[alexkroman]

Brings the voice APIs the CLI calls in line with the AssemblyAI docs and makes them work in production: streaming TTS (speak, dub, live) now runs without --sandbox, and dictate moves from the Sync STT API to the Dictation API.

Streaming TTS (docs)

• Production host: wss://tts.us.assemblyai.com/v1/ws. speak/dub/live drop the [sandbox] help tag and sandbox-only copy, so they show in everyone's --help. session.require_available stays as a backstop for an environment with no TTS host.
• Voices: the catalog is the 11 documented built-in voices, and each one speaks all six languages. The old 26-voice, one-language-per-voice catalog had 10 voices the service doesn't have, including juergen, the German default, which gives 3012 voice_not_found. It also had wrong languages for lola, rafael and marius. A non-built-in --voice (a UUID or a cloned-voice slug) now passes through without an aai- prefix.
• Connect params: voice_id, language as the lowercase English name (de → german), sample_rate, and a pinned encoding=pcm_s16le.
• Protocol: long text goes out as bounded Generate+Flush requests (≤3 in flight) on one socket, instead of a socket per chunk, which hits the new-session limit (3009). Sessions end Terminate → Termination. Unknown frames such as WordBoundaries are ignored, and the undocumented is_final is gone.
• --list-voices: shows the built-ins plus the account's own voices from GET /v1/voices. Records are keyed by slug and paginated via next_cursor. A shared eager option on all three commands means dub --list-voices needs no --lang.
• agent-cascade template fix: its loop waited for is_final, which the service never sends, so each sentence hung until the 2-minute idle timeout. It now ends on FlushDone.

Dictation (docs)

• dictate now calls POST https://dictation.assemblyai.com/v1/transcribe/live (core/sync_stt.py → core/dictation.py). The config part goes first, since audio-first is a 400, and fields use the documented names: language_codes, stt_prompt, keyterms_prompt.
• Default output is the send-ready cleanup rewrite. If the rewrite fails, it falls back to the verbatim transcript with a warning.
• New flags: --verbatim, --instruction (llm_instruction) and --rewrite-mode fast|smart. --keyterm replaces --word-boost, which stays as a hidden deprecated alias that warns.
• --json adds llm_response and llm_error next to the verbatim text.

Models

• live now defaults to claude-haiku-4-5-20251001. kimi-k2.5 isn't served by the production gateway; Haiku 4.5 tied for the fastest time to first token with tools bound in my measurements.
• Retired ids (kimi-k2.5, the gemini-*-previews) drop out of the known-models list. Every model id the CLI references is on the production gateway's model list.

Dependencies (separate commit)

Resolves all 75 open Dependabot alerts (2 critical, 40 high, 30 moderate, 3 low). All of them are in uv.lock, across 16 packages, and each is bumped to at least its first patched release: aiohttp, anyio, cryptography, httpcore2/httpx2, langgraph-sdk, langsmith, mcp, pyasn1, pydantic-settings, pyjwt, pypdf, starlette, urllib3, virtualenv, yt-dlp. The alerts are raised against main, so they close when this merges.

• mcp stays on the patched 1.x line (1.30.0) rather than 2.x, because langchain-mcp-adapters (behind live --mcp-config) doesn't set an upper bound on it.
• The new yt-dlp returns an int from parse_duration for whole seconds. _section_timestamp now coerces it to float so --download-sections ranges stay floats as declared.
• AGENTS.md asks for dependency bumps in their own PR. This one is a self-contained commit (6329ebb), so it can be cherry-picked into a dedicated PR if preferred.

Verification

• ./scripts/check.sh: All checks passed, including 100% patch coverage and the mutation gate.
• Ran against production:
  • transcribe (file and URL), transcripts list/get, stream, llm, agent, clip, caption, eval, doctor.
  • speak: default voice, --language es --voice anna, a ~3,350-character text on one socket, a two-speaker dialogue, and a cloned-voice slug.
  • dub -l de, --list-voices, live --show-code.
  • The dictate path: cleanup, verbatim, --instruction, and JSON output.
• Not covered:
  • The sandbox, because the available sandbox key is disabled.
  • Commands that use the browser-login session (sessions, balance, usage, limits, keys, audit) and login/onboard.
  • Microphone capture (dictate, control).

Follow-ups (not in this PR)

• live, its --show-code script and the agent-cascade template still open a TTS socket per spoken clause. The documented pattern is one long-lived session that uses Cancel for barge-in.
• live with a file input cuts off the agent's reply when the clip ends. This bug predates this PR and reproduces on the base commit.
• Uploading dictation audio while still recording, and selecting the EU endpoints.

https://claude.ai/code/session_01NoQ5jA9AJQ8wPWZbqbLuNn

🤖 Generated with Claude Code

[aikido-pr-checks]

Removing each request with pending.pop(0) shifts all remaining chunks, causing quadratic work for long inputs. Use an index or deque to consume chunks without repeated shifting.

Details

✨ AI Reasoning
​Long inputs are split into a number of chunks that grows with input size. Each request removes the first pending item, which shifts all remaining items; repeated removals therefore add avoidable work as the document grows.

🔧 How do I fix it?
Move constant work outside loops. Use StringBuilder instead of string concatenation in loops. Cache compiled regex patterns. Use hash-based lookups instead of nested loops. Batch database operations instead of N+1 queries.

_{Reply on this comment to give feedback or ignore the issue.
More info}

[alexkroman]

Agreed — the fix (collections.deque + popleft(), O(1) per chunk) is ready, but this PR entered the merge queue before it could be pushed, so it will land as a small follow-up rather than in this PR.

[aikido-pr-checks]

✅ Ignored this finding.