voice-vibecoder 2.3.0__tar.gz → 2.4.0__tar.gz

{voice_vibecoder-2.3.0 → voice_vibecoder-2.4.0}/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 <!-- version list -->
 
+## v2.4.0 (2026-02-19)
+
+### Bug Fixes
+
+- **server**: Handle unexpected errors during authentication
+  ([`f0ac102`](https://github.com/snokam/voice-vibecoder/commit/f0ac1025cac939f8fc048c796d63668c1d687f9e))
+
+
 ## v2.3.0 (2026-02-19)
 
 

{voice_vibecoder-2.3.0 → voice_vibecoder-2.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: voice-vibecoder
-Version: 2.3.0
+Version: 2.4.0
 Summary: Olaf The Vibecoder — a voice-controlled coding assistant using OpenAI Realtime API + Claude Code
 Project-URL: Homepage, https://github.com/snokam/voice-vibecoder
 Project-URL: Repository, https://github.com/snokam/voice-vibecoder
@@ -23,7 +23,6 @@ Requires-Python: >=3.10
 Requires-Dist: claude-agent-sdk>=0.1.30
 Requires-Dist: numpy>=1.24
 Requires-Dist: platformdirs>=4.0
-Requires-Dist: pyjwt[crypto]>=2.8
 Requires-Dist: rich>=13.0
 Requires-Dist: sounddevice>=0.4
 Requires-Dist: textual>=0.50

{voice_vibecoder-2.3.0 → voice_vibecoder-2.4.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "voice-vibecoder"
-version = "2.3.0"
+version = "2.4.0"
 description = "Olaf The Vibecoder — a voice-controlled coding assistant using OpenAI Realtime API + Claude Code"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -31,7 +31,6 @@ dependencies = [
     "numpy>=1.24",
     "claude-agent-sdk>=0.1.30",
     "platformdirs>=4.0",
-    "PyJWT[crypto]>=2.8",
 ]
 
 [project.urls]

{voice_vibecoder-2.3.0 → voice_vibecoder-2.4.0}/src/voice_vibecoder/__init__.py

@@ -3,7 +3,7 @@
 A voice-controlled coding assistant using OpenAI Realtime API + Claude Code.
 """
 
-__version__ = "2.3.0"
+__version__ = "2.4.0"
 
 from voice_vibecoder.app_config import VoiceConfig
 from voice_vibecoder.ui.screen import VoiceCodingScreen

{voice_vibecoder-2.3.0 → voice_vibecoder-2.4.0}/src/voice_vibecoder/app_config.py

@@ -9,6 +9,7 @@ Embedders can override any directory to colocate everything (e.g. ~/.snokam/).
 
 from __future__ import annotations
 
+from collections.abc import Awaitable
 from dataclasses import dataclass, field
 from pathlib import Path
 from typing import Callable
@@ -65,3 +66,9 @@ class VoiceConfig:
     # Called before an agent task runs. Receives (mcp_servers: dict, user_jwt: str | None)
     # and can mutate mcp_servers in place (e.g. inject OBO tokens).
     pre_agent_hook: Callable[[dict, str | None], None] | None = None
+
+    # Async callback for WebSocket authentication.
+    # Receives the raw token string, returns (user_email, raw_token).
+    # Raises ValueError on validation failure.
+    # When None, auth is disabled (no auth frame expected from clients).
+    authenticate: Callable[[str], Awaitable[tuple[str, str]]] | None = None

{voice_vibecoder-2.3.0 → voice_vibecoder-2.4.0}/src/voice_vibecoder/cli_serve.py

@@ -61,7 +61,6 @@ def main(voice_config: VoiceConfig | None = None) -> None:
     parser.add_argument("--host", default="127.0.0.1", help="Bind address (default: 127.0.0.1)")
     parser.add_argument("--port", type=int, default=8765, help="Port (default: 8765)")
     parser.add_argument("--repo", type=str, default=None, help="Repo root (auto-detects git root)")
-    parser.add_argument("--no-auth", action="store_true", help="Disable JWT authentication (for local dev)")
     parser.add_argument("-v", "--verbose", action="store_true", help="Debug logging")
     args = parser.parse_args()
 
@@ -94,7 +93,6 @@ def main(voice_config: VoiceConfig | None = None) -> None:
         repo_root=repo_root,
         voice_config=config,
         settings=settings,
-        no_auth=args.no_auth,
     ))
 
 

{voice_vibecoder-2.3.0 → voice_vibecoder-2.4.0}/src/voice_vibecoder/server.py

@@ -29,12 +29,9 @@ import asyncio
 import json
 import logging
 import os
-import time
 from pathlib import Path
 from typing import Any
-from urllib.parse import urlparse
 
-import jwt
 import websockets
 from websockets.asyncio.server import ServerConnection
 from websockets.http11 import Request, Response
@@ -47,70 +44,6 @@ from voice_vibecoder.voice_providers.openai import OpenAIVoiceProvider
 
 logger = logging.getLogger(__name__)
 
-# ── JWT validation for Azure AD ──────────────────────────────────────────────
-
-_JWKS_CACHE_TTL = 3600  # 1 hour
-
-
-class _JWKSEntry:
-    __slots__ = ("client", "fetched_at")
-
-    def __init__(self, client: jwt.PyJWKClient, fetched_at: float) -> None:
-        self.client = client
-        self.fetched_at = fetched_at
-
-
-_jwks_cache: dict[str, _JWKSEntry] = {}
-
-
-def _get_jwks_client(tenant_id: str) -> jwt.PyJWKClient:
-    """Return a cached JWKS client for the given Azure AD tenant."""
-    now = time.monotonic()
-    entry = _jwks_cache.get(tenant_id)
-    if entry and (now - entry.fetched_at) < _JWKS_CACHE_TTL:
-        return entry.client
-
-    jwks_url = f"https://login.microsoftonline.com/{tenant_id}/discovery/v2.0/keys"
-    client = jwt.PyJWKClient(jwks_url)
-    _jwks_cache[tenant_id] = _JWKSEntry(client, now)
-    return client
-
-
-def validate_token(token: str, tenant_id: str, audience: str) -> dict:
-    """Validate an Azure AD JWT and return decoded claims.
-
-    Raises ValueError if the token is invalid.
-    """
-    try:
-        jwks_client = _get_jwks_client(tenant_id)
-        signing_key = jwks_client.get_signing_key_from_jwt(token)
-        # Accept both v1 (aud=client_id) and v2 (aud=api://client_id) tokens,
-        # and both v1/v2 issuer formats.
-        audiences = [audience]
-        if audience.startswith("api://"):
-            audiences.append(audience[len("api://"):])
-        issuers = [
-            f"https://login.microsoftonline.com/{tenant_id}/v2.0",
-            f"https://sts.windows.net/{tenant_id}/",
-        ]
-        claims = jwt.decode(
-            token,
-            signing_key.key,
-            algorithms=["RS256"],
-            audience=audiences,
-            issuer=issuers,
-        )
-        return claims
-    except jwt.ExpiredSignatureError:
-        raise ValueError("Token has expired")
-    except jwt.InvalidAudienceError:
-        raise ValueError("Invalid audience")
-    except jwt.InvalidIssuerError:
-        raise ValueError("Invalid issuer")
-    except Exception as exc:
-        raise ValueError(f"Token validation failed: {exc}")
-
-
 # ── Auth timeout ─────────────────────────────────────────────────────────────
 
 AUTH_TIMEOUT_SECONDS = 10
@@ -313,11 +246,11 @@ def _log_send_error(future: asyncio.Future) -> None:
 
 async def _authenticate_ws(
     ws: ServerConnection,
-    tenant_id: str,
-    audience: str,
+    authenticate: Any,
 ) -> tuple[str, str] | None:
     """Wait for an auth message as the first frame.
 
+    *authenticate* is the ``VoiceConfig.authenticate`` async callback.
     Returns ``(user_email, raw_token)`` on success, ``None`` on failure.
     """
     try:
@@ -338,15 +271,18 @@ async def _authenticate_ws(
         token = token[7:]
 
     try:
-        claims = validate_token(token, tenant_id, audience)
+        result = await authenticate(token)
     except ValueError as exc:
-        logger.warning("JWT validation failed: %s", exc)
+        logger.warning("Authentication failed: %s", exc)
+        await ws.send(json.dumps({"type": "error", "message": "Authentication failed"}))
+        return None
+    except Exception as exc:
+        logger.error("Unexpected error during authentication: %s", exc, exc_info=True)
         await ws.send(json.dumps({"type": "error", "message": "Authentication failed"}))
         return None
 
     await ws.send(json.dumps({"type": "auth_ok"}))
-    user_email = claims.get("email") or claims.get("preferred_username") or claims.get("upn") or "unknown"
-    return (user_email, token)
+    return result
 
 
 async def _handle_connection(
@@ -354,17 +290,15 @@ async def _handle_connection(
     settings: RealtimeSettings,
     repo_root: Path,
     voice_config: VoiceConfig | None,
-    auth_enabled: bool,
-    tenant_id: str,
-    audience: str,
 ) -> None:
     remote = ws.remote_address
     logger.info("Client connected from %s", remote)
 
     user_email = None
     user_jwt = None
-    if auth_enabled:
-        auth_result = await _authenticate_ws(ws, tenant_id, audience)
+    authenticate = voice_config.authenticate if voice_config else None
+    if authenticate:
+        auth_result = await _authenticate_ws(ws, authenticate)
         if not auth_result:
             logger.warning("Auth failed for %s — closing", remote)
             await ws.close(4001, "Unauthorized")
@@ -387,7 +321,6 @@ async def serve(
     repo_root: Path | None = None,
     voice_config: VoiceConfig | None = None,
     settings: RealtimeSettings | None = None,
-    no_auth: bool = False,
     allowed_origins: list[str] | None = None,
 ) -> None:
     """Start the WebSocket server. Blocks until stopped."""
@@ -404,22 +337,11 @@ async def serve(
         logger.error("Not configured. Run 'vibecoder' TUI first to set API keys.")
         return
 
-    # JWT auth — enabled when both env vars are set
-    tenant_id = os.environ.get("AZURE_AD_TENANT_ID", "")
-    client_id = os.environ.get("AZURE_AD_CLIENT_ID", "")
-    auth_enabled = bool(tenant_id and client_id) and not no_auth
+    auth_enabled = voice_config is not None and voice_config.authenticate is not None
     if auth_enabled:
-        audience = f"api://{client_id}"
-        logger.info("JWT auth enabled  tenant=%s  audience=%s", tenant_id, audience)
-    elif no_auth:
-        audience = ""
-        logger.warning("JWT auth explicitly disabled via --no-auth")
+        logger.info("WebSocket auth enabled (authenticate callback provided)")
     else:
-        audience = ""
-        logger.warning(
-            "JWT auth disabled (AZURE_AD_TENANT_ID / AZURE_AD_CLIENT_ID not set). "
-            "Set these env vars or pass --no-auth to suppress this warning."
-        )
+        logger.info("WebSocket auth disabled (no authenticate callback)")
 
     # Origin checking — build allowed set from env var + explicit param
     origin_env = os.environ.get("VOICE_ALLOWED_ORIGINS", "")
@@ -444,7 +366,7 @@ async def serve(
     )
 
     async def handler(ws: ServerConnection) -> None:
-        await _handle_connection(ws, settings, repo_root, voice_config, auth_enabled, tenant_id, audience)
+        await _handle_connection(ws, settings, repo_root, voice_config)
 
     async with websockets.serve(handler, host, port, process_request=process_request):
         await asyncio.Future()  # Block forever