alvin-bot 4.18.5 → 4.19.2

package/CHANGELOG.md

@@ -2,6 +2,88 @@
 
 All notable changes to Alvin Bot are documented here.
 
+## [4.19.2] — 2026-04-24
+
+### 🐛 Fix: workspace switch produced "(no response)" format-kaskade; added empty-stream diagnostics
+
+**Symptom.** After v4.19.1 shipped, a workspace/dir switch still produced a broken response — but this time NOT an empty stream. Claude replied with literal text like `"(no response)\n\nUser: Hallo"`, then the next turn `"(no response)\n\nUser: wie viele tools hast du…"` — a format-kaskade where every response got worse.
+
+**Root cause.** v4.19.1's cwd-change reset set `session.lastSdkHistoryIndex = -1`. That value is consumed by `buildBridgeMessage()` in `handlers/message.ts`, which is designed for the Ollama-fallback path — its preamble frames past turns as *"the following N message(s) were exchanged with a fallback model"*. When the reset runs on a workspace switch, the ENTIRE conversation history (dozens of turns in a long-running session) gets packaged under that framing and prepended to the next prompt. If the history contains Telegram fallback artifacts (`(Keine Antwort)`, `(no response)`), Claude reads those as the "fallback model's response format" and imitates it. Each imitation lands back in history, poisoning the next bridge. Cascade.
+
+Workspace switch is not a fallback event — it's *"new persona, new task"*. The old conversation belongs to the old workspace and must not be reframed and re-injected.
+
+**Fix.** `handlers/message.ts`, `handlers/platform-message.ts`, and `handlers/commands.ts` (`/dir`) now set `session.lastSdkHistoryIndex = session.history.length - 1` on cwd change. `buildBridgeMessage()` returns empty for the next turn, Claude starts the new workspace with a clean slate — persona, cwd, system prompt, but no inherited conversation.
+
+**Additionally — empty-stream diagnostics.** `src/providers/claude-sdk-provider.ts` now logs a structured JSON dump on empty-stream detection: SDK result `subtype`/`is_error`/`num_turns`/`duration_ms`, the `usage` object, the `session_id` Claude returned vs. the one we passed, model override, cwd, effort, prompt/systemPrompt/history sizes, allowedTools count, and MCP state. Lets future empty-stream events be triaged in one log line instead of guessing.
+
+**Net effect.** `/workspace <name>` → message → clean response (no Fallback-framed preamble, no format-kaskade). `/dir <path>` → same. Next empty-stream event will come with actionable diagnostic output instead of a silent symptom.
+
+## [4.19.1] — 2026-04-24
+
+### 🐛 Critical fix: workspace/dir switch no longer produces empty-stream loop
+
+**Problem:** After `/workspace <name>` (or `/dir <path>`), every subsequent SDK message returned `⚠️ Claude antwortete mit leerem Stream …` — and even switching back to the previous workspace did not recover. The v4.18.5 auto-reset only masked the symptom; the underlying cause survived the recovery attempt.
+
+**Root cause — a two-part bug:**
+
+1. **Prevention layer missing.** The Claude Agent SDK's `resume: <sessionId>` is bound to the cwd the session was created in: session files live under `~/.claude/projects/<cwd-hash>/<session-id>.jsonl`. When a workspace switch changes `session.workingDir`, the stored `session.sessionId` points at a file that no longer exists in the new project folder. The CLI silently returns an empty stream.
+2. **Recovery layer broken.** v4.18.5's empty-stream detector correctly cleared `session.sessionId = null` on the `text` chunk — but the very next `done` chunk of the same stream carried `sessionId: resultMsg.session_id || capturedSessionId`, and the handler's `if (chunk.sessionId) session.sessionId = chunk.sessionId;` restored it. The "reset" was immediately undone by the trailing done chunk, so the next turn resumed the same dead session. Loop.
+
+**Fix (defense in depth, three layers):**
+
+- **Prevention** (root cause): `handlers/message.ts`, `handlers/platform-message.ts`, and `handlers/commands.ts` (`/dir`) now detect `session.workingDir !== workspace.cwd` (resp. new dir) BEFORE the query and clear `session.sessionId = null` + `session.lastSdkHistoryIndex = -1`. The next SDK turn starts fresh in the new project folder. `markSessionDirty()` is called so the clear persists across restarts.
+- **Recovery**: both handlers now track a local `sessionResetInStream` flag. When the provider signals `sessionResetRequested` on a text chunk, the flag is set, and the subsequent `done` chunk's sessionId is ignored (the original resume token or the CLI's fresh-but-wrong-project fallback — neither is safe).
+- **Hygiene**: `markSessionDirty()` is also called from the empty-stream reset path so the cleared sessionId is persisted immediately rather than waiting for the next trackProviderUsage debounce.
+
+**Net effect:** `/workspace <name>` → message → works. `/workspace default` → message → works. `/dir ~/Projects/foo` → message → works. No manual `/new` needed, no credit burn, no recovery retry.
+
+**Files:**
+- `src/handlers/message.ts` — cwd-change detection, sessionResetInStream flag, done-chunk guard, markSessionDirty import
+- `src/handlers/platform-message.ts` — same set of changes for non-Telegram platforms (Slack, Discord, WhatsApp)
+- `src/handlers/commands.ts` — `/dir` now invalidates SDK resume anchor on cwd change
+
+## [4.19.0] — 2026-04-24
+
+### 🧭 Feature: per-workspace runtime overrides (effort · provider · voice · temperature · toolset)
+
+Workspaces could already override `model` and `cwd`. v4.19.0 extends the YAML frontmatter with five more runtime fields that take effect automatically the moment a user runs `/workspace <name>`.
+
+**New workspace frontmatter fields** (`~/.alvin-bot/workspaces/<name>.md`):
+
+```yaml
+---
+purpose: my-project
+cwd: ~/path/to/workdir
+model: opus              # already existed
+effort: high             # NEW — low | medium | high
+provider: claude-sdk     # NEW — registry key; fallback chain still applies
+voice: iP95p4xoKVk53GoZ742B   # NEW — ElevenLabs voice ID, or Edge-TTS voice name (e.g. "en-US-JennyNeural")
+temperature: 0.3         # NEW — 0–2 sampling temperature
+toolset: research        # NEW — full (default) | readonly | research
+---
+Persona body continues here...
+```
+
+**Toolset presets** (map to concrete `allowedTools` lists via the new exported `toolsetToAllowedTools` helper):
+- `full` — provider default (`Read, Write, Edit, Bash, Glob, Grep, WebSearch, WebFetch, Task` + MCP)
+- `readonly` — `Read, Glob, Grep, WebSearch, WebFetch` (no Write/Edit/Bash)
+- `research` — `Read, WebSearch, WebFetch, Grep` (pure research mode)
+
+**Implementation:**
+
+- `src/services/workspaces.ts` — `Workspace` interface + `parseFrontmatter` extended; numeric parsing + enum validation so a malformed value is silently dropped and the session-default wins.
+- `src/handlers/message.ts` + `src/handlers/platform-message.ts` — at query-assembly time, every workspace-set field overrides the equivalent session/registry default exactly for this one query. Nothing sticky leaks across workspace switches.
+- `src/providers/registry.ts` — `queryWithFallback()` gains optional `providerOverride`. When supplied AND registered, it becomes primary for that query; fallback chain still applies, and the globally active provider joins the chain as a last-resort backup so availability drops still degrade gracefully.
+- `src/providers/claude-sdk-provider.ts` — passes `options.temperature` through to the Agent SDK when set.
+- `src/services/voice.ts` — `textToSpeech(text, voice?)` — optional second arg; picked up from `workspace.voice` in Telegram handler's voice-reply path. Works for both ElevenLabs (Voice ID) and Edge TTS (Voice Name like `de-DE-ConradNeural`).
+
+**Net effect:** Each workspace becomes a self-contained runtime profile. For example:
+- A `prep` workspace with `model: opus · effort: high · temperature: 0.3 · voice: en-US-JennyNeural` for polished long-form work;
+- A `research` workspace with `toolset: research · model: haiku · effort: low · temperature: 0.7` for cheap-and-fast web spelunking;
+- A `sensitive` workspace with `toolset: readonly · provider: claude-sdk` so the agent cannot accidentally `Write` or `Bash` inside the cwd.
+
+No data migration required — existing workspace files without the new fields keep working identically.
+
 ## [4.18.5] — 2026-04-23
 
 ### 🐛 Fix: auto-reset stale SDK sessionId on empty-stream detection

package/dist/handlers/commands.js

@@ -227,7 +227,22 @@ export function registerCommands(bot) {
             ? path.join(os.homedir(), newDir.slice(1))
             : path.resolve(newDir);
         if (fs.existsSync(resolved) && fs.statSync(resolved).isDirectory()) {
+            // v4.19.1 — Claude Agent SDK's `resume` is bound to the cwd. Changing
+            // the working dir without clearing the resume anchor would make the
+            // next SDK turn look up the session file in the wrong project folder
+            // → silent empty stream. Null out sessionId + history-anchor so the
+            // next turn starts a fresh SDK session in the new cwd.
+            const cwdChanged = session.workingDir !== resolved;
             session.workingDir = resolved;
+            if (cwdChanged) {
+                session.sessionId = null;
+                // v4.19.2 — Anchor at current last turn so no catch-up bridge is
+                // generated for the next turn. /dir semantically means "switch
+                // project context" just like /workspace — starting fresh is the
+                // sane default.
+                session.lastSdkHistoryIndex = session.history.length - 1;
+            }
+            markSessionDirty(userId);
             await ctx.reply(`Working directory: ${session.workingDir}`);
         }
         else {

package/dist/handlers/message.js

@@ -1,6 +1,6 @@
 import { InputFile } from "grammy";
 import fs from "fs";
-import { getSession, addToHistory, trackProviderUsage, buildSessionKey, getTelegramWorkspace } from "../services/session.js";
+import { getSession, addToHistory, trackProviderUsage, buildSessionKey, getTelegramWorkspace, markSessionDirty } from "../services/session.js";
 import { resolveWorkspaceOrDefault, getWorkspace } from "../services/workspaces.js";
 import { TelegramStreamer } from "../services/telegram.js";
 import { getRegistry } from "../engine.js";
@@ -313,9 +313,32 @@ export async function handleMessage(ctx) {
         const workspace = activeWsName
             ? (getWorkspace(activeWsName) ?? resolveWorkspaceOrDefault("telegram", String(userId), undefined))
             : resolveWorkspaceOrDefault("telegram", String(userId), undefined);
+        // v4.19.1 — Workspace switch detection. Claude Agent SDK's `resume` is
+        // bound to the cwd (session files live under
+        // ~/.claude/projects/<cwd-hash>/<session-id>.jsonl). If cwd changes as
+        // part of this switch, the stored sessionId points at a file the CLI
+        // cannot find in the new project folder → silent empty stream. Guard
+        // with a workspaceName change (not cwd comparison) so /dir-initiated
+        // custom cwds are preserved across turns where no workspace actually
+        // switched.
         if (session.workspaceName !== workspace.name) {
+            const cwdChanged = session.workingDir !== workspace.cwd;
             session.workspaceName = workspace.name;
             session.workingDir = workspace.cwd;
+            if (cwdChanged) {
+                console.log(`[session] workspace switch changed cwd (→ ${workspace.cwd}) — ` +
+                    `invalidating SDK resume anchor and skipping bridge`);
+                session.sessionId = null;
+                // v4.19.2 — Anchor at the last turn BEFORE the new user message so
+                // buildBridgeMessage() produces no catch-up preamble. A workspace
+                // switch means "new persona, new task" — the previous conversation
+                // (often from a different workspace) should NOT be reframed as
+                // "Fallback model turns" and fed back into Claude. That framing
+                // was producing format-kaskaden where Claude imitated Telegram
+                // "(Keine Antwort)" fallback artifacts from history.
+                session.lastSdkHistoryIndex = session.history.length - 1;
+                markSessionDirty(userId);
+            }
         }
         const chatIdStr = String(ctx.chat.id);
         const skillContext = buildSkillContext(text);
@@ -381,14 +404,23 @@ export async function handleMessage(ctx) {
                 }
             }
         }
+        // v4.19.0 — Per-workspace runtime overrides. Each is only applied when
+        // the workspace explicitly set it; otherwise the session/provider default
+        // wins. Toolset is mapped to a concrete allowedTools list via
+        // toolsetToAllowedTools(); providers that ignore allowedTools (Ollama etc.)
+        // just drop it.
+        const { toolsetToAllowedTools } = await import("../services/workspaces.js");
+        const wsAllowed = toolsetToAllowedTools(workspace.toolset);
         const queryOpts = {
             prompt: bridgedPrompt,
             systemPrompt,
             workingDir: session.workingDir,
-            effort: session.effort,
+            effort: workspace.effort ?? session.effort,
             // v4.15 — Per-workspace model override (optional YAML `model:` field).
-            // When unset, falls through to the globally active provider's model.
+            // v4.19 — ditto for temperature and toolset-derived allowedTools.
             ...(workspace.model ? { model: workspace.model } : {}),
+            ...(workspace.temperature !== undefined ? { temperature: workspace.temperature } : {}),
+            ...(wsAllowed ? { allowedTools: wsAllowed } : {}),
             abortSignal: session.abortController.signal,
             // User's UI locale — registry uses it to localize failure messages.
             locale: session.language,
@@ -420,7 +452,13 @@ export async function handleMessage(ctx) {
         // readable description (which only appears in the tool_use input,
         // not in the tool_result text). See Fix #17 Stage 2.
         let lastAgentToolUseInput;
-        for await (const chunk of registry.queryWithFallback(queryOpts)) {
+        // v4.19.1 — Track whether the provider requested a session reset during
+        // this stream. If it did, the trailing `done` chunk's sessionId MUST be
+        // ignored — otherwise it restores the exact sessionId we just cleared
+        // (the empty-stream capturedSessionId) and the next turn loops again.
+        // This is the second half of the empty-stream-loop fix.
+        let sessionResetInStream = false;
+        for await (const chunk of registry.queryWithFallback(queryOpts, workspace.provider)) {
             // v4.12.1 — Update pending-sync-task state FIRST so the timer's
             // next reset picks up the new state. This ordering is load-bearing:
             // reversing it means the timer rearms with stale state. A sync
@@ -455,6 +493,8 @@ export async function handleMessage(ctx) {
                         console.warn(`[session] provider requested reset for ${sessionKey} — clearing sessionId + SDK anchor`);
                         session.sessionId = null;
                         session.lastSdkHistoryIndex = -1;
+                        sessionResetInStream = true;
+                        markSessionDirty(userId);
                     }
                     // Emit the new delta for observers — accumulated text minus what
                     // we already broadcast.
@@ -535,7 +575,16 @@ export async function handleMessage(ctx) {
                     lastAgentToolUseInput = undefined;
                     break;
                 case "done":
-                    if (chunk.sessionId)
+                    // v4.19.1 — Respect the in-stream session reset. If the provider
+                    // already signalled `sessionResetRequested` on the preceding text
+                    // chunk (empty-stream detection), do NOT let the trailing done
+                    // chunk restore the sessionId we just nulled — that was the
+                    // silent bug behind the empty-stream loop across workspace
+                    // switches. The `done` chunk's sessionId on an empty stream is
+                    // either the stale resume token we tried to use or a brand-new
+                    // session file the CLI created in the wrong project folder;
+                    // neither is safe to resume from.
+                    if (chunk.sessionId && !sessionResetInStream)
                         session.sessionId = chunk.sessionId;
                     if (chunk.costUsd)
                         session.totalCost += chunk.costUsd;
@@ -608,7 +657,7 @@ export async function handleMessage(ctx) {
         if (session.voiceReply && finalText.trim()) {
             try {
                 await ctx.api.sendChatAction(ctx.chat.id, "upload_voice");
-                const audioPath = await textToSpeech(finalText);
+                const audioPath = await textToSpeech(finalText, workspace.voice);
                 await ctx.replyWithVoice(new InputFile(fs.readFileSync(audioPath), "response.mp3"));
                 fs.unlink(audioPath, () => { });
             }

package/dist/handlers/platform-message.js

@@ -7,7 +7,7 @@
  * This is the platform-agnostic equivalent of message.ts (which is Telegram-specific).
  */
 import fs from "fs";
-import { getSession, addToHistory, trackProviderUsage, buildSessionKey } from "../services/session.js";
+import { getSession, addToHistory, trackProviderUsage, buildSessionKey, markSessionDirty } from "../services/session.js";
 import { resolveWorkspaceOrDefault } from "../services/workspaces.js";
 import { getRegistry } from "../engine.js";
 import { buildSmartSystemPrompt } from "../services/personality.js";
@@ -114,11 +114,25 @@ export async function handlePlatformMessage(msg, adapter) {
         }
     }
     const workspace = resolveWorkspaceOrDefault(msg.platform, msg.chatId, channelName);
-    // If the workspace changed since last turn, update the session's cwd +
-    // workspaceName. This is debounced via session-persistence (v4.11.0).
+    // v4.19.1 — Workspace switch detection. If cwd changes as part of the
+    // switch, null out session.sessionId so the next SDK turn does not
+    // resume a session file that lives in the previous project folder
+    // (Claude Agent SDK stores sessions under ~/.claude/projects/<cwd-hash>/).
+    // Guard with workspaceName so /dir-initiated custom cwds survive turns
+    // where no workspace actually switched.
     if (session.workspaceName !== workspace.name) {
+        const cwdChanged = session.workingDir !== workspace.cwd;
         session.workspaceName = workspace.name;
         session.workingDir = workspace.cwd;
+        if (cwdChanged) {
+            console.log(`[session] workspace switch changed cwd (→ ${workspace.cwd}) — ` +
+                `invalidating SDK resume anchor and skipping bridge`);
+            session.sessionId = null;
+            // v4.19.2 — Anchor at current last turn so no catch-up bridge is
+            // generated for the next turn (see message.ts for full rationale).
+            session.lastSdkHistoryIndex = session.history.length - 1;
+            markSessionDirty(sessionKey);
+        }
     }
     // Skip if already processing (queue up to 3)
     if (session.isProcessing) {
@@ -164,14 +178,19 @@ export async function handlePlatformMessage(msg, adapter) {
         // in the system prompt for this query.
         const isFirstSDKTurn = isSDK && session.sessionId === null;
         const systemPrompt = (await buildSmartSystemPrompt(isSDK, session.language, fullText, msg.chatId, isFirstSDKTurn, workspace.systemPromptOverride)) + skillContext;
+        // v4.19.0 — Per-workspace runtime overrides (model/effort/temperature/toolset).
+        const { toolsetToAllowedTools } = await import("../services/workspaces.js");
+        const wsAllowed = toolsetToAllowedTools(workspace.toolset);
         const queryOpts = {
             prompt: fullText,
             systemPrompt,
             workingDir: session.workingDir,
-            effort: session.effort,
+            effort: workspace.effort ?? session.effort,
             // v4.15 — Per-workspace model override (optional YAML `model:` field).
-            // When unset, falls through to the globally active provider's model.
+            // v4.19 — ditto for temperature and toolset-derived allowedTools.
             ...(workspace.model ? { model: workspace.model } : {}),
+            ...(workspace.temperature !== undefined ? { temperature: workspace.temperature } : {}),
+            ...(wsAllowed ? { allowedTools: wsAllowed } : {}),
             sessionId: isSDK ? session.sessionId : null,
             history: !isSDK ? session.history : undefined,
             // v4.14 — Expose alvin_dispatch_agent MCP tool on non-Telegram
@@ -190,7 +209,12 @@ export async function handlePlatformMessage(msg, adapter) {
         if (!isSDK) {
             addToHistory(sessionKey, { role: "user", content: fullText });
         }
-        for await (const chunk of registry.queryWithFallback(queryOpts)) {
+        // v4.19.1 — Track whether the provider requested a session reset during
+        // this stream. If it did, the trailing `done` chunk's sessionId MUST be
+        // ignored — otherwise it restores the exact sessionId we just cleared
+        // and the next turn loops again. Mirror of message.ts.
+        let sessionResetInStream = false;
+        for await (const chunk of registry.queryWithFallback(queryOpts, workspace.provider)) {
             switch (chunk.type) {
                 case "text":
                     finalText = chunk.text || "";
@@ -200,10 +224,15 @@ export async function handlePlatformMessage(msg, adapter) {
                         console.warn(`[session] provider requested reset for ${sessionKey} — clearing sessionId + SDK anchor`);
                         session.sessionId = null;
                         session.lastSdkHistoryIndex = -1;
+                        sessionResetInStream = true;
+                        markSessionDirty(sessionKey);
                     }
                     break;
                 case "done":
-                    if (chunk.sessionId)
+                    // v4.19.1 — Respect in-stream reset: don't let done.sessionId undo
+                    // the clear from the empty-stream text chunk. See message.ts for
+                    // full rationale.
+                    if (chunk.sessionId && !sessionResetInStream)
                         session.sessionId = chunk.sessionId;
                     if (chunk.costUsd)
                         session.totalCost += chunk.costUsd;

package/dist/providers/claude-sdk-provider.js

@@ -192,6 +192,9 @@ export class ClaudeSDKProvider {
                     maxTurns: 50,
                     betas: ["context-1m-2025-08-07"],
                     ...(modelOverride ? { model: modelOverride } : {}),
+                    // v4.19.0 — per-workspace temperature override. Passed through to
+                    // the Agent SDK; providers that don't use it just drop it.
+                    ...(typeof options.temperature === "number" ? { temperature: options.temperature } : {}),
                     // Prefer Haiku as fallback on rate-limit/overload — cheap and
                     // fast, keeps the bot responsive when the primary tier is
                     // throttled. Omitted when the primary IS Haiku (SDK requires
@@ -377,6 +380,37 @@ export class ClaudeSDKProvider {
                     //      and knows to resend — without tripping the failover.
                     if (accumulatedText === "" && outputTok === 0) {
                         this.invalidateAvailabilityCache();
+                        // v4.19.2 — Diagnostic logging: when the Agent SDK returns an
+                        // empty stream, we need enough detail to tell apart the possible
+                        // causes (auth, quota, context overflow, model rejection, MCP
+                        // init failure). The message handler-level reset was fine for
+                        // stale-session recovery but gave us no signal on WHY it went
+                        // empty in the first place.
+                        try {
+                            const diag = {
+                                subtype: resultMsg.subtype,
+                                is_error: resultMsg.is_error,
+                                num_turns: resultMsg.num_turns,
+                                duration_ms: resultMsg.duration_ms,
+                                duration_api_ms: resultMsg.duration_api_ms,
+                                total_cost_usd: resultMsg.total_cost_usd,
+                                session_id: resultMsg.session_id,
+                                passed_session_id: options.sessionId ?? null,
+                                usage,
+                                modelOverride,
+                                cwd: options.workingDir,
+                                effort: options.effort,
+                                systemPromptLen: systemPrompt.length,
+                                promptLen: prompt.length,
+                                historyLen: options.history?.length ?? 0,
+                                allowedToolsCount: (options.allowedTools ?? defaultAllowed).length,
+                                hasMcp: Object.keys(mcpServers).length > 0,
+                            };
+                            console.warn(`[empty-stream] SDK returned 0 output tokens — diagnostic dump:`, JSON.stringify(diag));
+                        }
+                        catch (diagErr) {
+                            console.warn(`[empty-stream] SDK returned 0 output tokens (diagnostic serialisation failed: ${diagErr})`);
+                        }
                         const hint = "⚠️ Claude antwortete mit leerem Stream. " +
                             "Meist Folge einer stale SDK-Session nach /extra-usage, /login oder Token-Refresh. " +
                             "Ich starte die Session automatisch neu — bitte schick die Nachricht einfach nochmal.";

package/dist/providers/registry.js

@@ -109,8 +109,18 @@ export class ProviderRegistry {
      *    and asking the user to retry. The failover is only silent when
      *    the failing provider hadn't committed any visible text yet.
      */
-    async *queryWithFallback(options) {
-        const chain = [this.activeKey, ...this.fallbackKeys.filter(k => k !== this.activeKey)];
+    async *queryWithFallback(options, providerOverride) {
+        // v4.19.0 — Per-workspace provider override. If supplied AND registered,
+        // it becomes the primary for this query; fallbacks still apply so the
+        // bot can degrade gracefully if the override provider is unavailable.
+        const primary = providerOverride && this.providers.has(providerOverride)
+            ? providerOverride
+            : this.activeKey;
+        const chain = [primary, ...this.fallbackKeys.filter(k => k !== primary)];
+        // Also include activeKey as a last-resort fallback if override was used
+        if (providerOverride && !chain.includes(this.activeKey)) {
+            chain.push(this.activeKey);
+        }
         const errors = [];
         for (const key of chain) {
             const provider = this.providers.get(key);

package/dist/services/voice.js

@@ -55,7 +55,16 @@ export async function transcribeAudio(audioPath) {
     });
 }
 // ── Text-to-Speech (Edge TTS via node-edge-tts) ────────
-export async function textToSpeech(text) {
+/**
+ * Convert text to speech and return path to the MP3 file.
+ *
+ * @param text   The text to synthesize.
+ * @param voice  Optional voice ID / name override (v4.19.0 — per-workspace).
+ *               For ElevenLabs this is the Voice ID, for Edge TTS the Voice Name
+ *               (e.g. "de-DE-ConradNeural", "en-US-JennyNeural"). When undefined,
+ *               the config default is used.
+ */
+export async function textToSpeech(text, voice) {
     // Strip markdown formatting for cleaner TTS
     let cleanText = text
         .replace(/```[\s\S]*?```/g, " Code block skipped. ")
@@ -77,7 +86,9 @@ export async function textToSpeech(text) {
     if (config.ttsProvider === "elevenlabs" && config.elevenlabs.apiKey) {
         try {
             const { elevenLabsTTS } = await import("./elevenlabs.js");
-            return await elevenLabsTTS(cleanText);
+            // v4.19.0 — per-workspace voice override. When unset, elevenLabsTTS falls
+            // back to config.elevenlabs.voiceId.
+            return await elevenLabsTTS(cleanText, voice);
         }
         catch (err) {
             console.warn("ElevenLabs TTS failed, falling back to Edge TTS:", err instanceof Error ? err.message : err);
@@ -86,8 +97,9 @@ export async function textToSpeech(text) {
     // Edge TTS (default / fallback)
     const outputPath = path.join(TEMP_DIR, `tts_${Date.now()}.mp3`);
     const tts = new EdgeTTS({
-        voice: "de-DE-ConradNeural",
-        lang: "de-DE",
+        // v4.19.0 — allow workspace override; default German male.
+        voice: voice || "de-DE-ConradNeural",
+        lang: voice && voice.match(/^[a-z]{2}-[A-Z]{2}/) ? voice.slice(0, 5) : "de-DE",
         outputFormat: "audio-24khz-48kbitrate-mono-mp3",
     });
     await tts.ttsPromise(cleanText, outputPath);

package/dist/services/workspaces.js

@@ -32,6 +32,16 @@ import os from "os";
 import path from "path";
 import { WORKSPACES_DIR } from "../paths.js";
 import { config } from "../config.js";
+/** Map a toolset preset to the concrete allowedTools list. */
+export function toolsetToAllowedTools(toolset) {
+    if (!toolset || toolset === "full")
+        return undefined; // undefined = use provider default
+    if (toolset === "readonly")
+        return ["Read", "Glob", "Grep", "WebSearch", "WebFetch"];
+    if (toolset === "research")
+        return ["Read", "WebSearch", "WebFetch", "Grep"];
+    return undefined;
+}
 const registry = new Map();
 /** Expand ~ at the start of a path to the user's home directory. */
 function expandHome(p) {
@@ -100,6 +110,18 @@ function readWorkspaceFile(filePath, name) {
         const color = typeof fm.color === "string" ? fm.color : undefined;
         const emoji = typeof fm.emoji === "string" ? fm.emoji : undefined;
         const model = typeof fm.model === "string" && fm.model.trim() ? fm.model.trim() : undefined;
+        // v4.19.0 — per-workspace runtime overrides
+        const effortRaw = typeof fm.effort === "string" ? fm.effort.trim().toLowerCase() : "";
+        const effort = (effortRaw === "low" || effortRaw === "medium" || effortRaw === "high")
+            ? effortRaw : undefined;
+        const provider = typeof fm.provider === "string" && fm.provider.trim() ? fm.provider.trim() : undefined;
+        const voice = typeof fm.voice === "string" && fm.voice.trim() ? fm.voice.trim() : undefined;
+        const temperatureRaw = typeof fm.temperature === "string" ? parseFloat(fm.temperature) : (typeof fm.temperature === "number" ? fm.temperature : NaN);
+        const temperature = Number.isFinite(temperatureRaw) && temperatureRaw >= 0 && temperatureRaw <= 2
+            ? temperatureRaw : undefined;
+        const toolsetRaw = typeof fm.toolset === "string" ? fm.toolset.trim().toLowerCase() : "";
+        const toolset = (toolsetRaw === "full" || toolsetRaw === "readonly" || toolsetRaw === "research")
+            ? toolsetRaw : undefined;
         const channels = Array.isArray(fm.channels)
             ? fm.channels.filter((c) => typeof c === "string")
             : [];
@@ -111,6 +133,11 @@ function readWorkspaceFile(filePath, name) {
             emoji,
             channels,
             model,
+            effort,
+            provider,
+            voice,
+            temperature,
+            toolset,
             systemPromptOverride: body.trim(),
         };
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "alvin-bot",
-  "version": "4.18.5",
+  "version": "4.19.2",
   "description": "Alvin Bot \u2014 Your personal AI agent on Telegram, WhatsApp, Discord, Signal, and Web.",
   "type": "module",
   "main": "dist/index.js",