@goodandready/dsh-voice 0.9.42 → 0.9.44

package/lib/client.js

@@ -852,8 +852,7 @@ window.__ModuleLoader__.load({
       const text = chunks.join(' ')
       if (!text || text.length < 3) return []
       const matches = text.match(/[A-Za-zА-Яа-яЁё_][A-Za-zА-Яа-яЁё0-9_]{2,29}/g) || []
-      // Linguistic filter: functional stop-word dictionary for vocabulary keyword extraction.
-      // Language processing data for context analysis, distinct from user-facing UI text.
+      // Stop-word dictionary for vocabulary keyword extraction
       const stop = new Set([
         'the', 'and', 'for', 'are', 'but', 'not', 'you', 'all', 'any', 'can', 'her', 'was',
         'one', 'our', 'out', 'day', 'get', 'has', 'him', 'his', 'how', 'man', 'new', 'now',
@@ -983,9 +982,7 @@ window.__ModuleLoader__.load({
       return lead + s + trail
     }
 
-    // Functional speech edit commands (#37): spoken line breaks and punctuation -> symbols.
-    // Linguistic data for audio transcript post-processing; not user-facing UI text.
-    // Russian phrases match RU STT output; English covers EN dictation.
+    // Speech edit commands (#37): spoken line breaks and punctuation -> symbols
     const VOICE_COMMANDS = [
       [/(^|[\s,.!?])с новой строки([\s,.!?]|$)/gi, '$1\n$2'],
       [/(^|[\s,.!?])новая строка([\s,.!?]|$)/gi, '$1\n$2'],
@@ -1033,22 +1030,26 @@ window.__ModuleLoader__.load({
     function insertDraftText(text, target) {
       if (voice.disposed) return false
       const span = target && target.span
+      const sIn = (target && target.input) || voice.input
+      const sDraft = (sIn && typeof sIn.draft === 'string') ? sIn.draft : ''
+      const spaced = (sDraft && !/\s$/.test(sDraft) && !/^\s/.test(text)
+        && !/^[.,;:!?…»)\]}]/.test(text) && !/[\s(«"'\[]$/.test(sDraft)) ? ' ' + text : text
       if (span) {
         if (typeof span.insert === 'function') {
           try {
-            const r = span.insert(text)
+            const r = span.insert(spaced)
             if (r !== false) return true
             return false
           } catch (_) {}
         } else if (typeof span.insertText === 'function') {
           try {
-            const r = span.insertText(text)
+            const r = span.insertText(spaced)
             if (r !== false) return true
             return false
           } catch (_) {}
         } else if (typeof span === 'function') {
           try {
-            const r = span(text)
+            const r = span(spaced)
             if (r !== false) return true
             return false
           } catch (_) {}
@@ -1062,7 +1063,7 @@ window.__ModuleLoader__.load({
       }
       if (typeof actions.insertText === 'function') {
         try {
-          const res = actions.insertText(text, span)
+          const res = actions.insertText(spaced, span)
           if (res !== false) {
             if (target && typeof actions.captureInsertion === 'function') {
               try { target.span = actions.captureInsertion() } catch (_) {}
@@ -1124,14 +1125,7 @@ window.__ModuleLoader__.load({
       } catch (noAudio) { /* no audio — not critical */ }
     }
 
-    // ------------------------------------------------- browser recognition
-    //
-    // A separate leg unlike the others: the browser recognizes speech itself,
-    // nothing is uploaded to the host, no keys are needed, and text appears
-    // word by word while you speak.
-    //
-    // Cost: in Chrome audio goes to Google servers. This provider is never
-    // enabled automatically — only when placed explicitly in a chain.
+    // browser recognition: in-browser, no upload, only enabled when in chain
     function speechRecognitionCtor() {
       if (typeof window === 'undefined') return null
       return window.SpeechRecognition || window.webkitSpeechRecognition || null
@@ -1658,7 +1652,8 @@ voice._chainsPromise = null
         } else {
           rec.sileroSpeech = null
         }
-        if (rec.hadSpeech && raw > 0 && raw < 0.08) {
+        const lowT = Number(voice.settings?.lowVolumeThreshold ?? 0.08)
+        if (rec.hadSpeech && raw > 0 && raw < lowT) {
           rec.lowVolumeUntil = now + 800
           rec.hasLowVolume = true
         }
@@ -3156,6 +3151,7 @@ function cycleDictationMode() {
                 sessionCommands: !!(data && data.modes && data.modes.message && data.modes.message.sessionCommands),
                 noiseSuppression: data && data.noiseSuppression !== false,
                 noiseGateDb: Number(data && data.noiseGateDb !== undefined ? data.noiseGateDb : -45),
+                lowVolumeThreshold: Number(data && data.lowVolumeThreshold !== undefined ? data.lowVolumeThreshold : 0.08),
                 contextGlossary: data && data.contextGlossary !== false,
                 visualizerStyle: (data && data.visualizerStyle) || 'liquid-wave',
                 gatedTurnTaking: data && data.gatedTurnTaking !== false,

package/lib/host-routes.js

@@ -74,6 +74,7 @@ export function registerHostRoutes(ctx, deps) {
         localOnly: cfg.localOnly,
         micDeviceId: cfg.micDeviceId,
         noiseGateDb: cfg.noiseGateDb !== undefined ? cfg.noiseGateDb : -45,
+        lowVolumeThreshold: typeof cfg.lowVolumeThreshold === 'number' ? cfg.lowVolumeThreshold : 0.08,
         historyLimit: cfg.historyLimit,
         voiceCommands: cfg.voiceCommands,
         wakeWord: String(cfg.wakeWord || ''),

package/lib/http-util.js

@@ -102,11 +102,117 @@ export function readBody(req, maxBytes) {
 export function isLoopback(addr) {
   if (!addr) return false
   const clean = String(addr).replace(/^::ffff:/, '')
-  return clean === '127.0.0.1' || clean === '::1' || clean === 'localhost'
+  return clean === '127.0.0.1' || clean === '::1' || clean === 'localhost' || clean === '[::1]'
 }
 
 /**
- * Check whether a request originates from the same origin as the Host header (#292).
+ * Check whether an incoming HTTP request is from the DeepSeek desktop shell (#12, #295).
+ * Matches patterns from @deepseek-ai/dsh-desktop and official DSH shell wrappers.
+ * @param {import('node:http').IncomingMessage} req
+ * @returns {boolean}
+ */
+export function isDesktopShellRequest(req) {
+  if (!req || !req.headers) return false
+  const ua = String(req.headers['user-agent'] || '')
+  const cookie = String(req.headers.cookie || '')
+  if (ua.includes('@deepseek-ai/dsh-desktop/') && cookie.includes('dsh-auth-')) return true
+  const remote = req.socket?.remoteAddress || req.connection?.remoteAddress || ''
+  if (ua.includes('dsh-desktop') && isLoopback(remote)) return true
+  return false
+}
+
+/**
+ * Check whether an incoming HTTP request carries a DeepSeek Harness session cookie (#295).
+ * DSH core sets 'dsh-auth-<hash>=v1...' as a SameSite=Strict HttpOnly cookie.
+ * @param {import('node:http').IncomingMessage} req
+ * @returns {boolean}
+ */
+export function hasDshAuthCookie(req) {
+  if (!req || !req.headers) return false
+  const cookie = String(req.headers.cookie || '')
+  return cookie.includes('dsh-auth-')
+}
+
+/**
+ * Split host header or URL host into lowercase hostname and port string.
+ * @param {string} rawHost
+ * @returns {{ hostname: string, port: string }}
+ */
+function parseHost(rawHost) {
+  if (!rawHost) return { hostname: '', port: '' }
+  const clean = String(rawHost).trim().toLowerCase()
+  const ipv6Match = clean.match(/^\[([^\]]+)\](?::(\d+))?$/)
+  let hostname = ''
+  let port = ''
+  if (ipv6Match) {
+    hostname = ipv6Match[1]
+    port = ipv6Match[2] || ''
+  } else {
+    const parts = clean.split(':')
+    hostname = parts[0]
+    port = parts[1] || ''
+  }
+  if (port === '80' || port === '443') {
+    port = ''
+  }
+  return { hostname, port }
+}
+
+/**
+ * Verify whether an Origin or Referer URL is allowed for the given Host header (#12, #292, #295).
+ * @param {string} urlStr
+ * @param {string} hostHeader
+ * @param {import('node:http').IncomingMessage} req
+ * @returns {boolean}
+ */
+export function isOriginOrRefererAllowed(urlStr, hostHeader, req) {
+  if (!urlStr || typeof urlStr !== 'string') return false
+  const trimmed = urlStr.trim()
+  if (!trimmed) return false
+
+  const remote = req?.socket?.remoteAddress || req?.connection?.remoteAddress || ''
+  const remoteIsLoopback = isLoopback(remote)
+
+  // 1. Literal 'null' origin (sent by Chromium/Electron for local files or sandboxed views)
+  if (trimmed === 'null') {
+    return remoteIsLoopback && (isDesktopShellRequest(req) || hasDshAuthCookie(req))
+  }
+
+  try {
+    const u = new URL(trimmed)
+
+    // 2. Official DeepSeek desktop custom app scheme (e.g. dsh-app://app or dsh-app://localhost)
+    if (u.protocol === 'dsh-app:') {
+      const appHost = u.host.toLowerCase()
+      const allowedAppHost = !appHost || appHost === 'app' || appHost === 'localhost'
+      return allowedAppHost && remoteIsLoopback
+    }
+
+    // 3. Web schemes: HTTP and HTTPS
+    if (u.protocol === 'http:' || u.protocol === 'https:') {
+      if (!hostHeader) return false
+      const target = parseHost(hostHeader)
+      const origin = parseHost(u.host)
+
+      // Exact match
+      if (origin.hostname === target.hostname && origin.port === target.port) {
+        return true
+      }
+
+      // Loopback equivalence (e.g. localhost:3080 vs 127.0.0.1:3080 or ::1:3080)
+      if (isLoopback(origin.hostname) && isLoopback(target.hostname) && origin.port === target.port) {
+        return true
+      }
+    }
+
+    return false
+  } catch {
+    return false
+  }
+}
+
+/**
+ * Check whether a request originates from the same origin as the Host header or trusted desktop shell (#12, #292, #295).
  * @param {import('node:http').IncomingMessage} req
  * @returns {boolean}
  */
@@ -118,38 +224,33 @@ export function hasSameOrigin(req) {
   const host = String(req.headers.host || '').trim().toLowerCase()
   if (!host) return false
 
-  const origin = String(req.headers.origin || '').trim().toLowerCase()
+  const origin = String(req.headers.origin || '').trim()
   if (origin) {
-    try {
-      const u = new URL(origin)
-      return u.host.toLowerCase() === host
-    } catch {
-      return false
-    }
+    return isOriginOrRefererAllowed(origin, host, req)
   }
 
-  const referer = String(req.headers.referer || '').trim().toLowerCase()
+  const referer = String(req.headers.referer || '').trim()
   if (referer) {
-    try {
-      const u = new URL(referer)
-      return u.host.toLowerCase() === host
-    } catch {
-      return false
-    }
+    return isOriginOrRefererAllowed(referer, host, req)
   }
 
+  // Same-origin metadata from browser Fetch API
   if (secSite === 'same-origin') return true
 
+  // DeepSeek Desktop shell or authenticated DSH session on loopback/same-host
+  const remote = req.socket?.remoteAddress || req.connection?.remoteAddress || ''
+  if (isDesktopShellRequest(req)) return true
+  if (hasDshAuthCookie(req) && (isLoopback(remote) || host)) return true
+
   return false
 }
 
 /**
  * Verify that the HTTP request originates from a trusted caller.
- * Fail-closed security guard for state-changing or quota-consuming routes (#117, #173, #277, #292).
+ * Fail-closed security guard for state-changing or quota-consuming routes (#117, #173, #277, #292, #295).
  * - Routes marked loopbackOnly strictly reject non-loopback callers.
- * - Mutating requests (POST, PUT, PATCH) or WS upgrades require validated same-origin or valid session token (#292).
- *   Loopback callers without Origin/Referer through dsh-lanmode bridge are rejected without token.
- * - Non-loopback LAN requests require valid session token for mutating operations (#277).
+ * - Mutating requests (POST, PUT, PATCH) or WS upgrades require validated same-origin or valid session token (#12, #292, #295).
+ *   Raw LAN callers or reverse bridges without Origin/Referer/Cookie and without token are fail-closed rejected.
  * - Non-mutating GET requests require loopback or same-origin.
  * @param {import('node:http').IncomingMessage} req
  * @param {{ loopbackOnly?: boolean }} [options]
@@ -162,27 +263,18 @@ export function isTrustedCaller(req, options = {}) {
   const secSite = String(req.headers?.['sec-fetch-site'] || '').toLowerCase()
   if (secSite === 'cross-site' || secSite === 'same-site') return false
 
-  // 2. If Origin header is present, it must strictly match the Host header
   const host = String(req.headers?.host || '').toLowerCase()
-  const origin = String(req.headers?.origin || '').trim().toLowerCase()
+
+  // 2. If Origin header is present, verify against host or trusted desktop scheme (#12, #292, #295)
+  const origin = String(req.headers?.origin || '').trim()
   if (origin) {
-    try {
-      const u = new URL(origin)
-      if (u.host !== host) return false
-    } catch {
-      return false
-    }
+    if (!isOriginOrRefererAllowed(origin, host, req)) return false
   }
 
-  // 3. If Referer header is present, it must strictly match the Host header
-  const referer = String(req.headers?.referer || '').trim().toLowerCase()
+  // 3. If Referer header is present, verify against host or trusted desktop scheme (#12, #292, #295)
+  const referer = String(req.headers?.referer || '').trim()
   if (referer) {
-    try {
-      const u = new URL(referer)
-      if (u.host !== host) return false
-    } catch {
-      return false
-    }
+    if (!isOriginOrRefererAllowed(referer, host, req)) return false
   }
 
   // 4. For state-changing or data-carrying requests (POST/PUT/PATCH), require application/json or octet-stream
@@ -200,7 +292,7 @@ export function isTrustedCaller(req, options = {}) {
   const remote = req.socket?.remoteAddress || req.connection?.remoteAddress || ''
   const remoteIsLoopback = isLoopback(remote)
   const hostName = host.replace(/:\d+$/, '')
-  const hostIsLoopback = hostName === '127.0.0.1' || hostName === 'localhost' || hostName === '::1' || hostName === '[::1]'
+  const hostIsLoopback = isLoopback(hostName)
   const isPureLocal = remoteIsLoopback && hostIsLoopback
 
   // 5. If route strictly requires loopback (e.g. host model installer or hardware benchmark)
@@ -212,6 +304,7 @@ export function isTrustedCaller(req, options = {}) {
   // 6. Mutating requests (POST/PUT/PATCH):
   // Even from loopback (which may be proxied via dsh-lanmode bridge), requests without Origin/Referer
   // must present a valid x-dsh-voice-token (#292).
+  // Non-loopback LAN callers strictly require a valid session token to prevent forged LAN mutations (#277).
   if (isMutating) {
     const incomingToken = String(req.headers?.['x-dsh-voice-token'] || req.headers?.['x-voice-token'] || '')
     const hasValidToken = Boolean(incomingToken && verifyVoiceSessionToken(incomingToken))
@@ -221,8 +314,8 @@ export function isTrustedCaller(req, options = {}) {
       return hasValidToken
     }
 
-    // Loopback callers (or reverse bridge dsh-lanmode):
-    // If request has verified same-origin (browser UI), allow it.
+    // Loopback callers (local browser, desktop shell, or reverse bridge dsh-lanmode):
+    // If request has verified same-origin or desktop shell, allow it (#12, #295).
     if (hasSameOrigin(req)) return true
     // If request has valid session token, allow it.
     if (hasValidToken) return true
@@ -233,7 +326,7 @@ export function isTrustedCaller(req, options = {}) {
   // 7. Loopback remote address for non-mutating GET requests
   if (remoteIsLoopback) return true
 
-  // 8. Non-loopback LAN GET requests: require same-origin
+  // 8. Non-loopback LAN GET requests: require same-origin or authenticated session
   if (secSite === 'same-origin') return true
   if (hasSameOrigin(req)) return true
 

package/lib/schema.js

@@ -106,6 +106,8 @@ export const BaseConfig = z.object({
     .description('Microphone device id for recording. Empty means the system default.'),
   noiseGateDb: z.number().default(-45)
     .description('Audio noise gate threshold in dB for client-side recording (-50 to -25 dB, or <= -90 to disable). Silence below this threshold cuts ambient background noise and prevents false VAD triggers.'),
+  lowVolumeThreshold: z.number().min(0).max(1).default(0.08)
+    .description('Recording level (0..1) below which the "Low signal / speak louder" hint appears while dictating. Lower it for quiet microphones; 0 disables the hint.'),
   vadEngine: z.union(['silero', 'amplitude']).default('silero')
     .description('Voice activity detection engine: neural Silero VAD (WASM/ONNX) or classic amplitude threshold.'),
   streamingWs: z.boolean().default(true)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-voice",
-  "version": "0.9.42",
+  "version": "0.9.44",
   "description": "Voice input for DeepSeek Harness: dictation chunked by pauses and voice messages, each with its own provider fallback chain (Deepgram, Groq, HuggingFace, local whisper.cpp, plus any OpenAI-compatible API of your own).",
   "license": "MIT",
   "type": "module",