vocalize-cli 0.10.2__tar.gz → 0.12.0__tar.gz

{vocalize_cli-0.10.2 → vocalize_cli-0.12.0}/CHANGELOG.md

@@ -3,6 +3,204 @@
 All notable changes to this project are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## Unreleased
+
+Nothing yet.
+
+## 0.12.0 - 2026-09-07
+
+### Changed
+
+- **The default chain is now `kokoro`, then `say`.** A config with no
+  `chain` used to try ElevenLabs first; it now tries the on-device voice
+  first and falls back to macOS `say`. When `say` speaks because the Kokoro
+  model was never installed, the fallback line says so once and names the
+  fix: `vocalize local install`. Users who never set a chain hear `say`
+  after upgrading until they run that install; anyone with an explicit
+  `chain` sees no change. `vocalize usage`, `vocalize status` and the portal
+  now list the local providers first.
+- **Dictation decodes with beam search.** whisper.cpp ran with its greedy
+  decoder, which merged words on fast speech ("toget" for "to get",
+  [#4](https://github.com/matthager12-collab/vocalize/issues/4)). The worker
+  now uses beam search with five beams, whisper.cpp's own default for that
+  strategy. `[stt] beam_size` (1–8) is the escape hatch: `1` restores the
+  greedy decoder if a take is slow to land on your machine. Honest result:
+  on the owner's own voice both decoders still produced "themerge" for
+  "the merge", so beam search improves decoding but does not close #4;
+  that issue stays open. The cost was measured on a 43 s synthetic clip
+  and recorded in `docs/plans/2026-09-app-roadmap/spike-notes.md`.
+
+- **The default dictation model is now `large-v3-turbo-q5_0`.** On the
+  owner's own voice it was the first model to keep "the merge" as two
+  words ([#4](https://github.com/matthager12-collab/vocalize/issues/4));
+  beam search alone did not. It is no slower than `small.en` on an M4 and
+  uses about 90 MB more. **Upgrade note:** if your `[stt]` table sets no
+  `model`, dictation looks for the new default — run
+  `vocalize local install --stt` once (547 MB), or set
+  `model = "small.en"` to keep the lighter model.
+- **`[stt] cleanup` names where the cleanup pass runs.** It was `true` or
+  `false`; it is now `off`, `claude-cli`, `anthropic` or `local` (`local`
+  is accepted today and honoured from 0.14.0). Older `true` / `false`
+  values keep working. The pass lives in a new `vocalize/llm.py`, one seam
+  for every language-model call, and the default prompt now also drops
+  restatements, false starts and filler
+  ([#3](https://github.com/matthager12-collab/vocalize/issues/3)); say
+  "verbatim" as the first word of a take, pass `--verbatim`, or set
+  `[stt] verbatim = true` to keep every word.
+- **Every cloud send is visible.** One stderr line, `vocalize: sent to
+  <backend>`, prints immediately before text leaves the machine and never
+  otherwise; the clipboard notification for a cleaned take says "cleaned
+  up by Claude — sent off this Mac".
+- **`claude -p` sessions are tighter.** The cleanup pass and the plan-
+  speaking hook now pass `--strict-mcp-config`, run from the system
+  temporary directory, and the cleanup pass excludes your own hooks,
+  skills and `CLAUDE.md` (`--setting-sources ""`) and strips any stored
+  Anthropic key from the child's environment.
+- **Provider settings are type-checked** (issue
+  [#5](https://github.com/matthager12-collab/vocalize/issues/5)): a
+  `voice`, `model`, `engine`, `language`, `region` or `profile` that is not
+  a short printable string is refused with a message naming the file and
+  the key, in the CLI and the portal alike.
+- **Sentences no longer run together with the turbo models.** Their
+  segments arrive without a leading space and the worker joined them with
+  nothing ("working.I want"); segments are now joined with one space.
+
+### Fixed
+
+- **A stored key is readable from every Python on the Mac.** macOS pins a
+  keychain item to the binary that created it, so a key stored from the
+  terminal could be invisible, or behind an "Allow" dialog, when Claude
+  Code's shell or an upgraded vocalize asked for it. Keys are now written
+  and read through Apple's own `security` tool (secret on stdin, never on a
+  command line), which is the same accessing application whatever spawned
+  it; the item also records the date the key was last validated, shown by
+  `vocalize auth status`. An older item is replaced in place on the next
+  `vocalize auth login`.
+
+### Added
+
+- **An Anthropic key slot, and a Keys tab that can test and remove.**
+  `vocalize auth login --provider anthropic` stores the key the `anthropic`
+  cleanup backend uses, under its own keychain item; `auth status`,
+  `auth logout` and `vocalize usage` know the slot too. It is a key, not a
+  voice: the chain does not accept it. On the portal's Keys tab every slot
+  (the three voice providers and Anthropic) gets **Test without storing**,
+  which checks a key and keeps nothing, and **Remove stored key**, which
+  reads the keychain back before it says the key is gone; each card shows
+  when its key was last checked. The key field is `autocomplete=
+  "new-password"`, the value Safari and Chrome honour on a password field.
+  The Local tab gained a select for the cleanup backend.
+
+- **An Anthropic API backend for the cleanup pass** (`[stt] cleanup =
+  "anthropic"`): one Messages API call with a key from `ANTHROPIC_API_KEY`
+  or the keychain slot `anthropic-api-key`, under a monthly character
+  budget (`[providers.anthropic] monthly_chars`, 2,000,000 when unset)
+  counted in the usage ledger. The key is stored from the CLI or the
+  portal's Keys tab, as described above.
+- **A `[notes]` config table** (`folder`, `template`, `summarizer`,
+  `keep_audio`, `model`) is parsed, validated and preserved by every writer
+  of the config file. `vocalize notes` itself arrives in 0.14.0.
+- **`large-v3-turbo-q8_0`** joins the dictation models: the same turbo model
+  as `q5_0` with 8-bit weights (834 MB on disk), for machines with 16 GB or
+  more. `vocalize local install --stt --model large-v3-turbo-q8_0`. Pinned
+  from a completed download like the other three.
+
+## 0.11.0 - 2026-09-05
+
+### Added
+
+- **A web portal page** (`vocalize portal`) for the whole config surface: reorder
+  the provider chain; set each provider's voice, speed and monthly budget with a
+  live preview; store and check API keys (masked, `autocomplete="off"`); watch
+  usage; and drive the local Kokoro and whisper installs with progress — no more
+  hand-editing `config.toml`. Five tabs (Chain, Providers, Keys, Usage, Local)
+  plus a persistent readiness sidebar reading `/api/state`, with buttons on the
+  rows that map to a vocalize command the portal already runs. Every save goes
+  through the same compare-and-swap the CLI uses, so a change made elsewhere
+  while the page was open is refused rather than silently overwritten. Ships as
+  static HTML and JS with no framework, no inline script and no external
+  resource — the whole surface has to work with the network cable pulled — over
+  a loopback-only, one-time-code session (DEC-004).
+- **A voice picker on the Providers tab.** `GET /api/voices/<name>` returns the
+  provider's own `list_voices()`, paginated and cached for the life of the
+  portal process, so the field is a real dropdown of the account's actual
+  voices with the current value pre-selected, and `"Type a voice id…"` for an
+  id the list doesn't carry — rather than a hand-typed guess.
+
+### Fixed
+
+- **`vocalize voices` and `vocalize usage` printed the ElevenLabs API key to
+  stderr when the API quoted it back.** The SDK's `ApiError` renders the whole
+  response body and header dict, and both commands printed that text verbatim —
+  so a key the API named in an error reached terminal scrollback, any session
+  log, and whatever the user pasted into a bug report. `auth.scrub` already
+  existed for exactly this, but three callers never reached it. The scrub now
+  happens inside `tts` itself, below every caller, against the key the client
+  was built with. Found by the 0.11.0 release review (DEC-021).
+- **The portal's `say` voice list failed on the first ask.** The route gave every
+  provider the two-second budget meant for network probes, and enumerating the
+  system voices takes longer than that on a current Mac — so the one provider
+  needing no key, no account and no network was the one that said "couldn't
+  fetch the list". Offline lists get their own budget now.
+- **A key of four characters or fewer was shown in full** by `vocalize auth
+  status` and on the portal's Keys tab — a truncated paste, or another tool's
+  short secret in the same environment variable, reproduced whole in output the
+  design treats as safe to screenshot. Anything under eight characters now masks
+  to `…` alone.
+- **The portal's Keys tab pointed at Keychain Access** to remove a stored key.
+  It now names `vocalize auth logout --provider <name>`, which reads the entry
+  back and refuses to claim a removal it cannot verify.
+- **The ElevenLabs SDK client followed a redirect and re-sent the API key
+  wherever it pointed, cross-origin, over plain http.** The SDK's httpx client
+  follows a 3xx by default; every ElevenLabs endpoint is a fixed URL, so a
+  redirect was never legitimate and the key had no business leaving the
+  original origin. Present since 0.9.0, when the ElevenLabs provider first
+  shipped. Closed by building the client with `follow_redirects=False` — the
+  same rule the urllib-based providers already held via `_http._NoRedirects` —
+  and proven on two real loopback HTTP servers: the second origin never sees
+  the request.
+- **Nothing could rewrite a config file containing an `[stt]` table** —
+  which is every config a dictation user has had since 0.10.0 added the
+  table. The serialiser wrote flat keys and `[providers.*]` and had no
+  case for any other table, so `stt` reached the scalar renderer as a
+  `dict` and raised: "The config file has a table under 'stt'. The wizard
+  only manages flat keys, so it will not rewrite this file — edit that
+  file by hand." That refusal came out of `vocalize wizard` before it
+  asked its first question, and out of `vocalize chain google say` instead
+  of a write. The only way out was to delete the `[stt]` table, run the
+  command, and put it back. `[stt]` is now rendered as its own table, so
+  both commands rewrite the file and leave the dictation settings alone.
+  The rewritten file puts `[stt]` ahead of `[providers.*]` whatever order
+  they were in before — identical TOML, a one-off cosmetic diff.
+- **Two writers saving at the same moment could lose one of the two
+  changes.** The config write compared the file against the fingerprint it
+  had read and then renamed a temp file over it, with the two steps not
+  held together, so two saves that overlapped could both see an unchanged
+  file, both write, and both report success while only the second survived.
+  The compare and the rename now happen under one lock. Two `vocalize`
+  *processes* saving in the same instant can still race — the fingerprint
+  check narrows that to a window of microseconds, and closing it entirely
+  needs a lock file, which is deliberately not what this is.
+- **A config save rendered through a fixed `config.toml.tmp`**, so two
+  writers at once could render through the same temp file and leave one of
+  them writing a file the other had already renamed away — reported as
+  "Could not write config file", or worse, reported as success for bytes
+  that were not in the file. Each writer now gets its own temp file, made
+  with `mkstemp` in the same directory, still `0600`, and still renamed
+  into place atomically. The predictable name a local process could
+  pre-plant as a symlink is gone with it.
+
+### Known limitation
+
+- **Any other process on the Mac can close the portal with five wrong or
+  missing-origin requests to `/api/session`**, no code and no token needed —
+  the same guard that stops a cross-origin web page from doing it has no way
+  to tell that traffic apart from a local script's. This is availability
+  only: nothing is read or changed, the portal just exits. Rerun
+  `vocalize portal` and carry on. Accepted rather than fixed, since anything
+  able to send that traffic locally could kill the process outright anyway
+  (DEC-018).
+
 ## 0.10.2 - 2026-09-02
 
 ### Added

vocalize_cli-0.10.2/README.md → vocalize_cli-0.12.0/PKG-INFO

@@ -1,11 +1,48 @@
+Metadata-Version: 2.5
+Name: vocalize-cli
+Version: 0.12.0
+Summary: A local-first CLI that turns text, markdown, or piped stdin into speech: the on-device Kokoro voice by default, cloud voices optional, with markdown-table-aware preprocessing and Claude Code hooks.
+Project-URL: Homepage, https://github.com/matthager12-collab/vocalize
+Project-URL: Repository, https://github.com/matthager12-collab/vocalize
+Author: Mat
+License-Expression: MIT
+License-File: LICENSE
+Keywords: claude-code,cli,elevenlabs,kokoro,local,markdown,text-to-speech
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Multimedia :: Sound/Audio :: Speech
+Requires-Python: >=3.10
+Requires-Dist: click>=8.1
+Requires-Dist: elevenlabs>=2.0
+Requires-Dist: keyring>=25
+Requires-Dist: tomli>=2.0; python_version < '3.11'
+Provides-Extra: dev
+Requires-Dist: build; extra == 'dev'
+Requires-Dist: pytest-cov>=4.0; extra == 'dev'
+Requires-Dist: pytest>=7.0; extra == 'dev'
+Requires-Dist: ruff; extra == 'dev'
+Requires-Dist: twine; extra == 'dev'
+Provides-Extra: dotenv
+Requires-Dist: python-dotenv>=1.0; extra == 'dotenv'
+Provides-Extra: polly
+Requires-Dist: boto3>=1.34; extra == 'polly'
+Description-Content-Type: text/markdown
+
 # vocalize
 
 [![CI](https://github.com/matthager12-collab/vocalize/actions/workflows/ci.yml/badge.svg)](https://github.com/matthager12-collab/vocalize/actions/workflows/ci.yml)
 
 A command-line tool that turns text, markdown files, or piped stdin into
-natural-sounding speech using the [ElevenLabs](https://elevenlabs.io) API —
-plus a hook that wires it directly into [Claude Code](https://claude.com/claude-code),
-so Claude's responses get read aloud automatically in your terminal or IDE.
+natural-sounding speech on your own machine by default, with cloud voices as
+an option — plus a hook that wires it directly into
+[Claude Code](https://claude.com/claude-code), so Claude's responses get read
+aloud in your terminal or IDE.
 
 ## Quickstart
 
@@ -14,17 +51,19 @@ pipx install vocalize-cli
 ```
 
 ```bash
-vocalize config
+vocalize local install
 ```
 
-Walks you through your API key, a voice, and a speed, and saves it all.
+Downloads the on-device Kokoro voice once (about 350 MB; needs
+[`uv`](https://docs.astral.sh/uv/)). Skip it and `vocalize` speaks through
+macOS `say` until you come back to it — the fallback line tells you so.
 
 ```bash
 vocalize speak "hello"
 ```
 
-To set up just the key, skip the wizard and run `vocalize auth login` — it
-stores the key in your OS keychain.
+Prefer a cloud voice? See [Providers and fallback](#providers-and-fallback):
+`vocalize config` walks you through a key, a voice and a speed.
 
 ## Why this exists
 
@@ -62,33 +101,8 @@ cd vocalize
 pip install -e .
 ```
 
-Get a free ElevenLabs API key at
-[elevenlabs.io/app/settings/api-keys](https://elevenlabs.io/app/settings/api-keys)
-(free tier: 10,000 characters/month, API access included, no commercial
-license). Then, recommended, store it in your OS keychain:
-
-```bash
-vocalize auth login
-```
-
-This prompts for the key (input hidden), validates it against the
-ElevenLabs API, and stores it via your OS's own keychain (macOS Keychain,
-Windows Credential Locker, Linux Secret Service) — no plaintext file to
-manage. Piping it in from a secret manager works too:
-
-```bash
-op read op://vault/elevenlabs/key | vocalize auth login --stdin
-```
-
-An environment variable or `.env` file work as well, and take priority over
-the keychain if both are set:
-
-```bash
-export ELEVENLABS_API_KEY=your-key-here
-```
-
-or copy `.env.example` to `.env` and fill it in (requires the optional
-`python-dotenv` extra: `pip install -e ".[dotenv]"`).
+Cloud voices need an API key; storing one is covered under
+[Providers and fallback](#providers-and-fallback).
 
 ## Usage
 
@@ -180,6 +194,9 @@ Hotkeys: `↑`/`↓` or `k`/`j` move, `Enter` selects, `p` previews the
 highlighted voice, `m` types a value by hand, `q` or `Esc` cancels without
 writing anything.
 
+There's also a settings page in the browser — see
+[Settings portal](#settings-portal) below.
+
 | Setting | Flag | Env var | Config file key | Default |
 |---|---|---|---|---|
 | API key | `--api-key` | `ELEVENLABS_API_KEY` | not read from the config file | stored via `vocalize auth` |
@@ -203,7 +220,8 @@ back to `~/.config/vocalize/config.toml`. Flat keys, no sections:
 ```toml
 chain = ["elevenlabs", "google", "say"]
 
-# Flat keys = ElevenLabs, unchanged since before there was a chain.
+# Flat keys are the original cloud voice's settings, unchanged since
+# before there was a chain; see Providers and fallback.
 voice = "21m00Tcm4TlvDq8ikWAM"
 model = "eleven_flash_v2_5"
 speed = 0.95
@@ -259,6 +277,43 @@ configures a TTS provider — see
 [Dictation](#dictation-speech-to-text) below for every key and its
 allowlist.
 
+## Settings portal
+
+A page in your own browser for the whole config surface above, so you don't
+have to hand-edit `config.toml` or click through `vocalize config` one
+setting at a time.
+
+```bash
+vocalize portal              # opens your browser at a one-time link
+vocalize portal --no-browser # prints the link instead (headless, SSH)
+```
+
+Five tabs:
+
+- **Chain** — reorder providers, or add and remove one.
+- **Providers** — each provider's voice, model, speed, and monthly budget,
+  with a live preview of the voice you're looking at.
+- **Keys** — store, test or remove an API key for each provider and for
+  Anthropic (the dictation cleanup backend, not a voice); the field is
+  masked and never offers to autocomplete, a stored key is never shown
+  again, and each card says when the key was last checked.
+- **Usage** — this month's spend and quota per provider.
+- **Local** — install or update the on-device Kokoro and whisper models,
+  with progress.
+
+The opening link works once and for 60 seconds; after that, run the command
+again for a new one. The server only ever listens on `127.0.0.1`, and it
+closes itself on Ctrl-C or after fifteen minutes with nothing to do. Nothing
+you change on the page reaches disk until you press Save on that tab — and
+a save made against a config file that's changed on disk since the page
+loaded is refused rather than silently overwritten, the same protection
+`vocalize chain` and `vocalize config` already have.
+
+It assumes a single-user machine: everything that reads or changes your
+settings is behind that one-time token, but any other process on the Mac
+can still reach the port and close the portal under you. Nothing leaks if
+that happens — it's a shutdown, not a read — just run the command again.
+
 ## Providers and fallback
 
 vocalize tries providers in order — a **chain** — until one speaks. The
@@ -320,6 +375,41 @@ For the click-by-click setup of each provider — where to go, what to click,
 the one command that stores the credential, the one command that proves it
 works — see [docs/provider-credentials.md](docs/provider-credentials.md).
 
+### Storing a cloud API key
+
+For ElevenLabs, get a free API key at
+[elevenlabs.io/app/settings/api-keys](https://elevenlabs.io/app/settings/api-keys)
+(free tier: 10,000 characters/month, API access included, no commercial
+license). Then, recommended, store it in your OS keychain:
+
+```bash
+vocalize auth login
+```
+
+This prompts for the key (input hidden), validates it against the
+ElevenLabs API, and stores it via your OS's own keychain (macOS Keychain,
+Windows Credential Locker, Linux Secret Service) — no plaintext file to
+manage. On macOS the item is written and read through Apple's own
+`security` tool, so the same key is readable from every Python and app
+that runs vocalize — your terminal, Claude Code's shell, the portal —
+with no keychain dialog, and `vocalize auth status` shows the date it was
+last validated. Piping it in from a secret manager works too:
+
+```bash
+op read op://vault/elevenlabs/key | vocalize auth login --stdin
+```
+
+An environment variable or `.env` file work as well, and take priority over
+the keychain if both are set:
+
+```bash
+export ELEVENLABS_API_KEY=your-key-here
+```
+
+or copy `.env.example` to `.env` and fill it in (requires the optional
+`python-dotenv` extra: `pip install -e ".[dotenv]"`).
+
+
 ## Budgets and the usage ledger
 
 Cloud providers don't stop at their free tier — they bill past it. vocalize
@@ -383,7 +473,8 @@ Use it for one read with `--provider kokoro`, or add it to your chain in
 Long text streams: it's broken into ~400-character pieces, and playback
 starts after the first one is ready — roughly 20–25 seconds of speech —
 instead of waiting for the whole thing to render. Measured on this Mac
-(M3): about 5x faster than real time, peaking around 870 MB of RAM while
+(M3): about 5x faster than real time, peaking around 760 MB of RAM (measured
+on an M4 on 2026-09-07; the M3 spike saw 870 MB) while
 rendering. `vocalize stop`, run from any terminal, halts a Kokoro read
 mid-sentence the same as any other provider.
 
@@ -405,7 +496,7 @@ vocalize local install --stt
 A separate opt-in from Kokoro's `vocalize local install` — nothing here is
 downloaded or built until you run this. It:
 
-1. Downloads one whisper.cpp model (`small.en` by default, ~465 MB) from a
+1. Downloads one whisper.cpp model (`large-v3-turbo-q5_0` by default, ~547 MB) from a
    pinned Hugging Face revision, verified against a pinned sha256 before
    it's kept.
 2. Compiles and ad-hoc signs a small Swift recorder bundle, **Vocalize
@@ -479,10 +570,12 @@ overrides `[stt] max_seconds` for one invocation.
 
 ```toml
 [stt]
-model = "small.en"     # base.en | small.en | large-v3-turbo-q5_0
-language = "en"        # a whisper.cpp language code
+model = "large-v3-turbo-q5_0"  # base.en | small.en | large-v3-turbo-q5_0 | large-v3-turbo-q8_0
+language = "en"        # a whisper.cpp language code ("auto" to detect)
 input_device = ""      # "" = system default; else an exact name from --list-devices
-cleanup = false        # send the transcript (never audio) to Claude first
+cleanup = "off"        # off | local | claude-cli | anthropic — what tidies the transcript (never audio)
+verbatim = false       # true keeps every word even when cleanup is on
+beam_size = 5          # 1-8 whisper.cpp beams; 1 is the greedy decoder
 max_seconds = 120      # 1-600; the recorder self-stops here, dictate backstops it
 sounds = true          # the Tink/Pop/Glass feedback sounds
 cues = "sounds"        # "sounds" | "words" | "both" — speak "Start."/"Stopped."/"Ready." instead
@@ -490,10 +583,12 @@ cues = "sounds"        # "sounds" | "words" | "both" — speak "Start."/"Stopped
 
 | Key | Allowed values | Default |
 |---|---|---|
-| `model` | `base.en`, `small.en`, `large-v3-turbo-q5_0` | `small.en` |
+| `model` | `base.en`, `small.en`, `large-v3-turbo-q5_0`, `large-v3-turbo-q8_0` | `large-v3-turbo-q5_0` |
 | `language` | a whisper.cpp language code (`en`, `es`, `fr`, …); an `.en` model must stay `en` | `en` |
 | `input_device` | `""` (system default) or an exact name from `vocalize listen --list-devices`; ≤ 128 characters, printable, can't start with `-` | `""` |
-| `cleanup` | `true` / `false` | `false` |
+| `cleanup` | `off`, `local` (0.13), `claude-cli`, `anthropic`; an old `true`/`false` reads as `claude-cli`/`off` | `off` |
+| `verbatim` | `true` / `false` — keep every word even when cleanup is on | `false` |
+| `beam_size` | integer, 1–8 | `5` |
 | `paste` | reserved — not implemented in 0.10.0 | `false` |
 | `max_seconds` | integer, 1–600 | `120` |
 | `sounds` | `true` / `false` | `true` |
@@ -870,9 +965,11 @@ model.
   re-approve it in System Settings › Privacy & Security › Microphone. An
   install that doesn't change the source never re-signs, so this isn't
   every upgrade — only ones that touch the recorder.
-- **`small.en` mishears jargon.** The default model does fine on ordinary
-  speech but can mangle project-specific words (`pyproject`, a function
-  name) — pick `large-v3-turbo-q5_0` for better accuracy, or turn on
+- **The smaller models mishear jargon.** `large-v3-turbo-q5_0` is the
+  default because it was the first model to keep "the merge" as two words
+  on the owner's own voice; `small.en` (465 MB) is the lighter choice for a
+  slow Mac but can mangle project-specific words (`pyproject`, a function
+  name) — stay on the default for accuracy, or turn on
   `[stt] cleanup` so Claude fixes obvious transcription noise before it
   reaches your clipboard (it still can't guess a word it never heard
   correctly).