stackvox 0.2.0__tar.gz → 0.2.1__tar.gz

{stackvox-0.2.0/stackvox.egg-info → stackvox-0.2.1}/PKG-INFO

@@ -1,8 +1,8 @@
 Metadata-Version: 2.4
 Name: stackvox
-Version: 0.2.0
+Version: 0.2.1
 Summary: Offline TTS library using Kokoro-82M
-Author-email: "StackOne Technologies Ltd." <engineering@stackone.com>
+Author-email: "StackOne Technologies Ltd." <support@stackone.com>
 License-Expression: Apache-2.0
 Project-URL: Homepage, https://github.com/StackOneHQ/stackvox
 Project-URL: Repository, https://github.com/StackOneHQ/stackvox
@@ -42,19 +42,26 @@ Offline TTS using [Kokoro-82M](https://huggingface.co/hexgrad/Kokoro-82M) via [k
 
 ## Install
 
-Recommended — install globally with pipx so `stackvox` and `stackvox-say` end up on PATH:
+From PyPI — recommended for most users:
 
 ```bash
-pipx install git+https://github.com/StackOneHQ/stackvox.git
+pipx install stackvox    # global CLI (`stackvox` and `stackvox-say` on PATH)
+# or
+pip install stackvox     # use as a library
 ```
 
-Upgrade later with `pipx install --force git+https://github.com/StackOneHQ/stackvox.git` (pipx's `upgrade` doesn't always detect new commits on git installs).
+From git, if you want an unreleased commit:
+
+```bash
+pipx install git+https://github.com/StackOneHQ/stackvox.git
+# upgrade later with: pipx install --force git+https://github.com/StackOneHQ/stackvox.git
+```
 
 Dev install from a clone:
 
 ```bash
 python3 -m venv .venv && source .venv/bin/activate
-pip install -e .
+pip install -e ".[dev]"
 ```
 
 Model + voice files auto-download to `~/.cache/stackvox/` on first use. Override with `STACKVOX_CACHE_DIR`.
@@ -174,6 +181,16 @@ Before each utterance the daemon resets PortAudio so it picks up the current sys
 - macOS or Linux
 - `nc` (BSD netcat — default on macOS, `netcat-openbsd` on Linux) for the bash helper
 
+## Security considerations
+
+stackvox doesn't open any network port. The daemon binds a unix socket under `~/.cache/stackvox/` (default file-mode `0600`, i.e. user-only per the OS defaults for files in `$HOME`). Any process running as the same local user can send text to the daemon — there's no per-message authentication on the socket itself. That's the trust boundary: stackvox assumes anything running as your UID is allowed to speak on your behalf.
+
+If you're exposing stackvox through a different surface (HTTP server, shared system service, container), authentication and rate-limiting are your responsibility at that layer.
+
+Model weights (`kokoro-v1.0.onnx`, ~340 MB) and voices are downloaded from the [kokoro-onnx](https://github.com/thewh1teagle/kokoro-onnx) GitHub release assets on first use and cached under `~/.cache/stackvox/`. If you operate in a restricted environment, pre-seed that directory offline.
+
+Security issues themselves should not be filed as public GitHub issues — see [`SECURITY.md`](./SECURITY.md) for the disclosure process.
+
 ## License & attributions
 
 stackvox itself is licensed under the **Apache License, Version 2.0** — see [`LICENSE`](./LICENSE). Third-party attributions are collected in [`NOTICE`](./NOTICE); the summary below is informational.

{stackvox-0.2.0 → stackvox-0.2.1}/README.md

@@ -9,19 +9,26 @@ Offline TTS using [Kokoro-82M](https://huggingface.co/hexgrad/Kokoro-82M) via [k
 
 ## Install
 
-Recommended — install globally with pipx so `stackvox` and `stackvox-say` end up on PATH:
+From PyPI — recommended for most users:
 
 ```bash
-pipx install git+https://github.com/StackOneHQ/stackvox.git
+pipx install stackvox    # global CLI (`stackvox` and `stackvox-say` on PATH)
+# or
+pip install stackvox     # use as a library
 ```
 
-Upgrade later with `pipx install --force git+https://github.com/StackOneHQ/stackvox.git` (pipx's `upgrade` doesn't always detect new commits on git installs).
+From git, if you want an unreleased commit:
+
+```bash
+pipx install git+https://github.com/StackOneHQ/stackvox.git
+# upgrade later with: pipx install --force git+https://github.com/StackOneHQ/stackvox.git
+```
 
 Dev install from a clone:
 
 ```bash
 python3 -m venv .venv && source .venv/bin/activate
-pip install -e .
+pip install -e ".[dev]"
 ```
 
 Model + voice files auto-download to `~/.cache/stackvox/` on first use. Override with `STACKVOX_CACHE_DIR`.
@@ -141,6 +148,16 @@ Before each utterance the daemon resets PortAudio so it picks up the current sys
 - macOS or Linux
 - `nc` (BSD netcat — default on macOS, `netcat-openbsd` on Linux) for the bash helper
 
+## Security considerations
+
+stackvox doesn't open any network port. The daemon binds a unix socket under `~/.cache/stackvox/` (default file-mode `0600`, i.e. user-only per the OS defaults for files in `$HOME`). Any process running as the same local user can send text to the daemon — there's no per-message authentication on the socket itself. That's the trust boundary: stackvox assumes anything running as your UID is allowed to speak on your behalf.
+
+If you're exposing stackvox through a different surface (HTTP server, shared system service, container), authentication and rate-limiting are your responsibility at that layer.
+
+Model weights (`kokoro-v1.0.onnx`, ~340 MB) and voices are downloaded from the [kokoro-onnx](https://github.com/thewh1teagle/kokoro-onnx) GitHub release assets on first use and cached under `~/.cache/stackvox/`. If you operate in a restricted environment, pre-seed that directory offline.
+
+Security issues themselves should not be filed as public GitHub issues — see [`SECURITY.md`](./SECURITY.md) for the disclosure process.
+
 ## License & attributions
 
 stackvox itself is licensed under the **Apache License, Version 2.0** — see [`LICENSE`](./LICENSE). Third-party attributions are collected in [`NOTICE`](./NOTICE); the summary below is informational.

{stackvox-0.2.0 → stackvox-0.2.1}/pyproject.toml

@@ -4,13 +4,13 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "stackvox"
-version = "0.2.0"
+version = "0.2.1"
 description = "Offline TTS library using Kokoro-82M"
 readme = "README.md"
 requires-python = ">=3.10"
 license = "Apache-2.0"
 license-files = ["LICENSE", "NOTICE"]
-authors = [{ name = "StackOne Technologies Ltd.", email = "engineering@stackone.com" }]
+authors = [{ name = "StackOne Technologies Ltd.", email = "support@stackone.com" }]
 keywords = ["tts", "kokoro", "onnx", "offline", "speech"]
 classifiers = [
     "Operating System :: MacOS",

{stackvox-0.2.0 → stackvox-0.2.1/stackvox.egg-info}/PKG-INFO

@@ -1,8 +1,8 @@
 Metadata-Version: 2.4
 Name: stackvox
-Version: 0.2.0
+Version: 0.2.1
 Summary: Offline TTS library using Kokoro-82M
-Author-email: "StackOne Technologies Ltd." <engineering@stackone.com>
+Author-email: "StackOne Technologies Ltd." <support@stackone.com>
 License-Expression: Apache-2.0
 Project-URL: Homepage, https://github.com/StackOneHQ/stackvox
 Project-URL: Repository, https://github.com/StackOneHQ/stackvox
@@ -42,19 +42,26 @@ Offline TTS using [Kokoro-82M](https://huggingface.co/hexgrad/Kokoro-82M) via [k
 
 ## Install
 
-Recommended — install globally with pipx so `stackvox` and `stackvox-say` end up on PATH:
+From PyPI — recommended for most users:
 
 ```bash
-pipx install git+https://github.com/StackOneHQ/stackvox.git
+pipx install stackvox    # global CLI (`stackvox` and `stackvox-say` on PATH)
+# or
+pip install stackvox     # use as a library
 ```
 
-Upgrade later with `pipx install --force git+https://github.com/StackOneHQ/stackvox.git` (pipx's `upgrade` doesn't always detect new commits on git installs).
+From git, if you want an unreleased commit:
+
+```bash
+pipx install git+https://github.com/StackOneHQ/stackvox.git
+# upgrade later with: pipx install --force git+https://github.com/StackOneHQ/stackvox.git
+```
 
 Dev install from a clone:
 
 ```bash
 python3 -m venv .venv && source .venv/bin/activate
-pip install -e .
+pip install -e ".[dev]"
 ```
 
 Model + voice files auto-download to `~/.cache/stackvox/` on first use. Override with `STACKVOX_CACHE_DIR`.
@@ -174,6 +181,16 @@ Before each utterance the daemon resets PortAudio so it picks up the current sys
 - macOS or Linux
 - `nc` (BSD netcat — default on macOS, `netcat-openbsd` on Linux) for the bash helper
 
+## Security considerations
+
+stackvox doesn't open any network port. The daemon binds a unix socket under `~/.cache/stackvox/` (default file-mode `0600`, i.e. user-only per the OS defaults for files in `$HOME`). Any process running as the same local user can send text to the daemon — there's no per-message authentication on the socket itself. That's the trust boundary: stackvox assumes anything running as your UID is allowed to speak on your behalf.
+
+If you're exposing stackvox through a different surface (HTTP server, shared system service, container), authentication and rate-limiting are your responsibility at that layer.
+
+Model weights (`kokoro-v1.0.onnx`, ~340 MB) and voices are downloaded from the [kokoro-onnx](https://github.com/thewh1teagle/kokoro-onnx) GitHub release assets on first use and cached under `~/.cache/stackvox/`. If you operate in a restricted environment, pre-seed that directory offline.
+
+Security issues themselves should not be filed as public GitHub issues — see [`SECURITY.md`](./SECURITY.md) for the disclosure process.
+
 ## License & attributions
 
 stackvox itself is licensed under the **Apache License, Version 2.0** — see [`LICENSE`](./LICENSE). Third-party attributions are collected in [`NOTICE`](./NOTICE); the summary below is informational.