nixamp 0.28.44 → 0.29.1

package/src/decoder-policy.ts

@@ -0,0 +1,33 @@
+/**
+ * What a decoder may open while reading one source.
+ *
+ * ffmpeg follows references inside what it reads: an .m3u8 names segments, a
+ * concat list names files, a playlist on disk can name a URL. A file in
+ * somebody's library is untrusted input, and without a list of protocols it
+ * can make this machine fetch any address it likes, on the LAN included. So
+ * a file on disk may open files and pipes and nothing else, and a link may
+ * open the network protocols a stream needs and not the local file system.
+ *
+ * Sources this does not recognise (an ingest URL, a lavfi graph) are left
+ * alone rather than broken: the list is for what comes out of a library or a
+ * pasted link, which is where untrusted references come from.
+ */
+
+/** A file in a library: itself, and the pipes the pipeline is built from. */
+export const LOCAL_PROTOCOLS = "file,pipe,fd";
+
+/** A link: the network, as streams use it, and never `file`. */
+export const REMOTE_PROTOCOLS = [
+  "http", "https", "tcp", "tls", "crypto", "data", "httpproxy",
+  "rtmp", "rtmps", "rtmpt", "rtmpts", "rtmpe", "rtmpte", "ffrtmpcrypt", "ffrtmphttp",
+].join(",");
+
+/** The `-protocol_whitelist` to put before this source's `-i`, or nothing. */
+export function protocolArgs(source: string): string[] {
+  if (source === "-" || source.startsWith("pipe:")) return ["-protocol_whitelist", LOCAL_PROTOCOLS];
+  if (/^(https?|rtmp[a-z]*):\/\//i.test(source)) return ["-protocol_whitelist", REMOTE_PROTOCOLS];
+  if (/^file:/i.test(source)) return ["-protocol_whitelist", LOCAL_PROTOCOLS];
+  // Any other scheme (two letters or more, so `C:\` is still a path).
+  if (/^[a-z][a-z0-9+.-]+:/i.test(source)) return [];
+  return ["-protocol_whitelist", LOCAL_PROTOCOLS];
+}

package/src/destinations.ts

@@ -0,0 +1,78 @@
+/**
+ * Whether a link somebody else pasted may be fetched from this machine.
+ *
+ * A member -- any nixamp.com account -- may put a link on the air on a server
+ * that is not theirs. Fetching it is a request from inside the owner's
+ * network, so a link to the router, the cloud metadata address or a service
+ * on localhost would be the member reaching things only the owner can. The
+ * owner may fetch what they like: it is their network. A member's link has to
+ * resolve to a public address, every address it resolves to, at every hop
+ * this code follows.
+ *
+ * What it cannot see: a redirect yt-dlp or ffmpeg follows on its own, and a
+ * name that resolves differently a second later. The decoder's protocol list
+ * (decoder-policy.ts) keeps those off the file system; keeping them off the
+ * LAN entirely needs the fetch to happen here, which is later work.
+ */
+import { lookup as dnsLookup } from "node:dns/promises";
+import { isIP } from "node:net";
+
+export type Lookup = (host: string) => Promise<string[]>;
+
+const defaultLookup: Lookup = async (host) =>
+  (await dnsLookup(host, { all: true, verbatim: true })).map((one) => one.address);
+
+function v4Number(address: string): number {
+  return address.split(".").reduce((sum, part) => sum * 256 + Number(part), 0);
+}
+
+function inV4(address: string, base: string, bits: number): boolean {
+  const mask = bits === 0 ? 0 : (0xffffffff << (32 - bits)) >>> 0;
+  return ((v4Number(address) & mask) >>> 0) === ((v4Number(base) & mask) >>> 0);
+}
+
+const PRIVATE_V4: Array<[string, number]> = [
+  ["0.0.0.0", 8], ["10.0.0.0", 8], ["100.64.0.0", 10], ["127.0.0.0", 8],
+  ["169.254.0.0", 16], ["172.16.0.0", 12], ["192.0.0.0", 24], ["192.0.2.0", 24],
+  ["192.168.0.0", 16], ["198.18.0.0", 15], ["198.51.100.0", 24], ["203.0.113.0", 24],
+  ["224.0.0.0", 4], ["240.0.0.0", 4],
+];
+
+/** Not somewhere on the public internet: loopback, private, link-local, reserved. */
+export function isPrivateAddress(address: string): boolean {
+  const kind = isIP(address);
+  if (kind === 4) return PRIVATE_V4.some(([base, bits]) => inV4(address, base, bits));
+  if (kind !== 6) return true;
+  const lower = address.toLowerCase();
+  const mapped = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/.exec(lower);
+  if (mapped) return isPrivateAddress(mapped[1]!);
+  if (lower === "::" || lower === "::1") return true;
+  const first = parseInt(lower.split(":")[0] || "0", 16);
+  // fc00::/7 unique local, fe80::/10 link-local, ff00::/8 multicast.
+  if ((first & 0xfe00) === 0xfc00) return true;
+  if ((first & 0xffc0) === 0xfe80) return true;
+  if ((first & 0xff00) === 0xff00) return true;
+  return false;
+}
+
+/** "" when this link may be fetched for a member, else why not. */
+export async function refusedDestination(link: string, lookup: Lookup = defaultLookup): Promise<string> {
+  let url: URL;
+  try {
+    url = new URL(link);
+  } catch {
+    return "that is not a link";
+  }
+  if (!/^(https?|rtmps?):$/i.test(url.protocol)) return "only http, https and rtmp links can be played here";
+  const host = url.hostname.replace(/^\[|\]$/g, "");
+  if (host === "" || /^localhost$/i.test(host) || /\.localhost$/i.test(host)) return "that link points at this machine";
+  let addresses: string[];
+  try {
+    addresses = isIP(host) ? [host] : await lookup(host);
+  } catch {
+    return "that link's host does not resolve";
+  }
+  if (addresses.length === 0) return "that link's host does not resolve";
+  if (addresses.some(isPrivateAddress)) return "that link points inside a private network, which only this server's owner may play";
+  return "";
+}

package/src/library.ts

@@ -23,6 +23,8 @@ import { stateDir } from "./daemon.ts";
 export interface Config {
   /** The folder the daemon serves when it is not told which. */
   library?: string;
+  /** Whether this machine is listed in the public directory; unset until chosen. */
+  publish?: boolean;
 }
 
 export function configPath(): string {
@@ -34,7 +36,10 @@ export function readConfig(): Config {
     const parsed = JSON.parse(readFileSync(configPath(), "utf8")) as unknown;
     if (typeof parsed !== "object" || parsed === null) return {};
     const record = parsed as Record<string, unknown>;
-    return { ...(typeof record["library"] === "string" ? { library: record["library"] } : {}) };
+    return {
+      ...(typeof record["library"] === "string" ? { library: record["library"] } : {}),
+      ...(typeof record["publish"] === "boolean" ? { publish: record["publish"] } : {}),
+    };
   } catch {
     return {};
   }

package/src/links.ts

@@ -156,6 +156,11 @@ export function playlistFrom(text: string, base: string): { hls: boolean; source
   return { hls: false, sources: entries.map((entry) => entry.source), image };
 }
 
+/** Asked of every address before it is fetched: "" to go ahead, else why not. */
+export type Guard = (url: string) => Promise<string>;
+
+const PLAYLIST_MAX_REDIRECTS = 5;
+
 /**
  * A pasted .m3u, read and turned into a channel's worth of entries. Fetched
  * here rather than by yt-dlp, which would take the first entry and stop, or
@@ -163,14 +168,28 @@ export function playlistFrom(text: string, base: string): { hls: boolean; source
  */
 export async function resolvePlaylist(
   url: string,
-  options: { timeoutMs?: number; fetcher?: typeof fetch } = {},
+  options: { timeoutMs?: number; fetcher?: typeof fetch; guard?: Guard } = {},
 ): Promise<ResolvedLink | { error: string }> {
   const get = options.fetcher ?? fetch;
   const abort = new AbortController();
   const timer = setTimeout(() => abort.abort(), options.timeoutMs ?? PLAYLIST_FETCH_TIMEOUT_MS);
   let text = "";
   try {
-    const answer = await get(url, { signal: abort.signal, headers: { "user-agent": "nixamp" }, redirect: "follow" });
+    // Followed here, one hop at a time, when there is a guard: a public
+    // address that redirects to the router is the router.
+    let at = url;
+    let answer: Response;
+    for (let hop = 0; ; hop += 1) {
+      if (options.guard) {
+        const refused = await options.guard(at);
+        if (refused) return { error: refused };
+      }
+      answer = await get(at, { signal: abort.signal, headers: { "user-agent": "nixamp" }, redirect: options.guard ? "manual" : "follow" });
+      const next = answer.headers.get("location");
+      if (!options.guard || answer.status < 300 || answer.status >= 400 || !next) break;
+      if (hop >= PLAYLIST_MAX_REDIRECTS) return { error: "that playlist redirects too many times" };
+      at = new URL(next, at).toString();
+    }
     if (!answer.ok) return { error: `that playlist could not be fetched (HTTP ${answer.status})` };
     text = (await answer.text()).slice(0, PLAYLIST_MAX_BYTES);
   } catch (error) {
@@ -493,10 +512,10 @@ export const RESOLVE_TIMEOUT_MS = 60_000;
 export async function resolveLink(
   ytdlp: string[] | null,
   url: string,
-  options: { cookies?: string; timeoutMs?: number; format?: string } = {},
+  options: { cookies?: string; timeoutMs?: number; format?: string; guard?: Guard } = {},
 ): Promise<ResolvedLink | { error: string }> {
   if (isDirectMedia(url)) return directLink(url);
-  if (isPlaylistLink(url)) return resolvePlaylist(url, { timeoutMs: options.timeoutMs });
+  if (isPlaylistLink(url)) return resolvePlaylist(url, { timeoutMs: options.timeoutMs, guard: options.guard });
   // Without yt-dlp, a link is taken as the media it may well be: an IPTV
   // feed has no extension and no page behind it, and ffprobe -- asked next,
   // before anything goes on the air -- tells a stream from a web page in a

package/src/live-interpreter.ts

@@ -1,213 +1 @@
-import { audioError, transientAudioError } from "./live-recovery.ts";
-import { encodeWav } from "./pcm-wav.ts";
-import type { SpeakerTranscript, SpeakerTurn } from "./speaker-turns.ts";
-export interface Caption { channel: string; at: number; until: number; text: string; language?: string; original?: string; sourceLanguage?: string; speaker?: string; voiceProfile?: "lower" | "higher" | "unknown"; }
-export interface VoiceChoice { id: string; name: string; gender: string; language: string; }
-export interface AudioWindow { samples: Float32Array; at: number; until: number; freshAt: number; }
-
-export interface Speaker { id: string; profile: string; voice: string; }
-/** Match provider labels across overlapping timestamps. A speaker absent from
- * the rolling context gets a new label; pitch alone never identifies someone. */
-export class SpeakerTracker {
-  private previous: { start: number; end: number; speaker: string }[] = [];
-  private sequence = 0;
-  readonly speakers = new Map<string, Speaker>();
-  constructor(private readonly random: () => number = Math.random) {}
-  reset(): void { this.previous = []; this.sequence = 0; this.speakers.clear(); }
-
-  reconcile(turns: SpeakerTurn[], at: number, voices: VoiceChoice[]): Map<string, Speaker> {
-    const links = new Map<string, Speaker>();
-    const used = new Set<string>();
-    const candidates: { local: string; global: string; overlap: number }[] = [];
-    const totals = new Map<string, number>();
-    for (const turn of turns) for (const old of this.previous) {
-      const overlap = Math.min(at + turn.end * 1000, old.end) - Math.max(at + turn.start * 1000, old.start);
-      if (overlap > 120) { const key = `${turn.speaker}|${old.speaker}`; totals.set(key, (totals.get(key) ?? 0) + overlap); }
-    }
-    for (const [key, overlap] of totals) { const [local, global] = key.split("|"); candidates.push({ local: local!, global: global!, overlap }); }
-    for (const one of candidates.sort((a, b) => b.overlap - a.overlap)) {
-      const speaker = this.speakers.get(one.global);
-      if (speaker && !links.has(one.local) && !used.has(one.global)) { links.set(one.local, speaker); used.add(one.global); }
-    }
-    for (const turn of turns) {
-      let speaker = links.get(turn.speaker);
-      if (!speaker) {
-        // Assign contrasting stock voices, without guessing a person's
-        // gender from pitch or a noisy, short opening phrase.
-        const taken = new Set([...this.speakers.values()].map(one => one.voice));
-        const available = voices.filter(voice => !taken.has(voice.id));
-        const pool = available.length ? available : voices;
-        const voice = pool[Math.floor(this.random() * pool.length)];
-        speaker = { id: `speaker-${++this.sequence}`, profile: turn.profile, voice: voice?.id ?? "auto" };
-        this.speakers.set(speaker.id, speaker); links.set(turn.speaker, speaker);
-      }
-    }
-    this.previous = turns.map(turn => ({ start: at + turn.start * 1000, end: at + turn.end * 1000, speaker: links.get(turn.speaker)!.id }));
-    const present = new Set(this.previous.map(turn => turn.speaker));
-    for (const key of this.speakers.keys()) if (this.speakers.size > 64 && !present.has(key)) this.speakers.delete(key);
-    return links;
-  }
-}
-
-/** Listener-local interpretation for the playing media. One request in flight and only the latest pending audio window. */
-export class Interpreter {
-  readonly tracker = new SpeakerTracker();
-  private generation = 0;
-  private pending: AudioWindow | null = null;
-  private committedUntil: number | null = null;
-  private running: number | null = null;
-  private controller: AbortController | null = null;
-  private translating: number | null = null;
-  private translationController: AbortController | null = null;
-  private recognitionFailures = 0;
-  private translationFailures = 0;
-  private translations: { lines: Caption[]; language: string; target: string; until: number }[] = [];
-  constructor(private readonly options: {
-    language: () => string; speakers: () => boolean; voices: () => VoiceChoice[];
-    channel: () => string; lines: (lines: Caption[]) => void;
-    status: (text: string) => void; failed: (message: string) => void;
-    fetcher?: typeof fetch;
-  }) {}
-
-  reset(): void {
-    this.generation++; this.controller?.abort(); this.translationController?.abort();
-    this.pending = null; this.running = null; this.translating = null;
-    this.recognitionFailures = this.translationFailures = 0;
-    this.translations = []; this.committedUntil = null; this.tracker.reset();
-  }
-  push(window: AudioWindow): void {
-    this.committedUntil ??= window.freshAt;
-    this.pending = window;
-    if (this.running === null) void this.run(this.generation);
-  }
-  private async json(path: string, init: RequestInit, signal: AbortSignal): Promise<any> {
-    const response = await (this.options.fetcher ?? fetch)(path, { ...init, signal });
-    const body = await response.json();
-    if (!response.ok) throw audioError(body.error || "Audio translation is unavailable.", response.status);
-    return body;
-  }
-  private async run(generation: number): Promise<void> {
-    this.running = generation;
-    try {
-      while (this.pending && generation === this.generation) {
-        const window = this.pending; this.pending = null;
-        try {
-          if (Date.now() - window.until > 12_000) continue;
-          const controller = new AbortController(); this.controller = controller;
-          const signal = AbortSignal.any([controller.signal, AbortSignal.timeout(12_000)]);
-          const speakers = this.options.speakers(), target = this.options.language();
-          const heard = await this.json(speakers ? "/api/v1/speech/speakers" : "/api/v1/speech/transcribe?live=1", {
-            method: "POST", headers: { "content-type": "audio/wav" }, body: new Uint8Array(encodeWav(speakers ? window.samples : window.samples.slice(-80_000))),
-          }, signal) as SpeakerTranscript & { text?: string };
-          if (generation !== this.generation) return;
-          this.recognitionFailures = 0;
-          const language = heard.language;
-          let lines: Caption[] = [];
-          if (speakers) {
-            const links = this.tracker.reconcile(heard.turns ?? [], window.at, this.options.voices());
-            // The watermark follows emitted words, not the newest capture
-            // interval: an overlapping window can recover audio that arrived
-            // while recognition/translation was busy. Keep unfinished phrases
-            // in that overlap so short capture intervals do not split every
-            // sentence (especially damaging when German changes word order).
-            const cutoff = this.committedUntil ?? window.freshAt;
-            const turns = heard.turns ?? [];
-            for (const [index, turn] of turns.entries()) {
-              const speaker = links.get(turn.speaker)!;
-              const words = turn.words.filter(word =>
-                window.at + (word.start + word.end) * 500 >= cutoff &&
-                (window.at + word.end * 1000 <= window.until - 100 || /[.!?。！？]$/.test(word.text)));
-              let phrase: typeof words = [];
-              const emit = (): void => {
-                if (!phrase.length) return;
-                lines.push({ channel: this.options.channel(), at: window.at + phrase[0]!.start * 1000,
-                  until: window.at + phrase.at(-1)!.end * 1000, text: phrase.map(word => word.text).join(" ").trim(),
-                  language, speaker: speaker.id, voiceProfile: turn.profile });
-                phrase = [];
-              };
-              for (const word of words) {
-                if (phrase.length && word.start - phrase.at(-1)!.end >= 0.45) emit();
-                phrase.push(word);
-                if (/[.!?。！？]$/.test(word.text) || phrase.map(word => word.text).join(" ").length >= 400) emit();
-              }
-              if (phrase.length && (index < turns.length - 1 ||
-                window.until - (window.at + phrase.at(-1)!.end * 1000) >= 350 ||
-                window.until - (window.at + phrase[0]!.start * 1000) >= 3000)) emit();
-            }
-          } else if (heard.text) {
-            lines = [{ channel: this.options.channel(), at: window.freshAt, until: window.until, text: heard.text, language }];
-          }
-          if (!lines.length) continue;
-          this.committedUntil = Math.max(this.committedUntil ?? window.freshAt, ...lines.map(line => line.until));
-          // Drop expired work instead of turning off an otherwise healthy stream.
-          this.translations = this.translations.filter(item => Date.now() - item.until <= 12_000).slice(-11);
-          this.translations.push({ lines, language, target, until: window.until });
-          // Recognition of the next audio window can proceed while the text
-          // model translates this phrase. Voice synthesis is a third stage.
-          if (this.translating === null) void this.translate(this.generation);
-        } catch (error) {
-          if (generation !== this.generation) return;
-          if (!transientAudioError(error) || ++this.recognitionFailures >= 3) throw error;
-          this.options.status("Speech recognition interrupted · listening for the next phrase…");
-        }
-      }
-    } catch (error) {
-      if (generation === this.generation) { const message = error instanceof Error ? error.message : "Live translation stopped."; this.reset(); this.options.failed(message); this.options.status(message); }
-    } finally { if (this.running === generation) this.running = null; }
-  }
-
-  private async translate(generation: number): Promise<void> {
-    this.translating = generation;
-    try {
-      while (this.translations.length && generation === this.generation) {
-        const item = this.translations.shift()!;
-        try {
-          let { lines } = item;
-          const { language, target, until } = item;
-          if (Date.now() - until > 12_000) continue;
-          const controller = new AbortController(); this.translationController = controller;
-          if (target && language !== target) {
-            if (!language) throw audioError("The audio language could not be detected. Waiting for clearer speech.", 502);
-            const translated = await this.json("/api/v1/translate?live=1", {
-              method: "POST", headers: { "content-type": "application/json" },
-              body: JSON.stringify({ texts: lines.map(line => line.text), from: language, to: target }),
-            }, AbortSignal.any([controller.signal, AbortSignal.timeout(12_000)])) as { texts: string[] };
-            if (translated.texts.length !== lines.length || translated.texts.some(text => !text.trim())) throw audioError("Translation omitted a phrase. Waiting for the next phrase.", 502);
-            lines = lines.map((line, i) => ({ ...line, original: line.text, sourceLanguage: language, language: target, text: translated.texts[i]! }));
-          }
-          if (generation !== this.generation) return;
-          if (Date.now() - until > 12_000) continue;
-          this.translationFailures = 0;
-          this.options.lines(lines.flatMap(line => splitCaption(line)));
-          this.options.status(target ? `${language} → ${target} · live translation` : `Original audio language: ${language || "detecting…"}`);
-        } catch (error) {
-          if (generation !== this.generation) return;
-          if (!transientAudioError(error) || ++this.translationFailures >= 3) throw error;
-          this.options.status("Translation interrupted · catching up with live speech…");
-        }
-      }
-    } catch (error) {
-      if (generation === this.generation) { const message = error instanceof Error ? error.message : "Live translation stopped."; this.reset(); this.options.failed(message); this.options.status(message); }
-    } finally { if (this.translating === generation) this.translating = null; }
-  }
-}
-
-/** Preserve all words while respecting the speech API's character limit. */
-export function splitCaption(line: Caption): Caption[] {
-  const text = line.text.trim();
-  if (!text) return [];
-  const parts: string[] = [];
-  let rest = text;
-  while (rest.length > 600) {
-    const space = rest.lastIndexOf(" ", 600);
-    const end = space > 300 ? space : 600;
-    parts.push(rest.slice(0, end)); rest = rest.slice(end).trimStart();
-  }
-  if (rest) parts.push(rest);
-  let offset = 0;
-  return parts.map(part => {
-    const at = line.at + (line.until - line.at) * offset / text.length;
-    offset += part.length + 1;
-    return { ...line, text: part, at, until: Math.min(line.until, line.at + (line.until - line.at) * offset / text.length) };
-  });
-}
+export { Interpreter, SpeakerTracker, splitCaption, type Caption, type VoiceChoice, type AudioWindow, type Speaker } from "@profullstack/live-translate/core";

package/src/live-recovery.ts

@@ -1,10 +1 @@
-/** Access, billing and throttling failures are terminal. Only transient service
- * and transport failures may recover, with a bounded consecutive failure count. */
-export function transientAudioError(error: unknown): boolean {
-  const status = (error as { status?: number } | null)?.status;
-  if (typeof status === "number") return [408, 502, 503, 504].includes(status);
-  return error instanceof TypeError || (error instanceof Error && ["AbortError", "TimeoutError"].includes(error.name));
-}
-export function audioError(message: string, status: number): Error & { status: number } {
-  return Object.assign(new Error(message), { status });
-}
+export { audioError, transientAudioError } from "@profullstack/live-translate/core";