@goodandready/dsh-voice 0.9.3 → 0.9.4

package/README.md

@@ -189,14 +189,14 @@ Open **Settings → Plugins → Plugin settings → Voice** in the Web UI:
 - id: dsh-voice
   config:
     dictation:
-      language: ru
+      language: "" # auto-detect by default; or specify "en", "ru", "zh", etc.
       vadSilenceMs: 700
       chain:
         - provider: deepgram
         - provider: groq
         - provider: local-whisper
     message:
-      language: ru
+      language: "" # auto-detect by default; or specify "en", "ru", "zh", etc.
       autoSendMs: 4000
       chain:
         - provider: openai
@@ -206,6 +206,8 @@ Open **Settings → Plugins → Plugin settings → Voice** in the Web UI:
     whisperModel: /models/ggml-medium-q8_0.bin
 ```
 
+> **Note on language handling**: Setting `language: ""` (default) allows providers to auto-detect the spoken language. Spoken numeral normalization (`wordsToDigits`) and standard Russian tech slang correction (`DEFAULT_JARGON_DICTIONARY`) activate conditionally only when Russian is selected or auto-detected in the transcript, ensuring non-Russian speech is never distorted.
+
 ---
 
 ## 🤖 Agent Tool & HTTP API

package/README.ru.md

@@ -189,14 +189,14 @@ dsh plugin --profile web add @goodandready/dsh-voice
 - id: dsh-voice
   config:
     dictation:
-      language: ru
+      language: "" # автоопределение по умолчанию; или укажите "ru", "en", "zh" и др.
       vadSilenceMs: 700
       chain:
         - provider: deepgram
         - provider: groq
         - provider: local-whisper
     message:
-      language: ru
+      language: "" # автоопределение по умолчанию; или укажите "ru", "en", "zh" и др.
       autoSendMs: 4000
       chain:
         - provider: openai
@@ -206,6 +206,8 @@ dsh plugin --profile web add @goodandready/dsh-voice
     whisperModel: /models/ggml-medium-q8_0.bin
 ```
 
+> **Примечание по языку**: Значение `language: ""` (по умолчанию) включает автоопределение языка провайдером. Нормализация числительных словами в цифры и стандартный словарь технического сленга применяются адаптивно только при распознавании русской речи, исключая искажение англоязычного текста.
+
 ---
 
 ## 🤖 Инструмент агента и HTTP API

package/lib/client.js

@@ -3227,7 +3227,7 @@ window.__ModuleLoader__.load({
           React.createElement('div', { className: 'cb-section-desc' }, t('versionHint')),
           React.createElement('div', { className: 'cb-row', style: { alignItems: 'center', gap: '12px' } },
             React.createElement('span', { className: 'cb-badge cb-badge-ok' },
-              'v' + ((updaterStatus && updaterStatus.currentVersion) || '0.9.3')
+              'v' + ((updaterStatus && updaterStatus.currentVersion) || '0.9.4')
             ),
             updaterStatus && updaterStatus.updateAvailable
               ? React.createElement('span', { className: 'cb-badge cb-badge-warn' },

package/lib/http-util.js

@@ -46,14 +46,52 @@ export function isLoopback(addr) {
  */
 export function isTrustedCaller(req) {
   if (!req) return false
-  const remote = req.socket?.remoteAddress || req.connection?.remoteAddress || ''
-  if (isLoopback(remote)) return true
 
+  // 1. Browser security headers: immediately reject cross-site and same-site requests (#117, #173)
   const secSite = String(req.headers?.['sec-fetch-site'] || '').toLowerCase()
   if (secSite === 'cross-site' || secSite === 'same-site') return false
 
+  // 2. If Origin header is present, it must strictly match the Host header
   const host = String(req.headers?.host || '').toLowerCase()
   const origin = String(req.headers?.origin || '').trim().toLowerCase()
+  if (origin) {
+    try {
+      const u = new URL(origin)
+      if (u.host !== host) return false
+    } catch {
+      return false
+    }
+  }
+
+  // 3. If Referer header is present, it must strictly match the Host header
+  const referer = String(req.headers?.referer || '').trim().toLowerCase()
+  if (referer) {
+    try {
+      const u = new URL(referer)
+      if (u.host !== host) return false
+    } catch {
+      return false
+    }
+  }
+
+  // 4. For state-changing or data-carrying requests (POST/PUT/PATCH), require application/json or octet-stream
+  // Cross-origin simple form submissions cannot set application/json without a CORS preflight.
+  const method = String(req.method || 'GET').toUpperCase()
+  if (method === 'POST' || method === 'PUT' || method === 'PATCH') {
+    const contentType = String(req.headers?.['content-type'] || '').toLowerCase()
+    const isJson = contentType.startsWith('application/json')
+    const isOctet = contentType.startsWith('application/octet-stream')
+    if (!isJson && !isOctet) {
+      return false
+    }
+  }
+
+  // 5. Loopback remote address is trusted when not rejected by browser headers above
+  const remote = req.socket?.remoteAddress || req.connection?.remoteAddress || ''
+  if (isLoopback(remote)) return true
+
+  // 6. Non-loopback requests must be verified same-origin
+  if (secSite === 'same-origin') return true
   if (origin) {
     try {
       const u = new URL(origin)
@@ -61,10 +99,6 @@ export function isTrustedCaller(req) {
     } catch { /* invalid url */ }
     return false
   }
-
-  if (secSite === 'same-origin') return true
-
-  const referer = String(req.headers?.referer || '').trim().toLowerCase()
   if (referer) {
     try {
       const u = new URL(referer)

package/lib/index.js

@@ -84,7 +84,8 @@ const BaseConfig = z.object({
     chain: z.array(ChainEntry)
       .default([{ provider: 'deepgram', model: '' }, { provider: 'groq', model: '' }, { provider: 'local-whisper', model: '' }])
       .description('Fallback chain for dictation. Speed matters more than accuracy here.'),
-    language: z.string().default('ru'),
+    language: z.string().default('')
+      .description('Recognition language code for dictation (e.g. "en", "ru", "zh", or empty string for auto-detection).'),
     vadSilenceMs: z.number().default(700)
       .description('Silence longer than this ends a phrase and sends the chunk.'),
     sendDelayMs: z.number().default(0)
@@ -102,7 +103,8 @@ const BaseConfig = z.object({
     chain: z.array(ChainEntry)
       .default([{ provider: 'groq', model: '' }, { provider: 'hf', model: '' }, { provider: 'local-whisper', model: '' }])
       .description('Fallback chain for voice messages. Accuracy matters more than speed.'),
-    language: z.string().default('ru'),
+    language: z.string().default('')
+      .description('Recognition language code for messages (e.g. "en", "ru", "zh", or empty string for auto-detection).'),
     autoSendMs: z.number().default(4000)
       .description('Cancel window before the recognized text is sent to the agent.'),
     sessionCommands: z.boolean().default(false)
@@ -531,10 +533,15 @@ export function apply(ctx, baseConfig) {
       if (req.method !== 'POST') { writeJson(res, 405, { ok: false, error: { code: 'method', message: 'POST only' } }); return }
       if (!isTrustedCaller(req)) { writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'forbidden source origin' } }); return }
       const cfg = live()
+      const maxBodyBytes = Math.ceil((cfg.maxFileBytes * 4) / 3) + 64 * 1024
       let raw
       try {
-        raw = await readBody(req, cfg.maxFileBytes + 1024 * 1024)
+        raw = await readBody(req, maxBodyBytes)
       } catch (e) {
+        if (e && e.message === 'body too large') {
+          writeJson(res, 413, { ok: false, error: { code: 'too-large', message: `audio body exceeds limit for max ${cfg.maxFileBytes} bytes` } })
+          return
+        }
         writeJson(res, 400, { ok: false, error: { code: 'body', message: e.message } }); return
       }
       let payload
@@ -605,7 +612,7 @@ export function apply(ctx, baseConfig) {
         + 'Use for voice messages, recordings, interviews.',
       parameters: {
         file_path: { type: 'string', required: true, description: 'Absolute path to the audio file (wav, mp3, m4a, ogg, flac, webm).' },
-        language: { type: 'string', description: `Recognition language code. Default: ${(baseConfig && baseConfig.message && baseConfig.message.language) || 'ru'}.` },
+        language: { type: 'string', description: `Recognition language code (e.g. "en", "ru", "zh", or empty string for auto-detection). Default: ${(baseConfig && baseConfig.message && baseConfig.message.language) || 'auto'}.` },
       },
       output: {
         schema: {
@@ -637,12 +644,13 @@ export function apply(ctx, baseConfig) {
         const bytes = await readFile(real)
         const sniffedMime = validateAudioContent(bytes)
         const mime = sniffedMime || MIME_BY_EXT[path.extname(real).toLowerCase()] || 'audio/wav'
-        const modeCfg = { ...cfg.message, language: String(args.language || cfg.message.language) }
+        const modeCfg = { ...cfg.message, language: String(args.language !== undefined ? args.language : cfg.message.language) }
         let raw = await transcribe(modeCfg, bytes, mime, exec.signal)
         if (raw && raw.text) raw = { ...raw, text: await polishText(raw.text, modeCfg, exec.signal) }
         const out = raw
         if (cfg.normalizeTranscript && out && out.text) {
           out.text = normalizePhrase(out.text, {
+            lang: modeCfg.language,
             digits: true, capSentences: true, commaSpacing: true, trailingPeriod: true,
           })
         }

package/lib/normalize.js

@@ -107,7 +107,14 @@ function cachedJargonRegex(from) {
   return re
 }
 
-export function applyJargonDictionary(text, customReplacements = []) {
+export function isRussianLang(lang, text = '') {
+  const l = String(lang || '').trim().toLowerCase()
+  if (l === 'ru' || l.startsWith('ru-') || l.startsWith('ru_')) return true
+  if (l === '' || l === 'auto') return /[а-яё]/i.test(String(text || ''))
+  return false
+}
+
+export function applyJargonDictionary(text, customReplacements = [], options = {}) {
   if (!text || typeof text !== 'string') return text || ''
   let result = text
   for (const item of customReplacements || []) {
@@ -116,9 +123,11 @@ export function applyJargonDictionary(text, customReplacements = []) {
     re.lastIndex = 0
     result = result.replace(re, item.to)
   }
-  for (const item of DEFAULT_JARGON_REGEX) {
-    item.re.lastIndex = 0
-    result = result.replace(item.re, item.to)
+  if (options.defaultJargon !== false) {
+    for (const item of DEFAULT_JARGON_REGEX) {
+      item.re.lastIndex = 0
+      result = result.replace(item.re, item.to)
+    }
   }
   return result
 }
@@ -160,9 +169,13 @@ export function extractVoiceActions(text) {
 export function normalizePhrase(text, opts = {}) {
   let out = String(text || '').trim()
   if (!out) return out
-  if (opts.digits) out = wordsToDigits(out)
+  const lang = opts.lang ?? opts.language
+  const isRu = opts.isRussian ?? (lang !== undefined ? isRussianLang(lang, out) : true)
+  if (opts.digits && isRu) out = wordsToDigits(out)
   if (opts.commaSpacing) out = fixCommaSpacing(out)
-  if (opts.jargon) out = applyJargonDictionary(out, opts.customJargon)
+  if (opts.jargon) {
+    out = applyJargonDictionary(out, opts.customJargon, { defaultJargon: isRu })
+  }
   if (opts.capSentences) out = capitalizeSentences(out)
   if (opts.trailingPeriod) out = ensureTrailingPeriod(out)
   return out

package/lib/updater.js

@@ -2,7 +2,7 @@
 // Implements canonical DSH plugin-updater specification.
 
 import { spawn } from 'node:child_process';
-import { existsSync, readFileSync } from 'node:fs';
+import { existsSync, readFileSync, unlinkSync } from 'node:fs';
 import { readFile } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { basename, dirname, isAbsolute, resolve } from 'node:path';
@@ -169,12 +169,57 @@ export async function getUpdateStatus(options, target = runtime()) {
   };
 }
 
+export function readLockPid(lockPath) {
+  if (!existsSync(lockPath)) return null;
+  try {
+    const raw = readFileSync(lockPath, 'utf8').trim();
+    if (/^\d+$/.test(raw)) {
+      return parseInt(raw, 10);
+    }
+    const parsed = JSON.parse(raw);
+    if (parsed && typeof parsed.pid === 'number') {
+      return parsed.pid;
+    }
+  } catch { /* ignore unparseable lock file */ }
+  return null;
+}
+
+export function isProcessAlive(pid) {
+  if (!pid || typeof pid !== 'number' || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (e) {
+    return e && e.code === 'EPERM';
+  }
+}
+
+export function checkProfileLock(profileDir) {
+  const lockPath = resolve(profileDir, 'package.json.lock');
+  if (!existsSync(lockPath)) return { locked: false };
+  const pid = readLockPid(lockPath);
+  if (pid && isProcessAlive(pid)) {
+    return { locked: true, pid };
+  }
+  // Stale lock: PID is dead or unreadable; clean it up to prevent permanent blockage
+  try {
+    unlinkSync(lockPath);
+    return { locked: false, cleanedStale: true };
+  } catch {
+    return { locked: false };
+  }
+}
+
 async function installExact(target, packageSpec, options) {
   if (target.cliEntry === undefined) throw new Error('Automatic update is unavailable in this runtime.');
+  const lockCheck = checkProfileLock(target.profileDir);
+  if (lockCheck.locked) {
+    throw new Error(`Another package installation is currently in progress (PID ${lockCheck.pid}).`);
+  }
   await new Promise((resolvePromise, reject) => {
     const child = spawn(process.execPath, [
       target.cliEntry, 'plugin', '--profile', target.profileName, 'add',
-      '--config.minimumReleaseAge=0', packageSpec,
+      packageSpec,
       `--registry=${options.registry ?? 'https://registry.npmjs.org/'}`,
     ], {
       cwd: target.profileDir,
@@ -186,12 +231,23 @@ async function installExact(target, packageSpec, options) {
     child.stdout?.on('data', chunk => { detail = (detail + String(chunk)).slice(-4_000); });
     child.stderr?.on('data', chunk => { detail = (detail + String(chunk)).slice(-4_000); });
     const timer = setTimeout(() => {
-      child.kill();
+      child.kill('SIGTERM');
+      setTimeout(() => {
+        if (!child.killed) {
+          try { child.kill('SIGKILL'); } catch { /* ignore */ }
+        }
+        checkProfileLock(target.profileDir);
+      }, 1000).unref?.();
       reject(new Error('Update timed out; use the normal DSH update flow.'));
     }, UPDATE_TIMEOUT_MS);
-    child.once('error', error => { clearTimeout(timer); reject(error); });
+    child.once('error', error => {
+      clearTimeout(timer);
+      checkProfileLock(target.profileDir);
+      reject(error);
+    });
     child.once('exit', code => {
       clearTimeout(timer);
+      checkProfileLock(target.profileDir);
       if (code === 0) resolvePromise();
       else reject(new Error(detail.trim() || `Update exited with code ${String(code)}.`));
     });
@@ -233,8 +289,13 @@ export function registerPluginUpdater(ctx, options) {
           json(response, 403, { error: 'Rejected non-local or cross-origin update request.' });
           return;
         }
-        if (installing) {
-          json(response, 409, { error: 'This plugin is already updating.' });
+        const lockStatus = checkProfileLock(target.profileDir);
+        if (installing || lockStatus.locked) {
+          json(response, 409, {
+            error: lockStatus.locked
+              ? `Another package installation is currently in progress (PID ${lockStatus.pid}).`
+              : 'This plugin is already updating.',
+          });
           return;
         }
         installing = true;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-voice",
-  "version": "0.9.3",
+  "version": "0.9.4",
   "description": "Voice input for DeepSeek Harness: dictation chunked by pauses and voice messages, each with its own provider fallback chain (Deepgram, Groq, HuggingFace, local whisper.cpp, plus any OpenAI-compatible API of your own).",
   "license": "MIT",
   "type": "module",