@chatpanel/gateway 0.6.53 → 0.6.55

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chatpanel/gateway",
-  "version": "0.6.53",
+  "version": "0.6.55",
   "description": "Local privacy gateway — redacts PII out of OpenAI/Anthropic API traffic before it reaches a model, then restores it in the reply. Point opencode, codex, aider, Claude Code, etc. at it.",
   "type": "module",
   "bin": {

package/src/config.js

@@ -9,7 +9,10 @@ import { readFileSync, existsSync } from 'node:fs';
 import { join } from 'node:path';
 import os from 'node:os';
 
-const DEFAULTS = {
+// Exported so tests can assert that every section here survives persistConfig's
+// allowlist — a new section that is not persisted reverts on restart, and that
+// reads as a broken feature rather than an unsaved setting.
+export const DEFAULTS = {
   host: '127.0.0.1',
   port: 4320,
 

package/src/configstore.js

@@ -19,13 +19,18 @@ export function persistConfig(cfg, path = configPath()) {
   // detector key, and the entitlement/bridge tokens — same secret-at-rest posture
   // as the history key/secret files, so it isn't left world-readable on a shared host.
   mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+  // NOTE: this is an explicit allowlist, so a NEW config section does not persist
+  // until it is added here — and the symptom is a setting that silently reverts on
+  // restart, which reads as "the feature is broken" rather than "it was not saved".
+  // tests/configstore.test.js fails if a key in DEFAULTS is neither listed here nor
+  // deliberately excluded below.
   const out = {
     host: cfg.host, port: cfg.port, backend: cfg.backend,
     // Destinations (the configured agents + API models) MUST persist — otherwise a
     // restart drops them and every model falls back to the default OpenAI upstream.
     destinations: cfg.destinations,
     bridge: cfg.bridge, upstreams: cfg.upstreams, redaction: cfg.redaction,
-    ner: cfg.ner, stt: cfg.stt, allowedOrigins: cfg.allowedOrigins, maxBodyBytes: cfg.maxBodyBytes,
+    ner: cfg.ner, stt: cfg.stt, tts: cfg.tts, allowedOrigins: cfg.allowedOrigins, maxBodyBytes: cfg.maxBodyBytes,
     pro: cfg.pro, logRequests: cfg.logRequests, logDetail: cfg.logDetail, tools: cfg.tools,
   };
   // mode on writeFileSync only applies when CREATING the file; chmod after covers an

package/src/server.js

@@ -40,7 +40,7 @@ import * as diarizeEngine from './diarize-engine.js';
 import { MODEL_CATALOG, isKnownModel, isValidCustomModelId } from './models.js';
 import { STT_MODEL_CATALOG, isKnownSttModel, isValidCustomSttId, DEFAULT_STT_MODEL, STT_DTYPES, isValidDtype } from './stt-models.js';
 import * as ttsEngine from './tts-engine.js';
-import { TTS_MODEL_CATALOG, TTS_VOICES, isKnownTtsModel, isValidCustomTtsId, isKnownVoice, isValidVoiceId, DEFAULT_TTS_MODEL, DEFAULT_TTS_VOICE, TTS_DTYPES, isValidTtsDtype, MAX_TTS_CHARS } from './tts-models.js';
+import { TTS_MODEL_CATALOG, TTS_VOICES, isKnownTtsModel, isValidCustomTtsId, isKnownVoice, isValidVoiceId, DEFAULT_TTS_MODEL, DEFAULT_TTS_VOICE, TTS_DTYPES, isValidTtsDtype, MAX_TTS_CHARS, ttsModelHasCustomVoices } from './tts-models.js';
 import { ttsDestination, synthesizeRemote, isValidRemoteVoice } from './tts-remote.js';
 import * as ttsVoices from './tts-voices.js';
 import { resolvePro, checkQuota, consume, usage } from './freegate.js';
@@ -53,7 +53,7 @@ import * as openai from './openai.js';
 import * as responses from './responses.js';
 import * as anthropic from './anthropic.js';
 
-export const VERSION = '0.6.53';
+export const VERSION = '0.6.55';
 
 // WARM search tier — SQLite + FTS5 record store (falls back to an encrypted-JSON
 // store if SQLite can't load), fed by the extension's ingest sync + backup-ingest.
@@ -454,6 +454,16 @@ export function joinUpstream(base, pathname, search = '') {
   return b + pathname + search;
 }
 
+// Paths this gateway serves ITSELF. Used only to tell "you asked for a local
+// feature I do not have" apart from "you asked me to proxy something upstream" —
+// without it, calling a route added in a newer version reports a provider failure.
+// How long to wait for the speaker model before telling the caller to retry. Long
+// enough to cover loading one already on disk (seconds) plus a slow first fetch,
+// short enough that a stuck download does not hold a request open forever.
+const EMBEDDER_WAIT_MS = 90_000;
+
+const LOCAL_NAMESPACES = ['/tts', '/stt', '/ner', '/diarize', '/skills', '/config', '/logs', '/status', '/admin'];
+
 async function handleApi(req, res, { adapter, kind, pathname, search, base, destKey, destProtocol, harness, trace }, outBody, vault) {
   let upstream;
   const up0 = trace ? trace.clock() : 0;
@@ -989,7 +999,12 @@ export function createGateway(cfg = loadConfig()) {
           supportsVoices: ttsEngine.supportsVoices(),
           supportsCustomVoices: ttsEngine.supportsCustomVoices(),
           sampleRate: ttsEngine.sampleRate(),
-          voices: ttsEngine.arch() === 'vits' ? [] : TTS_VOICES.map((v) => ({ ...v, installed: ttsEngine.voiceOnDisk(v.id, active) })),
+          // Built-in voices belong to Kokoro alone. VITS is single-speaker and
+          // SpeechT5 speaks only in a RECORDED voice, so offering Kokoro's list
+          // for either would be offering choices that cannot take effect.
+          voices: ttsEngine.arch() && ttsEngine.arch() !== 'style-tts2'
+            ? []
+            : TTS_VOICES.map((v) => ({ ...v, installed: ttsEngine.voiceOnDisk(v.id, active) })),
           dtype: cfg.tts?.dtype || 'auto',
           loadedDtype: ttsEngine.health().dtype,
           runtime: ttsEngine.health().runtime,
@@ -1015,6 +1030,26 @@ export function createGateway(cfg = loadConfig()) {
         if (!cfg.tts) cfg.tts = { enabled: true, model: DEFAULT_TTS_MODEL, voice: DEFAULT_TTS_VOICE, allowDownload: true };
         if (id) cfg.tts.model = id;
         if (voice) cfg.tts.voice = voice;
+        // Switching model must revalidate the voice, or the config ends up naming a
+        // Kokoro voice for SpeechT5 (which then has nothing to speak in) or a
+        // recorded voice for Kokoro (which cannot use one). Both states look like
+        // "text-to-speech is broken" from the outside, and both are reachable with
+        // two clicks. Only rewrite when the CURRENT voice cannot work for the new
+        // model — never override a voice the caller just set.
+        if (id && !voice) {
+          const wantsCustom = ttsModelHasCustomVoices(id);
+          // "Is it a custom voice" is not enough — it must be one that still
+          // EXISTS. A config naming a deleted voice is exactly the state that made
+          // every later request fail with "no such saved voice".
+          const curId = ttsVoices.parseCustomVoice(cfg.tts.voice || '');
+          const isCustom = !!(curId && ttsVoices.getVoice(curId));
+          if (wantsCustom && !isCustom) {
+            const saved = ttsVoices.listVoices();
+            cfg.tts.voice = saved.length ? `custom:${saved[0].id}` : '';
+          } else if (!wantsCustom && isCustom) {
+            cfg.tts.voice = DEFAULT_TTS_VOICE;
+          }
+        }
         if (dtype) cfg.tts.dtype = dtype === 'auto' ? null : dtype;
         try { persistConfig(cfg, configPath()); } catch { /* best effort */ }
         if (id) ttsEngine.setModel(id, { onLog: (m) => console.log(m), dtype: dtype || cfg.tts.dtype || 'auto' });
@@ -1050,15 +1085,30 @@ export function createGateway(cfg = loadConfig()) {
           return sendJson(res, 400, { error: { message: 'need at least 1 second of 16 kHz mono audio', type: 'sample_too_short' } });
         }
         try {
-          // The embedder is the speaker model diarization already uses. If it is
-          // not resident yet, start it and say so — a ~100 MB download is not
-          // something to do silently while the user waits on a spinner.
+          // The embedder is the speaker model diarization already uses. WAIT for it
+          // rather than bailing: it is usually already on disk, where loading takes
+          // a couple of seconds — and the caller is holding a recording someone
+          // just made, so returning early means they lose it and record again.
+          // Only a genuine first-time download can outlast the ceiling, and that is
+          // the one case worth reporting as "come back in a moment".
           if (!diarizeEngine.isReady()) {
-            diarizeEngine.download({ onLog: (m) => console.log(m) });
-            return sendJson(res, 503, {
-              error: { message: 'the speaker model is downloading (~100 MB) — try again in a moment', type: 'embedder_not_ready' },
-              progress: diarizeEngine.progress(),
-            });
+            const load = diarizeEngine.download({ onLog: (m) => console.log(m) });
+            const timedOut = Symbol('timeout');
+            const raced = await Promise.race([
+              load.then(() => null).catch((e) => e),
+              new Promise((r) => setTimeout(() => r(timedOut), EMBEDDER_WAIT_MS)),
+            ]);
+            if (raced === timedOut || !diarizeEngine.isReady()) {
+              return sendJson(res, 503, {
+                error: {
+                  message: raced === timedOut
+                    ? 'the speaker model is still downloading (~100 MB) — your recording was kept, press Save again shortly'
+                    : `the speaker model failed to load: ${diarizeEngine.health().error || 'unknown error'}`,
+                  type: 'embedder_not_ready',
+                },
+                progress: diarizeEngine.progress(),
+              });
+            }
           }
           const vec = await diarizeEngine.embed(Float32Array.from(pcm));
           const saved = ttsVoices.saveVoice({ name, vec });
@@ -1071,7 +1121,16 @@ export function createGateway(cfg = loadConfig()) {
       if (req.method === 'DELETE') {
         const id = url.searchParams.get('id') || '';
         // Deleting someone's voice print is not a soft delete — the file is gone.
-        return sendJson(res, 200, { deleted: ttsVoices.deleteVoice(id) });
+        const deleted = ttsVoices.deleteVoice(id);
+        // …and the config must not keep NAMING it. A stored voice that no longer
+        // exists makes every later request fail with "no such saved voice", which
+        // is a confusing way to be told "you deleted that one".
+        if (deleted && cfg.tts?.voice === `custom:${id}`) {
+          const left = ttsVoices.listVoices();
+          cfg.tts.voice = left.length ? `custom:${left[0].id}` : DEFAULT_TTS_VOICE;
+          try { persistConfig(cfg, configPath()); } catch { /* best effort */ }
+        }
+        return sendJson(res, 200, { deleted, voice: cfg.tts?.voice });
       }
     }
 
@@ -1098,22 +1157,12 @@ export function createGateway(cfg = loadConfig()) {
       // not a Kokoro one), so the local catalog check would reject every valid id.
       const rawVoice = body && typeof body.voice === 'string' && body.voice.trim() ? body.voice.trim() : null;
       const voice = rawVoice || (dest ? dest.voice : (cfg.tts?.voice || DEFAULT_TTS_VOICE));
-      // `custom:<id>` names a saved voice. It is resolved to an embedding here so
-      // the engine never has to know where voices are stored.
-      const customId = dest ? null : ttsVoices.parseCustomVoice(voice);
-      let speakerEmbedding = null;
-      if (customId) {
-        const rec = ttsVoices.getVoice(customId);
-        if (!rec) return sendJson(res, 404, { error: { message: 'no such saved voice', type: 'bad_voice' } });
-        if (!ttsEngine.supportsCustomVoices() && ttsEngine.isReady()) {
-          return sendJson(res, 409, { error: { message: `the active model (${ttsEngine.arch()}) cannot use a recorded voice — switch to SpeechT5`, type: 'voice_unsupported' } });
-        }
-        speakerEmbedding = rec.vec;
+      // A REMOTE destination has its own voice namespace, so it is validated here;
+      // local voices cannot be resolved until the model is loaded, because which
+      // KIND of voice is valid depends on the architecture. See below.
+      if (dest && !isValidRemoteVoice(voice)) {
+        return sendJson(res, 400, { error: { message: 'unknown or invalid voice', type: 'bad_voice' } });
       }
-      const voiceOk = customId ? true
-        : dest ? isValidRemoteVoice(voice)
-          : (isKnownVoice(voice) && isValidVoiceId(voice));
-      if (!voiceOk) return sendJson(res, 400, { error: { message: 'unknown or invalid voice', type: 'bad_voice' } });
       // We synthesize WAV only. Say so rather than returning WAV bytes under an mp3
       // content-type — a client that trusts the header would play noise.
       const fmt = body && typeof body.response_format === 'string' ? body.response_format.toLowerCase() : 'wav';
@@ -1148,7 +1197,52 @@ export function createGateway(cfg = loadConfig()) {
           dtype: cfg.tts?.dtype || 'auto',
         });
         if (!ok) return sendJson(res, 503, { error: { message: ttsEngine.health().error || 'tts model not ready', type: 'tts_unavailable' } });
-        const pcm = await ttsEngine.synth(text, { voice, speed, speakerEmbedding });
+        // Voices are resolved AFTER the model is up, because what counts as a valid
+        // voice is a property of the architecture: Kokoro takes a style-bank name,
+        // SpeechT5 takes a recorded embedding, VITS takes neither. Resolving first
+        // meant a `custom:` voice could reach a freshly-loaded Kokoro and fail deep
+        // in the engine with "invalid voice id".
+        let useVoice = voice;
+        let speakerEmbedding = null;
+        let customId = ttsVoices.parseCustomVoice(voice);
+
+        if (ttsEngine.supportsCustomVoices()) {
+          // This model speaks ONLY in a recorded voice. If the configured one names
+          // a built-in (switching model does not rewrite `voice`) or points at a
+          // voice since deleted, fall back to the most recent saved one — the
+          // caller asked to be spoken to, not for that exact voice. A voice named
+          // EXPLICITLY in the request still fails loudly.
+          let rec = customId ? ttsVoices.getVoice(customId) : null;
+          if (!rec && !rawVoice) {
+            const saved = ttsVoices.listVoices();
+            if (saved.length) { customId = saved[0].id; rec = ttsVoices.getVoice(customId); }
+          }
+          if (!rec) {
+            return sendJson(res, customId ? 404 : 400, {
+              error: {
+                message: customId ? 'no such saved voice' : 'this model speaks in a voice you record — add one in Settings → Text-to-speech',
+                type: 'bad_voice',
+              },
+            });
+          }
+          speakerEmbedding = rec.vec;
+          useVoice = `custom:${customId}`;
+        } else if (customId) {
+          // Explicitly asked for a recorded voice this model cannot use — say so.
+          // Inherited from config, though, it is just a stale setting, and refusing
+          // to speak at all is a worse answer than speaking in the default voice.
+          if (rawVoice) {
+            return sendJson(res, 409, {
+              error: { message: `the active model (${ttsEngine.arch()}) cannot use a recorded voice — switch to SpeechT5`, type: 'voice_unsupported' },
+            });
+          }
+          customId = null;
+          useVoice = DEFAULT_TTS_VOICE;
+        } else if (ttsEngine.supportsVoices() && !(isKnownVoice(useVoice) && isValidVoiceId(useVoice))) {
+          return sendJson(res, 400, { error: { message: 'unknown or invalid voice', type: 'bad_voice' } });
+        }
+
+        const pcm = await ttsEngine.synth(text, { voice: useVoice, speed, speakerEmbedding });
         // The ACTIVE model's rate, not the constant: a VITS/MMS model emits 16 kHz
         // and writing it into a 24 kHz header plays it fast and chipmunked.
         const rate = ttsEngine.sampleRate();
@@ -1158,6 +1252,7 @@ export function createGateway(cfg = loadConfig()) {
           'Content-Length': String(out.length),
           'Cache-Control': 'no-store',
           'X-Tts-Sample-Rate': String(rate),
+          ...(customId ? { 'X-Tts-Voice': `custom:${customId}` } : {}),
         });
         return res.end(out);
       } catch (e) {
@@ -1289,6 +1384,20 @@ export function createGateway(cfg = loadConfig()) {
       return sendJson(res, 200, await aggregateModelsAsync(cfg));
     }
 
+    // Anything under a LOCAL namespace that reached here matched no route, which
+    // almost always means the caller is newer than this gateway. Falling through to
+    // the model proxy makes that arrive as "upstream fetch failed", pointing the
+    // user at their model provider for a feature their gateway simply does not
+    // have yet — so these 404 with the actual reason instead.
+    if (LOCAL_NAMESPACES.some((ns) => pathname === ns || pathname.startsWith(`${ns}/`))) {
+      return sendJson(res, 404, {
+        error: {
+          message: `this gateway (${VERSION}) has no ${pathname} — update it to use this feature`,
+          type: 'unknown_endpoint',
+        },
+      });
+    }
+
     const r = route(pathname, req.headers, cfg);
     let raw;
     try {