v0.7.0 — Inworld integration, security hardening, pipeline barge-in fix

Minor release — new backward-compatible public API since 0.6.9.

Highlights

✨ Inworld integration completed (#199)

• TTS pricing corrected & completed (both SDKs): inworld-tts-2 $0.025, inworld-tts-1.5-max $0.035, and the new inworld-tts-1.5-mini $0.015 (per 1k chars, On-Demand list rates).
• providers.inworld() TTS config helper; the TTSConfig(provider="inworld") path now builds the adapter.
• InworldLLM — OpenAI-compatible preset for the Inworld Realtime Router (https://api.inworld.ai/v1, INWORLD_API_KEY), unlocking 220+ models behind one key.

🔒 Security (#197, #198)

• SSRF guard now folds non-canonical IP encodings — decimal/octal/hex/short IPv4 and IPv4-mapped IPv6 (incl. 169.254.169.254 metadata). Shared getpatter/ssrf.py.
• Six parity-drift hardening fixes: TypeScript outbound fetch fails closed on redirects (redirect: 'error'), caller DTMF no longer logged, call-id path-traversal closed (POSIX + Windows separators), response-size cap enforced during the read, transfer phone numbers masked in logs, and the variable sanitizer now strips Unicode line separators.

🎙️ Pipeline (#200)

• Fixed a false barge-in that self-interrupted the user-turn LLM — the agent went mute after its opening line. Barge-in now arms only after real outbound audio, and a duplicate STT final no longer aborts a still-producing turn.

🔊 Audio / Skills / Memory (#196)

• Rate-aware resampler + opt-in high-pass/DC-block & speech-selective AGC inbound front-end (fixes the chipmunk/aliasing bug on non-16 kHz TTS).
• User-supplied agent skills (progressive disclosure) and token-aware pipeline compaction. New public API: AgcConfig, Skill, CompactionConfig.

Install

• Python: pip install getpatter==0.7.0
• TypeScript: npm install getpatter@0.7.0

Full changelog: see CHANGELOG.md (section 0.7.0). Released via #201.