1}'", { timeout: 3000, stdio: 'pipe' }).toString().trim(); // NOSONAR
     }
   } catch { /* ignore */ }
   try {
@@ -86,7 +86,7 @@ function _getNetworkInfo() {
       const m = sshdConf.match(/^Port\s+(\d+)/m);
       if (m) sshPort = m[1];
     } else {
-      const portLine = execSync("grep -E '^Port ' /etc/ssh/sshd_config 2>/dev/null || echo 'Port 22'", { timeout: 3000, stdio: 'pipe' }).toString().trim();
+      const portLine = execSync("grep -E '^Port ' /etc/ssh/sshd_config 2>/dev/null || echo 'Port 22'", { timeout: 3000, stdio: 'pipe' }).toString().trim(); // NOSONAR
       const m = portLine.match(/^Port\s+(\d+)/);
       if (m) sshPort = m[1];
     }
@@ -130,7 +130,7 @@ function _detectSetupState() {
 
       // Check sshd running
       try {
-        const svc = execSync('powershell -NoProfile -Command "(Get-Service sshd -EA SilentlyContinue).Status"',
+        const svc = execSync('powershell -NoProfile -Command "(Get-Service sshd -EA SilentlyContinue).Status"', // NOSONAR
           { timeout: 5000, stdio: 'pipe' }).toString().trim();
         state.sshdRunning = svc === 'Running';
       } catch { /* sshd not installed */ }
@@ -143,13 +143,13 @@ function _detectSetupState() {
 
       // Check ffmpeg
       try {
-        execSync('where ffmpeg', { timeout: 3000, stdio: 'pipe' });
+        execSync('where ffmpeg', { timeout: 3000, stdio: 'pipe' }); // NOSONAR
         state.ffmpegInstalled = true;
       } catch { /* not found */ }
 
       // Check piper
       try {
-        execSync('where piper', { timeout: 3000, stdio: 'pipe' });
+        execSync('where piper', { timeout: 3000, stdio: 'pipe' }); // NOSONAR
         state.piperInstalled = true;
       } catch {
         const piperPath = path.join(process.env.LOCALAPPDATA || '', 'Programs', 'Piper', 'piper.exe');
@@ -165,10 +165,10 @@ function _detectSetupState() {
       // Linux/macOS detection (original)
       let receiverHome = '';
       try {
-        execSync('id agentvibes-receiver', { timeout: 3000, stdio: 'pipe' });
+        execSync('id agentvibes-receiver', { timeout: 3000, stdio: 'pipe' }); // NOSONAR
         state.receiverUserExists = true;
         try {
-          receiverHome = execSync("getent passwd agentvibes-receiver 2>/dev/null | cut -d: -f6 || echo '/home/agentvibes-receiver'",
+          receiverHome = execSync("getent passwd agentvibes-receiver 2>/dev/null | cut -d: -f6 || echo '/home/agentvibes-receiver'", // NOSONAR
             { timeout: 3000, stdio: 'pipe' }).toString().trim();
         } catch { receiverHome = '/home/agentvibes-receiver'; }
       } catch { /* user does not exist */ }
@@ -201,7 +201,7 @@ function _detectSetupState() {
       } catch { /* no read access */ }
 
       try {
-        const modules = execSync('pactl list modules short 2>/dev/null', { timeout: 3000, stdio: 'pipe' }).toString();
+        const modules = execSync('pactl list modules short 2>/dev/null', { timeout: 3000, stdio: 'pipe' }).toString(); // NOSONAR
         state.tcpModuleLoaded = modules.includes('module-native-protocol-tcp');
       } catch { /* pactl not available */ }
     }
@@ -1031,7 +1031,7 @@ export function createReceiverTab(screen, services) {
     screen.render();
 
     // Fire SSH in background — don't block the TUI
-    const child = spawn('ssh', ['-o', 'ConnectTimeout=5', sshHost, encoded], {
+    const child = spawn('ssh', ['-o', 'ConnectTimeout=5', sshHost, encoded], { // NOSONAR
       stdio: 'ignore',
       detached: true,
     });
@@ -1361,7 +1361,7 @@ export function createReceiverTab(screen, services) {
     }
     _refreshCachedInfo();
     const text = _buildDetailedInstructions(RECEIVER_ALIAS, RECEIVER_SCRIPT, _networkInfo)
-      .replace(/\{[^}]*\}/g, '')
+      .replace(/\{[^}]*\}/g, '') // NOSONAR
       // eslint-disable-next-line no-control-regex
       .replace(/\x1b\[[0-9;]*m/g, '');
     // Try platform-appropriate clipboard command
@@ -1374,7 +1374,7 @@ export function createReceiverTab(screen, services) {
         mkdirSync(AGENTVIBES_DIR, { recursive: true });
         writeFileSync(tmpFile, '\ufeff' + text, 'utf-8');
         const psCmd = `Get-Content -Path "${tmpFile.replace(/\\/g, '/')}" -Encoding UTF8 -Raw | Set-Clipboard; Remove-Item "${tmpFile.replace(/\\/g, '/')}"`;
-        const r = spawnSync('powershell', ['-NoProfile', '-Command', psCmd], { timeout: 5000, stdio: ['pipe', 'pipe', 'pipe'] });
+        const r = spawnSync('powershell', ['-NoProfile', '-Command', psCmd], { timeout: 5000, stdio: ['pipe', 'pipe', 'pipe'] }); // NOSONAR
         if (r.status === 0) {
           _showFeedback('{green-fg}Copied to clipboard!{/green-fg}');
           copied = true;
@@ -1413,7 +1413,7 @@ export function createReceiverTab(screen, services) {
     // List available audio sinks and let user pick one
     let sinks;
     try {
-      const out = execSync('pactl --server=tcp:127.0.0.1:34567 list sinks short 2>/dev/null || pactl list sinks short 2>/dev/null', { timeout: 5000 }).toString().trim();
+      const out = execSync('pactl --server=tcp:127.0.0.1:34567 list sinks short 2>/dev/null || pactl list sinks short 2>/dev/null', { timeout: 5000 }).toString().trim(); // NOSONAR
       sinks = out.split('\n').filter(l => l.length > 0).map(line => {
         const parts = line.split('\t');
         return { id: parts[0], name: parts[1] || '', driver: parts[2] || '', state: parts[4] || '' };

package/src/console/tabs/settings-tab.js

@@ -645,7 +645,7 @@ export function createSettingsTab(screen, services) {
       if (_previewVoiceId === voiceId) { _killVP(); vpPreviewLine.setContent(''); _refreshVP(); return; }
       _killVP();
 
-      const phrase = SAMPLE_PHRASES[Math.floor(Math.random() * SAMPLE_PHRASES.length)];
+      const phrase = SAMPLE_PHRASES[Math.floor(Math.random() * SAMPLE_PHRASES.length)]; // NOSONAR
       const playTtsScript = path.join(_projectRoot, '.claude', 'hooks', 'play-tts.sh');
       if (!fs.existsSync(playTtsScript)) return;
 
@@ -653,7 +653,7 @@ export function createSettingsTab(screen, services) {
       const args = [playTtsScript, phrase, voiceId];
       if (remoteLlm) args.push('--llm', remoteLlm);
 
-      _previewProc = spawn('bash', args, {
+      _previewProc = spawn('bash', args, { // NOSONAR
         stdio: 'ignore',
         detached: true,
         env: _spawnEnv,