@goodandready/dsh-voice 0.9.2 → 0.9.4

package/README.md

@@ -189,14 +189,14 @@ Open **Settings → Plugins → Plugin settings → Voice** in the Web UI:
 - id: dsh-voice
   config:
     dictation:
-      language: ru
+      language: "" # auto-detect by default; or specify "en", "ru", "zh", etc.
       vadSilenceMs: 700
       chain:
         - provider: deepgram
         - provider: groq
         - provider: local-whisper
     message:
-      language: ru
+      language: "" # auto-detect by default; or specify "en", "ru", "zh", etc.
       autoSendMs: 4000
       chain:
         - provider: openai
@@ -206,6 +206,8 @@ Open **Settings → Plugins → Plugin settings → Voice** in the Web UI:
     whisperModel: /models/ggml-medium-q8_0.bin
 ```
 
+> **Note on language handling**: Setting `language: ""` (default) allows providers to auto-detect the spoken language. Spoken numeral normalization (`wordsToDigits`) and standard Russian tech slang correction (`DEFAULT_JARGON_DICTIONARY`) activate conditionally only when Russian is selected or auto-detected in the transcript, ensuring non-Russian speech is never distorted.
+
 ---
 
 ## 🤖 Agent Tool & HTTP API

package/README.ru.md

@@ -189,14 +189,14 @@ dsh plugin --profile web add @goodandready/dsh-voice
 - id: dsh-voice
   config:
     dictation:
-      language: ru
+      language: "" # автоопределение по умолчанию; или укажите "ru", "en", "zh" и др.
       vadSilenceMs: 700
       chain:
         - provider: deepgram
         - provider: groq
         - provider: local-whisper
     message:
-      language: ru
+      language: "" # автоопределение по умолчанию; или укажите "ru", "en", "zh" и др.
       autoSendMs: 4000
       chain:
         - provider: openai
@@ -206,6 +206,8 @@ dsh plugin --profile web add @goodandready/dsh-voice
     whisperModel: /models/ggml-medium-q8_0.bin
 ```
 
+> **Примечание по языку**: Значение `language: ""` (по умолчанию) включает автоопределение языка провайдером. Нормализация числительных словами в цифры и стандартный словарь технического сленга применяются адаптивно только при распознавании русской речи, исключая искажение англоязычного текста.
+
 ---
 
 ## 🤖 Инструмент агента и HTTP API

package/lib/client.js

@@ -773,6 +773,9 @@ window.__ModuleLoader__.load({
 
     function keyLabel(name) {
       if (!name) return t('keyUnset')
+      if (typeof name === 'string' && name.includes('+')) {
+        return name.split('+').map((p) => keyLabel(p)).join(' + ')
+      }
       if (name === 'Space') return t('keySpace')
       if (KEY_LABELS[name]) return KEY_LABELS[name]
       // Drop the Key/Digit prefix from codes like KeyR and Digit5.
@@ -781,10 +784,23 @@ window.__ModuleLoader__.load({
 
     // What to store on key press. Pure modifiers are remembered by name:
     // left and right have different codes but the user means "either".
+    // Supports combos like Control+Space or Alt+KeyV.
     function keyFromEvent(event) {
-      if (['Control', 'Alt', 'Shift', 'Meta'].includes(event.key)) return event.key
-      if (event.code) return event.code
-      return event.key || ''
+      if (!event) return ''
+      const modifiers = []
+      if (event.ctrlKey && event.key !== 'Control') modifiers.push('Control')
+      if (event.altKey && event.key !== 'Alt') modifiers.push('Alt')
+      if (event.shiftKey && event.key !== 'Shift') modifiers.push('Shift')
+      if (event.metaKey && event.key !== 'Meta') modifiers.push('Meta')
+
+      const main = ['Control', 'Alt', 'Shift', 'Meta'].includes(event.key)
+        ? event.key
+        : (event.code || event.key || '')
+
+      if (modifiers.length > 0 && !['Control', 'Alt', 'Shift', 'Meta'].includes(main)) {
+        return modifiers.concat(main).join('+')
+      }
+      return main
     }
 
     // Announce that the user started speaking.
@@ -1215,18 +1231,56 @@ window.__ModuleLoader__.load({
     // Hotkey: holding a key is easier than aiming the mouse. While the key is
     // down we record; Escape cancels.
     function hotkeyMatches(event, name) {
+      if (!event || !name) return false
+      if (typeof name === 'string' && name.includes('+')) {
+        const parts = name.split('+')
+        const main = parts[parts.length - 1]
+        const needCtrl = parts.includes('Control')
+        const needAlt = parts.includes('Alt')
+        const needShift = parts.includes('Shift')
+        const needMeta = parts.includes('Meta')
+        if (needCtrl && !event.ctrlKey) return false
+        if (needAlt && !event.altKey) return false
+        if (needShift && !event.shiftKey) return false
+        if (needMeta && !event.metaKey) return false
+        return event.code === main || event.key === main
+      }
       if (name === 'Control') return event.key === 'Control'
       if (name === 'Alt') return event.key === 'Alt'
       if (name === 'Shift') return event.key === 'Shift'
+      if (name === 'Meta') return event.key === 'Meta'
       return event.code === name || event.key === name
     }
 
+    function isAllowedInEditable(name) {
+      if (!name) return false
+      if (['Control', 'Alt', 'Shift', 'Meta'].includes(name)) return true
+      if (/^F\d{1,2}$/.test(name)) return true
+      if (typeof name === 'string' && name.includes('+')) return true
+      if (['Tab', 'Pause', 'ScrollLock', 'Insert'].includes(name)) return true
+      return false
+    }
+
+    let activeHotkeyCleanup = null
+
+    function clearGlobalHotkey() {
+      if (typeof activeHotkeyCleanup === 'function') {
+        try { activeHotkeyCleanup() } catch (_) { /* ignore */ }
+        activeHotkeyCleanup = null
+      }
+      if (typeof window !== 'undefined' && typeof window.__dsh_voice_hotkey_cleanup === 'function') {
+        try { window.__dsh_voice_hotkey_cleanup() } catch (_) { /* ignore */ }
+        window.__dsh_voice_hotkey_cleanup = null
+      }
+    }
+
     function installHotkey(ctx, keyName, mode) {
+      clearGlobalHotkey()
       if (typeof document === 'undefined' || !keyName) return () => {}
       const down = (event) => {
         if (event.repeat) return
-        // A modifier hotkey does not fight the text field: modifiers do not
-        // type. A plain letter key must not be hijacked while typing.
+        // A modifier, function key or combo does not fight the text field:
+        // modifiers/combos do not type plain text. A plain letter key must not be hijacked while typing.
         const target = event.target
         const isEditable = target && (
           target.tagName === 'INPUT' ||
@@ -1234,23 +1288,41 @@ window.__ModuleLoader__.load({
           target.isContentEditable ||
           (typeof target.getAttribute === 'function' && target.getAttribute('contenteditable') === 'true')
         )
-        if (isEditable && !['Control', 'Alt', 'Shift'].includes(keyName)) return
+        if (isEditable && !isAllowedInEditable(keyName)) return
 
-        if (hotkeyMatches(event, keyName)) beginHold(mode)
+        if (hotkeyMatches(event, keyName)) {
+          event.preventDefault()
+          event.stopPropagation()
+          beginHold(mode)
+        }
       }
       const up = (event) => {
-        if (hotkeyMatches(event, keyName)) endHold(false)
-        else if (event.key === 'Escape' && hold.armed) endHold(true)
+        if (hotkeyMatches(event, keyName)) {
+          event.preventDefault()
+          endHold(false)
+        } else if (event.key === 'Escape' && hold.armed) {
+          event.preventDefault()
+          endHold(true)
+        }
       }
       const blur = () => { if (hold.armed) endHold(true) }
       document.addEventListener('keydown', down, true)
       document.addEventListener('keyup', up, true)
       window.addEventListener('blur', blur)
-      return () => {
+      const cleanup = () => {
         document.removeEventListener('keydown', down, true)
         document.removeEventListener('keyup', up, true)
         window.removeEventListener('blur', blur)
+        if (activeHotkeyCleanup === cleanup) activeHotkeyCleanup = null
+        if (typeof window !== 'undefined' && window.__dsh_voice_hotkey_cleanup === cleanup) {
+          window.__dsh_voice_hotkey_cleanup = null
+        }
       }
+      activeHotkeyCleanup = cleanup
+      if (typeof window !== 'undefined') {
+        window.__dsh_voice_hotkey_cleanup = cleanup
+      }
+      return cleanup
     }
 
     function cancelCurrent() {
@@ -1941,6 +2013,7 @@ window.__ModuleLoader__.load({
           alive = false
           window.removeEventListener('dsh-voice:settings-saved', reload)
           dispose()
+          clearGlobalHotkey()
         }
       }, 'dsh-voice: hold hotkey')
 
@@ -2219,11 +2292,17 @@ window.__ModuleLoader__.load({
           if (event.key === 'Escape') { setCatching(false); return }
           const chosen = keyFromEvent(event)
           setDraft((d) => Object.assign({}, d || {}, { hotkey: chosen }))
+          voice.hotkey = chosen || ''
+          if (chosen) {
+            installHotkey(ctx, chosen, 'message')
+          } else {
+            clearGlobalHotkey()
+          }
           setCatching(false)
         }
         document.addEventListener('keydown', onKey, true)
         return () => document.removeEventListener('keydown', onKey, true)
-      }, [catching])
+      }, [catching, ctx])
 
       React.useEffect(() => {
         let alive = true
@@ -2562,7 +2641,14 @@ window.__ModuleLoader__.load({
         }
 
         const d = draft || {}
+        voice.hotkey = d.hotkey || ''
+        if (voice.hotkey) {
+          installHotkey(ctx, voice.hotkey, 'message')
+        } else {
+          clearGlobalHotkey()
+        }
         Object.assign(voice.settings, {
+          hotkey: d.hotkey || '',
           vadSilenceMs: Number(d.dictation && d.dictation.vadSilenceMs) || 700,
           autoSendMs: Number(d.message && d.message.autoSendMs) || 4000,
           beep: !!d.beep,
@@ -2611,7 +2697,11 @@ window.__ModuleLoader__.load({
           }, catching ? t('pressKey') : keyLabel(draft && draft.hotkey)),
           React.createElement('button', {
             type: 'button', className: 'cb-btn cb-btn-mini', title: t('clearKey'),
-            disabled: !writable, onClick: () => setDraft((d) => Object.assign({}, d || {}, { hotkey: '' })),
+            disabled: !writable, onClick: () => {
+              setDraft((d) => Object.assign({}, d || {}, { hotkey: '' }))
+              voice.hotkey = ''
+              clearGlobalHotkey()
+            },
           }, '×'),
         ),
         React.createElement('span', { className: 'dvs-sub' }, t('hotkeyHint1') + t('hotkeyHint2')),
@@ -3137,7 +3227,7 @@ window.__ModuleLoader__.load({
           React.createElement('div', { className: 'cb-section-desc' }, t('versionHint')),
           React.createElement('div', { className: 'cb-row', style: { alignItems: 'center', gap: '12px' } },
             React.createElement('span', { className: 'cb-badge cb-badge-ok' },
-              'v' + ((updaterStatus && updaterStatus.currentVersion) || '0.9.2')
+              'v' + ((updaterStatus && updaterStatus.currentVersion) || '0.9.4')
             ),
             updaterStatus && updaterStatus.updateAvailable
               ? React.createElement('span', { className: 'cb-badge cb-badge-warn' },

package/lib/http-util.js

@@ -46,14 +46,52 @@ export function isLoopback(addr) {
  */
 export function isTrustedCaller(req) {
   if (!req) return false
-  const remote = req.socket?.remoteAddress || req.connection?.remoteAddress || ''
-  if (isLoopback(remote)) return true
 
+  // 1. Browser security headers: immediately reject cross-site and same-site requests (#117, #173)
   const secSite = String(req.headers?.['sec-fetch-site'] || '').toLowerCase()
   if (secSite === 'cross-site' || secSite === 'same-site') return false
 
+  // 2. If Origin header is present, it must strictly match the Host header
   const host = String(req.headers?.host || '').toLowerCase()
   const origin = String(req.headers?.origin || '').trim().toLowerCase()
+  if (origin) {
+    try {
+      const u = new URL(origin)
+      if (u.host !== host) return false
+    } catch {
+      return false
+    }
+  }
+
+  // 3. If Referer header is present, it must strictly match the Host header
+  const referer = String(req.headers?.referer || '').trim().toLowerCase()
+  if (referer) {
+    try {
+      const u = new URL(referer)
+      if (u.host !== host) return false
+    } catch {
+      return false
+    }
+  }
+
+  // 4. For state-changing or data-carrying requests (POST/PUT/PATCH), require application/json or octet-stream
+  // Cross-origin simple form submissions cannot set application/json without a CORS preflight.
+  const method = String(req.method || 'GET').toUpperCase()
+  if (method === 'POST' || method === 'PUT' || method === 'PATCH') {
+    const contentType = String(req.headers?.['content-type'] || '').toLowerCase()
+    const isJson = contentType.startsWith('application/json')
+    const isOctet = contentType.startsWith('application/octet-stream')
+    if (!isJson && !isOctet) {
+      return false
+    }
+  }
+
+  // 5. Loopback remote address is trusted when not rejected by browser headers above
+  const remote = req.socket?.remoteAddress || req.connection?.remoteAddress || ''
+  if (isLoopback(remote)) return true
+
+  // 6. Non-loopback requests must be verified same-origin
+  if (secSite === 'same-origin') return true
   if (origin) {
     try {
       const u = new URL(origin)
@@ -61,10 +99,6 @@ export function isTrustedCaller(req) {
     } catch { /* invalid url */ }
     return false
   }
-
-  if (secSite === 'same-origin') return true
-
-  const referer = String(req.headers?.referer || '').trim().toLowerCase()
   if (referer) {
     try {
       const u = new URL(referer)

package/lib/index.js

@@ -84,7 +84,8 @@ const BaseConfig = z.object({
     chain: z.array(ChainEntry)
       .default([{ provider: 'deepgram', model: '' }, { provider: 'groq', model: '' }, { provider: 'local-whisper', model: '' }])
       .description('Fallback chain for dictation. Speed matters more than accuracy here.'),
-    language: z.string().default('ru'),
+    language: z.string().default('')
+      .description('Recognition language code for dictation (e.g. "en", "ru", "zh", or empty string for auto-detection).'),
     vadSilenceMs: z.number().default(700)
       .description('Silence longer than this ends a phrase and sends the chunk.'),
     sendDelayMs: z.number().default(0)
@@ -102,7 +103,8 @@ const BaseConfig = z.object({
     chain: z.array(ChainEntry)
       .default([{ provider: 'groq', model: '' }, { provider: 'hf', model: '' }, { provider: 'local-whisper', model: '' }])
       .description('Fallback chain for voice messages. Accuracy matters more than speed.'),
-    language: z.string().default('ru'),
+    language: z.string().default('')
+      .description('Recognition language code for messages (e.g. "en", "ru", "zh", or empty string for auto-detection).'),
     autoSendMs: z.number().default(4000)
       .description('Cancel window before the recognized text is sent to the agent.'),
     sessionCommands: z.boolean().default(false)
@@ -531,10 +533,15 @@ export function apply(ctx, baseConfig) {
       if (req.method !== 'POST') { writeJson(res, 405, { ok: false, error: { code: 'method', message: 'POST only' } }); return }
       if (!isTrustedCaller(req)) { writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'forbidden source origin' } }); return }
       const cfg = live()
+      const maxBodyBytes = Math.ceil((cfg.maxFileBytes * 4) / 3) + 64 * 1024
       let raw
       try {
-        raw = await readBody(req, cfg.maxFileBytes + 1024 * 1024)
+        raw = await readBody(req, maxBodyBytes)
       } catch (e) {
+        if (e && e.message === 'body too large') {
+          writeJson(res, 413, { ok: false, error: { code: 'too-large', message: `audio body exceeds limit for max ${cfg.maxFileBytes} bytes` } })
+          return
+        }
         writeJson(res, 400, { ok: false, error: { code: 'body', message: e.message } }); return
       }
       let payload
@@ -605,7 +612,7 @@ export function apply(ctx, baseConfig) {
         + 'Use for voice messages, recordings, interviews.',
       parameters: {
         file_path: { type: 'string', required: true, description: 'Absolute path to the audio file (wav, mp3, m4a, ogg, flac, webm).' },
-        language: { type: 'string', description: `Recognition language code. Default: ${(baseConfig && baseConfig.message && baseConfig.message.language) || 'ru'}.` },
+        language: { type: 'string', description: `Recognition language code (e.g. "en", "ru", "zh", or empty string for auto-detection). Default: ${(baseConfig && baseConfig.message && baseConfig.message.language) || 'auto'}.` },
       },
       output: {
         schema: {
@@ -637,12 +644,13 @@ export function apply(ctx, baseConfig) {
         const bytes = await readFile(real)
         const sniffedMime = validateAudioContent(bytes)
         const mime = sniffedMime || MIME_BY_EXT[path.extname(real).toLowerCase()] || 'audio/wav'
-        const modeCfg = { ...cfg.message, language: String(args.language || cfg.message.language) }
+        const modeCfg = { ...cfg.message, language: String(args.language !== undefined ? args.language : cfg.message.language) }
         let raw = await transcribe(modeCfg, bytes, mime, exec.signal)
         if (raw && raw.text) raw = { ...raw, text: await polishText(raw.text, modeCfg, exec.signal) }
         const out = raw
         if (cfg.normalizeTranscript && out && out.text) {
           out.text = normalizePhrase(out.text, {
+            lang: modeCfg.language,
             digits: true, capSentences: true, commaSpacing: true, trailingPeriod: true,
           })
         }

package/lib/normalize.js

@@ -107,7 +107,14 @@ function cachedJargonRegex(from) {
   return re
 }
 
-export function applyJargonDictionary(text, customReplacements = []) {
+export function isRussianLang(lang, text = '') {
+  const l = String(lang || '').trim().toLowerCase()
+  if (l === 'ru' || l.startsWith('ru-') || l.startsWith('ru_')) return true
+  if (l === '' || l === 'auto') return /[а-яё]/i.test(String(text || ''))
+  return false
+}
+
+export function applyJargonDictionary(text, customReplacements = [], options = {}) {
   if (!text || typeof text !== 'string') return text || ''
   let result = text
   for (const item of customReplacements || []) {
@@ -116,9 +123,11 @@ export function applyJargonDictionary(text, customReplacements = []) {
     re.lastIndex = 0
     result = result.replace(re, item.to)
   }
-  for (const item of DEFAULT_JARGON_REGEX) {
-    item.re.lastIndex = 0
-    result = result.replace(item.re, item.to)
+  if (options.defaultJargon !== false) {
+    for (const item of DEFAULT_JARGON_REGEX) {
+      item.re.lastIndex = 0
+      result = result.replace(item.re, item.to)
+    }
   }
   return result
 }
@@ -160,9 +169,13 @@ export function extractVoiceActions(text) {
 export function normalizePhrase(text, opts = {}) {
   let out = String(text || '').trim()
   if (!out) return out
-  if (opts.digits) out = wordsToDigits(out)
+  const lang = opts.lang ?? opts.language
+  const isRu = opts.isRussian ?? (lang !== undefined ? isRussianLang(lang, out) : true)
+  if (opts.digits && isRu) out = wordsToDigits(out)
   if (opts.commaSpacing) out = fixCommaSpacing(out)
-  if (opts.jargon) out = applyJargonDictionary(out, opts.customJargon)
+  if (opts.jargon) {
+    out = applyJargonDictionary(out, opts.customJargon, { defaultJargon: isRu })
+  }
   if (opts.capSentences) out = capitalizeSentences(out)
   if (opts.trailingPeriod) out = ensureTrailingPeriod(out)
   return out

package/lib/updater.js

@@ -2,7 +2,7 @@
 // Implements canonical DSH plugin-updater specification.
 
 import { spawn } from 'node:child_process';
-import { existsSync, readFileSync } from 'node:fs';
+import { existsSync, readFileSync, unlinkSync } from 'node:fs';
 import { readFile } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { basename, dirname, isAbsolute, resolve } from 'node:path';
@@ -169,12 +169,57 @@ export async function getUpdateStatus(options, target = runtime()) {
   };
 }
 
+export function readLockPid(lockPath) {
+  if (!existsSync(lockPath)) return null;
+  try {
+    const raw = readFileSync(lockPath, 'utf8').trim();
+    if (/^\d+$/.test(raw)) {
+      return parseInt(raw, 10);
+    }
+    const parsed = JSON.parse(raw);
+    if (parsed && typeof parsed.pid === 'number') {
+      return parsed.pid;
+    }
+  } catch { /* ignore unparseable lock file */ }
+  return null;
+}
+
+export function isProcessAlive(pid) {
+  if (!pid || typeof pid !== 'number' || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (e) {
+    return e && e.code === 'EPERM';
+  }
+}
+
+export function checkProfileLock(profileDir) {
+  const lockPath = resolve(profileDir, 'package.json.lock');
+  if (!existsSync(lockPath)) return { locked: false };
+  const pid = readLockPid(lockPath);
+  if (pid && isProcessAlive(pid)) {
+    return { locked: true, pid };
+  }
+  // Stale lock: PID is dead or unreadable; clean it up to prevent permanent blockage
+  try {
+    unlinkSync(lockPath);
+    return { locked: false, cleanedStale: true };
+  } catch {
+    return { locked: false };
+  }
+}
+
 async function installExact(target, packageSpec, options) {
   if (target.cliEntry === undefined) throw new Error('Automatic update is unavailable in this runtime.');
+  const lockCheck = checkProfileLock(target.profileDir);
+  if (lockCheck.locked) {
+    throw new Error(`Another package installation is currently in progress (PID ${lockCheck.pid}).`);
+  }
   await new Promise((resolvePromise, reject) => {
     const child = spawn(process.execPath, [
       target.cliEntry, 'plugin', '--profile', target.profileName, 'add',
-      '--config.minimumReleaseAge=0', packageSpec,
+      packageSpec,
       `--registry=${options.registry ?? 'https://registry.npmjs.org/'}`,
     ], {
       cwd: target.profileDir,
@@ -186,12 +231,23 @@ async function installExact(target, packageSpec, options) {
     child.stdout?.on('data', chunk => { detail = (detail + String(chunk)).slice(-4_000); });
     child.stderr?.on('data', chunk => { detail = (detail + String(chunk)).slice(-4_000); });
     const timer = setTimeout(() => {
-      child.kill();
+      child.kill('SIGTERM');
+      setTimeout(() => {
+        if (!child.killed) {
+          try { child.kill('SIGKILL'); } catch { /* ignore */ }
+        }
+        checkProfileLock(target.profileDir);
+      }, 1000).unref?.();
       reject(new Error('Update timed out; use the normal DSH update flow.'));
     }, UPDATE_TIMEOUT_MS);
-    child.once('error', error => { clearTimeout(timer); reject(error); });
+    child.once('error', error => {
+      clearTimeout(timer);
+      checkProfileLock(target.profileDir);
+      reject(error);
+    });
     child.once('exit', code => {
       clearTimeout(timer);
+      checkProfileLock(target.profileDir);
       if (code === 0) resolvePromise();
       else reject(new Error(detail.trim() || `Update exited with code ${String(code)}.`));
     });
@@ -233,8 +289,13 @@ export function registerPluginUpdater(ctx, options) {
           json(response, 403, { error: 'Rejected non-local or cross-origin update request.' });
           return;
         }
-        if (installing) {
-          json(response, 409, { error: 'This plugin is already updating.' });
+        const lockStatus = checkProfileLock(target.profileDir);
+        if (installing || lockStatus.locked) {
+          json(response, 409, {
+            error: lockStatus.locked
+              ? `Another package installation is currently in progress (PID ${lockStatus.pid}).`
+              : 'This plugin is already updating.',
+          });
           return;
         }
         installing = true;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-voice",
-  "version": "0.9.2",
+  "version": "0.9.4",
   "description": "Voice input for DeepSeek Harness: dictation chunked by pauses and voice messages, each with its own provider fallback chain (Deepgram, Groq, HuggingFace, local whisper.cpp, plus any OpenAI-compatible API of your own).",
   "license": "MIT",
   "type": "module",