thaddeus 1.0.12 → 1.0.13

package/bin/thaddeus.js

@@ -59,10 +59,8 @@ env.THADDEUS_USE_XAI = 'true';
 env.THADDEUS_USE_PROXY = 'true';  // Route through Render backend (has xAI/ElevenLabs/Twilio keys)
 env.CLAUBBIT = '1';
 
-// Auth token — set via env var or .env file, fallback to provisioned default
-if (!env.THADDEUS_AUTH_TOKEN) {
-  env.THADDEUS_AUTH_TOKEN = 'thd_8afadf66c4da726e27628871f7c3c635c567d3bae7d6246ade13a3a452110605';
-}
+// Auth token — set via THADDEUS_AUTH_TOKEN env var, .env file, or ~/.thaddeus/auth.json
+// Do NOT hardcode tokens here — npm package is public
 
 // Remove conflicting auth from other installs
 delete env.ANTHROPIC_API_KEY;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thaddeus",
-  "version": "1.0.12",
+  "version": "1.0.13",
   "description": "Thaddeus — Oracle AI's Permanent Agent Terminal",
   "author": "Delphi Labs Inc.",
   "license": "PROPRIETARY",

package/src/services/elevenlabsTTS.ts

@@ -11,6 +11,7 @@ import { unlink, writeFile } from 'fs/promises'
 import { tmpdir } from 'os'
 import { join } from 'path'
 import { logError } from '../utils/log.js'
+import { getAuthToken, getBackendUrl } from './thaddeusAuth.js'
 
 // ─── Configuration ──────────────────────────────────────────────────
 
@@ -59,9 +60,10 @@ export function stop(): void {
 export async function speak(text: string): Promise<void> {
   if (!ttsEnabled) return
 
+  const useProxy = process.env.THADDEUS_USE_PROXY === 'true' || process.env.THADDEUS_USE_PROXY === '1'
   const apiKey = process.env.ELEVENLABS_API_KEY
-  if (!apiKey) {
-    logError(new Error('[elevenlabsTTS] ELEVENLABS_API_KEY not set'))
+  if (!apiKey && !useProxy) {
+    logError(new Error('[elevenlabsTTS] ELEVENLABS_API_KEY not set and proxy not enabled'))
     return
   }
 
@@ -113,10 +115,40 @@ export async function speak(text: string): Promise<void> {
 // ─── Internal: API call ─────────────────────────────────────────────
 
 async function fetchTTSAudio(
-  apiKey: string,
+  apiKey: string | undefined,
   text: string,
   signal: AbortSignal,
 ): Promise<ArrayBuffer | null> {
+  const useProxy = process.env.THADDEUS_USE_PROXY === 'true' || process.env.THADDEUS_USE_PROXY === '1'
+
+  // Route through Render proxy — backend holds the ElevenLabs key
+  if (useProxy) {
+    const authToken = getAuthToken()
+    const proxyUrl = `${getBackendUrl()}/api/thaddeus/tts`
+    const response = await fetch(proxyUrl, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        Accept: 'audio/mpeg',
+        ...(authToken ? { Authorization: `Bearer ${authToken}` } : {}),
+      },
+      body: JSON.stringify({
+        text,
+        voice_id: VOICE_ID,
+        model_id: MODEL_ID,
+      }),
+      signal,
+    })
+
+    if (!response.ok) {
+      const body = await response.text().catch(() => '<unreadable>')
+      logError(new Error(`[elevenlabsTTS] Proxy error ${response.status}: ${body.slice(0, 200)}`))
+      return null
+    }
+    return response.arrayBuffer()
+  }
+
+  // Direct ElevenLabs call (when user has own API key)
   const url = `${API_BASE}/${VOICE_ID}`
 
   const response = await fetch(url, {
@@ -124,7 +156,7 @@ async function fetchTTSAudio(
     headers: {
       Accept: 'audio/mpeg',
       'Content-Type': 'application/json',
-      'xi-api-key': apiKey,
+      'xi-api-key': apiKey!,
     },
     body: JSON.stringify({
       text,