Skip to content

Releases

dsh-voice-dialog 0.1.4 · Route admission / 路由准入

dsh-voice-dialog 0.1.4 · Route admission / 路由准入 Latest
Latest

Choose a tag to compare

View all tags
@QiNFPV QiNFPV released this 11 Nov 18:44
v0.1.4
e9b9a5f

English

dsh-voice-dialog 0.1.4 — security hardening for the /voice-tutor/* routes, on top of everything in 0.1.3.

  • Route admission. Every /voice-tutor/* request now asks the DSH connection service first (requestRejection, the same Host/Origin fence and session check DSH's own routes use). Cross-site calls and DNS rebinding are rejected before any handler runs; if the service is unavailable the plugin fails closed with 503.
  • API keys are write-only. GET /voice-tutor/config reports whether a key is set, never the value. Saving with an empty key keeps the existing one; the settings page has an explicit Clear key button. External endpoints are restricted to http(s).
  • One-time update confirmation. GET /voice-tutor/whisper-update issues a single-use token valid for 90 seconds; POST /voice-tutor/whisper-update/apply requires it in addition to confirm: true, so confirm alone no longer triggers a pip install plus bridge restart.
  • Documentation: a Security section now spells out the trust model — built-in recognition by default, a second pass through a DSH model, reply text sent to Microsoft for Edge TTS, a daily PyPI / Hugging Face update check, and settings stored in plain text at ~/.dsh/voice-tutor-config.json.

Everything from 0.1.3 is included: bilingual UI, local Whisper update check, stutter collapse, short-utterance language rescue, and the 0.1.1 startup fixes.

v0.1.3 has been withdrawn — install this release instead.

Install: dsh plugin --profile desktop add /path/to/dsh-voice-dialog-0.1.4.tgz, add dsh-voice-dialog to dsh.profile.bundles, restart DSH.

Asset: dsh-voice-dialog-0.1.4.tgz. MIT License.

中文

dsh-voice-dialog 0.1.4：给 /voice-tutor/* 路由补上准入校验，其余功能与 0.1.3 相同。

  • 路由准入：每个 /voice-tutor/* 请求先向 DSH 的 connection 服务要一次 requestRejection（与 DSH 自带路由同一道 Host/Origin 围栏 + 登录态校验）。跨站调用和 DNS 重绑定在任何处理逻辑之前被拒；拿不到该服务时失败关闭（503）。
  • 密钥只写不读：GET /voice-tutor/config 只回「是否已设置」，不回原文；留空保存等于保留原值，设置页提供显式的清除密钥按钮。外接接口只接受 http(s) 地址。
  • 更新确认一次性化：GET /voice-tutor/whisper-update 下发 90 秒有效、只能用一次的 token；POST /voice-tutor/whisper-update/apply 除了 confirm: true 还必须带它，光带 confirm 不会再触发 pip install 和重启桥。
  • 文档新增安全说明：默认用 DSH 自带识别、识别结果会再走一次 DSH 模型纠错、回复文字会发给微软用于 Edge TTS、每天查一次 PyPI / Hugging Face 更新、设置以明文存放在 ~/.dsh/voice-tutor-config.json。

0.1.3 的功能全部包含：中英界面、本地 Whisper 更新检查、口吃折叠、短句语言救援，以及 0.1.1 的全部启动修复。

v0.1.3 已下线，请安装这个版本。

安装：dsh plugin --profile desktop add /path/to/dsh-voice-dialog-0.1.4.tgz，把 dsh-voice-dialog 加入 dsh.profile.bundles，重启 DSH。

资产：dsh-voice-dialog-0.1.4.tgz。MIT License。

Assets 3
Loading