@chatpanel/gateway 0.6.28 → 0.6.30

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chatpanel/gateway",
-  "version": "0.6.28",
+  "version": "0.6.30",
   "description": "Local privacy gateway — redacts PII out of OpenAI/Anthropic API traffic before it reaches a model, then restores it in the reply. Point opencode, codex, aider, Claude Code, etc. at it.",
   "type": "module",
   "bin": {
@@ -27,7 +27,7 @@
     "node": ">=18"
   },
   "dependencies": {
-    "@chatpanel/pii": "^0.2.11",
+    "@chatpanel/pii": "^0.2.14",
     "@huggingface/transformers": "^4.2.0",
     "onnxruntime-web": "1.26.0-dev.20260416-b7804b056c"
   },

package/src/config.js

@@ -34,12 +34,9 @@ const DEFAULTS = {
   allowedOrigins: [],
   maxBodyBytes: 26214400,
 
-  // Monetization: the gateway is free to try, paid to rely on. Free = full-tier
-  // redaction (the real thing — NER names/orgs + dictionary) for a FIXED LIFETIME
-  // allowance (freegate.FREE_TOTAL_CAP redactions), then it stops. Paste a
-  // ChatPanel Pro entitlement token (the same offline-signed token the extension/
-  // bridge use) to unlock unlimited usage. `free.used` is the running lifetime
-  // count (server-authoritative; persisted here so it survives restarts).
+  // `free.used` is the running lifetime redaction count for the free allowance
+  // (freegate.FREE_TOTAL_CAP redactions at full tier), persisted here. A valid
+  // ChatPanel entitlement token unlocks unlimited use.
   pro: {
     entitlementToken: '',
     free: {

package/src/configstore.js

@@ -2,7 +2,7 @@
 // configure it live over the localhost API (GET/POST /config). The gateway stays
 // authoritative — the extension is just a UI client.
 
-import { writeFileSync, mkdirSync } from 'node:fs';
+import { writeFileSync, mkdirSync, chmodSync } from 'node:fs';
 import { join, dirname } from 'node:path';
 import os from 'node:os';
 import { usage } from './freegate.js';
@@ -15,7 +15,10 @@ export function configPath(env = process.env) {
 
 // Persist the user-editable subset (not derived runtime state).
 export function persistConfig(cfg, path = configPath()) {
-  mkdirSync(dirname(path), { recursive: true });
+  // 0700 the dir + 0600 the file: this JSON holds per-destination apiKeys, the
+  // detector key, and the entitlement/bridge tokens — same secret-at-rest posture
+  // as the history key/secret files, so it isn't left world-readable on a shared host.
+  mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
   const out = {
     host: cfg.host, port: cfg.port, backend: cfg.backend,
     // Destinations (the configured agents + API models) MUST persist — otherwise a
@@ -25,7 +28,10 @@ export function persistConfig(cfg, path = configPath()) {
     ner: cfg.ner, stt: cfg.stt, allowedOrigins: cfg.allowedOrigins, maxBodyBytes: cfg.maxBodyBytes,
     pro: cfg.pro, logRequests: cfg.logRequests, logDetail: cfg.logDetail, tools: cfg.tools,
   };
-  writeFileSync(path, JSON.stringify(out, null, 2));
+  // mode on writeFileSync only applies when CREATING the file; chmod after covers an
+  // already-existing (pre-fix, possibly 0644) config too. Best-effort for non-POSIX.
+  writeFileSync(path, JSON.stringify(out, null, 2), { mode: 0o600 });
+  try { chmodSync(path, 0o600); } catch { /* platforms without POSIX perms */ }
 }
 
 // Safe view for GET /config — never leak secrets (the entitlement + bridge tokens
@@ -47,8 +53,7 @@ export function publicConfig(cfg, { proUnlocked = false } = {}) {
     ner: cfg.ner,
     stt: cfg.stt,
     allowedOrigins: Array.isArray(cfg.allowedOrigins) ? cfg.allowedOrigins : [],
-    // free = lifetime trial usage ({ used, cap, remaining }) — read-only; the cap
-    // is fixed and the count is server-authoritative (never settable from the UI).
+    // free = lifetime trial usage ({ used, cap, remaining }), read-only.
     pro: { unlocked: proUnlocked, hasToken: !!cfg.pro?.entitlementToken, free: usage(cfg) },
     logRequests: !!cfg.logRequests,
     logDetail: ['types', 'values'].includes(cfg.logDetail) ? cfg.logDetail : 'off',
@@ -106,9 +111,8 @@ export function applyConfigPatch(cfg, patch = {}) {
   if (Array.isArray(patch.allowedOrigins)) cfg.allowedOrigins = patch.allowedOrigins;
   if (patch.pro && typeof patch.pro === 'object') {
     if (typeof patch.pro.entitlementToken === 'string') cfg.pro.entitlementToken = patch.pro.entitlementToken;
-    // NOTE: the free trial is a FIXED lifetime cap (freegate.FREE_TOTAL_CAP) and
-    // its `used` count is server-authoritative — neither is editable here, so a
-    // client can't raise the cap or reset its own trial.
+    // The free allowance (freegate.FREE_TOTAL_CAP) and its `used` count are not
+    // part of the editable patch.
   }
   // Local dictation toggle. The MODEL is switched via POST /stt/models (like the
   // NER manager), not patched here.

package/src/entitlement-refresh.js

@@ -1,25 +1,15 @@
-// Online entitlement re-validation — closes the refund/revoke abuse window.
-//
-// The gateway stores ONE offline-signed entitlement token (pushed once from the
-// extension via POST /config). Verified purely offline (entitlement.js), that token
-// keeps unlocking Pro until its `exp` — up to 7 days — EVEN AFTER the subscription
-// is refunded, cancelled, or the seat is revoked. The extension/bridge avoid this
-// by re-polling the license worker; the gateway didn't, so a refund left unlimited
-// redaction open for the rest of the token's life.
-//
-// So we also re-check ONLINE on an interval: poll the worker's /entitlement for the
-// token's install_id and either
-//   • REFRESH the stored token (still entitled) — so it never lapses while paid, and
-//   • CLEAR it (worker says valid:false → refunded/cancelled/revoked) — dropping the
-//     gateway to Free immediately instead of riding the offline exp.
-// Network/worker errors NEVER revoke (fail-open for paying users); the offline `exp`
-// still bounds the worst case. Bounds post-refund Pro to <= CHECK_INTERVAL_MS.
+// Online entitlement re-validation. The gateway stores one offline-signed
+// entitlement token and verifies it offline (entitlement.js). On an interval it also
+// re-checks online: it polls the worker's /entitlement for the token's install_id and
+// either refreshes the stored token (still entitled) or clears it (worker reports
+// valid:false), dropping the gateway to Free. Network/worker errors never revoke
+// (fail-open); the offline `exp` still bounds the token's lifetime.
 
 import { persistConfig, configPath } from './configstore.js';
 
 // Same worker the extension/bridge use. Overridable for self-hosted/test.
 const API_BASE = (process.env.CHATPANEL_API_BASE || 'https://api.chatpanel.net').replace(/\/+$/, '');
-const CHECK_INTERVAL_MS = 60 * 60 * 1000; // 1h — the autonomous post-refund Pro window
+const CHECK_INTERVAL_MS = 60 * 60 * 1000; // 1h — online re-check interval
 const FIRST_CHECK_DELAY_MS = 30 * 1000;   // let the server settle before first poll
 const MIN_RECHECK_MS = 2 * 60 * 1000;     // throttle on-demand (/status) re-checks
 
@@ -63,7 +53,7 @@ async function revalidate(cfg) {
       try { persistConfig(cfg, configPath()); } catch { /* best effort */ }
     }
   } else if (data && data.valid === false) {
-    // Refunded / cancelled / seat revoked → drop Pro NOW (don't wait out the exp).
+    // Worker reports the token is no longer valid → clear it and drop to Free.
     cfg.pro.entitlementToken = '';
     try { persistConfig(cfg, configPath()); } catch { /* best effort */ }
     console.log('[gateway] entitlement no longer valid — Pro deactivated (refund/revoke/seat lost).');

package/src/entitlement.js

@@ -1,11 +1,6 @@
-// Offline Pro/Team entitlement verification — the HARD gate for paid features
-// (e.g. custom "bring your own CLI" agents).
-//
-// The license server (Cloudflare Worker) signs a compact entitlement token with
-// an ECDSA P-256 private key that lives ONLY there. The bridge ships the matching
-// PUBLIC key and verifies the signature locally — no network, no secret. A forked
-// client or a raw `curl` to the bridge can't forge entitlement without the
-// private key, so this is a real cryptographic gate, not a UI check.
+// Offline entitlement verification. The license server signs an ECDSA P-256 token;
+// the gateway ships the matching public key and verifies it locally. Gates paid
+// features such as custom "bring your own CLI" agents.
 //
 // Token format (identical to the extension's, extension/js/license.js):
 //   token   = base64url(JSON payload) + "." + base64url(raw ECDSA signature)

package/src/freegate.js

@@ -1,20 +1,11 @@
-// Free vs Pro for the gateway runtime — the "taste" gate.
-//
-// Free (no entitlement token): full-tier redaction works, but only for a fixed
-// LIFETIME number of redactions (FREE_TOTAL_CAP) — a real trial of the genuine
-// thing, then you buy. Pro (a valid ChatPanel entitlement token — the same
-// offline-signed token the extension and bridge use) unlocks UNLIMITED redaction.
-// The cryptographic check (entitlement.js) means a forked UI can't unlock it —
-// only the configured/paid token does.
-//
-// The cap is LIFETIME (overall), not per-day, and it is NOT user-editable — so a
-// free user gets exactly FREE_TOTAL_CAP genuine redactions, full stop. The count
-// persists in cfg.pro.free.used (written via configstore.persistConfig), so it
-// survives restarts.
+// Free vs Pro for the gateway runtime. Without an entitlement token, full-tier
+// redaction is available for a fixed lifetime number of redactions (FREE_TOTAL_CAP);
+// a valid ChatPanel entitlement token unlocks unlimited redaction. The count is
+// stored in cfg.pro.free.used (persisted via configstore.persistConfig).
 
 import { isProEntitled } from './entitlement.js';
 
-// The lifetime free allowance. Fixed — deliberately NOT configurable.
+// The lifetime free allowance.
 export const FREE_TOTAL_CAP = 100;
 
 const proCache = { token: null, val: false };
@@ -34,10 +25,10 @@ export async function resolvePro(token) {
   return val;
 }
 
-// May this request still redact? Pro = always. Free = allowed until the lifetime
-// cap is reached, then refused so the client gets a clear upsell. This only
-// CHECKS — the count is advanced by consume() AFTER a redaction actually happens,
-// so requests with nothing to redact don't burn the allowance.
+// May this request still redact? Pro = always; Free = allowed until the lifetime
+// cap is reached. This only CHECKS — consume() advances the count after a
+// redaction actually happens, so requests with nothing to redact don't consume
+// allowance.
 export function checkQuota(cfg, isPro) {
   if (isPro) return { allowed: true, remaining: Infinity, isPro: true };
   const used = Number(cfg.pro?.free?.used) || 0;

package/src/gateway-token.js

@@ -0,0 +1,60 @@
+// Per-install bearer token for the gateway's ADMIN routes (M2), mirroring the
+// bridge's model. The gateway proxies model traffic for any local client (the /v1/*
+// data plane stays open, no auth — that's the product), but its ADMIN surface
+// (reconfigure via POST /config, read /logs) must not be reachable by every local
+// process or by a drive-by localhost web page.
+//
+// Two ways to authenticate an admin call:
+//   • the ChatPanel extension — recognised by its chrome-/moz-extension:// Origin
+//     (a web page can't forge that; browsers set it honestly). The extension can't
+//     read a local file, so Origin is how IT authenticates.
+//   • a token — this 32-byte secret at ~/.chatpanel/gateway-token (0600), for a
+//     non-browser admin client (a setup script/CLI). A random local process doesn't
+//     have it.
+// Residual (same as the bridge): a MALICIOUS local process could forge the
+// extension Origin. A local attacker at that privilege level already owns much;
+// this still blocks web drive-by and benign no-Origin processes from the admin API.
+
+import { randomBytes, timingSafeEqual } from 'node:crypto';
+import { existsSync, readFileSync, writeFileSync, mkdirSync, chmodSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import os from 'node:os';
+
+const TOKEN_PATH = process.env.CHATPANEL_GATEWAY_TOKEN_PATH || join(os.homedir(), '.chatpanel', 'gateway-token');
+let TOKEN = '';
+
+// Load-or-create the token. Best-effort: token auth is hardening, never fail startup.
+export function ensureGatewayToken(path = TOKEN_PATH) {
+  try {
+    if (existsSync(path)) TOKEN = readFileSync(path, 'utf8').trim();
+    if (!TOKEN) {
+      TOKEN = randomBytes(32).toString('hex');
+      mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+      writeFileSync(path, TOKEN, { mode: 0o600 });
+      try { chmodSync(path, 0o600); } catch { /* non-POSIX */ }
+    }
+  } catch (e) {
+    console.warn(`[gateway] could not initialise admin token: ${e?.message || e}`);
+  }
+  return TOKEN;
+}
+
+export function isExtensionOrigin(origin) {
+  return typeof origin === 'string' && (/^chrome-extension:\/\//.test(origin) || /^moz-extension:\/\//.test(origin));
+}
+
+function tokenMatches(headers) {
+  if (!TOKEN) return false;
+  const h = String(headers?.authorization || '');
+  const provided = (h.startsWith('Bearer ') ? h.slice(7) : String(headers?.['x-chatpanel-token'] || '')).trim();
+  if (!provided) return false;
+  const a = Buffer.from(provided);
+  const b = Buffer.from(TOKEN);
+  return a.length === b.length && timingSafeEqual(a, b);
+}
+
+// True when a request may reach an ADMIN route: the extension (by Origin) or a
+// token-bearing client.
+export function isAdminAuthorized(req) {
+  return isExtensionOrigin(req.headers?.origin) || tokenMatches(req.headers);
+}

package/src/model-hashes.json

@@ -0,0 +1,3 @@
+{
+  "_README": "SHA-256 hashes of curated model weight files, keyed by modelId then by path relative to the model's cache dir (~/.chatpanel/models/<org>/<name>/). Generated on a TRUSTED host by tools/gen-model-hashes.mjs — do NOT hand-edit. Empty = verification is warn-and-allow (no protection yet); populate to enable fail-closed integrity checking. Keys starting with '_' are ignored by the loader."
+}

package/src/model-integrity.js

@@ -0,0 +1,82 @@
+// Model-weight integrity verification (H3).
+//
+// The gateway downloads ONNX model weights (NER / Whisper / Parakeet) from the
+// dl.chatpanel.net mirror or Hugging Face and loads them straight into an ONNX
+// runtime. A compromised mirror, an HF repo takeover, or a MITM on a downgraded
+// connection could therefore feed a malicious model into native code. This module
+// verifies a downloaded model's weight files against committed SHA-256 hashes.
+//
+// Design (deliberately non-breaking):
+//   • Hashes live in the committed `model-hashes.json` — a { modelId: { relPath:
+//     sha256 } } map generated on a TRUSTED host by `tools/gen-model-hashes.mjs`.
+//   • FAIL-CLOSED only on a genuine mismatch: a listed file whose hash differs is
+//     deleted and the load is refused (throws). That's the security event.
+//   • WARN-AND-ALLOW everywhere else: a model not in the manifest, or a listed file
+//     not yet on disk, logs loudly and proceeds — so an empty/partial manifest never
+//     bricks model loading, and shipping the mechanism before the hashes are
+//     populated is safe. (Populate on a trusted machine to switch protection on.)
+//   • Verified on the DOWNLOAD path (when weights first arrive from the network —
+//     the supply-chain moment), not on every offline load (avoids re-hashing 100s of
+//     MB each boot).
+
+import { createHash } from 'node:crypto';
+import { readFileSync, existsSync, rmSync } from 'node:fs';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const MANIFEST_PATH = fileURLToPath(new URL('./model-hashes.json', import.meta.url));
+let _manifest = null;
+
+// { modelId: { 'onnx/model_quantized.onnx': '<sha256>' , … } }. Keys starting with
+// '_' are metadata (schema note) and ignored. Missing/invalid file → empty map
+// (verification simply becomes warn-and-allow for everything).
+export function loadHashManifest(path = MANIFEST_PATH) {
+  if (_manifest && path === MANIFEST_PATH) return _manifest;
+  let parsed = {};
+  try {
+    const raw = JSON.parse(readFileSync(path, 'utf8'));
+    for (const [k, v] of Object.entries(raw)) {
+      if (!k.startsWith('_') && v && typeof v === 'object') parsed[k] = v;
+    }
+  } catch { parsed = {}; }
+  if (path === MANIFEST_PATH) _manifest = parsed;
+  return parsed;
+}
+
+export function sha256File(path) {
+  return createHash('sha256').update(readFileSync(path)).digest('hex');
+}
+
+// Verify a model's weight files under `modelsDir`. Returns a result object; THROWS
+// only on a real hash mismatch (fail-closed). `modelsDir` is the model cache root
+// (e.g. ~/.chatpanel/models); the per-model dir is modelsDir/<org>/<name>.
+/**
+ * @param {string} modelId
+ * @param {{ modelsDir?: string, log?: (msg: string) => void, manifest?: Record<string, Record<string, string>> }} [opts]
+ */
+export function verifyModelWeights(modelId, { modelsDir, log = () => {}, manifest = loadHashManifest() } = {}) {
+  const expected = manifest[modelId];
+  if (!expected || Object.keys(expected).length === 0) {
+    log(`[integrity] no recorded hashes for ${modelId} — skipping verification `
+      + `(run tools/gen-model-hashes.mjs on a trusted host to enable)`);
+    return { verified: false, reason: 'unlisted', checked: 0 };
+  }
+  const dir = join(modelsDir, ...modelId.split('/'));
+  let checked = 0;
+  for (const [rel, wantSha] of Object.entries(expected)) {
+    const p = join(dir, ...rel.split('/'));
+    if (!existsSync(p)) { log(`[integrity] ${modelId}: listed file ${rel} not on disk — skipping`); continue; }
+    const gotSha = sha256File(p);
+    if (gotSha !== wantSha) {
+      try { rmSync(p); } catch { /* best effort */ }
+      throw new Error(
+        `[integrity] ${modelId}/${rel} SHA-256 mismatch `
+        + `(expected ${wantSha.slice(0, 12)}…, got ${gotSha.slice(0, 12)}…) — `
+        + `deleted the file and refusing to load a tampered model`,
+      );
+    }
+    checked++;
+  }
+  if (checked) log(`[integrity] ${modelId}: ${checked} weight file(s) verified ✓`);
+  return { verified: checked > 0, reason: checked ? 'ok' : 'no-files-present', checked };
+}

package/src/ner-engine.js

@@ -18,15 +18,40 @@ import os from 'node:os';
 import { join } from 'node:path';
 import { existsSync, mkdirSync } from 'node:fs';
 import { isKnownModel } from './models.js';
+import { isLoopbackHost, isPrivateHost, isMetadataHost } from '@chatpanel/pii';
+import { verifyModelWeights } from './model-integrity.js';
 
 const DEFAULT_MODEL = 'Xenova/bert-base-NER';
+const DEFAULT_MODEL_HOST = 'https://dl.chatpanel.net/models/';
 
-// Download models from ChatPanel's own CDN (a branded, edge-cached proxy we
-// control) rather than directly from Hugging Face — so a clean install depends only
-// on chatpanel.net. Override with CHATPANEL_MODEL_BASE_URL (e.g. point at HF for
-// dev, or an air-gapped mirror). Must end with '/' (transformers appends the model
-// path template to it).
-const MODEL_HOST = (process.env.CHATPANEL_MODEL_BASE_URL || 'https://dl.chatpanel.net/models/').replace(/\/*$/, '/');
+// Where model weights are fetched from — ChatPanel's own edge-cached CDN by default,
+// so a clean install depends only on chatpanel.net. CHATPANEL_MODEL_BASE_URL can
+// override it (HF for dev, or an air-gapped LAN mirror) — but that env var is a
+// download-redirect vector: an attacker who sets it could serve a malicious ONNX
+// model into the runtime. So we VALIDATE the override before trusting it: http(s)
+// only, never cloud metadata, and no PLAINTEXT http to a PUBLIC host (a LAN/loopback
+// mirror on http is fine — that's the air-gap case). Anything else falls back to the
+// signed default and logs loudly. (True per-file checksum verification is the
+// remaining H3 step — needs a committed {model→sha256} manifest.)
+export function resolveModelHost() {
+  const raw = process.env.CHATPANEL_MODEL_BASE_URL;
+  if (!raw) return DEFAULT_MODEL_HOST;
+  const fallback = (why) => {
+    console.warn(`[models] ignoring CHATPANEL_MODEL_BASE_URL (${raw}): ${why} — using ${DEFAULT_MODEL_HOST}`);
+    return DEFAULT_MODEL_HOST;
+  };
+  let u;
+  try { u = new URL(raw); } catch { return fallback('not a valid URL'); }
+  if (u.protocol !== 'http:' && u.protocol !== 'https:') return fallback(`scheme ${u.protocol} not allowed`);
+  if (isMetadataHost(u.hostname)) return fallback('points at cloud metadata');
+  const localish = isLoopbackHost(u.hostname) || isPrivateHost(u.hostname);
+  if (u.protocol === 'http:' && !localish) return fallback('plaintext http:// to a public host (use https or a LAN/loopback mirror)');
+  console.warn(`[models] ⚠ model weights will be downloaded from ${u.origin} (CHATPANEL_MODEL_BASE_URL override), not ${DEFAULT_MODEL_HOST}`);
+  return raw.replace(/\/*$/, '/');
+}
+
+// Must end with '/' (transformers appends the model path template to it).
+const MODEL_HOST = resolveModelHost();
 
 let _state = 'off';        // 'off' | 'loading' | 'downloading' | 'ready' | 'error'
 let _model = null;         // active model id, e.g. 'Xenova/bert-base-NER'
@@ -232,6 +257,20 @@ async function loadModel(modelId, { log = () => {}, allowDownload = true } = {})
       lib.env.allowRemoteModels = true;
       pipe = await lib.pipeline('token-classification', modelId, { dtype: 'q8', progress_callback });
     }
+    // H3: verify freshly-downloaded weights against committed hashes before we trust
+    // this pipeline. On a mismatch, dispose it (never use its outputs) and let the
+    // throw fall through to the catch (keeps the previous model / deterministic-only).
+    // NOTE: transformers downloads+loads in one call, so this runs POST-load — it
+    // prevents USING and PERSISTING a tampered model, not a hypothetical ORT
+    // parse-time bug. Warn-and-allow when the model isn't in the hash manifest.
+    if (!haveLocal) {
+      try {
+        verifyModelWeights(modelId, { modelsDir: modelRoot(), log });
+      } catch (e) {
+        try { await pipe.dispose?.(); } catch { /* ignore */ }
+        throw e;
+      }
+    }
     // Swap in the new pipeline, dispose the old one (free its WASM/native session).
     _pipe = pipe; _model = modelId; _state = 'ready'; _err = null; _progress = null;
     if (prevPipe && prevPipe !== pipe) { try { await prevPipe.dispose?.(); } catch { /* ignore */ } }

package/src/parakeet-engine.js

@@ -0,0 +1,241 @@
+// In-process speech-to-text — NVIDIA Parakeet TDT (transducer) via onnxruntime.
+//
+// Whisper (stt-engine.js) is an encoder-DECODER seq2seq model and loads through the
+// transformers.js `automatic-speech-recognition` pipeline. Parakeet is a *transducer*
+// (Token-and-Duration Transducer / TDT on a FastConformer encoder) — a fundamentally
+// different architecture the transformers.js pipeline can't drive (it errors with
+// `Unsupported model type "nemo-conformer-tdt"`). So we run the ONNX graphs directly
+// on the same onnxruntime the gateway already ships, with a hand-written greedy TDT
+// decode loop.
+//
+// Why bother: Parakeet-TDT-0.6b-v3 is multilingual (25 European languages, auto-
+// detected — no forced-language step) and runs ~35× realtime at int8 on CPU, several
+// times faster than Whisper at comparable accuracy. It's the fast local-dictation path.
+//
+// Model layout (istupakov/onnx-asr export, e.g. `istupakov/parakeet-tdt-0.6b-v3-onnx`):
+//   nemo128.onnx            mel preprocessor  (waveforms → 128-bin log-mel features)
+//   encoder-model[.int8].onnx   FastConformer encoder (features → [B,D,T'] frames)
+//   decoder_joint[.int8].onnx   fused prediction-net (LSTM) + joint network
+//   vocab.txt               "<piece> <id>" per line; the last line is "<blk> <id>"
+//
+// This module owns ONE concern: load those graphs and turn 16 kHz mono Float32 PCM
+// into text. The streaming/session/redaction/diarization layer lives in stt-engine.js
+// and calls us through a tiny adapter, so nothing downstream needs to know the engine.
+
+import { join } from 'node:path';
+import { existsSync, mkdirSync, readFileSync, createWriteStream, renameSync, statSync } from 'node:fs';
+import { Readable } from 'node:stream';
+import { modelRoot } from './ner-engine.js';
+
+// transformers.js reports these `model_type`s for the transducer exports. Any of them
+// means "not a whisper pipeline model — route here instead".
+const TRANSDUCER_MODEL_TYPES = new Set([
+  'nemo-conformer-tdt', 'nemo-conformer-rnnt', 'parakeet_tdt', 'parakeet-tdt', 'parakeet_rnnt',
+]);
+export function isTransducerModelType(mt) {
+  return TRANSDUCER_MODEL_TYPES.has(String(mt || '').trim());
+}
+
+// Parakeet ships its own quantizations (standard QDQ/QOperator int8 — NOT whisper's
+// block-quantized q8, so it loads on BOTH the native and WASM runtimes). Default to
+// int8: ~690 MB total vs ~2.5 GB for fp32, with negligible accuracy loss for ASR.
+export const PARAKEET_DEFAULT_DTYPE = 'int8';
+export function parakeetDtype(d) {
+  return d === 'fp32' ? 'fp32' : PARAKEET_DEFAULT_DTYPE; // only int8 | fp32 are exported
+}
+
+// The repo files this engine needs for a given precision. `encoder-model.onnx` (fp32)
+// carries its weights in a sibling `.onnx.data` external-data file that ORT loads
+// automatically when it sits next to the graph — so we must fetch it too.
+function filesFor(dtype) {
+  const s = parakeetDtype(dtype) === 'fp32' ? '' : '.int8';
+  const files = ['config.json', 'vocab.txt', 'nemo128.onnx', `encoder-model${s}.onnx`, `decoder_joint-model${s}.onnx`];
+  if (!s) files.push('encoder-model.onnx.data'); // fp32 external weights
+  return files;
+}
+
+export function parakeetDir(modelId) {
+  return join(modelRoot(), ...String(modelId).split('/'));
+}
+
+// Present on disk = every required file exists and is non-empty (a truncated download
+// must not read as "installed"). Mirrors stt/ner `modelOnDisk` intent.
+export function parakeetOnDisk(modelId, dtype = PARAKEET_DEFAULT_DTYPE) {
+  const dir = parakeetDir(modelId);
+  if (!existsSync(dir)) return false;
+  try {
+    return filesFor(dtype).every((f) => { const p = join(dir, f); return existsSync(p) && statSync(p).size > 0; });
+  } catch { return false; }
+}
+
+// ── onnxruntime, matching the gateway's runtime (native npm vs WASM binary) ──────────
+// The npm gateway uses native onnxruntime-node (fast). The standalone binary embeds the
+// onnxruntime-web WASM runtime and hands us its paths via __CHATPANEL_WASM_PATHS__ (the
+// same global ner-engine keys off) — configure ORT-web from it. Memoized once.
+let _ortPromise = null;
+function getOrt() {
+  if (_ortPromise) return _ortPromise;
+  _ortPromise = (async () => {
+    const wasmPaths = globalThis.__CHATPANEL_WASM_PATHS__ || null;
+    const mod = await import(wasmPaths ? 'onnxruntime-web' : 'onnxruntime-node');
+    const ort = mod.InferenceSession ? mod : (mod.default || mod);
+    if (wasmPaths) {
+      try { ort.env.wasm.numThreads = 1; ort.env.wasm.proxy = false; ort.env.wasm.wasmPaths = wasmPaths; } catch { /* optional */ }
+    }
+    return ort;
+  })();
+  return _ortPromise;
+}
+
+// ── download (only when a model isn't already on disk) ───────────────────────────────
+// Custom/BYO STT ids aren't on the dl.chatpanel.net mirror, so — like stt-engine's
+// custom path — fetch straight from Hugging Face. Streamed to a .part file then renamed,
+// so an interrupted download never looks complete. `onProgress({ file, pct })` drives
+// the extension's model-manager UI.
+async function downloadFile(modelId, file, dir, { onProgress, log } = {}) {
+  const url = `https://huggingface.co/${modelId}/resolve/main/${encodeURIComponent(file).replace(/%2F/g, '/')}`;
+  const res = await fetch(url, { redirect: 'follow' });
+  if (!res.ok || !res.body) throw new Error(`fetch ${file} → HTTP ${res.status}`);
+  const total = Number(res.headers.get('content-length')) || 0;
+  const tmp = join(dir, `${file}.part`);
+  const out = createWriteStream(tmp);
+  let got = 0, lastPct = -1;
+  const src = Readable.fromWeb(res.body);
+  src.on('data', (chunk) => {
+    got += chunk.length;
+    if (total) { const pct = Math.round((got / total) * 100); if (pct !== lastPct) { lastPct = pct; onProgress?.({ file, pct }); } }
+  });
+  await new Promise((resolve, reject) => {
+    src.pipe(out);
+    out.on('finish', resolve); out.on('error', reject); src.on('error', reject);
+  });
+  renameSync(tmp, join(dir, file));
+  log?.(`[parakeet] fetched ${file}`);
+}
+
+async function ensureFiles(modelId, dtype, { onProgress, log } = {}) {
+  const dir = parakeetDir(modelId);
+  mkdirSync(dir, { recursive: true });
+  for (const file of filesFor(dtype)) {
+    const dest = join(dir, file);
+    if (existsSync(dest) && statSync(dest).size > 0) continue;
+    log?.(`[parakeet] downloading ${file}…`);
+    await downloadFile(modelId, file, dir, { onProgress, log });
+  }
+  return dir;
+}
+
+// ── vocab / detokenize ───────────────────────────────────────────────────────────────
+// vocab.txt: "<piece> <id>" per line. SentencePiece marks a word boundary with ▁
+// (U+2581); replace it with a space. The final line "<blk> <id>" is the blank/SOS id.
+function loadVocab(dir) {
+  const vocab = [];
+  let blank = -1;
+  for (const line of readFileSync(join(dir, 'vocab.txt'), 'utf8').split('\n')) {
+    if (!line) continue;
+    const sp = line.lastIndexOf(' ');
+    if (sp < 0) continue;
+    const id = parseInt(line.slice(sp + 1), 10);
+    const tok = line.slice(0, sp);
+    if (!Number.isFinite(id)) continue;
+    vocab[id] = tok.replace(/▁/g, ' ');
+    if (tok === '<blk>') blank = id;
+  }
+  if (blank < 0) blank = vocab.length - 1; // fall back to the last id (export convention)
+  return { vocab, blank };
+}
+
+function argmax(arr, from, to) {
+  let bi = from, bv = arr[from];
+  for (let i = from + 1; i < to; i++) if (arr[i] > bv) { bv = arr[i]; bi = i; }
+  return bi;
+}
+
+const DURATIONS = 5;        // TDT duration head bins → advance 0..4 encoder frames
+const MAX_SYMBOLS = 10;     // cap non-blank emissions per frame (anti-runaway)
+
+// ── recognizer ───────────────────────────────────────────────────────────────────────
+// Loads the three ONNX sessions once; `transcribe()` is stateless per call (fresh LSTM
+// state), so it's safe to call for every streaming segment. Serialize calls externally
+// (stt-engine already funnels decodes through one chain).
+export async function loadRecognizer({ modelId, dtype = PARAKEET_DEFAULT_DTYPE, allowDownload = true, onProgress, log = () => {} }) {
+  const dt = parakeetDtype(dtype);
+  const onDisk = parakeetOnDisk(modelId, dt);
+  if (!onDisk && !allowDownload) throw new Error('model not on disk and downloads disabled');
+  const dir = onDisk ? parakeetDir(modelId) : await ensureFiles(modelId, dt, { onProgress, log });
+
+  const ort = await getOrt();
+  const s = dt === 'fp32' ? '' : '.int8';
+  const opts = { executionProviders: ['cpu'], graphOptimizationLevel: 'all', logSeverityLevel: 3 };
+  const [prep, encoder, decoder] = await Promise.all([
+    ort.InferenceSession.create(join(dir, 'nemo128.onnx'), opts),
+    ort.InferenceSession.create(join(dir, `encoder-model${s}.onnx`), opts),
+    ort.InferenceSession.create(join(dir, `decoder_joint-model${s}.onnx`), opts),
+  ]);
+  const { vocab, blank } = loadVocab(dir);
+  const VOCAB = blank + 1;   // token logits span [0, VOCAB); duration logits follow
+  const Tensor = ort.Tensor;
+
+  async function transcribe(float32) {
+    if (!(float32 instanceof Float32Array) || float32.length < 400) return '';
+    const n = float32.length;
+
+    // 1) mel features (done in-graph — no manual DSP).
+    const pr = await prep.run({
+      waveforms: new Tensor('float32', float32, [1, n]),
+      waveforms_lens: new Tensor('int64', BigInt64Array.from([BigInt(n)]), [1]),
+    });
+
+    // 2) FastConformer encoder → outputs [1, D, T'] (channels-first, TIME LAST).
+    const er = await encoder.run({ audio_signal: pr.features, length: pr.features_lens });
+    const enc = er.outputs;
+    const [, D, T] = enc.dims;
+    const encLen = Number(er.encoded_lengths.data[0]);
+    const ed = enc.data; // element (0,d,t) at index d*T + t
+
+    // 3) greedy TDT decode. Per encoder frame: run the fused prednet+joint on the
+    // previous token + LSTM state; split the logits into token- and duration-heads.
+    // Only a NON-BLANK emission appends a token and advances the LSTM state; the
+    // duration argmax says how many frames to jump (0..4). duration==0 lets us emit
+    // another symbol at the same frame (up to MAX_SYMBOLS) — this is what makes TDT
+    // faster than plain RNN-T.
+    let h = new Float32Array(2 * 640);
+    let c = new Float32Array(2 * 640);
+    const tokens = [];
+    const frame = new Float32Array(D);
+    let t = 0, emitted = 0;
+    const guard = encLen * (MAX_SYMBOLS + 1) + 8; // hard stop; the loop always advances, but be safe
+    for (let iter = 0; t < encLen && iter < guard; iter++) {
+      for (let d = 0; d < D; d++) frame[d] = ed[d * T + t];
+      const prev = tokens.length ? tokens[tokens.length - 1] : blank;
+      const out = await decoder.run({
+        encoder_outputs: new Tensor('float32', frame, [1, D, 1]),
+        targets: new Tensor('int32', Int32Array.from([prev]), [1, 1]),
+        target_length: new Tensor('int32', Int32Array.from([1]), [1]),
+        input_states_1: new Tensor('float32', h, [2, 1, 640]),
+        input_states_2: new Tensor('float32', c, [2, 1, 640]),
+      });
+      const logits = out.outputs.data;
+      const tok = argmax(logits, 0, VOCAB);
+      const durIdx = argmax(logits, VOCAB, VOCAB + DURATIONS) - VOCAB; // 0..4
+      if (tok !== blank) {
+        h = out.output_states_1.data; c = out.output_states_2.data; // advance state only on emit
+        tokens.push(tok);
+        emitted++;
+      }
+      if (durIdx > 0) { t += durIdx; emitted = 0; }
+      else if (tok === blank || emitted >= MAX_SYMBOLS) { t += 1; emitted = 0; }
+      // else duration==0 & non-blank & under cap → stay on this frame, emit again
+    }
+
+    let text = '';
+    for (const id of tokens) text += vocab[id] ?? '';
+    return text.replace(/^\s+/, '').replace(/\s+/g, ' ').trimEnd();
+  }
+
+  function dispose() {
+    for (const sess of [prep, encoder, decoder]) { try { sess.release?.(); } catch { /* ignore */ } }
+  }
+
+  return { transcribe, dispose, dtype: dt, dir };
+}

package/src/redact.js

@@ -14,10 +14,10 @@ import * as engine from './ner-engine.js';
 // tier: 'basic' | 'full'. For 'full' we run the local detector over the combined
 // text to harvest names/orgs, then redact every segment against that entity set.
 //
-// Free vs Pro on the gateway: the free trial is limited by a REQUEST QUOTA
-// (freegate.js), not by downgrading quality — so free users get the REAL tier
-// (names/orgs via NER) within their allowance. The custom dictionary, though, is
-// still a Pro power feature: gatedDictionary caps it to FREE_DICT_LIMIT for free.
+// Free use is bounded by a request quota (freegate.js), not by downgrading
+// quality — free requests get the full tier (names/orgs via NER) within their
+// allowance. The custom dictionary is capped for free: gatedDictionary limits it
+// to FREE_DICT_LIMIT via the shared chatpanel-pii gate.
 export async function redactSegments(segments, redactionCfg, { signal, isPro = true } = {}) {
   const vault = createVault();
 
@@ -38,7 +38,7 @@ export async function redactSegments(segments, redactionCfg, { signal, isPro = t
   const texts = segments.map((s) => s.get()).filter((t) => typeof t === 'string' && t);
   if (texts.length === 0) return { vault, count: 0, sanitized };
 
-  // Use the configured tier as-is (no free downgrade — the quota is the free gate),
+  // Use the configured tier as-is (no free downgrade — the quota bounds free use),
   // but keep the dictionary capped for free via the shared chatpanel-pii gate.
   const tier = redactionCfg.tier === 'full' ? 'full' : 'basic';
   const dictionary = gatedDictionary(redactionCfg, isPro);

package/src/router.js

@@ -10,6 +10,8 @@
 //     baseUrl, protocol,        (api) where to forward + 'openai'|'anthropic'
 //     models: [..],             models this destination serves (for /v1/models)
 //   }
+
+import { secureFetch } from './secure-fetch.js';
 //
 // /v1/models aggregates every destination's models so clients can discover them.
 
@@ -87,7 +89,8 @@ export async function aggregateModelsAsync(cfg, { timeoutMs = 4000 } = {}) {
         if (d.protocol === 'anthropic') { headers['x-api-key'] = d.apiKey; headers['anthropic-version'] = '2023-06-01'; }
         else headers.authorization = `Bearer ${d.apiKey}`;
       }
-      const res = await fetch(`${d.baseUrl.replace(/\/$/, '')}/models`, { headers, signal: ctrl.signal });
+      // secureFetch: SSRF guard (scheme/host + resolved-IP); a blocked dest throws → skipped via the catch.
+      const res = await secureFetch(`${d.baseUrl.replace(/\/$/, '')}/models`, { headers, signal: ctrl.signal });
       if (!res.ok) return;
       const j = await res.json();
       const list = Array.isArray(j?.data) ? j.data : (Array.isArray(j?.models) ? j.models : []);

package/src/secure-fetch.js

@@ -0,0 +1,58 @@
+// Node-side SSRF-hardened fetch (M1). The shared @chatpanel/pii/net.js classifier is
+// browser-safe and can only match on the URL's HOSTNAME string — so a public name
+// whose A/AAAA record resolves to a private/metadata IP (DNS-rebinding at the fetch
+// layer) slips past it. Node CAN resolve DNS, so here we additionally validate every
+// RESOLVED address against the same policy, and revalidate on each redirect hop.
+//
+// Policy defaults to the ENDPOINT context (loopback + LAN allowed — Ollama / a LAN
+// model box are legitimate gateway upstreams — but cloud metadata never). So in
+// practice the DNS check blocks a hostname that resolves to cloud metadata; the
+// redirect revalidation blocks a public upstream that 3xx-redirects to a blocked host.
+//
+// Residual (documented): we validate the resolved IPs but do NOT pin the socket to
+// them, so a sub-second TOCTOU window between lookup and connect remains. Closing it
+// fully needs a custom undici dispatcher; the resolved-IP check already removes the
+// easy DNS-rebinding cases, which is the point of M1.
+
+import { lookup as dnsLookup } from 'node:dns/promises';
+import { assertEndpointUrl, isBlockedHost } from '@chatpanel/pii';
+
+const ENDPOINT_POLICY = { allowLoopback: true, allowPrivate: true };
+const isLiteralIp = (h) => /^\d{1,3}(\.\d{1,3}){3}$/.test(h) || h.includes(':');
+
+// Reject if ANY resolved address is blocked under `policy`. A literal-IP host is
+// already covered by the URL check, so skip DNS for it. A resolution failure is left
+// for fetch() to surface (don't mask a real network error as a security error).
+async function assertResolvedIps(hostname, policy, lookupFn) {
+  if (isLiteralIp(hostname)) return;
+  let addrs;
+  try { addrs = await lookupFn(hostname, { all: true }); } catch { return; }
+  for (const { address } of addrs) {
+    if (isBlockedHost(address, policy)) {
+      throw new Error(`refusing to reach ${hostname} — it resolves to a blocked address (${address})`);
+    }
+  }
+}
+
+// secureFetch(url, { policy?, maxRedirects?, lookupFn?, fetchFn?, ...init })
+// Validates the URL (scheme + host policy) AND its resolved IPs before each request,
+// following redirects manually so every hop is re-checked. Returns the final Response.
+// `...init` forwards any standard fetch options (method, headers, body, signal, …).
+/**
+ * @param {string|URL} url
+ * @param {any} [opts]
+ */
+export async function secureFetch(url, {
+  policy = ENDPOINT_POLICY, maxRedirects = 5, lookupFn = dnsLookup, fetchFn = fetch, ...init
+} = {}) {
+  let current = assertEndpointUrl(url, policy);
+  for (let hop = 0; ; hop++) {
+    await assertResolvedIps(current.hostname, policy, lookupFn);
+    const res = await fetchFn(current.toString(), { ...init, redirect: 'manual' });
+    const loc = res.status >= 300 && res.status < 400 ? res.headers.get('location') : null;
+    if (!loc) return res;
+    if (hop >= maxRedirects) throw new Error('too many redirects');
+    current = assertEndpointUrl(new URL(loc, current).toString(), policy); // revalidate the hop
+    try { res.body?.cancel?.(); } catch { /* free the redirect body */ }
+  }
+}

package/src/server.js

@@ -22,7 +22,9 @@ import { loadConfig } from './config.js';
 import { startEntitlementRefresh, maybeRevalidate } from './entitlement-refresh.js';
 import { redactSegments, segment } from './redact.js';
 import { pipeRestoredStream, pipeRestoredOpenAIStream, makeTokenRestorer } from './stream.js';
-import { restoreText, gatedDictionary, narrowSpecs, makeToolHarness, placeholderToolNote } from '@chatpanel/pii';
+import { restoreText, gatedDictionary, narrowSpecs, makeToolHarness, placeholderToolNote, assertEndpointUrl } from '@chatpanel/pii';
+import { ensureGatewayToken, isAdminAuthorized } from './gateway-token.js';
+import { secureFetch } from './secure-fetch.js';
 import { streamBridgeChat, readBridgeToken, openBridgeChat } from './bridge.js';
 import { createRelaySession, getRelaySession, endRelaySession, pumpBridgeStream, deliverToolResult, toolsToSpecs, parseToolCallId } from './toolrelay.js';
 import { shaperFor } from './shape.js';
@@ -43,7 +45,7 @@ import * as openai from './openai.js';
 import * as responses from './responses.js';
 import * as anthropic from './anthropic.js';
 
-export const VERSION = '0.6.28';
+export const VERSION = '0.6.30';
 
 // WARM search tier — SQLite + FTS5 record store (falls back to an encrypted-JSON
 // store if SQLite can't load), fed by the extension's ingest sync + backup-ingest.
@@ -255,7 +257,8 @@ async function probeNerHealth(cfg) {
   const url = nerBaseUrl(cfg);
   if (!url) return { configured: false, ok: false, url: null, model: null };
   try {
-    const r = await fetch(url.replace(/\/ner\/?$/, '') + '/health', { signal: AbortSignal.timeout(2000) });
+    // secureFetch: scheme + host policy AND resolved-IP validation (DNS-rebinding).
+    const r = await secureFetch(url.replace(/\/ner\/?$/, '') + '/health', { signal: AbortSignal.timeout(2000) });
     if (!r.ok) return { configured: true, ok: false, url, model: null };
     const j = await r.json().catch(() => ({}));
     return { configured: true, ok: true, url, model: j.model || null };
@@ -306,8 +309,8 @@ async function startRelay(req, res, { kind, adapter, agent }, body, vault, cfg,
   const { messages, system } = adapter.toTurn(body);
   const token = readBridgeToken(cfg.bridge.token);
   const shaper = shaperFor(kind, body?.model || agent);
-  // Full tier for everyone here (the free allowance is enforced by the quota gate
-  // in the main handler), but the custom dictionary stays capped for free.
+  // Full tier for everyone here (the free allowance is enforced in the main
+  // handler), but the custom dictionary stays capped for free.
   const redactOpts = { tier: cfg.redaction.tier === 'full' ? 'full' : 'basic', dictionary: gatedDictionary(cfg.redaction, isPro), entities: [] };
   const s = createRelaySession({ vault, redactOpts, bridgeUrl: cfg.bridge.url, token, harness });
   const ttl = setTimeout(() => endRelaySession(s.id), 135_000); // bridge tool-call timeout is 120s
@@ -425,7 +428,11 @@ async function handleApi(req, res, { adapter, kind, pathname, search, base, dest
       if (destProtocol === 'anthropic') { headers['x-api-key'] = destKey; delete headers.authorization; }
       else { headers.authorization = `Bearer ${destKey}`; }
     }
-    upstream = await fetch(base.replace(/\/$/, '') + pathname + search, {
+    // SSRF guard on the config-supplied upstream: block cloud-metadata + non-http(s)
+    // BEFORE the fetch. Loopback/LAN stay allowed (Ollama/LM Studio/homelab are the
+    // point of a BYO gateway); only the credential-theft pivot is refused.
+    const upstreamUrl = assertEndpointUrl(base.replace(/\/$/, '') + pathname + search).toString();
+    upstream = await fetch(upstreamUrl, {
       method: req.method,
       headers,
       body: ['GET', 'HEAD'].includes(req.method) ? undefined : outBody,
@@ -492,6 +499,14 @@ export function createGateway(cfg = loadConfig()) {
     if (req.headers.origin) setCors(res, req.headers.origin);
     if (req.method === 'OPTIONS') { res.writeHead(204); return res.end(); }
 
+    // M2: ADMIN routes reconfigure the gateway (POST /config) or expose its in-memory
+    // logs (GET /logs). Unlike the /v1 data plane (open to any local client — the
+    // product), these must not be reachable by a no-Origin local process or a drive-by
+    // localhost web page. Require the extension Origin or the gateway token.
+    if ((pathname === '/config' || pathname === '/logs') && !isAdminAuthorized(req)) {
+      return sendJson(res, 403, { error: 'admin route: extension origin or gateway token required' });
+    }
+
     if (req.method === 'GET' && pathname === '/health') {
       // `stt` is ADDITIVE (Tesla rule): old clients ignore it, new clients use it
       // to auto-detect local dictation. `enabled` reflects config; the model only
@@ -621,7 +636,8 @@ export function createGateway(cfg = loadConfig()) {
         if (!url) return sendJson(res, 503, { error: { message: 'NER not configured — deterministic-only redaction', type: 'ner_off' } });
         try {
           const body = await readBody(req, cfg.maxBodyBytes);
-          const r = await fetch(url, { method: 'POST', headers: { 'content-type': 'application/json' }, body, signal: AbortSignal.timeout(8000) });
+          // secureFetch: scheme/host policy + resolved-IP check before POSTing raw text to the detector.
+          const r = await secureFetch(url, { method: 'POST', headers: { 'content-type': 'application/json' }, body, signal: AbortSignal.timeout(8000) });
           const text = await r.text();
           res.writeHead(r.status, { 'content-type': 'application/json' });
           return res.end(text);
@@ -892,9 +908,9 @@ export function createGateway(cfg = loadConfig()) {
           body.tools = narrowSpecs(body.tools, latestUserText(body, r.kind), { cap, keep, name: toolName, description: toolDesc });
           narrowedTools = before - body.tools.length;
         }
-        // Free/Pro gate: free users get the REAL thing (full-tier redaction), but
-        // only for a fixed lifetime allowance — checked here, consumed below once a
-        // redaction actually happens. Over the cap → 402 upsell.
+        // Free users get full-tier redaction within a fixed lifetime allowance —
+        // checked here, consumed below once a redaction actually happens. Over the
+        // cap returns 402.
         isPro = await resolvePro(cfg.pro?.entitlementToken);
         const allow = checkQuota(cfg, isPro);
         if (!allow.allowed) {
@@ -907,16 +923,16 @@ export function createGateway(cfg = loadConfig()) {
         const ac = new AbortController();
         req.on('close', () => ac.abort());
         const rd0 = trace ? trace.clock() : 0;
-        // Redact at the configured tier for everyone (free users get genuine
-        // name/org redaction within their allowance, not a downgraded preview);
-        // the custom dictionary stays capped for free (isPro decides that inside).
+        // Redact at the configured tier for everyone (free users get name/org
+        // redaction within their allowance); the custom dictionary stays capped for
+        // free (isPro decides that inside).
         const { vault: v, count, sanitized } = await redactSegments(segs, cfg.redaction, { signal: ac.signal, isPro });
         if (trace) trace.lap('redact', rd0);
         vault = v;
         redactedCount = count;
         sanitizedCount = sanitized || 0;
-        // Burn one lifetime free credit only when we actually redacted something,
-        // then persist so the count survives a restart. (No-op / no write for Pro.)
+        // Consume one lifetime free credit only when we actually redacted
+        // something, then persist. (No-op / no write for Pro.)
         if (!isPro && count > 0) {
           consume(cfg, isPro);
           try { persistConfig(cfg, configPath()); } catch { /* best effort — usage is advisory */ }
@@ -958,11 +974,12 @@ export function createGateway(cfg = loadConfig()) {
 
 export function start(cfg = loadConfig()) {
   installTimestampedConsole(); // every gateway log line gets a clock — before anything logs
+  ensureGatewayToken(); // M2: load/create the admin-route token (best-effort)
   const server = createGateway(cfg);
   const ner = startNer(cfg); // may mutate cfg.redaction when it comes up
-  // Re-validate the stored Pro entitlement online on an interval, so a refunded /
-  // revoked subscription drops the gateway to Free instead of riding the offline
-  // token to its exp (see entitlement-refresh.js).
+  // Re-validate the stored entitlement online on an interval; clears it and drops
+  // the gateway to Free when the worker reports it invalid (see
+  // entitlement-refresh.js).
   const entitlement = startEntitlementRefresh(cfg);
   // Fail LOUD on a port clash instead of crashing with a raw stack trace. We bind a
   // FIXED port (4320) so the extension / install.sh / OpenCode can always find us; if
@@ -983,6 +1000,12 @@ export function start(cfg = loadConfig()) {
     console.log(`  backend  : ${cfg.backend}` + (cfg.backend === 'bridge' ? ` (agent: ${cfg.bridge.agent}, via ${cfg.bridge.url})` : ''));
     console.log(`  redaction: ${cfg.redaction.tier}` + (cfg.redaction.detection?.backend && cfg.redaction.detection.backend !== 'off'
       ? ` + ${cfg.redaction.detection.backend} detector` : (cfg.ner?.autostart ? ' (+ NER starting…)' : '')));
+    // M7: a non-loopback bind exposes the gateway on the LAN, where the per-request
+    // loopback Host check is trivially satisfied by a spoofed `Host: 127.0.0.1`. The
+    // /v1 data plane forwards with the client's own key, but make the exposure LOUD.
+    if (!isLoopbackHost(cfg.host)) {
+      console.error(`⚠ SECURITY: gateway bound to NON-LOOPBACK host ${cfg.host}. It is reachable off-machine, and the loopback Host-header check is spoofable from the LAN. Admin routes still need the token/extension, but prefer binding 127.0.0.1 unless you intend LAN exposure on a trusted network.`);
+    }
   });
   // If the user handed off a backup key, refresh the warm store from the latest
   // daily backup in the background — so the gateway stays current even when the

package/src/stt-engine.js

@@ -20,7 +20,9 @@ import { join } from 'node:path';
 import { existsSync, readdirSync } from 'node:fs';
 import { randomUUID } from 'node:crypto';
 import { ensureLib, modelRoot } from './ner-engine.js';
-import { DEFAULT_STT_MODEL, isEnglishOnly, sttModelDtype, isKnownSttModel } from './stt-models.js';
+import { verifyModelWeights } from './model-integrity.js';
+import { DEFAULT_STT_MODEL, isEnglishOnly, sttModelDtype, isKnownSttModel, sttModelEngine } from './stt-models.js';
+import * as parakeet from './parakeet-engine.js';
 import * as diarize from './diarize-engine.js';
 
 export const SAMPLE_RATE = 16000; // fixed wire contract: 16 kHz mono Float32 PCM
@@ -65,6 +67,8 @@ const DTYPE_SUFFIX = {
 };
 
 export function modelOnDisk(modelId = _model || DEFAULT_STT_MODEL, dtype = sttModelDtype(modelId) || runtimeDtype()) {
+  // Transducer models (parakeet) have a different file layout + engine — delegate.
+  if (sttModelEngine(modelId) === 'parakeet-tdt') return parakeet.parakeetOnDisk(modelId, parakeet.parakeetDtype(dtype));
   const dir = join(modelRoot(), ...modelId.split('/'), 'onnx');
   if (!existsSync(dir)) return false;
   const suffix = DTYPE_SUFFIX[dtype] ?? '';
@@ -87,6 +91,9 @@ export function health() {
 // and a failed SWITCH keeps the previous working pipeline.
 /** @param {string} modelId @param {{ log?: (m: string) => void, allowDownload?: boolean, dtype?: string }} [opts] */
 async function loadModel(modelId, { log = () => {}, allowDownload = true, dtype: dtypeOverride = null } = {}) {
+  // Transducer models aren't whisper pipelines — hand off to the parakeet engine.
+  if (sttModelEngine(modelId) === 'parakeet-tdt') return loadParakeet(modelId, { log, allowDownload, dtype: dtypeOverride });
+
   const prevPipe = _pipe;
   const prevModel = _model;
   let lib;
@@ -145,6 +152,16 @@ async function loadModel(modelId, { log = () => {}, allowDownload = true, dtype:
       lib.env.allowRemoteModels = true;
       pipe = await lib.pipeline('automatic-speech-recognition', modelId, { dtype, progress_callback });
     }
+    // H3: verify freshly-downloaded weights (fail-closed on a real mismatch;
+    // warn-and-allow when unlisted). Post-load — see model-integrity.js note.
+    if (!haveLocal) {
+      try {
+        verifyModelWeights(modelId, { modelsDir: modelRoot(), log });
+      } catch (e) {
+        try { await pipe.dispose?.(); } catch { /* ignore */ }
+        throw e;
+      }
+    }
     _pipe = pipe; _model = modelId; _state = 'ready'; _err = null; _progress = null; _dtype = dtype;
     if (prevPipe && prevPipe !== pipe) { try { await prevPipe.dispose?.(); } catch { /* ignore */ } }
     log(`[stt] ready — model ${modelId} @ ${dtype} (in-process, offline) — local dictation active`);
@@ -160,6 +177,52 @@ async function loadModel(modelId, { log = () => {}, allowDownload = true, dtype:
   }
 }
 
+// Load a Parakeet TDT (transducer) model via parakeet-engine.js (raw onnxruntime), and
+// expose it to the session layer as a whisper-shaped `_pipe(audio) → { text }` adapter,
+// so decodeSession/streaming/redaction/diarization all work unchanged. Fail-open and
+// keep-previous-on-switch-failure, exactly like the whisper path above.
+/** @param {string} modelId @param {{ log?: (m: string) => void, allowDownload?: boolean, dtype?: string|null }} [opts] */
+async function loadParakeet(modelId, { log = () => {}, allowDownload = true, dtype: dtypeOverride = null } = {}) {
+  const prevPipe = _pipe;
+  const prevModel = _model;
+  const dtype = parakeet.parakeetDtype(dtypeOverride && dtypeOverride !== 'auto' ? dtypeOverride : PARAKEET_RUNTIME_DTYPE());
+  const haveLocal = parakeet.parakeetOnDisk(modelId, dtype);
+  if (!haveLocal && !allowDownload) {
+    _state = 'error'; _err = 'model not on disk and downloads disabled';
+    log(`[stt] model ${modelId} not installed and downloads disabled`);
+    return false;
+  }
+  _state = haveLocal ? 'loading' : 'downloading';
+  if (!haveLocal) { _progress = { model: modelId, file: null, pct: 0 }; log(`[stt] downloading model ${modelId} (one-time, from Hugging Face)…`); }
+  try {
+    const rec = await parakeet.loadRecognizer({
+      modelId, dtype, allowDownload, log,
+      onProgress: (p) => { _progress = { model: modelId, file: p.file || null, pct: typeof p.pct === 'number' ? p.pct : (_progress?.pct ?? 0) }; },
+    });
+    // whisper-shaped adapter: ignores the whisper `{ language, task }` opts (parakeet
+    // auto-detects language) and returns { text }. `__parakeet` flags the language-ID
+    // short-circuit; `dispose` frees the ORT sessions on switch.
+    const adapter = async (audio) => ({ text: await rec.transcribe(audio) });
+    adapter.__parakeet = true;
+    adapter.dispose = () => rec.dispose();
+    _pipe = adapter; _model = modelId; _state = 'ready'; _err = null; _progress = null; _dtype = dtype;
+    if (prevPipe && prevPipe !== adapter) { try { await prevPipe.dispose?.(); } catch { /* ignore */ } }
+    log(`[stt] ready — model ${modelId} @ ${dtype} (parakeet-tdt, in-process, offline) — local dictation active`);
+    return true;
+  } catch (e) {
+    _err = e.message; _progress = null;
+    if (prevPipe) { _pipe = prevPipe; _model = prevModel; _state = 'ready'; }
+    else { _state = 'error'; }
+    log(`[stt] model load failed (${e.message})${prevPipe ? ' — keeping previous model' : ''}`);
+    return false;
+  }
+}
+
+// Parakeet only ships int8 + fp32 exports (no whisper-style q8). int8 loads and runs on
+// BOTH runtimes; only force fp32 if a caller explicitly asks. Independent of the whisper
+// runtimeDtype (which returns q8/fp32).
+function PARAKEET_RUNTIME_DTYPE() { return parakeet.PARAKEET_DEFAULT_DTYPE; }
+
 // Load the configured model once, on FIRST USE (never at gateway startup — the
 // download is deferred until someone actually dictates). Single-flight.
 export function init(cfg = {}) {
@@ -174,8 +237,11 @@ export function init(cfg = {}) {
 export async function setModel(modelId, opts = {}) {
   const log = typeof opts.onLog === 'function' ? opts.onLog : () => {};
   if (!modelId) return false;
-  // Re-load if the model OR the requested precision changed.
-  const wantDtype = opts.dtype && opts.dtype !== 'auto' ? opts.dtype : (sttModelDtype(modelId) || runtimeDtype());
+  // Re-load if the model OR the requested precision changed. Parakeet has its own
+  // dtype domain (int8/fp32), independent of whisper's q8/fp32 runtimeDtype.
+  const wantDtype = sttModelEngine(modelId) === 'parakeet-tdt'
+    ? parakeet.parakeetDtype(opts.dtype && opts.dtype !== 'auto' ? opts.dtype : parakeet.PARAKEET_DEFAULT_DTYPE)
+    : (opts.dtype && opts.dtype !== 'auto' ? opts.dtype : (sttModelDtype(modelId) || runtimeDtype()));
   if (modelId === _model && isReady() && _dtype === wantDtype) return true;
   return loadModel(modelId, { log, allowDownload: opts.allowDownload !== false, dtype: opts.dtype });
 }
@@ -348,7 +414,7 @@ async function decodeSession(s, { flush = false } = {}) {
 
   // Auto-detect the spoken language on the session's first voiced audio (≥1s),
   // then pin it. An explicit client `lang` wins; `.en` models skip all of this.
-  if (!s.lang && !s.langTried && !isEnglishOnly(_model) && audio.length >= SAMPLE_RATE) {
+  if (!s.lang && !s.langTried && !isEnglishOnly(_model) && !_pipe?.__parakeet && audio.length >= SAMPLE_RATE) {
     s.langTried = true;
     const detected = await detectLanguage(audio);
     if (detected) { s.lang = detected; emit(s, { type: 'language', lang: detected }); }

package/src/stt-models.js

@@ -53,8 +53,35 @@ export const STT_MODEL_CATALOG = [
     ramMB: 3200,
     note: 'Best accuracy. For powerful machines; use the native (npm) gateway for speed.',
   },
+  {
+    // NOT a whisper/seq2seq model — a NeMo TDT transducer. It doesn't run through the
+    // transformers.js ASR pipeline; the STT engine routes `engine: 'parakeet-tdt'`
+    // models to parakeet-engine.js (raw onnxruntime + a greedy TDT decode). Multilingual
+    // (25 European languages, auto-detected) and ~35× realtime at int8 on the native
+    // (npm) gateway — the fast local-dictation path. WASM runs it but slower.
+    id: 'istupakov/parakeet-tdt-0.6b-v3-onnx',
+    label: 'Parakeet TDT 0.6B v3 (multilingual, fast)',
+    lang: '25 European languages (auto-detected)',
+    tier: 'accurate',
+    engine: 'parakeet-tdt',
+    recommended: true,   // our default recommendation: faster + more accurate than Whisper.
+    approxMB: 690,   // int8: encoder 652 + decoder_joint 18 + preprocessor
+    ramMB: 1600,
+    note: 'Recommended — NVIDIA Parakeet transducer. Several× faster than Whisper at similar or better accuracy, English + 24 EU languages. One-time download; best on the native (npm) gateway.',
+  },
 ];
 
+// The model we steer users to (a bigger, on-demand download — NOT the boot default,
+// which stays a small model so first dictation works instantly). The settings UI
+// surfaces this so users can install it after the gateway is running.
+export const RECOMMENDED_STT_MODEL = 'istupakov/parakeet-tdt-0.6b-v3-onnx';
+
+// STT engine backing a model. Default 'whisper' = the transformers.js ASR pipeline;
+// 'parakeet-tdt' = the raw-onnxruntime transducer engine (parakeet-engine.js).
+export function sttModelEngine(id) {
+  return sttModel(id)?.engine || 'whisper';
+}
+
 export function isKnownSttModel(id) {
   return STT_MODEL_CATALOG.some((m) => m.id === id);
 }