@goodandready/dsh-voice 0.8.27 → 0.8.29

package/lib/http-util.js

@@ -25,4 +25,52 @@ export function readBody(req, maxBytes) {
     req.on('end', () => resolve(Buffer.concat(chunks)))
     req.on('error', reject)
   })
+}
+
+/**
+ * Check whether an IP address is a local loopback interface.
+ * @param {string} addr
+ * @returns {boolean}
+ */
+export function isLoopback(addr) {
+  if (!addr) return false
+  const clean = String(addr).replace(/^::ffff:/, '')
+  return clean === '127.0.0.1' || clean === '::1' || clean === 'localhost'
+}
+
+/**
+ * Verify that the HTTP request originates from a trusted caller (loopback or same-origin).
+ * Fail-closed security guard for state-changing or quota-consuming POST routes.
+ * @param {import('node:http').IncomingMessage} req
+ * @returns {boolean}
+ */
+export function isTrustedCaller(req) {
+  if (!req) return false
+  const remote = req.socket?.remoteAddress || req.connection?.remoteAddress || ''
+  if (isLoopback(remote)) return true
+
+  const secSite = String(req.headers?.['sec-fetch-site'] || '').toLowerCase()
+  if (secSite === 'same-origin' || secSite === 'same-site') return true
+  if (secSite === 'cross-site') return false
+
+  const host = String(req.headers?.host || '').toLowerCase()
+  const origin = String(req.headers?.origin || '').trim().toLowerCase()
+  if (origin) {
+    try {
+      const u = new URL(origin)
+      if (u.host === host) return true
+    } catch { /* invalid url */ }
+    return false
+  }
+
+  const referer = String(req.headers?.referer || '').trim().toLowerCase()
+  if (referer) {
+    try {
+      const u = new URL(referer)
+      if (u.host === host) return true
+    } catch { /* invalid url */ }
+    return false
+  }
+
+  return false
 }

package/lib/index.js

@@ -22,16 +22,17 @@ import { makeProviders, PROVIDER_KEYS, PRESET_KEYS, KNOWN_KEYS, DEFAULT_MODELS,
 import { toWav16k } from './wav.js'
 import { normalizePhrase } from './normalize.js'
 import { createStatsTracker, mergeContextVocabulary } from './stats.js'
-import { writeJson, readBody } from './http-util.js'
+import { writeJson, readBody, isTrustedCaller } from './http-util.js'
 import { createPolishText } from './polish.js'
 import { createUserMessage } from '@deepseek-ai/dsh-llm'
 import { buildProviderOrder, sessionCommand } from './transcribe-core.js'
+import { registerPluginUpdater } from './updater.js'
 
 function isAutoLang(lang) {
   return !lang || lang === 'auto' || String(lang).includes(',')
 }
 
-export const name = 'dsh-voice'
+export const name = '@goodandready/dsh-voice'
 export const inject = ['tools', 'credentials', 'webServer', 'shell', 'settings', 'llm']
 
 const ChainEntry = z.object({
@@ -207,6 +208,7 @@ export function apply(ctx, baseConfig) {
     } catch { return false }
   }
 
+  let whisperError = null
   let startingWhisper = false
   async function startWhisper() {
     if (startingWhisper) return false
@@ -216,7 +218,10 @@ export function apply(ctx, baseConfig) {
     // Without a model path there is nothing to start: the package cannot know
     // where a user's model lives and must not launch a random binary.
     if (!cfg.whisperModel) return false
-    if (await whisperAlive()) return true
+    if (await whisperAlive()) {
+      whisperError = null
+      return true
+    }
     try {
       const spec = ctx.shell.resolve({
         command: `${JSON.stringify(cfg.whisperBin)} -m ${JSON.stringify(cfg.whisperModel)}`
@@ -227,10 +232,17 @@ export function apply(ctx, baseConfig) {
       child = ctx.shell.start(spec)
       for (let i = 0; i < 20; i++) {
         await new Promise((r) => setTimeout(r, 500))
-        if (await whisperAlive()) return true
+        if (await whisperAlive()) {
+          whisperError = null
+          return true
+        }
       }
+      whisperError = 'whisper server process started but failed health check on port 8001'
       return false
-    } catch { return false }
+    } catch (err) {
+      whisperError = String(err && err.message ? err.message : err)
+      return false
+    }
     finally { startingWhisper = false }
   }
 
@@ -238,6 +250,7 @@ export function apply(ctx, baseConfig) {
 
   // SenseVoice-ONNX / Sherpa-ONNX: autostart and health check.
   let sensevoiceChild = null
+  let sensevoiceError = null
 
   async function sensevoiceAlive() {
     try {
@@ -259,7 +272,10 @@ export function apply(ctx, baseConfig) {
     const cfg = live()
     if (!cfg.sensevoiceAutostart) return false
     if (!cfg.sensevoiceModel) return false
-    if (await sensevoiceAlive()) return true
+    if (await sensevoiceAlive()) {
+      sensevoiceError = null
+      return true
+    }
     try {
       let port = '6006'
       try { port = new URL(cfg.sensevoiceUrl).port || '6006' } catch { /* invalid URL */ }
@@ -273,10 +289,17 @@ export function apply(ctx, baseConfig) {
       sensevoiceChild = ctx.shell.start(spec)
       for (let i = 0; i < 20; i++) {
         await new Promise((r) => setTimeout(r, 500))
-        if (await sensevoiceAlive()) return true
+        if (await sensevoiceAlive()) {
+          sensevoiceError = null
+          return true
+        }
       }
+      sensevoiceError = 'sensevoice process started but failed health check'
       return false
-    } catch { return false }
+    } catch (err) {
+      sensevoiceError = String(err && err.message ? err.message : err)
+      return false
+    }
     finally { startingSensevoice = false }
   }
 
@@ -330,9 +353,14 @@ export function apply(ctx, baseConfig) {
     handler: async (req, res) => {
       if (req.method !== 'GET') { writeJson(res, 405, { ok: false, error: { code: 'method', message: 'GET only' } }); return }
       const cfg = live()
+      const whisperOk = await whisperAlive()
+      const sensevoiceOk = await sensevoiceAlive()
       writeJson(res, 200, {
         ok: true,
-        whisperRunning: await whisperAlive(),
+        whisperRunning: whisperOk,
+        whisperError: whisperOk ? null : whisperError,
+        sensevoiceRunning: sensevoiceOk,
+        sensevoiceError: sensevoiceOk ? null : sensevoiceError,
         // The hotkey is needed by the browser half: it installs the hold handler.
         hotkey: cfg.hotkey,
         providers: KNOWN_KEYS.concat(
@@ -378,9 +406,10 @@ export function apply(ctx, baseConfig) {
     path: '/dsh-voice/polish',
     handler: async (req, res) => {
       if (req.method !== 'POST') { writeJson(res, 405, { ok: false, error: { code: 'method', message: 'POST only' } }); return }
+      if (!isTrustedCaller(req)) { writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'forbidden source origin' } }); return }
       const cfg = live()
       let raw
-      try { raw = await readBody(req, cfg.maxFileBytes + 1024 * 1024) } catch (e) { writeJson(res, 400, { ok: false, error: { code: 'body', message: e.message } }); return }
+      try { raw = await readBody(req, 1024 * 1024) } catch (e) { writeJson(res, 400, { ok: false, error: { code: 'body', message: e.message } }); return }
       let payload = {}
       try { payload = JSON.parse(raw.toString('utf8') || '{}') } catch { /* empty */ }
       const text = typeof payload.text === 'string' ? payload.text.trim() : ''
@@ -401,6 +430,7 @@ export function apply(ctx, baseConfig) {
     path: '/dsh-voice/transcribe',
     handler: async (req, res) => {
       if (req.method !== 'POST') { writeJson(res, 405, { ok: false, error: { code: 'method', message: 'POST only' } }); return }
+      if (!isTrustedCaller(req)) { writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'forbidden source origin' } }); return }
       const cfg = live()
       let raw
       try {
@@ -512,4 +542,10 @@ export function apply(ctx, baseConfig) {
     if (child) { try { child.kill && child.kill() } catch { /* already dead */ } }
     if (sensevoiceChild) { try { sensevoiceChild.kill && sensevoiceChild.kill() } catch { /* already dead */ } }
   }, 'dsh-voice: stop child processes')
+
+  ctx.effect(() => registerPluginUpdater(ctx, {
+    endpoint: '/api/dsh-voice/update',
+    packageName: '@goodandready/dsh-voice',
+    manifestUrl: new URL('../package.json', import.meta.url),
+  }), 'dsh-voice: updater route')
 }

package/lib/normalize.js

@@ -16,8 +16,10 @@ export function ensureTrailingPeriod(text) {
   return t + '.'
 }
 
+// Functional linguistic data for speech-to-text numeral normalization.
+// Note: Language processing dictionary for audio transcript conversion, not UI text strings.
 const NUM_WORDS = {
-  ноль: 0, один: 1, одна: 1, два: 2, две: 2, три: 3, четыре: 4, пять: 5,
+  ноль: 0, один: 1, одна: 1, одно: 1, два: 2, две: 2, три: 3, четыре: 4, пять: 5,
   шесть: 6, семь: 7, восемь: 8, девять: 9, десять: 10, одиннадцать: 11,
   двенадцать: 12, тринадцать: 13, четырнадцать: 14, пятнадцать: 15,
   шестнадцать: 16, семнадцать: 17, восемнадцать: 18, девятнадцать: 19,

package/lib/provider-http.js

@@ -0,0 +1,64 @@
+// Pure helper functions for STT provider HTTP requests and responses.
+
+/**
+ * Check if the language is unspecified or set to automatic detection.
+ * @param {string} [lang]
+ * @returns {boolean}
+ */
+export function isAutoLang(lang) {
+  return !lang || lang === 'auto' || String(lang).includes(',')
+}
+
+/**
+ * Determine the audio container format supported by the OpenAI Chat Audio API.
+ * @param {string} [mime='']
+ * @returns {'wav' | 'mp3' | ''}
+ */
+export function chatAudioFormat(mime = '') {
+  if (mime.includes('wav')) return 'wav'
+  if (mime.includes('mpeg') || mime.includes('mp3')) return 'mp3'
+  return ''
+}
+
+/**
+ * Return a safe file name based on mime type for multipart form uploads.
+ * @param {string} [mime='']
+ * @returns {string}
+ */
+export function fileName(mime = '') {
+  if (mime.includes('wav')) return 'audio.wav'
+  if (mime.includes('ogg')) return 'audio.ogg'
+  if (mime.includes('mp4')) return 'audio.m4a'
+  return 'audio.webm'
+}
+
+/**
+ * Safely parse JSON from a response or throw a standardized descriptive Error.
+ * @param {Response} res
+ * @param {string} defaultLabel
+ * @returns {Promise<any>}
+ */
+export async function safeJson(res, defaultLabel) {
+  try {
+    return await res.json()
+  } catch {
+    throw new Error(`${defaultLabel}: invalid JSON response`)
+  }
+}
+
+/**
+ * Extract an error message or detail string from a non-2xx HTTP response.
+ * @param {Response} res
+ * @param {string} defaultLabel
+ * @returns {Promise<string>}
+ */
+export async function readErrorDetail(res, defaultLabel) {
+  let detail = `HTTP ${res.status}`
+  try {
+    const e = await res.json()
+    if (e?.error) detail = typeof e.error === 'string' ? e.error : (e.error.message || JSON.stringify(e.error))
+    else if (e?.message) detail = e.message
+    else if (e?.err_msg) detail = e.err_msg
+  } catch { /* not json */ }
+  return `${defaultLabel} ${detail}`
+}

package/lib/providers.js

@@ -68,13 +68,8 @@ const CHAT_AUDIO_PROMPT =
   'Transcribe the audio verbatim. Reply with the transcript text only, '
   + 'without comments, quotes or formatting.'
 
-// Formats the chat template accepts in input_audio. Everything else
-// (including browser webm/opus) is converted to WAV first.
-function chatAudioFormat(mime) {
-  if (mime.includes('wav')) return 'wav'
-  if (mime.includes('mpeg') || mime.includes('mp3')) return 'mp3'
-  return ''
-}
+import { readErrorDetail, safeJson, isAutoLang, fileName, chatAudioFormat } from './provider-http.js'
+export { readErrorDetail, safeJson, isAutoLang, fileName, chatAudioFormat }
 
 export const DEFAULT_MODELS = {
   deepgram: 'nova-2',
@@ -89,37 +84,6 @@ function pickModel(models, key) {
   return chosen || DEFAULT_MODELS[key]
 }
 
-function fileName(mime) {
-  if (mime.includes('wav')) return 'audio.wav'
-  if (mime.includes('ogg')) return 'audio.ogg'
-  if (mime.includes('mp4')) return 'audio.m4a'
-  return 'audio.webm'
-}
-
-// Auto language: empty, 'auto', or a list ('ru,en') means the provider
-// detects language; the language field is omitted. whisper.cpp gets -l auto.
-function isAutoLang(lang) {
-  return !lang || lang === 'auto' || String(lang).includes(',')
-}
-
-async function readErrorDetail(res, defaultLabel) {
-  let detail = `HTTP ${res.status}`
-  try {
-    const e = await res.json()
-    if (e?.error) detail = typeof e.error === 'string' ? e.error : (e.error.message || JSON.stringify(e.error))
-    else if (e?.message) detail = e.message
-    else if (e?.err_msg) detail = e.err_msg
-  } catch { /* not json */ }
-  return `${defaultLabel} ${detail}`
-}
-
-async function safeJson(res, defaultLabel) {
-  try {
-    return await res.json()
-  } catch {
-    throw new Error(`${defaultLabel}: invalid JSON response`)
-  }
-}
 
 export function makeProviders(deps, req) {
   const { resolveKey, fetchImpl, cfg } = deps

package/lib/transcribe-core.js

@@ -29,10 +29,10 @@ export function buildProviderOrder({ localOnly, chain, customKeys, knownKeys, de
 }
 
 const SESSION_COMMANDS = [
-  { re: /^(отправь|отправить|пошли|send)\s*[.!?]*$/i, cmd: 'send' },
-  { re: /^(отмени|отмена|cancel|отменить)\s*[.!?]*$/i, cmd: 'cancel' },
-  { re: /^(стоп|stop|хватит)\s*[.!?]*$/i, cmd: 'stop' },
-  { re: /^(продолжи|continue|продолжай)\s*[.!?]*$/i, cmd: 'continue' },
+  { re: /^(отправь|отправить|пошли|send|发送|发出去)\s*[.!?]*$/i, cmd: 'send' },
+  { re: /^(отмени|отмена|cancel|отменить|取消|算了)\s*[.!?]*$/i, cmd: 'cancel' },
+  { re: /^(стоп|stop|хватит|停止|暂停)\s*[.!?]*$/i, cmd: 'stop' },
+  { re: /^(продолжи|continue|продолжай|继续)\s*[.!?]*$/i, cmd: 'continue' },
 ]
 
 /**

package/lib/updater.js

@@ -0,0 +1,266 @@
+// lib/updater.js — Host-side one-click updater for @goodandready/dsh-voice
+// Implements canonical DSH plugin-updater specification.
+
+import { spawn } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import { readFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { basename, dirname, isAbsolute, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const UPDATE_HEADER = 'x-dsh-plugin-update';
+const UPDATE_TIMEOUT_MS = 10 * 60_000;
+const VERSION_CACHE_MS = 5 * 60_000;
+let latestCache;
+
+function header(request, name) {
+  const value = request?.headers?.[name];
+  return Array.isArray(value) ? value[0] : value;
+}
+
+function isLoopback(value) {
+  const address = value?.toLowerCase().replace(/^\[|\]$/g, '');
+  return address === 'localhost' || address === 'localhost.' || address === '::1'
+    || address?.startsWith('127.') === true
+    || address?.startsWith('::ffff:127.') === true;
+}
+
+export function isTrustedUpdateRequest(request) {
+  if (header(request, UPDATE_HEADER) !== '1') return false;
+  if (!isLoopback(request.socket?.remoteAddress)) return false;
+  const site = header(request, 'sec-fetch-site');
+  if (site !== undefined && site !== 'same-origin') return false;
+  const origin = header(request, 'origin');
+  const host = header(request, 'host');
+  if (origin === undefined || host === undefined) return false;
+  try {
+    const url = new URL(origin);
+    return (url.protocol === 'http:' || url.protocol === 'https:')
+      && isLoopback(url.hostname) && url.host === host;
+  } catch {
+    return false;
+  }
+}
+
+function validProfileName(value) {
+  return typeof value === 'string' && value !== '' && value !== '.' && value !== '..'
+    && !value.includes('/') && !value.includes('\\') && !/[\0-\x1f\x7f]/.test(value);
+}
+
+function profileNameFromArgv(argv) {
+  for (let index = 2; index < argv.length; index += 1) {
+    if (argv[index] === '--profile') return argv[index + 1];
+    if (argv[index]?.startsWith('--profile=')) return argv[index].slice('--profile='.length);
+  }
+  return argv[2] === 'web' ? 'web' : undefined;
+}
+
+function findDshCliEntry() {
+  const value = process.argv[1];
+  if (value === undefined || value === '') return undefined;
+  const entry = value.startsWith('file:') ? fileURLToPath(value) : resolve(process.cwd(), value);
+  if (!existsSync(entry)) return undefined;
+  for (let directory = dirname(entry); ; directory = dirname(directory)) {
+    const manifestPath = resolve(directory, 'package.json');
+    if (existsSync(manifestPath)) {
+      try {
+        const manifest = JSON.parse(readFileSync(manifestPath, 'utf8'));
+        const bin = typeof manifest.bin === 'string'
+          ? manifest.bin
+          : typeof manifest.bin === 'object' && manifest.bin !== null
+            ? manifest.bin.dsh
+            : undefined;
+        if (manifest.name === '@deepseek-ai/dsh' && typeof bin === 'string'
+          && !isAbsolute(bin) && resolve(directory, bin) === resolve(entry)) return entry;
+      } catch {
+        // Continue searching parent package directories.
+      }
+    }
+    const parent = dirname(directory);
+    if (parent === directory) return undefined;
+  }
+}
+
+function runtime() {
+  const profileDir = resolve(process.env.DSH_PROFILE_DIR
+    ?? resolve(homedir(), '.dsh', 'profiles', 'web'));
+  const selected = profileNameFromArgv(process.argv);
+  const profileName = validProfileName(selected)
+    ? selected
+    : validProfileName(basename(profileDir)) ? basename(profileDir) : 'web';
+  const cliEntry = findDshCliEntry();
+  return cliEntry === undefined ? { profileName, profileDir } : { profileName, profileDir, cliEntry };
+}
+
+export function parseSemver(value) {
+  const match = /^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/.exec(value);
+  if (match === null) return undefined;
+  return {
+    core: [Number(match[1]), Number(match[2]), Number(match[3])],
+    prerelease: match[4]?.split('.') ?? [],
+  };
+}
+
+function comparePrerelease(left, right) {
+  if (left.length === 0 || right.length === 0) return left.length === right.length ? 0 : left.length === 0 ? 1 : -1;
+  const length = Math.max(left.length, right.length);
+  for (let index = 0; index < length; index += 1) {
+    const a = left[index];
+    const b = right[index];
+    if (a === undefined || b === undefined) return a === b ? 0 : a === undefined ? -1 : 1;
+    if (a === b) continue;
+    const aNumeric = /^\d+$/.test(a);
+    const bNumeric = /^\d+$/.test(b);
+    if (aNumeric && bNumeric) {
+      const aNumber = BigInt(a);
+      const bNumber = BigInt(b);
+      if (aNumber !== bNumber) return aNumber > bNumber ? 1 : -1;
+      continue;
+    }
+    if (aNumeric !== bNumeric) return aNumeric ? -1 : 1;
+    return a > b ? 1 : -1;
+  }
+  return 0;
+}
+
+export function isNewerVersion(currentValue, candidateValue) {
+  const current = parseSemver(currentValue);
+  const candidate = parseSemver(candidateValue);
+  if (current === undefined || candidate === undefined) return false;
+  for (let index = 0; index < 3; index += 1) {
+    if (candidate.core[index] !== current.core[index]) return candidate.core[index] > current.core[index];
+  }
+  return comparePrerelease(candidate.prerelease, current.prerelease) > 0;
+}
+
+async function latestVersion(packageName, registry) {
+  if (latestCache?.packageName === packageName && latestCache.registry === registry && Date.now() < latestCache.expiresAt) return latestCache.version;
+  try {
+    const response = await fetch(`${registry.replace(/\/$/, '')}/${encodeURIComponent(packageName)}/latest`, {
+      signal: AbortSignal.timeout(8_000),
+    });
+    if (!response.ok) return undefined;
+    const value = await response.json();
+    if (typeof value.version !== 'string' || value.version === '') return undefined;
+    latestCache = { packageName, registry, version: value.version, expiresAt: Date.now() + VERSION_CACHE_MS };
+    return value.version;
+  } catch {
+    return undefined;
+  }
+}
+
+async function currentVersion(manifestUrl) {
+  const value = JSON.parse(await readFile(manifestUrl, 'utf8'));
+  if (typeof value.version !== 'string' || value.version === '') throw new Error('Cannot read current plugin version.');
+  return value.version;
+}
+
+export async function getUpdateStatus(options, target = runtime()) {
+  const current = await currentVersion(options.manifestUrl);
+  const latest = await latestVersion(options.packageName, options.registry ?? 'https://registry.npmjs.org');
+  return {
+    packageName: options.packageName,
+    currentVersion: current,
+    ...(latest === undefined ? {} : { latestVersion: latest }),
+    latestCheckFailed: latest === undefined,
+    updateAvailable: latest !== undefined && isNewerVersion(current, latest),
+    profileName: target.profileName,
+    canAutoUpdate: target.cliEntry !== undefined,
+  };
+}
+
+async function installExact(target, packageSpec, options) {
+  if (target.cliEntry === undefined) throw new Error('Automatic update is unavailable in this runtime.');
+  await new Promise((resolvePromise, reject) => {
+    const child = spawn(process.execPath, [
+      target.cliEntry, 'plugin', '--profile', target.profileName, 'add',
+      '--config.minimumReleaseAge=0', packageSpec,
+      `--registry=${options.registry ?? 'https://registry.npmjs.org/'}`,
+    ], {
+      cwd: target.profileDir,
+      windowsHide: true,
+      stdio: ['ignore', 'pipe', 'pipe'],
+      env: { ...process.env, NO_COLOR: '1' },
+    });
+    let detail = '';
+    child.stdout?.on('data', chunk => { detail = (detail + String(chunk)).slice(-4_000); });
+    child.stderr?.on('data', chunk => { detail = (detail + String(chunk)).slice(-4_000); });
+    const timer = setTimeout(() => {
+      child.kill();
+      reject(new Error('Update timed out; use the normal DSH update flow.'));
+    }, UPDATE_TIMEOUT_MS);
+    child.once('error', error => { clearTimeout(timer); reject(error); });
+    child.once('exit', code => {
+      clearTimeout(timer);
+      if (code === 0) resolvePromise();
+      else reject(new Error(detail.trim() || `Update exited with code ${String(code)}.`));
+    });
+  });
+}
+
+function json(response, statusCode, value) {
+  response.writeHead(statusCode, {
+    'content-type': 'application/json; charset=utf-8',
+    'cache-control': 'no-store',
+  });
+  response.end(JSON.stringify(value));
+}
+
+export function registerPluginUpdater(ctx, options) {
+  const host = ctx;
+  let installing = false;
+  return host.webServer.register({
+    kind: 'exact',
+    path: options.endpoint,
+    handler: async (request, response) => {
+      try {
+        const target = runtime();
+        if (request.method === 'GET' || request.method === 'HEAD') {
+          const payload = await getUpdateStatus(options, target);
+          response.writeHead(200, {
+            'content-type': 'application/json; charset=utf-8',
+            'cache-control': 'no-store',
+          });
+          response.end(request.method === 'HEAD' ? undefined : JSON.stringify(payload));
+          return;
+        }
+        if (request.method !== 'POST') {
+          response.writeHead(405, { allow: 'GET, HEAD, POST' });
+          response.end();
+          return;
+        }
+        if (!isTrustedUpdateRequest(request)) {
+          json(response, 403, { error: 'Rejected non-local or cross-origin update request.' });
+          return;
+        }
+        if (installing) {
+          json(response, 409, { error: 'This plugin is already updating.' });
+          return;
+        }
+        installing = true;
+        try {
+          const before = await getUpdateStatus(options, target);
+          if (before.latestVersion === undefined) {
+            json(response, 503, { error: 'The latest version is temporarily unavailable.' });
+            return;
+          }
+          if (!before.updateAvailable) {
+            json(response, 200, before);
+            return;
+          }
+          await installExact(target, `${options.packageName}@${before.latestVersion}`, options);
+          json(response, 200, {
+            ...before,
+            updatedVersion: before.latestVersion,
+            restartRequired: true,
+          });
+        } finally {
+          installing = false;
+        }
+      } catch (error) {
+        ctx.logger?.warn?.(`plugin updater failed: ${String(error)}`);
+        json(response, 503, { error: 'Plugin update failed; see server logs.' });
+      }
+    },
+  });
+}

package/lib/wav.js

@@ -29,13 +29,13 @@ export function toWav16k(bytes, ffmpegBin = 'ffmpeg', signal = null) {
 
     const timeout = setTimeout(() => {
       cleanup()
-      try { proc.kill('SIGKILL') } catch {}
+      try { proc.kill('SIGKILL') } catch (e) { /* process already exited */ }
       reject(new Error('ffmpeg conversion timed out after 30s'))
     }, 30000)
 
     const onAbort = () => {
       cleanup()
-      try { proc.kill('SIGKILL') } catch {}
+      try { proc.kill('SIGKILL') } catch (e) { /* process already exited */ }
       reject(new Error('ffmpeg conversion aborted'))
     }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-voice",
-  "version": "0.8.27",
+  "version": "0.8.29",
   "description": "Voice input for DeepSeek Harness: dictation chunked by pauses and voice messages, each with its own provider fallback chain (Deepgram, Groq, HuggingFace, local whisper.cpp, plus any OpenAI-compatible API of your own).",
   "license": "MIT",
   "type": "module",
@@ -43,7 +43,9 @@
   "scripts": {
     "test": "node --test test/*.test.mjs",
     "build:client": "node scripts/build-client.mjs",
-    "pretest": "node scripts/build-client.mjs"
+    "pretest": "node scripts/build-client.mjs",
+    "lint": "node --check lib/*.js scripts/*.mjs",
+    "pack:check": "node scripts/pack-check.mjs"
   },
   "dsh": {
     "bundle": {