@goodandready/dsh-voice 0.8.28 → 0.8.30

package/cordis.patch.yml

@@ -1,7 +1,7 @@
 # dsh-voice bundle layer: applied automatically when the package is installed
 # as a profile bundle (package.json declares dsh.bundle.patch).
 #
-# `name` must stay the full npm package name: the client-modules registry
+# Full npm package identifier is required: the client-modules registry
 # resolves the browser bundle by the loader entry name, so a shortened name
 # leaves the UI half silently out of window.__DSH_BOOT__.
 #

package/lib/client.js

@@ -17,6 +17,14 @@ window.__ModuleLoader__.load({
     Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' })
     let React = require('react')
 
+    let ChevronIcon = null
+    try {
+      const primitives = require('@deepseek-ai/dsh-client-ui-primitives')
+      ChevronIcon = primitives && (primitives.IconChevronDownOutline14 || primitives.IconChevronDownOutline)
+    } catch {
+      ChevronIcon = null
+    }
+
     const NS = 'dsh-voice'
 
     // UI strings live in the locale registry so a separate package can
@@ -183,6 +191,15 @@ window.__ModuleLoader__.load({
       'noiseGate': 'Noise Gate (dB)',
       'noiseGateHint': 'Mute background fan hum and keyboard clicks below threshold. Off = disabled',
       'noiseGateOff': 'Off',
+      'versionTitle': 'Plugin Version & Updates',
+      'versionHint': 'Check for new versions and update directly from npm.',
+      'updateAvailable': 'Update available',
+      'upToDate': 'Up to date',
+      'updatePrompt': 'A new version is available on npm. Click update to install.',
+      'updateNow': 'Update now',
+      'updating': 'Updating…',
+      'updateSuccess': 'Updated successfully! Restart DSH to apply.',
+      'updateFailed': 'Update failed. Check logs.',
     }
 
     const zh = {
@@ -346,6 +363,15 @@ window.__ModuleLoader__.load({
       'noiseGate': '噪声门 (dB)',
       'noiseGateHint': '静音切除低于阈值的风扇嗡嗡声与机械键盘敲击声。Off = 关闭',
       'noiseGateOff': '关闭',
+      'versionTitle': '插件版本与更新',
+      'versionHint': '检查新版本并直接从 npm 更新。',
+      'updateAvailable': '有可用更新',
+      'upToDate': '已是最新版本',
+      'updatePrompt': 'npm 上有新版本可用。点击更新进行安装。',
+      'updateNow': '立即更新',
+      'updating': '正在更新…',
+      'updateSuccess': '更新成功！请重启 DSH 生效。',
+      'updateFailed': '更新失败，请查看日志。',
     }
 
     // Strings are also needed outside components — in recording handlers and
@@ -357,7 +383,8 @@ window.__ModuleLoader__.load({
       '.dvo-btn{display:flex;align-items:center;justify-content:center;width:30px;height:30px;border-radius:50%;border:1px solid var(--dsw-alias-border-l1);background:transparent;color:var(--dsw-alias-label-secondary);cursor:pointer;padding:0;box-sizing:border-box;user-select:none;-webkit-user-select:none;touch-action:manipulation}' +
       '.dvo-btn:hover{color:var(--dsw-alias-label-primary);border-color:var(--dsw-alias-border-l2)}' +
       '.dvo-btn[data-err="1"]{color:var(--dsw-alias-state-error-primary);border-color:var(--dsw-alias-state-error-primary)}' +
-      '.dvo-pill{display:flex;align-items:center;gap:10px;height:52px;border-radius:26px;background:var(--dsw-alias-bg-layer-1);border:1px solid var(--dsw-alias-border-l1);padding:0 14px;width:100%;max-width:720px;margin:0 auto;box-shadow:0 8px 24px rgba(0,0,0,.18);box-sizing:border-box;user-select:none;-webkit-user-select:none}' +
+      '.dvo-pill{display:flex;align-items:center;gap:10px;height:52px;border-radius:26px;background:var(--dsw-alias-bg-layer-1);border:1px solid var(--dsw-alias-border-l1);padding:0 14px;width:100%;max-width:720px;margin:0 auto;box-shadow:0 8px 24px color-mix(in srgb, var(--dsw-alias-label-primary) 18%, transparent);box-sizing:border-box;user-select:none;-webkit-user-select:none}' +
+      '.dvo-chev-icon{width:14px;height:14px;display:block;flex:none}' +
       '.dvo-pbtn{display:flex;align-items:center;justify-content:center;width:34px;height:34px;border-radius:50%;cursor:pointer;padding:0;flex:none;box-sizing:border-box;border:1px solid var(--dsw-alias-border-l2);background:transparent;color:var(--dsw-alias-label-primary);user-select:none;-webkit-user-select:none;touch-action:manipulation}' +
       '.dvo-pbtn:hover{background:var(--dsw-alias-bg-layer-2)}' +
       '.dvo-wave{flex:1;min-width:0;max-width:100%;height:40px;width:100%;color:var(--dsw-alias-label-primary)}' +
@@ -447,8 +474,31 @@ window.__ModuleLoader__.load({
       React.createElement('path', { d: 'M10.29 3.86L1.82 18a2 2 0 0 0 1.71 3h16.94a2 2 0 0 0 1.71-3L13.71 3.86a2 2 0 0 0-3.42 0z' }),
       React.createElement('line', { x1: 12, y1: 9, x2: 12, y2: 13 }),
       React.createElement('line', { x1: 12, y1: 17, x2: 12.01, y2: 17 }))
-    const chevronIcon = () => React.createElement('svg', ic,
-      React.createElement('path', { d: 'M6 9l6 6 6-6' }))
+    const chevronIcon = () => (
+      ChevronIcon
+        ? React.createElement(ChevronIcon, { className: 'dvo-chev-icon' })
+        : React.createElement('svg', {
+            className: 'dvo-chev-icon',
+            width: 14, height: 14, viewBox: '0 0 16 16', fill: 'none',
+          },
+          React.createElement('path', {
+            d: 'M4 6l4 4 4-4', stroke: 'currentColor', strokeWidth: 1.5,
+            strokeLinecap: 'round', strokeLinejoin: 'round',
+          }))
+    )
+
+    function focusComposer() {
+      if (typeof window === 'undefined') return
+      const actions = voice.inputActions
+      if (actions && typeof actions.focus === 'function') {
+        try { actions.focus(); return } catch { /* best effort */ }
+      }
+      try {
+        const el = document.querySelector('.conversation-input textarea, .cb-composer textarea, .dsh-composer textarea, [data-slate-editor="true"], textarea')
+        if (el && typeof el.focus === 'function') el.focus()
+      } catch { /* best effort */ }
+    }
+
 
     // ------------------------------------------------------------ transport
     function blobToBase64(blob) {
@@ -466,6 +516,8 @@ window.__ModuleLoader__.load({
       const text = (voice.input && typeof voice.input.draft === 'string') ? voice.input.draft : ''
       if (!text || text.length < 3) return []
       const matches = text.match(/[A-Za-zА-Яа-яЁё_][A-Za-zА-Яа-яЁё0-9_]{2,29}/g) || []
+      // Linguistic filter: functional stop-word dictionary for vocabulary keyword extraction.
+      // Language processing data for context analysis, distinct from user-facing UI text.
       const stop = new Set([
         'the', 'and', 'for', 'are', 'but', 'not', 'you', 'all', 'any', 'can', 'her', 'was',
         'one', 'our', 'out', 'day', 'get', 'has', 'him', 'his', 'how', 'man', 'new', 'now',
@@ -526,8 +578,8 @@ window.__ModuleLoader__.load({
       return s
     }
 
-    // Spoken edit commands (#37): "new line" / "с новой строки" -> \n and so on.
-    // Applied before normalization, only when enabled in settings.
+    // Functional speech edit commands (#37): spoken line breaks and punctuation -> symbols.
+    // Linguistic data for audio transcript post-processing; not user-facing UI text.
     // Russian phrases match RU STT output; English covers EN dictation.
     const VOICE_COMMANDS = [
       [/(^|[\s,.!?])с новой строки([\s,.!?]|$)/gi, '$1\n$2'],
@@ -790,7 +842,7 @@ window.__ModuleLoader__.load({
           src.connect(filter)
           lastNode = filter
           rec.filterNode = filter
-        } catch (e) {}
+        } catch (e) { /* audio filter fallback */ }
 
         rec.analyser = rec.audioCtx.createAnalyser()
         rec.analyser.fftSize = 128
@@ -1016,6 +1068,7 @@ window.__ModuleLoader__.load({
 
     function cancelCurrent() {
       announceVoice('end')
+      focusComposer()
       if (voice.browser) {
         voice.browser.abort()
         voice.browser = null
@@ -1039,6 +1092,7 @@ window.__ModuleLoader__.load({
     // sends the whole recording and opens the cancel window.
     function stopCurrent() {
       announceVoice('end')
+      focusComposer()
       if (voice.browser) {
         const mode = voice.mode
         const said = (voice.browserFinals || []).join(' ').trim()
@@ -1164,11 +1218,14 @@ window.__ModuleLoader__.load({
       return React.createElement(React.Fragment, null,
         React.createElement('button', {
           type: 'button', className: 'dvo-btn', 'data-err': err ? '1' : '0',
-          title: err ? v.error : t('dictationBtn'), onClick: startDictation,
+          title: err ? v.error : t('dictationBtn'),
+          'aria-label': err ? v.error : t('dictationBtn'),
+          onClick: startDictation,
         }, micIcon()),
         React.createElement('button', {
           type: 'button', className: 'dvo-btn', 'data-err': err ? '1' : '0',
           title: err ? v.error : (t('messageBtn') + hk),
+          'aria-label': err ? v.error : (t('messageBtn') + hk),
           // Hold: record while pressed; leaving the control cancels.
           onPointerDown: (e) => { e.preventDefault(); beginHold('message') },
           onPointerUp: () => endHold(false),
@@ -1178,6 +1235,7 @@ window.__ModuleLoader__.load({
           ? React.createElement('button', {
               type: 'button', className: 'dvo-btn' + (voice.showPlayer ? ' dvo-btn-active' : ''),
               title: t('listenBack'),
+              'aria-label': t('listenBack'),
               onClick: () => voice.set({ showPlayer: !voice.showPlayer }),
             }, playIcon())
           : null,
@@ -1399,7 +1457,7 @@ window.__ModuleLoader__.load({
             g.clearRect(0, 0, cssW, cssH)
 
             if (!voice.waveColor) {
-              try { voice.waveColor = getComputedStyle(canvas).color || '#fff' } catch (e) { voice.waveColor = '#fff' }
+              try { voice.waveColor = getComputedStyle(canvas).color || 'currentColor' } catch (e) { voice.waveColor = 'currentColor' }
             }
             const levels = voice.levels
             const style = (voice.settings && voice.settings.visualizerStyle) || 'liquid-wave'
@@ -1457,11 +1515,12 @@ window.__ModuleLoader__.load({
 
       if (v.phase === 'idle') {
         if (!voice.showPlayer || !voice.lastNote || !voice.lastNote.url) return null
-        return React.createElement('div', { className: 'dvo-pill' },
+        return React.createElement('div', { className: 'dvo-pill', role: 'region', 'aria-label': t('title') },
           React.createElement('div', { className: 'dvo-audio-wrap' },
             React.createElement('button', {
               type: 'button', className: 'dvo-audio-play',
               title: isPlaying ? t('pause') : t('play'),
+              'aria-label': isPlaying ? t('pause') : t('play'),
               onClick: () => {
                 const el = audioRef.current
                 if (!el) return
@@ -1477,13 +1536,15 @@ window.__ModuleLoader__.load({
             }),
             React.createElement('span', { className: 'dvo-audio-time' }, t('lastRecording')),
           ),
-          React.createElement('span', { className: 'dvo-status' }, voice.lastNote.text || ''),
+          React.createElement('span', { className: 'dvo-status', 'aria-live': 'polite', 'aria-atomic': 'true' }, voice.lastNote.text || ''),
           React.createElement('button', {
             type: 'button', className: 'dvo-pbtn', title: t('hide'),
+            'aria-label': t('hide'),
             onClick: () => {
               if (audioRef.current) audioRef.current.pause()
               setIsPlaying(false)
               voice.set({ showPlayer: false })
+              focusComposer()
             },
           }, xIcon()),
         )
@@ -1496,12 +1557,16 @@ window.__ModuleLoader__.load({
         // Live caption of what is heard right now. Until the browser emits a
         // final chunk the text is interim and changes on screen.
         const caption = voice.caption || (inBrowser ? '' : null)
-        return React.createElement('div', { className: 'dvo-pill' },
-          React.createElement('button', { type: 'button', className: 'dvo-pbtn', title: t('cancel'), onClick: cancelCurrent }, xIcon()),
+        return React.createElement('div', { className: 'dvo-pill', role: 'region', 'aria-label': t('title') },
+          React.createElement('button', {
+            type: 'button', className: 'dvo-pbtn', title: t('cancel'),
+            'aria-label': t('cancel'),
+            onClick: cancelCurrent,
+          }, xIcon()),
           inBrowser
             ? null
             : React.createElement('canvas', { className: 'dvo-wave', ref: canvasRef, width: 720, height: 40 }),
-          React.createElement('span', { className: 'dvo-status' },
+          React.createElement('span', { className: 'dvo-status', 'aria-live': 'polite', 'aria-atomic': 'true' },
             caption
               ? caption
               : (voice.holding
@@ -1509,36 +1574,43 @@ window.__ModuleLoader__.load({
                 : (inBrowser
                   ? t('listening')
                   : (rec && rec.hadSpeech ? (v.speaking ? t('speaking') : t('silence')) : hint)))),
-          React.createElement('button', { type: 'button', className: 'dvo-pbtn', title: t('stop'), onClick: stopCurrent }, stopIcon()),
+          React.createElement('button', {
+            type: 'button', className: 'dvo-pbtn', title: t('stop'),
+            'aria-label': t('stop'),
+            onClick: stopCurrent,
+          }, stopIcon()),
         )
       }
 
       if (v.phase === 'processing') {
-        return React.createElement('div', { className: 'dvo-pill' },
-          React.createElement('span', { className: 'dvo-status' }, spinIcon(), t('transcribing')))
+        return React.createElement('div', { className: 'dvo-pill', role: 'region', 'aria-label': t('title') },
+          React.createElement('span', { className: 'dvo-status', 'aria-live': 'polite', 'aria-atomic': 'true' }, spinIcon(), t('transcribing')))
       }
 
       if (v.phase === 'pending') {
         const left = Math.max(0, Math.ceil((voice.pending ? voice.pending.leftMs : 0) / 1000))
         if (voice.pending && voice.pending.undoOnly) {
           // Cancel window for delayed dictation insert (#29-5).
-          return React.createElement('div', { className: 'dvo-pill' },
-            React.createElement('span', { className: 'dvo-status' }, t('undo'), ': ', left, t('secondsShort')),
+          return React.createElement('div', { className: 'dvo-pill', role: 'region', 'aria-label': t('title') },
+            React.createElement('span', { className: 'dvo-status', 'aria-live': 'polite', 'aria-atomic': 'true' }, t('undo'), ': ', left, t('secondsShort')),
             React.createElement('button', {
               type: 'button', className: 'dvo-pbtn', title: t('undo'),
+              'aria-label': t('undo'),
               onClick: async () => {
                 const msg = await undoLastInsert()
                 voice.set({ phase: 'idle', error: msg === t('undone') ? '' : msg })
+                focusComposer()
               },
             }, xIcon()),
           )
         }
-        return React.createElement('div', { className: 'dvo-pill' },
+        return React.createElement('div', { className: 'dvo-pill', role: 'region', 'aria-label': t('title') },
           voice.lastNote && voice.lastNote.url
             ? React.createElement('div', { className: 'dvo-audio-wrap' },
                 React.createElement('button', {
                   type: 'button', className: 'dvo-audio-play',
                   title: isPlaying ? t('pause') : t('play'),
+                  'aria-label': isPlaying ? t('pause') : t('play'),
                   onClick: () => {
                     const el = audioRef.current
                     if (!el) return
@@ -1555,15 +1627,29 @@ window.__ModuleLoader__.load({
                 React.createElement('span', { className: 'dvo-audio-time' }, t('listenBack')),
               )
             : null,
-          React.createElement('span', { className: 'dvo-status' }, t('sendingIn')),
+          React.createElement('span', { className: 'dvo-status', 'aria-live': 'polite', 'aria-atomic': 'true' }, t('sendingIn')),
           React.createElement('span', { className: 'dvo-count' }, left + t('secondsShort')),
-          React.createElement('button', { type: 'button', className: 'dvo-pbtn', title: t('keepPending'), onClick: keepPending }, xIcon()),
+          React.createElement('button', {
+            type: 'button', className: 'dvo-pbtn', title: t('keepPending'),
+            'aria-label': t('keepPending'),
+            onClick: () => {
+              keepPending()
+              focusComposer()
+            },
+          }, xIcon()),
         )
       }
 
-      return React.createElement('div', { className: 'dvo-pill' },
-        React.createElement('span', { className: 'dvo-status dvo-err' }, warnIcon(), v.error),
-        React.createElement('button', { type: 'button', className: 'dvo-pbtn', title: t('hide'), onClick: () => voice.set({ phase: 'idle', error: '' }) }, xIcon()),
+      return React.createElement('div', { className: 'dvo-pill', role: 'region', 'aria-label': t('title') },
+        React.createElement('span', { className: 'dvo-status dvo-err', 'aria-live': 'polite', 'aria-atomic': 'true' }, warnIcon(), v.error),
+        React.createElement('button', {
+          type: 'button', className: 'dvo-pbtn', title: t('hide'),
+          'aria-label': t('hide'),
+          onClick: () => {
+            voice.set({ phase: 'idle', error: '' })
+            focusComposer()
+          },
+        }, xIcon()),
       )
     }
 
@@ -1666,16 +1752,16 @@ window.__ModuleLoader__.load({
       '.cb-row{display:flex;flex-wrap:wrap;gap:10px;align-items:center}' +
       '.cb-grid-2{display:grid;grid-template-columns:repeat(auto-fit, minmax(260px, 1fr));gap:12px}' +
       '.cb-badge{font-size:11px;padding:2px 8px;border-radius:999px;border:1px solid var(--dsw-alias-border-l2);display:inline-flex;align-items:center;gap:4px;font-weight:500}' +
-      '.cb-badge-ok{border-color:var(--dsw-alias-state-success-primary);color:var(--dsw-alias-state-success-primary);background:rgba(16,185,129,0.08)}' +
-      '.cb-badge-warn{border-color:var(--dsw-alias-state-warning-primary);color:var(--dsw-alias-state-warning-primary);background:rgba(245,158,11,0.08)}' +
-      '.cb-badge-bad{border-color:var(--dsw-alias-state-error-primary);color:var(--dsw-alias-state-error-primary);background:rgba(239,68,68,0.08)}' +
+      '.cb-badge-ok{border-color:var(--dsw-alias-state-success-primary);color:var(--dsw-alias-state-success-primary);background:color-mix(in srgb, var(--dsw-alias-state-success-primary) 8%, transparent)}' +
+      '.cb-badge-warn{border-color:var(--dsw-alias-state-warning-primary);color:var(--dsw-alias-state-warning-primary);background:color-mix(in srgb, var(--dsw-alias-state-warning-primary) 8%, transparent)}' +
+      '.cb-badge-bad{border-color:var(--dsw-alias-state-error-primary);color:var(--dsw-alias-state-error-primary);background:color-mix(in srgb, var(--dsw-alias-state-error-primary) 8%, transparent)}' +
       '.cb-input{height:34px;border:1px solid var(--dsw-alias-border-l2);background:var(--dsw-alias-bg-layer-2);color:var(--dsw-alias-label-primary);border-radius:8px;padding:0 10px;font-size:13px;box-sizing:border-box}' +
       '.cb-input:focus{outline:none;border-color:var(--dsw-alias-state-brand-primary)}' +
       '.cb-btn{appearance:none;font:inherit;cursor:pointer;border:1px solid var(--dsw-alias-border-l2);border-radius:8px;padding:6px 12px;font-size:13px;background:var(--dsw-alias-bg-layer-2);color:var(--dsw-alias-label-primary);font-weight:500;display:inline-flex;align-items:center;justify-content:center;gap:6px;transition:all .15s ease}' +
       '.cb-btn:hover:not(:disabled){background:var(--dsw-alias-bg-layer-4, var(--dsw-alias-bg-layer-2));border-color:var(--dsw-alias-label-dimmed, var(--dsw-alias-border-l2))}' +
       '.cb-btn-primary{background:var(--dsw-alias-label-primary);color:var(--dsw-alias-bg-layer-3);border-color:transparent}' +
       '.cb-btn-primary:hover:not(:disabled){background:var(--dsw-alias-label-primary) !important;color:var(--dsw-alias-bg-layer-3) !important;opacity:0.88}' +
-      '.cb-btn-danger{color:var(--dsw-alias-state-error-primary);border-color:rgba(239,68,68,0.3)}' +
+      '.cb-btn-danger{color:var(--dsw-alias-state-error-primary);border-color:color-mix(in srgb, var(--dsw-alias-state-error-primary) 30%, transparent)}' +
       '.cb-btn-mini{border:1px solid var(--dsw-alias-border-l2);background:transparent;color:var(--dsw-alias-label-primary);border-radius:6px;width:28px;height:28px;cursor:pointer;flex:none;display:inline-flex;align-items:center;justify-content:center;padding:0;font-size:13px}' +
       '.cb-btn-mini:hover:not(:disabled){background:var(--dsw-alias-bg-layer-2)}' +
       '.cb-field{display:flex;flex-direction:column;gap:6px;padding:6px 0;font-size:13px;color:var(--dsw-alias-label-primary)}' +
@@ -1683,7 +1769,7 @@ window.__ModuleLoader__.load({
       '.cb-field textarea{height:auto;padding:8px 10px;font-family:inherit}' +
       '.cb-check-label{display:flex;align-items:center;gap:8px;cursor:pointer;font-size:13px;color:var(--dsw-alias-label-primary);user-select:none}' +
       '.cb-check-label input[type="checkbox"]{width:16px;height:16px;cursor:pointer}' +
-      '.cb-alert-err{padding:10px 14px;border-radius:8px;background:rgba(239,68,68,0.1);color:var(--dsw-alias-state-error-primary);font-size:13px}' +
+      '.cb-alert-err{padding:10px 14px;border-radius:8px;background:color-mix(in srgb, var(--dsw-alias-state-error-primary) 10%, transparent);color:var(--dsw-alias-state-error-primary);font-size:13px}' +
       '.dvs-wrap{display:flex;flex-direction:column;gap:18px;padding:4px 0;max-width:960px}' +
       '.dvs-block{display:flex;flex-direction:column;gap:10px}' +
       '.dvs-h{font-size:14px;font-weight:600;color:var(--dsw-alias-label-primary)}' +
@@ -1947,8 +2033,8 @@ window.__ModuleLoader__.load({
         if (testingMic) {
           if (testRef.current) {
             testRef.current.active = false
-            try { testRef.current.stream.getTracks().forEach((t) => t.stop()) } catch (e) {}
-            if (testRef.current.audioCtx) { try { testRef.current.audioCtx.close() } catch (e) {} }
+            try { testRef.current.stream.getTracks().forEach((t) => t.stop()) } catch (e) { /* already stopped */ }
+            if (testRef.current.audioCtx) { try { testRef.current.audioCtx.close() } catch (e) { /* already closed */ } }
             testRef.current = null
           }
           setTestingMic(false)
@@ -1973,7 +2059,7 @@ window.__ModuleLoader__.load({
             filter.Q.value = 0.707
             src.connect(filter)
             lastNode = filter
-          } catch (e) {}
+          } catch (e) { /* filter fallback */ }
           const analyser = audioCtx.createAnalyser()
           analyser.fftSize = 128
           lastNode.connect(analyser)
@@ -1982,12 +2068,12 @@ window.__ModuleLoader__.load({
 
           const check = () => {
             if (!testRef.current || !testRef.current.active) return
-            const data = new Uint8Array(analyser.frequencyBinCount)
-            analyser.getByteFrequencyData(data)
+            const arr = new Uint8Array(analyser.frequencyBinCount)
+            analyser.getByteFrequencyData(arr)
             let sum = 0
-            for (let i = 0; i < data.length; i++) sum += data[i]
-            const lvl = Math.min(100, Math.round((sum / data.length / 255) * 220))
-            setTestLevel(lvl)
+            for (let i = 0; i < arr.length; i++) sum += arr[i]
+            const avg = sum / (arr.length || 1)
+            setTestLevel(Math.min(100, Math.round((avg / 128) * 100)))
             requestAnimationFrame(check)
           }
           requestAnimationFrame(check)
@@ -2000,8 +2086,8 @@ window.__ModuleLoader__.load({
         return () => {
           if (testRef.current) {
             testRef.current.active = false
-            try { testRef.current.stream.getTracks().forEach((t) => t.stop()) } catch (e) {}
-            if (testRef.current.audioCtx) { try { testRef.current.audioCtx.close() } catch (e) {} }
+            try { testRef.current.stream.getTracks().forEach((t) => t.stop()) } catch (e) { /* already stopped */ }
+            if (testRef.current.audioCtx) { try { testRef.current.audioCtx.close() } catch (e) { /* already closed */ } }
             testRef.current = null
           }
         }
@@ -2032,6 +2118,55 @@ window.__ModuleLoader__.load({
         fetchStatus()
       }, [fetchStatus])
 
+      const [updaterStatus, setUpdaterStatus] = React.useState(null)
+      const [updating, setUpdating] = React.useState(false)
+      const [updaterMsg, setUpdaterMsg] = React.useState('')
+      const [updaterLoading, setUpdaterLoading] = React.useState(false)
+
+      const checkUpdater = React.useCallback(async () => {
+        setUpdaterLoading(true)
+        setUpdaterMsg('')
+        try {
+          const res = await fetch('/api/dsh-voice/update', {
+            headers: { accept: 'application/json' },
+            cache: 'no-store',
+          })
+          if (!res.ok) throw new Error(`HTTP ${res.status}`)
+          const data = await res.json()
+          setUpdaterStatus(data)
+        } catch (e) {
+          /* best effort update check */
+        } finally {
+          setUpdaterLoading(false)
+        }
+      }, [])
+
+      const onUpdateNow = async () => {
+        setUpdating(true)
+        setUpdaterMsg('')
+        try {
+          const res = await fetch('/api/dsh-voice/update', {
+            method: 'POST',
+            headers: {
+              'x-dsh-plugin-update': '1',
+              'content-type': 'application/json',
+            },
+          })
+          const data = await res.json()
+          if (!res.ok) throw new Error(data?.error || `HTTP ${res.status}`)
+          setUpdaterStatus(data)
+          setUpdaterMsg(t('updateSuccess'))
+        } catch (e) {
+          setUpdaterMsg(t('updateFailed') + ' ' + (e?.message || String(e)))
+        } finally {
+          setUpdating(false)
+        }
+      }
+
+      React.useEffect(() => {
+        checkUpdater()
+      }, [checkUpdater])
+
       if (!ready) {
         const waiting = !snap || snap.status === 'loading'
         return React.createElement('div', { className: 'cb-page' },
@@ -2461,6 +2596,47 @@ window.__ModuleLoader__.load({
           ),
         ),
 
+        // 7. Plugin Version & Updates Card
+        React.createElement('div', { className: 'cb-section-card' },
+          React.createElement('div', { className: 'cb-section-title' },
+            React.createElement('span', null, '📦 ' + t('versionTitle')),
+            React.createElement('button', {
+              type: 'button', className: 'cb-btn', style: { fontSize: '12px', padding: '4px 8px' },
+              onClick: checkUpdater, disabled: updaterLoading || updating,
+            }, updaterLoading ? '⏳…' : '🔄 ' + t('refreshStats')),
+          ),
+          React.createElement('div', { className: 'cb-section-desc' }, t('versionHint')),
+          React.createElement('div', { className: 'cb-row', style: { alignItems: 'center', gap: '12px' } },
+            React.createElement('span', { className: 'cb-badge cb-badge-ok' },
+              'v' + ((updaterStatus && updaterStatus.currentVersion) || '0.8.29')
+            ),
+            updaterStatus && updaterStatus.updateAvailable
+              ? React.createElement('span', { className: 'cb-badge cb-badge-warn' },
+                  t('updateAvailable') + ': v' + updaterStatus.latestVersion
+                )
+              : React.createElement('span', { className: 'cb-badge cb-badge-ok' },
+                  t('upToDate')
+                ),
+            updaterStatus && updaterStatus.updateAvailable
+              ? React.createElement('button', {
+                  type: 'button', className: 'cb-btn cb-btn-primary', style: { fontSize: '12px', padding: '4px 10px' },
+                  onClick: onUpdateNow, disabled: updating,
+                }, updating ? t('updating') : t('updateNow'))
+              : null,
+          ),
+          updaterMsg
+            ? React.createElement('div', {
+                style: {
+                  marginTop: '8px',
+                  fontSize: '12px',
+                  color: updaterMsg.includes('fail') || updaterMsg.includes('失败')
+                    ? 'var(--dsw-alias-state-warning-primary)'
+                    : 'var(--dsw-alias-state-success-primary)',
+                },
+              }, updaterMsg)
+            : null,
+        ),
+
         // Action bar (Save)
         React.createElement('div', { className: 'cb-row' },
           React.createElement('button', { type: 'button', className: 'cb-btn cb-btn-primary', disabled: !writable, onClick: save }, t('save')),

package/lib/http-util.js

@@ -25,4 +25,52 @@ export function readBody(req, maxBytes) {
     req.on('end', () => resolve(Buffer.concat(chunks)))
     req.on('error', reject)
   })
+}
+
+/**
+ * Check whether an IP address is a local loopback interface.
+ * @param {string} addr
+ * @returns {boolean}
+ */
+export function isLoopback(addr) {
+  if (!addr) return false
+  const clean = String(addr).replace(/^::ffff:/, '')
+  return clean === '127.0.0.1' || clean === '::1' || clean === 'localhost'
+}
+
+/**
+ * Verify that the HTTP request originates from a trusted caller (loopback or same-origin).
+ * Fail-closed security guard for state-changing or quota-consuming POST routes.
+ * @param {import('node:http').IncomingMessage} req
+ * @returns {boolean}
+ */
+export function isTrustedCaller(req) {
+  if (!req) return false
+  const remote = req.socket?.remoteAddress || req.connection?.remoteAddress || ''
+  if (isLoopback(remote)) return true
+
+  const secSite = String(req.headers?.['sec-fetch-site'] || '').toLowerCase()
+  if (secSite === 'same-origin' || secSite === 'same-site') return true
+  if (secSite === 'cross-site') return false
+
+  const host = String(req.headers?.host || '').toLowerCase()
+  const origin = String(req.headers?.origin || '').trim().toLowerCase()
+  if (origin) {
+    try {
+      const u = new URL(origin)
+      if (u.host === host) return true
+    } catch { /* invalid url */ }
+    return false
+  }
+
+  const referer = String(req.headers?.referer || '').trim().toLowerCase()
+  if (referer) {
+    try {
+      const u = new URL(referer)
+      if (u.host === host) return true
+    } catch { /* invalid url */ }
+    return false
+  }
+
+  return false
 }

package/lib/index.js

@@ -22,16 +22,18 @@ import { makeProviders, PROVIDER_KEYS, PRESET_KEYS, KNOWN_KEYS, DEFAULT_MODELS,
 import { toWav16k } from './wav.js'
 import { normalizePhrase } from './normalize.js'
 import { createStatsTracker, mergeContextVocabulary } from './stats.js'
-import { writeJson, readBody } from './http-util.js'
+import { writeJson, readBody, isTrustedCaller } from './http-util.js'
 import { createPolishText } from './polish.js'
 import { createUserMessage } from '@deepseek-ai/dsh-llm'
 import { buildProviderOrder, sessionCommand } from './transcribe-core.js'
+import { registerPluginUpdater } from './updater.js'
 
 function isAutoLang(lang) {
   return !lang || lang === 'auto' || String(lang).includes(',')
 }
 
-export const name = 'dsh-voice'
+export const name = '@goodandready/dsh-voice'
+export const NS = 'dsh-voice'
 export const inject = ['tools', 'credentials', 'webServer', 'shell', 'settings', 'llm']
 
 const ChainEntry = z.object({
@@ -181,7 +183,7 @@ export function apply(ctx, baseConfig) {
   const live = () => Config(structuredClone(getConfig() ?? {})) ?? baseConfig
 
   ctx.inject(['settings'], (sctx) => {
-    const scope = sctx.settings.register(name, Config, { base: baseConfig })
+    const scope = sctx.settings.register(NS, Config, { base: baseConfig })
     getConfig = () => scope.get() ?? baseConfig
     sctx.effect(() => () => { getConfig = () => baseConfig })
   })
@@ -207,6 +209,7 @@ export function apply(ctx, baseConfig) {
     } catch { return false }
   }
 
+  let whisperError = null
   let startingWhisper = false
   async function startWhisper() {
     if (startingWhisper) return false
@@ -216,7 +219,10 @@ export function apply(ctx, baseConfig) {
     // Without a model path there is nothing to start: the package cannot know
     // where a user's model lives and must not launch a random binary.
     if (!cfg.whisperModel) return false
-    if (await whisperAlive()) return true
+    if (await whisperAlive()) {
+      whisperError = null
+      return true
+    }
     try {
       const spec = ctx.shell.resolve({
         command: `${JSON.stringify(cfg.whisperBin)} -m ${JSON.stringify(cfg.whisperModel)}`
@@ -227,10 +233,17 @@ export function apply(ctx, baseConfig) {
       child = ctx.shell.start(spec)
       for (let i = 0; i < 20; i++) {
         await new Promise((r) => setTimeout(r, 500))
-        if (await whisperAlive()) return true
+        if (await whisperAlive()) {
+          whisperError = null
+          return true
+        }
       }
+      whisperError = 'whisper server process started but failed health check on port 8001'
       return false
-    } catch { return false }
+    } catch (err) {
+      whisperError = String(err && err.message ? err.message : err)
+      return false
+    }
     finally { startingWhisper = false }
   }
 
@@ -238,6 +251,7 @@ export function apply(ctx, baseConfig) {
 
   // SenseVoice-ONNX / Sherpa-ONNX: autostart and health check.
   let sensevoiceChild = null
+  let sensevoiceError = null
 
   async function sensevoiceAlive() {
     try {
@@ -259,7 +273,10 @@ export function apply(ctx, baseConfig) {
     const cfg = live()
     if (!cfg.sensevoiceAutostart) return false
     if (!cfg.sensevoiceModel) return false
-    if (await sensevoiceAlive()) return true
+    if (await sensevoiceAlive()) {
+      sensevoiceError = null
+      return true
+    }
     try {
       let port = '6006'
       try { port = new URL(cfg.sensevoiceUrl).port || '6006' } catch { /* invalid URL */ }
@@ -273,10 +290,17 @@ export function apply(ctx, baseConfig) {
       sensevoiceChild = ctx.shell.start(spec)
       for (let i = 0; i < 20; i++) {
         await new Promise((r) => setTimeout(r, 500))
-        if (await sensevoiceAlive()) return true
+        if (await sensevoiceAlive()) {
+          sensevoiceError = null
+          return true
+        }
       }
+      sensevoiceError = 'sensevoice process started but failed health check'
       return false
-    } catch { return false }
+    } catch (err) {
+      sensevoiceError = String(err && err.message ? err.message : err)
+      return false
+    }
     finally { startingSensevoice = false }
   }
 
@@ -330,9 +354,14 @@ export function apply(ctx, baseConfig) {
     handler: async (req, res) => {
       if (req.method !== 'GET') { writeJson(res, 405, { ok: false, error: { code: 'method', message: 'GET only' } }); return }
       const cfg = live()
+      const whisperOk = await whisperAlive()
+      const sensevoiceOk = await sensevoiceAlive()
       writeJson(res, 200, {
         ok: true,
-        whisperRunning: await whisperAlive(),
+        whisperRunning: whisperOk,
+        whisperError: whisperOk ? null : whisperError,
+        sensevoiceRunning: sensevoiceOk,
+        sensevoiceError: sensevoiceOk ? null : sensevoiceError,
         // The hotkey is needed by the browser half: it installs the hold handler.
         hotkey: cfg.hotkey,
         providers: KNOWN_KEYS.concat(
@@ -378,9 +407,10 @@ export function apply(ctx, baseConfig) {
     path: '/dsh-voice/polish',
     handler: async (req, res) => {
       if (req.method !== 'POST') { writeJson(res, 405, { ok: false, error: { code: 'method', message: 'POST only' } }); return }
+      if (!isTrustedCaller(req)) { writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'forbidden source origin' } }); return }
       const cfg = live()
       let raw
-      try { raw = await readBody(req, cfg.maxFileBytes + 1024 * 1024) } catch (e) { writeJson(res, 400, { ok: false, error: { code: 'body', message: e.message } }); return }
+      try { raw = await readBody(req, 1024 * 1024) } catch (e) { writeJson(res, 400, { ok: false, error: { code: 'body', message: e.message } }); return }
       let payload = {}
       try { payload = JSON.parse(raw.toString('utf8') || '{}') } catch { /* empty */ }
       const text = typeof payload.text === 'string' ? payload.text.trim() : ''
@@ -401,6 +431,7 @@ export function apply(ctx, baseConfig) {
     path: '/dsh-voice/transcribe',
     handler: async (req, res) => {
       if (req.method !== 'POST') { writeJson(res, 405, { ok: false, error: { code: 'method', message: 'POST only' } }); return }
+      if (!isTrustedCaller(req)) { writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'forbidden source origin' } }); return }
       const cfg = live()
       let raw
       try {
@@ -512,4 +543,10 @@ export function apply(ctx, baseConfig) {
     if (child) { try { child.kill && child.kill() } catch { /* already dead */ } }
     if (sensevoiceChild) { try { sensevoiceChild.kill && sensevoiceChild.kill() } catch { /* already dead */ } }
   }, 'dsh-voice: stop child processes')
+
+  ctx.effect(() => registerPluginUpdater(ctx, {
+    endpoint: '/api/dsh-voice/update',
+    packageName: '@goodandready/dsh-voice',
+    manifestUrl: new URL('../package.json', import.meta.url),
+  }), 'dsh-voice: updater route')
 }

package/lib/normalize.js

@@ -16,6 +16,8 @@ export function ensureTrailingPeriod(text) {
   return t + '.'
 }
 
+// Functional linguistic data for speech-to-text numeral normalization.
+// Note: Language processing dictionary for audio transcript conversion, not UI text strings.
 const NUM_WORDS = {
   ноль: 0, один: 1, одна: 1, одно: 1, два: 2, две: 2, три: 3, четыре: 4, пять: 5,
   шесть: 6, семь: 7, восемь: 8, девять: 9, десять: 10, одиннадцать: 11,

package/lib/provider-http.js

@@ -0,0 +1,64 @@
+// Pure helper functions for STT provider HTTP requests and responses.
+
+/**
+ * Check if the language is unspecified or set to automatic detection.
+ * @param {string} [lang]
+ * @returns {boolean}
+ */
+export function isAutoLang(lang) {
+  return !lang || lang === 'auto' || String(lang).includes(',')
+}
+
+/**
+ * Determine the audio container format supported by the OpenAI Chat Audio API.
+ * @param {string} [mime='']
+ * @returns {'wav' | 'mp3' | ''}
+ */
+export function chatAudioFormat(mime = '') {
+  if (mime.includes('wav')) return 'wav'
+  if (mime.includes('mpeg') || mime.includes('mp3')) return 'mp3'
+  return ''
+}
+
+/**
+ * Return a safe file name based on mime type for multipart form uploads.
+ * @param {string} [mime='']
+ * @returns {string}
+ */
+export function fileName(mime = '') {
+  if (mime.includes('wav')) return 'audio.wav'
+  if (mime.includes('ogg')) return 'audio.ogg'
+  if (mime.includes('mp4')) return 'audio.m4a'
+  return 'audio.webm'
+}
+
+/**
+ * Safely parse JSON from a response or throw a standardized descriptive Error.
+ * @param {Response} res
+ * @param {string} defaultLabel
+ * @returns {Promise<any>}
+ */
+export async function safeJson(res, defaultLabel) {
+  try {
+    return await res.json()
+  } catch {
+    throw new Error(`${defaultLabel}: invalid JSON response`)
+  }
+}
+
+/**
+ * Extract an error message or detail string from a non-2xx HTTP response.
+ * @param {Response} res
+ * @param {string} defaultLabel
+ * @returns {Promise<string>}
+ */
+export async function readErrorDetail(res, defaultLabel) {
+  let detail = `HTTP ${res.status}`
+  try {
+    const e = await res.json()
+    if (e?.error) detail = typeof e.error === 'string' ? e.error : (e.error.message || JSON.stringify(e.error))
+    else if (e?.message) detail = e.message
+    else if (e?.err_msg) detail = e.err_msg
+  } catch { /* not json */ }
+  return `${defaultLabel} ${detail}`
+}

package/lib/providers.js

@@ -68,13 +68,8 @@ const CHAT_AUDIO_PROMPT =
   'Transcribe the audio verbatim. Reply with the transcript text only, '
   + 'without comments, quotes or formatting.'
 
-// Formats the chat template accepts in input_audio. Everything else
-// (including browser webm/opus) is converted to WAV first.
-function chatAudioFormat(mime) {
-  if (mime.includes('wav')) return 'wav'
-  if (mime.includes('mpeg') || mime.includes('mp3')) return 'mp3'
-  return ''
-}
+import { readErrorDetail, safeJson, isAutoLang, fileName, chatAudioFormat } from './provider-http.js'
+export { readErrorDetail, safeJson, isAutoLang, fileName, chatAudioFormat }
 
 export const DEFAULT_MODELS = {
   deepgram: 'nova-2',
@@ -89,37 +84,6 @@ function pickModel(models, key) {
   return chosen || DEFAULT_MODELS[key]
 }
 
-function fileName(mime) {
-  if (mime.includes('wav')) return 'audio.wav'
-  if (mime.includes('ogg')) return 'audio.ogg'
-  if (mime.includes('mp4')) return 'audio.m4a'
-  return 'audio.webm'
-}
-
-// Auto language: empty, 'auto', or a list ('ru,en') means the provider
-// detects language; the language field is omitted. whisper.cpp gets -l auto.
-function isAutoLang(lang) {
-  return !lang || lang === 'auto' || String(lang).includes(',')
-}
-
-async function readErrorDetail(res, defaultLabel) {
-  let detail = `HTTP ${res.status}`
-  try {
-    const e = await res.json()
-    if (e?.error) detail = typeof e.error === 'string' ? e.error : (e.error.message || JSON.stringify(e.error))
-    else if (e?.message) detail = e.message
-    else if (e?.err_msg) detail = e.err_msg
-  } catch { /* not json */ }
-  return `${defaultLabel} ${detail}`
-}
-
-async function safeJson(res, defaultLabel) {
-  try {
-    return await res.json()
-  } catch {
-    throw new Error(`${defaultLabel}: invalid JSON response`)
-  }
-}
 
 export function makeProviders(deps, req) {
   const { resolveKey, fetchImpl, cfg } = deps

package/lib/updater.js

@@ -0,0 +1,266 @@
+// lib/updater.js — Host-side one-click updater for @goodandready/dsh-voice
+// Implements canonical DSH plugin-updater specification.
+
+import { spawn } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import { readFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { basename, dirname, isAbsolute, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const UPDATE_HEADER = 'x-dsh-plugin-update';
+const UPDATE_TIMEOUT_MS = 10 * 60_000;
+const VERSION_CACHE_MS = 5 * 60_000;
+let latestCache;
+
+function header(request, name) {
+  const value = request?.headers?.[name];
+  return Array.isArray(value) ? value[0] : value;
+}
+
+function isLoopback(value) {
+  const address = value?.toLowerCase().replace(/^\[|\]$/g, '');
+  return address === 'localhost' || address === 'localhost.' || address === '::1'
+    || address?.startsWith('127.') === true
+    || address?.startsWith('::ffff:127.') === true;
+}
+
+export function isTrustedUpdateRequest(request) {
+  if (header(request, UPDATE_HEADER) !== '1') return false;
+  if (!isLoopback(request.socket?.remoteAddress)) return false;
+  const site = header(request, 'sec-fetch-site');
+  if (site !== undefined && site !== 'same-origin') return false;
+  const origin = header(request, 'origin');
+  const host = header(request, 'host');
+  if (origin === undefined || host === undefined) return false;
+  try {
+    const url = new URL(origin);
+    return (url.protocol === 'http:' || url.protocol === 'https:')
+      && isLoopback(url.hostname) && url.host === host;
+  } catch {
+    return false;
+  }
+}
+
+function validProfileName(value) {
+  return typeof value === 'string' && value !== '' && value !== '.' && value !== '..'
+    && !value.includes('/') && !value.includes('\\') && !/[\0-\x1f\x7f]/.test(value);
+}
+
+function profileNameFromArgv(argv) {
+  for (let index = 2; index < argv.length; index += 1) {
+    if (argv[index] === '--profile') return argv[index + 1];
+    if (argv[index]?.startsWith('--profile=')) return argv[index].slice('--profile='.length);
+  }
+  return argv[2] === 'web' ? 'web' : undefined;
+}
+
+function findDshCliEntry() {
+  const value = process.argv[1];
+  if (value === undefined || value === '') return undefined;
+  const entry = value.startsWith('file:') ? fileURLToPath(value) : resolve(process.cwd(), value);
+  if (!existsSync(entry)) return undefined;
+  for (let directory = dirname(entry); ; directory = dirname(directory)) {
+    const manifestPath = resolve(directory, 'package.json');
+    if (existsSync(manifestPath)) {
+      try {
+        const manifest = JSON.parse(readFileSync(manifestPath, 'utf8'));
+        const bin = typeof manifest.bin === 'string'
+          ? manifest.bin
+          : typeof manifest.bin === 'object' && manifest.bin !== null
+            ? manifest.bin.dsh
+            : undefined;
+        if (manifest.name === '@deepseek-ai/dsh' && typeof bin === 'string'
+          && !isAbsolute(bin) && resolve(directory, bin) === resolve(entry)) return entry;
+      } catch {
+        // Continue searching parent package directories.
+      }
+    }
+    const parent = dirname(directory);
+    if (parent === directory) return undefined;
+  }
+}
+
+function runtime() {
+  const profileDir = resolve(process.env.DSH_PROFILE_DIR
+    ?? resolve(homedir(), '.dsh', 'profiles', 'web'));
+  const selected = profileNameFromArgv(process.argv);
+  const profileName = validProfileName(selected)
+    ? selected
+    : validProfileName(basename(profileDir)) ? basename(profileDir) : 'web';
+  const cliEntry = findDshCliEntry();
+  return cliEntry === undefined ? { profileName, profileDir } : { profileName, profileDir, cliEntry };
+}
+
+export function parseSemver(value) {
+  const match = /^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/.exec(value);
+  if (match === null) return undefined;
+  return {
+    core: [Number(match[1]), Number(match[2]), Number(match[3])],
+    prerelease: match[4]?.split('.') ?? [],
+  };
+}
+
+function comparePrerelease(left, right) {
+  if (left.length === 0 || right.length === 0) return left.length === right.length ? 0 : left.length === 0 ? 1 : -1;
+  const length = Math.max(left.length, right.length);
+  for (let index = 0; index < length; index += 1) {
+    const a = left[index];
+    const b = right[index];
+    if (a === undefined || b === undefined) return a === b ? 0 : a === undefined ? -1 : 1;
+    if (a === b) continue;
+    const aNumeric = /^\d+$/.test(a);
+    const bNumeric = /^\d+$/.test(b);
+    if (aNumeric && bNumeric) {
+      const aNumber = BigInt(a);
+      const bNumber = BigInt(b);
+      if (aNumber !== bNumber) return aNumber > bNumber ? 1 : -1;
+      continue;
+    }
+    if (aNumeric !== bNumeric) return aNumeric ? -1 : 1;
+    return a > b ? 1 : -1;
+  }
+  return 0;
+}
+
+export function isNewerVersion(currentValue, candidateValue) {
+  const current = parseSemver(currentValue);
+  const candidate = parseSemver(candidateValue);
+  if (current === undefined || candidate === undefined) return false;
+  for (let index = 0; index < 3; index += 1) {
+    if (candidate.core[index] !== current.core[index]) return candidate.core[index] > current.core[index];
+  }
+  return comparePrerelease(candidate.prerelease, current.prerelease) > 0;
+}
+
+async function latestVersion(packageName, registry) {
+  if (latestCache?.packageName === packageName && latestCache.registry === registry && Date.now() < latestCache.expiresAt) return latestCache.version;
+  try {
+    const response = await fetch(`${registry.replace(/\/$/, '')}/${encodeURIComponent(packageName)}/latest`, {
+      signal: AbortSignal.timeout(8_000),
+    });
+    if (!response.ok) return undefined;
+    const value = await response.json();
+    if (typeof value.version !== 'string' || value.version === '') return undefined;
+    latestCache = { packageName, registry, version: value.version, expiresAt: Date.now() + VERSION_CACHE_MS };
+    return value.version;
+  } catch {
+    return undefined;
+  }
+}
+
+async function currentVersion(manifestUrl) {
+  const value = JSON.parse(await readFile(manifestUrl, 'utf8'));
+  if (typeof value.version !== 'string' || value.version === '') throw new Error('Cannot read current plugin version.');
+  return value.version;
+}
+
+export async function getUpdateStatus(options, target = runtime()) {
+  const current = await currentVersion(options.manifestUrl);
+  const latest = await latestVersion(options.packageName, options.registry ?? 'https://registry.npmjs.org');
+  return {
+    packageName: options.packageName,
+    currentVersion: current,
+    ...(latest === undefined ? {} : { latestVersion: latest }),
+    latestCheckFailed: latest === undefined,
+    updateAvailable: latest !== undefined && isNewerVersion(current, latest),
+    profileName: target.profileName,
+    canAutoUpdate: target.cliEntry !== undefined,
+  };
+}
+
+async function installExact(target, packageSpec, options) {
+  if (target.cliEntry === undefined) throw new Error('Automatic update is unavailable in this runtime.');
+  await new Promise((resolvePromise, reject) => {
+    const child = spawn(process.execPath, [
+      target.cliEntry, 'plugin', '--profile', target.profileName, 'add',
+      '--config.minimumReleaseAge=0', packageSpec,
+      `--registry=${options.registry ?? 'https://registry.npmjs.org/'}`,
+    ], {
+      cwd: target.profileDir,
+      windowsHide: true,
+      stdio: ['ignore', 'pipe', 'pipe'],
+      env: { ...process.env, NO_COLOR: '1' },
+    });
+    let detail = '';
+    child.stdout?.on('data', chunk => { detail = (detail + String(chunk)).slice(-4_000); });
+    child.stderr?.on('data', chunk => { detail = (detail + String(chunk)).slice(-4_000); });
+    const timer = setTimeout(() => {
+      child.kill();
+      reject(new Error('Update timed out; use the normal DSH update flow.'));
+    }, UPDATE_TIMEOUT_MS);
+    child.once('error', error => { clearTimeout(timer); reject(error); });
+    child.once('exit', code => {
+      clearTimeout(timer);
+      if (code === 0) resolvePromise();
+      else reject(new Error(detail.trim() || `Update exited with code ${String(code)}.`));
+    });
+  });
+}
+
+function json(response, statusCode, value) {
+  response.writeHead(statusCode, {
+    'content-type': 'application/json; charset=utf-8',
+    'cache-control': 'no-store',
+  });
+  response.end(JSON.stringify(value));
+}
+
+export function registerPluginUpdater(ctx, options) {
+  const host = ctx;
+  let installing = false;
+  return host.webServer.register({
+    kind: 'exact',
+    path: options.endpoint,
+    handler: async (request, response) => {
+      try {
+        const target = runtime();
+        if (request.method === 'GET' || request.method === 'HEAD') {
+          const payload = await getUpdateStatus(options, target);
+          response.writeHead(200, {
+            'content-type': 'application/json; charset=utf-8',
+            'cache-control': 'no-store',
+          });
+          response.end(request.method === 'HEAD' ? undefined : JSON.stringify(payload));
+          return;
+        }
+        if (request.method !== 'POST') {
+          response.writeHead(405, { allow: 'GET, HEAD, POST' });
+          response.end();
+          return;
+        }
+        if (!isTrustedUpdateRequest(request)) {
+          json(response, 403, { error: 'Rejected non-local or cross-origin update request.' });
+          return;
+        }
+        if (installing) {
+          json(response, 409, { error: 'This plugin is already updating.' });
+          return;
+        }
+        installing = true;
+        try {
+          const before = await getUpdateStatus(options, target);
+          if (before.latestVersion === undefined) {
+            json(response, 503, { error: 'The latest version is temporarily unavailable.' });
+            return;
+          }
+          if (!before.updateAvailable) {
+            json(response, 200, before);
+            return;
+          }
+          await installExact(target, `${options.packageName}@${before.latestVersion}`, options);
+          json(response, 200, {
+            ...before,
+            updatedVersion: before.latestVersion,
+            restartRequired: true,
+          });
+        } finally {
+          installing = false;
+        }
+      } catch (error) {
+        ctx.logger?.warn?.(`plugin updater failed: ${String(error)}`);
+        json(response, 503, { error: 'Plugin update failed; see server logs.' });
+      }
+    },
+  });
+}

package/lib/wav.js

@@ -29,13 +29,13 @@ export function toWav16k(bytes, ffmpegBin = 'ffmpeg', signal = null) {
 
     const timeout = setTimeout(() => {
       cleanup()
-      try { proc.kill('SIGKILL') } catch {}
+      try { proc.kill('SIGKILL') } catch (e) { /* process already exited */ }
       reject(new Error('ffmpeg conversion timed out after 30s'))
     }, 30000)
 
     const onAbort = () => {
       cleanup()
-      try { proc.kill('SIGKILL') } catch {}
+      try { proc.kill('SIGKILL') } catch (e) { /* process already exited */ }
       reject(new Error('ffmpeg conversion aborted'))
     }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-voice",
-  "version": "0.8.28",
+  "version": "0.8.30",
   "description": "Voice input for DeepSeek Harness: dictation chunked by pauses and voice messages, each with its own provider fallback chain (Deepgram, Groq, HuggingFace, local whisper.cpp, plus any OpenAI-compatible API of your own).",
   "license": "MIT",
   "type": "module",
@@ -43,7 +43,9 @@
   "scripts": {
     "test": "node --test test/*.test.mjs",
     "build:client": "node scripts/build-client.mjs",
-    "pretest": "node scripts/build-client.mjs"
+    "pretest": "node scripts/build-client.mjs",
+    "lint": "node --check lib/*.js scripts/*.mjs",
+    "pack:check": "node scripts/pack-check.mjs"
   },
   "dsh": {
     "bundle": {