diff --git a/dockerfiles/Dockerfile.hermes-agent b/dockerfiles/Dockerfile.hermes-agent index 35a2f463..4f41fec2 100644 --- a/dockerfiles/Dockerfile.hermes-agent +++ b/dockerfiles/Dockerfile.hermes-agent @@ -1526,7 +1526,7 @@ function replaceOnce(source, before, after, label) { it to the shared Hermes bot from your Telegram account.

Open Telegram setup diff --git a/dockerfiles/Dockerfile.hermes-jetson-tts b/dockerfiles/Dockerfile.hermes-jetson-tts index deba4080..4257934a 100644 --- a/dockerfiles/Dockerfile.hermes-jetson-tts +++ b/dockerfiles/Dockerfile.hermes-jetson-tts @@ -24,18 +24,41 @@ ADD --checksum=sha256:f7d01dde371555732c4c314111ac79672b1a5ce2fc19266ab42178fd8d ADD --checksum=sha256:45754dfdebb3b8661c3fc564713772deec6e064feeb5b4e9594857dc7305193a --chmod=0444 \ https://huggingface.co/rhasspy/piper-voices/resolve/ea046e8458f6acd997706d6e6066a022b42f6fb1/en/en_US/lessac/low/en_US-lessac-low.onnx.json?download=true \ /opt/models/piper/en_US-lessac-low.onnx.json + +# Multilingual chat voice policy: English -> amy, Russian -> irina, Spanish -> +# claude (Mexican Spanish, the only "claude" voice rhasspy/piper-voices +# publishes; there is no es_ES-claude). +ADD --checksum=sha256:b3a6e47b57b8c7fbe6a0ce2518161a50f59a9cdd8a50835c02cb02bdd6206c18 --chmod=0444 \ + https://huggingface.co/rhasspy/piper-voices/resolve/ea046e8458f6acd997706d6e6066a022b42f6fb1/en/en_US/amy/medium/en_US-amy-medium.onnx?download=true \ + /opt/models/piper/en_US-amy-medium.onnx +ADD --checksum=sha256:95a23eb4d42909d38df73bb9ac7f45f597dbfcde2d1bf9526fdeaf5466977d77 --chmod=0444 \ + https://huggingface.co/rhasspy/piper-voices/resolve/ea046e8458f6acd997706d6e6066a022b42f6fb1/en/en_US/amy/medium/en_US-amy-medium.onnx.json?download=true \ + /opt/models/piper/en_US-amy-medium.onnx.json +ADD --checksum=sha256:8ff38212d23da300bbe3705c645e6e5b9475f0bfde01558eb17813e22acaaaaa --chmod=0444 \ + https://huggingface.co/rhasspy/piper-voices/resolve/ea046e8458f6acd997706d6e6066a022b42f6fb1/ru/ru_RU/irina/medium/ru_RU-irina-medium.onnx?download=true \ + /opt/models/piper/ru_RU-irina-medium.onnx +ADD --checksum=sha256:c2ec28bb38e2b59e93b959b3e40348c1afebbd272f30fed5d41205d08e98a9d7 --chmod=0444 \ + https://huggingface.co/rhasspy/piper-voices/resolve/ea046e8458f6acd997706d6e6066a022b42f6fb1/ru/ru_RU/irina/medium/ru_RU-irina-medium.onnx.json?download=true \ + /opt/models/piper/ru_RU-irina-medium.onnx.json +ADD --checksum=sha256:3ef40a71ea63852cd8ab7e6fa7d2ecdcfa67a0b47c9c48e3f10e02ee02083ea0 --chmod=0444 \ + https://huggingface.co/rhasspy/piper-voices/resolve/ea046e8458f6acd997706d6e6066a022b42f6fb1/es/es_MX/claude/high/es_MX-claude-high.onnx?download=true \ + /opt/models/piper/es_MX-claude-high.onnx +ADD --checksum=sha256:1afc81f703c0e4cb3b4d7c0dca096b8b54a98806807f0170cf5eb5557723c12d --chmod=0444 \ + https://huggingface.co/rhasspy/piper-voices/resolve/ea046e8458f6acd997706d6e6066a022b42f6fb1/es/es_MX/claude/high/es_MX-claude-high.onnx.json?download=true \ + /opt/models/piper/es_MX-claude-high.onnx.json RUN chmod 0555 /opt/models /opt/models/piper COPY dockerfiles/hermes-jetson-tts-server.py /opt/atlas/hermes-jetson-tts-server.py RUN chmod 0555 /opt/atlas/hermes-jetson-tts-server.py -# Load the actual pinned voice during the ARM64 build. This catches package or -# model-format drift before the image can reach Flux. -RUN python -c "import stat; from pathlib import Path; from piper import PiperVoice; p=Path('/opt/models/piper'); models=[p/'en_US-lessac-high.onnx',p/'en_US-lessac-medium.onnx',p/'en_US-lessac-low.onnx']; assert stat.S_IMODE(p.stat().st_mode)==0o555; assert all(stat.S_IMODE(model.stat().st_mode)==0o444 for model in models); voices=[PiperVoice.load(model,Path(str(model)+'.json'),use_cuda=False,download_dir=p) for model in models]; assert all(voice.config.sample_rate>0 for voice in voices)" +# Load every pinned voice during the ARM64 build, including the three baked +# for the multilingual chat policy. This catches package or model-format +# drift before the image can reach Flux. +RUN python -c "import stat; from pathlib import Path; from piper import PiperVoice; p=Path('/opt/models/piper'); models=[p/'en_US-lessac-high.onnx',p/'en_US-lessac-medium.onnx',p/'en_US-lessac-low.onnx',p/'en_US-amy-medium.onnx',p/'ru_RU-irina-medium.onnx',p/'es_MX-claude-high.onnx']; assert stat.S_IMODE(p.stat().st_mode)==0o555; assert all(stat.S_IMODE(model.stat().st_mode)==0o444 for model in models); voices=[PiperVoice.load(model,Path(str(model)+'.json'),use_cuda=False,download_dir=p) for model in models]; assert all(voice.config.sample_rate>0 for voice in voices)" ENV HERMES_TTS_HOST=0.0.0.0 \ HERMES_TTS_PORT=9001 \ - HERMES_TTS_VOICE=en_US-lessac-medium \ + HERMES_TTS_VOICE=en_US-amy-medium \ HERMES_TTS_CACHE=/opt/models/piper \ OMP_NUM_THREADS=2 \ PYTHONDONTWRITEBYTECODE=1 \ diff --git a/dockerfiles/Dockerfile.hermes-webui b/dockerfiles/Dockerfile.hermes-webui index 29e69ad3..d6b83e98 100644 --- a/dockerfiles/Dockerfile.hermes-webui +++ b/dockerfiles/Dockerfile.hermes-webui @@ -90,12 +90,14 @@ PY # Add the Atlas voice bridge as a narrow integration layer. It activates only # when a tenant's server-side STT capability reports the private Jetson route. COPY dockerfiles/hermes-webui-atlas-patch.py /tmp/hermes-webui-atlas-patch.py +COPY dockerfiles/hermes-webui-stt-patch.py /tmp/hermes-webui-stt-patch.py COPY dockerfiles/hermes-webui-telegram-project-patch.py /tmp/hermes-webui-telegram-project-patch.py COPY dockerfiles/hermes-webui-atlas-voice.js /opt/hermes-webui/static/atlas-voice.js COPY dockerfiles/hermes-webui-atlas-voice.css /opt/hermes-webui/static/atlas-voice.css COPY dockerfiles/hermes-webui-router-patch.py /tmp/hermes-webui-router-patch.py COPY dockerfiles/hermes-webui-router.js /opt/hermes-webui/static/atlas-router.js RUN /opt/hermes/.venv/bin/python /tmp/hermes-webui-atlas-patch.py +RUN /opt/hermes/.venv/bin/python /tmp/hermes-webui-stt-patch.py RUN /opt/hermes/.venv/bin/python /tmp/hermes-webui-telegram-project-patch.py RUN /opt/hermes/.venv/bin/python /tmp/hermes-webui-router-patch.py @@ -109,6 +111,7 @@ RUN /opt/hermes/.venv/bin/python -c 'import cryptography, yaml' \ && grep -Fq "'atlas/auto/maximum': 'Automatic · Maximum'" /opt/hermes-webui/static/panels.js \ && grep -Fq 'Atlas Jetson (private)' /opt/hermes-webui/static/index.html \ && grep -Fq 'HERMES_WEBUI_ATLAS_TTS_URL' /opt/hermes-webui/api/routes.py \ + && grep -Fq 'Audio conversion failed: upload is invalid' /opt/hermes/tools/transcription_tools.py \ && grep -Fq "capability.provider!=='local_command'" /opt/hermes-webui/static/atlas-voice.js \ && grep -Fq 'prefers-reduced-motion: reduce' /opt/hermes-webui/static/atlas-voice.css \ && grep -Fq 'id="voiceInstrumentStyles"' /opt/hermes-webui/static/index.html \ @@ -116,9 +119,16 @@ RUN /opt/hermes/.venv/bin/python -c 'import cryptography, yaml' \ && grep -Fq 'routing_priority:priority' /opt/hermes-webui/static/atlas-router.js \ && grep -Fq "'atlas/auto/fast':'Automatic · Fast'" /opt/hermes-webui/static/atlas-router.js \ && grep -Fq 'explicit_reasoning_effort' /opt/hermes-webui/api/gateway_chat.py \ + && grep -Fq '"language": detected_language' /opt/hermes/tools/transcription_tools.py \ + && grep -Fq "'language': detected" /opt/hermes-webui/api/upload.py \ + && grep -Fq 'def _atlas_tts_language(body):' /opt/hermes-webui/api/routes.py \ + && grep -Fq 'request_payload["language"] = _atlas_language' /opt/hermes-webui/api/routes.py \ + && grep -Fq 'takeSttLanguage(token)' /opt/hermes-webui/static/atlas-voice.js \ && /opt/hermes/.venv/bin/python -m py_compile \ /opt/hermes-webui/api/routes.py \ - /opt/hermes-webui/api/gateway_chat.py + /opt/hermes-webui/api/upload.py \ + /opt/hermes-webui/api/gateway_chat.py \ + /opt/hermes/tools/transcription_tools.py # Exercise the real server process in the target architecture before publish. RUN set -eu; \ diff --git a/dockerfiles/hermes-jetson-stt-server.py b/dockerfiles/hermes-jetson-stt-server.py index 1ecb9374..6e0efd08 100644 --- a/dockerfiles/hermes-jetson-stt-server.py +++ b/dockerfiles/hermes-jetson-stt-server.py @@ -62,6 +62,34 @@ def _clean_transcript(result: dict) -> str: return " ".join(kept).strip() +def _detected_language(result: object) -> str: + """Return the bare ISO-639 code Whisper decoded with, or nothing at all. + + ``whisper.transcribe`` reports the language it auto-detected (or the one it + was told to use) as a plain lowercase token such as ``en``/``ru``/``yue``. + Anything that is not that exact shape is dropped rather than guessed at, so + a surprising model result can never become a downstream voice selector. + """ + if not isinstance(result, dict): + return "" + value = result.get("language") + if not isinstance(value, str): + return "" + code = value.strip().lower() + if not 2 <= len(code) <= 3 or not code.isascii() or not code.isalpha(): + return "" + return code + + +def _transcription_payload(result: dict) -> dict: + """Build the transcription contract: text plus the model's own language.""" + return { + "text": _clean_transcript(result), + "model": MODEL_NAME, + "language": _detected_language(result), + } + + def _json(handler: BaseHTTPRequestHandler, status: int, payload: dict) -> None: body = json.dumps(payload).encode("utf-8") handler.send_response(status) @@ -148,8 +176,7 @@ class SpeechHandler(BaseHTTPRequestHandler): no_speech_threshold=0.5, verbose=False, ) - transcript = _clean_transcript(result) - _json(self, 200, {"text": transcript, "model": MODEL_NAME}) + _json(self, 200, _transcription_payload(result)) except Exception as exc: print(f"[stt] transcription failed: {exc}", flush=True) _json(self, 500, {"error": "transcription failed"}) diff --git a/dockerfiles/hermes-jetson-tts-server.py b/dockerfiles/hermes-jetson-tts-server.py index 3abdc28b..0b962ae2 100644 --- a/dockerfiles/hermes-jetson-tts-server.py +++ b/dockerfiles/hermes-jetson-tts-server.py @@ -17,12 +17,50 @@ from piper import PiperConfig, PiperVoice, SynthesisConfig HOST = os.getenv("HERMES_TTS_HOST", "0.0.0.0") PORT = int(os.getenv("HERMES_TTS_PORT", "9001")) -VOICE_NAME = os.getenv("HERMES_TTS_VOICE", "en_US-lessac-high") CACHE_DIR = Path(os.getenv("HERMES_TTS_CACHE", "/cache/piper")) MAX_TEXT_CHARS = 5000 ONNX_THREADS = max(1, int(os.getenv("HERMES_TTS_ONNX_THREADS", "4"))) VOICE_LOCK = threading.Lock() +# Fixed, allow-listed language -> baked voice mapping. This is the ONLY path +# from a client-supplied string to a model name: client input is looked up +# here and never used to build a filesystem path directly. Both "-" and "_" +# separators and any case are accepted; anything not present here falls back +# to DEFAULT_VOICE_NAME (safe English default), never an error and never an +# unbaked model. +LANGUAGE_VOICE_MAP = { + "en": "en_US-amy-medium", + "en-us": "en_US-amy-medium", + "ru": "ru_RU-irina-medium", + "ru-ru": "ru_RU-irina-medium", + "es": "es_MX-claude-high", + "es-mx": "es_MX-claude-high", + "es-es": "es_MX-claude-high", +} +BAKED_VOICE_NAMES = frozenset(LANGUAGE_VOICE_MAP.values()) +DEFAULT_VOICE_NAME = os.getenv("HERMES_TTS_VOICE", "en_US-amy-medium") + + +def normalize_language(value: object) -> str | None: + """Lowercase and fold "_"/"-" separators; reject non-string/blank input.""" + if not isinstance(value, str): + return None + normalized = value.strip().lower().replace("_", "-") + return normalized or None + + +def resolve_voice_name(language: object) -> str: + """Map a client-supplied language to one of the baked policy voices. + + Unknown, missing, or malformed language always resolves to the safe + default rather than raising, and the result is always a member of + BAKED_VOICE_NAMES. + """ + normalized = normalize_language(language) + if normalized is None: + return DEFAULT_VOICE_NAME + return LANGUAGE_VOICE_MAP.get(normalized, DEFAULT_VOICE_NAME) + def _json(handler: BaseHTTPRequestHandler, status: int, payload: dict) -> None: body = json.dumps(payload).encode("utf-8") @@ -46,7 +84,16 @@ class SpeechHandler(BaseHTTPRequestHandler): if self.path != "/health": _json(self, 404, {"error": "not found"}) return - _json(self, 200, {"ok": True, "voice": VOICE_NAME, "device": "cpu"}) + _json( + self, + 200, + { + "ok": True, + "voices": sorted(self.server.voices), # type: ignore[attr-defined] + "default_voice": self.server.default_voice_name, # type: ignore[attr-defined] + "device": "cpu", + }, + ) def do_POST(self) -> None: if self.path != "/v1/audio/speech": @@ -71,10 +118,16 @@ class SpeechHandler(BaseHTTPRequestHandler): return speed = min(2.0, max(0.5, speed)) + # Policy is driven ONLY by "language". A client-supplied "voice" + # field is deliberately never read here; it cannot override the + # allow-listed mapping. + voice_name = resolve_voice_name(payload.get("language")) + voice = self.server.voices[voice_name] # type: ignore[attr-defined] + output = io.BytesIO() try: with VOICE_LOCK, wave.open(output, "wb") as wav_file: - self.server.voice.synthesize_wav( # type: ignore[attr-defined] + voice.synthesize_wav( text, wav_file, SynthesisConfig(length_scale=1.0 / speed), @@ -84,6 +137,7 @@ class SpeechHandler(BaseHTTPRequestHandler): self.send_header("Content-Type", "audio/wav") self.send_header("Content-Length", str(len(audio))) self.send_header("Cache-Control", "no-store") + self.send_header("X-TTS-Voice", voice_name) self.end_headers() self.wfile.write(audio) except Exception as exc: @@ -91,30 +145,54 @@ class SpeechHandler(BaseHTTPRequestHandler): _json(self, 500, {"error": "speech synthesis failed"}) -def main() -> None: - """Load the checksum-pinned voice from the image and serve it on CPU.""" - CACHE_DIR.mkdir(parents=True, exist_ok=True) - model_path = CACHE_DIR / f"{VOICE_NAME}.onnx" - config_path = CACHE_DIR / f"{VOICE_NAME}.onnx.json" +def _load_voice(cache_dir: Path, voice_name: str, threads: int) -> PiperVoice: + model_path = cache_dir / f"{voice_name}.onnx" + config_path = cache_dir / f"{voice_name}.onnx.json" if not model_path.exists() or not config_path.exists(): - raise RuntimeError(f"baked Piper voice is missing: {VOICE_NAME}") + raise RuntimeError(f"baked Piper voice is missing: {voice_name}") with config_path.open("r", encoding="utf-8") as config_file: config = PiperConfig.from_dict(json.load(config_file)) session_options = onnxruntime.SessionOptions() - session_options.intra_op_num_threads = ONNX_THREADS + session_options.intra_op_num_threads = threads session_options.inter_op_num_threads = 1 session = onnxruntime.InferenceSession( str(model_path), sess_options=session_options, providers=["CPUExecutionProvider"], ) - voice = PiperVoice(session=session, config=config, download_dir=CACHE_DIR) + return PiperVoice(session=session, config=config, download_dir=cache_dir) + + +def load_voices(cache_dir: Path, threads: int) -> dict[str, PiperVoice]: + """Eagerly load all three policy voices. + + Preload (not lazy-load-on-first-use) was chosen deliberately: measured + RSS on this model set is ~88MB for one voice and ~243MB for all three + (~+155MB versus the previous single-voice baseline), which comfortably + fits the pod's memory budget on the CPU-only voice node. Preloading + avoids a slow, request-serializing first synthesis per language and + keeps the fail-closed missing-model check (below) at process start + rather than deferring a possible crash to a live user request. + """ + return {name: _load_voice(cache_dir, name, threads) for name in sorted(BAKED_VOICE_NAMES)} + + +def main() -> None: + """Load the checksum-pinned policy voices from the image and serve them on CPU.""" + CACHE_DIR.mkdir(parents=True, exist_ok=True) + if DEFAULT_VOICE_NAME not in BAKED_VOICE_NAMES: + raise RuntimeError( + f"HERMES_TTS_VOICE must name one of the baked policy voices: {sorted(BAKED_VOICE_NAMES)}" + ) + voices = load_voices(CACHE_DIR, ONNX_THREADS) print( - f"[tts] loaded Piper voice {VOICE_NAME} on CPU with {ONNX_THREADS} ONNX threads", + f"[tts] loaded {len(voices)} Piper voices on CPU with {ONNX_THREADS} ONNX threads each: " + + ", ".join(sorted(voices)), flush=True, ) server = ThreadingHTTPServer((HOST, PORT), SpeechHandler) - server.voice = voice # type: ignore[attr-defined] + server.voices = voices # type: ignore[attr-defined] + server.default_voice_name = DEFAULT_VOICE_NAME # type: ignore[attr-defined] print(f"[tts] ready on {HOST}:{PORT}", flush=True) server.serve_forever(poll_interval=0.25) diff --git a/dockerfiles/hermes-public-extract/provider.py b/dockerfiles/hermes-public-extract/provider.py index 1e97576c..631fec56 100644 --- a/dockerfiles/hermes-public-extract/provider.py +++ b/dockerfiles/hermes-public-extract/provider.py @@ -65,7 +65,7 @@ def _fetch_public(url: str) -> tuple[str, str, str]: """Fetch one public URL with redirect, size, MIME, and policy checks.""" current = url headers = { - "User-Agent": "HermesPrivateChat/1.0 (+https://chat.hermes.bstein.dev)", + "User-Agent": "HermesPrivateChat/1.0 (+https://chat.bstein.dev)", "Accept": "text/html, text/plain;q=0.9, application/xhtml+xml;q=0.8", } with httpx.Client(follow_redirects=False, timeout=15.0, headers=headers) as client: diff --git a/dockerfiles/hermes-webui-atlas-patch.py b/dockerfiles/hermes-webui-atlas-patch.py index d7bccf63..c39e236b 100644 --- a/dockerfiles/hermes-webui-atlas-patch.py +++ b/dockerfiles/hermes-webui-atlas-patch.py @@ -6,6 +6,9 @@ from pathlib import Path ROOT = Path(os.environ.get("HERMES_WEBUI_PATCH_ROOT", "/opt/hermes-webui")) +# The WebUI imports the pinned agent's STT tooling from the same image, so the +# local-command transcription envelope is patched alongside the WebUI itself. +AGENT_ROOT = Path(os.environ.get("HERMES_AGENT_PATCH_ROOT", "/opt/hermes")) def replace_exact(path: Path, before: str, after: str, count: int = 1) -> None: @@ -16,6 +19,43 @@ def replace_exact(path: Path, before: str, after: str, count: int = 1) -> None: path.write_text(source.replace(before, after, count), encoding="utf-8") +def replace_between_exact( + path: Path, start: str, end: str, after: str = "", count: int = 1 +) -> None: + """Replace one exact, bounded upstream region and fail when the pin drifts.""" + source = path.read_text(encoding="utf-8") + if source.count(start) != count or source.count(end) != count: + raise SystemExit( + f"Atlas voice patch context changed in {path}: {start[:80]!r}" + ) + start_index = source.index(start) + end_index = source.index(end, start_index) + len(end) + path.write_text( + source[:start_index] + after + source[end_index:], encoding="utf-8" + ) + + +def assert_absent(path: Path, *needles: str) -> None: + """Fail the image build if a removed voice-choice surface remains.""" + source = path.read_text(encoding="utf-8") + remaining = [needle for needle in needles if needle in source] + if remaining: + raise SystemExit(f"Atlas voice choice remains in {path}: {remaining!r}") + + +def remove_lines_containing(path: Path, *needles: str) -> None: + """Remove all pinned translation entries for a retired settings control.""" + source = path.read_text(encoding="utf-8") + for needle in needles: + if needle not in source: + raise SystemExit(f"Atlas voice patch context changed in {path}: {needle!r}") + lines = source.splitlines(keepends=True) + path.write_text( + "".join(line for line in lines if not any(n in line for n in needles)), + encoding="utf-8", + ) + + index = ROOT / "static/index.html" replace_exact( index, @@ -29,6 +69,16 @@ replace_exact( '', '', ) +replace_exact( + index, + '''
+ +
Preferred voice. Populated from your browser's available voices.
+
''', + "", +) replace_exact( index, '', @@ -62,11 +112,33 @@ replace_exact( ) ui = ROOT / "static/ui.js" +replace_exact( + ui, + ''' const savedVoice=localStorage.getItem('hermes-tts-voice'); + const voices=speechSynthesis.getVoices(); + if(savedVoice&&voices.length){ + const match=voices.find(v=>v.name===savedVoice); + if(match) utter.voice=match; + } +''', + "", +) replace_exact(ui, "function _playEdgeTtsChunked(text, btn){", "function _playEdgeTtsChunked(text, btn, engineOverride){") +replace_exact( + ui, + " const voice=localStorage.getItem('hermes-tts-voice')||'zh-CN-XiaoxiaoNeural';\n", + "", +) replace_exact( ui, "body:JSON.stringify({text:chunk, voice:voice, rate:rate, pitch:pitch})", - "body:JSON.stringify({text:chunk, voice:voice, rate:rate, pitch:pitch, engine:engineOverride||'edge'})", + "body:JSON.stringify({text:chunk, rate:rate, pitch:pitch, engine:engineOverride||'edge'})", +) +replace_exact( + ui, + " voice: localStorage.getItem('hermes-tts-voice')||'',\n", + "", + count=2, ) replace_exact( ui, @@ -79,7 +151,177 @@ replace_exact( "if(engine==='edge'||engine==='atlas'){\n _playEdgeTtsChunked(clean, null, engine);", ) +panels = ROOT / "static/panels.js" +replace_exact(panels, " tts_voice:'hermes-tts-voice',\n", "") +replace_exact( + panels, + ''' const ttsVoiceSel=$('settingsTtsVoice'); + if(ttsVoiceSel) _setOwnedSpeechPayload(payload,'tts_voice',ttsVoiceSel.value||''); +''', + "", +) +replace_exact( + panels, + ''' localStorage.setItem('hermes-tts-engine',this.value); + window._populateTtsVoices(); + _schedulePreferencesAutosave();''', + ''' localStorage.setItem('hermes-tts-engine',this.value); + _schedulePreferencesAutosave();''', +) +replace_between_exact( + panels, + " // Populate voice selector based on engine\n", + " // TTS rate/pitch sliders\n", + " // TTS speaker selection is intentionally server policy only.\n", +) +replace_exact( + panels, + "let _settingsSpeechChangedKeys=new Set();\n", + "let _settingsSpeechChangedKeys=new Set();\n" + "try{localStorage.removeItem('hermes-tts-voice');}catch(_){}\n", +) + +boot = ROOT / "static/boot.js" +replace_exact( + boot, + ''' voice: localStorage.getItem("hermes-tts-voice")||'', +''', + "", +) +replace_exact( + boot, + ''' const voice=localStorage.getItem("hermes-tts-voice")||"zh-CN-XiaoxiaoNeural"; +''', + "", +) +replace_exact( + boot, + " body: JSON.stringify({text: clean, voice, rate, pitch})", + " body: JSON.stringify({text: clean, rate, pitch})", +) +replace_exact( + boot, + ''' const savedVoice=localStorage.getItem('hermes-tts-voice'); + const voices=speechSynthesis.getVoices(); + if(savedVoice&&voices.length){ + const match=voices.find(v=>v.name===savedVoice); + if(match) utter.voice=match; + } +''', + "", +) +replace_exact(boot, " tts_voice:'',\n", "") +replace_exact(boot, " ['tts_voice','hermes-tts-voice'],\n", "") + +config = ROOT / "api/config.py" +replace_exact(config, ' "tts_voice": "",\n', "") +replace_exact(config, ' "tts_voice",\n', "") +replace_exact( + config, + ''' if k == "tts_voice": + if not isinstance(v, str) or len(v) > 200 or "\\x00" in v: + continue +''', + "", +) + +assert_absent(index, "settingsTtsVoice", "settings_label_tts_voice") +assert_absent(ui, "hermes-tts-voice", "voice:voice") +assert_absent(panels, "settingsTtsVoice", "tts_voice") +assert_absent(boot, "hermes-tts-voice", "tts_voice", "text: clean, voice") +assert_absent(config, '"tts_voice"') + +i18n = ROOT / "static/i18n.js" +remove_lines_containing( + i18n, + "settings_label_tts_voice:", + "settings_desc_tts_voice:", +) +assert_absent(i18n, "settings_label_tts_voice", "settings_desc_tts_voice") + +# The private Whisper service reports the language it decoded with. Carry that +# through the agent's local-command STT envelope so the WebUI can hand a voice +# hint to Piper instead of guessing the reply's language from its text. +transcription = AGENT_ROOT / "tools/transcription_tools.py" +replace_exact( + transcription, + ''' transcript_text = txt_files[0].read_text(encoding="utf-8").strip() + logger.info( + "Transcribed %s via local STT command (%s, %d chars)", + Path(file_path).name, + normalized_model, + len(transcript_text), + ) + return {"success": True, "transcript": transcript_text, "provider": "local_command"} +''', + ''' transcript_text = txt_files[0].read_text(encoding="utf-8").strip() + logger.info( + "Transcribed %s via local STT command (%s, %d chars)", + Path(file_path).name, + normalized_model, + len(transcript_text), + ) + detected_language = "" + language_files = sorted(Path(output_dir).glob("*.language")) + if language_files: + try: + candidate = language_files[0].read_text(encoding="utf-8").strip().lower() + except (OSError, ValueError): + candidate = "" + if 2 <= len(candidate) <= 3 and candidate.isascii() and candidate.isalpha(): + detected_language = candidate + return { + "success": True, + "transcript": transcript_text, + "provider": "local_command", + "language": detected_language, + } +''', +) + +upload = ROOT / "api/upload.py" +replace_exact( + upload, + """ transcript = str(result.get('transcript') or '').strip() + return j(handler, {'ok': True, 'transcript': transcript}) +""", + """ transcript = str(result.get('transcript') or '').strip() + detected = str(result.get('language') or '').strip().lower() + if not (2 <= len(detected) <= 3 and detected.isascii() and detected.isalpha()): + detected = '' + return j(handler, {'ok': True, 'transcript': transcript, 'language': detected}) +""", +) + routes = ROOT / "api/routes.py" +replace_exact( + routes, + "def _tts_open(req, *, timeout=30, opener_factory=None):", + '''ATLAS_TTS_LANGUAGES = ("en", "ru", "es") + + +def _atlas_tts_language(body): + """Return a plain, allow-listed en/ru/es code, or "" to send no language. + + This is a trust boundary, not a parser. Only the exact normalized codes the + private Piper deployment bakes a voice for are forwarded; a missing field, + a wrong type, a region tag, padding, control characters, a traversal or + injection string, an oversized value, an object, an array, a number or a + client-supplied "voice" all resolve to "" and the language field is then + omitted entirely, so the Jetson service applies its own English default. + Coercing a malformed value into a supported code would let a browser + describe hostile input as a language we support; omission cannot. + """ + if not isinstance(body, dict): + return "" + value = body.get("language") + if not isinstance(value, str): + return "" + return value if value in ATLAS_TTS_LANGUAGES else "" + + +def _tts_open(req, *, timeout=30, opener_factory=None):''', +) marker = " # ── ElevenLabs TTS ──────────────────────────────────────────────────\n" atlas = ''' # ── Atlas private Jetson TTS ───────────────────────────────────────── if engine == "atlas": @@ -94,12 +336,19 @@ atlas = ''' # ── Atlas private Jetson TTS ────────── speed = max(0.5, min(2.0, 1.0 + (float(rate_str.rstrip("%")) / 100.0))) except ValueError: speed = 1.0 - request_body = json.dumps({ + request_payload = { "model": "piper", "input": text, - "voice": "en_US-lessac-high", "speed": speed, - }).encode("utf-8") + } + # Attach a language ONLY when the browser sent a plain allow-listed + # code. Omitting it is the fail-safe: the Jetson service then speaks + # its own English default, which is also what every partially rolled + # out combination of these components degrades to. + _atlas_language = _atlas_tts_language(data) + if _atlas_language: + request_payload["language"] = _atlas_language + request_body = json.dumps(request_payload).encode("utf-8") request = Request(atlas_url, data=request_body, headers={ "Content-Type": "application/json", "Accept": "audio/wav", diff --git a/dockerfiles/hermes-webui-atlas-voice.js b/dockerfiles/hermes-webui-atlas-voice.js index 707e3457..a5042f5e 100644 --- a/dockerfiles/hermes-webui-atlas-voice.js +++ b/dockerfiles/hermes-webui-atlas-voice.js @@ -1,4 +1,4 @@ -// Natural turn-taking for chat.hermes.bstein.dev using the private Jetsons. +// Natural turn-taking for chat.bstein.dev using the private Jetsons. (function(){ 'use strict'; @@ -31,9 +31,37 @@ error:'Voice unavailable', idle:'', }; + // The only language signal this file trusts is the one the private Whisper + // service returned for the audio of the turn currently being answered. It is + // bound to that turn's generation token and consumed exactly once. + let sttLanguage=''; + let sttLanguageToken=-1; + const TTS_LANGUAGES=['en','ru','es']; const originalAutoRead=window.autoReadLastAssistant; const originalApplyPreference=window._applyVoiceModePref; + function normalizeSttLanguage(value){ + if(typeof value!=='string') return ''; + const code=value.trim().toLowerCase(); + return TTS_LANGUAGES.indexOf(code)>=0?code:''; + } + + function clearSttLanguage(){ + sttLanguage=''; + sttLanguageToken=-1; + } + + function rememberSttLanguage(language, token){ + sttLanguage=language||''; + sttLanguageToken=sttLanguage?token:-1; + } + + function takeSttLanguage(token){ + const language=sttLanguageToken===token?sttLanguage:''; + clearSttLanguage(); + return language; + } + function toast(message){ if(typeof window.showToast==='function') window.showToast(message,3000); } @@ -107,6 +135,7 @@ active=false; thinkingSession=null; clearErrorTimer(); + clearSttLanguage(); stopCapture(); stopPlayback(); modeBtn.classList.remove('active'); @@ -120,28 +149,36 @@ },delay||500); } - function sendTranscript(transcript, token){ + function sendTranscript(transcript, token, language){ if(!active||token!==generation) return; const text=String(transcript||'').trim(); - if(!text){restartSoon(token,350);return;} + if(!text){clearSttLanguage();restartSoon(token,350);return;} composer.value=text; if(typeof window.autoResize==='function') window.autoResize(); thinkingSession=(typeof S!=='undefined'&&S.session)?S.session.session_id:null; + rememberSttLanguage(language,token); setState('thinking'); if(typeof window.send==='function') window.send(); } + function audioExtension(mimeType){ + const normalized=String(mimeType||'').toLowerCase(); + if(normalized.indexOf('ogg')>=0) return 'ogg'; + if(normalized.indexOf('mp4')>=0) return 'mp4'; + return 'webm'; + } + async function transcribe(blob, token){ if(!active||token!==generation) return; setState('transcribing'); - const ext=(blob.type||'').indexOf('ogg')>=0?'ogg':'webm'; + const ext=audioExtension(blob.type); const form=new FormData(); form.append('file',new File([blob],'voice-input.'+ext,{type:blob.type||'audio/'+ext})); try{ const response=await fetch('/api/transcribe',{method:'POST',body:form}); const payload=await response.json().catch(function(){return {};}); if(!response.ok) throw new Error(payload.error||('Whisper request failed: '+response.status)); - sendTranscript(payload.transcript,token); + sendTranscript(payload.transcript,token,normalizeSttLanguage(payload.language)); }catch(error){ if(!active||token!==generation) return; const message=errorMessage(error,'Private Whisper is unavailable'); @@ -159,6 +196,7 @@ async function startListening(token){ if(!active||token!==generation) return; stopCapture(); + clearSttLanguage(); setState('listening'); try{ const capture=await navigator.mediaDevices.getUserMedia({ @@ -182,19 +220,26 @@ audioContext.createMediaStreamSource(stream).connect(highpass); highpass.connect(analyser); const samples=new Uint8Array(analyser.fftSize); - const mimeTypes=['audio/webm;codecs=opus','audio/ogg;codecs=opus','audio/webm']; + const mimeTypes=['audio/webm;codecs=opus','audio/ogg;codecs=opus','audio/mp4;codecs=mp4a.40.2','audio/mp4','audio/webm']; const mime=mimeTypes.find(function(value){return MediaRecorder.isTypeSupported(value);})||''; const chunks=[]; const preRoll=[]; + let initialChunk=null; let heardSpeech=false; let voiceFrames=0; let noiseFloor=0.008; let lastSpeech=Date.now(); const started=Date.now(); recorder=new MediaRecorder(stream,mime?{mimeType:mime}:undefined); + let recordedMime=recorder.mimeType||mime||''; recorder.ondataavailable=function(event){ if(!event.data||!event.data.size) return; + if(event.data.type) recordedMime=event.data.type; if(heardSpeech){chunks.push(event.data);return;} + // MediaRecorder's first timeslice owns the container initialization + // (EBML/Opus headers for WebM, and equivalent headers for Ogg/MP4). + // Keep it separately while bounding the actual audio pre-roll. + if(!initialChunk){initialChunk=event.data;return;} preRoll.push(event.data); while(preRoll.length>3) preRoll.shift(); }; @@ -207,7 +252,7 @@ recorder=null; if(!active||token!==generation) return; if(!heardSpeech||!chunks.length){restartSoon(token,300);return;} - transcribe(new Blob(chunks,{type:mime||'audio/webm'}),token); + transcribe(new Blob(chunks,{type:recordedMime||'audio/webm'}),token); }; recorder.start(250); const silenceMs=Math.max(900,parseInt(localStorage.getItem('hermes-voice-silence-ms')||'1600',10)||1600); @@ -229,6 +274,7 @@ if(!heardSpeech&&voiceFrames>=3){ heardSpeech=true; lastSpeech=now; + if(initialChunk){chunks.push(initialChunk);initialChunk=null;} while(preRoll.length) chunks.push(preRoll.shift()); }else if(heardSpeech&&voiceNow){ lastSpeech=now; @@ -273,11 +319,15 @@ }); } - async function fetchSpeech(chunk){ + async function fetchSpeech(chunk, language){ + // `language` is only ever the private STT result for this turn. When it is + // absent the field is omitted entirely and the server picks English. + const request={text:chunk,engine:'atlas'}; + if(language) request.language=language; const response=await fetch('/api/tts',{ method:'POST', headers:{'Content-Type':'application/json'}, - body:JSON.stringify({text:chunk,engine:'atlas'}), + body:JSON.stringify(request), }); if(!response.ok){ const payload=await response.json().catch(function(){return {};}); @@ -291,10 +341,12 @@ const currentSession=(typeof S!=='undefined'&&S.session)?S.session.session_id:null; if(thinkingSession&¤tSession&&thinkingSession!==currentSession){ thinkingSession=null; + clearSttLanguage(); restartSoon(token,250); return; } thinkingSession=null; + const language=takeSttLanguage(token); const rows=document.querySelectorAll('.msg-row[data-role="assistant"], .assistant-segment[data-raw-text]'); if(!rows.length){restartSoon(token,250);return;} const text=cleanForSpeech(rows[rows.length-1].dataset.rawText||''); @@ -302,11 +354,11 @@ setState('speaking'); const chunks=typeof window._splitForTTS==='function'?window._splitForTTS(text,280):[text]; try{ - let pending=fetchSpeech(chunks[0]); + let pending=fetchSpeech(chunks[0],language); for(let index=0;index None: + """Replace one exact upstream fragment, failing closed on image drift.""" + source = path.read_text(encoding="utf-8") + if source.count(before) != 1: + raise SystemExit(f"Hermes STT patch context changed in {path}: {before[:80]!r}") + path.write_text(source.replace(before, after, 1), encoding="utf-8") + + +transcription = ROOT / "tools/transcription_tools.py" +replace_exact( + transcription, + """ except subprocess.CalledProcessError as e: + details = e.stderr.strip() or e.stdout.strip() or str(e) + logger.error("ffmpeg conversion failed for %s: %s", file_path, details) + return None, f"Failed to convert audio for local STT: {details}" +""", + """ except subprocess.CalledProcessError as e: + details = e.stderr.strip() or e.stdout.strip() or str(e) + logger.error( + "ffmpeg conversion failed for %s: %s", file_path, details[-2000:] + ) + return None, ( + "Audio conversion failed: upload is invalid, incomplete, or uses an " + "unsupported codec" + ) +""", +) diff --git a/infrastructure/core/coredns-custom.yaml b/infrastructure/core/coredns-custom.yaml index beda2f43..9c83c009 100644 --- a/infrastructure/core/coredns-custom.yaml +++ b/infrastructure/core/coredns-custom.yaml @@ -18,6 +18,7 @@ data: 192.168.22.9 call.live.bstein.dev 192.168.22.9 cd.bstein.dev 192.168.22.9 chat.ai.bstein.dev + 192.168.22.9 chat.bstein.dev 192.168.22.9 chat.hermes.bstein.dev 192.168.22.9 ci.bstein.dev 192.168.22.9 cloud.bstein.dev @@ -45,6 +46,7 @@ data: 192.168.22.9 stream.bstein.dev 192.168.22.9 wolf.bstein.dev 192.168.22.9 tasks.bstein.dev + 192.168.22.9 triage.bstein.dev 192.168.22.9 triage.hermes.bstein.dev 192.168.22.9 vault.bstein.dev fallthrough diff --git a/knowledge/catalog/atlas.json b/knowledge/catalog/atlas.json index 98628e38..d7247bfd 100644 --- a/knowledge/catalog/atlas.json +++ b/knowledge/catalog/atlas.json @@ -4404,7 +4404,7 @@ } }, { - "host": "chat.hermes.bstein.dev", + "host": "chat.bstein.dev", "path": "/", "backend": { "namespace": "hermes", @@ -5164,7 +5164,7 @@ } }, { - "host": "triage.hermes.bstein.dev", + "host": "triage.bstein.dev", "path": "/", "backend": { "namespace": "hermes", diff --git a/knowledge/catalog/atlas.yaml b/knowledge/catalog/atlas.yaml index 6e355e7f..8ae1b49b 100644 --- a/knowledge/catalog/atlas.yaml +++ b/knowledge/catalog/atlas.yaml @@ -2888,7 +2888,7 @@ http_endpoints: kind: Ingress name: bstein-dev-home source: bstein-dev-home -- host: chat.hermes.bstein.dev +- host: chat.bstein.dev path: / backend: namespace: hermes @@ -3361,7 +3361,7 @@ http_endpoints: kind: Ingress name: planka source: planka -- host: triage.hermes.bstein.dev +- host: triage.bstein.dev path: / backend: namespace: hermes diff --git a/knowledge/diagrams/atlas-http.mmd b/knowledge/diagrams/atlas-http.mmd index 11b55c8a..5c0c9be7 100644 --- a/knowledge/diagrams/atlas-http.mmd +++ b/knowledge/diagrams/atlas-http.mmd @@ -51,9 +51,9 @@ flowchart LR host_chat_ai_bstein_dev --> svc_bstein_dev_home_chat_ai_gateway wl_bstein_dev_home_chat_ai_gateway["bstein-dev-home/chat-ai-gateway (Deployment)"] svc_bstein_dev_home_chat_ai_gateway --> wl_bstein_dev_home_chat_ai_gateway - host_chat_hermes_bstein_dev["chat.hermes.bstein.dev"] + host_chat_bstein_dev["chat.bstein.dev"] svc_hermes_oauth2_proxy_hermes_chat["hermes/oauth2-proxy-hermes-chat (Service)"] - host_chat_hermes_bstein_dev --> svc_hermes_oauth2_proxy_hermes_chat + host_chat_bstein_dev --> svc_hermes_oauth2_proxy_hermes_chat wl_hermes_oauth2_proxy_hermes_chat["hermes/oauth2-proxy-hermes-chat (Deployment)"] svc_hermes_oauth2_proxy_hermes_chat --> wl_hermes_oauth2_proxy_hermes_chat host_ci_bstein_dev["ci.bstein.dev"] @@ -170,9 +170,9 @@ flowchart LR host_tasks_bstein_dev --> svc_planka_planka wl_planka_planka["planka/planka (Deployment)"] svc_planka_planka --> wl_planka_planka - host_triage_hermes_bstein_dev["triage.hermes.bstein.dev"] + host_triage_bstein_dev["triage.bstein.dev"] svc_hermes_oauth2_proxy_hermes_triage["hermes/oauth2-proxy-hermes-triage (Service)"] - host_triage_hermes_bstein_dev --> svc_hermes_oauth2_proxy_hermes_triage + host_triage_bstein_dev --> svc_hermes_oauth2_proxy_hermes_triage wl_hermes_oauth2_proxy_hermes_triage["hermes/oauth2-proxy-hermes-triage (Deployment)"] svc_hermes_oauth2_proxy_hermes_triage --> wl_hermes_oauth2_proxy_hermes_triage host_vault_bstein_dev["vault.bstein.dev"] diff --git a/services/bstein-dev-home/kustomization.yaml b/services/bstein-dev-home/kustomization.yaml index 3fb48ea0..92fcb22b 100644 --- a/services/bstein-dev-home/kustomization.yaml +++ b/services/bstein-dev-home/kustomization.yaml @@ -20,9 +20,9 @@ resources: - ingress.yaml images: - name: registry.bstein.dev/bstein/bstein-dev-home-frontend - newTag: 0.1.1-478 # {"$imagepolicy": "bstein-dev-home:bstein-dev-home-frontend:tag"} + newTag: 0.1.1-479 # {"$imagepolicy": "bstein-dev-home:bstein-dev-home-frontend:tag"} - name: registry.bstein.dev/bstein/bstein-dev-home-backend - newTag: 0.1.1-478 # {"$imagepolicy": "bstein-dev-home:bstein-dev-home-backend:tag"} + newTag: 0.1.1-479 # {"$imagepolicy": "bstein-dev-home:bstein-dev-home-backend:tag"} configMapGenerator: - name: chat-ai-gateway namespace: bstein-dev-home diff --git a/services/comms/knowledge/catalog/atlas.json b/services/comms/knowledge/catalog/atlas.json index 98628e38..d7247bfd 100644 --- a/services/comms/knowledge/catalog/atlas.json +++ b/services/comms/knowledge/catalog/atlas.json @@ -4404,7 +4404,7 @@ } }, { - "host": "chat.hermes.bstein.dev", + "host": "chat.bstein.dev", "path": "/", "backend": { "namespace": "hermes", @@ -5164,7 +5164,7 @@ } }, { - "host": "triage.hermes.bstein.dev", + "host": "triage.bstein.dev", "path": "/", "backend": { "namespace": "hermes", diff --git a/services/comms/knowledge/catalog/atlas.yaml b/services/comms/knowledge/catalog/atlas.yaml index 6e355e7f..8ae1b49b 100644 --- a/services/comms/knowledge/catalog/atlas.yaml +++ b/services/comms/knowledge/catalog/atlas.yaml @@ -2888,7 +2888,7 @@ http_endpoints: kind: Ingress name: bstein-dev-home source: bstein-dev-home -- host: chat.hermes.bstein.dev +- host: chat.bstein.dev path: / backend: namespace: hermes @@ -3361,7 +3361,7 @@ http_endpoints: kind: Ingress name: planka source: planka -- host: triage.hermes.bstein.dev +- host: triage.bstein.dev path: / backend: namespace: hermes diff --git a/services/comms/knowledge/diagrams/atlas-http.mmd b/services/comms/knowledge/diagrams/atlas-http.mmd index 11b55c8a..5c0c9be7 100644 --- a/services/comms/knowledge/diagrams/atlas-http.mmd +++ b/services/comms/knowledge/diagrams/atlas-http.mmd @@ -51,9 +51,9 @@ flowchart LR host_chat_ai_bstein_dev --> svc_bstein_dev_home_chat_ai_gateway wl_bstein_dev_home_chat_ai_gateway["bstein-dev-home/chat-ai-gateway (Deployment)"] svc_bstein_dev_home_chat_ai_gateway --> wl_bstein_dev_home_chat_ai_gateway - host_chat_hermes_bstein_dev["chat.hermes.bstein.dev"] + host_chat_bstein_dev["chat.bstein.dev"] svc_hermes_oauth2_proxy_hermes_chat["hermes/oauth2-proxy-hermes-chat (Service)"] - host_chat_hermes_bstein_dev --> svc_hermes_oauth2_proxy_hermes_chat + host_chat_bstein_dev --> svc_hermes_oauth2_proxy_hermes_chat wl_hermes_oauth2_proxy_hermes_chat["hermes/oauth2-proxy-hermes-chat (Deployment)"] svc_hermes_oauth2_proxy_hermes_chat --> wl_hermes_oauth2_proxy_hermes_chat host_ci_bstein_dev["ci.bstein.dev"] @@ -170,9 +170,9 @@ flowchart LR host_tasks_bstein_dev --> svc_planka_planka wl_planka_planka["planka/planka (Deployment)"] svc_planka_planka --> wl_planka_planka - host_triage_hermes_bstein_dev["triage.hermes.bstein.dev"] + host_triage_bstein_dev["triage.bstein.dev"] svc_hermes_oauth2_proxy_hermes_triage["hermes/oauth2-proxy-hermes-triage (Service)"] - host_triage_hermes_bstein_dev --> svc_hermes_oauth2_proxy_hermes_triage + host_triage_bstein_dev --> svc_hermes_oauth2_proxy_hermes_triage wl_hermes_oauth2_proxy_hermes_triage["hermes/oauth2-proxy-hermes-triage (Deployment)"] svc_hermes_oauth2_proxy_hermes_triage --> wl_hermes_oauth2_proxy_hermes_triage host_vault_bstein_dev["vault.bstein.dev"] diff --git a/services/hermes/NOTES.md b/services/hermes/NOTES.md index ac0c4216..def0bcd8 100644 --- a/services/hermes/NOTES.md +++ b/services/hermes/NOTES.md @@ -1,8 +1,8 @@ # Hermes on Atlas: operator guide This is the mental model and demonstration script for the operator instance at -`triage.hermes.bstein.dev`. Read it once, then prove each section in the live UI. The -consumer instance at `chat.hermes.bstein.dev` is intentionally separate and is not the +`triage.bstein.dev`. Read it once, then prove each section in the live UI. The +consumer instance at `chat.bstein.dev` is intentionally separate and is not the place to perform infrastructure triage. `agent.hermes.bstein.dev` is the owner-only engineering control plane. Its root @@ -14,7 +14,7 @@ its conversation-first layout is a better fit. ## Consumer chat and Telegram -`chat.hermes.bstein.dev` uses the pinned Hermes WebUI rather than the operator +`chat.bstein.dev` uses the pinned Hermes WebUI rather than the operator dashboard. Keycloak still authenticates every browser request, and the tenant router permanently assigns each Keycloak subject to one Hermes process and one PVC. The four slots are an isolation pool, not a provider round robin: every @@ -40,6 +40,40 @@ or the WebUI. Browser chat remains available when `bot_token` is empty. The bot token and relay key must never be added to Git or a Kubernetes Secret. The router does not log prompt bodies, raw Telegram IDs, link codes, or tokens. +## Private Jetson voice: multilingual TTS policy + +`hermes-tts` on `titan-21` bakes three checksum-pinned Piper voices and +selects one per request from a fixed, allow-listed `language` field: `en`/ +`en-US` → `en_US-amy-medium`, `ru`/`ru-RU` → `ru_RU-irina-medium`, `es`/ +`es-MX`/`es-ES` → `es_MX-claude-high` (Piper's `claude` voice is Mexican +Spanish; there is no Castilian `es_ES-claude`). Matching is case-insensitive +and accepts both `_` and `-` separators. Any language that is missing, +unrecognized, or malformed falls back to English amy rather than erroring. +The mapping is a fixed dict from `language` to one of the three baked model +names only — a client-supplied `voice` field is never read, so no client +input can select or construct a model path. All three voices are preloaded +at process start (see `dockerfiles/hermes-jetson-tts-server.py`). + +Hermes Chat deliberately exposes no TTS speaker/model choice. The deterministic +WebUI image patch removes the pinned upstream voice selector, its label and +translations, its browser/server preference persistence, and every outbound +client `voice` field while preserving the TTS engine, speech rate/pitch, +dictation, hands-free Voice Mode, and the conversation instrument. Legacy +`hermes-tts-voice` browser state is deleted. Voice choice is therefore policy, +not a client preference: validated English maps to amy, Russian to irina, +Spanish to claude, and every unsupported or absent language falls back to amy. + +The private WebUI voice bridge (`dockerfiles/hermes-webui-atlas-voice.js`, +patched into `api/routes.py` by `hermes-webui-atlas-patch.py`) has no signal +for the language of the assistant reply it is about to speak — it sends only +`text` and `engine`. Until the WebUI or gateway attaches an explicit +`language` field to that request, every reply speaks in the safe English +default regardless of its actual language. Closing that gap needs a language +signal upstream of the TTS call (e.g. tagging the assistant turn with a +detected/declared reply language and threading it through +`hermes-webui-atlas-voice.js` → `api/routes.py` → the `language` field), not +client- or server-side guessing bolted onto the TTS service itself. + ## The one-sentence explanation Hermes is the persistent agent runtime and control surface; Codex or the local @@ -347,6 +381,40 @@ Use this short explanation: - `Use $tune-atlas-alerts. Trace one currently firing alert to its generated source and raw PromQL, but do not edit it.` - `Use $master-hermes-on-atlas. Assess me on the request path and permission boundary. One question at a time.` +## Private voice: choosing the Piper voice from the STT-detected language + +Hands-free voice mode in `chat.hermes.bstein.dev` selects the private Piper +voice from the language the private Jetson Whisper service reports for the +user's own speech. The signal travels one way only, and every hop narrows it: + +1. `hermes-stt` returns `{text, model, language}`. `language` is whatever + Whisper decoded with, accepted only as a bare ISO-639 token (`en`, `ru`, + `es`, `yue`, …); anything else is reported as empty. +2. `hermes_stt_client.py` writes the usual `.txt` transcript plus a + `.language` sidecar. The transcript stays the only `.txt` in the + output directory, so the stock Hermes local-command contract is unchanged. +3. The patched local-command STT envelope reads that sidecar and adds + `language` to its result; `/api/transcribe` re-validates it and returns it + next to `transcript`. +4. `atlas-voice.js` keeps that value only for the turn it belongs to. It is + bound to the voice-mode generation token and the chat session id, consumed + exactly once by the reply that turn produced, and cleared on cancellation, + restart, session change, an empty transcript, or a transcription error. +5. `/api/tts` accepts `language` only from the fixed allow-list and otherwise + sends English. The Jetson TTS service applies the same allow-list again as + the final authority. + +**What this does not claim.** The language is the language the *user spoke*, +not the language of the reply. A model asked a Russian question may answer in +English and will then be read aloud by the Russian voice, and vice versa; this +is a deliberate policy choice for hands-free mode, not a detection failure. +Nothing here detects the language of assistant text. + +**Everything else stays English.** Typed messages, the manual read-aloud +button, and any assistant reply that was not produced by a hands-free spoken +turn carry no trusted STT signal, so they synthesize with `en_US-amy-medium`. +A `voice` field from a browser is never honoured at any hop. + ## Honest limits - Hermes does not currently apply production or cluster changes autonomously. diff --git a/services/hermes/agent-certificate.yaml b/services/hermes/agent-certificate.yaml index 486bab8b..6630ae75 100644 --- a/services/hermes/agent-certificate.yaml +++ b/services/hermes/agent-certificate.yaml @@ -11,5 +11,9 @@ spec: name: letsencrypt dnsNames: - agent.hermes.bstein.dev + - chat.bstein.dev + - triage.bstein.dev + # Legacy hosts stay on the certificate until they are retired on purpose; + # the rename in #34 must not break links or sessions already in flight. - chat.hermes.bstein.dev - triage.hermes.bstein.dev diff --git a/services/hermes/agent-configmap.yaml b/services/hermes/agent-configmap.yaml index d339b8c2..bcec67ac 100644 --- a/services/hermes/agent-configmap.yaml +++ b/services/hermes/agent-configmap.yaml @@ -84,7 +84,9 @@ data: failure_limit: 2 orchestrator_profile: default default_assignee: cli-auto - max_in_progress_per_profile: 1 + # Allow a release review and independent evidence task to run together; + # gateway-wide and provider quota/cooldown limits remain in force. + max_in_progress_per_profile: 2 auto_decompose: true auto_decompose_per_tick: 2 # In-pod autonomous supervisor (kanban_supervisor.py). Default false so it @@ -320,7 +322,7 @@ data: cannot read Secrets, exec or attach to pods, create service-account tokens, mutate workloads or RBAC, or reconcile Flux. Put every durable cluster change on a reviewed titan-iac branch. Never expose credentials in chat or - logs. Triage belongs at triage.hermes.bstein.dev. + logs. Triage belongs at triage.bstein.dev. ## Atlas engineering access diff --git a/services/hermes/agent-ingress.yaml b/services/hermes/agent-ingress.yaml index 19ae39b7..775adbce 100644 --- a/services/hermes/agent-ingress.yaml +++ b/services/hermes/agent-ingress.yaml @@ -88,10 +88,35 @@ spec: tls: - hosts: - agent.hermes.bstein.dev + - chat.bstein.dev + - triage.bstein.dev - chat.hermes.bstein.dev - triage.hermes.bstein.dev secretName: hermes-sites-tls rules: + - host: chat.bstein.dev + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: oauth2-proxy-hermes-chat + port: + name: http + - host: triage.bstein.dev + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: oauth2-proxy-hermes-triage + port: + name: http + # Legacy hosts serve the same backends so the rename is additive. They are + # kept until an explicit retirement change, not redirected: oauth2-proxy + # cookies are host-bound, so a redirect would silently drop the session. - host: chat.hermes.bstein.dev http: paths: diff --git a/services/hermes/chat-configmap.yaml b/services/hermes/chat-configmap.yaml index 75f2ae52..1ac6e20b 100644 --- a/services/hermes/chat-configmap.yaml +++ b/services/hermes/chat-configmap.yaml @@ -68,7 +68,7 @@ data: atlas/manual/claude/opus: {provider: atlas-switchyard, model: atlas/manual/claude/opus} atlas/manual/local/qwen-14b: {provider: atlas-switchyard, model: atlas/manual/local/qwen-14b} dashboard: - public_url: https://chat.hermes.bstein.dev + public_url: https://chat.bstein.dev display: compact: true tool_progress: all diff --git a/services/hermes/chat-statefulset.yaml b/services/hermes/chat-statefulset.yaml index 244b18a6..38756cf7 100644 --- a/services/hermes/chat-statefulset.yaml +++ b/services/hermes/chat-statefulset.yaml @@ -277,7 +277,7 @@ spec: - {name: API_SERVER_ENABLED, value: "true"} - {name: API_SERVER_HOST, value: 0.0.0.0} - {name: API_SERVER_PORT, value: "8642"} - - {name: API_SERVER_CORS_ORIGINS, value: https://chat.hermes.bstein.dev} + - {name: API_SERVER_CORS_ORIGINS, value: https://chat.bstein.dev} - {name: HERMES_IMAGE_BROKER_URL, value: http://hermes-image-broker.hermes.svc.cluster.local:9002} - {name: HERMES_IMAGE_BROKER_KEY_FILE, value: /runtime-access/chat-relay-key} - {name: HERMES_AUTO_ROUTER_PROFILE, value: chat} @@ -345,7 +345,7 @@ spec: # NetworkPolicy admits this port only from hermes-chat-router; the # CIDR lets the WebUI validate that router's changing pod address. - {name: HERMES_WEBUI_TRUSTED_PROXY_CIDRS, value: 10.42.0.0/16} - - {name: HERMES_WEBUI_ALLOWED_ORIGINS, value: https://chat.hermes.bstein.dev} + - {name: HERMES_WEBUI_ALLOWED_ORIGINS, value: https://chat.bstein.dev} - {name: HERMES_WEBUI_TRUST_FORWARDED_HOST, value: "1"} - {name: HERMES_WEBUI_TRUST_FORWARDED_PROTO, value: "1"} - {name: HERMES_ROUTER_PROFILE, value: chat} diff --git a/services/hermes/configmap.yaml b/services/hermes/configmap.yaml index 7d27e93c..722ce75c 100644 --- a/services/hermes/configmap.yaml +++ b/services/hermes/configmap.yaml @@ -83,7 +83,7 @@ data: - "*kubectl describe secret*" dashboard: - public_url: https://triage.hermes.bstein.dev + public_url: https://triage.bstein.dev display: compact: true @@ -111,10 +111,10 @@ data: You are Hermes running inside the Titan Kubernetes cluster as a supervised testing and operations triage assistant. - This is the dedicated triage appliance at triage.hermes.bstein.dev. Keep + This is the dedicated triage appliance at triage.bstein.dev. Keep automated Ariadne intake and testing conversations here. Project delivery and coding orchestration belong to agent.hermes.bstein.dev; general user - chat belongs to chat.hermes.bstein.dev. + chat belongs to chat.bstein.dev. Start in AUTO routing with a careful, intelligence-biased posture. Every new request is classified locally before a hosted model is selected. The diff --git a/services/hermes/deployment.yaml b/services/hermes/deployment.yaml index 25b3ada3..15c55b71 100644 --- a/services/hermes/deployment.yaml +++ b/services/hermes/deployment.yaml @@ -284,7 +284,7 @@ spec: - name: HERMES_DASHBOARD value: "0" - name: HERMES_DASHBOARD_PUBLIC_URL - value: https://triage.hermes.bstein.dev + value: https://triage.bstein.dev - name: API_SERVER_ENABLED value: "true" - name: API_SERVER_HOST @@ -292,7 +292,7 @@ spec: - name: API_SERVER_PORT value: "8642" - name: API_SERVER_CORS_ORIGINS - value: https://triage.hermes.bstein.dev + value: https://triage.bstein.dev - name: VICTORIA_METRICS_URL value: http://victoria-metrics-single-server.monitoring.svc.cluster.local:8428 - name: ARIADNE_BASE_URL @@ -405,7 +405,7 @@ spec: - {name: HERMES_WEBUI_GATEWAY_USE_RUNS_API, value: "true"} - {name: HERMES_WEBUI_SKIP_ONBOARDING, value: "1"} - {name: HERMES_WEBUI_SECURE, value: "1"} - - {name: HERMES_WEBUI_ALLOWED_ORIGINS, value: https://triage.hermes.bstein.dev} + - {name: HERMES_WEBUI_ALLOWED_ORIGINS, value: https://triage.bstein.dev} - {name: HERMES_WEBUI_TRUST_FORWARDED_HOST, value: "1"} - {name: HERMES_WEBUI_TRUST_FORWARDED_PROTO, value: "1"} - {name: HERMES_ROUTER_PROFILE, value: triage} diff --git a/services/hermes/execution-coordinator-patch.yaml b/services/hermes/execution-coordinator-patch.yaml index b0526d8e..816f6068 100644 --- a/services/hermes/execution-coordinator-patch.yaml +++ b/services/hermes/execution-coordinator-patch.yaml @@ -18,7 +18,9 @@ spec: - name: cli-lane-runner env: - {name: HERMES_CLI_LANE_OWNED_WORKSPACES_ONLY, value: "true"} - - {name: HERMES_CLI_LANE_CONCURRENCY, value: "1"} + # Cap simultaneous direct cli-* Codex/Claude runner slots separately + # from the normal Hermes profile cap in agent-configmap.yaml. + - {name: HERMES_CLI_LANE_CONCURRENCY, value: "2"} - name: execution-pool-coordinator image: registry.bstein.dev/bstein/hermes-agent@sha256:81970563e542f0720773e72297810b3a844b83e381e278f25c0916c78d930107 imagePullPolicy: IfNotPresent diff --git a/services/hermes/oauth2-proxy.yaml b/services/hermes/oauth2-proxy.yaml index 52dea326..5cd9d01f 100644 --- a/services/hermes/oauth2-proxy.yaml +++ b/services/hermes/oauth2-proxy.yaml @@ -82,7 +82,7 @@ spec: args: - --provider=oidc - --config=/vault/secrets/oidc-config - - --redirect-url=https://triage.hermes.bstein.dev/oauth2/callback + - --redirect-url=https://triage.bstein.dev/oauth2/callback - --oidc-issuer-url=https://sso.bstein.dev/realms/atlas - --user-id-claim=sub - --code-challenge-method=S256 @@ -181,7 +181,7 @@ spec: args: - --provider=oidc - --config=/vault/secrets/oidc-config - - --redirect-url=https://chat.hermes.bstein.dev/oauth2/callback + - --redirect-url=https://chat.bstein.dev/oauth2/callback - --oidc-issuer-url=https://sso.bstein.dev/realms/atlas - --user-id-claim=sub - --code-challenge-method=S256 diff --git a/services/hermes/router/telegram.go b/services/hermes/router/telegram.go index a2d591df..b2dcd799 100644 --- a/services/hermes/router/telegram.go +++ b/services/hermes/router/telegram.go @@ -249,7 +249,7 @@ func (bot *telegramBot) handleUpdate(update telegramUpdate) { command, args := commandParts(message.Text) if command == "start" || command == "link" { if len(args) == 0 { - _ = bot.sendText(message.Chat.ID, "Sign in to chat.hermes.bstein.dev, open Telegram, and create a one-time link code.") + _ = bot.sendText(message.Chat.ID, "Sign in to chat.bstein.dev, open Telegram, and create a one-time link code.") return } if _, err := bot.router.consumeLink(userID, args[0]); err != nil { @@ -273,7 +273,7 @@ func (bot *telegramBot) handleUpdate(update telegramUpdate) { } slot, linked := bot.router.telegramSlot(userID) if !linked { - _ = bot.sendText(message.Chat.ID, "This Telegram account is not linked. Sign in to chat.hermes.bstein.dev and open Telegram to connect it.") + _ = bot.sendText(message.Chat.ID, "This Telegram account is not linked. Sign in to chat.bstein.dev and open Telegram to connect it.") return } if command == "topic" { diff --git a/services/hermes/scripts/hermes_stt_client.py b/services/hermes/scripts/hermes_stt_client.py index 639fc7b1..96f7081d 100644 --- a/services/hermes/scripts/hermes_stt_client.py +++ b/services/hermes/scripts/hermes_stt_client.py @@ -12,6 +12,34 @@ from pathlib import Path from urllib.request import Request, urlopen +LANGUAGE_SUFFIX = ".language" + + +def _normalize_language(value: object) -> str: + """Accept only a bare ISO-639 code from the private Whisper response.""" + if not isinstance(value, str): + return "" + code = value.strip().lower() + if not 2 <= len(code) <= 3 or not code.isascii() or not code.isalpha(): + return "" + return code + + +def _write_result(output_dir: Path, stem: str, transcript: str, language: str) -> Path: + """Write the .txt Hermes reads, plus the language sidecar when we have one. + + Hermes' local-command contract is "leave a .txt in --output-dir"; it globs + ``*.txt`` and reads the first match. The sidecar deliberately uses another + suffix so the transcript stays the only ``.txt`` in the directory. + """ + output_dir.mkdir(parents=True, exist_ok=True) + transcript_path = output_dir / f"{stem}.txt" + transcript_path.write_text(transcript, encoding="utf-8") + if language: + (output_dir / f"{stem}{LANGUAGE_SUFFIX}").write_text(language, encoding="utf-8") + return transcript_path + + def _multipart(audio: Path, language: str, model: str) -> tuple[bytes, str]: boundary = f"atlas-hermes-{secrets.token_hex(12)}" mime = mimetypes.guess_type(audio.name)[0] or "application/octet-stream" @@ -67,9 +95,12 @@ def main() -> None: with urlopen(request, timeout=120) as response: result = json.loads(response.read().decode("utf-8")) transcript = str(result.get("text") or "").strip() - args.output_dir.mkdir(parents=True, exist_ok=True) - output = args.output_dir / f"{args.input_path.stem}.txt" - output.write_text(transcript, encoding="utf-8") + _write_result( + args.output_dir, + args.input_path.stem, + transcript, + _normalize_language(result.get("language")), + ) if __name__ == "__main__": diff --git a/services/hermes/skills/master-hermes-on-atlas/references/architecture.md b/services/hermes/skills/master-hermes-on-atlas/references/architecture.md index 9ec70a10..17636d75 100644 --- a/services/hermes/skills/master-hermes-on-atlas/references/architecture.md +++ b/services/hermes/skills/master-hermes-on-atlas/references/architecture.md @@ -7,9 +7,9 @@ asserting health, placement, ownership, or current model availability. | Surface | Purpose | Identity boundary | State and permissions | | --- | --- | --- | --- | -| `triage.hermes.bstein.dev` | Brad's automated testing triage | Keycloak plus an outer oauth2-proxy exact-email allow-list for `brad@bstein.dev` | `hermes` namespace, its own PVC and service account; read-only cluster triage plus approved internal evidence endpoints | +| `triage.bstein.dev` | Brad's automated testing triage | Keycloak plus an outer oauth2-proxy exact-email allow-list for `brad@bstein.dev` | `hermes` namespace, its own PVC and service account; read-only cluster triage plus approved internal evidence endpoints | | `agent.hermes.bstein.dev` | Brad's project coordinator | Keycloak plus an outer oauth2-proxy exact-email allow-list for `brad@bstein.dev` | `hermes` namespace and separate PVC; native Hermes delegates bounded work while Herdr preserves real Codex and Claude Code CLI sessions when needed | -| `chat.hermes.bstein.dev` | Private consumer chat and research through Hermes WebUI or a linked Telegram DM | Keycloak login plus one-time Telegram account link | One Hermes process and PVC per assigned Keycloak subject; no Kubernetes RBAC, terminal, or private-service access | +| `chat.bstein.dev` | Private consumer chat and research through Hermes WebUI or a linked Telegram DM | Keycloak login plus one-time Telegram account link | One Hermes process and PVC per assigned Keycloak subject; no Kubernetes RBAC, terminal, or private-service access | The instances do not share conversation state, credentials, profiles, skills created on their PVCs, or Kubernetes identities. They share only the inference diff --git a/services/keycloak/bootstrap-jobs/hermes-access-oidc-client-job.yaml b/services/keycloak/bootstrap-jobs/hermes-access-oidc-client-job.yaml index 7eae3a1e..b2020e8e 100644 --- a/services/keycloak/bootstrap-jobs/hermes-access-oidc-client-job.yaml +++ b/services/keycloak/bootstrap-jobs/hermes-access-oidc-client-job.yaml @@ -3,7 +3,7 @@ apiVersion: batch/v1 kind: Job metadata: - name: hermes-access-oidc-client-ensure-10 + name: hermes-access-oidc-client-ensure-11 namespace: sso spec: backoffLimit: 3 diff --git a/services/keycloak/scripts/hermes_access_oidc_ensure.sh b/services/keycloak/scripts/hermes_access_oidc_ensure.sh index 0ab9fbb0..2e54603c 100755 --- a/services/keycloak/scripts/hermes_access_oidc_ensure.sh +++ b/services/keycloak/scripts/hermes_access_oidc_ensure.sh @@ -84,10 +84,24 @@ ensure_proxy_client() { client_id="$1" public_url="$2" vault_path="$3" + # Optional legacy host kept registered alongside the canonical one during a + # hostname rename. Keycloak matches redirect_uri exactly, so dropping the old + # entry turns every in-flight login into "Invalid parameter: redirect_uri". + legacy_url="${4:-}" + if [ -n "${legacy_url}" ]; then + origins="$(jq -nc --arg a "${public_url}" --arg b "${legacy_url}" '[$a,$b]')" + else + origins="$(jq -nc --arg a "${public_url}" '[$a]')" + fi + redirect_uris="$(printf '%s' "${origins}" | jq -c 'map(. + "/oauth2/callback")')" + # Keycloak takes post-logout origins as one "##"-delimited string. + post_logout="$(printf '%s' "${origins}" | jq -r 'join("##")')" payload="$(jq -nc \ --arg client_id "${client_id}" \ - --arg redirect_uri "${public_url}/oauth2/callback" \ + --argjson redirect_uris "${redirect_uris}" \ + --argjson web_origins "${origins}" \ --arg web_origin "${public_url}" \ + --arg post_logout "${post_logout}" \ '{ clientId:$client_id, name:$client_id, @@ -98,13 +112,13 @@ ensure_proxy_client() { implicitFlowEnabled:false, directAccessGrantsEnabled:false, serviceAccountsEnabled:false, - redirectUris:[$redirect_uri], - webOrigins:[$web_origin], + redirectUris:$redirect_uris, + webOrigins:$web_origins, rootUrl:$web_origin, baseUrl:"/", attributes:{ "pkce.code.challenge.method":"S256", - "post.logout.redirect.uris":$web_origin, + "post.logout.redirect.uris":$post_logout, "access.token.lifespan":"1200" } }')" @@ -327,8 +341,10 @@ ensure_telegram_config() { } ensure_hermes_owner -ensure_proxy_client "hermes-chat-proxy" "https://chat.hermes.bstein.dev" "hermes/chat-oidc" +ensure_proxy_client "hermes-chat-proxy" "https://chat.bstein.dev" "hermes/chat-oidc" \ + "https://chat.hermes.bstein.dev" ensure_proxy_client "hermes-agent-proxy" "https://agent.hermes.bstein.dev" "hermes/agent-oidc" -ensure_proxy_client "hermes-triage-proxy" "https://triage.hermes.bstein.dev" "hermes/triage-oidc" +ensure_proxy_client "hermes-triage-proxy" "https://triage.bstein.dev" "hermes/triage-oidc" \ + "https://triage.hermes.bstein.dev" ensure_service_account_client "hermes-automation" "hermes/developer-keycloak" ensure_telegram_config diff --git a/services/maintenance/apps/ariadne-deployment.yaml b/services/maintenance/apps/ariadne-deployment.yaml index d58b342d..c456464b 100644 --- a/services/maintenance/apps/ariadne-deployment.yaml +++ b/services/maintenance/apps/ariadne-deployment.yaml @@ -555,7 +555,7 @@ spec: # open the run that wrote it rather than taking "Proposed by # Hermes" on trust. - name: ARIADNE_HERMES_UI_URL - value: https://triage.hermes.bstein.dev + value: https://triage.bstein.dev - name: ARIADNE_HERMES_SONAR_ENABLED value: "true" - name: ARIADNE_HERMES_SONAR_URL diff --git a/services/quality/zap-baseline-configmap.yaml b/services/quality/zap-baseline-configmap.yaml index 06bb82bb..c659edbb 100644 --- a/services/quality/zap-baseline-configmap.yaml +++ b/services/quality/zap-baseline-configmap.yaml @@ -27,8 +27,8 @@ data: https://money.bstein.dev https://health.bstein.dev https://agent.hermes.bstein.dev - https://chat.hermes.bstein.dev - https://triage.hermes.bstein.dev + https://chat.bstein.dev + https://triage.bstein.dev https://cassandra.bstein.dev https://veles.bstein.dev https://matrix.live.bstein.dev diff --git a/testing/fixtures/hermes-agent-9de9c25f/SOURCE.md b/testing/fixtures/hermes-agent-9de9c25f/SOURCE.md new file mode 100644 index 00000000..de2e910c --- /dev/null +++ b/testing/fixtures/hermes-agent-9de9c25f/SOURCE.md @@ -0,0 +1,12 @@ +# Hermes Agent STT fixture provenance + +This minimal module contains the exact `_prepare_local_audio` patch context +extracted from the agent image inherited by `Dockerfile.hermes-webui`: + +- Image: `registry.bstein.dev/bstein/hermes-agent@sha256:81970563e542f0720773e72297810b3a844b83e381e278f25c0916c78d930107` +- OCI platform manifest: `sha256:9b4c00a25fd08f0df3bcb800d755bd48576fb65af5ab0df40058fbb78a147e43` +- Upstream Hermes revision: `9de9c25f620ff7f1ce0fd5457d596052d5159596` +- Full upstream `tools/transcription_tools.py` SHA-256: `d7d7df56b98dfadc0a7c08d5addd02db4e3106e6fd3b753e9241c23145eb2951` + +Tests execute the production patcher against this source fragment and then run +its real ffmpeg conversion boundary with browser-produced bytes. diff --git a/testing/fixtures/hermes-agent-9de9c25f/tools/transcription_tools.py b/testing/fixtures/hermes-agent-9de9c25f/tools/transcription_tools.py new file mode 100644 index 00000000..460b320a --- /dev/null +++ b/testing/fixtures/hermes-agent-9de9c25f/tools/transcription_tools.py @@ -0,0 +1,44 @@ +"""Exact pinned local-audio preparation fragment with its direct dependencies.""" + +import os +from pathlib import Path +import shutil +import subprocess +from typing import Optional + + +LOCAL_NATIVE_AUDIO_FORMATS = {".wav", ".aiff", ".aif"} +logger = __import__("logging").getLogger(__name__) + + +def _find_ffmpeg_binary() -> Optional[str]: + return shutil.which("ffmpeg") + + +def windows_hide_flags() -> int: + return 0 + + +def _prepare_local_audio(file_path: str, work_dir: str) -> tuple[Optional[str], Optional[str]]: + """Normalize audio for local CLI STT when needed.""" + audio_path = Path(file_path) + if audio_path.suffix.lower() in LOCAL_NATIVE_AUDIO_FORMATS: + return file_path, None + + ffmpeg = _find_ffmpeg_binary() + if not ffmpeg: + return None, "Local STT fallback requires ffmpeg for non-WAV inputs, but ffmpeg was not found" + + converted_path = os.path.join(work_dir, f"{audio_path.stem}.wav") + command = [ffmpeg, "-y", "-i", file_path, converted_path] + + try: + subprocess.run(command, check=True, capture_output=True, text=True, timeout=300, stdin=subprocess.DEVNULL, creationflags=windows_hide_flags()) + return converted_path, None + except subprocess.TimeoutExpired: + logger.error("ffmpeg conversion timed out for %s", file_path) + return None, "Audio conversion for local STT timed out" + except subprocess.CalledProcessError as e: + details = e.stderr.strip() or e.stdout.strip() or str(e) + logger.error("ffmpeg conversion failed for %s: %s", file_path, details) + return None, f"Failed to convert audio for local STT: {details}" diff --git a/testing/fixtures/hermes-agent/tools/transcription_tools.py b/testing/fixtures/hermes-agent/tools/transcription_tools.py new file mode 100644 index 00000000..4f04b14b --- /dev/null +++ b/testing/fixtures/hermes-agent/tools/transcription_tools.py @@ -0,0 +1,28 @@ +"""Pinned local-command STT envelope anchor used by image-patch tests.""" + +import contextlib +from pathlib import Path + + +class _Logger: + def info(self, *args): + return None + + +logger = _Logger() + + +def _transcribe_local_command(file_path, normalized_model, output_dir): + try: + with contextlib.nullcontext(output_dir): + txt_files = sorted(Path(output_dir).glob("*.txt")) + transcript_text = txt_files[0].read_text(encoding="utf-8").strip() + logger.info( + "Transcribed %s via local STT command (%s, %d chars)", + Path(file_path).name, + normalized_model, + len(transcript_text), + ) + return {"success": True, "transcript": transcript_text, "provider": "local_command"} + except OSError as error: + return {"success": False, "transcript": "", "error": str(error)} diff --git a/testing/fixtures/hermes-webui-0.52.181/api/config.py b/testing/fixtures/hermes-webui-0.52.181/api/config.py new file mode 100644 index 00000000..98bd4888 --- /dev/null +++ b/testing/fixtures/hermes-webui-0.52.181/api/config.py @@ -0,0 +1,10 @@ +_SETTINGS_DEFAULTS = { + "tts_voice": "", +} +_SETTINGS_SPEECH_KEYS = { + "tts_voice", +} +UPSTREAM_VALIDATION_FRAGMENT = ''' if k == "tts_voice": + if not isinstance(v, str) or len(v) > 200 or "\x00" in v: + continue +''' diff --git a/testing/fixtures/hermes-webui-0.52.181/api/routes.py b/testing/fixtures/hermes-webui-0.52.181/api/routes.py index de5cf520..499048df 100644 --- a/testing/fixtures/hermes-webui-0.52.181/api/routes.py +++ b/testing/fixtures/hermes-webui-0.52.181/api/routes.py @@ -1,3 +1,41 @@ -def tts(handler, engine): +"""Pinned Atlas TTS route anchors used by image-patch tests.""" + +import json +import os +from urllib.request import ProxyHandler, Request, build_opener + + +class _NoRedirectTtsHandler: + """Placeholder for the upstream no-redirect opener handler.""" + + +class _Logger: + def exception(self, message): + return None + + +logger = _Logger() + + +class _Upstream: + def read(self): + return b"RIFFsynthetic" + + def __enter__(self): + return self + + def __exit__(self, *exc_info): + return False + + +def _buffer_tts_audio_response(response): + return response.read() + + +def _tts_open(req, *, timeout=30, opener_factory=None): + return _Upstream() + + +def _handle_tts(handler, data, text, rate_str, engine): # ── ElevenLabs TTS ────────────────────────────────────────────────── - return False + return None diff --git a/testing/fixtures/hermes-webui-0.52.181/api/upload.py b/testing/fixtures/hermes-webui-0.52.181/api/upload.py new file mode 100644 index 00000000..582cebbe --- /dev/null +++ b/testing/fixtures/hermes-webui-0.52.181/api/upload.py @@ -0,0 +1,13 @@ +"""Pinned upstream /api/transcribe response anchor used by image-patch tests.""" + + +def j(handler, payload, status=200): + return {"status": status, "payload": payload} + + +def handle_transcribe(handler, result): + try: + transcript = str(result.get('transcript') or '').strip() + return j(handler, {'ok': True, 'transcript': transcript}) + except ValueError as error: + return j(handler, {'error': str(error)}, status=400) diff --git a/testing/fixtures/hermes-webui-0.52.181/static/boot.js b/testing/fixtures/hermes-webui-0.52.181/static/boot.js new file mode 100644 index 00000000..88541e22 --- /dev/null +++ b/testing/fixtures/hermes-webui-0.52.181/static/boot.js @@ -0,0 +1,34 @@ +function speakWithRegisteredEngine(){ + const _opts={ + voice: localStorage.getItem("hermes-tts-voice")||'', + rate: parseFloat(localStorage.getItem("hermes-tts-rate")), + }; + return _opts; +} +function speakWithEdge(clean){ + const voice=localStorage.getItem("hermes-tts-voice")||"zh-CN-XiaoxiaoNeural"; + const rate=''; + const pitch=''; + return fetch('/api/tts', { + body: JSON.stringify({text: clean, voice, rate, pitch}) + }); +} +function speakWithBrowser(clean){ + const utter=new SpeechSynthesisUtterance(clean); + const savedVoice=localStorage.getItem('hermes-tts-voice'); + const voices=speechSynthesis.getVoices(); + if(savedVoice&&voices.length){ + const match=voices.find(v=>v.name===savedVoice); + if(match) utter.voice=match; + } + return utter; +} +function _mirrorSpeechSettingsFromServer(s){ + const defaults={ + tts_voice:'', + }; + [ + ['tts_voice','hermes-tts-voice'], + ].forEach(([settingKey,storageKey])=>localStorage.setItem(storageKey,s[settingKey])); + return defaults; +} diff --git a/testing/fixtures/hermes-webui-0.52.181/static/i18n.js b/testing/fixtures/hermes-webui-0.52.181/static/i18n.js new file mode 100644 index 00000000..aa558ec1 --- /dev/null +++ b/testing/fixtures/hermes-webui-0.52.181/static/i18n.js @@ -0,0 +1,4 @@ +const EN = { + settings_label_tts_voice: 'Voice', + settings_desc_tts_voice: "Preferred voice. Populated from your browser's available voices.", +}; diff --git a/testing/fixtures/hermes-webui-0.52.181/static/index.html b/testing/fixtures/hermes-webui-0.52.181/static/index.html index 6eb7f63d..b8ff3aca 100644 --- a/testing/fixtures/hermes-webui-0.52.181/static/index.html +++ b/testing/fixtures/hermes-webui-0.52.181/static/index.html @@ -5,6 +5,12 @@ +
+ +
Preferred voice. Populated from your browser's available voices.
+