fix: full review pass (main process, voice pipeline, Hermes client, HUD) and e2e-validated local voice (v2.1.0.1)

Electron main
- utility-process channel: sherpa output copied into V8 buffers (Electron rejects external
  buffers), audio exchanged as base64; worker restart on timeout, identity-safe exit handling,
  deterministic native unload by restart
- webhook: loopback by default without secret, UTF-8-safe body assembly, clean restart, port validation
- files IPC: realpath-based root check, openPath allow-list (reveal-only outside document folders),
  Windows reserved names; store: debounced async atomic writes with backup of corrupt files;
  logger: streaming writes with rotation; log message size cap
- HTTP stream proxy: socket released on idle timeout / renderer destroyed, id validation
- model manager: inactivity timeout, retrying rm/rename (Windows locks), engine stopped before
  replacing a model; WAV decoder handles float/24-bit; IPC payload validation
- window: opaque rounded window on Windows, navigation lock-down, visibility events;
  Ctrl+Alt+Escape instead of the Task Manager shortcut; single-instance guard; EVEFLOW_USER_DATA

Voice pipeline
- abort semantics (SendHandle.aborted), abort before the stream opens, session id prefixes per transport
- hands-free re-arm after replies without speech, start/stop race, no chime on auto re-arm,
  no silence shipped to STT (400 ms pre-roll), no transcription of empty manual stops
- TTS: bounded prefetch, cancellable segments, non-interrupting notices, volume applied at play time
- SSE CRLF split, usage in chat completions, finish_reason length, phonetic regex hoisted

HUD
- core renderer: no canvas shadows, cached colours, reusable spectrum buffer, theme read on change,
  30 fps idle, stops when the window is hidden; ping flashes on send / tool / speech
- deltas coalesced per animation frame; stable auto-scroll; narrow selectors everywhere
- bundled fonts (offline), reduce-motion fix, error toasts, ops drawer below 1180 px,
  interim transcript and first-token latency in the core caption, Ctrl+K, dialog semantics,
  switch/aria roles, compact widget cleanup, Whisper small recommended for French
- docs/ROADMAP.md: audit results, e2e results and the plan towards a real JARVIS

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017Wn5VX9HNbJ7N54hR24u9Y

electron/voice/catalog.ts

@@ -22,7 +22,7 @@ export const VOICE_CATALOG: VoiceModelSpec[] = [
     kind: 'stt',
     engine: 'whisper',
     name: 'Whisper base (multilingue)',
-    description: 'Rapide sur CPU, bonne qualité en français pour des commandes courtes.',
+    description: 'Le plus rapide sur CPU ; précision moyenne en français, suffisante pour des commandes courtes.',
     languages: ['fr', 'en', 'multi'],
     sizeMb: 208,
     url: `${ASR}/sherpa-onnx-whisper-base.tar.bz2`,
@@ -35,12 +35,13 @@ export const VOICE_CATALOG: VoiceModelSpec[] = [
     kind: 'stt',
     engine: 'whisper',
     name: 'Whisper small (multilingue)',
-    description: 'Plus précis que base, environ trois fois plus lent.',
+    description: 'Recommandé pour le français : nettement plus précis que base, environ trois fois plus lent.',
     languages: ['fr', 'en', 'multi'],
     sizeMb: 640,
     url: `${ASR}/sherpa-onnx-whisper-small.tar.bz2`,
     dir: 'sherpa-onnx-whisper-small',
-    files: ['small-encoder.int8.onnx', 'small-decoder.int8.onnx', 'small-tokens.txt']
+    files: ['small-encoder.int8.onnx', 'small-decoder.int8.onnx', 'small-tokens.txt'],
+    recommended: true
   },
   {
     id: 'whisper-turbo',

electron/voice/engine.ts

@@ -19,13 +19,22 @@ let child: UtilityProcess | null = null;
 let nextId = 1;
 const pending = new Map<number, Pending>();
 
+function rejectAll(message: string): void {
+  for (const [id, p] of pending) {
+    clearTimeout(p.timer);
+    p.reject(new Error(message));
+    pending.delete(id);
+  }
+}
+
 function spawn(): UtilityProcess {
   if (child) return child;
   const script = path.join(__dirname, 'voice-worker.js');
-  child = utilityProcess.fork(script, [], { serviceName: 'eveflow-voice', stdio: 'pipe' });
-  child.stdout?.on('data', (d: Buffer) => log('DEBUG', 'voice-worker', d.toString().trim()));
-  child.stderr?.on('data', (d: Buffer) => log('WARN', 'voice-worker', d.toString().trim()));
-  child.on('message', (msg: { id: number; ok: boolean; result?: unknown; error?: string }) => {
+  const proc = utilityProcess.fork(script, [], { serviceName: 'eveflow-voice', stdio: 'pipe' });
+  child = proc;
+  proc.stdout?.on('data', (d: Buffer) => log('DEBUG', 'voice-worker', d.toString().trim()));
+  proc.stderr?.on('data', (d: Buffer) => log('WARN', 'voice-worker', d.toString().trim()));
+  proc.on('message', (msg: { id: number; ok: boolean; result?: unknown; error?: string }) => {
     const p = pending.get(msg.id);
     if (!p) return;
     pending.delete(msg.id);
@@ -33,17 +42,15 @@ function spawn(): UtilityProcess {
     if (msg.ok) p.resolve(msg.result);
     else p.reject(new Error(msg.error ?? 'erreur moteur vocal'));
   });
-  child.on('exit', (code) => {
+  proc.on('exit', (code) => {
     log(code === 0 ? 'INFO' : 'ERROR', 'voice-worker', `exited with code ${code}`);
+    // A newer worker may already have replaced this one; only clean up if we are still current.
+    if (child !== proc) return;
     child = null;
-    for (const [id, p] of pending) {
-      clearTimeout(p.timer);
-      p.reject(new Error('Le moteur vocal local s’est arrêté de façon inattendue.'));
-      pending.delete(id);
-    }
+    rejectAll('Le moteur vocal local s’est arrêté de façon inattendue.');
   });
   log('INFO', 'voice', 'voice worker started');
-  return child;
+  return proc;
 }
 
 function request<T>(message: Record<string, unknown>, timeoutMs = 120_000): Promise<T> {
@@ -53,9 +60,20 @@ function request<T>(message: Record<string, unknown>, timeoutMs = 120_000): Prom
     const timer = setTimeout(() => {
       pending.delete(id);
       reject(new Error('Délai dépassé pour le moteur vocal local.'));
+      // The worker handles requests synchronously: a stuck request wedges everything behind it.
+      if (child === proc) {
+        log('WARN', 'voice', 'worker unresponsive, restarting');
+        stopEngine();
+      }
     }, timeoutMs);
     pending.set(id, { resolve: (v) => resolve(v as T), reject, timer });
-    proc.postMessage({ id, ...message });
+    try {
+      proc.postMessage({ id, ...message });
+    } catch (err) {
+      pending.delete(id);
+      clearTimeout(timer);
+      reject(err as Error);
+    }
   });
 }
 
@@ -76,21 +94,31 @@ export async function engineStatus(): Promise<VoiceEngineStatus> {
 }
 
 export function transcribe(req: TranscribeRequest): Promise<TranscribeResult> {
-  return request<TranscribeResult>({ type: 'transcribe', model: modelRef(req.modelId), wav: req.wav, language: req.language }, 180_000);
+  // Binary payloads are base64-encoded for the worker: the utility process channel rejects external buffers.
+  const wav = Buffer.from(req.wav.buffer, req.wav.byteOffset, req.wav.byteLength).toString('base64');
+  return request<TranscribeResult>({ type: 'transcribe', model: modelRef(req.modelId), wav, language: req.language }, 180_000);
 }
 
-export function synthesize(req: SynthesizeRequest): Promise<SynthesizeResult> {
-  return request<SynthesizeResult>({ type: 'synthesize', model: modelRef(req.modelId), text: req.text, speaker: req.speaker, speed: req.speed }, 180_000);
+export async function synthesize(req: SynthesizeRequest): Promise<SynthesizeResult> {
+  const result = await request<Omit<SynthesizeResult, 'wav'> & { wav: string }>(
+    { type: 'synthesize', model: modelRef(req.modelId), text: req.text, speaker: req.speaker, speed: req.speed },
+    180_000
+  );
+  const buffer = Buffer.from(result.wav, 'base64');
+  return { ...result, wav: new Uint8Array(buffer.buffer, buffer.byteOffset, buffer.byteLength) };
 }
 
-export function unload(modelId?: string): Promise<unknown> {
-  if (!child) return Promise.resolve({ ok: true });
-  return request({ type: 'unload', modelId }, 20_000);
+/** Native model memory is only released deterministically by restarting the worker. */
+export function unload(_modelId?: string): Promise<unknown> {
+  stopEngine();
+  return Promise.resolve({ ok: true });
 }
 
 export function stopEngine(): void {
-  if (child) {
-    child.kill();
-    child = null;
+  const proc = child;
+  child = null;
+  if (proc) {
+    rejectAll('Moteur vocal redémarré.');
+    proc.kill();
   }
 }

electron/voice/ipc.ts

@@ -16,7 +16,15 @@ export function registerVoiceIpc(): void {
     await removeModel(id);
     return listModels();
   });
-  ipcMain.handle(VOICE_IPC.transcribe, (_e, req: TranscribeRequest) => transcribe(req));
-  ipcMain.handle(VOICE_IPC.synthesize, (_e, req: SynthesizeRequest) => synthesize(req));
+  ipcMain.handle(VOICE_IPC.transcribe, (_e, req: TranscribeRequest) => {
+    if (!req || !(req.wav instanceof Uint8Array) || req.wav.byteLength < 44 || req.wav.byteLength > 64 * 1024 * 1024) throw new Error('Audio invalide');
+    if (typeof req.modelId !== 'string') throw new Error('Modèle invalide');
+    return transcribe({ ...req, language: typeof req.language === 'string' ? req.language.slice(0, 8) : 'auto' });
+  });
+  ipcMain.handle(VOICE_IPC.synthesize, (_e, req: SynthesizeRequest) => {
+    if (!req || typeof req.text !== 'string' || !req.text.trim() || req.text.length > 5000) throw new Error('Texte invalide');
+    if (typeof req.modelId !== 'string') throw new Error('Modèle invalide');
+    return synthesize({ ...req, speaker: Number.isFinite(req.speaker) ? req.speaker : 0, speed: Number.isFinite(req.speed) ? req.speed : 1 });
+  });
   ipcMain.handle(VOICE_IPC.unload, (_e, id?: string) => unload(id));
 }

electron/voice/models.ts

@@ -11,9 +11,13 @@ import * as tar from 'tar';
 import unbzip2 from 'unbzip2-stream';
 import { VOICE_IPC, type VoiceDownloadProgress, type VoiceModelSpec, type VoiceModelStatus } from '../../shared/voice';
 import { VOICE_CATALOG, findModel } from './catalog';
+import { stopEngine } from './engine';
 import { log } from '../logger';
 
 const active = new Map<string, AbortController>();
+/** Windows keeps files locked briefly (AV scans, memory-mapped models): retry removals. */
+const RM = { recursive: true, force: true, maxRetries: 10, retryDelay: 200 } as const;
+const DOWNLOAD_IDLE_MS = 60_000;
 
 export function modelsDir(): string {
   const dir = path.join(app.getPath('userData'), 'models');
@@ -59,7 +63,8 @@ export function listModels(): VoiceModelStatus[] {
 export async function removeModel(id: string): Promise<void> {
   const spec = findModel(id);
   if (!spec) throw new Error(`Modèle inconnu : ${id}`);
-  await fs.promises.rm(modelDir(spec), { recursive: true, force: true });
+  stopEngine(); // releases memory-mapped model files before deleting them
+  await fs.promises.rm(modelDir(spec), RM);
   log('INFO', 'voice', `model removed: ${id}`);
 }
 
@@ -78,8 +83,14 @@ export async function downloadModel(id: string, sender: WebContents | null): Pro
   };
 
   const tmpDir = path.join(modelsDir(), `.tmp-${spec.id}`);
-  await fs.promises.rm(tmpDir, { recursive: true, force: true });
+  await fs.promises.rm(tmpDir, RM);
   await fs.promises.mkdir(tmpDir, { recursive: true });
+  // Abort the transfer when no byte arrives for a while (fetch itself has no inactivity timeout).
+  let idleTimer: ReturnType<typeof setTimeout> | null = null;
+  const touch = () => {
+    if (idleTimer) clearTimeout(idleTimer);
+    idleTimer = setTimeout(() => controller.abort(new Error('Téléchargement interrompu (aucune donnée reçue)')), DOWNLOAD_IDLE_MS);
+  };
 
   try {
     log('INFO', 'voice', `downloading ${spec.id} from ${spec.url}`);
@@ -88,9 +99,11 @@ export async function downloadModel(id: string, sender: WebContents | null): Pro
     const total = Number(response.headers.get('content-length')) || Math.round(spec.sizeMb * 1024 * 1024);
     let received = 0;
     let lastReport = 0;
+    touch();
     const counter = new Transform({
       transform(chunk: Buffer, _enc, cb) {
         received += chunk.length;
+        touch();
         const now = Date.now();
         if (now - lastReport > 250) {
           lastReport = now;
@@ -116,19 +129,30 @@ export async function downloadModel(id: string, sender: WebContents | null): Pro
     if (missing.length) throw new Error(`Archive incomplète, fichiers manquants : ${missing.join(', ')}`);
 
     const finalDir = modelDir(spec);
-    await fs.promises.rm(finalDir, { recursive: true, force: true });
-    await fs.promises.rename(extracted, finalDir);
-    await fs.promises.rm(tmpDir, { recursive: true, force: true });
+    if (isInstalled(spec)) stopEngine();
+    await fs.promises.rm(finalDir, RM);
+    for (let attempt = 0; ; attempt++) {
+      try {
+        await fs.promises.rename(extracted, finalDir);
+        break;
+      } catch (err) {
+        const code = (err as NodeJS.ErrnoException).code ?? '';
+        if (attempt >= 10 || !['EPERM', 'EBUSY', 'ENOTEMPTY', 'EACCES'].includes(code)) throw err;
+        await new Promise((r) => setTimeout(r, 300));
+      }
+    }
+    await fs.promises.rm(tmpDir, RM);
     report({ phase: 'done', received: total, total, percent: 100 });
     log('INFO', 'voice', `model installed: ${spec.id}`);
   } catch (err) {
-    await fs.promises.rm(tmpDir, { recursive: true, force: true }).catch(() => undefined);
-    const e = err as Error;
-    const cancelled = e.name === 'AbortError' || controller.signal.aborted;
+    await fs.promises.rm(tmpDir, RM).catch(() => undefined);
+    const e = (controller.signal.reason instanceof Error ? controller.signal.reason : err) as Error;
+    const cancelled = (e.name === 'AbortError' || controller.signal.aborted) && !(controller.signal.reason instanceof Error);
     report({ phase: cancelled ? 'cancelled' : 'error', received: 0, total: 0, percent: 0, message: cancelled ? 'annulé' : e.message });
     log(cancelled ? 'INFO' : 'ERROR', 'voice', `download ${spec.id} ${cancelled ? 'cancelled' : 'failed: ' + e.message}`);
     if (!cancelled) throw new Error(e.message);
   } finally {
+    if (idleTimer) clearTimeout(idleTimer);
     active.delete(id);
   }
   return listModels().find((m) => m.id === id)!;

electron/voice/worker.ts

@@ -16,7 +16,7 @@ interface ModelRef {
 
 type Request =
   | { id: number; type: 'status' }
-  | { id: number; type: 'transcribe'; model: ModelRef; wav: Uint8Array; language: string }
+  | { id: number; type: 'transcribe'; model: ModelRef; wav: Uint8Array | string; language: string }
   | { id: number; type: 'synthesize'; model: ModelRef; text: string; speaker: number; speed: number }
   | { id: number; type: 'unload'; modelId?: string };
 
@@ -32,7 +32,7 @@ type Sherpa = {
   OfflineTts: new (config: unknown) => {
     numSpeakers: number;
     sampleRate: number;
-    generate: (req: { text: string; sid: number; speed: number }) => { samples: Float32Array; sampleRate: number };
+    generate: (req: { text: string; sid: number; speed: number; enableExternalBuffer?: boolean }) => { samples: Float32Array; sampleRate: number };
   };
   version: string;
 };
@@ -136,16 +136,20 @@ function getSynthesizer(model: ModelRef) {
 // ── audio helpers ──────────────────────────────────────────────────────────
 function decodeWav(bytes: Uint8Array): { samples: Float32Array; sampleRate: number } {
   const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
-  if (String.fromCharCode(bytes[0], bytes[1], bytes[2], bytes[3]) !== 'RIFF') throw new Error('WAV invalide');
+  if (String.fromCharCode(bytes[0], bytes[1], bytes[2], bytes[3]) !== 'RIFF' || String.fromCharCode(bytes[8], bytes[9], bytes[10], bytes[11]) !== 'WAVE') {
+    throw new Error('WAV invalide');
+  }
   let offset = 12;
   let sampleRate = 16000;
   let channels = 1;
   let bits = 16;
+  let format = 1; // 1 = PCM, 3 = IEEE float
   let data: { start: number; length: number } | null = null;
   while (offset + 8 <= bytes.byteLength) {
     const id = String.fromCharCode(bytes[offset], bytes[offset + 1], bytes[offset + 2], bytes[offset + 3]);
     const size = view.getUint32(offset + 4, true);
     if (id === 'fmt ') {
+      format = view.getUint16(offset + 8, true);
       channels = view.getUint16(offset + 10, true);
       sampleRate = view.getUint32(offset + 12, true);
       bits = view.getUint16(offset + 22, true);
@@ -163,7 +167,16 @@ function decodeWav(bytes: Uint8Array): { samples: Float32Array; sampleRate: numb
     let sum = 0;
     for (let c = 0; c < channels; c++) {
       const pos = data.start + (i * channels + c) * bytesPerSample;
-      sum += bits === 16 ? view.getInt16(pos, true) / 32768 : bits === 32 ? view.getInt32(pos, true) / 2147483648 : (bytes[pos] - 128) / 128;
+      sum +=
+        format === 3 && bits === 32
+          ? view.getFloat32(pos, true)
+          : bits === 16
+            ? view.getInt16(pos, true) / 32768
+            : bits === 24
+              ? (((bytes[pos] | (bytes[pos + 1] << 8) | (bytes[pos + 2] << 16)) << 8) >> 8) / 8388608
+              : bits === 32
+                ? view.getInt32(pos, true) / 2147483648
+                : (bytes[pos] - 128) / 128;
     }
     samples[i] = sum / channels;
   }
@@ -225,8 +238,11 @@ function handle(req: Request): unknown {
     }
     case 'transcribe': {
       const started = Date.now();
-      const { samples, sampleRate } = decodeWav(req.wav);
+      // Audio crosses the process boundary as base64: V8 refuses to serialize external buffers.
+      const bytes = typeof req.wav === 'string' ? new Uint8Array(Buffer.from(req.wav, 'base64')) : req.wav;
+      const { samples, sampleRate } = decodeWav(bytes);
       const pcm = resampleTo16k(samples, sampleRate);
+      if (pcm.length < 1600) throw new Error('Audio trop court');
       const recognizer = getRecognizer(req.model, req.language);
       const stream = recognizer.createStream();
       stream.acceptWaveform({ sampleRate: 16000, samples: pcm });
@@ -238,8 +254,15 @@ function handle(req: Request): unknown {
       const started = Date.now();
       const tts = getSynthesizer(req.model);
       const sid = Math.max(0, Math.min(tts.numSpeakers - 1, Math.floor(req.speaker)));
-      const audio = tts.generate({ text: req.text, sid, speed: Math.max(0.5, Math.min(2, req.speed || 1)) });
-      return { wav: encodeWav(audio.samples, audio.sampleRate), sampleRate: audio.sampleRate, durationMs: Date.now() - started, audioSec: audio.samples.length / audio.sampleRate };
+      // Electron forbids N-API external buffers: ask sherpa-onnx to copy the samples into a V8 buffer.
+      const audio = tts.generate({ text: req.text, sid, speed: Math.max(0.5, Math.min(2, req.speed || 1)), enableExternalBuffer: false });
+      const wav = encodeWav(audio.samples, audio.sampleRate);
+      return {
+        wav: Buffer.from(wav.buffer, wav.byteOffset, wav.byteLength).toString('base64'),
+        sampleRate: audio.sampleRate,
+        durationMs: Date.now() - started,
+        audioSec: audio.samples.length / audio.sampleRate
+      };
     }
     case 'unload': {
       if (req.modelId) {