agentwire-dev 1.51.0__tar.gz → 1.53.0__tar.gz

{agentwire_dev-1.51.0 → agentwire_dev-1.53.0}/.github/workflows/security.yml

@@ -55,7 +55,7 @@ jobs:
       # asserts), and we fail only on high-severity high-confidence findings.
       # Green on the clean tree today; red only on NEW genuinely-dangerous code.
       - name: Run bandit
-        run: uvx bandit -c pyproject.toml -r agentwire --severity-level high --confidence-level high
+        run: uvx bandit==1.9.4 -c pyproject.toml -r agentwire --severity-level high --confidence-level high
 
   pip-audit:
     name: pip-audit (advisory)
@@ -87,7 +87,7 @@ jobs:
       # chatterbox-tts relax the ceiling. See docs/wiki/security/pip-audit.md.
       - name: Audit runtime dependencies
         run: >
-          uvx pip-audit -r requirements.txt
+          uvx pip-audit==2.10.1 -r requirements.txt
           --ignore-vuln PYSEC-2026-161
           --ignore-vuln CVE-2026-48818
           --ignore-vuln CVE-2026-48817
@@ -101,4 +101,4 @@ jobs:
         run: uv export --no-emit-project --all-extras --format requirements-txt -o requirements-all.txt
       - name: Full audit (weekly cron, optional extras)
         if: github.event_name == 'schedule'
-        run: uvx pip-audit -r requirements-all.txt
+        run: uvx pip-audit==2.10.1 -r requirements-all.txt

{agentwire_dev-1.51.0 → agentwire_dev-1.53.0}/.gitignore

@@ -60,3 +60,6 @@ snapshot_report.html
 
 # Node
 node_modules/
+
+# Private security-audit findings (never publish — see SECURITY.md)
+/security-audit/

{agentwire_dev-1.51.0 → agentwire_dev-1.53.0}/CONTRIBUTING.md

@@ -25,16 +25,21 @@ Add it automatically with `git commit -s` (use your real name and an email that
 git clone https://github.com/dotdevdotdev/agentwire-dev.git
 cd agentwire-dev
 
-# Install in development mode
-uv pip install -e .
+# Install dependencies into a project venv (creates .venv automatically)
+uv sync --extra dev
+
+# Run the test suite
+uv run pytest
 
 # Run in development mode (picks up code changes instantly)
-agentwire portal start --dev
+uv run agentwire portal start --dev
 
-# After structural changes (pyproject.toml, new files)
-agentwire rebuild
+# After changing pyproject.toml or adding files, re-sync
+uv sync --extra dev
 ```
 
+If you also have agentwire installed as a tool (`uv tool install agentwire-dev`) and want that install to pick up your source changes, run `agentwire rebuild` (reinstalls from your checkout).
+
 ### Development Workflow
 
 ```bash
@@ -108,20 +113,6 @@ from agentwire.utils import agentwire_dir, config_path, logs_dir
 base = agentwire_dir()  # ~/.agentwire/
 ```
 
-### Error Handling
-
-Use the structured error classes in `agentwire/errors.py`:
-
-```python
-from agentwire.errors import AgentWireError
-
-raise AgentWireError(
-    what="Session not found",
-    why="No tmux session exists with that name",
-    how="Create a new session with 'agentwire new -s name'"
-)
-```
-
 ### Configuration
 
 Use dataclasses for configuration (see `agentwire/config.py`):
@@ -164,7 +155,6 @@ agentwire/
 ├── *_cli.py         # Per-domain command groups, each with a register_<domain>_parser()
 ├── server.py        # WebSocket server
 ├── config.py        # Configuration dataclasses
-├── errors.py        # Structured error classes
 ├── validation.py    # Config validation
 ├── utils/           # Shared utilities
 │   ├── subprocess.py  # Command execution

{agentwire_dev-1.51.0 → agentwire_dev-1.53.0}/Dockerfile.local

@@ -33,8 +33,8 @@ WORKDIR /app
 
 # Install Python dependencies for HTTP server
 RUN pip install --no-cache-dir \
-    torch>=2.0.0 \
-    torchaudio>=2.0.0 \
+    "torch>=2.0.0" \
+    "torchaudio>=2.0.0" \
     fastapi \
     uvicorn[standard] \
     faster-whisper \

{agentwire_dev-1.51.0 → agentwire_dev-1.53.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentwire-dev
-Version: 1.51.0
+Version: 1.53.0
 Summary: Multi-session voice web interface for AI coding agents
 Project-URL: Homepage, https://agentwire.dev
 Project-URL: Repository, https://github.com/dotdevdotdev/agentwire-dev
@@ -227,18 +227,22 @@ Requires-Python: >=3.10
 Requires-Dist: aiohttp-jinja2>=1.6
 Requires-Dist: aiohttp>=3.13.4
 Requires-Dist: av>=12.0.0
+Requires-Dist: fastapi>=0.104.0
 Requires-Dist: jinja2>=3.1.0
 Requires-Dist: kokoro-onnx>=0.4.9; python_version < '3.14'
 Requires-Dist: markdown>=3.5
 Requires-Dist: mcp>=1.2.0
 Requires-Dist: pydantic>=2.0.0
 Requires-Dist: python-dotenv>=1.2.2
+Requires-Dist: python-multipart>=0.0.6
 Requires-Dist: pywebpush>=1.14.0
 Requires-Dist: pyyaml>=6.0
 Requires-Dist: qrcode>=7.4
 Requires-Dist: requests>=2.33.0
 Requires-Dist: resend>=2.0.0
+Requires-Dist: soundfile>=0.12.0; python_version < '3.14'
 Requires-Dist: useful-moonshine-onnx>=20250101; python_version < '3.14'
+Requires-Dist: uvicorn>=0.24.0
 Provides-Extra: dev
 Requires-Dist: pytest-asyncio>=0.23.0; extra == 'dev'
 Requires-Dist: pytest-cov>=4.1.0; extra == 'dev'
@@ -336,8 +340,8 @@ session to commanding many.
 ## Quick Start
 
 ```bash
-# Install
-pip install agentwire-dev
+# Install (isolated tool env — works on any Python, including Homebrew/Debian PEP 668 setups)
+uv tool install agentwire-dev
 
 # Setup (interactive)
 agentwire init
@@ -346,12 +350,13 @@ agentwire init
 agentwire portal start
 # Open http://127.0.0.1:8765 in Chrome — your cockpit is live (voice works immediately too)
 
-# New here? Start a guided helper session — it walks you through setup,
-# wires up your projects, explains the system, and helps you file issues or fork.
-agentwire dev
+# Start your first agent session
+agentwire new -s hello -p ~/projects/hello
 ```
 
-**Requirements:** Python 3.10+, tmux, ffmpeg, Claude Code
+> **Optional:** clone this repo (`git clone https://github.com/dotdevdotdev/agentwire-dev ~/projects/agentwire-dev`) and `agentwire dev` opens a guided helper session inside it — setup walkthrough, project wiring, issue filing, forking. It requires the source checkout; everything above works without one.
+
+**Requirements:** Python 3.10+, tmux, Claude Code. Optional: ffmpeg (only for host-mic push-to-talk capture and voice cloning — browser voice input works without it).
 
 **Honest setup time:** under a minute to a working voice portal with a genuinely good voice — Kokoro-82M runs on CPU out of the box (one-time ~200 MB model download in the background; the browser voice covers the wait). ~15 minutes for the full experience: cloned voices via a self-hosted TTS shim, Whisper-grade transcription, phone-from-anywhere (certs + token).
 
@@ -377,17 +382,21 @@ Origin checks reject cross-site browser requests on every bind. Keep the portal
 
 **macOS:**
 ```bash
-brew install tmux ffmpeg
-pip install agentwire-dev
+brew install tmux uv        # ffmpeg optional: only for host-mic PTT + voice cloning
+uv tool install agentwire-dev
 ```
 
+> Bare `pip install agentwire-dev` fails on Homebrew Python 3.12+ with `error: externally-managed-environment` (PEP 668). `uv tool install` (or `pipx install agentwire-dev`) sidesteps that by installing into its own isolated environment.
+
 **Ubuntu/Debian:**
 ```bash
-sudo apt install tmux ffmpeg python3-pip python3-venv
-python3 -m venv ~/.agentwire-venv && source ~/.agentwire-venv/bin/activate
-pip install agentwire-dev
+sudo apt install tmux       # ffmpeg optional: only for host-mic PTT + voice cloning
+curl -LsSf https://astral.sh/uv/install.sh | sh
+uv tool install agentwire-dev
 ```
 
+`pipx install agentwire-dev` works everywhere too. Prefer plain pip? Use a venv: `python3 -m venv ~/.agentwire-venv && source ~/.agentwire-venv/bin/activate && pip install agentwire-dev`.
+
 **WSL2:** Same as Ubuntu. Audio is limited; use as remote worker with portal on Windows host.
 
 </details>

{agentwire_dev-1.51.0 → agentwire_dev-1.53.0}/README.md

@@ -73,8 +73,8 @@ session to commanding many.
 ## Quick Start
 
 ```bash
-# Install
-pip install agentwire-dev
+# Install (isolated tool env — works on any Python, including Homebrew/Debian PEP 668 setups)
+uv tool install agentwire-dev
 
 # Setup (interactive)
 agentwire init
@@ -83,12 +83,13 @@ agentwire init
 agentwire portal start
 # Open http://127.0.0.1:8765 in Chrome — your cockpit is live (voice works immediately too)
 
-# New here? Start a guided helper session — it walks you through setup,
-# wires up your projects, explains the system, and helps you file issues or fork.
-agentwire dev
+# Start your first agent session
+agentwire new -s hello -p ~/projects/hello
 ```
 
-**Requirements:** Python 3.10+, tmux, ffmpeg, Claude Code
+> **Optional:** clone this repo (`git clone https://github.com/dotdevdotdev/agentwire-dev ~/projects/agentwire-dev`) and `agentwire dev` opens a guided helper session inside it — setup walkthrough, project wiring, issue filing, forking. It requires the source checkout; everything above works without one.
+
+**Requirements:** Python 3.10+, tmux, Claude Code. Optional: ffmpeg (only for host-mic push-to-talk capture and voice cloning — browser voice input works without it).
 
 **Honest setup time:** under a minute to a working voice portal with a genuinely good voice — Kokoro-82M runs on CPU out of the box (one-time ~200 MB model download in the background; the browser voice covers the wait). ~15 minutes for the full experience: cloned voices via a self-hosted TTS shim, Whisper-grade transcription, phone-from-anywhere (certs + token).
 
@@ -114,17 +115,21 @@ Origin checks reject cross-site browser requests on every bind. Keep the portal
 
 **macOS:**
 ```bash
-brew install tmux ffmpeg
-pip install agentwire-dev
+brew install tmux uv        # ffmpeg optional: only for host-mic PTT + voice cloning
+uv tool install agentwire-dev
 ```
 
+> Bare `pip install agentwire-dev` fails on Homebrew Python 3.12+ with `error: externally-managed-environment` (PEP 668). `uv tool install` (or `pipx install agentwire-dev`) sidesteps that by installing into its own isolated environment.
+
 **Ubuntu/Debian:**
 ```bash
-sudo apt install tmux ffmpeg python3-pip python3-venv
-python3 -m venv ~/.agentwire-venv && source ~/.agentwire-venv/bin/activate
-pip install agentwire-dev
+sudo apt install tmux       # ffmpeg optional: only for host-mic PTT + voice cloning
+curl -LsSf https://astral.sh/uv/install.sh | sh
+uv tool install agentwire-dev
 ```
 
+`pipx install agentwire-dev` works everywhere too. Prefer plain pip? Use a venv: `python3 -m venv ~/.agentwire-venv && source ~/.agentwire-venv/bin/activate && pip install agentwire-dev`.
+
 **WSL2:** Same as Ubuntu. Audio is limited; use as remote worker with portal on Windows host.
 
 </details>

{agentwire_dev-1.51.0 → agentwire_dev-1.53.0}/agentwire/__init__.py

@@ -1,3 +1,3 @@
 """AgentWire - Multi-session voice web interface for AI coding agents."""
 
-__version__ = "1.51.0"
+__version__ = "1.53.0"

{agentwire_dev-1.51.0 → agentwire_dev-1.53.0}/agentwire/__main__.py

@@ -187,7 +187,7 @@ Command Categories:
     #   - msg:    polite agent-to-agent inbox (rides the watchdog)
     from . import diff_cli, limits_cli, msg_cli, pane_cli, prompts_cli, send_cli  # noqa: I001  # session_cli kept on its own line below to minimize Phase 1 #495 merge conflicts
     from . import session_cli
-    from . import channels_cli, portal_cli, tts_cli
+    from . import channels_cli, config_cli, portal_cli, tts_cli
     from . import scheduler_cli, ensure_cli
     from . import doctor_cli, history_cli, machine_cli, safety_cli
     from . import handoff_cli, hooks_cli, mcp_cli, roles_cli, tunnels_cli
@@ -222,6 +222,7 @@ Command Categories:
         system_cli.register_system_parser,
         push_cli.register_push_parser,
         repo_cli.register_repo_parser,
+        config_cli.register_config_parser,
     ]
     for _reg in _REGISTRARS:
         _reg(subparsers)
@@ -353,6 +354,7 @@ _GROUP_COMMANDS = [
     "portal", "tts", "stt", "tunnels", "machine", "history", "handoff",
     "wiki", "hooks", "projects", "safety", "network", "listen",
     "voiceclone", "roles", "task", "lock", "scheduler", "council", "limits",
+    "config",
 ]
 
 

{agentwire_dev-1.51.0 → agentwire_dev-1.53.0}/agentwire/agents/tmux.py

@@ -236,11 +236,11 @@ class TmuxAgent(AgentBackend):
                 # Use base64 + load-buffer on remote to avoid PTY flooding
                 import base64
                 encoded = base64.b64encode(text.encode()).decode()
+                # Pipe straight into the tmux buffer — no on-disk temp that could
+                # expose message content or be pre-planted on the remote host
                 cmd = (
-                    f"echo {shlex.quote(encoded)} | base64 -d > /tmp/aw-send-$$.txt && "
-                    f"tmux load-buffer /tmp/aw-send-$$.txt && "
+                    f"echo {shlex.quote(encoded)} | base64 -d | tmux load-buffer - && "
                     f"tmux paste-buffer -t {shlex.quote(session_name)} && "
-                    f"rm -f /tmp/aw-send-$$.txt && "
                     f"sleep 0.2 && "
                     f"tmux send-keys -t {shlex.quote(session_name)} Enter"
                 )

{agentwire_dev-1.51.0 → agentwire_dev-1.53.0}/agentwire/channels_cli.py

@@ -288,7 +288,10 @@ def cmd_say(args) -> int:
     display = getattr(args, 'display', None)
     # Capture whether the toast actually reached the portal, so the caller can
     # report it honestly rather than claiming "shown" when the portal is down.
-    toast_ok = _post_desktop_notification(display, session=session, priority="high") if display else None
+    # Briefing cards are info, not action items: normal priority, but a longer
+    # fade than the 8s default since the card carries more than the spoken line.
+    toast_ok = _post_desktop_notification(display, session=session, priority="normal",
+                                          timeout=30) if display else None
 
     def _say_result(rc: int, sink: str, clients: int = 0) -> int:
         """Report which sink actually received the audio (#444): browser

{agentwire_dev-1.51.0 → agentwire_dev-1.53.0}/agentwire/completion.py

@@ -170,49 +170,6 @@ def write_task_context(
     return context_file
 
 
-def read_task_context(session: str) -> dict | None:
-    """Read task context file.
-
-    Args:
-        session: tmux session name
-
-    Returns:
-        Context dict or None if not found
-    """
-    context_file = TASKS_DIR / f"{session}.json"
-    if not context_file.exists():
-        return None
-
-    try:
-        return json.loads(context_file.read_text())
-    except (json.JSONDecodeError, OSError):
-        return None
-
-
-def update_task_context(session: str, **updates) -> bool:
-    """Update fields in task context file.
-
-    Args:
-        session: tmux session name
-        **updates: Fields to update
-
-    Returns:
-        True if updated successfully
-    """
-    context = read_task_context(session)
-    if context is None:
-        return False
-
-    context.update(updates)
-    context_file = TASKS_DIR / f"{session}.json"
-
-    try:
-        context_file.write_text(json.dumps(context, indent=2))
-        return True
-    except OSError:
-        return False
-
-
 def clear_task_context(session: str) -> None:
     """Remove task context and completion signal files.
 
@@ -332,145 +289,6 @@ def get_summary_prompt(summary_file: str) -> str:
     return SYSTEM_SUMMARY_PROMPT.format(summary_file=summary_file)
 
 
-def is_session_idle(session: str, idle_threshold: float = 3.0) -> bool:
-    """Check if a session is currently idle.
-
-    Uses the portal's cached status if available, otherwise checks tmux activity.
-
-    Args:
-        session: Session name
-        idle_threshold: Seconds of inactivity to consider idle
-
-    Returns:
-        True if session is idle, False otherwise
-    """
-    # Try to get activity time from tmux
-    # Note: display-message and capture-pane don't support = prefix for exact match
-    try:
-        result = subprocess.run(
-            ["tmux", "display-message", "-p", "-t", session, "#{pane_last_activity}"],
-            capture_output=True,
-            text=True,
-            timeout=5,
-        )
-        if result.returncode == 0 and result.stdout.strip():
-            last_activity = int(result.stdout.strip())
-            current_time = int(time.time())
-            idle_seconds = current_time - last_activity
-            return idle_seconds >= idle_threshold
-    except (subprocess.TimeoutExpired, ValueError, subprocess.SubprocessError):
-        pass
-
-    # Fallback: check if output is changing
-    # This is less reliable but works as a backup
-    return False
-
-
-def wait_for_idle(
-    session: str,
-    timeout: float = 300.0,
-    idle_threshold: float = 3.0,
-    poll_interval: float = 2.0,
-    stable_count: int = 3,
-) -> bool:
-    """Wait for a session to become idle.
-
-    "Idle" means the session has not produced output for idle_threshold seconds
-    for stable_count consecutive checks.
-
-    Args:
-        session: Session name
-        timeout: Maximum seconds to wait
-        idle_threshold: Seconds of inactivity to consider idle
-        poll_interval: Seconds between checks
-        stable_count: Number of consecutive idle checks required
-
-    Returns:
-        True if session became idle, False if timeout
-
-    Raises:
-        CompletionTimeout: If timeout is exceeded
-    """
-    start_time = time.time()
-    consecutive_idle = 0
-    last_output_hash = None
-
-    while True:
-        elapsed = time.time() - start_time
-        if elapsed >= timeout:
-            raise CompletionTimeout(
-                f"Timeout waiting for session '{session}' to become idle "
-                f"after {timeout:.0f}s"
-            )
-
-        # Check if session is still running
-        result = subprocess.run(
-            ["tmux", "has-session", "-t", f"={session}"],
-            capture_output=True,
-        )
-        if result.returncode != 0:
-            raise CompletionError(f"Session '{session}' no longer exists")
-
-        # Get current output snapshot
-        # Note: capture-pane doesn't support = prefix for exact match
-        result = subprocess.run(
-            ["tmux", "capture-pane", "-t", session, "-p", "-S", "-20"],
-            capture_output=True,
-            text=True,
-            timeout=5,
-        )
-        if result.returncode != 0:
-            time.sleep(poll_interval)
-            continue
-
-        current_hash = hash(result.stdout)
-
-        if current_hash == last_output_hash:
-            consecutive_idle += 1
-            if consecutive_idle >= stable_count:
-                return True
-        else:
-            consecutive_idle = 0
-            last_output_hash = current_hash
-
-        time.sleep(poll_interval)
-
-
-def wait_for_file(
-    path: Path,
-    timeout: float = 60.0,
-    poll_interval: float = 1.0,
-) -> bool:
-    """Wait for a file to be created.
-
-    Args:
-        path: Path to the file
-        timeout: Maximum seconds to wait
-        poll_interval: Seconds between checks
-
-    Returns:
-        True if file was created
-
-    Raises:
-        CompletionTimeout: If timeout is exceeded
-    """
-    start_time = time.time()
-
-    while True:
-        if path.exists() and path.stat().st_size > 0:
-            # Give a moment for the file to be fully written
-            time.sleep(0.5)
-            return True
-
-        elapsed = time.time() - start_time
-        if elapsed >= timeout:
-            raise CompletionTimeout(
-                f"Timeout waiting for file '{path}' after {timeout:.0f}s"
-            )
-
-        time.sleep(poll_interval)
-
-
 def parse_summary_file(path: Path) -> SummaryResult:
     """Parse a task summary file.
 
@@ -596,53 +414,3 @@ def status_to_exit_code(status: str) -> int:
         return 7
     else:
         return 2
-
-
-# =============================================================================
-# Loop mode helpers
-# =============================================================================
-
-# Directory for iteration review files (relative to project root)
-ITERATIONS_DIR = ".agentwire/iterations"
-
-
-def generate_iteration_filename(session: str, iteration: int) -> str:
-    """Generate a filename for an iteration review file.
-
-    Args:
-        session: tmux session name
-        iteration: Current iteration number (1-based)
-
-    Returns:
-        Relative path like .agentwire/iterations/mysession-iter-1.md
-    """
-    return f"{ITERATIONS_DIR}/{session}-iter-{iteration}.md"
-
-
-# Prompt sent between loop iterations to get a review
-ITERATION_REVIEW_PROMPT = """Review your progress so far. Write a brief status report to {iter_file}:
-
-# Iteration {iteration} Review
-
-## Status
-complete | incomplete
-
-## What Was Done
-[Brief description of work in this iteration]
-
-## Remaining Work
-[What still needs to be done, or "none" if complete]
-
-Use "complete" if the task is fully done. Use "incomplete" if more work is needed.
-Write the file now."""
-
-
-# Prompt sent to continue the loop with context
-ITERATION_CONTINUE_PROMPT = """Continue working on the task. This is iteration {iteration} of {max_iterations}.
-
-Previous iteration reviews are in {iterations_dir}/ — read them for context on what's been done.
-
-Original task:
-{original_prompt}
-
-Continue where you left off. Focus on remaining work identified in previous reviews."""

{agentwire_dev-1.51.0 → agentwire_dev-1.53.0}/agentwire/config.py

@@ -74,6 +74,12 @@ class ServerConfig:
     # bearer token then transits in cleartext. Required to start a non-loopback
     # bind without TLS — the BYO-tunnel case where the tunnel terminates TLS.
     allow_insecure: bool = False
+    # Emit HTTP Strict-Transport-Security. Leave OFF for self-signed /
+    # localhost / LAN — HSTS + a self-signed cert locks the browser out of the
+    # portal if the cert ever rotates. Enable ONLY when serving a real
+    # (CA-signed) cert directly. Behind Cloudflare Tunnel / a reverse proxy,
+    # set HSTS at the edge instead.
+    hsts: bool = False
 
 
 @dataclass
@@ -590,6 +596,7 @@ def _dict_to_config(data: dict) -> Config:
         # "" (explicit disable) must survive — don't collapse it to None.
         auth_token=server_data.get("auth_token"),
         allow_insecure=bool(server_data.get("allow_insecure", False)),
+        hsts=bool(server_data.get("hsts", False)),
     )
 
     # Projects