1095c5679f
Implements all reviewer comments (code-review, red-team, and test-strategy audit), accepting the recommended variants. Server — realtime service (ai-realtime.service.ts): - SSRF: pin the validated IP via a WebSocket `lookup` hook that re-checks every resolved address with isIpAllowed (mirrors external-mcp buildPinnedDispatcher), closing the TOCTOU/DNS-rebinding window; fix the misleading comment. - no-silent-loss: on Stop, drain the in-flight segment (bounded 2.5s) and deliver the final via onFinal before closing instead of dropping the tail. - fail-closed deriveRealtimeUrl: a non-empty unparseable base now THROWS (no silent api.openai.com fallback that would leak a self-hosted key); http://ws:// bases rejected (plaintext key). Path normalization preserved. - parseUpstreamEvent keys the accumulator by item_id+content_index so GA segments don't concatenate. - inject a wsFactory seam for testing; also fix a latent bug — `import WebSocket from 'ws'` resolved to undefined at runtime (no esModuleInterop) -> import=require. - unref idle/max/drain timers. Server — realtime gateway (ai-realtime.gateway.ts, session-limits.ts): - reject revoked/disabled users and inactive sessions (mirror jwt.strategy: findById+isUserDisabled + findActiveById) with NO counter increment. - CSWSH: Origin allowlist (matching APP_URL, or no Origin for native clients) before auth, no increment. - extract SessionCounters (delete-at-zero, never negative) + pure canConnect (both caps >= checked before any increment); document the per-process/in-memory cap caveat (single-replica only). Client: - dictation-group: realtime final now inserts at the captured rangeRef SNAPSHOT (not the live caret) and guards editor.isEditable; single-space separator. - use-realtime-dictation/realtime-dictation-client: stop-during-acquisition tears down the mic (no leak / button reset); reconnect re-emits start (double-start guarded); interim ghost cleared on teardown; io() options de-duplicated. - pcm16-worklet: flush the partial sub-frame tail on stop; one-pole anti-aliasing low-pass before 48k->24k. - extract shared mic-capture (acquireMicStream/mapGetUserMediaError, used by batch + realtime), pure DSP (pcm16-dsp.ts), and the session reducer/baseLanguageSubtag; extract applyInterimMeta/clampRange/resolveUrl/appendFinalToDraft. Tests + infra: +~150 server tests (deriveRealtimeUrl, parseUpstreamEvent branches, openSession/lifecycle/timers/testConnection via fake ws, gateway auth/caps/no-leak, realtime-test admin contract, AiSettings update/resolve, DTO boolean, SSRF deny) and +~140 client tests (DSP property/edge, resampler continuity, framing, reducer, mic-capture, RealtimeDictationClient/MicButton, ProseMirror interim regression + history guards, appendFinalToDraft, resolveKeyField, route contract). Added @vitest/coverage-v8. CHANGELOG [Unreleased] entry incl. the single-replica caveat. Review: APPROVE WITH SUGGESTIONS (no critical/regression); applied the drain-timer unref. Server tsc clean + 358 tests; client tsc clean + 201 tests; vite build ok. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
100 lines
3.0 KiB
JSON
100 lines
3.0 KiB
JSON
{
|
|
"name": "client",
|
|
"private": true,
|
|
"version": "0.93.0",
|
|
"scripts": {
|
|
"dev": "vite",
|
|
"build": "tsc && vite build",
|
|
"lint": "eslint .",
|
|
"preview": "vite preview",
|
|
"format": "prettier --write \"src/**/*.tsx\" \"src/**/*.ts\"",
|
|
"test": "vitest run",
|
|
"test:watch": "vitest"
|
|
},
|
|
"dependencies": {
|
|
"@ai-sdk/react": "^3.0.208",
|
|
"@atlaskit/pragmatic-drag-and-drop": "1.8.1",
|
|
"@atlaskit/pragmatic-drag-and-drop-auto-scroll": "2.1.5",
|
|
"@atlaskit/pragmatic-drag-and-drop-flourish": "2.0.15",
|
|
"@atlaskit/pragmatic-drag-and-drop-hitbox": "1.1.0",
|
|
"@atlaskit/pragmatic-drag-and-drop-live-region": "1.3.4",
|
|
"@casl/react": "5.0.1",
|
|
"@docmost/editor-ext": "workspace:*",
|
|
"@excalidraw/excalidraw": "0.18.0-3a5ef40",
|
|
"@mantine/core": "8.3.18",
|
|
"@mantine/dates": "8.3.18",
|
|
"@mantine/form": "8.3.18",
|
|
"@mantine/hooks": "8.3.18",
|
|
"@mantine/modals": "8.3.18",
|
|
"@mantine/notifications": "8.3.18",
|
|
"@mantine/spotlight": "8.3.18",
|
|
"@slidoapp/emoji-mart": "5.8.7",
|
|
"@slidoapp/emoji-mart-data": "1.2.4",
|
|
"@slidoapp/emoji-mart-react": "1.1.5",
|
|
"@tabler/icons-react": "3.40.0",
|
|
"@tanstack/react-query": "5.90.17",
|
|
"@tanstack/react-virtual": "3.13.24",
|
|
"ai": "6.0.207",
|
|
"alfaaz": "1.1.0",
|
|
"axios": "1.16.0",
|
|
"blueimp-load-image": "5.16.0",
|
|
"clsx": "2.1.1",
|
|
"dompurify": "3.4.1",
|
|
"file-saver": "2.0.5",
|
|
"highlightjs-sap-abap": "0.3.0",
|
|
"i18next": "25.10.1",
|
|
"i18next-http-backend": "3.0.6",
|
|
"jotai": "2.18.1",
|
|
"jotai-optics": "0.4.0",
|
|
"js-cookie": "3.0.7",
|
|
"jwt-decode": "4.0.0",
|
|
"katex": "0.16.40",
|
|
"lowlight": "3.3.0",
|
|
"mantine-form-zod-resolver": "1.3.0",
|
|
"mermaid": "11.15.0",
|
|
"mitt": "3.0.1",
|
|
"posthog-js": "1.372.2",
|
|
"react": "18.3.1",
|
|
"react-clear-modal": "^2.0.18",
|
|
"react-dom": "^18.3.1",
|
|
"react-drawio": "1.0.7",
|
|
"react-error-boundary": "6.1.1",
|
|
"react-helmet-async": "3.0.0",
|
|
"react-i18next": "16.5.8",
|
|
"react-router-dom": "7.13.1",
|
|
"semver": "7.7.4",
|
|
"socket.io-client": "4.8.3",
|
|
"zod": "4.3.6"
|
|
},
|
|
"devDependencies": {
|
|
"@eslint/js": "9.28.0",
|
|
"@tanstack/eslint-plugin-query": "5.94.4",
|
|
"@testing-library/jest-dom": "6.6.0",
|
|
"@testing-library/react": "16.1.0",
|
|
"@types/blueimp-load-image": "5.16.6",
|
|
"@types/file-saver": "2.0.7",
|
|
"@types/js-cookie": "3.0.6",
|
|
"@types/katex": "0.16.8",
|
|
"@types/node": "22.19.1",
|
|
"@types/react": "18.3.12",
|
|
"@types/react-dom": "18.3.1",
|
|
"@vitejs/plugin-react": "6.0.1",
|
|
"@vitest/coverage-v8": "4.1.6",
|
|
"eslint": "9.28.0",
|
|
"eslint-plugin-react": "7.37.5",
|
|
"eslint-plugin-react-hooks": "7.0.1",
|
|
"eslint-plugin-react-refresh": "0.5.2",
|
|
"globals": "15.13.0",
|
|
"jsdom": "25.0.0",
|
|
"optics-ts": "2.4.1",
|
|
"postcss": "8.5.14",
|
|
"postcss-preset-mantine": "1.18.0",
|
|
"postcss-simple-vars": "7.0.1",
|
|
"prettier": "3.8.1",
|
|
"typescript": "5.9.3",
|
|
"typescript-eslint": "8.57.1",
|
|
"vite": "8.0.5",
|
|
"vitest": "4.1.6"
|
|
}
|
|
}
|