@chatpanel/gateway 0.6.50 → 0.6.51

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chatpanel/gateway",
-  "version": "0.6.50",
+  "version": "0.6.51",
   "description": "Local privacy gateway — redacts PII out of OpenAI/Anthropic API traffic before it reaches a model, then restores it in the reply. Point opencode, codex, aider, Claude Code, etc. at it.",
   "type": "module",
   "bin": {

package/src/config.js

@@ -111,9 +111,23 @@ const DEFAULTS = {
   // as stt: the model downloads on FIRST synthesis, never on gateway boot.
   tts: {
     enabled: true,
+    // 'local' = Kokoro in this process, nothing leaves the machine (the default).
+    // 'openai' | 'elevenlabs' = a remote voice. Auth is passed through from the
+    // client as everywhere else here; no key is stored. See src/tts-remote.js for
+    // why remote synthesis redacts by default and what that costs.
+    provider: 'local',
     model: 'onnx-community/Kokoro-82M-v1.0-ONNX',
     voice: 'af_heart',
     allowDownload: true,
+    remote: {
+      baseUrl: '',   // '' = the provider's own default endpoint
+      model: '',
+      voice: '',
+      // Redact before the text leaves this machine. Audio cannot be un-redacted,
+      // so this genuinely means the voice says "PERSON_1" — set false only if you
+      // accept sending real values to the vendor.
+      redact: true,
+    },
   },
 
   // Log one line per request (method, tokens redacted) without any raw values.

package/src/server.js

@@ -41,6 +41,7 @@ import { MODEL_CATALOG, isKnownModel, isValidCustomModelId } from './models.js';
 import { STT_MODEL_CATALOG, isKnownSttModel, isValidCustomSttId, DEFAULT_STT_MODEL, STT_DTYPES, isValidDtype } from './stt-models.js';
 import * as ttsEngine from './tts-engine.js';
 import { TTS_MODEL_CATALOG, TTS_VOICES, isKnownTtsModel, isValidCustomTtsId, isKnownVoice, isValidVoiceId, DEFAULT_TTS_MODEL, DEFAULT_TTS_VOICE, TTS_DTYPES, isValidTtsDtype, MAX_TTS_CHARS } from './tts-models.js';
+import { ttsDestination, synthesizeRemote, isValidRemoteVoice } from './tts-remote.js';
 import { resolvePro, checkQuota, consume, usage } from './freegate.js';
 import { publicConfig, applyConfigPatch, applyNerModelSelection, persistConfig, configPath } from './configstore.js';
 import { resolveDestination, aggregateModelsAsync, listDestinations } from './router.js';
@@ -51,7 +52,7 @@ import * as openai from './openai.js';
 import * as responses from './responses.js';
 import * as anthropic from './anthropic.js';
 
-export const VERSION = '0.6.50';
+export const VERSION = '0.6.51';
 
 // WARM search tier — SQLite + FTS5 record store (falls back to an encrypted-JSON
 // store if SQLite can't load), fed by the extension's ingest sync + backup-ingest.
@@ -1025,14 +1026,41 @@ export function createGateway(cfg = loadConfig()) {
       const text = body && typeof (body.input ?? body.text) === 'string' ? String(body.input ?? body.text).trim() : '';
       if (!text) return sendJson(res, 400, { error: { message: 'text is required', type: 'bad_request' } });
       if (text.length > MAX_TTS_CHARS) return sendJson(res, 413, { error: { message: `text too long (max ${MAX_TTS_CHARS} chars)`, type: 'too_long' } });
-      const voice = body && typeof body.voice === 'string' && body.voice.trim() ? body.voice.trim() : (cfg.tts?.voice || DEFAULT_TTS_VOICE);
-      if (!(isKnownVoice(voice) && isValidVoiceId(voice))) return sendJson(res, 400, { error: { message: 'unknown or invalid voice', type: 'bad_voice' } });
       const speed = Number.isFinite(body.speed) ? Math.min(2, Math.max(0.5, body.speed)) : 1;
+      const dest = ttsDestination(cfg);
+      // A remote destination has its own voice namespace (an ElevenLabs voice id is
+      // not a Kokoro one), so the local catalog check would reject every valid id.
+      const rawVoice = body && typeof body.voice === 'string' && body.voice.trim() ? body.voice.trim() : null;
+      const voice = rawVoice || (dest ? dest.voice : (cfg.tts?.voice || DEFAULT_TTS_VOICE));
+      const voiceOk = dest ? isValidRemoteVoice(voice) : (isKnownVoice(voice) && isValidVoiceId(voice));
+      if (!voiceOk) return sendJson(res, 400, { error: { message: 'unknown or invalid voice', type: 'bad_voice' } });
       // We synthesize WAV only. Say so rather than returning WAV bytes under an mp3
       // content-type — a client that trusts the header would play noise.
       const fmt = body && typeof body.response_format === 'string' ? body.response_format.toLowerCase() : 'wav';
       if (fmt !== 'wav' && fmt !== 'pcm') return sendJson(res, 400, { error: { message: `unsupported response_format "${fmt}" — this gateway synthesizes wav`, type: 'bad_format' } });
       try {
+        // Remote destination: the caller's own auth goes upstream, the text is
+        // redacted first unless this destination explicitly opted out, and the
+        // vendor's own audio format is passed straight through rather than
+        // re-wrapped — we did not synthesize it and must not claim its container.
+        if (dest) {
+          const { audio, contentType, redacted } = await synthesizeRemote({
+            dest, text, voice, speed,
+            auth: req.headers.authorization || req.headers['xi-api-key'] || '',
+            redaction: cfg.redaction,
+            isPro: await resolvePro(cfg.pro?.entitlementToken),
+          });
+          res.writeHead(200, {
+            'Content-Type': contentType,
+            'Content-Length': String(audio.length),
+            'Cache-Control': 'no-store',
+            // Say what actually left. A caller that asked for privacy can verify it,
+            // and one that turned it off can see that it is off.
+            'X-Tts-Provider': dest.kind,
+            'X-Tts-Redacted': String(redacted),
+          });
+          return res.end(audio);
+        }
         const ok = await ttsEngine.ready({
           onLog: (m) => console.log(m),
           allowDownload: cfg.tts?.allowDownload !== false,

package/src/tts-remote.js

@@ -0,0 +1,109 @@
+// Remote text-to-speech destinations — ElevenLabs, OpenAI, or anything that speaks
+// the OpenAI /audio/speech shape (Groq, a local server, an OpenAI-compatible proxy).
+//
+// TWO RULES, and they are the whole reason this is a separate module from
+// tts-engine.js rather than a branch inside it.
+//
+// 1. NO KEY LIVES HERE. config.js says it outright — "the gateway forwards the
+//    CLIENT's own auth header upstream (it stores no provider keys)" — and a TTS
+//    destination is not the place to break that. The caller sends its own
+//    Authorization (or xi-api-key) and we pass it through. Config holds the ROUTE.
+//
+// 2. THE PRIVACY DECISION INVERTS. Local synthesis speaks restored text because the
+//    words never leave the machine; there is nothing to protect them from. The
+//    moment the destination is remote, the text IS leaving, to a vendor, and every
+//    other egress in this gateway is redacted first. So remote synthesis redacts by
+//    default.
+//
+//    That trade is real and cannot be papered over: audio cannot be un-redacted the
+//    way a text completion can, so a redacted remote voice literally says
+//    "PERSON_1". The honest options are (a) placeholders spoken aloud, or (b) real
+//    PII sent to a vendor — and the user picks, per destination, with `redact`. The
+//    default is the safe one and the choice is logged via onEgress, so sending real
+//    names to ElevenLabs is something someone DID, not something that happened.
+
+import { secureFetch } from './secure-fetch.js';
+import { redactSegments, segment } from './redact.js';
+
+export const TTS_PROVIDERS = ['local', 'openai', 'elevenlabs'];
+
+export function isValidTtsProvider(p) {
+  return TTS_PROVIDERS.includes(String(p || ''));
+}
+
+/** The configured destination, or null when synthesis is local (the default). */
+export function ttsDestination(cfg = {}) {
+  const t = cfg.tts || {};
+  const kind = t.provider || 'local';
+  if (kind === 'local' || !isValidTtsProvider(kind)) return null;
+  const r = t.remote || {};
+  return {
+    kind,
+    baseUrl: String(r.baseUrl || (kind === 'elevenlabs' ? 'https://api.elevenlabs.io/v1' : 'https://api.openai.com/v1')).replace(/\/+$/, ''),
+    model: r.model || (kind === 'elevenlabs' ? 'eleven_multilingual_v2' : 'tts-1'),
+    voice: r.voice || (kind === 'elevenlabs' ? '21m00Tcm4TlvDq8ikWAM' : 'alloy'),
+    // Undefined means "not set", which must read as ON — an absent flag is never
+    // permission to send someone's name to a vendor.
+    redact: r.redact !== false,
+  };
+}
+
+// A remote voice id lands in a URL PATH for ElevenLabs, so it is shape-checked
+// rather than trusted: no slashes, no traversal, no query smuggling.
+export function isValidRemoteVoice(v) {
+  return /^[A-Za-z0-9_-]{1,64}$/.test(String(v || ''));
+}
+
+/**
+ * Synthesize remotely. Returns { audio: Buffer, contentType, redacted } — `redacted`
+ * is the count of values replaced, so the caller can report what actually left.
+ *
+ * @param {{dest: any, text: string, voice?: string, speed?: number, auth?: string,
+ *          redaction?: any, isPro?: boolean, onEgress?: Function, fetchImpl?: Function}} opts
+ */
+export async function synthesizeRemote({ dest, text, voice, speed = 1, auth, redaction, isPro = true, onEgress = null, fetchImpl = null } = {}) {
+  if (!dest) throw new Error('no remote TTS destination configured');
+  const pick = voice || dest.voice;
+  if (!isValidRemoteVoice(pick)) throw new Error(`invalid remote voice id: ${pick}`);
+
+  // Redact BEFORE anything is built, so there is no path where the raw string
+  // reaches a request body by accident.
+  let out = String(text);
+  let redacted = 0;
+  if (dest.redact && redaction) {
+    const box = { text: out };
+    const r = await redactSegments([segment(() => box.text, (v) => { box.text = v; })], redaction, { isPro, onEgress });
+    out = box.text;
+    redacted = r?.count || 0;
+  }
+
+  const fetcher = fetchImpl || secureFetch;
+  const headers = { 'Content-Type': 'application/json' };
+  let url, body;
+  if (dest.kind === 'elevenlabs') {
+    url = `${dest.baseUrl}/text-to-speech/${encodeURIComponent(pick)}`;
+    body = { text: out, model_id: dest.model };
+    // ElevenLabs uses its own header. Accept either form from the caller so a
+    // generic OpenAI client can drive it too.
+    const key = stripBearer(auth);
+    if (key) headers['xi-api-key'] = key;
+  } else {
+    url = `${dest.baseUrl}/audio/speech`;
+    body = { model: dest.model, input: out, voice: pick, response_format: 'wav', speed };
+    if (auth) headers.Authorization = auth.startsWith('Bearer ') ? auth : `Bearer ${auth}`;
+  }
+
+  const res = await fetcher(url, { method: 'POST', headers, body: JSON.stringify(body) });
+  if (!res.ok) {
+    let detail = `HTTP ${res.status}`;
+    try { detail = (await res.text()).slice(0, 300) || detail; } catch { /* no body */ }
+    throw new Error(`remote tts failed: ${detail}`);
+  }
+  const audio = Buffer.from(await res.arrayBuffer());
+  return { audio, contentType: res.headers.get('content-type') || 'audio/mpeg', redacted };
+}
+
+function stripBearer(a) {
+  const s = String(a || '').trim();
+  return s.toLowerCase().startsWith('bearer ') ? s.slice(7).trim() : s;
+}