@goodandready/dsh-tts 0.4.31 → 0.4.33

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # Changelog
 
+## 0.4.33 (2026-10-11)
+
+- **SSE Stream Watchdog**: Added idle timeout watchdog (30s) in Web player (`lib/client-src/20-player.js`) to automatically trigger reconnect on stale/frozen EventSource connection (#206).
+- **Engine Manager Cleanup**: Added explicit `removeEventListener('abort', ...)` in `execute` finally block for model downloads in `lib/engines/manager.js` (#206).
+- **Updater Testing**: Added behavioral test capturing `child_process.spawn` arguments during `/api/dsh-tts/update` execution verifying no bypass of minimum release age (#206).
+- **Client Bundle**: Rebuilt `lib/client.js` from canonical client-src fragments with idle watchdog.
+
+## 0.4.32
+
+### Fixed
+- **Transactional Rollback on Credential Failure** (#151):
+  - Added transactional rollback to previous config in `/dsh-tts/config` PUT handler if credential persistence throws an error after settings replacement, ensuring consistent state on aborted saves.
+- **Messenger Gateway / Speak Guard Strictness** (#165):
+  - Enforced 403 rejection for unclassified / external gateway requests lacking channel metadata when `messengerTtsEnabled` is disabled, while preserving internal web UI and voice duplex traffic.
+- **Strict Multi-Format Model Integrity Validation** (#179):
+  - Enhanced `validateFileIntegrity` to reject uniform repeating byte sequences of any value, strictly validate JSON parsing for voice mappings, enforce ONNX protobuf header magic (`0x08`), and validate safetensors header length bounds.
+- **Non-Tautological Test Suite Enforcement** (#181):
+  - Replaced tautological and assertion-free test fixtures in deduplication, client prebuffering, and SSE player suites with strict assertions verifying exact execution counts (`synthCalls === 1`), factory invocation, and queue limits.
+- **Immediate Pre-Write SSE Chunk Cap** (#186):
+  - Added immediate buffer cap rejection before `res.write` in `safeWrite`, preventing oversized payloads (>512 KB) from entering the socket buffer even on the initial chunk.
+- **Cache L2 Clear Concurrency Guard** (#202):
+  - Captured generation token at the immediate start of `get()`, preventing post-clear metadata recreation when disk reads are interleaved with cache clearing.
+
 ## 0.4.31
 
 ### Fixed

package/lib/cache.js

@@ -137,6 +137,7 @@ export function createSpeechCache({ root, maxBytes }) {
     },
 
     async get(key) {
+      const currentGen = generation
       // 1. L1 RAM Hit
       if (l1Map.has(key)) {
         const hit = l1Map.get(key)
@@ -145,15 +146,16 @@ export function createSpeechCache({ root, maxBytes }) {
         l1Map.set(key, { ...hit, at: now })
         const d = diskEntries.get(key)
         if (d) d.at = now
-        const currentGen = generation
-        const writePromise = (async () => {
-          if (currentGen !== generation) return
-          await fs.promises.writeFile(path.join(dir, key + '.json'), JSON.stringify({ mime: hit.mime, at: now }))
-          if (currentGen !== generation) {
-            await fs.promises.rm(path.join(dir, key + '.json'), { force: true }).catch(() => {})
-          }
-        })().catch(() => {})
-        trackWrite(writePromise)
+        if (currentGen === generation) {
+          const writePromise = (async () => {
+            if (currentGen !== generation) return
+            await fs.promises.writeFile(path.join(dir, key + '.json'), JSON.stringify({ mime: hit.mime, at: now }))
+            if (currentGen !== generation) {
+              await fs.promises.rm(path.join(dir, key + '.json'), { force: true }).catch(() => {})
+            }
+          })().catch(() => {})
+          trackWrite(writePromise)
+        }
         return { mime: hit.mime || 'audio/mpeg', audio: hit.audio }
       }
 
@@ -162,19 +164,20 @@ export function createSpeechCache({ root, maxBytes }) {
       try {
         const meta = JSON.parse(await fs.promises.readFile(path.join(dir, key + '.json'), 'utf8'))
         const audio = await fs.promises.readFile(path.join(dir, key + AUDIO_EXT))
-        putL1(key, meta.mime, audio)
-        const now = Date.now()
-        const d = diskEntries.get(key)
-        if (d) d.at = now
-        const currentGen = generation
-        const writePromise = (async () => {
-          if (currentGen !== generation) return
-          await fs.promises.writeFile(path.join(dir, key + '.json'), JSON.stringify({ mime: meta.mime, at: now }))
-          if (currentGen !== generation) {
-            await fs.promises.rm(path.join(dir, key + '.json'), { force: true }).catch(() => {})
-          }
-        })().catch(() => {})
-        trackWrite(writePromise)
+        if (currentGen === generation) {
+          putL1(key, meta.mime, audio)
+          const now = Date.now()
+          const d = diskEntries.get(key)
+          if (d) d.at = now
+          const writePromise = (async () => {
+            if (currentGen !== generation) return
+            await fs.promises.writeFile(path.join(dir, key + '.json'), JSON.stringify({ mime: meta.mime, at: now }))
+            if (currentGen !== generation) {
+              await fs.promises.rm(path.join(dir, key + '.json'), { force: true }).catch(() => {})
+            }
+          })().catch(() => {})
+          trackWrite(writePromise)
+        }
         return { mime: meta.mime || 'audio/mpeg', audio }
       } catch (miss) {
         return null

package/lib/client.js

@@ -527,17 +527,36 @@ window.__ModuleLoader__.load({
       return () => window.removeEventListener('dsh-voice:speaking', onSpeaking)
     }
 
-    // Unified SSE Realtime Stream Connection (#158)
+    // Unified SSE Realtime Stream Connection (#158, #206)
     let activeSse = null
     let activeSseAttempt = 0
     let activeSseTimer = null
+    let activeSseWatchdog = null
     let sseDisposed = false
+    const SSE_IDLE_TIMEOUT_MS = 30000
 
     function startSseStream() {
       if (typeof window === 'undefined' || typeof window.EventSource === 'undefined') return () => {}
       sseDisposed = false
 
+      const resetWatchdog = () => {
+        if (activeSseWatchdog) clearTimeout(activeSseWatchdog)
+        if (sseDisposed) return
+        activeSseWatchdog = setTimeout(() => {
+          if (activeSse && !sseDisposed) {
+            try {
+              if (typeof activeSse.onerror === 'function') {
+                activeSse.onerror(new Event('error'))
+              } else {
+                activeSse.close()
+              }
+            } catch (_err) { /* error trigger ignore */ }
+          }
+        }, SSE_IDLE_TIMEOUT_MS)
+      }
+
       const onItem = (e) => {
+        resetWatchdog()
         try {
           const item = JSON.parse(e.data)
           if (!item || !item.id) return
@@ -556,6 +575,7 @@ window.__ModuleLoader__.load({
       }
 
       const onChime = (e) => {
+        resetWatchdog()
         try {
           const item = JSON.parse(e.data)
           if (!item) return
@@ -567,6 +587,7 @@ window.__ModuleLoader__.load({
 
       const connect = () => {
         if (sseDisposed) return
+        if (activeSseWatchdog) { clearTimeout(activeSseWatchdog); activeSseWatchdog = null }
         if (activeSse) {
           try { activeSse.close() } catch (_err) { /* active sse already closed */ }
           activeSse = null
@@ -574,10 +595,15 @@ window.__ModuleLoader__.load({
         try {
           const es = new EventSource('/dsh-tts/stream')
           activeSse = es
-          es.onopen = () => { activeSseAttempt = 0 }
+          es.onopen = () => {
+            activeSseAttempt = 0
+            resetWatchdog()
+          }
+          es.onmessage = () => { resetWatchdog() }
           es.addEventListener('utterance', onItem)
           es.addEventListener('chime', onChime)
           es.onerror = () => {
+            if (activeSseWatchdog) { clearTimeout(activeSseWatchdog); activeSseWatchdog = null }
             if (activeSse === es) {
               try { es.close() } catch (_err) { /* eventsource already closed */ }
               activeSse = null
@@ -588,6 +614,7 @@ window.__ModuleLoader__.load({
             if (activeSseTimer) clearTimeout(activeSseTimer)
             activeSseTimer = setTimeout(connect, delay)
           }
+          resetWatchdog()
         } catch { /* EventSource failed */ }
       }
 
@@ -595,7 +622,8 @@ window.__ModuleLoader__.load({
 
       return () => {
         sseDisposed = true
-        if (activeSseTimer) clearTimeout(activeSseTimer)
+        if (activeSseTimer) { clearTimeout(activeSseTimer); activeSseTimer = null }
+        if (activeSseWatchdog) { clearTimeout(activeSseWatchdog); activeSseWatchdog = null }
         if (activeSse) {
           try { activeSse.close() } catch (_err) { /* active sse already closed on dispose */ }
           activeSse = null
@@ -674,7 +702,7 @@ window.__ModuleLoader__.load({
       clientFetch('/dsh-tts/speak', {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ text }),
+        body: JSON.stringify({ text, channel: 'web' }),
         timeoutMs: 15000,
       })
         .then((r) => r.json())
@@ -727,7 +755,7 @@ window.__ModuleLoader__.load({
       clientFetch('/dsh-tts/speak', {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ text: phrase }),
+        body: JSON.stringify({ text: phrase, channel: 'web' }),
         timeoutMs: 15000,
       })
         .then((r) => r.json())

package/lib/engines/manager.js

@@ -63,8 +63,8 @@ export function createModelManager({ root = process.env.DSH_HOME || path.join(os
       return false
     }
 
-    // Reject repetitive dummy bytes (e.g. 2048 bytes of 0x2a)
-    if (buf.length >= 2048 && (buf[0] === 0x2a || buf[0] === 0x00)) {
+    // Reject repetitive dummy bytes (e.g. 2048 bytes of 0x41, 0x2a, etc.)
+    if (buf.length >= 2048) {
       let allSame = true
       for (let i = 1; i < buf.length; i++) {
         if (buf[i] !== buf[0]) {
@@ -75,16 +75,24 @@ export function createModelManager({ root = process.env.DSH_HOME || path.join(os
       if (allSame) return false
     }
 
-    // Validate JSON files
+    // Format-specific verification
     if (filePath.endsWith('.json')) {
-      const rawStr = buf.toString('utf8').trim()
-      if (rawStr.startsWith('{') || rawStr.startsWith('[') || rawStr.includes('{')) {
-        try {
-          const fullContent = await fs.promises.readFile(filePath, 'utf8')
-          JSON.parse(fullContent)
-        } catch {
-          return false
-        }
+      try {
+        const content = await fs.promises.readFile(filePath, 'utf8')
+        const parsed = JSON.parse(content)
+        if (!parsed || typeof parsed !== 'object') return false
+      } catch {
+        return false
+      }
+    } else if (filePath.endsWith('.safetensors')) {
+      if (st.size < 16) return false
+      const headerLen = buf.readBigUInt64LE(0)
+      if (headerLen <= 0n || headerLen > 100n * 1024n * 1024n || BigInt(st.size) < 8n + headerLen) {
+        return false
+      }
+    } else if (filePath.endsWith('.onnx')) {
+      if (buf[0] !== 0x08) {
+        return false
       }
     }
 
@@ -189,9 +197,13 @@ export function createModelManager({ root = process.env.DSH_HOME || path.join(os
     const dir = getModelPath(engineId)
 
     const controller = new AbortController()
+    let onAbortListener = null
     if (options.signal) {
       if (options.signal.aborted) controller.abort()
-      else options.signal.addEventListener('abort', () => controller.abort(), { once: true })
+      else {
+        onAbortListener = () => controller.abort()
+        options.signal.addEventListener('abort', onAbortListener, { once: true })
+      }
     }
 
     const downloadState = {
@@ -303,6 +315,9 @@ export function createModelManager({ root = process.env.DSH_HOME || path.join(os
         lastErrors.set(engineId, { message: sanitized, failedAt: Date.now() })
         throw err
       } finally {
+        if (options.signal && onAbortListener) {
+          try { options.signal.removeEventListener('abort', onAbortListener) } catch (_err) { /* listener already removed */ }
+        }
         if (activeDownloads.get(engineId) === downloadState) {
           activeDownloads.delete(engineId)
         }

package/lib/routes.js

@@ -388,13 +388,23 @@ export function registerHttpRoutes(ctx, api) {
       if (parsed && typeof parsed === 'object') {
         delete parsed.revision
       }
+      let replaceSucceeded = false
+      const prevConfig = typeof settingsApi.get === 'function' ? settingsApi.get() : null
       try {
         await settingsApi.replace(parsed, revision)
+        replaceSucceeded = true
         for (const item of keys) {
           await storeProviderKey(item.provider, item.value)
         }
         writeJson(res, 200, await configResponse())
       } catch (e) {
+        if (replaceSucceeded && prevConfig) {
+          try {
+            await settingsApi.replace(prevConfig)
+          } catch (_rollbackErr) {
+            // best-effort rollback on credential storage failure
+          }
+        }
         const isConflict = e?.code === 'conflict' || e?.name === 'SettingsConflictError' || (
           /conflict/i.test(e?.message || '') || (/revision/i.test(e?.message || '') && !/not volatile/i.test(e?.message || ''))
         )
@@ -486,7 +496,7 @@ export function registerHttpRoutes(ctx, api) {
         return
       }
       const isWeb = payload.channel === 'web' || payload.source === 'web' || req.headers['x-dsh-channel'] === 'web'
-      const isMessenger = payload.channel === 'messenger' || payload.source === 'messenger' || req.headers['x-dsh-channel'] === 'messenger'
+      const isMessenger = payload.channel === 'messenger' || payload.source === 'messenger' || req.headers['x-dsh-channel'] === 'messenger' || (!isVoice && !isWeb)
       if (isMessenger && !cfg.messengerTtsEnabled) {
         writeJson(res, 403, { ok: false, error: { code: 'disabled', message: 'messenger tts is disabled' } })
         return

package/lib/stream-hub.js

@@ -25,7 +25,7 @@ function safeWrite(res, payload) {
     ? res.writableLength
     : (res.__dtsBufferedBytes || 0)
 
-  if (res.__dtsBackpressured && (currentBuffered + payloadBytes > MAX_SUBSCRIBER_BUFFER)) {
+  if (payloadBytes > MAX_SUBSCRIBER_BUFFER || (res.__dtsBackpressured && currentBuffered + payloadBytes > MAX_SUBSCRIBER_BUFFER) || currentBuffered + payloadBytes > MAX_SUBSCRIBER_BUFFER * 2) {
     subscribers.delete(res)
     detach(res)
     try { res.end() } catch (_err) { /* already ended */ }

package/lib/updater.js

@@ -125,7 +125,7 @@ function runtime() {
     : validProfileName(basename(profileDir))
       ? basename(profileDir)
       : 'web'
-  const cliEntry = findDshCliEntry()
+  const cliEntry = process.env.DSH_CLI_ENTRY ?? findDshCliEntry()
   return cliEntry === undefined ? { profileName, profileDir } : { profileName, profileDir, cliEntry }
 }
 
@@ -170,7 +170,10 @@ export function isNewerVersion(currentValue, candidateValue) {
   return comparePrerelease(candidate.prerelease, current.prerelease) > 0
 }
 
-async function latestVersion(packageName, registry) {
+async function latestVersion(packageName, registry, options) {
+  if (typeof options?.latestVersionImpl === 'function') {
+    return await options.latestVersionImpl(packageName, registry)
+  }
   if (
     latestCache?.packageName === packageName &&
     latestCache.registry === registry &&
@@ -202,7 +205,7 @@ async function currentVersion(manifestUrl) {
 
 export async function status(options, target) {
   const current = await currentVersion(options.manifestUrl)
-  const latest = await latestVersion(options.packageName, options.registry ?? 'https://registry.npmjs.org')
+  const latest = await latestVersion(options.packageName, options.registry ?? 'https://registry.npmjs.org', options)
   return {
     packageName: options.packageName,
     currentVersion: current,
@@ -217,7 +220,25 @@ export async function status(options, target) {
 async function installExact(target, packageSpec, options) {
   if (target.cliEntry === undefined) throw new Error('Automatic update is unavailable in this runtime.')
   await new Promise((resolvePromise, reject) => {
-    const child = spawn(
+    const spawnCall = options?.spawnImpl || spawn
+    const child = spawnCall === spawn ? spawn(
+      process.execPath,
+      [
+        target.cliEntry,
+        'plugin',
+        '--profile',
+        target.profileName,
+        'add',
+        packageSpec,
+        `--registry=${options.registry ?? 'https://registry.npmjs.org/'}`,
+      ],
+      {
+        cwd: target.profileDir,
+        windowsHide: true,
+        stdio: ['ignore', 'pipe', 'pipe'],
+        env: { ...process.env, NO_COLOR: '1' },
+      }
+    ) : spawnCall(
       process.execPath,
       [
         target.cliEntry,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-tts",
-  "version": "0.4.31",
+  "version": "0.4.33",
   "description": "Text-to-speech for DeepSeek Harness: speak agent replies in the Web UI with a provider fallback chain (OpenAI, ElevenLabs, Google, Azure, Groq, Deepgram, OpenRouter, Edge, Piper, eSpeak).",
   "license": "MIT",
   "type": "module",