release: 1.2.0 (stt-server client >=0.3.3,<0.4)

AGENTS.md

@@ -77,7 +77,7 @@ the GitHub `pypi` environment. One-time prerequisites: a PyPI trusted
 publisher (project `onoats`, repo `vr000m/onoats-bot`, workflow
 `release.yml`, environment `pypi`) and the GitHub `pypi` environment itself.
 PyPI rejects direct-URL `Requires-Dist` entries — dependencies must come
-from PyPI (this is why `pipecat-local-stt-server` is a `>=0.1.2,<0.2`
+from PyPI (this is why `pipecat-local-stt-server` is a `>=0.3.3,<0.4`
 registry dep, not a git pin).
 
 ## Supervisor ↔ capturer lifecycle (`cli._run_socket_supervisor`)

CHANGELOG.md

@@ -15,6 +15,20 @@ Annotated tags exist from `v0.9.0` forward.
 
 ## [Unreleased]
 
+## [1.2.0] - 2026-06-28
+
+### Changed
+- Bumped `pipecat-local-stt-server` from `>=0.1.2,<0.2` to `>=0.3.3,<0.4`,
+  keeping the bundled client library in lockstep with the running server
+  generation. 0.3.3 adds server-side UDS trust-boundary hardening (0700
+  socket-directory enforcement + peer-credential `403` for cross-uid
+  connections); the wire protocol stays `"0.1"`, so the recorder's client
+  code is unchanged. `websockets` now resolves to 16.0 (satisfies onoats's
+  `>=13` and the server's new `>=16,<17`). **Operator note:** the 0.3.3
+  server refuses to start on a legacy `0755` socket dir — re-run the
+  server installer (don't `git pull` + bare `launchctl kickstart`) so it
+  self-heals `0755`→`0700` and restarts in one step.
+
 ### Added
 - `onoats stop` subcommand: signal the running recorder to stop gracefully
   (SIGTERM → drain + final flush, then exit). It is a behavioural twin of

native/onoats-menubar/Info.plist

@@ -11,7 +11,7 @@
 	<key>CFBundlePackageType</key>
 	<string>APPL</string>
 	<key>CFBundleShortVersionString</key>
-	<string>1.1.0</string>
+	<string>1.2.0</string>
 	<key>CFBundleVersion</key>
 	<string>2</string>
 	<key>LSMinimumSystemVersion</key>

pyproject.toml

@@ -10,7 +10,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "onoats"
-version = "1.1.0"
+version = "1.2.0"
 description = "Standalone onoats voice recorder (extracted from koda)."
 readme = "README.md"
 license = "BSD-2-Clause"
@@ -28,10 +28,11 @@ classifiers = [
 ]
 dependencies = [
     "pipecat-ai[deepgram,google,local,runner,silero,soundfile,webrtc,whisper]>=1.0.0,<2.0.0",
-    # 0.1.2 is the PyPI release of the exact commit previously pinned by git
-    # URL (5062b98 == tag v0.1.2). <0.2 until the 0.2/0.3 wire protocol is
-    # smoke-tested live against the recorder.
-    "pipecat-local-stt-server>=0.1.2,<0.2",
+    # Kept in lockstep with the running server generation. 0.3.3 added UDS
+    # trust-boundary hardening (0700 socket-dir enforcement + peer-cred 403);
+    # wire protocol stays "0.1", so the recorder's client code is unchanged.
+    # <0.4 until the next minor is smoke-tested live against the recorder.
+    "pipecat-local-stt-server>=0.3.3,<0.4",
     "websockets>=13.0",
     "python-dotenv>=1.2.1",
     "loguru>=0.7.0",