@olares/lares-core 0.15.24 → 0.15.26

package/voice/gpu-mode.js

@@ -1,3 +1,5 @@
+import { readFile } from "node:fs/promises";
+import https from "node:https";
 import { readJsonFile, writeJsonFile } from "../tools/json-file.js";
 import { dshPluginConfigPath } from "../workspace/home.js";
 import { VoiceError } from "../router/stt.js";
@@ -119,18 +121,41 @@ function speechDevice(nodes) {
     ?? null;
 }
 
+let seenGpu = undefined;
+
+/** Last card `speechGpu` observed. `undefined` means it has not been asked yet. */
+export function noteSpeechGpu(gpu) {
+  seenGpu = gpu ?? null;
+}
+
 /**
- * The NVIDIA card the speech models are bound to.
- * @returns {Promise<{ node: string, device: string, model: string, type: string, memory: number, available: string[], bindings: { app: string, memory: number }[] } | null>}
+ * Read-while-writing only while the saved mode asks for it and the card is
+ * memory-sliced. Time slicing cannot keep the language model and speech model
+ * resident together, so a saved streaming flag does not override that.
  */
-export async function speechGpu(options = {}) {
-  const result = await runOlaresCli(["settings", "compute", "list", "-o", "json"], options.spawnFn);
-  if (result.code !== 0 || !Array.isArray(result.json)) {
-    throw new GpuError(cliProblem(result, "voice_gpu_failed"));
+export function streamingEnabled() {
+  return readConfig().streaming === true && seenGpu?.type === "MemorySlice";
+}
+
+/** What the reading-mode control needs, without listing every GPU app. */
+export async function readingModePayload(options = {}) {
+  let gpu = null;
+  let problem = null;
+  try {
+    gpu = await speechGpu(options);
+  } catch (err) {
+    problem = problemOf(err);
   }
-  const device = speechDevice(result.json);
-  if (!device) return null;
   return {
+    streaming: readConfig().streaming === true,
+    allowed: gpu?.type === "MemorySlice",
+    gpu: gpu ? { type: gpu.type, model: gpu.model } : null,
+    problem,
+  };
+}
+
+function gpuFromDevice(device) {
+  const gpu = {
     node: String(device.nodeName ?? ""),
     device: String(device.id ?? ""),
     model: String(device.cardModel ?? ""),
@@ -142,6 +167,133 @@ export async function speechGpu(options = {}) {
       memory: Number(binding?.memory) || 0,
     })).filter((binding) => binding.app),
   };
+  noteSpeechGpu(gpu);
+  return gpu;
+}
+
+const SHARE_MODE_PREFIX = "sharemode.gpu.bytetrade.io/";
+const NVIDIA_REGISTER = "hami.io/node-nvidia-register";
+
+/**
+ * Node annotation `sharemode.gpu.bytetrade.io/<uuid>` uses the platform's
+ * legacy codes: 0 exclusive, 1 memory slice, anything else time slice.
+ */
+export function supportTypeFromShareMode(mode) {
+  if (mode === "0") return "Exclusive";
+  if (mode === "1") return "MemorySlice";
+  return "TimeSlice";
+}
+
+/**
+ * The card the speech models use, from the node's share-mode annotation and
+ * the GPUBinding objects. Memory in those objects is MiB.
+ * @returns {ReturnType<typeof gpuFromDevice> | null}
+ */
+export function gpuFromClusterState(nodeList, bindingList) {
+  const nodes = Array.isArray(nodeList?.items) ? nodeList.items : [];
+  const bindings = Array.isArray(bindingList?.items) ? bindingList.items : [];
+  const speechApps = new Set(Object.values(VOICE_CHARTS).map((chart) => chart.app));
+  const cards = [];
+  for (const node of nodes) {
+    const annotations = node?.metadata?.annotations ?? {};
+    const register = String(annotations[NVIDIA_REGISTER] ?? "");
+    const rows = register.split(":").map((row) => row.split(",")).filter((fields) => fields[0]);
+    for (const [key, value] of Object.entries(annotations)) {
+      if (!key.startsWith(SHARE_MODE_PREFIX)) continue;
+      const device = key.slice(SHARE_MODE_PREFIX.length);
+      if (!device) continue;
+      const card = rows.find((fields) => fields[0] === device);
+      const bound = bindings.filter((item) => item?.spec?.uuid === device);
+      cards.push({
+        node: String(node?.metadata?.name ?? ""),
+        device,
+        model: card?.[4] ? String(card[4]) : "",
+        type: supportTypeFromShareMode(String(value ?? "").trim()),
+        memory: card ? (Number(card[2]) || 0) * MIB : 0,
+        available: ["TimeSlice", "MemorySlice", "Exclusive"],
+        bindings: bound.map((item) => ({
+          app: String(item?.spec?.appName ?? ""),
+          memory: (Number(item?.spec?.memory) || 0) * MIB,
+        })).filter((binding) => binding.app),
+      });
+    }
+  }
+  const chosen = cards.find((card) => card.bindings.some((binding) => speechApps.has(binding.app))) ?? cards[0] ?? null;
+  if (!chosen) return null;
+  noteSpeechGpu(chosen);
+  return chosen;
+}
+
+function kubeGet(path) {
+  return new Promise((resolve, reject) => {
+    Promise.all([
+      readFile("/var/run/secrets/kubernetes.io/serviceaccount/token", "utf8"),
+      readFile("/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"),
+    ]).then(([token, ca]) => {
+      const req = https.request({
+        hostname: "kubernetes.default.svc",
+        path,
+        method: "GET",
+        ca,
+        headers: { Authorization: `Bearer ${token.trim()}` },
+        timeout: 8000,
+      }, (res) => {
+        let body = "";
+        res.setEncoding("utf8");
+        res.on("data", (chunk) => { body += chunk; });
+        res.on("end", () => {
+          if (res.statusCode !== 200) {
+            reject(new Error(`kubernetes ${path} returned ${res.statusCode}`));
+            return;
+          }
+          try {
+            resolve(JSON.parse(body));
+          } catch (err) {
+            reject(err);
+          }
+        });
+      });
+      req.on("error", reject);
+      req.on("timeout", () => req.destroy(new Error("kubernetes API timed out")));
+      req.end();
+    }).catch(reject);
+  });
+}
+
+async function speechGpuFromCluster(options) {
+  const get = options.kubeGet ?? kubeGet;
+  const [nodes, bindings] = await Promise.all([
+    get("/api/v1/nodes"),
+    get("/apis/gpu.bytetrade.io/v1alpha1/gpubindings"),
+  ]);
+  return gpuFromClusterState(nodes, bindings);
+}
+
+/**
+ * The NVIDIA card the speech models are bound to.
+ * The pod CLI profile is the first source. When that profile is not mounted,
+ * the node's share-mode annotation is the same fact the settings page shows.
+ * @returns {Promise<{ node: string, device: string, model: string, type: string, memory: number, available: string[], bindings: { app: string, memory: number }[] } | null>}
+ */
+export async function speechGpu(options = {}) {
+  const result = await runOlaresCli(["settings", "compute", "list", "-o", "json"], options.spawnFn);
+  if (result.code === 0 && Array.isArray(result.json)) {
+    const device = speechDevice(result.json);
+    if (!device) {
+      noteSpeechGpu(null);
+      return null;
+    }
+    return gpuFromDevice(device);
+  }
+  const problem = cliProblem(result, "voice_gpu_failed");
+  if (problem.code === "voice_gpu_login") {
+    try {
+      return await speechGpuFromCluster(options);
+    } catch {
+      /* The annotation is unreadable; the CLI failure is what we can report. */
+    }
+  }
+  throw new GpuError(problem);
 }
 
 /**

package/voice/host-service.js

@@ -1,6 +1,6 @@
 import { createVoiceAgentSession } from "./agent-session.js";
 import { createVoiceRecords } from "./records.js";
-import { createVoiceDialogue, cleanDictation } from "./dialogue.js";
+import { createVoiceDialogue, cleanDictation, voiceChat } from "./dialogue.js";
 import { readConfig, validateConfigPatch } from "./config.js";
 import { listModels } from "../router/stt.js";
 import { validatedRealtimeModels } from "./realtime.js";
@@ -24,12 +24,21 @@ export function createVoiceHostService(api, { env = process.env, metric = () =>
     records.clear(ownerOf(scope), before);
     records.bind(ownerOf(scope), scope.contextId, keyOf(scope));
   };
+  // Router groups a keyed Realtime session's child requests by its session id (Router ADR-83).
+  const chatFor = (scope) => (request) => (chat || voiceChat)({ ...request, ...(scope.routerSessionId ? { headers: { ...request.headers, "x-session-id": scope.routerSessionId } } : {}) });
+  const summarize = (scope) => {
+    const key = keyOf(scope);
+    const checkpointVersion = records.read(ownerOf(scope), key).version;
+    scope.summaryTask = Promise.resolve(scope.summaryTask).catch(() => {}).then(() => scope.dialogue.summarize()).then((summary) => records.checkpoint(ownerOf(scope), key, summary, checkpointVersion)).catch((cause) => {
+      scope.summaryError = cause.code || cause.message || "voice_summary_failed";
+    });
+  };
   const scopes = new Set();
   const service = {
     async clean(scope, text, options = {}) {
       if (typeof text !== "string" || text.length > 16000) throw failure("voice_input_invalid", 400);
       if (options.config && Object.keys(options.config).some((key) => key !== "dictationProfiles")) throw failure("voice_config_invalid", 400);
-      return cleanDictation(text, { config: { ...config(), ...validateConfigPatch(options.config || {}) }, owner: scope.owner, chat, preset: options.preset, signal: options.signal });
+      return cleanDictation(text, { config: { ...config(), ...validateConfigPatch(options.config || {}) }, owner: scope.owner, chat: chatFor(scope), preset: options.preset, signal: options.signal });
     },
     async open(scope, body) {
       if (scope.active || scope.opening || scope.closing) throw failure("voice_session_active", 409);
@@ -69,7 +78,7 @@ export function createVoiceHostService(api, { env = process.env, metric = () =>
       scope.active = true; scope.readAloud = body.readAloud === true;
       scope.voiceState = { version: 0, running: false, utterance: null, error: null };
       scope.voiceRequests = new Map(); scope.deliveredTasks = new Set(restoredRequests.map((item) => item.requestId));
-      scope.dialogue = preset === "direct" ? null : createVoiceDialogue({ config: scope.voiceConfig, owner: scope.owner, context: history.summary?.recent || [], summary: history.summary?.text || "", chat,
+      scope.dialogue = preset === "direct" ? null : createVoiceDialogue({ config: scope.voiceConfig, owner: scope.owner, context: history.summary?.recent || [], summary: history.summary?.text || "", chat: chatFor(scope),
         submit: async (text, requestId, operation) => {
           if (operation === "status") return scope.session.snapshot();
           const id = `${requestId}:delegate`;
@@ -122,11 +131,7 @@ export function createVoiceHostService(api, { env = process.env, metric = () =>
           });
           const source = records.read(ownerOf(scope), keyOf(scope)).records.find((row) => row.id === `${scope.id}:${body.requestId}:user`);
           append(scope, "assistant", text, body.requestId, source?.taskId || null);
-          const key = keyOf(scope);
-          const checkpointVersion = records.read(ownerOf(scope), key).version;
-          scope.summaryTask = scope.dialogue.summarize().then((summary) => records.checkpoint(ownerOf(scope), key, summary, checkpointVersion)).catch((cause) => {
-            scope.summaryError = cause.code || cause.message || "voice_summary_failed";
-          });
+          summarize(scope);
           scope.voiceState.utterance = { key: body.requestId, turn: scope.voiceState.version, step: 0, text, done: true, silent: false };
         } catch (cause) {
           scope.voiceState.error = cause.code || cause.message || "voice_failed";
@@ -204,6 +209,33 @@ export function createVoiceHostService(api, { env = process.env, metric = () =>
     output(scope, value) { if (typeof value !== "boolean") throw failure("voice_output_invalid", 400); scope.readAloud = value; },
     resume: (scope) => scope.session?.resume(),
     cancel: (scope) => scope.session?.cancel(),
+    instructions(scope, text) {
+      if (!scope.dialogue || scope.voiceConfig?.preset !== "chat") throw failure("voice_instructions_unsupported", 400);
+      scope.dialogue.setInstructions(text);
+    },
+    /**
+     * Keeps only the heard part of a spoken reply in records and dialogue context.
+     * Agent output lives in the dsh log and is not rewritten there.
+     */
+    truncate(scope, utteranceKey, text) {
+      const key = String(utteranceKey || "");
+      const turnId = key.startsWith("task:") ? `result:${key.slice(5)}` : key;
+      const row = records.read(ownerOf(scope), keyOf(scope)).records.find((item) => item.id === `${scope.id}:${turnId}:assistant`);
+      if (!row || row.text === text) return false;
+      append(scope, "assistant", text, turnId, row.taskId, { status: "truncated", ...(Number.isInteger(row.taskTurn) ? { taskTurn: row.taskTurn } : {}) });
+      if (!key.startsWith("task:") && scope.dialogue?.replaceLastAssistant(text)) summarize(scope);
+      return true;
+    },
+    async withdraw(scope, requestId) {
+      if (!scope.session) return "not_cancellable";
+      // A delegated assistant task is submitted under its turn id plus ":delegate".
+      const ids = [requestId, `${requestId}:delegate`];
+      for (const id of ids) {
+        const result = await scope.session.withdraw(id);
+        if (result !== "not_cancellable") return result;
+      }
+      return "not_cancellable";
+    },
     async close(scope) {
       scope.epoch = (scope.epoch || 0) + 1; scope.opening = false; scope.closing = true;
       scope.active = false; scope.voiceAbort?.abort(); scope.realtimeSocket?.close();

package/voice/internal-upgrade.js

@@ -0,0 +1,20 @@
+/**
+ * The voice host publishes its Bearer-key upgrade here so the internal entrance listener
+ * (port 8081, `webhook-internal`) can serve `lares-realtime-v1` to Router without a direct
+ * Service route, which the per-user namespace's NetworkPolicy refuses.
+ */
+let handler = null;
+
+export function publishRealtimeUpgrade(next) {
+  handler = next;
+  return () => { if (handler === next) handler = null; };
+}
+
+export function internalRealtimeUpgrade(req, socket, head) {
+  const path = new URL(req.url ?? "/", "http://lares").pathname;
+  if (path !== "/api/lares/voice/realtime" || !req.headers.authorization || !handler) {
+    socket.end("HTTP/1.1 404 Not Found\r\nConnection: close\r\n\r\n");
+    return;
+  }
+  handler(req, socket, head);
+}

package/voice/key-models.js

@@ -0,0 +1 @@
+export const VOICE_KEY_MODELS = Object.freeze(["voice-dictation", "voice-chat", "voice-assistant", "voice-direct"]);

package/voice/keys-client.js

@@ -0,0 +1,30 @@
+import { VOICE_KEY_MODELS } from "./key-models.js";
+
+export { VOICE_KEY_MODELS };
+/** Agent-driving models act as the Lares owner; a new key leaves them out unless chosen. */
+export const VOICE_KEY_AGENT_MODELS = Object.freeze(["voice-assistant", "voice-direct"]);
+export const VOICE_KEY_DEFAULT_MODELS = Object.freeze(VOICE_KEY_MODELS.filter((model) => !VOICE_KEY_AGENT_MODELS.includes(model)));
+const PATH = "/api/lares/voice/keys";
+
+/** Browser request port with the `{ ok, status, body }` shape the mobile host request uses. */
+export async function fetchVoiceRequest(path, { method = "GET", body } = {}) {
+  const res = await fetch(path, { method, ...(body === undefined ? {} : { headers: { "content-type": "application/json" }, body: JSON.stringify(body) }) });
+  let payload = null;
+  try { payload = await res.json(); } catch { payload = null; }
+  return { ok: res.ok, status: res.status, body: payload };
+}
+
+const value = (res) => {
+  if (res?.ok) return res.body;
+  throw new Error(res?.body?.error?.code || "voice_key_failed");
+};
+
+/** Owner voice keys for server-side Realtime callers (docs/realtime-protocol.md). */
+export function createVoiceKeysClient(request = fetchVoiceRequest) {
+  return {
+    async list() { return value(await request(PATH)).keys || []; },
+    /** The returned `key` is shown once; the Host stores only its hash. */
+    async issue({ name, models }) { return value(await request(PATH, { method: "POST", body: { name: String(name || "").trim(), models } })); },
+    async revoke(id) { return value(await request(PATH, { method: "DELETE", body: { id } })).revoked === true; },
+  };
+}

package/voice/keys.js

@@ -0,0 +1,63 @@
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { dirname, join } from "node:path";
+import { readJsonFile, writeJsonFile } from "../tools/json-file.js";
+import { dshPluginConfigPath } from "../workspace/home.js";
+import { VOICE_KEY_MODELS } from "./key-models.js";
+
+export { VOICE_KEY_MODELS };
+const KEY = /^lvk_([a-f0-9]{16})_[A-Za-z0-9_-]{43}$/;
+const LIMIT = 32;
+
+function invalid(message) {
+  throw Object.assign(new Error(message), { code: "voice_key_invalid", status: 400 });
+}
+const digest = (key) => createHash("sha256").update(key).digest();
+const view = ({ hash: _hash, ...record }) => record;
+const optional = (value, name) => {
+  if (value == null || value === "") return null;
+  if (typeof value !== "string" || value.length > 256 || /[\u0000-\u001f\u007f]/.test(value)) invalid(`invalid ${name}`);
+  return value;
+};
+
+/**
+ * Owner-issued credentials for server-side Realtime callers such as Router.
+ * Only hashes are stored; the file is re-read on every check so revocation needs no restart.
+ */
+export function createVoiceKeyStore({ path = join(dirname(dshPluginConfigPath("voice-input")), "keys.json"), now = Date.now } = {}) {
+  const read = () => {
+    const stored = readJsonFile(path);
+    return Array.isArray(stored?.keys) ? stored.keys : [];
+  };
+  return {
+    list: () => read().map(view),
+    issue(body = {}) {
+      const name = typeof body.name === "string" ? body.name.trim() : "";
+      if (!name || name.length > 64 || /[\u0000-\u001f\u007f]/.test(name)) invalid("invalid key name");
+      const models = Array.isArray(body.models) ? [...new Set(body.models)] : [];
+      if (!models.length || models.some((model) => !VOICE_KEY_MODELS.includes(model))) invalid("invalid key models");
+      const keys = read();
+      if (keys.length >= LIMIT) throw Object.assign(new Error("too many voice keys"), { code: "voice_key_limit", status: 409 });
+      const id = randomBytes(8).toString("hex");
+      const key = `lvk_${id}_${randomBytes(32).toString("base64url")}`;
+      const record = { id, name, models, sessionId: optional(body.sessionId, "sessionId"), workspaceId: optional(body.workspaceId, "workspaceId"), createdAt: new Date(now()).toISOString() };
+      writeJsonFile(path, { keys: [...keys, { ...record, hash: digest(key).toString("hex") }] });
+      return { ...record, key };
+    },
+    revoke(id) {
+      const keys = read();
+      const next = keys.filter((record) => record.id !== id);
+      if (next.length === keys.length) return false;
+      writeJsonFile(path, { keys: next });
+      return true;
+    },
+    /** @returns {null | { id: string, name: string, models: string[], sessionId: string | null, workspaceId: string | null }} */
+    verify(authorization) {
+      const key = typeof authorization === "string" && authorization.startsWith("Bearer ") ? authorization.slice(7).trim() : "";
+      const match = KEY.exec(key);
+      if (!match) return null;
+      const record = read().find((value) => value.id === match[1]);
+      if (!record || typeof record.hash !== "string" || !/^[a-f0-9]{64}$/.test(record.hash)) return null;
+      return timingSafeEqual(digest(key), Buffer.from(record.hash, "hex")) ? view(record) : null;
+    },
+  };
+}