shadok-ai 0.16.28 → 0.16.30

package/README.md

@@ -191,6 +191,13 @@ Enter to skip; you can add it later from the web UI).
   `SHADOK_WHISPER_MODEL` picks a bigger one if your recordings need it.
   Set `SHADOK_WHISPER_DIR` to a directory shared between containers and one copy
   serves them all.
+- **Dictate a prompt on the web** — a 🎙 button beside *Send* records your
+  microphone and transcribes it with the **same local whisper.cpp** the voice
+  notes use (nothing leaves the machine). The text drops into the composer
+  **editable**, never auto-sent, so a misheard word is fixed before it goes —
+  click to start, click to stop, a red timer runs while recording. Needs a
+  secure context (localhost or HTTPS) for the browser to grant the mic; the
+  first use pays the same one-time whisper install as the voice notes above.
 - **Videos on Telegram** — share a video (or a GIF, or a round video note) and
   the agent actually sees it: shadok pulls a handful of stills out of the clip
   for it to look at, and transcribes the sound when there is speech. Both run
@@ -242,6 +249,13 @@ Enter to skip; you can add it later from the web UI).
   otherwise just print a local path you cannot open. **Artifacts are denied**
   cockpit-wide for the same reason — a page on claude.ai is not the file you
   asked for (`SHADOK_ALLOW_ARTIFACTS=1` lifts it).
+- **Photos and videos, viewable** — an image or a **video** (mp4/webm/mov…) in
+  the chat renders inline (a video gets a real player), and clicking a photo
+  opens it full-size in a lightbox. The 🖼 button in an agent's bar opens a
+  **media gallery**: a grid of every photo and video in that conversation —
+  click a thumbnail to view or play it full-size, then back to the grid. Videos
+  are served with HTTP range requests so they seek and stream instead of
+  downloading whole.
 - **Compaction summaries, folded away** — when Claude Code runs out of context
   it compacts the conversation and writes a long "This session is being
   continued…" summary as the first message of what follows. Shown in full it

package/dist/download.d.ts

@@ -2,6 +2,8 @@
 export declare const SEND_FILE_TOOL = "SendUserFile";
 /** Would the web render this inline as an <img>? */
 export declare function isImageFile(name: string): boolean;
+/** Would the web render this inline as a <video>? */
+export declare function isVideoFile(name: string): boolean;
 /** Should Telegram send this as a photo (inline) rather than a document? */
 export declare function telegramPhotoable(name: string): boolean;
 /** Best-effort Content-Type for GET /download. `image/svg+xml` is served with a
@@ -13,8 +15,24 @@ export interface FileCard {
     path: string;
     name: string;
     image: boolean;
+    video: boolean;
 }
 export declare function fileCard(p: string): FileCard;
+/**
+ * Pure: parse an HTTP `Range` header against a known file size, for the single
+ * `bytes=start-end` form a <video> issues (browsers never send multipart ranges
+ * to a plain file server, so one range is all we honour).
+ *
+ * Returns the inclusive byte slice, `null` when there is no range to honour (no
+ * header, a non-bytes unit, a syntactically broken value → serve the whole file,
+ * a 200), or `"unsatisfiable"` when the range is well-formed but out of bounds
+ * (→ the caller answers 416). `bytes=N-` is "from N to the end"; `bytes=-N` is
+ * "the last N bytes".
+ */
+export declare function parseByteRange(header: string | undefined, size: number): {
+    start: number;
+    end: number;
+} | null | "unsatisfiable";
 /** The `files` a SendUserFile tool_use delivered — its `input.files`, kept only
  *  when they are real string paths. Any other tool → none. */
 export declare function toolFiles(name: unknown, input: unknown): string[];

package/dist/download.js

@@ -9,6 +9,10 @@ import path from "node:path";
 /** The tool that delivers a file to the user. */
 export const SEND_FILE_TOOL = "SendUserFile";
 const IMAGE_EXT = new Set([".png", ".jpg", ".jpeg", ".gif", ".webp", ".svg", ".avif", ".bmp", ".ico"]);
+// What the web renders inline as a <video>. Kept to the formats a browser can
+// actually play (mp4/webm/ogg, plus mov which Safari plays and Chrome often
+// does too); an unplayable container still downloads via the octet-stream path.
+const VIDEO_EXT = new Set([".mp4", ".m4v", ".webm", ".ogv", ".mov"]);
 // What Telegram will accept as a PHOTO (inline preview). Narrower than the web's
 // <img>: svg/gif/bmp/ico are not photos there, so they go as documents.
 const TG_PHOTO_EXT = new Set([".png", ".jpg", ".jpeg", ".webp"]);
@@ -18,12 +22,18 @@ const CONTENT_TYPE = {
     ".ico": "image/x-icon", ".pdf": "application/pdf", ".html": "text/html", ".htm": "text/html",
     ".css": "text/css", ".js": "text/javascript", ".json": "application/json", ".csv": "text/csv",
     ".txt": "text/plain", ".md": "text/markdown", ".xml": "application/xml", ".zip": "application/zip",
+    ".mp4": "video/mp4", ".m4v": "video/mp4", ".webm": "video/webm", ".ogv": "video/ogg",
+    ".mov": "video/quicktime",
 };
 const ext = (name) => path.extname(String(name || "")).toLowerCase();
 /** Would the web render this inline as an <img>? */
 export function isImageFile(name) {
     return IMAGE_EXT.has(ext(name));
 }
+/** Would the web render this inline as a <video>? */
+export function isVideoFile(name) {
+    return VIDEO_EXT.has(ext(name));
+}
 /** Should Telegram send this as a photo (inline) rather than a document? */
 export function telegramPhotoable(name) {
     return TG_PHOTO_EXT.has(ext(name));
@@ -35,7 +45,44 @@ export function contentTypeFor(name) {
 }
 export function fileCard(p) {
     const name = path.basename(String(p || ""));
-    return { path: String(p || ""), name, image: isImageFile(name) };
+    return { path: String(p || ""), name, image: isImageFile(name), video: isVideoFile(name) };
+}
+/**
+ * Pure: parse an HTTP `Range` header against a known file size, for the single
+ * `bytes=start-end` form a <video> issues (browsers never send multipart ranges
+ * to a plain file server, so one range is all we honour).
+ *
+ * Returns the inclusive byte slice, `null` when there is no range to honour (no
+ * header, a non-bytes unit, a syntactically broken value → serve the whole file,
+ * a 200), or `"unsatisfiable"` when the range is well-formed but out of bounds
+ * (→ the caller answers 416). `bytes=N-` is "from N to the end"; `bytes=-N` is
+ * "the last N bytes".
+ */
+export function parseByteRange(header, size) {
+    if (!header || size <= 0)
+        return null;
+    const m = /^bytes=(\d*)-(\d*)$/.exec(header.trim());
+    if (!m)
+        return null;
+    const [, rawStart, rawEnd] = m;
+    if (rawStart === "" && rawEnd === "")
+        return null;
+    let start, end;
+    if (rawStart === "") {
+        // Suffix: the last N bytes. N === 0 is unsatisfiable (no "last zero bytes").
+        const n = Number(rawEnd);
+        if (n === 0)
+            return "unsatisfiable";
+        start = Math.max(0, size - n);
+        end = size - 1;
+    }
+    else {
+        start = Number(rawStart);
+        end = rawEnd === "" ? size - 1 : Math.min(Number(rawEnd), size - 1);
+    }
+    if (start > end || start >= size)
+        return "unsatisfiable";
+    return { start, end };
 }
 /** The `files` a SendUserFile tool_use delivered — its `input.files`, kept only
  *  when they are real string paths. Any other tool → none. */

package/dist/download.js.map

@@ -1 +1 @@
-{"version":3,"file":"download.js","sourceRoot":"","sources":["../src/download.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,gFAAgF;AAChF,uEAAuE;AACvE,gFAAgF;AAChF,kFAAkF;AAClF,EAAE;AACF,iFAAiF;AAEjF,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,iDAAiD;AACjD,MAAM,CAAC,MAAM,cAAc,GAAG,cAAc,CAAC;AAE7C,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AACvG,iFAAiF;AACjF,wEAAwE;AACxE,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAEjE,MAAM,YAAY,GAA2B;IAC3C,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW;IACrF,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW;IAC1F,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW;IAC5F,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,UAAU;IAC7F,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,iBAAiB;CACnG,CAAC;AAEF,MAAM,GAAG,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AAErF,oDAAoD;AACpD,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,OAAO,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAClC,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AACrC,CAAC;AAED;qEACqE;AACrE,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,0BAA0B,CAAC;AAC/D,CAAC;AAUD,MAAM,UAAU,QAAQ,CAAC,CAAS;IAChC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;AACnE,CAAC;AAED;8DAC8D;AAC9D,MAAM,UAAU,SAAS,CAAC,IAAa,EAAE,KAAc;IACrD,IAAI,IAAI,KAAK,cAAc,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IAC9E,MAAM,KAAK,GAAI,KAA6B,CAAC,KAAK,CAAC;IACnD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,UAAkB;IAC9C,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,UAAU;QAAE,OAAO,GAAG,CAAC;IAC9D,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC;YAAE,SAAS;QAC7D,IAAI,CAAM,CAAC;QACX,IAAI,CAAC;YAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,SAAS;QAAC,CAAC;QACjD,MAAM,OAAO,GAAG,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC;QACpC,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,IAAI,CAAC,EAAE,IAAI,KAAK,UAAU;oBAAE,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC;wBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,EAAE,aAAa,EAAE,WAAW,CAAC;QAC3C,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,KAAK,MAAM,CAAC,IAAI,IAAI;gBAAE,IAAI,OAAO,CAAC,EAAE,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI;oBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"download.js","sourceRoot":"","sources":["../src/download.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,gFAAgF;AAChF,uEAAuE;AACvE,gFAAgF;AAChF,kFAAkF;AAClF,EAAE;AACF,iFAAiF;AAEjF,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,iDAAiD;AACjD,MAAM,CAAC,MAAM,cAAc,GAAG,cAAc,CAAC;AAE7C,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AACvG,8EAA8E;AAC9E,4EAA4E;AAC5E,gFAAgF;AAChF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AACrE,iFAAiF;AACjF,wEAAwE;AACxE,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAEjE,MAAM,YAAY,GAA2B;IAC3C,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW;IACrF,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW;IAC1F,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW;IAC5F,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,UAAU;IAC7F,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,iBAAiB;IAClG,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW;IACpF,MAAM,EAAE,iBAAiB;CAC1B,CAAC;AAEF,MAAM,GAAG,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AAErF,oDAAoD;AACpD,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,OAAO,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAClC,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,OAAO,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAClC,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AACrC,CAAC;AAED;qEACqE;AACrE,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,0BAA0B,CAAC;AAC/D,CAAC;AAWD,MAAM,UAAU,QAAQ,CAAC,CAAS;IAChC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;AAC7F,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,cAAc,CAC5B,MAA0B,EAC1B,IAAY;IAEZ,IAAI,CAAC,MAAM,IAAI,IAAI,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,CAAC,GAAG,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACpD,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,QAAQ,KAAK,EAAE,IAAI,MAAM,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,KAAa,EAAE,GAAW,CAAC;IAC/B,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QACpB,6EAA6E;QAC7E,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QACzB,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,eAAe,CAAC;QACpC,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC;QAC9B,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC;IACjB,CAAC;SAAM,CAAC;QACN,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;QACzB,GAAG,GAAG,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,KAAK,GAAG,GAAG,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,eAAe,CAAC;IACzD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AACxB,CAAC;AAED;8DAC8D;AAC9D,MAAM,UAAU,SAAS,CAAC,IAAa,EAAE,KAAc;IACrD,IAAI,IAAI,KAAK,cAAc,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IAC9E,MAAM,KAAK,GAAI,KAA6B,CAAC,KAAK,CAAC;IACnD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,UAAkB;IAC9C,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,UAAU;QAAE,OAAO,GAAG,CAAC;IAC9D,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC;YAAE,SAAS;QAC7D,IAAI,CAAM,CAAC;QACX,IAAI,CAAC;YAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,SAAS;QAAC,CAAC;QACjD,MAAM,OAAO,GAAG,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC;QACpC,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,IAAI,CAAC,EAAE,IAAI,KAAK,UAAU;oBAAE,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC;wBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,EAAE,aAAa,EAAE,WAAW,CAAC;QAC3C,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,KAAK,MAAM,CAAC,IAAI,IAAI;gBAAE,IAAI,OAAO,CAAC,EAAE,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI;oBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/server.js

@@ -11,7 +11,7 @@ import { fileURLToPath } from "node:url";
 import express from "express";
 import { WebSocketServer, WebSocket } from "ws";
 import { detectDialog, dialogKey, isResumeSummaryDialog, findSessionId, lastPromptAt, listSessions, loadHistory, resumedTurnStart, transcriptFilePath, } from "./extract.js";
-import { fileCard, sentFilePaths, contentTypeFor, isImageFile } from "./download.js";
+import { fileCard, sentFilePaths, contentTypeFor, isImageFile, isVideoFile, parseByteRange } from "./download.js";
 import { OFFER_TOOL, filesFileFor, loadOffers, saveOffers, offerVerdict, withOffer, offeredPaths, refusalMessage, statForOffer, } from "./files.js";
 // Same implementation as the web client's preview (plain JS, loaded as is by
 // the browser): one source for reading the in-flight text off the screen.
@@ -39,6 +39,7 @@ import { getUsage } from "./usage.js";
 import { loadChannels, loadGroups, saveGroups, upsertChannel, removeChannel, mergeClientChannels, channelWriteAllowed, profilePatch, loadTgGroup, saveTgGroup, isHomeChannel, homeAdoptionTarget, resolveSessionTarget, resolveResumeId, resumeTarget, } from "./channels.js";
 import { deliverWithRetry } from "./reload.js";
 import { startTelegram, renameTelegramTopic, closeTelegramTopic, probeToken, isStalePreface, announceLoggedOut, resetLoggedOutNotice, attachmentPrompt, pasteFileName, MEDIA_DIR, } from "./telegram.js";
+import { transcribe, audioClipExtension } from "./whisper.js";
 import { cancelPairingCode, issuePairingCode, pairingStatus } from "./tg-pairing.js";
 import { migrateTgBindings } from "./channels.js";
 import { instanceKey } from "./paths.js";
@@ -1267,6 +1268,50 @@ app.post("/paste", express.raw({ type: () => true, limit: PASTE_LIMIT }), (req,
         res.status(500).json({ error: e instanceof Error ? e.message : String(e) });
     }
 });
+/**
+ * Speech-to-text for the composer's microphone button. The browser records a
+ * short clip (MediaRecorder → webm/opus) and POSTs the raw bytes here; we run
+ * the SAME local whisper.cpp pipeline the Telegram voice path uses
+ * (`transcribe`) and return the text for the client to drop into the composer.
+ *
+ * The text is NEVER auto-sent — it lands in the editable composer so the user
+ * reads it before acting, because a misheard instruction acted on in silence is
+ * worse than a voice note that was ignored (the reason `heardNotice` exists).
+ *
+ * `requestFromBrowser` like `/paste`: this writes a file and records the mic, a
+ * browser-only capability with no business being reachable by a script on
+ * loopback. The clip is TRANSIENT — written to the OS temp dir and removed in
+ * `finally`, never kept in `MEDIA_DIR`: it is spoken input, not a file to hand
+ * the agent.
+ *
+ * The first call on a fresh instance provisions whisper (ffmpeg / model / build
+ * via `ensureWhisper` inside `transcribe`), which can take minutes; the client
+ * shows a working state and we simply wait. The French whisper notices are kept
+ * server-side — the client maps `kind` to its own English UI copy, so the web
+ * stays English while Telegram keeps its spoken-language notices.
+ */
+app.post("/transcribe", express.raw({ type: () => true, limit: PASTE_LIMIT }), async (req, res) => {
+    if (!requestFromBrowser(req))
+        return res.status(403).json({ error: "same-origin browser only" });
+    const body = req.body;
+    if (!Buffer.isBuffer(body) || !body.length)
+        return res.status(400).json({ error: "empty body" });
+    const ext = audioClipExtension(String(req.headers["content-type"] ?? ""));
+    const tmp = path.join(os.tmpdir(), `shadok-stt-${randomUUID()}.${ext}`);
+    try {
+        await fs.promises.writeFile(tmp, body);
+        const out = await transcribe(tmp);
+        if (out.ok)
+            return res.json({ ok: true, text: out.text });
+        return res.json({ ok: false, kind: out.kind });
+    }
+    catch (e) {
+        return res.status(500).json({ ok: false, error: e instanceof Error ? e.message : String(e) });
+    }
+    finally {
+        await fs.promises.rm(tmp, { force: true }).catch(() => { });
+    }
+});
 app.use(express.static(path.join(__dirname, "..", "public")));
 // Markdown parser served locally (history rendering on the client).
 // Resolved through require.resolve, not a hardcoded path: in the npm install
@@ -3030,6 +3075,38 @@ function historyWithOffers(turns, sessionId) {
         out.push(fileTurns[oi++]);
     return out;
 }
+// Stream a vetted file back to the browser, honouring a single `Range` so a
+// <video> can seek and so Safari plays one at all (it demands a 206 before it
+// will start). Images/PDF/etc. get the same path — Range is harmless there and
+// helps a resumed download. A raster image or a video is served `inline` (the
+// chat's <img>/<video> renders it, and opening the URL shows it); everything
+// else — including SVG/HTML — downloads, under the same nosniff + sandbox CSP.
+function serveStaticFile(req, res, filePath, stat, name) {
+    const ct = contentTypeFor(name);
+    const inline = (isImageFile(name) && ct !== "image/svg+xml") || isVideoFile(name);
+    res.setHeader("Content-Type", ct);
+    res.setHeader("X-Content-Type-Options", "nosniff");
+    res.setHeader("Content-Security-Policy", "sandbox; default-src 'none'");
+    res.setHeader("Content-Disposition", `${inline ? "inline" : "attachment"}; filename="${name.replace(/["\\]/g, "_")}"`);
+    res.setHeader("Accept-Ranges", "bytes");
+    const range = parseByteRange(req.headers.range, stat.size);
+    if (range === "unsatisfiable") {
+        res.setHeader("Content-Range", `bytes */${stat.size}`);
+        res.status(416).end();
+        return;
+    }
+    const onErr = () => { if (!res.headersSent)
+        res.status(500); res.end(); };
+    if (range) {
+        res.status(206);
+        res.setHeader("Content-Range", `bytes ${range.start}-${range.end}/${stat.size}`);
+        res.setHeader("Content-Length", String(range.end - range.start + 1));
+        fs.createReadStream(filePath, { start: range.start, end: range.end }).on("error", onErr).pipe(res);
+        return;
+    }
+    res.setHeader("Content-Length", String(stat.size));
+    fs.createReadStream(filePath).on("error", onErr).pipe(res);
+}
 app.get("/download", (req, res) => {
     const session = String(req.query.session ?? "");
     const wanted = String(req.query.path ?? "");
@@ -3066,17 +3143,7 @@ app.get("/download", (req, res) => {
     catch {
         return res.status(404).type("text").send("file no longer on disk");
     }
-    const name = path.basename(wanted);
-    res.setHeader("Content-Type", contentTypeFor(name));
-    res.setHeader("Content-Length", String(stat.size));
-    res.setHeader("X-Content-Type-Options", "nosniff");
-    res.setHeader("Content-Security-Policy", "sandbox; default-src 'none'");
-    // A raster image is served inline (so opening it shows the image); everything
-    // else — including SVG/HTML — downloads. The <img> in the chat renders either.
-    const inline = isImageFile(name) && contentTypeFor(name) !== "image/svg+xml";
-    res.setHeader("Content-Disposition", `${inline ? "inline" : "attachment"}; filename="${name.replace(/["\\]/g, "_")}"`);
-    fs.createReadStream(wanted).on("error", () => { if (!res.headersSent)
-        res.status(500); res.end(); }).pipe(res);
+    serveStaticFile(req, res, wanted, stat, path.basename(wanted));
 });
 // Serve a file the USER dropped / pasted (or a Telegram attachment) — they all
 // land in MEDIA_DIR, referenced in the chat as `[Attached image: <path>]`. The
@@ -3100,14 +3167,7 @@ app.get("/media/:name", (req, res) => {
     catch {
         return res.status(404).type("text").send("no such media");
     }
-    res.setHeader("Content-Type", contentTypeFor(base));
-    res.setHeader("Content-Length", String(stat.size));
-    res.setHeader("X-Content-Type-Options", "nosniff");
-    res.setHeader("Content-Security-Policy", "sandbox; default-src 'none'");
-    const inline = isImageFile(base) && contentTypeFor(base) !== "image/svg+xml";
-    res.setHeader("Content-Disposition", `${inline ? "inline" : "attachment"}; filename="${base.replace(/["\\]/g, "_")}"`);
-    fs.createReadStream(file).on("error", () => { if (!res.headersSent)
-        res.status(500); res.end(); }).pipe(res);
+    serveStaticFile(req, res, file, stat, base);
 });
 // Install (or repair) the global Claude Code CLI on demand — `npm i -g
 // @anthropic-ai/claude-code`. The cockpit shows this button when an agent's TUI