mirror of https://github.com/getpaseo/paseo.git synced 2026-07-29 12:01:31 +00:00

Files

João Sousa Andrade 9dd5c6e5f3 Patch production dependency advisories (#856 )

* Patch production dependency advisories

* ci: harden dependency installs with npm ci --ignore-scripts

- Replace npm install with npm ci --ignore-scripts across all workflows
  to enforce lockfile parity and block dependency postinstall scripts.
- Run npm run postinstall explicitly after install so our root patch
  script still applies (the only legitimate postinstall use in this
  repo); dep lifecycle scripts stay blocked.
- Add lockfile-lint and npm audit signatures to the lint job to catch
  registry-host tampering and verify cryptographic signatures.
- Regenerate package-lock.json to match bumped package.json versions.

* ci: drop --ignore-scripts; rely on npm ci + lockfile-lint + audit signatures

Lavamoat allow-scripts only traverses root deps; it can't see workspace
deps like electron, esbuild, sharp. Without proper monorepo support, an
allowlist would be incomplete and electron's binary download breaks.

Keep the rest of the security stack:
- npm ci (strict lockfile parity)
- lockfile-lint (resolved-host check)
- npm audit signatures (cryptographic verification)

Real script-blocking would need pnpm 10+ migration. Tracking separately.

* ci(nix-build): use PR head SHA so fork checkouts work

The previous `ref: ${{ github.head_ref || github.ref }}` made
actions/checkout fetch a branch name that only exists on the fork,
not origin. Use the PR head SHA instead — origin mirrors PR commits
via refs/pull/N/head, so this works for fork PRs without changing
the push-to-main auto-commit behavior.

---------

Co-authored-by: Mohamed Boudra <boudra.moha@gmail.com>

2026-05-10 11:45:24 +08:00

scripts

Run server tests on Linux+Windows matrix (#809 )

2026-05-08 10:57:22 +08:00

src

refactor: share agent state priority (#846 )

2026-05-09 22:52:06 +08:00

.env.example

Gate Claude SDK stream trace logs behind PASEO_CLAUDE_DEBUG

2026-04-10 10:05:13 +07:00

.gitignore

server(codex): normalize file paths, truncate large diffs, and drop turn/diff/updated telemetry

2026-02-06 11:51:59 +07:00

AGENTS.md

refactor(agent): add wait_for_agent tool and simplify prompt sending API

2025-11-03 11:47:15 +01:00

CLAUDE.md

docs: lowercase internal docs + migrate website docs to public-docs/ (#634 )

2026-04-30 17:27:15 +08:00

package.json

Patch production dependency advisories (#856 )

2026-05-10 11:45:24 +08:00

README.md

chore: reformat codebase with oxfmt

2026-04-23 21:44:48 +07:00

tsconfig.scripts.json

Align script TypeScript lib with server build

2026-05-05 18:54:29 +07:00

tsconfig.server.json

Move terminal sessions to worker process

2026-04-30 22:35:22 +07:00

tsconfig.server.typecheck.json

Fix repo typecheck failures

2025-11-15 20:17:47 +01:00

vitest.config.ts

refactor: eliminate getCheckoutStatusLite, use WorkspaceGitService

2026-04-14 19:05:36 +07:00

README.md

Voice Assistant

A voice-controlled terminal assistant that runs as a single local service.

Quick Start

# Install dependencies
npm install

# Copy environment variables
cp .env.example .env
# Edit .env and add your API keys (OpenAI, Deepgram)

# Run development servers
npm run dev

# Open browser to http://localhost:5173

Architecture

Express Server (port 3000) - Serves API and built UI in production
Vite Dev Server (port 5173) - Hot-reload React UI in development
WebSocket (/ws) - Real-time bidirectional communication
Agent - STT → LLM → TTS pipeline with terminal control
Daemon - tmux-based terminal management (in-process)

Development

# Run both servers (recommended)
npm run dev

# Or run separately:
npm run dev:server  # Express on port 3000
npm run dev:ui      # Vite on port 5173

# Type checking
npm run typecheck

# Build for production
npm run build

# Start production server
npm start

Project Status

✅ Completed (Phases 1-2):

Package setup and configuration
Express server with WebSocket
React UI with Vite
WebSocket client with ping/pong testing

⏳ In Progress (Phase 3):

Terminal control (tmux integration)

📋 Planned (Phases 4-9):

LLM integration (OpenAI GPT-4)
Agent orchestrator
Speech-to-Text (Deepgram)
Text-to-Speech (OpenAI)
Audio streaming
UI polish

See IMPLEMENTATION_PLAN.md for complete details.

Environment Variables

OPENAI_API_KEY=your-openai-key-here      # GPT-4 and TTS
DEEPGRAM_API_KEY=your-deepgram-key-here  # Streaming STT
STT_MODEL=whisper-1        # Optional: override to gpt-4o-transcribe, etc.
STT_CONFIDENCE_THRESHOLD=-3.0  # Optional: reject low-confidence clips
STT_DEBUG_AUDIO_DIR=.stt-debug # Optional: persist raw dictation audio for debugging
PASEO_HOME=~/.paseo        # Runtime state directory (agents/, etc.)
PASEO_LISTEN=127.0.0.1:6767  # Listen address (host:port or /path/to/socket)

PASEO_HOME defaults to ~/.paseo and isolates runtime artifacts like agents/. PASEO_LISTEN controls the daemon listen address. For blue/green testing you can run a parallel server without touching production state:

PASEO_HOME=~/.paseo-blue PASEO_LISTEN=127.0.0.1:7777 npm run dev

Tech Stack

Server: Express, TypeScript, ws (WebSocket)
Client: React 18, Vite, TypeScript
Terminal: tmux (via child_process)
AI: OpenAI (LLM + TTS), Deepgram (STT)

Testing

Currently manual testing via:

Start servers: npm run dev
Open http://localhost:5173
Test WebSocket connection (green status indicator)
Click "Send Ping" button to test communication

More testing guidance as features are implemented.

License

MIT