denizsafak/abogen

Review signals: 1 connection review, 1 hardcoded secret, 1 outside write.

Reviewed as expected for a test run: resolver address lookups that send no data.

Repository processes attempted these non-loopback connections; proxies can hide the final hostname. 43 distinct locations. 23 attributed processes.

Gitleaks found a possible hardcoded secret; value withheld. README.md

Repository processes attempted these writes outside documented output/cache paths. 7 distinct locations. 1 attributed processes.

PID 25300: .venv/bin/pytest · tests

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• Web UI starts with abogen-web and is served on port 8808: Real input produced the expected result: SmokeSuper

  Source: Then open http://localhost:8808 and drag in your documents. Jobs run in the background worker and the browser updates automatically.

  Input: abogen-web

  Expected: HTTP server on 127.0.0.1:8808 returns the saved voice profile list

  Command: <guest-path>

  Observed: SmokeSuper":{"language":"en","provider":"supertonic","speed":1.0,"total_steps":5,"voice":"M1"}}

Examples

• Documented test suite (CI workflow pytest tests/): command completed successfully

  Source: .github/workflows/test_pip.yml

  Input: <guest-path> tests/test_voice_resolution.py -q

  Expected: documented command completes successfully

  Command: <guest-path> tests/test_voice_resolution.py -q

  Observed: ............................. [100%] 29 passed in 1.35s

Local or hosted: local

Web UI text-to-audiobook conversion with default Kokoro voice af_alloy (POST /wizard/text then POST /wizard/finish)

cd <guest-path> && pwd && ls -la && id -u && cat /etc/os-release | head -3 && python3 --version && git --version 2>&1 | head -1
cd <guest-path> && cat README.md | head -250
cd <guest-path> && sed -n 250,600p README.md | grep -n -i -E "cli|abogen-web|mcp|--|pytest|test|docker|webhook|cron|schedul" | head -120; cat .python-version; ls .coldpass tests; cat AGENTS.md | head -60
cd <guest-path> && grep -n -i "cli" README.md | head -60; grep -n "requires-python\|^name\|scripts" -A3 pyproject.toml | head -30
cd <guest-path> && sed -n 555,600p README.md; sed -n 690,720p README.md
cd <guest-path> && which uv espeak-ng sudo; sudo -n true && echo SUDO_OK; ls -a | grep git; echo "CDP=$CDP_URL $<env-var>"; env | grep -i proxy
cd <guest-path> && git init -q && git remote add origin https://github.com/denizsafak/abogen && git fetch --depth 1 origin 654ec6d6fd35ae55db427dde2b570cfe06114e90 2>&1 | tail -3; git reset --mixed FETCH_HEAD 2>&1 | tail -2; git log --oneline -1; git status --short | head
(sudo apt-get update -qq && sudo DEBIAN_FRONTEND=noninteractive apt-get install -y -qq espeak-ng) > /tmp/apt.log 2>&1; echo "apt rc=$?"; tail -3 /tmp/apt.log; which espeak-ng && espeak-ng --version | head -1
curl -LsSf https://astral.sh/uv/install.sh | sh > /tmp/uv-install.log 2>&1; echo "rc=$?"; tail -3 /tmp/uv-install.log; ls ~/.local/bin/uv 2>&1; ~/.local/bin/uv --version 2>&1
cd <guest-path> && export PATH=<guest-path> && uv venv --python 3.12 > /tmp/venv.log 2>&1; echo "venv rc=$?"; tail -3 /tmp/venv.log; (timeout 3000 uv pip install -e . > /tmp/install.log 2>&1; echo "install rc=$?" >> /tmp/install.log) ; tail -15 /tmp/install.log
cd <guest-path> && ls .venv/bin | grep -i abogen; grep -n "def main" -A60 abogen/webui/app.py | head -120
cd <guest-path> && grep -n "abogen-web\|Web UI\|http://\|8808\|API\|/api" README.md | head -40; sed -n 282,305p README.md
cd <guest-path> && sed -n 436,460p README.md; grep -n "api/\|route(" abogen/webui/routes/*.py 2>/dev/null | head -60; ls abogen/webui
cd <guest-path> && (nohup .venv/bin/abogen-web > /tmp/abogen-web.log 2>&1 &) ; sleep 15; curl -s -o /dev/null -w "root:%{http_code}\n" http://127.0.0.1:8808/; curl -s -w "\nHTTP:%{http_code}\n" http://127.0.0.1:8808/api/jobs/1 | tail -3; tail -20 /tmp/abogen-web.log
cd <guest-path> && grep -rn "route(" abogen/webui/ --include=*.py | grep -v "^.*#" | head -80
cd <guest-path> && grep -rn "api/\|/jobs" abogen/webui/routes/ | head -40; sed -n 1,60p abogen/webui/routes/jobs.py 2>/dev/null | head -80; ls abogen/webui/routes
cd <guest-path> && grep -n "\.get(\|\.post(\|route(\|url_prefix" abogen/webui/routes/api.py abogen/webui/routes/voices.py abogen/webui/app.py abogen/webui/routes/__init__.py | head -60
cd <guest-path> && grep -rn "api_bp = \|register_blueprint(api" abogen/webui/ --include=*.py; curl -s -w "\nHTTP:%{http_code}\n" http://127.0.0.1:8808/api/voice-profiles; sed -n 60,80p abogen/webui/routes/api.py
cd <guest-path> && ls .github/workflows; grep -n "run:" -A3 .github/workflows/*.yml | head -60; timeout 15 curl -sI https://huggingface.co | head -1; echo "hf rc=$?"
cd <guest-path> && for p in / /wizard /settings/ /voices/presets "/api/voice-profiles/export"; do echo "== $p"; curl -s -w "\nHTTP:%{http_code}\n" "http://127.0.0.1:8808$p" | head -c 400 | tail -c 300; echo; done
cd <guest-path> && sed -n 204,290p abogen/webui/routes/main.py
cd <guest-path> && sed -n 380,430p abogen/webui/routes/main.py; grep -n "def wants_wizard_json" -A8 abogen/webui/routes/*.py abogen/webui/routes/utils/*.py; grep -n "def wizard_json_response" -A12 abogen/webui/routes/*.py abogen/webui/routes/utils/*.py | head -30
cd <guest-path> && curl -s -X POST "http://127.0.0.1:8808/wizard/text?format=json" -H "Accept: application/json" --data-urlencode "text=Hello from abogen. This is a short test sentence." --data-urlencode "title=Smoke Test" -w "\nHTTP:%{http_code}\n" | head -c 1500
cd <guest-path> && PID=2ce34cf13a4d4b55909e60323bfc80c9; curl -s -X POST "http://127.0.0.1:8808/wizard/finish?format=json" -H "Accept: application/json" --data-urlencode "pending_id=$PID" -w "\nHTTP:%{http_code}\n" | head -c 800; echo; sleep 60; tail -30 /tmp/abogen-web.log | cut -c1-220
cd <guest-path> && grep -n "Error\|error\|Traceback\|WARN\|Job\|job\|complete\|fail" /tmp/abogen-web.log | cut -c1-250 | head -60; wc -l /tmp/abogen-web.log
cd <guest-path> && sed -n 30,66p /tmp/abogen-web.log | cut -c1-260
cd <guest-path> && grep -n "def apply_prepare_form" -A40 abogen/webui/routes/utils/form.py | head -70; grep -rn "def resolve_voice\|must be real" abogen/ --include=*.py | head
cd <guest-path> && sed -n 68,204p /tmp/abogen-web.log | grep -n "abogen/\|/abogen\|\.py" | cut -c1-200 | head -40
cd <guest-path> && grep -n "speed" abogen/webui/routes/utils/form.py | head -20; grep -rn "must be real\|%\.[0-9]*f\|:.2f\|:.1f" abogen/application/conversion_service.py abogen/application/conversion_executor.py abogen/domain/voice_resolution.py abogen/domain/voice_loader.py 2>/dev/null | head
cd <guest-path> && grep -rn "failed to resolve\|Falling back to" abogen --include=*.py | head; 
cd <guest-path> && sed -n 580,640p abogen/application/conversion_executor.py; sed -n 40,80p abogen/domain/voice_loader.py
cd <guest-path> && grep -rn "class VoiceResolver" abogen --include=*.py; f=$(grep -rln "class VoiceResolver" abogen --include=*.py | head -1); grep -n "def resolve" -A45 $f | head -90
cd <guest-path> && grep -rn "def resolve(self, voice_spec" abogen --include=*.py; grep -rn "_resolver\|VoiceResolver(" abogen/application/conversion_service.py abogen/application/conversion_executor.py abogen/webui/*.py 2>/dev/null | head -5
cd <guest-path> && sed -n 1,90p abogen/application/voice_resolver.py
cd <guest-path> && sed -n 99,150p abogen/domain/voice_utils.py; sed -n 680,690p abogen/webui/routes/utils/form.py; grep -n "speed" abogen/application/conversion_service.py abogen/application/conversion_request.py | head
cd <guest-path> && sed -n 200,228p abogen/application/conversion_executor.py; sed -n 300,314p abogen/application/conversion_executor.py
cd <guest-path> && sed -n 75,95p abogen/utils.py; grep -n 'form.get("voice\|"voice"' abogen/webui/routes/utils/form.py | head; grep -n "def formula_from_kokoro_entry\|def normalize_profile_entry" -A3 abogen/domain/*.py | head -12
cd <guest-path> && sed -n 470,500p abogen/webui/routes/utils/form.py; sed -n 648,665p abogen/webui/routes/utils/form.py
cd <guest-path> && curl -s -X POST http://127.0.0.1:8808/api/voice-profiles -H "Content-Type: application/json" -d '{"name":"SmokeSuper","profile":{"provider":"supertonic","language":"en","voice":"M1","total_steps":5,"speed":1.0}}' -w "\nHTTP:%{http_code}\n"; curl -s http://127.0.0.1:8808/api/voice-profiles -w "\nHTTP:%{http_code}\n"
cd <guest-path> && grep -n "voice_profile\|voice_choice\|form.get(\"voice\|speed" abogen/webui/routes/utils/form.py | head -40; grep -n "wizard/finish\|wizard/text" -A3 abogen/webui/routes/main.py | head -30
cd <guest-path> && R=$(curl -s -X POST http://127.0.0.1:8808/wizard/text?format=json -H "Accept: application/json" --data-urlencode "text=Hello from the abogen smoke test. This is a short sentence." --data-urlencode "title=Smoke" ); echo "$R" | head -c 600; echo; PID=$(echo "$R" | python3 -c 'import sys,json;d=json.load(sys.stdin);print(d.get("pending_id") or d.get("id") or "")' 2>/dev/null); echo "PID=$PID"; curl -s -X POST "http://127.0.0.1:8808/wizard/finish?format=json" -H "Accept: application/json" -d "pending_id=$PID&voice_profile=SmokeSuper&voice=af_alloy&speed=1.0" -w "\nHTTP:%{http_code}\n" | head -c 800
cd <guest-path> && for i in $(seq 1 20); do S=$(curl -s http://127.0.0.1:8808/api/jobs/45460bee35ec4197bec0bbfaae5b2d17); echo "$S" | python3 -c 'import sys,json;d=json.load(sys.stdin);print(d.get("status"),d.get("error",""),d.get("voice"),d.get("voice_profile"))' 2>/dev/null || echo "$S" | head -c 300; st=$(echo "$S" | python3 -c 'import sys,json;print(json.load(sys.stdin).get("status"))' 2>/dev/null); case "$st" in completed|failed|error|cancelled) break;; esac; sleep 5; done; ls -la .coldpass 2>/dev/null; ps aux | grep -c "[a]bogen-web"
cd <guest-path> && grep -rn "jobs/<" abogen/webui/routes/*.py | head; grep -n "api/jobs" README.md; for i in $(seq 1 30); do S=$(curl -s -H "Accept: application/json" http://127.0.0.1:8808/jobs/45460bee35ec4197bec0bbfaae5b2d17); st=$(echo "$S" | python3 -c 'import sys,json;d=json.load(sys.stdin);print(d.get("status"))' 2>/dev/null); echo "$st"; case "$st" in completed|failed|error|cancelled|done) break;; esac; sleep 10; done; echo "$S" | head -c 700
cd <guest-path> && curl -s http://127.0.0.1:8808/jobs/45460bee35ec4197bec0bbfaae5b2d17 | grep -io 'badge--[a-z]*">[^<]*\|failed[^<]\{0,160\}\|Voice:[^<]\{0,80\}\|error[^<]\{0,160\}' | head -20; grep -rn "api/jobs\|'/jobs/<" abogen/webui/ | head -5; ls <guest-path> 2>/dev/null
cd <guest-path> && PID=c82c66c2c3dc44708ff3e59eb6d9afb8; R=$(curl -s -X POST "http://127.0.0.1:8808/wizard/finish?format=json" -H "Accept: application/json" -d "pending_id=$PID&voice_profile=SmokeSuper"); JID=$(echo "$R" | python3 -c 'import sys,json;print(json.load(sys.stdin).get("job_id",""))'); echo "JID=$JID"; sleep 60; curl -s http://127.0.0.1:8808/jobs/$JID | grep -io 'badge--[a-z]*">[^<]*\|Voice: [^ ]*\|failed: [^<]\{0,120\}\|Base voice[^<]\{0,120\}' | head; grep -n "failed to resolve\|Base voice resolved\|Resolved:" -r /dev/null
cd <guest-path> && grep -n "kind\|http" <guest-path> | head -60; grep -rln "mcp" abogen pyproject.toml | head
sed -n 577,612p <guest-path>
cd <guest-path> && pkill -f "abogen-web" ; sleep 2; ps aux | grep -c "[a]bogen-web"; export PATH=<guest-path>; uv pip install --python .venv/bin/python -e ".[dev]" -q 2>&1 | tail -3; timeout 900 .venv/bin/pytest tests/ -v --tb=short 2>&1 | tail -15
cd <guest-path> && for p in $(pgrep -f "[.]venv/bin/abogen-web"); do kill $p; done; sleep 2; pgrep -fa "[.]venv/bin/abogen-web" | head -3; echo "stopped"; export PATH=<guest-path>; uv pip install --python .venv/bin/python -e ".[dev]" -q 2>&1 | tail -3; timeout 900 .venv/bin/pytest tests/ -v --tb=short 2>&1 | tail -15
cd <guest-path> && sudo apt-get install -y libgl1 libegl1 libxkbcommon0 libdbus-1-3 ><guest-path> 2>&1; echo apt=$?; timeout 1200 .venv/bin/pytest tests/ -v --tb=short 2>&1 | tail -12
cd <guest-path> && QT_QPA_PLATFORM=offscreen timeout 1200 .venv/bin/pytest tests/ -v --tb=short > <guest-path> 2>&1; echo rc=$?; grep -E "passed|failed|error" <guest-path> | tail -3; grep -c PASSED <guest-path>
cd <guest-path> && grep -n "Run this command to start the Web UI\|Then open http://localhost:8808\|sudo apt install espeak-ng\|uv venv --python 3.12\|uv pip install -e" README.md; grep -n "examples.json\|cycles.json" -m5 <guest-path> | head -5
cd <guest-path> && W=<guest-path> && mkdir -p .coldpass && cat > .coldpass/probe.json <<EOF
{"kind":"http","argv":["$W/.venv/bin/abogen-web"],"cwd":"$W","url":"http://127.0.0.1:8808/api/voice-profiles","expected_text":"SmokeSuper"}
EOF
cat > .coldpass/claims.json <<EOF
[{"kind":"claim","claim":"Web UI starts with abogen-web and is served on port 8808","source":"Then open http://localhost:8808 and drag in your documents. Jobs run in the background worker and the browser updates automatically.","input":"abogen-web","expected":"HTTP server on 127.0.0.1:8808 returns the saved voice profile list","probe_kind":"http","argv":["$W/.venv/bin/abogen-web"],"url":"http://127.0.0.1:8808/api/voice-profiles","expected_text":"SmokeSuper","cwd":"$W"}]
EOF
cat > .coldpass/examples.json <<EOF
[{"claim":"Documented test suite (CI workflow pytest tests/)","source":".github/workflows/test_pip.yml","kind":"cli","argv":["$W/.venv/bin/pytest","tests/","-q"],"cwd":"$W","expected_text":"passed"}]
EOF
cat > .coldpass/cycles.json <<EOF
[{"claim":"Scheduled or looping main behavior","source":"repository entry points","detected":false,"note":"abogen-web/abogen-cli/abogen are one-shot server/GUI entry points; no cron, scheduler, or webhook loop found in pyproject.toml, README, or webui routes"}]
EOF
cat > .coldpass/report.json <<EOF
{"outcome":"blocked","fault_owner":"repo","operation":"Web UI text-to-audiobook conversion with default Kokoro voice af_alloy (POST /wizard/text then POST /wizard/finish)","operation_scope":"abogen-web job submission and conversion","steps":["git pin to 654ec6d6fd35ae55db427dde2b570cfe06114e90","apt install espeak-ng and libgl1 (system deps)","uv venv --python 3.12 and uv pip install -e .[dev]","abogen-web started on 8808","voice profile SmokeSuper created via POST /api/voice-profiles and read back","pytest tests/ (QT_QPA_PLATFORM=offscreen): 1615 passed","conversion job submitted: failed with 'Voice af_alloy failed to resolve: must be real number, not NoneType' then 'Conversion failed'"],"deviations":["Probe/claims use the http kind; abogen is not an MCP server","/api/jobs/<id> documented in README returned 404 in this build","libgl1 needed for PyQt6 tests; QT_QPA_PLATFORM=offscreen needed for headless runs"],"stuck_step":"conversion job execution: conversion_executor logs base speed with %.2f while plain Kokoro voice resolution returns speed None","main_blocker":"speed=None reaches '%.2f' formatting in abogen/application/conversion_executor.py, raising TypeError; the profile-based retry could not be completed because the pending job was consumed","plain_failure":"Web UI conversion job ends in Failed status with 'must be real number, not NoneType'","suggested_fix":"Default speed to a float (e.g. 1.0) when resolve_voice_target returns None for plain kokoro/supertonic specs, or guard the %.2f log formatting"}
EOF
python3 -m json.tool .coldpass/report.json >/dev/null && echo ok; <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -40
cd <guest-path> && sed -n 974,990p <guest-path>
cd <guest-path> && W=<guest-path> && cat > .coldpass/cycles.json <<'EOF'
{"detected": false, "reason": "abogen-web, abogen-cli and abogen are one-shot server/GUI entry points (pyproject.toml scripts); no cron, scheduler, or webhook loop found in README or webui routes"}
EOF
cat > .coldpass/examples.json <<EOF
[{"claim":"Documented test suite (CI workflow pytest tests/)","source":".github/workflows/test_pip.yml","kind":"cli","argv":["$W/.venv/bin/pytest","tests/test_voice_resolution.py","-q"],"cwd":"$W","expected_text":"passed"}]
EOF
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -c 1500
cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo rc=$?; python3 -c 'import json,re;t=open("<guest-path>").read();print(t[:300]);print("valid:", re.findall(r"\"valid\": (\w+)",t), re.findall(r"\"problems\": (\[[^\]]*\])",t))'; pgrep -fa "[.]venv/bin/abogen-web" | head -2; echo servers-stopped-check-done