fix: full review pass (main process, voice pipeline, Hermes client, HUD) and e2e-validated local voice (v2.1.0.1)

Electron main
- utility-process channel: sherpa output copied into V8 buffers (Electron rejects external
  buffers), audio exchanged as base64; worker restart on timeout, identity-safe exit handling,
  deterministic native unload by restart
- webhook: loopback by default without secret, UTF-8-safe body assembly, clean restart, port validation
- files IPC: realpath-based root check, openPath allow-list (reveal-only outside document folders),
  Windows reserved names; store: debounced async atomic writes with backup of corrupt files;
  logger: streaming writes with rotation; log message size cap
- HTTP stream proxy: socket released on idle timeout / renderer destroyed, id validation
- model manager: inactivity timeout, retrying rm/rename (Windows locks), engine stopped before
  replacing a model; WAV decoder handles float/24-bit; IPC payload validation
- window: opaque rounded window on Windows, navigation lock-down, visibility events;
  Ctrl+Alt+Escape instead of the Task Manager shortcut; single-instance guard; EVEFLOW_USER_DATA

Voice pipeline
- abort semantics (SendHandle.aborted), abort before the stream opens, session id prefixes per transport
- hands-free re-arm after replies without speech, start/stop race, no chime on auto re-arm,
  no silence shipped to STT (400 ms pre-roll), no transcription of empty manual stops
- TTS: bounded prefetch, cancellable segments, non-interrupting notices, volume applied at play time
- SSE CRLF split, usage in chat completions, finish_reason length, phonetic regex hoisted

HUD
- core renderer: no canvas shadows, cached colours, reusable spectrum buffer, theme read on change,
  30 fps idle, stops when the window is hidden; ping flashes on send / tool / speech
- deltas coalesced per animation frame; stable auto-scroll; narrow selectors everywhere
- bundled fonts (offline), reduce-motion fix, error toasts, ops drawer below 1180 px,
  interim transcript and first-token latency in the core caption, Ctrl+K, dialog semantics,
  switch/aria roles, compact widget cleanup, Whisper small recommended for French
- docs/ROADMAP.md: audit results, e2e results and the plan towards a real JARVIS

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017Wn5VX9HNbJ7N54hR24u9Y

electron/webhook.ts

@@ -35,16 +35,20 @@ export function getWebhookStatus(): WebhookStatus {
 export function stopWebhookServer(): Promise<void> {
   return new Promise((resolve) => {
     if (!server) return resolve();
-    server.close(() => resolve());
+    const current = server;
     server = null;
     status = { ...status, listening: false };
+    current.closeAllConnections();
+    current.close(() => resolve());
   });
 }
 
 export async function startWebhookServer(getWindow: () => BrowserWindow | null, options: WebhookOptions): Promise<WebhookStatus> {
   await stopWebhookServer();
   const { port, secret } = options;
-  const host = options.host ?? '0.0.0.0';
+  // Without a shared secret the hook only listens on loopback: anyone on the LAN could otherwise inject messages.
+  const host = options.host ?? (secret ? '0.0.0.0' : '127.0.0.1');
+  if (host !== '127.0.0.1' && !secret) log('WARN', 'webhook', `listening on ${host} without a secret`);
 
   server = http.createServer((req, res) => {
     const json = (code: number, payload: unknown) => {
@@ -69,19 +73,24 @@ export async function startWebhookServer(getWindow: () => BrowserWindow | null,
       }
     }
 
-    let body = '';
+    const chunks: Buffer[] = [];
+    let bytes = 0;
     let tooLarge = false;
     req.on('data', (chunk: Buffer) => {
       if (tooLarge) return;
-      body += chunk.toString('utf8');
-      if (body.length > MAX_BODY_BYTES) {
+      bytes += chunk.length;
+      if (bytes > MAX_BODY_BYTES) {
         tooLarge = true;
-        json(413, { error: 'Payload too large' });
-        req.destroy();
+        res.writeHead(413, { 'Content-Type': 'application/json', Connection: 'close' });
+        res.end(JSON.stringify({ error: 'Payload too large' }), () => req.socket.destroy());
+        return;
       }
+      chunks.push(chunk);
     });
     req.on('end', () => {
       if (tooLarge) return;
+      // Concatenate before decoding so multibyte UTF-8 (accents, emoji) split across chunks stays intact.
+      const body = Buffer.concat(chunks).toString('utf8');
       try {
         const raw: unknown = body.trim() ? JSON.parse(body) : {};
         const events = normalizeHermesPush(raw);
@@ -99,13 +108,18 @@ export async function startWebhookServer(getWindow: () => BrowserWindow | null,
   });
 
   return new Promise((resolve) => {
-    server!.once('error', (err: NodeJS.ErrnoException) => {
+    const instance = server!;
+    instance.on('error', (err: NodeJS.ErrnoException) => {
       log('ERROR', 'webhook', `server error: ${err.message}`);
       status = { listening: false, port, path: WEBHOOK_PATH, secretConfigured: !!secret, error: err.message };
-      server = null;
+      if (server === instance) server = null;
       resolve(status);
     });
-    server!.listen(port, host, () => {
+    if (!Number.isInteger(port) || port < 1 || port > 65535) {
+      instance.emit('error', new Error(`port invalide : ${port}`));
+      return;
+    }
+    instance.listen(port, host, () => {
       log('INFO', 'webhook', `listening on http://${host}:${port}${WEBHOOK_PATH}`);
       status = { listening: true, port, path: WEBHOOK_PATH, secretConfigured: !!secret };
       resolve(status);