feat(2.0)!: split voice into @open-gitagent/voice, drop unused deps

Documentation.md

@@ -60,7 +60,7 @@ curl -fsSL https://raw.githubusercontent.com/open-gitagent/gitagent/main/install
 
 **Manual install:**
 ```bash
-npm install -g @open-gitagent/gitagent
+npm install -g @open-gitagent/gitagent @open-gitagent/voice   # omit @open-gitagent/voice for slim CLI/SDK only
 mkdir ~/assistant && cd ~/assistant && git init
 gitagent --voice --dir .
 ```

README.md

@@ -61,9 +61,37 @@ This will:
 ### Or install manually:
 
 ```bash
+# Slim CLI + SDK (recommended in sandboxed/CI environments where supply-chain
+# scanners reject larger bundles)
 npm install -g @open-gitagent/gitagent
+
+# Add voice mode + web UI (the same web UI install.sh launches at :3333)
+npm install -g @open-gitagent/voice
 ```
 
+`install.sh` installs both packages by default. Set `GITAGENT_SLIM=1` before
+the curl-bash to skip voice.
+
+## Migrating from 1.x → 2.0
+
+Voice mode lives in `@open-gitagent/voice` now. The reason: as a single bundle,
+the package was being blocked by some supply-chain scanners that flagged its
+3,800-line `dist/voice/ui.html` and the unused `baileys` dependency. Splitting
+voice out drops the slim-core tarball from ~180 kB to ~85 kB and removes the
+scanner triggers entirely.
+
+```bash
+# If you were on v1.x and used voice:
+npm install -g @open-gitagent/gitagent@latest @open-gitagent/voice
+
+# If you only use the SDK / non-voice CLI:
+npm install -g @open-gitagent/gitagent@latest
+```
+
+The `gitagent` command and `@open-gitagent/gitagent` SDK exports are unchanged.
+`gitagent --voice` dynamically loads `@open-gitagent/voice`; without it
+installed, it prints a one-line install hint and exits cleanly.
+
 ## Quick Start
 
 **Run your first agent in one line:**
@@ -752,7 +780,7 @@ Your agent lives in a git repository with structured files:
 ### Installation & Setup
 
 **What are the requirements?**
-Node.js 18+ (or 20+ recommended), npm, and git. Install globally with `npm install -g @open-gitagent/gitagent`.
+Node.js 18+ (or 20+ recommended), npm, and git. Install globally with `npm install -g @open-gitagent/gitagent` (slim CLI + SDK). Add `@open-gitagent/voice` for voice mode + the web UI.
 
 **How do I set up API keys?**
 Run the installer for guided setup:

install.sh

@@ -106,17 +106,28 @@ if [ "$(uname)" != "Darwin" ] && ! npm root -g 2>/dev/null | grep -q "$HOME"; th
   NPM_CMD="sudo npm"
 fi
 
+# v2.0+ ships voice as a separate optional package. We install both by default
+# so the curl-bash UX is unchanged. Set GITAGENT_SLIM=1 before the install
+# (e.g. in sandboxed/CI environments where the voice package's larger surface
+# could trip supply-chain scanners) to install the core only.
+NPM_PACKAGES="@open-gitagent/gitagent@latest"
+VOICE_LABEL="(core only — GITAGENT_SLIM=1)"
+if [ "${GITAGENT_SLIM:-}" != "1" ]; then
+  NPM_PACKAGES="$NPM_PACKAGES @open-gitagent/voice@latest"
+  VOICE_LABEL="(core + voice)"
+fi
+
 if command -v gitagent &>/dev/null; then
   INSTALLED_VER="$(npm ls -g @open-gitagent/gitagent --depth=0 --json 2>/dev/null | node -pe "JSON.parse(require('fs').readFileSync('/dev/stdin','utf8')).dependencies?.['@open-gitagent/gitagent']?.version || ''" 2>/dev/null || echo "")"
   LATEST_VER="$(npm view @open-gitagent/gitagent version 2>/dev/null || echo "")"
 
   if [ -n "$INSTALLED_VER" ] && [ -n "$LATEST_VER" ] && [ "$INSTALLED_VER" != "$LATEST_VER" ]; then
-    echo -e "  ${YELLOW}⬆${NC}  gitagent ${DIM}v${INSTALLED_VER}${NC} installed — ${GREEN}v${LATEST_VER}${NC} available"
+    echo -e "  ${YELLOW}⬆${NC}  gitagent ${DIM}v${INSTALLED_VER}${NC} installed — ${GREEN}v${LATEST_VER}${NC} available ${DIM}${VOICE_LABEL}${NC}"
     read -rp "  Update to v${LATEST_VER}? [Y/n]: " UPDATE_CHOICE
     UPDATE_CHOICE="${UPDATE_CHOICE:-Y}"
     if [[ "$UPDATE_CHOICE" =~ ^[Yy] ]]; then
       echo -e "  ${BOLD}Updating gitagent...${NC}"
-      $NPM_CMD install -g @open-gitagent/gitagent@latest 2>&1 | tail -2
+      $NPM_CMD install -g $NPM_PACKAGES 2>&1 | tail -2
       echo -e "  ${GREEN}✓${NC} gitagent updated to v${LATEST_VER}"
     else
       echo -e "  ${DIM}  keeping v${INSTALLED_VER}${NC}"
@@ -125,13 +136,13 @@ if command -v gitagent &>/dev/null; then
     echo -e "  ${GREEN}✓${NC} gitagent v${INSTALLED_VER:-latest} ${DIM}(up to date)${NC}"
   fi
 else
-  echo -e "  ${BOLD}Installing gitagent...${NC}"
+  echo -e "  ${BOLD}Installing gitagent...${NC} ${DIM}${VOICE_LABEL}${NC}"
   # Remove corrupted partial installs that cause ENOTDIR
   NPM_GLOBAL_DIR="$(npm root -g 2>/dev/null || echo "")"
   if [ -n "$NPM_GLOBAL_DIR" ] && [ -d "${NPM_GLOBAL_DIR}/@open-gitagent/gitagent" ] && [ ! -f "${NPM_GLOBAL_DIR}/@open-gitagent/gitagent/package.json" ]; then
     $NPM_CMD rm -rf "${NPM_GLOBAL_DIR}/@open-gitagent/gitagent" 2>/dev/null
   fi
-  $NPM_CMD install -g @open-gitagent/gitagent@latest 2>&1 | tail -2
+  $NPM_CMD install -g $NPM_PACKAGES 2>&1 | tail -2
   echo -e "  ${GREEN}✓${NC} gitagent installed"
 fi
 echo ""