@goodandready/dsh-voice 0.9.0 → 0.9.1

package/README.md

@@ -211,7 +211,7 @@ Open **Settings → Plugins → Plugin settings → Voice** in the Web UI:
 ## 🤖 Agent Tool & HTTP API
 
 ### Agent Tool (`transcribe_audio`)
-Registers `transcribe_audio(file_path, language?)` in `ctx.tools`, allowing agents to analyze audio files, interview recordings, and voice notes directly from disk.
+Registers `transcribe_audio(file_path, language?)` in `ctx.tools`, allowing agents to analyze audio files, interview recordings, and voice notes directly from disk. Path containment is strictly enforced against allowed directories (`allowedAudioDirs`, `~/.dsh`, `tmpdir`, `cwd`) with symlink traversal escape prevention and magic-byte audio format validation.
 
 ### Internal HTTP Endpoints
 * `POST /dsh-voice/transcribe` — `{ dataBase64, mimeType, mode }` → `{ ok, text, provider, tookMs }`
@@ -219,6 +219,7 @@ Registers `transcribe_audio(file_path, language?)` in `ctx.tools`, allowing agen
 * `GET /dsh-voice/status` — Returns daemon status, active chains, SenseVoice.
 * `GET /dsh-voice/config` — Returns live plugin configuration snapshot.
 * `PUT /dsh-voice/config` — Updates and persists plugin configuration across network.
+* `GET/POST /dsh-voice/sensevoice-installer` — SenseVoice 1-click model installation status and trigger (protected by `isTrustedCaller`, model paths redacted).
 
 ---
 

package/README.ru.md

@@ -211,7 +211,7 @@ dsh plugin --profile web add @goodandready/dsh-voice
 ## 🤖 Инструмент агента и HTTP API
 
 ### Инструмент агента (`transcribe_audio`)
-Регистрирует `transcribe_audio(file_path, language?)` в `ctx.tools`, позволяя агентам распознавать аудиофайлы, интервью и записи с диска.
+Регистрирует `transcribe_audio(file_path, language?)` в `ctx.tools` (с проверкой границ разрешённых каталогов `allowedAudioDirs` / `~/.dsh` / `tmpdir` / `cwd`, защитой от симлинков и валидацией сигнатур аудиофайлов), позволяя агентам распознавать аудиофайлы, интервью и записи с диска.
 
 ### Внутренние HTTP эндпоинты
 * `POST /dsh-voice/transcribe` — `{ dataBase64, mimeType, mode }` → `{ ok, text, provider, tookMs }`

package/README.zh.md

@@ -131,11 +131,17 @@ v0.8.18 质量审查后的修复批次（Gitea #79–#87，PR #88）：
 
 ## 🤖 智能体工具与 HTTP 端点
 
+### 智能体工具 (`transcribe_audio`)
+在 `ctx.tools` 中注册 `transcribe_audio(file_path, language?)`，允许智能体直接读取和转写本地音频文件。包含严格的目录边界检查（`allowedAudioDirs`、`~/.dsh`、`tmpdir`、`cwd`）、符号链接越界防护以及音频特征码（magic bytes）校验。
+
+### 内部 HTTP 端点
+
 * `POST /dsh-voice/transcribe` — 音频转写：`{ dataBase64, mimeType, mode }` → `{ ok, text, provider, tookMs }`
 * `POST /dsh-voice/polish` — 文本模型润色：`{ text }` → `{ ok, text }`
 * `GET /dsh-voice/status` — 查询后端状态、服务商健康度与 SenseVoice
 * `GET /dsh-voice/config` — 获取插件运行时配置快照
 * `PUT /dsh-voice/config` — 跨网络安全持久化更新插件配置
+* `GET/POST /dsh-voice/sensevoice-installer` — SenseVoice 一键模型安装状态与触发接口（受 `isTrustedCaller` 保护，绝对路径脱敏）
 
 ---
 

package/lib/audio-guard.js

@@ -0,0 +1,133 @@
+import path from 'node:path'
+import os from 'node:os'
+import { realpath } from 'node:fs/promises'
+
+/**
+ * Check whether a target path is strictly located within any of the allowed root directories.
+ * Boundary-aware prefix match: /tmp does not allow /tmp-other.
+ * @param {string} targetPath
+ * @param {string[]} allowedRoots
+ * @returns {boolean}
+ */
+export function isPathUnderRoots(targetPath, allowedRoots) {
+  if (!targetPath || !Array.isArray(allowedRoots) || allowedRoots.length === 0) return false
+  const normalized = path.resolve(targetPath)
+
+  return allowedRoots.some((root) => {
+    if (!root) return false
+    const normRoot = path.resolve(root)
+    if (normalized === normRoot) return true
+    const prefix = normRoot.endsWith(path.sep) ? normRoot : normRoot + path.sep
+    return normalized.startsWith(prefix)
+  })
+}
+
+/**
+ * Return allowed root directories for the transcribe_audio tool.
+ * Combines configured audio directories with standard safe locations (.dsh, tmpdir, cwd).
+ * @param {object} [cfg]
+ * @returns {string[]}
+ */
+export function getAllowedAudioRoots(cfg) {
+  const custom = Array.isArray(cfg?.allowedAudioDirs) ? cfg.allowedAudioDirs : []
+  const defaults = [
+    os.tmpdir(),
+    path.join(os.homedir(), '.dsh'),
+    process.cwd(),
+  ]
+  return [...custom, ...defaults].map((d) => path.resolve(String(d)))
+}
+
+/**
+ * Validate audio path before access:
+ * 1. Checks lexical path boundary before calling stat or read.
+ * 2. Checks realpath to prevent symlink traversal escapes.
+ * @param {string} filePath
+ * @param {string[]} allowedRoots
+ * @returns {Promise<{ resolved: string, real: string }>}
+ */
+export async function validateAudioPath(filePath, allowedRoots) {
+  const raw = String(filePath || '').trim()
+  if (!raw) {
+    throw new Error('transcribe_audio: file_path is required')
+  }
+
+  const resolved = path.resolve(raw)
+  if (!isPathUnderRoots(resolved, allowedRoots)) {
+    throw new Error(`transcribe_audio: path is outside allowed audio directories: ${raw}`)
+  }
+
+  let real = ''
+  try {
+    real = await realpath(resolved)
+  } catch (err) {
+    throw new Error(`transcribe_audio: file not found: ${raw}`)
+  }
+
+  if (!isPathUnderRoots(real, allowedRoots)) {
+    throw new Error(`transcribe_audio: resolved symlink is outside allowed audio directories: ${raw}`)
+  }
+
+  return { resolved, real }
+}
+
+/**
+ * Sniff audio format from magic bytes.
+ * Supports WAV, MP3, OGG, FLAC, WebM, and M4A/MP4.
+ * @param {Buffer|Uint8Array} buffer
+ * @returns {string|null} Detected MIME type or null
+ */
+export function sniffAudioFormat(buffer) {
+  if (!buffer || buffer.length < 4) return null
+
+  // WAV: 'RIFF' .... 'WAVE'
+  if (buffer.length >= 12) {
+    const riff = String.fromCharCode(buffer[0], buffer[1], buffer[2], buffer[3])
+    const wave = String.fromCharCode(buffer[8], buffer[9], buffer[10], buffer[11])
+    if (riff === 'RIFF' && wave === 'WAVE') return 'audio/wav'
+  }
+
+  // OGG: 'OggS'
+  if (String.fromCharCode(buffer[0], buffer[1], buffer[2], buffer[3]) === 'OggS') {
+    return 'audio/ogg'
+  }
+
+  // FLAC: 'fLaC'
+  if (String.fromCharCode(buffer[0], buffer[1], buffer[2], buffer[3]) === 'fLaC') {
+    return 'audio/flac'
+  }
+
+  // WebM / Matroska: 0x1A 0x45 0xDF 0xA3 (EBML)
+  if (buffer[0] === 0x1a && buffer[1] === 0x45 && buffer[2] === 0xdf && buffer[3] === 0xa3) {
+    return 'audio/webm'
+  }
+
+  // MP3: ID3 header or frame sync 0xFF 0xFB/F3/F2
+  if (buffer.length >= 3 && String.fromCharCode(buffer[0], buffer[1], buffer[2]) === 'ID3') {
+    return 'audio/mpeg'
+  }
+  if (buffer[0] === 0xff && (buffer[1] & 0xe0) === 0xe0) {
+    return 'audio/mpeg'
+  }
+
+  // M4A / MP4: '....ftyp'
+  if (buffer.length >= 8) {
+    const ftyp = String.fromCharCode(buffer[4], buffer[5], buffer[6], buffer[7])
+    if (ftyp === 'ftyp') return 'audio/mp4'
+  }
+
+  return null
+}
+
+/**
+ * Enforce audio MIME/content validation independently of file extension.
+ * @param {Buffer|Uint8Array} buffer
+ * @returns {string} Detected audio MIME type
+ */
+export function validateAudioContent(buffer) {
+  const mime = sniffAudioFormat(buffer)
+  if (!mime) {
+    throw new Error('transcribe_audio: unsupported or invalid audio file format (magic bytes check failed)')
+  }
+  return mime
+}

package/lib/client.js

@@ -225,6 +225,7 @@ window.__ModuleLoader__.load({
       'jargonAdd': 'Add replacement',
       'jargonFrom': 'Spoken slang',
       'jargonTo': 'Correct spelling',
+      'jargonPlaceholder': 'k8s -> kubernetes\npr -> pull request',
     }
 
     const zh = {
@@ -418,6 +419,7 @@ window.__ModuleLoader__.load({
       'jargonAdd': '添加替换项',
       'jargonFrom': '口语词汇',
       'jargonTo': '标准拼写',
+      'jargonPlaceholder': 'k8s -> kubernetes\npr -> pull request',
     }
 
     // Strings are also needed outside components — in recording handlers and
@@ -3025,7 +3027,7 @@ window.__ModuleLoader__.load({
             React.createElement('textarea', {
               rows: 3,
               disabled: !writable,
-              placeholder: 'кубик -> k8s\nворктри -> worktree',
+              placeholder: t('jargonPlaceholder'),
               value: Array.isArray(draft && draft.jargonDictionary)
                 ? draft.jargonDictionary.map((item) => item && item.from ? `${item.from} -> ${item.to}` : '').filter(Boolean).join('\n')
                 : '',
@@ -3108,7 +3110,7 @@ window.__ModuleLoader__.load({
           React.createElement('div', { className: 'cb-section-desc' }, t('versionHint')),
           React.createElement('div', { className: 'cb-row', style: { alignItems: 'center', gap: '12px' } },
             React.createElement('span', { className: 'cb-badge cb-badge-ok' },
-              'v' + ((updaterStatus && updaterStatus.currentVersion) || '0.9.0')
+              'v' + ((updaterStatus && updaterStatus.currentVersion) || '0.9.1')
             ),
             updaterStatus && updaterStatus.updateAvailable
               ? React.createElement('span', { className: 'cb-badge cb-badge-warn' },

package/lib/http-util.js

@@ -50,8 +50,7 @@ export function isTrustedCaller(req) {
   if (isLoopback(remote)) return true
 
   const secSite = String(req.headers?.['sec-fetch-site'] || '').toLowerCase()
-  if (secSite === 'same-origin' || secSite === 'same-site') return true
-  if (secSite === 'cross-site') return false
+  if (secSite === 'cross-site' || secSite === 'same-site') return false
 
   const host = String(req.headers?.host || '').toLowerCase()
   const origin = String(req.headers?.origin || '').trim().toLowerCase()
@@ -63,6 +62,8 @@ export function isTrustedCaller(req) {
     return false
   }
 
+  if (secSite === 'same-origin') return true
+
   const referer = String(req.headers?.referer || '').trim().toLowerCase()
   if (referer) {
     try {

package/lib/index.js

@@ -30,6 +30,7 @@ import { registerPluginUpdater } from './updater.js'
 import { registerSensevoiceInstaller } from './sensevoice-installer.js'
 import { createConfigReader } from './config-compat.js'
 import { registerConfigRoutes } from './config-routes.js'
+import { getAllowedAudioRoots, validateAudioPath, validateAudioContent } from './audio-guard.js'
 
 function isAutoLang(lang) {
   return !lang || lang === 'auto' || String(lang).includes(',')
@@ -136,6 +137,7 @@ const BaseConfig = z.object({
   ffmpegBin: z.string().default('ffmpeg')
     .description('ffmpeg used to convert browser webm/opus into the WAV that whisper.cpp requires.'),
   timeoutMs: z.number().default(120000),
+  allowedAudioDirs: z.array(z.string()).default([]),
   maxFileBytes: z.number().default(25 * 1024 * 1024),
   normalizeTranscript: z.boolean().default(false)
     .description('transcribe_audio: convert spoken numbers to digits and tidy punctuation.'),
@@ -624,14 +626,17 @@ export function apply(ctx, baseConfig) {
         const cfg = live()
         const filePath = String(args.file_path || '').trim()
         if (!filePath) throw new Error('transcribe_audio: file_path is required')
-        const info = await stat(filePath).catch(() => null)
+        const allowedRoots = getAllowedAudioRoots(cfg)
+        const { real } = await validateAudioPath(filePath, allowedRoots)
+        const info = await stat(real).catch(() => null)
         if (!info) throw new Error(`transcribe_audio: file not found: ${filePath}`)
         if (info.size > cfg.maxFileBytes) {
           throw new Error(`transcribe_audio: file too large (${info.size} bytes, max ${cfg.maxFileBytes})`)
         }
         if (info.size < 44) throw new Error('transcribe_audio: file is empty or too small')
-        const mime = MIME_BY_EXT[path.extname(filePath).toLowerCase()] || 'audio/wav'
-        const bytes = await readFile(filePath)
+        const bytes = await readFile(real)
+        const sniffedMime = validateAudioContent(bytes)
+        const mime = sniffedMime || MIME_BY_EXT[path.extname(real).toLowerCase()] || 'audio/wav'
         const modeCfg = { ...cfg.message, language: String(args.language || cfg.message.language) }
         let raw = await transcribe(modeCfg, bytes, mime, exec.signal)
         if (raw && raw.text) raw = { ...raw, text: await polishText(raw.text, modeCfg, exec.signal) }

package/lib/sensevoice-installer.js

@@ -41,6 +41,13 @@ export function findModelFile(dir) {
   return null
 }
 
+export function redactModelPath(filePath) {
+  if (!filePath) return ""
+  const str = String(filePath).replace(/\\/g, "/")
+  const idx = str.indexOf(".dsh/models/")
+  if (idx !== -1) return "~/" + str.slice(idx)
+  return path.basename(str)
+}
 export function findTokensFile(dir) {
   if (!dir || !existsSync(dir)) return null
   try {
@@ -68,8 +75,9 @@ export async function getSensevoiceStatus(cfg, isAliveFn) {
   return {
     installed,
     running,
-    modelPath: modelFile || '',
-    tokensPath: tokensFile || '',
+    modelPath: redactModelPath(modelFile),
+    tokensPath: redactModelPath(tokensFile),
+    path: installed ? '~/.dsh/models/sensevoice' : '',
     installing: installerState.installing,
     progress: installerState.progress,
     step: installerState.step,
@@ -189,6 +197,11 @@ export function registerSensevoiceInstaller(ctx, { liveConfig, isAlive, updateCo
     kind: 'exact',
     path: '/dsh-voice/sensevoice-installer',
     handler: async (req, res) => {
+      if (!isTrustedCaller(req)) {
+        writeJson(res, 403, { ok: false, error: 'Forbidden: untrusted caller' })
+        return
+      }
+
       if (req.method === 'GET') {
         const status = await getSensevoiceStatus(liveConfig(), isAlive)
         writeJson(res, 200, status)
@@ -196,13 +209,9 @@ export function registerSensevoiceInstaller(ctx, { liveConfig, isAlive, updateCo
       }
 
       if (req.method === 'POST') {
-        if (!isTrustedCaller(req)) {
-          writeJson(res, 403, { ok: false, error: 'Forbidden: untrusted caller' })
-          return
-        }
-
+        const safeState = { ...installerState, modelPath: redactModelPath(installerState.modelPath) }
         if (installerState.installing) {
-          writeJson(res, 409, { ok: false, error: 'Installation already in progress', state: installerState })
+          writeJson(res, 409, { ok: false, error: 'Installation already in progress', state: safeState })
           return
         }
 
@@ -211,7 +220,7 @@ export function registerSensevoiceInstaller(ctx, { liveConfig, isAlive, updateCo
           ctx.logger?.warn?.(`SenseVoice 1-click install error: ${String(err)}`)
         })
 
-        writeJson(res, 202, { ok: true, message: 'SenseVoice installation started', state: installerState })
+        writeJson(res, 202, { ok: true, message: 'SenseVoice installation started', state: safeState })
         return
       }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-voice",
-  "version": "0.9.0",
+  "version": "0.9.1",
   "description": "Voice input for DeepSeek Harness: dictation chunked by pauses and voice messages, each with its own provider fallback chain (Deepgram, Groq, HuggingFace, local whisper.cpp, plus any OpenAI-compatible API of your own).",
   "license": "MIT",
   "type": "module",