fix: full review pass (main process, voice pipeline, Hermes client, HUD) and e2e-validated local voice (v2.1.0.1)

Electron main
- utility-process channel: sherpa output copied into V8 buffers (Electron rejects external
  buffers), audio exchanged as base64; worker restart on timeout, identity-safe exit handling,
  deterministic native unload by restart
- webhook: loopback by default without secret, UTF-8-safe body assembly, clean restart, port validation
- files IPC: realpath-based root check, openPath allow-list (reveal-only outside document folders),
  Windows reserved names; store: debounced async atomic writes with backup of corrupt files;
  logger: streaming writes with rotation; log message size cap
- HTTP stream proxy: socket released on idle timeout / renderer destroyed, id validation
- model manager: inactivity timeout, retrying rm/rename (Windows locks), engine stopped before
  replacing a model; WAV decoder handles float/24-bit; IPC payload validation
- window: opaque rounded window on Windows, navigation lock-down, visibility events;
  Ctrl+Alt+Escape instead of the Task Manager shortcut; single-instance guard; EVEFLOW_USER_DATA

Voice pipeline
- abort semantics (SendHandle.aborted), abort before the stream opens, session id prefixes per transport
- hands-free re-arm after replies without speech, start/stop race, no chime on auto re-arm,
  no silence shipped to STT (400 ms pre-roll), no transcription of empty manual stops
- TTS: bounded prefetch, cancellable segments, non-interrupting notices, volume applied at play time
- SSE CRLF split, usage in chat completions, finish_reason length, phonetic regex hoisted

HUD
- core renderer: no canvas shadows, cached colours, reusable spectrum buffer, theme read on change,
  30 fps idle, stops when the window is hidden; ping flashes on send / tool / speech
- deltas coalesced per animation frame; stable auto-scroll; narrow selectors everywhere
- bundled fonts (offline), reduce-motion fix, error toasts, ops drawer below 1180 px,
  interim transcript and first-token latency in the core caption, Ctrl+K, dialog semantics,
  switch/aria roles, compact widget cleanup, Whisper small recommended for French
- docs/ROADMAP.md: audit results, e2e results and the plan towards a real JARVIS

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017Wn5VX9HNbJ7N54hR24u9Y

electron/voice/models.ts

@@ -11,9 +11,13 @@ import * as tar from 'tar';
 import unbzip2 from 'unbzip2-stream';
 import { VOICE_IPC, type VoiceDownloadProgress, type VoiceModelSpec, type VoiceModelStatus } from '../../shared/voice';
 import { VOICE_CATALOG, findModel } from './catalog';
+import { stopEngine } from './engine';
 import { log } from '../logger';
 
 const active = new Map<string, AbortController>();
+/** Windows keeps files locked briefly (AV scans, memory-mapped models): retry removals. */
+const RM = { recursive: true, force: true, maxRetries: 10, retryDelay: 200 } as const;
+const DOWNLOAD_IDLE_MS = 60_000;
 
 export function modelsDir(): string {
   const dir = path.join(app.getPath('userData'), 'models');
@@ -59,7 +63,8 @@ export function listModels(): VoiceModelStatus[] {
 export async function removeModel(id: string): Promise<void> {
   const spec = findModel(id);
   if (!spec) throw new Error(`Modèle inconnu : ${id}`);
-  await fs.promises.rm(modelDir(spec), { recursive: true, force: true });
+  stopEngine(); // releases memory-mapped model files before deleting them
+  await fs.promises.rm(modelDir(spec), RM);
   log('INFO', 'voice', `model removed: ${id}`);
 }
 
@@ -78,8 +83,14 @@ export async function downloadModel(id: string, sender: WebContents | null): Pro
   };
 
   const tmpDir = path.join(modelsDir(), `.tmp-${spec.id}`);
-  await fs.promises.rm(tmpDir, { recursive: true, force: true });
+  await fs.promises.rm(tmpDir, RM);
   await fs.promises.mkdir(tmpDir, { recursive: true });
+  // Abort the transfer when no byte arrives for a while (fetch itself has no inactivity timeout).
+  let idleTimer: ReturnType<typeof setTimeout> | null = null;
+  const touch = () => {
+    if (idleTimer) clearTimeout(idleTimer);
+    idleTimer = setTimeout(() => controller.abort(new Error('Téléchargement interrompu (aucune donnée reçue)')), DOWNLOAD_IDLE_MS);
+  };
 
   try {
     log('INFO', 'voice', `downloading ${spec.id} from ${spec.url}`);
@@ -88,9 +99,11 @@ export async function downloadModel(id: string, sender: WebContents | null): Pro
     const total = Number(response.headers.get('content-length')) || Math.round(spec.sizeMb * 1024 * 1024);
     let received = 0;
     let lastReport = 0;
+    touch();
     const counter = new Transform({
       transform(chunk: Buffer, _enc, cb) {
         received += chunk.length;
+        touch();
         const now = Date.now();
         if (now - lastReport > 250) {
           lastReport = now;
@@ -116,19 +129,30 @@ export async function downloadModel(id: string, sender: WebContents | null): Pro
     if (missing.length) throw new Error(`Archive incomplète, fichiers manquants : ${missing.join(', ')}`);
 
     const finalDir = modelDir(spec);
-    await fs.promises.rm(finalDir, { recursive: true, force: true });
-    await fs.promises.rename(extracted, finalDir);
-    await fs.promises.rm(tmpDir, { recursive: true, force: true });
+    if (isInstalled(spec)) stopEngine();
+    await fs.promises.rm(finalDir, RM);
+    for (let attempt = 0; ; attempt++) {
+      try {
+        await fs.promises.rename(extracted, finalDir);
+        break;
+      } catch (err) {
+        const code = (err as NodeJS.ErrnoException).code ?? '';
+        if (attempt >= 10 || !['EPERM', 'EBUSY', 'ENOTEMPTY', 'EACCES'].includes(code)) throw err;
+        await new Promise((r) => setTimeout(r, 300));
+      }
+    }
+    await fs.promises.rm(tmpDir, RM);
     report({ phase: 'done', received: total, total, percent: 100 });
     log('INFO', 'voice', `model installed: ${spec.id}`);
   } catch (err) {
-    await fs.promises.rm(tmpDir, { recursive: true, force: true }).catch(() => undefined);
-    const e = err as Error;
-    const cancelled = e.name === 'AbortError' || controller.signal.aborted;
+    await fs.promises.rm(tmpDir, RM).catch(() => undefined);
+    const e = (controller.signal.reason instanceof Error ? controller.signal.reason : err) as Error;
+    const cancelled = (e.name === 'AbortError' || controller.signal.aborted) && !(controller.signal.reason instanceof Error);
     report({ phase: cancelled ? 'cancelled' : 'error', received: 0, total: 0, percent: 0, message: cancelled ? 'annulé' : e.message });
     log(cancelled ? 'INFO' : 'ERROR', 'voice', `download ${spec.id} ${cancelled ? 'cancelled' : 'failed: ' + e.message}`);
     if (!cancelled) throw new Error(e.message);
   } finally {
+    if (idleTimer) clearTimeout(idleTimer);
     active.delete(id);
   }
   return listModels().find((m) => m.id === id)!;