@goodandready/dsh-voice 0.9.41 → 0.9.43

package/README.md

@@ -222,16 +222,19 @@ Open **Settings → Plugins → Plugin settings → Voice** in the Web UI:
 ### Agent Tool (`transcribe_audio`)
 Registers `transcribe_audio(file_path, language?)` in `ctx.tools`, allowing agents to analyze audio files, interview recordings, and voice notes directly from disk. Path containment is strictly enforced against allowed directories (`allowedAudioDirs`, `~/.dsh`, `tmpdir`, `cwd`) with symlink traversal escape prevention and magic-byte audio format validation.
 
-### Internal HTTP Endpoints
+### Internal HTTP & WebSocket Endpoints
+* `GET /dsh-voice/ws/stream` — RFC 6455 WebSocket streaming channel for real-time dictation with interim transcription previews (`{ type: 'interim', text }`) and final transcript dispatch (`{ type: 'final', text, action, provider }`). Authenticated via `hasSameOrigin` or `x-dsh-voice-token` (#282, #292).
 * `POST /dsh-voice/transcribe` — `{ dataBase64, mimeType, mode }` → `{ ok, text, provider, tookMs }`
 * `POST /dsh-voice/polish` — `{ text }` → `{ ok, text }`
-* `GET /dsh-voice/status` — Returns daemon status, active chains, SenseVoice and `effectiveSensevoiceProvider`.
+* `GET /dsh-voice/status` — Returns daemon status, active chains, SenseVoice and `effectiveSensevoiceProvider`. Emits `sessionToken` exclusively to verified same-origin callers (#292).
 * `GET /dsh-voice/config` — Returns live plugin configuration snapshot.
-* `PUT /dsh-voice/config` — Updates and persists plugin configuration across network.
+* `PUT /dsh-voice/config` — Updates and persists plugin configuration across network with automatic session token rotation (#292).
 * `GET/POST /dsh-voice/sensevoice-installer` — SenseVoice 1-click model installation status and trigger (protected by `isTrustedCaller`, model paths redacted).
 * `POST /api/dsh-voice/update` — Triggers plugin self-update to latest compatible npm version (protected by local caller verification and profile lock check).
 * `GET /api/dsh-voice/update` — Returns update check status (current version, latest version, updateAvailable).
 
+> **Security & Quota Protections (#292, #293)**: State-changing HTTP routes and WebSocket upgrades enforce strict same-origin verification and token authentication against reverse LAN bridges (such as `dsh-lanmode`), preventing unauthorized configuration changes or quota depletion. Real-time interim WebSocket streaming processes only the latest audio chunk ($O(N)$ linear byte consumption) and restricts recognition strictly to local engines (`local-whisper`, `sensevoice`, `browser-webgpu`), ensuring zero cloud quota consumption during interim speech preview.
+
 ### 🔒 Profile Lock & Controlled Operator Recovery Policy
 When updating or installing plugins, DeepSeek Harness profiles coordinate concurrent operations using `<profile-dir>/package.json.lock` (for example, `~/.dsh/profiles/<profile>/package.json.lock`).
 * **Canonical Contender Policy**: The contender process never deletes or unlinks an existing lockfile. Automatic stale lock removal by contenders is prohibited to eliminate TOCTOU (Time-of-Check to Time-of-Use) race conditions and prevent unintended lockfile clobbering.

package/lib/client.js

@@ -1498,6 +1498,7 @@ voice._chainsPromise = null
         voice._chainsPromise = fetch('/dsh-voice/status', { cache: 'no-store' })
           .then((res) => res.json())
           .then((data) => {
+            if (data?.sessionToken && typeof window !== 'undefined') window.__dshVoiceToken = data.sessionToken
             if (data && typeof data.localOnly === 'boolean') {
               voice.settings.localOnly = data.localOnly
             }

package/lib/config-routes.js

@@ -1,7 +1,7 @@
 // lib/config-routes.js — Host route for plugin configuration persistence over network.
 // Solves DSH network limitation where client-side persistence is blocked in non-loopback environments (Gitea #149).
 
-import { writeJson, readBody, isTrustedCaller } from './http-util.js'
+import { writeJson, readBody, isTrustedCaller, rotateVoiceSessionToken, getVoiceSessionToken } from './http-util.js'
 
 export function registerConfigRoutes(ctx, {
   NS,
@@ -153,11 +153,12 @@ export function registerConfigRoutes(ctx, {
           triggerAutostart()
         }
 
+        rotateVoiceSessionToken()
         let newRev
         try {
           newRev = settingsService?.describe?.()?.find?.((r) => r.ns === NS)?.revision
         } catch {}
-        writeJson(res, 200, { ok: true, config: live(), revision: newRev })
+        writeJson(res, 200, { ok: true, config: live(), revision: newRev, sessionToken: getVoiceSessionToken() })
       } catch (err) {
         writeJson(res, 500, { ok: false, error: { code: 'save', message: String(err?.message || err) } })
       }

package/lib/host-routes.js

@@ -1,6 +1,6 @@
 // HTTP host routes registered on ctx.webServer.
 import os from 'node:os'
-import { readBody, isLoopback, isTrustedCaller, getVoiceSessionToken } from './http-util.js'
+import { readBody, isLoopback, isTrustedCaller, getVoiceSessionToken, verifyVoiceSessionToken, hasSameOrigin } from './http-util.js'
 import { resolveSensevoiceProvider } from './sensevoice-installer.js'
 import { applyVoiceMacros } from './macros.js'
 import { createSyntheticWav } from './wav.js'
@@ -46,7 +46,7 @@ export function registerHostRoutes(ctx, deps) {
       const sensevoiceError = sensevoiceOk ? null : getSensevoiceError()
       writeJson(res, 200, {
         ok: true,
-        sessionToken: getVoiceSessionToken(),
+        sessionToken: hasSameOrigin(req) ? getVoiceSessionToken() : null,
         whisperRunning: whisperOk,
         whisperError: whisperOk ? null : whisperError,
         sensevoiceRunning: sensevoiceOk,
@@ -385,7 +385,12 @@ export function registerHostRoutes(ctx, deps) {
           const url = new URL(req.url || '/', 'http://127.0.0.1')
           const token = req.headers['x-dsh-voice-token'] || url.searchParams.get('token')
           const expected = getVoiceSessionToken()
-          if (expected && token !== expected) {
+          if (!hasSameOrigin(req) && (!token || !verifyVoiceSessionToken(token))) {
+            socket.write('HTTP/1.1 403 Forbidden\r\n\r\n')
+            socket.destroy()
+            return
+          }
+          if (expected && token && !verifyVoiceSessionToken(token)) {
             socket.write('HTTP/1.1 401 Unauthorized\r\n\r\n')
             socket.destroy()
             return
@@ -409,14 +414,33 @@ export function registerHostRoutes(ctx, deps) {
                     streamChunks.push(Buffer.from(msg.dataBase64, 'base64'))
                   } else if (msg.type === 'interim') {
                     if (streamChunks.length > 0) {
-                      const buf = Buffer.concat(streamChunks)
-                      if (buf.length > 3000) {
-                        try {
-                          const interimOut = await transcribe(buf, streamMime, streamMode)
-                          if (interimOut && interimOut.text) {
-                            ws.send(JSON.stringify({ type: 'interim', text: interimOut.text }))
+                      const latestChunk = streamChunks[streamChunks.length - 1]
+                      if (latestChunk && latestChunk.length > 3000) {
+                        const cfg = live()
+                        const baseModeCfg = streamMode === 'message' ? cfg.message : cfg.dictation
+                        const LOCAL_ENGINES = new Set(['local-whisper', 'sensevoice', 'browser-webgpu'])
+                        const interimChain = (baseModeCfg.chain || []).filter((e) => LOCAL_ENGINES.has(e.provider))
+
+                        let canRunLocal = false
+                        for (const entry of interimChain) {
+                          if (entry.provider === 'local-whisper' && (await whisperAlive())) { canRunLocal = true; break }
+                          if (entry.provider === 'sensevoice' && (await sensevoiceAlive())) { canRunLocal = true; break }
+                          if (entry.provider === 'browser-webgpu') { canRunLocal = true; break }
+                        }
+
+                        if (canRunLocal && interimChain.length > 0) {
+                          const interimModeCfg = { ...baseModeCfg, chain: interimChain, polish: false }
+                          const controller = new AbortController()
+                          const timer = setTimeout(() => controller.abort(), 5000)
+                          try {
+                            const interimOut = await transcribe(interimModeCfg, latestChunk, streamMime, controller.signal)
+                            if (interimOut && interimOut.text) {
+                              ws.send(JSON.stringify({ type: 'interim', text: interimOut.text }))
+                            }
+                          } catch (err) { /* ignore interim failure */ } finally {
+                            clearTimeout(timer)
                           }
-                        } catch (_) {}
+                        }
                       }
                     }
                   } else if (msg.type === 'finish') {
@@ -426,11 +450,15 @@ export function registerHostRoutes(ctx, deps) {
                       ws.send(JSON.stringify({ type: 'final', text: '', ok: true }))
                       return
                     }
+                    const cfg = live()
+                    const modeCfg = streamMode === 'message' ? cfg.message : cfg.dictation
+                    const controller = new AbortController()
+                    const timer = setTimeout(() => controller.abort(), cfg.timeoutMs || 25000)
                     try {
-                      const finalOut = await transcribe(buf, streamMime, streamMode)
+                      const finalOut = await transcribe(modeCfg, buf, streamMime, controller.signal)
                       let text = finalOut && finalOut.text ? finalOut.text : ''
                       let action = null
-                      if (extractVoiceActions) {
+                      if (extractVoiceActions && cfg.voiceActions !== false) {
                         const act = extractVoiceActions(text)
                         if (act.action) { action = act.action; text = act.text }
                       }
@@ -443,9 +471,11 @@ export function registerHostRoutes(ctx, deps) {
                         type: 'error',
                         error: String(err && err.message ? err.message : err), ok: false,
                       }))
+                    } finally {
+                      clearTimeout(timer)
                     }
                   }
-                } catch (_) {}
+                } catch (err) { /* ignore parse error */ }
               }
             })
           })

package/lib/http-util.js

@@ -22,6 +22,11 @@ export function setVoiceSessionToken(t) {
   sessionSecret = String(t || '')
 }
 
+export function rotateVoiceSessionToken() {
+  sessionSecret = randomBytes(24).toString('hex')
+  return sessionSecret
+}
+
 export function verifyVoiceSessionToken(token) {
   if (!token || typeof token !== 'string') return false
   const secret = getVoiceSessionToken()
@@ -97,15 +102,156 @@ export function readBody(req, maxBytes) {
 export function isLoopback(addr) {
   if (!addr) return false
   const clean = String(addr).replace(/^::ffff:/, '')
-  return clean === '127.0.0.1' || clean === '::1' || clean === 'localhost'
+  return clean === '127.0.0.1' || clean === '::1' || clean === 'localhost' || clean === '[::1]'
+}
+
+/**
+ * Check whether an incoming HTTP request is from the DeepSeek desktop shell (#12, #295).
+ * Matches patterns from @deepseek-ai/dsh-desktop and official DSH shell wrappers.
+ * @param {import('node:http').IncomingMessage} req
+ * @returns {boolean}
+ */
+export function isDesktopShellRequest(req) {
+  if (!req || !req.headers) return false
+  const ua = String(req.headers['user-agent'] || '')
+  const cookie = String(req.headers.cookie || '')
+  if (ua.includes('@deepseek-ai/dsh-desktop/') && cookie.includes('dsh-auth-')) return true
+  const remote = req.socket?.remoteAddress || req.connection?.remoteAddress || ''
+  if (ua.includes('dsh-desktop') && isLoopback(remote)) return true
+  return false
+}
+
+/**
+ * Check whether an incoming HTTP request carries a DeepSeek Harness session cookie (#295).
+ * DSH core sets 'dsh-auth-<hash>=v1...' as a SameSite=Strict HttpOnly cookie.
+ * @param {import('node:http').IncomingMessage} req
+ * @returns {boolean}
+ */
+export function hasDshAuthCookie(req) {
+  if (!req || !req.headers) return false
+  const cookie = String(req.headers.cookie || '')
+  return cookie.includes('dsh-auth-')
+}
+
+/**
+ * Split host header or URL host into lowercase hostname and port string.
+ * @param {string} rawHost
+ * @returns {{ hostname: string, port: string }}
+ */
+function parseHost(rawHost) {
+  if (!rawHost) return { hostname: '', port: '' }
+  const clean = String(rawHost).trim().toLowerCase()
+  const ipv6Match = clean.match(/^\[([^\]]+)\](?::(\d+))?$/)
+  let hostname = ''
+  let port = ''
+  if (ipv6Match) {
+    hostname = ipv6Match[1]
+    port = ipv6Match[2] || ''
+  } else {
+    const parts = clean.split(':')
+    hostname = parts[0]
+    port = parts[1] || ''
+  }
+  if (port === '80' || port === '443') {
+    port = ''
+  }
+  return { hostname, port }
+}
+
+/**
+ * Verify whether an Origin or Referer URL is allowed for the given Host header (#12, #292, #295).
+ * @param {string} urlStr
+ * @param {string} hostHeader
+ * @param {import('node:http').IncomingMessage} req
+ * @returns {boolean}
+ */
+export function isOriginOrRefererAllowed(urlStr, hostHeader, req) {
+  if (!urlStr || typeof urlStr !== 'string') return false
+  const trimmed = urlStr.trim()
+  if (!trimmed) return false
+
+  const remote = req?.socket?.remoteAddress || req?.connection?.remoteAddress || ''
+  const remoteIsLoopback = isLoopback(remote)
+
+  // 1. Literal 'null' origin (sent by Chromium/Electron for local files or sandboxed views)
+  if (trimmed === 'null') {
+    return remoteIsLoopback && (isDesktopShellRequest(req) || hasDshAuthCookie(req))
+  }
+
+  try {
+    const u = new URL(trimmed)
+
+    // 2. Official DeepSeek desktop custom app scheme (e.g. dsh-app://app or dsh-app://localhost)
+    if (u.protocol === 'dsh-app:') {
+      const appHost = u.host.toLowerCase()
+      const allowedAppHost = !appHost || appHost === 'app' || appHost === 'localhost'
+      return allowedAppHost && remoteIsLoopback
+    }
+
+    // 3. Web schemes: HTTP and HTTPS
+    if (u.protocol === 'http:' || u.protocol === 'https:') {
+      if (!hostHeader) return false
+      const target = parseHost(hostHeader)
+      const origin = parseHost(u.host)
+
+      // Exact match
+      if (origin.hostname === target.hostname && origin.port === target.port) {
+        return true
+      }
+
+      // Loopback equivalence (e.g. localhost:3080 vs 127.0.0.1:3080 or ::1:3080)
+      if (isLoopback(origin.hostname) && isLoopback(target.hostname) && origin.port === target.port) {
+        return true
+      }
+    }
+
+    return false
+  } catch {
+    return false
+  }
+}
+
+/**
+ * Check whether a request originates from the same origin as the Host header or trusted desktop shell (#12, #292, #295).
+ * @param {import('node:http').IncomingMessage} req
+ * @returns {boolean}
+ */
+export function hasSameOrigin(req) {
+  if (!req || !req.headers) return false
+  const secSite = String(req.headers['sec-fetch-site'] || '').toLowerCase()
+  if (secSite === 'cross-site' || secSite === 'same-site') return false
+
+  const host = String(req.headers.host || '').trim().toLowerCase()
+  if (!host) return false
+
+  const origin = String(req.headers.origin || '').trim()
+  if (origin) {
+    return isOriginOrRefererAllowed(origin, host, req)
+  }
+
+  const referer = String(req.headers.referer || '').trim()
+  if (referer) {
+    return isOriginOrRefererAllowed(referer, host, req)
+  }
+
+  // Same-origin metadata from browser Fetch API
+  if (secSite === 'same-origin') return true
+
+  // DeepSeek Desktop shell or authenticated DSH session on loopback/same-host
+  const remote = req.socket?.remoteAddress || req.connection?.remoteAddress || ''
+  if (isDesktopShellRequest(req)) return true
+  if (hasDshAuthCookie(req) && (isLoopback(remote) || host)) return true
+
+  return false
 }
 
 /**
  * Verify that the HTTP request originates from a trusted caller.
- * Fail-closed security guard for state-changing or quota-consuming POST routes (#117, #173, #277).
- * - Loopback callers (127.0.0.1, ::1) are trusted unless rejected by browser security headers.
- * - Non-loopback LAN mutating/quota-consuming POST/PUT requests require valid session token (#277).
+ * Fail-closed security guard for state-changing or quota-consuming routes (#117, #173, #277, #292, #295).
  * - Routes marked loopbackOnly strictly reject non-loopback callers.
+ * - Mutating requests (POST, PUT, PATCH) or WS upgrades require validated same-origin or valid session token (#12, #292, #295).
+ *   Raw LAN callers or reverse bridges without Origin/Referer/Cookie and without token are fail-closed rejected.
+ * - Non-mutating GET requests require loopback or same-origin.
  * @param {import('node:http').IncomingMessage} req
  * @param {{ loopbackOnly?: boolean }} [options]
  * @returns {boolean}
@@ -117,32 +263,24 @@ export function isTrustedCaller(req, options = {}) {
   const secSite = String(req.headers?.['sec-fetch-site'] || '').toLowerCase()
   if (secSite === 'cross-site' || secSite === 'same-site') return false
 
-  // 2. If Origin header is present, it must strictly match the Host header
   const host = String(req.headers?.host || '').toLowerCase()
-  const origin = String(req.headers?.origin || '').trim().toLowerCase()
+
+  // 2. If Origin header is present, verify against host or trusted desktop scheme (#12, #292, #295)
+  const origin = String(req.headers?.origin || '').trim()
   if (origin) {
-    try {
-      const u = new URL(origin)
-      if (u.host !== host) return false
-    } catch {
-      return false
-    }
+    if (!isOriginOrRefererAllowed(origin, host, req)) return false
   }
 
-  // 3. If Referer header is present, it must strictly match the Host header
-  const referer = String(req.headers?.referer || '').trim().toLowerCase()
+  // 3. If Referer header is present, verify against host or trusted desktop scheme (#12, #292, #295)
+  const referer = String(req.headers?.referer || '').trim()
   if (referer) {
-    try {
-      const u = new URL(referer)
-      if (u.host !== host) return false
-    } catch {
-      return false
-    }
+    if (!isOriginOrRefererAllowed(referer, host, req)) return false
   }
 
   // 4. For state-changing or data-carrying requests (POST/PUT/PATCH), require application/json or octet-stream
   const method = String(req.method || 'GET').toUpperCase()
-  if (method === 'POST' || method === 'PUT' || method === 'PATCH') {
+  const isMutating = method === 'POST' || method === 'PUT' || method === 'PATCH'
+  if (isMutating) {
     const contentType = String(req.headers?.['content-type'] || '').toLowerCase()
     const isJson = contentType.startsWith('application/json')
     const isOctet = contentType.startsWith('application/octet-stream')
@@ -151,39 +289,46 @@ export function isTrustedCaller(req, options = {}) {
     }
   }
 
-  // 5. Loopback remote address is trusted when not rejected by browser headers above
   const remote = req.socket?.remoteAddress || req.connection?.remoteAddress || ''
-  if (isLoopback(remote)) return true
+  const remoteIsLoopback = isLoopback(remote)
+  const hostName = host.replace(/:\d+$/, '')
+  const hostIsLoopback = isLoopback(hostName)
+  const isPureLocal = remoteIsLoopback && hostIsLoopback
 
-  // If route strictly requires loopback (e.g. host model installer or hardware benchmark)
-  if (options && options.loopbackOnly) return false
+  // 5. If route strictly requires loopback (e.g. host model installer or hardware benchmark)
+  if (options && options.loopbackOnly) {
+    if (!isPureLocal) return false
+    return true
+  }
 
-  // 6. Non-loopback LAN requests: POST/PUT/PATCH quota-burning operations require session auth token (#277)
-  const isMutating = method === 'POST' || method === 'PUT' || method === 'PATCH'
+  // 6. Mutating requests (POST/PUT/PATCH):
+  // Even from loopback (which may be proxied via dsh-lanmode bridge), requests without Origin/Referer
+  // must present a valid x-dsh-voice-token (#292).
+  // Non-loopback LAN callers strictly require a valid session token to prevent forged LAN mutations (#277).
   if (isMutating) {
     const incomingToken = String(req.headers?.['x-dsh-voice-token'] || req.headers?.['x-voice-token'] || '')
-    if (incomingToken && verifyVoiceSessionToken(incomingToken)) {
-      return true
+    const hasValidToken = Boolean(incomingToken && verifyVoiceSessionToken(incomingToken))
+
+    if (!remoteIsLoopback) {
+      // Non-loopback LAN callers: always require valid token (#277)
+      return hasValidToken
     }
+
+    // Loopback callers (local browser, desktop shell, or reverse bridge dsh-lanmode):
+    // If request has verified same-origin or desktop shell, allow it (#12, #295).
+    if (hasSameOrigin(req)) return true
+    // If request has valid session token, allow it.
+    if (hasValidToken) return true
+    // Requests without Origin/Referer and without token: strictly reject (#292)
     return false
   }
 
-  // 7. Non-state-changing GET requests from LAN: verify same-origin
+  // 7. Loopback remote address for non-mutating GET requests
+  if (remoteIsLoopback) return true
+
+  // 8. Non-loopback LAN GET requests: require same-origin or authenticated session
   if (secSite === 'same-origin') return true
-  if (origin) {
-    try {
-      const u = new URL(origin)
-      if (u.host === host) return true
-    } catch { /* invalid url */ }
-    return false
-  }
-  if (referer) {
-    try {
-      const u = new URL(referer)
-      if (u.host === host) return true
-    } catch { /* invalid url */ }
-    return false
-  }
+  if (hasSameOrigin(req)) return true
 
   return false
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-voice",
-  "version": "0.9.41",
+  "version": "0.9.43",
   "description": "Voice input for DeepSeek Harness: dictation chunked by pauses and voice messages, each with its own provider fallback chain (Deepgram, Groq, HuggingFace, local whisper.cpp, plus any OpenAI-compatible API of your own).",
   "license": "MIT",
   "type": "module",