daemora 1.0.10 → 1.0.11

package/src/tools/textToSpeech.js

@@ -15,9 +15,9 @@
 
 import { writeFileSync, mkdirSync } from "node:fs";
 import { join } from "node:path";
-import { tmpdir } from "node:os";
-
-const TMP_DIR = join(tmpdir(), "daemora-tts");
+import filesystemGuard from "../safety/FilesystemGuard.js";
+import { getTenantTmpDir } from "./_paths.js";
+import tenantContext from "../tenants/TenantContext.js";
 const OPENAI_CHAR_LIMIT = 4096;
 const ELEVENLABS_CHAR_LIMIT = 5000;
 
@@ -31,7 +31,10 @@ export async function textToSpeech(text, optionsJson) {
     const provider = opts.provider?.toLowerCase() || "openai";
 
     // Prefer ElevenLabs if key is present and provider not forced
-    if (provider === "elevenlabs" || (provider === "auto" && process.env.ELEVENLABS_API_KEY)) {
+    const _store = tenantContext.getStore();
+    const _keys = _store?.apiKeys || {};
+    const hasElevenLabs = _keys.ELEVENLABS_API_KEY || process.env.ELEVENLABS_API_KEY;
+    if (provider === "elevenlabs" || (provider === "auto" && hasElevenLabs)) {
       return await _elevenLabs(text.trim(), opts);
     }
 
@@ -44,26 +47,30 @@ export async function textToSpeech(text, optionsJson) {
 // ── OpenAI TTS ────────────────────────────────────────────────────────────────
 
 async function _openAI(text, opts) {
-  if (!process.env.OPENAI_API_KEY) {
+  const store = tenantContext.getStore();
+  const apiKeys = store?.apiKeys || {};
+  const apiKey = apiKeys.OPENAI_API_KEY || process.env.OPENAI_API_KEY;
+
+  if (!apiKey) {
     return "Error: textToSpeech requires OPENAI_API_KEY";
   }
 
   const { default: OpenAI } = await import("openai");
-  const client = new OpenAI({ apiKey: process.env.OPENAI_API_KEY });
+  const client = new OpenAI({ apiKey });
 
   const voice  = opts.voice  || "nova";    // nova = clear, neutral, works great for most use cases
   const speed  = Math.max(0.25, Math.min(4.0, parseFloat(opts.speed  || "1.0")));
   const format = opts.format || "mp3";     // mp3 | opus | aac | flac
   const model  = opts.hd === false ? "tts-1" : "tts-1-hd"; // tts-1-hd = better quality
 
-  mkdirSync(TMP_DIR, { recursive: true });
+  const ttsDir = getTenantTmpDir("daemora-tts");
 
   // Split into chunks if text exceeds API limit
   const chunks = _splitText(text, OPENAI_CHAR_LIMIT);
 
   if (chunks.length === 1) {
     const response = await client.audio.speech.create({ model, voice, input: chunks[0], speed, response_format: format });
-    const filePath = join(TMP_DIR, `speech-${Date.now()}.${format}`);
+    const filePath = join(ttsDir, `speech-${Date.now()}.${format}`);
     writeFileSync(filePath, Buffer.from(await response.arrayBuffer()));
     return `Audio saved to: ${filePath}`;
   }
@@ -72,7 +79,7 @@ async function _openAI(text, opts) {
   const paths = [];
   for (let i = 0; i < chunks.length; i++) {
     const response = await client.audio.speech.create({ model, voice, input: chunks[i], speed, response_format: format });
-    const filePath = join(TMP_DIR, `speech-${Date.now()}-part${i + 1}.${format}`);
+    const filePath = join(ttsDir, `speech-${Date.now()}-part${i + 1}.${format}`);
     writeFileSync(filePath, Buffer.from(await response.arrayBuffer()));
     paths.push(filePath);
   }
@@ -83,7 +90,9 @@ async function _openAI(text, opts) {
 // ── ElevenLabs TTS ────────────────────────────────────────────────────────────
 
 async function _elevenLabs(text, opts) {
-  const apiKey = process.env.ELEVENLABS_API_KEY;
+  const store = tenantContext.getStore();
+  const tenantKeys = store?.apiKeys || {};
+  const apiKey = tenantKeys.ELEVENLABS_API_KEY || process.env.ELEVENLABS_API_KEY;
   if (!apiKey) {
     return "Error: provider=elevenlabs requires ELEVENLABS_API_KEY";
   }
@@ -115,8 +124,8 @@ async function _elevenLabs(text, opts) {
     return `Error: ElevenLabs API returned HTTP ${res.status}${body ? `: ${body.slice(0, 200)}` : ""}`;
   }
 
-  mkdirSync(TMP_DIR, { recursive: true });
-  const filePath = join(TMP_DIR, `speech-eleven-${Date.now()}.mp3`);
+  const ttsDir = getTenantTmpDir("daemora-tts");
+  const filePath = join(ttsDir, `speech-eleven-${Date.now()}.mp3`);
   writeFileSync(filePath, Buffer.from(await res.arrayBuffer()));
   return `Audio saved to: ${filePath}`;
 }

package/src/tools/transcribeAudio.js

@@ -9,8 +9,10 @@
  */
 import { createReadStream, writeFileSync, existsSync } from "node:fs";
 import { join, extname, basename } from "node:path";
-import { tmpdir } from "node:os";
 import OpenAI from "openai";
+import filesystemGuard from "../safety/FilesystemGuard.js";
+import { getTenantTmpDir } from "./_paths.js";
+import tenantContext from "../tenants/TenantContext.js";
 
 const SUPPORTED_EXTENSIONS = new Set([
   ".mp3", ".mp4", ".mpeg", ".mpga", ".m4a", ".wav", ".webm", ".ogg", ".oga", ".flac"
@@ -23,7 +25,10 @@ export async function transcribeAudio(audioPath, prompt) {
   try {
     if (!audioPath) return "Error: audioPath is required";
 
-    if (!process.env.OPENAI_API_KEY) {
+    const _store = tenantContext.getStore();
+    const _keys = _store?.apiKeys || {};
+    const apiKey = _keys.OPENAI_API_KEY || process.env.OPENAI_API_KEY;
+    if (!apiKey) {
       return "Error: transcribeAudio requires OPENAI_API_KEY (uses OpenAI Whisper API)";
     }
 
@@ -32,7 +37,7 @@ export async function transcribeAudio(audioPath, prompt) {
     // Download if URL
     if (audioPath.startsWith("https://") || audioPath.startsWith("http://")) {
       const ext = extname(new URL(audioPath).pathname) || ".ogg";
-      const tmpPath = join(tmpdir(), `audio-${Date.now()}${ext}`);
+      const tmpPath = join(getTenantTmpDir("daemora-audio"), `audio-${Date.now()}${ext}`);
 
       const res = await fetch(audioPath, { signal: AbortSignal.timeout(30000) });
       if (!res.ok) return `Error downloading audio: HTTP ${res.status}`;
@@ -42,6 +47,12 @@ export async function transcribeAudio(audioPath, prompt) {
       localPath = tmpPath;
     }
 
+    // Guard read access for local files (not downloaded URLs — those are already in tenant workspace)
+    if (!audioPath.startsWith("http")) {
+      const rc = filesystemGuard.checkRead(localPath);
+      if (!rc.allowed) return `Error: ${rc.reason}`;
+    }
+
     if (!existsSync(localPath)) {
       return `Error: Audio file not found: ${localPath}`;
     }
@@ -56,7 +67,7 @@ export async function transcribeAudio(audioPath, prompt) {
       return `Error: Unsupported audio format: ${ext}. Supported: ${[...SUPPORTED_EXTENSIONS].join(", ")}`;
     }
 
-    const openai = new OpenAI({ apiKey: process.env.OPENAI_API_KEY });
+    const openai = new OpenAI({ apiKey });
 
     const transcription = await openai.audio.transcriptions.create({
       file: createReadStream(localPath),