@fastagent-sh/voicenote 0.18.3 → 0.18.5

package/README.md

@@ -6,7 +6,7 @@ CLI command: `vn`
 
 [中文文档 / Chinese documentation](README.zh-CN.md)
 
-Currently tuned for the PHILIPS VTR6500 voice recorder, but the workflow is generic: scan recordings under a mount point → transcribe with speaker diarization → GPT performs the necessary cleanup and process reconstruction inside the notes-generation stage → produce smart notes.
+Currently tuned for the PHILIPS VTR6500 voice recorder, but the workflow is generic: scan recordings under a mount point → transcribe with speaker diarization → the selected summary model performs cleanup and process reconstruction → produce smart notes.
 
 **Two ways to use it:**
 
@@ -130,6 +130,24 @@ provider that actually failed. If that empties the chain, `vn run --mode notes`
 skips instead of paying for a transcript whose summary cannot happen.
 `vn doctor` prints the effective chain and the status of anything not ready.
 
+### DeepSeek notes
+
+In the desktop app, open **Settings → Notes generation**, select **DeepSeek API**, enter your API key, and save. The model defaults to `deepseek-v4-flash`; enter `deepseek-v4-pro` to use Pro. ChatGPT sign-in is only shown for configurations that use ChatGPT. Audio transcription continues to use Volcano.
+
+For the CLI, merge these values into `~/.config/voicenote/config.json`:
+
+```json
+{
+  "VOICENOTE_PI_PROVIDER": "deepseek",
+  "VOICENOTE_PI_MODEL_SUMMARY": "deepseek-v4-flash",
+  "DEEPSEEK_API_KEY": "..."
+}
+```
+
+The notes-specific model setting takes precedence over `VOICENOTE_PI_MODEL`. When switching providers in the GUI, the model resets to that provider's default. API keys can also come from pi's authentication file or the environment; pi's authentication file takes priority over API-key environment variables.
+
+Save changes, then check `vn doctor` or the app's Status panel. Credential checks confirm configuration, not API connectivity or account balance. Each provider in a fallback chain receives the same model ID, so configure DeepSeek on its own rather than mixing it with OpenAI.
+
 ## Usage
 
 ```bash
@@ -176,7 +194,9 @@ The install script writes an editable template:
 }
 ```
 
-Changes take effect on the next `vn run`. A legacy `~/.config/voicenote/speakers.json` is still read as a compatibility fallback.
+Changes take effect on the next `vn run`. Config values and unquoted/double-quoted `.zshrc` exports support simple `$VAR` / `${VAR}` references to other settings and `$HOME`. Single-quoted shell values stay literal. Shell commands are never executed. Runtime references honor inherited environment values; scheduler comparisons resolve from files alone.
+
+A legacy `~/.config/voicenote/speakers.json` is still read as a compatibility fallback.
 
 ## Workflow
 
@@ -219,7 +239,7 @@ The LaunchAgent invokes `vn run` every 60 seconds. It skips safely when no recor
 
 > Config changes (`config.json` or `~/.zshrc`) are picked up automatically by the background agent on its next run — no reinstall needed. The plist only snapshots real environment variables and pi's absolute path: **after changing `VOICENOTE_PI_BIN`, re-run `vn install-launch-agent` and reload** (`vn upgrade` regenerates the plist automatically). If pi is not signed in or ASR is not configured, the agent skips processing instead of burning ASR spend.
 >
-> Exception: if you `export http_proxy=...` directly in your shell (instead of using `LOCAL_PROXY_HOST`) and then run `vn install-launch-agent`, that real env value is snapshotted into the plist and keeps overriding later `LOCAL_PROXY_HOST` changes; re-run `vn install-launch-agent` to clear it. Prefer `LOCAL_PROXY_HOST`/`LOCAL_PROXY_PORT` for proxy configuration.
+> Proxy values that match the file configuration, including expanded variable references, are not embedded and produce no override warning. Values supplied only by the shell, or differing from the files, are embedded as explicit overrides. To clear an unwanted override, update or unset the shell variable, then run `vn install-launch-agent --load`. Prefer `LOCAL_PROXY_HOST`/`LOCAL_PROXY_PORT` in `config.json` for proxy configuration.
 
 Logs:
 
@@ -259,7 +279,7 @@ A self-contained macOS `.app` (Tauri v2) for **non-terminal users**: the target
 
 **Positioning**: the GUI is only a "status dashboard + quick access to output" — it does **not** drive processing. The full pipeline runs autonomously every 60s via the background LaunchAgent using the bundled engine (it keeps running with the GUI closed).
 
-- First run: setup wizard (identity / Volcano keys / proxy) → ChatGPT sign-in (no terminal on the device; uses `vn login`'s browser-callback flow)
+- First run: settings (identity / Volcano keys / notes provider / proxy). Choose DeepSeek with an API key, or ChatGPT with browser sign-in (`vn login`'s browser-callback flow).
 - After that: the main view shows agent activity + recent notes (open note / open folder)
 
 ### What's bundled
@@ -271,7 +291,7 @@ A self-contained macOS `.app` (Tauri v2) for **non-terminal users**: the target
 | `vn` (compiled) | externalBin | pipeline + ChatGPT sign-in |
 | `bun` | externalBin | runs pi |
 | `ffprobe` (native arm64 static) | externalBin | audio duration (pi only needs ffprobe, not all of ffmpeg) |
-| `pi` + node_modules | resource | notes backend (ChatGPT Codex agent) |
+| `pi` + node_modules | resource | notes backend (ChatGPT, OpenAI API, or DeepSeek) |
 
 At runtime, Rust generates a wrapper (`exec <bundled bun> <bundled pi/cli.js> "$@"`) and injects `VOICENOTE_PI_BIN` / `VOICENOTE_FFPROBE_BIN` into `vn`. Release builds are **universal** (x86_64 + arm64; vn/bun/ffprobe each merged with `lipo`; pi is JS and needs none).
 
@@ -317,12 +337,14 @@ irm https://raw.githubusercontent.com/fastagent-sh/voicenote/main/scripts/instal
 
 `install-app.sh` downloads the packaged `.app` from GitHub Releases → installs to `/Applications` → **removes the quarantine flag for the user** (Gatekeeper bypass for un-notarized builds) → opens it. The target machine needs no bun/pi/ffprobe/global vn (all bundled).
 
-**First launch**: the app lands on Settings → fill in identity + your own Volcano ASR/TOS keys + proxy (BYOK) → save → click "Sign in to ChatGPT" in the Status panel (one-time browser authorization). The GUI then installs and loads the background LaunchAgent (pointing at the bundled engine); plug in the recorder and transcription + notes happen automatically.
+**First launch**: the app lands on Settings. Fill in identity, your Volcano ASR/TOS keys, notes provider/model, and proxy as needed. For DeepSeek or OpenAI API, enter the corresponding API key; for ChatGPT, save and click "Sign in to ChatGPT" in the Status panel. Saving installs and loads the background LaunchAgent using the bundled engine. Once credentials are configured, plug in the recorder for automatic transcription and notes.
 
 > The background agent label is `sh.fastagent.voicenote` (same as the CLI version; only one exists per machine). If the `.app` is moved, open it once to recalibrate the plist.
 
 **Upgrades**: since 0.1.9 the app has a built-in updater — open the app → "Settings → Software update" → "Check for updates"; when a new version appears, click "Download & install"; the app restarts automatically with config/notes preserved. For first installs, or upgrades from 0.1.8 and earlier (which had no updater), re-run the one-line install script above.
 
+> **Windows, from 0.1.11 or earlier**: those builds point their updater at the pre-rebrand repo, which still exists and stops at 0.1.11 — "Check for updates" therefore always reports "up to date". The bundle identifier changed in the same rebrand, so re-running the installer does *not* replace them; both copies stay installed under the same name. Uninstall the old VoiceNote (Settings → Apps) first, then run the one-line install. Config and notes are untouched by the uninstall.
+
 ### Maintainers: packaging + release
 
 **Automatic (recommended)**: push an `app-v*` tag to trigger `.github/workflows/release-app.yml`:

package/README.zh-CN.md

@@ -321,6 +321,8 @@ irm https://raw.githubusercontent.com/fastagent-sh/voicenote/main/scripts/instal
 
 **升级**:0.1.9 起内置自动更新 —— 打开 app →「设置 → 软件更新」→「检查更新」，有新版点「下载并安装」，装好自动重启，配置/纪要均保留。首次安装、或从 0.1.8 及更早版本升级（它们还没有更新器），重跑上面的一键安装脚本即可。
 
+> **Windows 从 0.1.11 及更早版本升级**：这些构建的更新地址指向改名前的旧仓库，而旧仓库至今存在、最新版停在 0.1.11，所以「检查更新」永远显示已是最新。同一次改名还换了 bundle identifier，重跑安装脚本**不会**覆盖旧版，两份会同名共存。先在「设置 → 应用」里卸载旧的 VoiceNote，再跑一键安装。卸载不影响配置和纪要。
+
 ### 维护者:打包 + 发布
 
 **自动(推荐)**:打 `app-v*` tag 触发 `.github/workflows/release-app.yml`:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fastagent-sh/voicenote",
-  "version": "0.18.3",
+  "version": "0.18.5",
   "description": "Voice recordings → diarized transcripts → integrated semantic Markdown notes. Currently optimized for the PHILIPS VTR6500 recorder, but the workflow is generic.",
   "type": "module",
   "license": "MIT",

package/src/cli.ts

@@ -2,7 +2,7 @@
 import { cac } from 'cac'
 import { deriveNoProxy, envKeysToEmbed, hydrateFromFileEnv, parseFileEnv } from './envConfig'
 import { parseLockOwner } from './runLock'
-import { parsePiAuthStatus, parseProviderChain, usableChain, type PiAuthStatus } from './piProvider'
+import { defaultPiModel, parsePiAuthStatus, parseProviderChain, usableChain, type PiAuthStatus } from './piProvider'
 import { applyOutcome, buildJobsView, classify, emptyState, localIso, MAX_ATTEMPTS, migrateLegacyState, ownsOutput, parseJobsLimit, parseStateFile, parseStrictJson, patchJob, pruneUnseen, reconcileInterrupted, startAttempt, SUMMARY_FAILED_STATUS, type CurrentJob, type JobRecord, type StateFile } from './jobs'
 import { createHash, createHmac, randomUUID } from 'node:crypto'
 import { appendFile, chmod, mkdir, readFile, writeFile, copyFile, rename, unlink, stat, readdir, rm } from 'node:fs/promises'
@@ -13,7 +13,7 @@ import { fileURLToPath, pathToFileURL } from 'node:url'
 import { spawn, spawnSync } from 'node:child_process'
 import os from 'node:os'
 
-const VERSION = '0.18.3'
+const VERSION = '0.18.5'
 const LAUNCH_AGENT_LABEL = 'sh.fastagent.voicenote'
 const LAUNCH_AGENT_LABEL_LEGACY = 'com.kid7st.voicenote' // pre-fastagent installs; cleaned up on install
 const TASK_NAME = 'VoiceNote'   // Windows Task Scheduler name (mac uses LAUNCH_AGENT_LABEL)
@@ -137,6 +137,7 @@ const ENV_KEYS = [
   'HTTP_PROXY', 'HTTPS_PROXY', 'ALL_PROXY', 'NO_PROXY',
   'LOCAL_PROXY_HOST', 'LOCAL_PROXY_PORT', 'LOCAL_NO_PROXY',
   'OPENAI_API_KEY',
+  'DEEPSEEK_API_KEY',
 ]
 
 // Volcano endpoints (TOS object storage + openspeech ASR) should NEVER go through
@@ -208,20 +209,21 @@ function applyDerivedProxy(): void {
   }
 }
 
-// What the config files would provide for each ENV_KEY, independent of this
-// process's environment. Primary source is ~/.config/voicenote/config.json
+// File values for each ENV_KEY. Hydration passes the current environment for
+// variable references; scheduler comparison uses files alone. Primary source is
+// ~/.config/voicenote/config.json
 // (ENV-style runtime keys at the top level; identity under `speakers`); the
 // legacy fallback is `export KEY=...` lines in ~/.zshrc, for CLI installs
 // that predate config.json. Precedence/expansion logic lives in envConfig.ts
 // (pure + tested). Two consumers: loadEnvConfig() hydrates these into
 // process.env for keys the real environment doesn't set, and launchAgentEnv()
 // uses them to decide which values are recoverable at run time.
-function fileProvidedEnv(): Record<string, string> {
+function fileProvidedEnv(environment: Record<string, string | undefined> = {}): Record<string, string> {
   const data = loadJsonSync<Record<string, unknown>>(CONFIG_ENV_PATH, {})
   let zshrc: string | null = null
   const zshrcPath = join(os.homedir(), '.zshrc')
   if (existsSync(zshrcPath)) { try { zshrc = readFileSync(zshrcPath, 'utf8') } catch { zshrc = null } }
-  return parseFileEnv(ENV_KEYS, data, zshrc, os.homedir())
+  return parseFileEnv(ENV_KEYS, data, zshrc, os.homedir(), environment)
 }
 
 let envConfigLoaded = false
@@ -230,7 +232,7 @@ function loadEnvConfig(): void {
   envConfigLoaded = true
   // Precedence: process.env > config.json (GUI) > ~/.zshrc (legacy); an
   // explicit empty string in the environment is never overridden.
-  const toApply = hydrateFromFileEnv(ENV_KEYS, process.env, fileProvidedEnv())
+  const toApply = hydrateFromFileEnv(ENV_KEYS, process.env, fileProvidedEnv(process.env))
   for (const [key, v] of Object.entries(toApply)) { process.env[key] = v; hydratedEnvKeys.add(key) }
   // Derive http_proxy etc. from LOCAL_PROXY_HOST/PORT regardless of source, and
   // always keep Volcano hosts on NO_PROXY. (Runs even with no config files.)
@@ -1493,7 +1495,8 @@ function piProviderAuthStatus(provider: string): PiAuthStatus {
   const cached = piAuthStatusCache.get(provider)
   if (cached && Date.now() - cached.at < PI_AUTH_TTL_MS) return cached.status
   const inv = piInvocation(['auth', 'check', '--provider', provider, '--json'])
-  const out = spawnSync(inv.bin, inv.args, { encoding: 'utf8', timeout: PI_AUTH_PROBE_MS, windowsHide: true })
+  // Bun's spawnSync needs an explicit env to inherit keys loaded from config.json.
+  const out = spawnSync(inv.bin, inv.args, { encoding: 'utf8', timeout: PI_AUTH_PROBE_MS, windowsHide: true, env: process.env })
   // No pi binary is deterministic evidence in its own right — next run gets the
   // same answer — so it belongs with 'unusable', not with a probe that timed out.
   const status = (out.error as NodeJS.ErrnoException | undefined)?.code === 'ENOENT'
@@ -1524,7 +1527,7 @@ function piProviderFor(): string {
 }
 
 function piCodexModelFor(): string {
-  return process.env.VOICENOTE_PI_MODEL_SUMMARY || process.env.VOICENOTE_PI_MODEL || 'gpt-5.5'
+  return process.env.VOICENOTE_PI_MODEL_SUMMARY || process.env.VOICENOTE_PI_MODEL || defaultPiModel(piConfiguredProviders()[0]!)
 }
 
 function stripJsonFences(text: string): string {
@@ -1661,7 +1664,7 @@ function piSummaryToolsHint(contextDir: string): string {
   return `Before writing the notes you have two read-only tools: read and grep. Your current working directory (cwd) is \`${contextDir}\` (the configured notes/reference directory); use relative paths for grep/read.\n\nGoal: use existing context to align names, speakers, client/project names, product names, and domain terms in this note; do not maintain or assume a separate glossary.\n\nSuggested flow:\n- First extract the most likely client/project/product keywords from the title, filename, and transcript.\n- If a clear topic matches, prefer grep/read on related index pages, project docs, status records, or the 3-5 most recent related notes in the same directory; use them to identify Speaker B/C/F etc., common aliases, product names, and term spellings.\n- If no clear topic matches, grep the current directory with keywords and read only the few most relevant files.\n- Before output, do one names/terms lint pass: eliminate leftover Speaker A/B/C, obviously misheard names, product-name variants, and outdated names; when context is insufficient, keep the uncertainty — never guess.\n\nConstraints:\n- At most 10 tool calls total; if the transcript alone is sufficient, make none.\n- Read only within \`${contextDir}\`; skip directories that clearly involve personal privacy/credentials/finance (e.g. identity / credentials / finance).\n- Found information is only for consistency and background calibration; never write content absent from this transcript into the notes as new meeting facts.\n- Do not attempt to write files or call bash (those tools are not enabled).`
 }
 
-// Summary runs on the pi-codex backend. The agent's working dir IS the knowledge
+// Summary runs through pi with the configured provider. The agent's working dir IS the knowledge
 // base, so read/grep/find operate there directly. If a configured context dir is
 // missing, say so loudly and run without tools rather than searching the wrong
 // tree (tools, the cwd hint, and the spawn cwd move together).
@@ -2248,12 +2251,6 @@ async function launchAgentEnv(): Promise<Record<string, string>> {
   // about: it may equally be a stale shell session, and it will keep
   // overriding config edits until the scheduler is reinstalled.
   //
-  // Known blind spot: the matrix compares each key against its OWN file value,
-  // so it can't see cross-key derivations. A real-env http_proxy is embedded
-  // as-is and will shadow a GUI edit to LOCAL_PROXY_HOST (different key name)
-  // until reinstall. Only no_proxy is special-cased (originals below) because
-  // WE synthesize it; http_proxy from a user's shell is left as a real value.
-  //
   // no_proxy/NO_PROXY carry a volcano-hosts merge we added; substitute the
   // pre-merge real-env original (or drop it entirely if we synthesized the
   // whole value) so the scheduler never freezes our merge over config edits.
@@ -2263,7 +2260,7 @@ async function launchAgentEnv(): Promise<Record<string, string>> {
   const { embed, frozenOverrides } = envKeysToEmbed(ENV_KEYS, embedEnv, hydratedEnvKeys, fileEnv)
   Object.assign(env, embed)
   for (const k of frozenOverrides) {
-    console.error(`Warning: environment ${k} differs from the config file value; the environment value is snapshotted into the scheduler and will override config edits until you re-run \`vn install-launch-agent\`.`)
+    console.error(`Warning: environment ${k} overrides the config file. Update or unset it, then re-run \`vn install-launch-agent --load\` to apply the intended value.`)
   }
   // Embed pi's ABSOLUTE path so launchd resolves it regardless of the fixed plist
   // PATH (npm global bin can live outside it under nvm / custom prefixes). Resolve
@@ -2753,8 +2750,8 @@ async function collectDoctor() {
   const ff = await runCommand(ffprobeBin(), ['-version'], 5000)
   const v = config.volcano
   const tools = piSummaryTools()
-  // Configured vs effective, plus per-provider status: "why did my chain shrink"
-  // and "why is my misspelled provider still listed" are the same question.
+  // An explicit status refresh must see newly saved keys and OAuth logins.
+  piAuthStatusCache.clear()
   const configuredProviders = piConfiguredProviders()
   const effectiveProviders = piProviderCandidates()
   const providerStatus = Object.fromEntries(configuredProviders.map(p => [p, piProviderAuthStatus(p)]))
@@ -2989,7 +2986,7 @@ async function serve(): Promise<void> {
 
 const cli = cac('vn')
 
-cli.command('run', 'Scan recorder and process recordings (Volcano ASR + pi-codex notes)')
+cli.command('run', 'Scan recorder and process recordings (Volcano ASR + pi notes)')
   .option('--mode <mode>', 'Output mode: notes (default) | transcript', { default: 'notes' })
   .option('--latest', 'Only process newest eligible recording')
   .option('--force', 'Reprocess already processed recordings')

package/src/envConfig.ts

@@ -1,8 +1,9 @@
 // Pure logic behind cli.ts's env-config provenance. Extracted (no fs, no
 // process.env) so its invariants are testable — see envConfig.test.ts:
 //
-// 1. File precedence: config.json (GUI) wins over ~/.zshrc (legacy CLI);
-//    $HOME tokens are expanded in both.
+// 1. File precedence: config.json (GUI) wins over ~/.zshrc (legacy CLI).
+//    Simple $VAR/${VAR} references resolve from these values without running
+//    shell code; runtime hydration may also use inherited environment values.
 // 2. Hydration: only keys the real environment does NOT set are filled from
 //    files — an explicit empty string in the environment (e.g.
 //    VOICENOTE_PI_SUMMARY_TOOLS="") counts as set and is never overridden.
@@ -17,28 +18,46 @@
 //    warn: it may equally be a stale shell session shadowing a fresh config
 //    edit, and it will keep overriding until the scheduler is reinstalled.
 
-/** File-provided values for `keys`: config.json over zshrc, $HOME expanded. */
+/** Omit `environment` when checking which values files can reproduce on their own. */
 export function parseFileEnv(
   keys: readonly string[],
   configData: Record<string, unknown>,
   zshrcContent: string | null,
   home: string,
+  environment: Record<string, string | undefined> = {},
 ): Record<string, string> {
-  const out: Record<string, string> = {}
-  const expand = (v: string) => v.replace(/\$\{?HOME\}?/g, home)
+  const raw = new Map<string, string>()
+  const literal = new Set<string>()
   for (const key of keys) {
     const v = configData[key]
-    if (typeof v === 'string') out[key] = expand(v)
+    if (typeof v === 'string') { raw.set(key, v); continue }
+    const pattern = new RegExp(`(?:^|\\n)\\s*export\\s+${key}=(?:"([^"]*)"|'([^']*)'|([^\\s"'#]+))`)
+    const match = zshrcContent?.match(pattern)
+    const value = match?.slice(1).find(v => v !== undefined)
+    if (value !== undefined) raw.set(key, value)
+    if (match?.[2] !== undefined) literal.add(key)
   }
-  if (zshrcContent !== null) {
-    for (const key of keys) {
-      if (out[key] !== undefined) continue // config.json wins
-      const pattern = new RegExp(`(?:^|\\n)\\s*export\\s+${key}=(?:"([^"]*)"|'([^']*)'|([^\\s"'#]+))`)
-      const value = zshrcContent.match(pattern)?.slice(1).find(v => v !== undefined)
-      if (value !== undefined) out[key] = expand(value)
-    }
+  const resolved = new Map<string, string>()
+  const visiting = new Set<string>()
+  const resolve = (key: string): string => {
+    const cached = resolved.get(key)
+    if (cached !== undefined) return cached
+    if (visiting.has(key)) throw new Error(`Circular config variable reference: ${key}`)
+    visiting.add(key)
+    const value = raw.get(key)!
+    const expanded = literal.has(key) ? value : value.replace(/\\(\$)|\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))/g, (token, escaped, braced, bare) => {
+      if (escaped) return escaped
+      const ref = braced || bare
+      if (ref === 'HOME') return home
+      // Unknown references stay literal, so they cannot look recoverable from files.
+      if (Object.hasOwn(environment, ref) && environment[ref] !== undefined) return environment[ref]!
+      return raw.has(ref) ? resolve(ref) : token
+    })
+    visiting.delete(key)
+    resolved.set(key, expanded)
+    return expanded
   }
-  return out
+  return Object.fromEntries(Array.from(raw.keys(), key => [key, resolve(key)]))
 }
 
 /** Which keys to copy from fileEnv into an environment (invariant 2). */

package/src/piProvider.ts

@@ -3,6 +3,10 @@
 
 export const DEFAULT_PI_PROVIDERS = ['openai-codex', 'openai']
 
+export function defaultPiModel(provider: string): string {
+  return provider === 'deepseek' ? 'deepseek-v4-flash' : 'gpt-5.5'
+}
+
 export function parseProviderChain(raw: string | undefined): string[] {
   const parsed = Array.from(new Set((raw ?? '').split(',').map(s => s.trim()).filter(Boolean)))
   return parsed.length ? parsed : [...DEFAULT_PI_PROVIDERS]