feat(voice): core voice pipeline + UI

.gitignore

@@ -216,3 +216,21 @@ sdks/typescript/node_modules/
 sdks/kotlin/build/
 sdks/kotlin/.gradle/
 sdks/kotlin/bin/
+
+# Frontend build/cache artifacts
+frontend/.svelte-kit/
+frontend/build/
+frontend/.vite/
+frontend/.vercel/
+
+# Voice model artifacts downloaded at runtime (Piper)
+en_US-*.onnx
+en_US-*.onnx.json
+
+# Runtime logs and provider test outputs
+logs/
+
+# Local tooling/worktree manager state
+.kilo/
+.idea/
+.local/

.pre-commit-config.yaml

@@ -1,3 +1,4 @@
+exclude: ^\.agents/
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: v5.0.0
@@ -21,15 +22,15 @@ repos:
     hooks:
       - id: ty
         name: ty type checker
-        entry: uv run ty check bindu/ tests/ --exclude bindu/grpc/generated/
+        entry: uv run ty check bindu/ --exclude bindu/grpc/generated/
         language: system
         types: [python]
         pass_filenames: false
         exclude: ^(examples/|bindu/grpc/generated/)
 
       - id: pytest
         name: pytest with coverage
-        entry: bash -c 'uv run pytest -n auto --cov=bindu --cov-report= && coverage report --skip-covered --fail-under=60'
+        entry: bash -c 'uv run pytest -n auto --cov=bindu --cov-report= && uv run coverage report --skip-covered --fail-under=60'
         language: system
         pass_filenames: false
         always_run: true

bindu/common/protocol/types.py

@@ -156,7 +156,7 @@ class FileWithUri(FileWithBytes):
 
 
 @pydantic.with_config(ConfigDict(alias_generator=to_camel))
-class FilePart(TextPart):
+class FilePart(TypedDict):
     """Represents a file segment within a message or artifact.
 
     The file content can be provided either directly as bytes or as a URI.
@@ -168,11 +168,15 @@ class FilePart(TextPart):
     file: Required[FileWithBytes | FileWithUri]
     """The file of the part."""
 
+    metadata: NotRequired[dict[str, Any]]
+    """Metadata about the file part."""
+
     embeddings: NotRequired[list[float]]
     """The embeddings of File. <NotPartOfA2A>"""
 
 
-class DataPart(TextPart):
+@pydantic.with_config(ConfigDict(alias_generator=to_camel))
+class DataPart(TypedDict):
     """Represents a structured data segment (e.g., JSON) within a message or artifact."""
 
     kind: Required[Literal["data"]]
@@ -181,6 +185,9 @@ class DataPart(TextPart):
     data: Required[dict[str, Any]]
     """The data of the part."""
 
+    metadata: NotRequired[dict[str, Any]]
+    """Metadata about the data part."""
+
     embeddings: NotRequired[list[float]]
     """The embeddings of Data. <NotPartOfA2A>"""
 

bindu/extensions/__init__.py

@@ -34,6 +34,13 @@
 negotiate prices, request payments, and execute transactions based on cryptographic
 mandates, creating a true agent economy.
 
+**Voice (Real-time Voice Conversations)**
+Adds Vapi-like real-time voice capability to Bindu agents via WebSocket.
+The pipeline uses Pipecat with configurable provider-based STT and TTS to provide
+bidirectional voice conversations. Providers can be selected via the ``voice``
+config passed to ``bindufy()`` or through ``VOICE__ENABLED``-based environment
+settings.
+
 
 Each extension follows the A2A protocol specification for extensions:
 https://a2a-protocol.org/v0.3.0/topics/extensions/

bindu/extensions/did/did_agent_extension.py

@@ -1,12 +1,3 @@
-# |---------------------------------------------------------|
-# |                                                         |
-# |                 Give Feedback / Get Help                |
-# | https://github.com/getbindu/Bindu/issues/new/choose    |
-# |                                                         |
-# |---------------------------------------------------------|
-#
-#  Thank you users! We ❤️ you! - 🌻
-
 """DID (Decentralized Identifier) Extension for Bindu Agents.
 
 Why is DID an Extension?
@@ -29,6 +20,8 @@
 
 import os
 import platform
+import subprocess
+import getpass
 
 from datetime import datetime, timezone
 from functools import cached_property
@@ -222,17 +215,31 @@ def generate_and_save_key_pair(self) -> dict[str, str]:
             # Windows does not enforce POSIX permissions — write directly
             self.private_key_path.write_bytes(private_pem)
             self.public_key_path.write_bytes(public_pem)
+            try:
+                self._harden_windows_key_file_acl(self.private_key_path)
+                self._harden_windows_key_file_acl(self.public_key_path)
+            except Exception:
+                for key_path in (self.private_key_path, self.public_key_path):
+                    try:
+                        key_path.unlink(missing_ok=True)
+                    except OSError:
+                        logger.warning(
+                            f"Failed to remove key file during ACL hardening rollback: {key_path}"
+                        )
+                raise
         else:
             # POSIX: use os.open to set permissions atomically on creation
             fd = os.open(
                 str(self.private_key_path), os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600
             )
+            os.fchmod(fd, 0o600)
             with os.fdopen(fd, "wb") as f:
                 f.write(private_pem)
 
             fd = os.open(
                 str(self.public_key_path), os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o644
             )
+            os.fchmod(fd, 0o644)
             with os.fdopen(fd, "wb") as f:
                 f.write(public_pem)
 
@@ -241,6 +248,44 @@ def generate_and_save_key_pair(self) -> dict[str, str]:
             "public_key_path": str(self.public_key_path),
         }
 
+    @staticmethod
+    def _harden_windows_key_file_acl(path: Path) -> None:
+        """Restrict Windows ACLs to current user for key file confidentiality."""
+        username = (os.getenv("USERNAME") or "").strip()
+        if not username:
+            try:
+                username = os.getlogin().strip()
+            except Exception:
+                username = ""
+        if not username:
+            try:
+                username = (getpass.getuser() or "").strip()
+            except Exception:
+                username = ""
+        if not username:
+            raise RuntimeError(
+                "Unable to determine Windows username for key ACL hardening"
+            )
+
+        # Remove inherited ACLs and grant full control to current user only.
+        cmd = [
+            "icacls",
+            str(path),
+            "/inheritance:r",
+            "/grant:r",
+            f"{username}:F",
+            "/remove:g",
+            "Users",
+            "Authenticated Users",
+            "Everyone",
+        ]
+        result = subprocess.run(cmd, capture_output=True, text=True, check=False)
+        if result.returncode != 0:
+            raise RuntimeError(
+                "Failed to harden ACL for key file "
+                f"{path}: {result.stderr.strip() or result.stdout.strip()}"
+            )
+
     def _load_key_from_file(self, key_path: Path, key_type: str) -> bytes:
         """Load key PEM data from file.
 

bindu/extensions/voice/__init__.py

@@ -0,0 +1,19 @@
+"""Voice Agent extension for real-time voice conversations.
+
+Provides Vapi-like voice capabilities (STT → Agent → TTS) integrated
+into Bindu's A2A protocol and extension system.
+
+Usage::
+
+    from bindu.extensions.voice import VoiceAgentExtension
+
+    voice = VoiceAgentExtension(
+        stt_provider="deepgram",
+        tts_provider="elevenlabs",
+        tts_voice_id="21m00Tcm4TlvDq8ikWAM",
+    )
+"""
+
+from .voice_agent_extension import VoiceAgentExtension
+
+__all__ = ["VoiceAgentExtension"]