@goodandready/dsh-voice 0.9.3 → 0.9.5

package/README.md

@@ -189,14 +189,14 @@ Open **Settings → Plugins → Plugin settings → Voice** in the Web UI:
 - id: dsh-voice
   config:
     dictation:
-      language: ru
+      language: "" # auto-detect by default; or specify "en", "ru", "zh", etc.
       vadSilenceMs: 700
       chain:
         - provider: deepgram
         - provider: groq
         - provider: local-whisper
     message:
-      language: ru
+      language: "" # auto-detect by default; or specify "en", "ru", "zh", etc.
       autoSendMs: 4000
       chain:
         - provider: openai
@@ -206,6 +206,8 @@ Open **Settings → Plugins → Plugin settings → Voice** in the Web UI:
     whisperModel: /models/ggml-medium-q8_0.bin
 ```
 
+> **Note on language handling**: Setting `language: ""` (default) allows providers to auto-detect the spoken language. Spoken numeral normalization (`wordsToDigits`) and standard Russian tech slang correction (`DEFAULT_JARGON_DICTIONARY`) activate conditionally only when Russian is selected or auto-detected in the transcript, ensuring non-Russian speech is never distorted.
+
 ---
 
 ## 🤖 Agent Tool & HTTP API

package/README.ru.md

@@ -189,14 +189,14 @@ dsh plugin --profile web add @goodandready/dsh-voice
 - id: dsh-voice
   config:
     dictation:
-      language: ru
+      language: "" # автоопределение по умолчанию; или укажите "ru", "en", "zh" и др.
       vadSilenceMs: 700
       chain:
         - provider: deepgram
         - provider: groq
         - provider: local-whisper
     message:
-      language: ru
+      language: "" # автоопределение по умолчанию; или укажите "ru", "en", "zh" и др.
       autoSendMs: 4000
       chain:
         - provider: openai
@@ -206,6 +206,8 @@ dsh plugin --profile web add @goodandready/dsh-voice
     whisperModel: /models/ggml-medium-q8_0.bin
 ```
 
+> **Примечание по языку**: Значение `language: ""` (по умолчанию) включает автоопределение языка провайдером. Нормализация числительных словами в цифры и стандартный словарь технического сленга применяются адаптивно только при распознавании русской речи, исключая искажение англоязычного текста.
+
 ---
 
 ## 🤖 Инструмент агента и HTTP API

package/lib/client.js

@@ -918,7 +918,7 @@ window.__ModuleLoader__.load({
         const row = modes[mode] || {}
         return {
           chain: Array.isArray(row.chain) ? row.chain.map((e) => e && e.provider) : [],
-          language: row.language || 'ru',
+          language: row.language !== undefined ? row.language : '',
         }
       })
     }
@@ -2403,7 +2403,10 @@ window.__ModuleLoader__.load({
         setInstallingSensevoice(true)
         fetch('/dsh-voice/sensevoice-installer', {
           method: 'POST',
-          headers: { 'x-dsh-plugin-update': '1' },
+          headers: {
+            'x-dsh-plugin-update': '1',
+            'Content-Type': 'application/json',
+          },
         })
           .then((r) => r.json())
           .then(() => {
@@ -3227,7 +3230,7 @@ window.__ModuleLoader__.load({
           React.createElement('div', { className: 'cb-section-desc' }, t('versionHint')),
           React.createElement('div', { className: 'cb-row', style: { alignItems: 'center', gap: '12px' } },
             React.createElement('span', { className: 'cb-badge cb-badge-ok' },
-              'v' + ((updaterStatus && updaterStatus.currentVersion) || '0.9.3')
+              'v' + ((updaterStatus && updaterStatus.currentVersion) || '0.9.4')
             ),
             updaterStatus && updaterStatus.updateAvailable
               ? React.createElement('span', { className: 'cb-badge cb-badge-warn' },

package/lib/http-util.js

@@ -46,14 +46,52 @@ export function isLoopback(addr) {
  */
 export function isTrustedCaller(req) {
   if (!req) return false
-  const remote = req.socket?.remoteAddress || req.connection?.remoteAddress || ''
-  if (isLoopback(remote)) return true
 
+  // 1. Browser security headers: immediately reject cross-site and same-site requests (#117, #173)
   const secSite = String(req.headers?.['sec-fetch-site'] || '').toLowerCase()
   if (secSite === 'cross-site' || secSite === 'same-site') return false
 
+  // 2. If Origin header is present, it must strictly match the Host header
   const host = String(req.headers?.host || '').toLowerCase()
   const origin = String(req.headers?.origin || '').trim().toLowerCase()
+  if (origin) {
+    try {
+      const u = new URL(origin)
+      if (u.host !== host) return false
+    } catch {
+      return false
+    }
+  }
+
+  // 3. If Referer header is present, it must strictly match the Host header
+  const referer = String(req.headers?.referer || '').trim().toLowerCase()
+  if (referer) {
+    try {
+      const u = new URL(referer)
+      if (u.host !== host) return false
+    } catch {
+      return false
+    }
+  }
+
+  // 4. For state-changing or data-carrying requests (POST/PUT/PATCH), require application/json or octet-stream
+  // Cross-origin simple form submissions cannot set application/json without a CORS preflight.
+  const method = String(req.method || 'GET').toUpperCase()
+  if (method === 'POST' || method === 'PUT' || method === 'PATCH') {
+    const contentType = String(req.headers?.['content-type'] || '').toLowerCase()
+    const isJson = contentType.startsWith('application/json')
+    const isOctet = contentType.startsWith('application/octet-stream')
+    if (!isJson && !isOctet) {
+      return false
+    }
+  }
+
+  // 5. Loopback remote address is trusted when not rejected by browser headers above
+  const remote = req.socket?.remoteAddress || req.connection?.remoteAddress || ''
+  if (isLoopback(remote)) return true
+
+  // 6. Non-loopback requests must be verified same-origin
+  if (secSite === 'same-origin') return true
   if (origin) {
     try {
       const u = new URL(origin)
@@ -61,10 +99,6 @@ export function isTrustedCaller(req) {
     } catch { /* invalid url */ }
     return false
   }
-
-  if (secSite === 'same-origin') return true
-
-  const referer = String(req.headers?.referer || '').trim().toLowerCase()
   if (referer) {
     try {
       const u = new URL(referer)

package/lib/index.js

@@ -32,39 +32,14 @@ import { createConfigReader } from './config-compat.js'
 import { registerConfigRoutes } from './config-routes.js'
 import { getAllowedAudioRoots, validateAudioPath, validateAudioContent } from './audio-guard.js'
 import { isAutoLang } from './provider-http.js'
+import { ChainEntry, CustomProvider, BaseConfig } from './schema.js'
+import { registerTranscribeAudioTool, MIME_BY_EXT } from './tool.js'
+export { ChainEntry, CustomProvider, BaseConfig }
 
 export const name = '@goodandready/dsh-voice'
 export const NS = 'dsh-voice'
 export const inject = ['tools', 'credentials', 'webServer', 'shell', 'settings', 'llm']
 
-const ChainEntry = z.object({
-  provider: z.string().default('local-whisper')
-    .description(`Provider key. Built in: ${PROVIDER_KEYS.join(', ')}. `
-      + `Ready-made, just add the key: ${PRESET_KEYS.join(', ')}. `
-      + 'Or the name of an entry from customProviders. '
-      + '"browser" recognises speech in the page itself — no key, no upload to this host, '
-      + 'text appears while you speak; put a normal provider after it as a fallback.'),
-  model: z.string().default('')
-    .description('Model override. Empty means the provider default.'),
-})
-
-// Custom provider: everything needed to call any OpenAI-compatible API.
-const CustomProvider = z.object({
-  key: z.string().default('')
-    .description('Name used in the chains above. Must differ from the built-in keys.'),
-  template: z.string().default('openai-transcriptions')
-    .description(`API shape: ${CUSTOM_TEMPLATES.join(' or ')}. `
-      + 'OpenRouter has no /audio/transcriptions, use openai-chat-audio there.'),
-  baseURL: z.string().default('')
-    .description('API root without a trailing slash, e.g. https://openrouter.ai/api/v1'),
-  model: z.string().default(''),
-  keyEnv: z.string().default('')
-    .description('Credential name holding the API key. Empty means no authorization header.'),
-  prompt: z.string().default('')
-    .description('openai-chat-audio only: instruction sent along with the audio. '
-      + 'Empty means the built-in one.'),
-})
-
 function makeVolatile(schema) {
   if (!schema || typeof schema.volatile !== 'function') return schema
   if (schema.type === 'object' && schema.dict) {
@@ -79,133 +54,10 @@ function makeVolatile(schema) {
   return schema.volatile()
 }
 
-const BaseConfig = z.object({
-  dictation: z.object({
-    chain: z.array(ChainEntry)
-      .default([{ provider: 'deepgram', model: '' }, { provider: 'groq', model: '' }, { provider: 'local-whisper', model: '' }])
-      .description('Fallback chain for dictation. Speed matters more than accuracy here.'),
-    language: z.string().default('ru'),
-    vadSilenceMs: z.number().default(700)
-      .description('Silence longer than this ends a phrase and sends the chunk.'),
-    sendDelayMs: z.number().default(0)
-      .description('Dictation: wait this many ms after a phrase before appending it, with a cancel window. 0 disables the delay.'),
-    polish: z.boolean().default(false)
-      .description('Polish the transcript through the harness model before inserting: punctuation, paragraphs, filler-word removal.'),
-    stream: z.boolean().default(false)
-      .description('Continuous dictation: cut phrases by a timer instead of waiting for a long silence, so text flows while you speak.'),
-    streamChunkMs: z.number().default(1200)
-      .description('Continuous dictation: phrase length in ms of uninterrupted speech before the chunk is sent.'),
-    vadAdapt: z.number().min(0).max(1).default(0)
-      .description('Adaptive silence threshold: 0 = fixed (current behaviour); >0 shrinks the threshold during dense speech and grows it during pauses.'),
-  }).default({}),
-  message: z.object({
-    chain: z.array(ChainEntry)
-      .default([{ provider: 'groq', model: '' }, { provider: 'hf', model: '' }, { provider: 'local-whisper', model: '' }])
-      .description('Fallback chain for voice messages. Accuracy matters more than speed.'),
-    language: z.string().default('ru'),
-    autoSendMs: z.number().default(4000)
-      .description('Cancel window before the recognized text is sent to the agent.'),
-    sessionCommands: z.boolean().default(false)
-      .description('Voice session commands: a clean "send", "cancel", "stop", "continue" does not become text — it drives the composer/session.'),
-    polishSend: z.boolean().default(false)
-      .description('Polish the whole composed draft through the model right before sending, not just single phrases.'),
-  }).default({}),
-  hotkey: z.string().default('Control')
-    .description('Hold this key anywhere in the page to record a voice message; release to send, '
-      + 'Escape to discard. Modifier names (Control, Alt, Shift) or a KeyboardEvent code. '
-      + 'Empty disables the hotkey.'),
-  customProviders: z.array(CustomProvider).default([])
-    .description('Own recognition providers, usable in both chains next to the built-in ones.'),
-  deepgramKeyEnv: z.string().default('DEEPGRAM_API_KEY'),
-  deepgramBaseUrl: z.string().default('https://api.deepgram.com')
-    .description('Deepgram-compatible host. Point this at a private/self-hosted Deepgram deployment '
-      + 'instead of the public api.deepgram.com endpoint.'),
-  groqKeyEnv: z.string().default('GROQ_API_KEY'),
-  hfTokenEnv: z.string().default('HF_TOKEN'),
-  whisperUrl: z.string().default('http://127.0.0.1:8001/inference'),
-  whisperBin: z.string().default('whisper-server')
-    .description('whisper.cpp server binary, looked up in PATH unless an absolute path is given.'),
-  whisperModel: z.string().default('')
-    .description('Absolute path to the ggml model. Autostart stays off while this is empty; '
-      + 'point it at your own model file to let the plugin launch whisper.cpp itself.'),
-  autoStart: z.boolean().default(true)
-    .description('Launch the local whisper.cpp server on activation if the port is free. '
-      + 'Requires whisperModel to be set.'),
-  ffmpegBin: z.string().default('ffmpeg')
-    .description('ffmpeg used to convert browser webm/opus into the WAV that whisper.cpp requires.'),
-  timeoutMs: z.number().default(120000),
-  allowedAudioDirs: z.array(z.string()).default([]),
-  maxFileBytes: z.number().default(25 * 1024 * 1024),
-  normalizeTranscript: z.boolean().default(false)
-    .description('transcribe_audio: convert spoken numbers to digits and tidy punctuation.'),
-  beep: z.boolean().default(false)
-    .description('Play a short beep when recording starts and stops.'),
-  localOnly: z.boolean().default(false)
-    .description('Restrict both chains to local-whisper only: fully offline, no cloud providers.'),
-  micDeviceId: z.string().default('')
-    .description('Microphone device id for recording. Empty means the system default.'),
-  noiseGateDb: z.number().default(-45)
-    .description('Audio noise gate threshold in dB for client-side recording (-50 to -25 dB, or <= -90 to disable). Silence below this threshold cuts ambient background noise and prevents false VAD triggers.'),
-  historyLimit: z.number().default(20)
-    .description('How many recent dictation inserts to keep for undo in the browser. 0 disables history.'),
-  vocabulary: z.array(z.string()).default([])
-    .description('Custom words (names, terms) hinted to providers so they recognize them correctly.'),
-  contextGlossary: z.boolean().default(true)
-    .description('Automatically extract code words and terms from context and hint them to STT providers.'),
-  noiseSuppression: z.boolean().default(true)
-    .description('Enable hardware noise suppression, echo cancellation, and auto gain control.'),
-  voiceCommands: z.boolean().default(false)
-    .description('During dictation, spoken edit commands ("new line", "paragraph") become real line breaks instead of words.'),
-  wakeWord: z.string().default('')
-    .description('Heads-free dictation: a phrase that, when recognized by the browser leg, starts a recording. Empty disables.'),
-  bargeIn: z.boolean().default(false)
-    .description('Ongoing playback or a long turn is interrupted by detected speech (browser leg).'),
-  polishBaseUrl: z.string().default('')
-    .description('Offline polish: OpenAI-compatible /chat/completions endpoint (e.g. local Ollama). Empty uses the harness model.'),
-  polishModel: z.string().default('')
-    .description('Offline polish: model id on polishBaseUrl.'),
-  polishKeyEnv: z.string().default('')
-    .description('Offline polish: credential name for the api key. Empty means no Authorization header.'),
-  polishProvider: z.string().default('')
-    .description('Harness polish: provider id. Empty uses the agent default model selection.'),
-  polishModelId: z.string().default('')
-    .description('Harness polish: model id. Empty uses the agent default model selection.'),
-  sensevoiceUrl: z.string().default('http://127.0.0.1:6006/api/v1/asr')
-    .description('SenseVoice-ONNX / Sherpa-ONNX endpoint: POST /api/v1/asr or OpenAI-compatible /v1/audio/transcriptions.'),
-  sensevoiceBin: z.string().default('sherpa-onnx-offline-http-server')
-    .description('SenseVoice / sherpa-onnx executable binary used when autostart is enabled.'),
-  sensevoiceModel: z.string().default('')
-    .description('SenseVoice / sherpa-onnx model path or model identifier.'),
-  sensevoiceAutostart: z.boolean().default(false)
-    .description('Start the local SenseVoice / sherpa-onnx server process automatically on startup.'),
-  visualizerStyle: z.union(['liquid-wave', 'dynamic-orb', 'bars', 'off']).default('liquid-wave')
-    .description('Audio visualizer animation style in the recording pill: "liquid-wave", "dynamic-orb", "bars", or "off".'),
-  gatedTurnTaking: z.boolean().default(true)
-    .description('Gated mode for speakers: pause recording or ignore input while assistant TTS is speaking to prevent acoustic feedback.'),
-  autoSendVisualRing: z.boolean().default(true)
-    .description('Show animated circular countdown ring on recording pill before auto-sending.'),
-  voiceActions: z.boolean().default(true)
-    .description('Enable spoken action triggers ("send", "cancel", "clear", "new line" in English/Russian).'),
-  techJargonCorrection: z.boolean().default(true)
-    .description('Apply developer lexicon and IT jargon normalization (GitHub, Docker, pnpm, Kubernetes, etc.).'),
-  jargonDictionary: z.array(z.object({ from: z.string(), to: z.string() })).default([])
-    .description('Custom jargon replacement dictionary.'),
-  liveInterimPreview: z.boolean().default(true)
-    .description('Display real-time interim speech preview (ghost text) in the recording pill.'),
-  structuredPromptVoice: z.boolean().default(true)
-    .description('Target voice dictation and numeric choices to active DSH structured prompt modals.'),
-})
-
 export const Config = typeof z.number().volatile === 'function'
   ? makeVolatile(BaseConfig)
   : BaseConfig
 
-const MIME_BY_EXT = {
-  '.wav': 'audio/wav', '.mp3': 'audio/mpeg', '.m4a': 'audio/mp4', '.mp4': 'audio/mp4',
-  '.ogg': 'audio/ogg', '.oga': 'audio/ogg', '.flac': 'audio/flac', '.webm': 'audio/webm', '.aac': 'audio/aac',
-}
-
-
 export function apply(ctx, baseConfig) {
   let child = null
 
@@ -253,6 +105,10 @@ export function apply(ctx, baseConfig) {
       return true
     }
     try {
+      if (child && typeof child.kill === 'function') {
+        try { child.kill() } catch { /* ignore */ }
+        child = null
+      }
       const spec = ctx.shell.resolve({
         command: `${JSON.stringify(cfg.whisperBin)} -m ${JSON.stringify(cfg.whisperModel)}`
           + ` --host 127.0.0.1 --port 8001 -t 8 -p 1 -l ${isAutoLang(cfg.dictation.language) ? 'auto' : cfg.dictation.language}`,
@@ -319,6 +175,10 @@ export function apply(ctx, baseConfig) {
       return true
     }
     try {
+      if (sensevoiceChild && typeof sensevoiceChild.kill === 'function') {
+        try { sensevoiceChild.kill() } catch { /* ignore */ }
+        sensevoiceChild = null
+      }
       let port = '6006'
       try { port = new URL(cfg.sensevoiceUrl).port || '6006' } catch { /* invalid URL */ }
       const tokensPath = findTokensFile(path.dirname(cfg.sensevoiceModel))
@@ -531,10 +391,15 @@ export function apply(ctx, baseConfig) {
       if (req.method !== 'POST') { writeJson(res, 405, { ok: false, error: { code: 'method', message: 'POST only' } }); return }
       if (!isTrustedCaller(req)) { writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'forbidden source origin' } }); return }
       const cfg = live()
+      const maxBodyBytes = Math.ceil((cfg.maxFileBytes * 4) / 3) + 64 * 1024
       let raw
       try {
-        raw = await readBody(req, cfg.maxFileBytes + 1024 * 1024)
+        raw = await readBody(req, maxBodyBytes)
       } catch (e) {
+        if (e && e.message === 'body too large') {
+          writeJson(res, 413, { ok: false, error: { code: 'too-large', message: `audio body exceeds limit for max ${cfg.maxFileBytes} bytes` } })
+          return
+        }
         writeJson(res, 400, { ok: false, error: { code: 'body', message: e.message } }); return
       }
       let payload
@@ -595,61 +460,13 @@ export function apply(ctx, baseConfig) {
     },
   }), 'dsh-voice: /transcribe route')
 
-  ctx.effect(() => ctx.tools.register(
-    defineTool({
-      name: 'transcribe_audio',
-      description:
-        'Recognize speech in an audio file and return the transcript as text. '
-        + 'Uses the voice-message fallback chain from the dsh-voice settings, so a single '
-        + 'provider outage or rate limit does not fail the request. '
-        + 'Use for voice messages, recordings, interviews.',
-      parameters: {
-        file_path: { type: 'string', required: true, description: 'Absolute path to the audio file (wav, mp3, m4a, ogg, flac, webm).' },
-        language: { type: 'string', description: `Recognition language code. Default: ${(baseConfig && baseConfig.message && baseConfig.message.language) || 'ru'}.` },
-      },
-      output: {
-        schema: {
-          type: 'object',
-          additionalProperties: false,
-          properties: { provider: { type: 'string' }, text: { type: 'string' }, tookMs: { type: 'integer' } },
-        },
-        render(args, value) {
-          const body = value.text.length > 4000
-            ? `${value.text.slice(0, 4000)}\n…[truncated ${value.text.length} chars]`
-            : value.text
-          return [{ type: 'text', text: `transcribe_audio (${value.provider}, ${value.tookMs}ms):\n${body}` }]
-        },
-      },
-      isConcurrencySafe: () => false,
-      timeoutMs: 365000,
-      async execute(args, exec) {
-        const cfg = live()
-        const filePath = String(args.file_path || '').trim()
-        if (!filePath) throw new Error('transcribe_audio: file_path is required')
-        const allowedRoots = getAllowedAudioRoots(cfg)
-        const { real } = await validateAudioPath(filePath, allowedRoots)
-        const info = await stat(real).catch(() => null)
-        if (!info) throw new Error(`transcribe_audio: file not found: ${filePath}`)
-        if (info.size > cfg.maxFileBytes) {
-          throw new Error(`transcribe_audio: file too large (${info.size} bytes, max ${cfg.maxFileBytes})`)
-        }
-        if (info.size < 44) throw new Error('transcribe_audio: file is empty or too small')
-        const bytes = await readFile(real)
-        const sniffedMime = validateAudioContent(bytes)
-        const mime = sniffedMime || MIME_BY_EXT[path.extname(real).toLowerCase()] || 'audio/wav'
-        const modeCfg = { ...cfg.message, language: String(args.language || cfg.message.language) }
-        let raw = await transcribe(modeCfg, bytes, mime, exec.signal)
-        if (raw && raw.text) raw = { ...raw, text: await polishText(raw.text, modeCfg, exec.signal) }
-        const out = raw
-        if (cfg.normalizeTranscript && out && out.text) {
-          out.text = normalizePhrase(out.text, {
-            digits: true, capSentences: true, commaSpacing: true, trailingPeriod: true,
-          })
-        }
-        return out
-      },
-    }),
-  ), 'dsh-voice: transcribe_audio tool')
+  // Registers agent tool name: 'transcribe_audio'
+  ctx.effect(() => registerTranscribeAudioTool(ctx, {
+    live,
+    baseConfig,
+    transcribe,
+    polishText,
+  }), 'dsh-voice: transcribe_audio tool')
 
   ctx.effect(() => () => {
     if (child) { try { child.kill && child.kill() } catch { /* already dead */ } }

package/lib/normalize.js

@@ -107,7 +107,14 @@ function cachedJargonRegex(from) {
   return re
 }
 
-export function applyJargonDictionary(text, customReplacements = []) {
+export function isRussianLang(lang, text = '') {
+  const l = String(lang || '').trim().toLowerCase()
+  if (l === 'ru' || l.startsWith('ru-') || l.startsWith('ru_')) return true
+  if (l === '' || l === 'auto') return /[а-яё]/i.test(String(text || ''))
+  return false
+}
+
+export function applyJargonDictionary(text, customReplacements = [], options = {}) {
   if (!text || typeof text !== 'string') return text || ''
   let result = text
   for (const item of customReplacements || []) {
@@ -116,9 +123,11 @@ export function applyJargonDictionary(text, customReplacements = []) {
     re.lastIndex = 0
     result = result.replace(re, item.to)
   }
-  for (const item of DEFAULT_JARGON_REGEX) {
-    item.re.lastIndex = 0
-    result = result.replace(item.re, item.to)
+  if (options.defaultJargon !== false) {
+    for (const item of DEFAULT_JARGON_REGEX) {
+      item.re.lastIndex = 0
+      result = result.replace(item.re, item.to)
+    }
   }
   return result
 }
@@ -160,9 +169,13 @@ export function extractVoiceActions(text) {
 export function normalizePhrase(text, opts = {}) {
   let out = String(text || '').trim()
   if (!out) return out
-  if (opts.digits) out = wordsToDigits(out)
+  const lang = opts.lang ?? opts.language
+  const isRu = opts.isRussian ?? (lang !== undefined ? isRussianLang(lang, out) : true)
+  if (opts.digits && isRu) out = wordsToDigits(out)
   if (opts.commaSpacing) out = fixCommaSpacing(out)
-  if (opts.jargon) out = applyJargonDictionary(out, opts.customJargon)
+  if (opts.jargon) {
+    out = applyJargonDictionary(out, opts.customJargon, { defaultJargon: isRu })
+  }
   if (opts.capSentences) out = capitalizeSentences(out)
   if (opts.trailingPeriod) out = ensureTrailingPeriod(out)
   return out

package/lib/schema.js

@@ -0,0 +1,153 @@
+// lib/schema.js — Schemastery configuration schemas for @goodandready/dsh-voice
+import z from '@deepseek-ai/schemastery'
+import { PROVIDER_KEYS, PRESET_KEYS, CUSTOM_TEMPLATES } from './providers.js'
+
+export const ChainEntry = z.object({
+  provider: z.string().default('local-whisper')
+    .description(`Provider key. Built in: ${PROVIDER_KEYS.join(', ')}. `
+      + `Ready-made, just add the key: ${PRESET_KEYS.join(', ')}. `
+      + 'Or the name of an entry from customProviders. '
+      + '"browser" recognises speech in the page itself — no key, no upload to this host, '
+      + 'text appears while you speak; put a normal provider after it as a fallback.'),
+  model: z.string().default('')
+    .description('Model override. Empty means the provider default.'),
+})
+
+// Custom provider: everything needed to call any OpenAI-compatible API.
+export const CustomProvider = z.object({
+  key: z.string().default('')
+    .description('Name used in the chains above. Must differ from the built-in keys.'),
+  template: z.string().default('openai-transcriptions')
+    .description(`API shape: ${CUSTOM_TEMPLATES.join(' or ')}. `
+      + 'OpenRouter has no /audio/transcriptions, use openai-chat-audio there.'),
+  baseURL: z.string().default('')
+    .description('API root without a trailing slash, e.g. https://openrouter.ai/api/v1'),
+  model: z.string().default(''),
+  keyEnv: z.string().default('')
+    .description('Credential name holding the API key. Empty means no authorization header.'),
+  prompt: z.string().default('')
+    .description('openai-chat-audio only: instruction sent along with the audio. '
+      + 'Empty means the built-in one.'),
+})
+
+
+export const BaseConfig = z.object({
+  dictation: z.object({
+    chain: z.array(ChainEntry)
+      .default([{ provider: 'deepgram', model: '' }, { provider: 'groq', model: '' }, { provider: 'local-whisper', model: '' }])
+      .description('Fallback chain for dictation. Speed matters more than accuracy here.'),
+    language: z.string().default('')
+      .description('Recognition language code for dictation (e.g. "en", "ru", "zh", or empty string for auto-detection).'),
+    vadSilenceMs: z.number().default(700)
+      .description('Silence longer than this ends a phrase and sends the chunk.'),
+    sendDelayMs: z.number().default(0)
+      .description('Dictation: wait this many ms after a phrase before appending it, with a cancel window. 0 disables the delay.'),
+    polish: z.boolean().default(false)
+      .description('Polish the transcript through the harness model before inserting: punctuation, paragraphs, filler-word removal.'),
+    stream: z.boolean().default(false)
+      .description('Continuous dictation: cut phrases by a timer instead of waiting for a long silence, so text flows while you speak.'),
+    streamChunkMs: z.number().default(1200)
+      .description('Continuous dictation: phrase length in ms of uninterrupted speech before the chunk is sent.'),
+    vadAdapt: z.number().min(0).max(1).default(0)
+      .description('Adaptive silence threshold: 0 = fixed (current behaviour); >0 shrinks the threshold during dense speech and grows it during pauses.'),
+  }).default({}),
+  message: z.object({
+    chain: z.array(ChainEntry)
+      .default([{ provider: 'groq', model: '' }, { provider: 'hf', model: '' }, { provider: 'local-whisper', model: '' }])
+      .description('Fallback chain for voice messages. Accuracy matters more than speed.'),
+    language: z.string().default('')
+      .description('Recognition language code for messages (e.g. "en", "ru", "zh", or empty string for auto-detection).'),
+    autoSendMs: z.number().default(4000)
+      .description('Cancel window before the recognized text is sent to the agent.'),
+    sessionCommands: z.boolean().default(false)
+      .description('Voice session commands: a clean "send", "cancel", "stop", "continue" does not become text — it drives the composer/session.'),
+    polishSend: z.boolean().default(false)
+      .description('Polish the whole composed draft through the model right before sending, not just single phrases.'),
+  }).default({}),
+  hotkey: z.string().default('Control')
+    .description('Hold this key anywhere in the page to record a voice message; release to send, '
+      + 'Escape to discard. Modifier names (Control, Alt, Shift) or a KeyboardEvent code. '
+      + 'Empty disables the hotkey.'),
+  customProviders: z.array(CustomProvider).default([])
+    .description('Own recognition providers, usable in both chains next to the built-in ones.'),
+  deepgramKeyEnv: z.string().default('DEEPGRAM_API_KEY'),
+  deepgramBaseUrl: z.string().default('https://api.deepgram.com')
+    .description('Deepgram-compatible host. Point this at a private/self-hosted Deepgram deployment '
+      + 'instead of the public api.deepgram.com endpoint.'),
+  groqKeyEnv: z.string().default('GROQ_API_KEY'),
+  hfTokenEnv: z.string().default('HF_TOKEN'),
+  whisperUrl: z.string().default('http://127.0.0.1:8001/inference'),
+  whisperBin: z.string().default('whisper-server')
+    .description('whisper.cpp server binary, looked up in PATH unless an absolute path is given.'),
+  whisperModel: z.string().default('')
+    .description('Absolute path to the ggml model. Autostart stays off while this is empty; '
+      + 'point it at your own model file to let the plugin launch whisper.cpp itself.'),
+  autoStart: z.boolean().default(true)
+    .description('Launch the local whisper.cpp server on activation if the port is free. '
+      + 'Requires whisperModel to be set.'),
+  ffmpegBin: z.string().default('ffmpeg')
+    .description('ffmpeg used to convert browser webm/opus into the WAV that whisper.cpp requires.'),
+  timeoutMs: z.number().default(120000),
+  allowedAudioDirs: z.array(z.string()).default([]),
+  maxFileBytes: z.number().default(25 * 1024 * 1024),
+  normalizeTranscript: z.boolean().default(false)
+    .description('transcribe_audio: convert spoken numbers to digits and tidy punctuation.'),
+  beep: z.boolean().default(false)
+    .description('Play a short beep when recording starts and stops.'),
+  localOnly: z.boolean().default(false)
+    .description('Restrict both chains to local-whisper only: fully offline, no cloud providers.'),
+  micDeviceId: z.string().default('')
+    .description('Microphone device id for recording. Empty means the system default.'),
+  noiseGateDb: z.number().default(-45)
+    .description('Audio noise gate threshold in dB for client-side recording (-50 to -25 dB, or <= -90 to disable). Silence below this threshold cuts ambient background noise and prevents false VAD triggers.'),
+  historyLimit: z.number().default(20)
+    .description('How many recent dictation inserts to keep for undo in the browser. 0 disables history.'),
+  vocabulary: z.array(z.string()).default([])
+    .description('Custom words (names, terms) hinted to providers so they recognize them correctly.'),
+  contextGlossary: z.boolean().default(true)
+    .description('Automatically extract code words and terms from context and hint them to STT providers.'),
+  noiseSuppression: z.boolean().default(true)
+    .description('Enable hardware noise suppression, echo cancellation, and auto gain control.'),
+  voiceCommands: z.boolean().default(false)
+    .description('During dictation, spoken edit commands ("new line", "paragraph") become real line breaks instead of words.'),
+  wakeWord: z.string().default('')
+    .description('Heads-free dictation: a phrase that, when recognized by the browser leg, starts a recording. Empty disables.'),
+  bargeIn: z.boolean().default(false)
+    .description('Ongoing playback or a long turn is interrupted by detected speech (browser leg).'),
+  polishBaseUrl: z.string().default('')
+    .description('Offline polish: OpenAI-compatible /chat/completions endpoint (e.g. local Ollama). Empty uses the harness model.'),
+  polishModel: z.string().default('')
+    .description('Offline polish: model id on polishBaseUrl.'),
+  polishKeyEnv: z.string().default('')
+    .description('Offline polish: credential name for the api key. Empty means no Authorization header.'),
+  polishProvider: z.string().default('')
+    .description('Harness polish: provider id. Empty uses the agent default model selection.'),
+  polishModelId: z.string().default('')
+    .description('Harness polish: model id. Empty uses the agent default model selection.'),
+  sensevoiceUrl: z.string().default('http://127.0.0.1:6006/api/v1/asr')
+    .description('SenseVoice-ONNX / Sherpa-ONNX endpoint: POST /api/v1/asr or OpenAI-compatible /v1/audio/transcriptions.'),
+  sensevoiceBin: z.string().default('sherpa-onnx-offline-http-server')
+    .description('SenseVoice / sherpa-onnx executable binary used when autostart is enabled.'),
+  sensevoiceModel: z.string().default('')
+    .description('SenseVoice / sherpa-onnx model path or model identifier.'),
+  sensevoiceAutostart: z.boolean().default(false)
+    .description('Start the local SenseVoice / sherpa-onnx server process automatically on startup.'),
+  visualizerStyle: z.union(['liquid-wave', 'dynamic-orb', 'bars', 'off']).default('liquid-wave')
+    .description('Audio visualizer animation style in the recording pill: "liquid-wave", "dynamic-orb", "bars", or "off".'),
+  gatedTurnTaking: z.boolean().default(true)
+    .description('Gated mode for speakers: pause recording or ignore input while assistant TTS is speaking to prevent acoustic feedback.'),
+  autoSendVisualRing: z.boolean().default(true)
+    .description('Show animated circular countdown ring on recording pill before auto-sending.'),
+  voiceActions: z.boolean().default(true)
+    .description('Enable spoken action triggers ("send", "cancel", "clear", "new line" in English/Russian).'),
+  techJargonCorrection: z.boolean().default(true)
+    .description('Apply developer lexicon and IT jargon normalization (GitHub, Docker, pnpm, Kubernetes, etc.).'),
+  jargonDictionary: z.array(z.object({ from: z.string(), to: z.string() })).default([])
+    .description('Custom jargon replacement dictionary.'),
+  liveInterimPreview: z.boolean().default(true)
+    .description('Display real-time interim speech preview (ghost text) in the recording pill.'),
+  structuredPromptVoice: z.boolean().default(true)
+    .description('Target voice dictation and numeric choices to active DSH structured prompt modals.'),
+})
+
+

package/lib/tool.js

@@ -0,0 +1,69 @@
+import { defineTool } from '@deepseek-ai/dsh-tools'
+import { readFile, stat } from 'node:fs/promises'
+import path from 'node:path'
+import { getAllowedAudioRoots, validateAudioPath, validateAudioContent } from './audio-guard.js'
+import { normalizePhrase } from './normalize.js'
+
+export const MIME_BY_EXT = {
+  '.wav': 'audio/wav', '.mp3': 'audio/mpeg', '.m4a': 'audio/mp4', '.mp4': 'audio/mp4',
+  '.ogg': 'audio/ogg', '.oga': 'audio/ogg', '.flac': 'audio/flac', '.webm': 'audio/webm', '.aac': 'audio/aac',
+}
+
+export function registerTranscribeAudioTool(ctx, { live, baseConfig, transcribe, polishText }) {
+  return ctx.tools.register(
+    defineTool({
+      name: 'transcribe_audio',
+      description:
+        'Recognize speech in an audio file and return the transcript as text. '
+        + 'Uses the voice-message fallback chain from the dsh-voice settings, so a single '
+        + 'provider outage or rate limit does not fail the request. '
+        + 'Use for voice messages, recordings, interviews.',
+      parameters: {
+        file_path: { type: 'string', required: true, description: 'Absolute path to the audio file (wav, mp3, m4a, ogg, flac, webm).' },
+        language: { type: 'string', description: `Recognition language code (e.g. "en", "ru", "zh", or empty string for auto-detection). Default: ${(baseConfig && baseConfig.message && baseConfig.message.language) || 'auto'}.` },
+      },
+      output: {
+        schema: {
+          type: 'object',
+          additionalProperties: false,
+          properties: { provider: { type: 'string' }, text: { type: 'string' }, tookMs: { type: 'integer' } },
+        },
+        render(args, value) {
+          const body = value.text.length > 4000
+            ? `${value.text.slice(0, 4000)}\n…[truncated ${value.text.length} chars]`
+            : value.text
+          return [{ type: 'text', text: `transcribe_audio (${value.provider}, ${value.tookMs}ms):\n${body}` }]
+        },
+      },
+      isConcurrencySafe: () => false,
+      timeoutMs: 365000,
+      async execute(args, exec) {
+        const cfg = live()
+        const filePath = String(args.file_path || '').trim()
+        if (!filePath) throw new Error('transcribe_audio: file_path is required')
+        const allowedRoots = getAllowedAudioRoots(cfg)
+        const { real } = await validateAudioPath(filePath, allowedRoots)
+        const info = await stat(real).catch(() => null)
+        if (!info) throw new Error(`transcribe_audio: file not found: ${filePath}`)
+        if (info.size > cfg.maxFileBytes) {
+          throw new Error(`transcribe_audio: file too large (${info.size} bytes, max ${cfg.maxFileBytes})`)
+        }
+        if (info.size < 44) throw new Error('transcribe_audio: file is empty or too small')
+        const bytes = await readFile(real)
+        const sniffedMime = validateAudioContent(bytes)
+        const mime = sniffedMime || MIME_BY_EXT[path.extname(real).toLowerCase()] || 'audio/wav'
+        const modeCfg = { ...cfg.message, language: String(args.language !== undefined ? args.language : cfg.message.language) }
+        let raw = await transcribe(modeCfg, bytes, mime, exec.signal)
+        if (raw && raw.text) raw = { ...raw, text: await polishText(raw.text, modeCfg, exec.signal) }
+        const out = raw
+        if (cfg.normalizeTranscript && out && out.text) {
+          out.text = normalizePhrase(out.text, {
+            lang: modeCfg.language,
+            digits: true, capSentences: true, commaSpacing: true, trailingPeriod: true,
+          })
+        }
+        return out
+      },
+    }),
+  )
+}

package/lib/updater.js

@@ -2,7 +2,7 @@
 // Implements canonical DSH plugin-updater specification.
 
 import { spawn } from 'node:child_process';
-import { existsSync, readFileSync } from 'node:fs';
+import { existsSync, readFileSync, unlinkSync } from 'node:fs';
 import { readFile } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { basename, dirname, isAbsolute, resolve } from 'node:path';
@@ -169,12 +169,57 @@ export async function getUpdateStatus(options, target = runtime()) {
   };
 }
 
+export function readLockPid(lockPath) {
+  if (!existsSync(lockPath)) return null;
+  try {
+    const raw = readFileSync(lockPath, 'utf8').trim();
+    if (/^\d+$/.test(raw)) {
+      return parseInt(raw, 10);
+    }
+    const parsed = JSON.parse(raw);
+    if (parsed && typeof parsed.pid === 'number') {
+      return parsed.pid;
+    }
+  } catch { /* ignore unparseable lock file */ }
+  return null;
+}
+
+export function isProcessAlive(pid) {
+  if (!pid || typeof pid !== 'number' || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (e) {
+    return e && e.code === 'EPERM';
+  }
+}
+
+export function checkProfileLock(profileDir) {
+  const lockPath = resolve(profileDir, 'package.json.lock');
+  if (!existsSync(lockPath)) return { locked: false };
+  const pid = readLockPid(lockPath);
+  if (pid && isProcessAlive(pid)) {
+    return { locked: true, pid };
+  }
+  // Stale lock: PID is dead or unreadable; clean it up to prevent permanent blockage
+  try {
+    unlinkSync(lockPath);
+    return { locked: false, cleanedStale: true };
+  } catch {
+    return { locked: false };
+  }
+}
+
 async function installExact(target, packageSpec, options) {
   if (target.cliEntry === undefined) throw new Error('Automatic update is unavailable in this runtime.');
+  const lockCheck = checkProfileLock(target.profileDir);
+  if (lockCheck.locked) {
+    throw new Error(`Another package installation is currently in progress (PID ${lockCheck.pid}).`);
+  }
   await new Promise((resolvePromise, reject) => {
     const child = spawn(process.execPath, [
       target.cliEntry, 'plugin', '--profile', target.profileName, 'add',
-      '--config.minimumReleaseAge=0', packageSpec,
+      packageSpec,
       `--registry=${options.registry ?? 'https://registry.npmjs.org/'}`,
     ], {
       cwd: target.profileDir,
@@ -186,12 +231,23 @@ async function installExact(target, packageSpec, options) {
     child.stdout?.on('data', chunk => { detail = (detail + String(chunk)).slice(-4_000); });
     child.stderr?.on('data', chunk => { detail = (detail + String(chunk)).slice(-4_000); });
     const timer = setTimeout(() => {
-      child.kill();
+      child.kill('SIGTERM');
+      setTimeout(() => {
+        if (!child.killed) {
+          try { child.kill('SIGKILL'); } catch { /* ignore */ }
+        }
+        checkProfileLock(target.profileDir);
+      }, 1000).unref?.();
       reject(new Error('Update timed out; use the normal DSH update flow.'));
     }, UPDATE_TIMEOUT_MS);
-    child.once('error', error => { clearTimeout(timer); reject(error); });
+    child.once('error', error => {
+      clearTimeout(timer);
+      checkProfileLock(target.profileDir);
+      reject(error);
+    });
     child.once('exit', code => {
       clearTimeout(timer);
+      checkProfileLock(target.profileDir);
       if (code === 0) resolvePromise();
       else reject(new Error(detail.trim() || `Update exited with code ${String(code)}.`));
     });
@@ -233,8 +289,13 @@ export function registerPluginUpdater(ctx, options) {
           json(response, 403, { error: 'Rejected non-local or cross-origin update request.' });
           return;
         }
-        if (installing) {
-          json(response, 409, { error: 'This plugin is already updating.' });
+        const lockStatus = checkProfileLock(target.profileDir);
+        if (installing || lockStatus.locked) {
+          json(response, 409, {
+            error: lockStatus.locked
+              ? `Another package installation is currently in progress (PID ${lockStatus.pid}).`
+              : 'This plugin is already updating.',
+          });
           return;
         }
         installing = true;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-voice",
-  "version": "0.9.3",
+  "version": "0.9.5",
   "description": "Voice input for DeepSeek Harness: dictation chunked by pauses and voice messages, each with its own provider fallback chain (Deepgram, Groq, HuggingFace, local whisper.cpp, plus any OpenAI-compatible API of your own).",
   "license": "MIT",
   "type": "module",