diff --git a/AGENTS.md b/AGENTS.md
index 357aa9c..5ab3164 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -77,7 +77,7 @@ the GitHub `pypi` environment. One-time prerequisites: a PyPI trusted
publisher (project `onoats`, repo `vr000m/onoats-bot`, workflow
`release.yml`, environment `pypi`) and the GitHub `pypi` environment itself.
PyPI rejects direct-URL `Requires-Dist` entries — dependencies must come
-from PyPI (this is why `pipecat-local-stt-server` is a `>=0.1.2,<0.2`
+from PyPI (this is why `pipecat-local-stt-server` is a `>=0.3.3,<0.4`
registry dep, not a git pin).
## Supervisor ↔ capturer lifecycle (`cli._run_socket_supervisor`)
diff --git a/CHANGELOG.md b/CHANGELOG.md
index cbf6936..2e0f905 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -15,6 +15,20 @@ Annotated tags exist from `v0.9.0` forward.
## [Unreleased]
+## [1.2.0] - 2026-06-28
+
+### Changed
+- Bumped `pipecat-local-stt-server` from `>=0.1.2,<0.2` to `>=0.3.3,<0.4`,
+ keeping the bundled client library in lockstep with the running server
+ generation. 0.3.3 adds server-side UDS trust-boundary hardening (0700
+ socket-directory enforcement + peer-credential `403` for cross-uid
+ connections); the wire protocol stays `"0.1"`, so the recorder's client
+ code is unchanged. `websockets` now resolves to 16.0 (satisfies onoats's
+ `>=13` and the server's new `>=16,<17`). **Operator note:** the 0.3.3
+ server refuses to start on a legacy `0755` socket dir — re-run the
+ server installer (don't `git pull` + bare `launchctl kickstart`) so it
+ self-heals `0755`→`0700` and restarts in one step.
+
### Added
- `onoats stop` subcommand: signal the running recorder to stop gracefully
(SIGTERM → drain + final flush, then exit). It is a behavioural twin of
diff --git a/native/onoats-menubar/Info.plist b/native/onoats-menubar/Info.plist
index fa01ef1..cc494ef 100644
--- a/native/onoats-menubar/Info.plist
+++ b/native/onoats-menubar/Info.plist
@@ -11,7 +11,7 @@
CFBundlePackageType
APPL
CFBundleShortVersionString
- 1.1.0
+ 1.2.0
CFBundleVersion
2
LSMinimumSystemVersion
diff --git a/pyproject.toml b/pyproject.toml
index 45a9e90..772d4af 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -10,7 +10,7 @@ build-backend = "hatchling.build"
[project]
name = "onoats"
-version = "1.1.0"
+version = "1.2.0"
description = "Standalone onoats voice recorder (extracted from koda)."
readme = "README.md"
license = "BSD-2-Clause"
@@ -28,10 +28,11 @@ classifiers = [
]
dependencies = [
"pipecat-ai[deepgram,google,local,runner,silero,soundfile,webrtc,whisper]>=1.0.0,<2.0.0",
- # 0.1.2 is the PyPI release of the exact commit previously pinned by git
- # URL (5062b98 == tag v0.1.2). <0.2 until the 0.2/0.3 wire protocol is
- # smoke-tested live against the recorder.
- "pipecat-local-stt-server>=0.1.2,<0.2",
+ # Kept in lockstep with the running server generation. 0.3.3 added UDS
+ # trust-boundary hardening (0700 socket-dir enforcement + peer-cred 403);
+ # wire protocol stays "0.1", so the recorder's client code is unchanged.
+ # <0.4 until the next minor is smoke-tested live against the recorder.
+ "pipecat-local-stt-server>=0.3.3,<0.4",
"websockets>=13.0",
"python-dotenv>=1.2.1",
"loguru>=0.7.0",
diff --git a/uv.lock b/uv.lock
index c753d81..473cd8c 100644
--- a/uv.lock
+++ b/uv.lock
@@ -2107,7 +2107,7 @@ wheels = [
[[package]]
name = "onoats"
-version = "1.1.0"
+version = "1.2.0"
source = { editable = "." }
dependencies = [
{ name = "loguru" },
@@ -2135,7 +2135,7 @@ requires-dist = [
{ name = "loguru", specifier = ">=0.7.0" },
{ name = "mlx-whisper", marker = "extra == 'macos'", specifier = ">=0.4.0" },
{ name = "pipecat-ai", extras = ["deepgram", "google", "local", "runner", "silero", "soundfile", "webrtc", "whisper"], specifier = ">=1.0.0,<2.0.0" },
- { name = "pipecat-local-stt-server", specifier = ">=0.1.2,<0.2" },
+ { name = "pipecat-local-stt-server", specifier = ">=0.3.3,<0.4" },
{ name = "python-dotenv", specifier = ">=1.2.1" },
{ name = "websockets", specifier = ">=13.0" },
]
@@ -2351,14 +2351,14 @@ wheels = [
[[package]]
name = "pipecat-local-stt-server"
-version = "0.1.2"
+version = "0.3.3"
source = { registry = "https://pypi.org/simple" }
dependencies = [
{ name = "websockets" },
]
-sdist = { url = "https://files.pythonhosted.org/packages/91/f0/b276694a03e6da0fa33c5275bb680bd9b85316ab54e5cccfac471661595c/pipecat_local_stt_server-0.1.2.tar.gz", hash = "sha256:1a4fbdc1f020b46a8a30e8af5c6da63ea4da22ddbee5a0d7f6fb6ab48dfb1770", size = 192315, upload-time = "2026-05-30T18:14:21.306Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/dd/7a/7af0d646c5e0056ce9dff8e2b304c05e314eafa0a885b96606317a1e3da3/pipecat_local_stt_server-0.3.3.tar.gz", hash = "sha256:4ad50f6b60e9fc544bfc96548910ee758ec3ff719c05190fad2df6604d9f47a4", size = 305429, upload-time = "2026-06-28T08:57:50.35Z" }
wheels = [
- { url = "https://files.pythonhosted.org/packages/f7/18/7f6b619550b70f4689c10ba59d6e458f678e227fd1017db8103b4a0687ab/pipecat_local_stt_server-0.1.2-py3-none-any.whl", hash = "sha256:52a325f4878af14833d44708c3eebc36c4f49414584e9ff0c48bc924069ee40e", size = 53267, upload-time = "2026-05-30T18:14:20.236Z" },
+ { url = "https://files.pythonhosted.org/packages/89/bb/8bd99f174628339651f1446cba6d82031500c62999e448a75b39146f9726/pipecat_local_stt_server-0.3.3-py3-none-any.whl", hash = "sha256:ecf04ff7647362d51af7c22cd045299bd2c722813becf9f23cea75475e4cd423", size = 62135, upload-time = "2026-06-28T08:57:49.077Z" },
]
[[package]]