Compare commits

..
7 Commits
Author SHA1 Message Date
Palash DebnathandClaude Opus 4.8 fa64dcaa92 chore(release): v0.3.4 (#269)
Patch release. Version bumped across all sources + lock files; [0.3.4] CHANGELOG.

Ships:
- #255 — PyTorch-Whisper backend works as a standalone fallback (no cuDNN 8,
  no OMNIVOICE_PRELOAD_TTS_ASR=1), unblocking Windows+NVIDIA users hitting the
  cudnn_ops_infer64_8.dll error.

Tagging v0.3.4 triggers release.yml (desktop) + docker.yml.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-03 08:31:34 +05:30
Palash DebnathandClaude Opus 4.8 63a0d00f09 fix(asr): PyTorch-Whisper fallback works without cuDNN 8 or preload (#255) (#268)
Windows + NVIDIA users hit `Could not locate cudnn_ops_infer64_8.dll`:
WhisperX/faster-whisper run on CTranslate2, which needs cuDNN 8, but PyTorch
2.8 ships cuDNN 9 and the side-loaded `cudnn8_compat` libs were missing from
the venv. The PyTorch-Whisper backend should have been the fallback, but it
errored "set OMNIVOICE_PRELOAD_TTS_ASR=1" because it only worked when the TTS
model preloaded an ASR head.

- `PyTorchWhisperBackend._ensure_pipe()` now builds its OWN transformers ASR
  pipeline on demand (PyTorch stack → cuDNN 9, no CTranslate2/cuDNN-8), without
  loading the full TTS model and without the preload env var. A constructor-
  passed pipe (when the TTS model already has one) is still reused. Model is
  overridable via OMNIVOICE_PYTORCH_ASR_MODEL.
- dub_core transcribe preflight no longer hard-rejects pytorch-whisper when no
  pipe is preloaded — it lazy-loads; any failure surfaces per-chunk with the
  real cause.

So a Windows box without cuDNN 8 can switch ASR backend to "PyTorch Whisper"
in Settings → Models and transcription works. Docs: troubleshooting entry.

Tests: tests/test_pytorch_whisper_fallback.py (lazy standalone build, reuse of
a passed pipe, no get_model() call, env override). Full tests/ suite: 700 pass.

Does NOT close #255 — pending the reporter confirming the fallback works on
their machine; the cuDNN-8 install gap (faster-whisper path) is a follow-up.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-03 08:23:58 +05:30
Palash DebnathandClaude Opus 4.8 4e65774610 chore(release): v0.3.3 (#267)
Patch release. Bumps version across all sources + lock files; adds [0.3.3]
CHANGELOG.

Ships:
- #262 — Settings → About now shows the server's CPU architecture (was the
  client browser's platform, e.g. "Win32", in Docker).
- Validates the bash-3.2 checksum CI fix on a real release (the macOS
  SHA256SUMS should now upload automatically).

Tagging v0.3.3 triggers release.yml (desktop) + docker.yml (GHCR
:0.3.3/:0.3/:latest).

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-03 07:13:34 +05:30
Palash DebnathandClaude Opus 4.8 e740786a08 fix(about): show server CPU arch, not the client browser's platform (#262) (#266)
Settings → About → Architecture rendered `navigator.platform` — the *client
browser's* OS. In the Docker/web build that's the remote machine (e.g. "Win32"
when browsing from Windows), not the container, which is misleading.

Expose the server's `platform.machine()` as `arch` on /system/info and render
that instead, so the row reflects the machine OmniVoice actually runs on — for
both the desktop app (local backend) and Docker.

Note: the *blank* version/GPU/RAM/VRAM in the same report were the loopback-gate
403s fixed in v0.3.2 (#261); this PR fixes the remaining architecture row.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-03 07:06:30 +05:30
Palash DebnathandClaude Opus 4.8 35b62ad0c0 fix(ci): make SHA-256 checksum step bash-3.2 safe (macOS runner) (#265)
The "Compute SHA-256 checksums" step used `mapfile -t` (a bash 4+ builtin) but
macOS GitHub runners execute `shell: bash` as /bin/bash 3.2, which has no
`mapfile`. The step exited 127 ("mapfile: command not found") on the macOS leg,
so `SHA256SUMS-macOS Apple Silicon.txt` was never produced/uploaded for v0.3.1
and v0.3.2 (the binaries themselves shipped fine; only the macOS checksum file
was missing and had to be regenerated by hand each time).

Replace `mapfile` with a portable `while IFS= read -r … done < <(find … | sort)`
loop (works on bash 3.2). Verified on bash 3.2.57: builds the array correctly,
handles spaces in bundle filenames. Linux/Windows legs are unaffected.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-03 06:56:42 +05:30
Palash DebnathandClaude Opus 4.8 27b4e151e1 chore(release): v0.3.2 (#264)
Patch release. Bumps the version across all sources + lock files and adds the
[0.3.2] CHANGELOG section.

Ships:
- #261 — "Loopback origin required" 403s in the Docker admin UI (and blank
  version): the image now runs in OMNIVOICE_SERVER_MODE so the loopback gate
  is relaxed for the headless deployment; desktop loopback boundary unchanged.

Tagging v0.3.2 triggers release.yml (desktop) and docker.yml (GHCR
:0.3.2/:0.3/:latest).

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-03 06:30:27 +05:30
Palash DebnathandClaude Opus 4.8 b4f1fe18d7 fix(server): relax loopback gate in headless server mode so Docker admin UI works (#261) (#263)
In Docker the loopback origin gate (`require_loopback`) is unenforceable:
Docker's NAT rewrites `request.client.host` to the bridge gateway (e.g.
172.17.0.1) even for a localhost-only `-p 127.0.0.1:3900:3900` mapping, so every
request looks non-loopback. The gate then 403s the operator out of the routes
the web UI needs — `/system/*` (incl. `/system/info`, which left the version
blank, re-breaking #249 in Docker) and `/api/settings/*` (HF-token entry) —
surfacing as "Loopback origin required" all over the UI.

Fix: add an explicit, opt-in `OMNIVOICE_SERVER_MODE` flag. When set,
`require_loopback` becomes a no-op; exposure is then governed by the operator's
port mapping plus the optional share PIN (NetworkAccessMiddleware still 401s
unauthenticated non-loopback clients whenever a PIN is set). The Docker image
sets `OMNIVOICE_SERVER_MODE=1` (Dockerfile + documented in compose).

Security: the desktop build NEVER sets this, so its loopback boundary is
unchanged — LAN share guests are still denied the admin/system routes. New
unit tests lock the contract (strict 403 by default incl. the PR #81 vectors;
relaxed only under the flag). Existing non-loopback 403 tests still pass.

Docs: docker.md troubleshooting entry for "Loopback origin required".

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-03 06:22:25 +05:30
23 changed files with 309 additions and 34 deletions
+7 -1
View File
@@ -540,7 +540,13 @@ jobs:
# Gather artifact paths per matrix leg's `bundles` (msi/app/dmg/deb/appimage/updater).
# `find` is portable across all three runners (Git Bash on Windows).
mapfile -t ARTIFACTS < <(find "$BUNDLE_DIR" -type f \
# NB: macOS runners use /bin/bash 3.2, which has no `mapfile` (a bash 4+
# builtin) — using it 127'd this step and dropped the macOS SHA256SUMS
# for v0.3.1 and v0.3.2. A `while read` loop is portable to bash 3.2.
ARTIFACTS=()
while IFS= read -r artifact; do
ARTIFACTS+=("$artifact")
done < <(find "$BUNDLE_DIR" -type f \
\( -name "*.dmg" -o -name "*.app.tar.gz" -o -name "*.app.tar.gz.sig" \
-o -name "*.msi" -o -name "*.msi.sig" \
-o -name "*.AppImage" -o -name "*.AppImage.sig" \
+39
View File
@@ -6,6 +6,45 @@ The format is loosely based on [Keep a Changelog](https://keepachangelog.com/).
Versions track the desktop app (`tauri.conf.json` + `frontend/src-tauri/Cargo.toml`).
The bundled TTS model package (`pyproject.toml`) is versioned independently.
## [0.3.4] — 2026-06-03
### Fixed
- **Transcription on Windows + NVIDIA failed with `Could not locate
cudnn_ops_infer64_8.dll`.** WhisperX/faster-whisper need cuDNN 8 (via
CTranslate2); when the side-loaded `cudnn8_compat` libs are missing, the
**PyTorch Whisper** backend (Settings → Models) now works as a drop-in
fallback — it builds its own transformers pipeline on PyTorch's cuDNN-9
stack, with no CTranslate2/cuDNN-8 dependency and no
`OMNIVOICE_PRELOAD_TTS_ASR=1` required. (#255)
## [0.3.3] — 2026-06-03
### Fixed
- **Settings → About showed the wrong architecture in the Docker/web build.**
The "Architecture" row rendered the *client browser's* platform
(`navigator.platform` → e.g. "Win32"); it now reports the **server's** CPU
architecture from the backend (`platform.machine()`), correct for both the
desktop app and Docker. The blank version/GPU/RAM/VRAM in the same report
were the loopback-gate 403s already fixed in v0.3.2. (#262)
### CI
- The release SHA-256 checksum step no longer uses `mapfile` (a bash 4+
builtin) — it broke on the macOS runner's bash 3.2 and dropped the macOS
`SHA256SUMS` for v0.3.1/v0.3.2. Now portable to bash 3.2.
## [0.3.2] — 2026-06-03
### Fixed
- **"Loopback origin required" all over the Docker UI** (and a blank version).
The `/system/*` and `/api/settings/*` routes are restricted to a loopback
origin, but Docker's NAT makes every request look non-loopback, so the gate
403'd the operator out of the admin UI — including `/system/info` (blanking
the version) and HF-token entry. The Docker image now runs with
`OMNIVOICE_SERVER_MODE=1`, which relaxes the gate for the headless
deployment; exposure is governed by the `-p` port mapping plus the optional
share PIN. Desktop builds are unaffected — their loopback boundary (and the
denial of admin routes to LAN share guests) is unchanged. (#261)
## [0.3.1] — 2026-06-03
First tagged build of the 0.3 line off `main` — it ships the accumulated
+35 -3
View File
@@ -5,9 +5,12 @@ These are intentionally tiny — one concern per dependency — so they can be
composed at the route or router level without surprises.
Currently exposed:
- `require_loopback`: 403 unless the request came from a loopback origin.
- `require_loopback`: 403 unless the request came from a loopback origin
(bypassed in explicit server mode — see `_server_mode`).
"""
import os
from fastapi import HTTPException, Request
@@ -19,6 +22,28 @@ from fastapi import HTTPException, Request
# the guard: nothing here matches a non-loopback origin.
_LOOPBACK_HOSTS = frozenset({"127.0.0.1", "::1", "localhost"})
_TRUTHY = frozenset({"1", "true", "yes", "on"})
def _server_mode() -> bool:
"""Whether this process is a headless server deployment (Docker image).
In Docker the loopback gate is *unenforceable*: Docker's network NAT
rewrites ``request.client.host`` to the bridge gateway (e.g. 172.17.0.1)
even for a localhost-only ``-p 127.0.0.1:3900:3900`` mapping, so every
request looks non-loopback and the gate 403s the operator out of the
system/settings routes they need (issue #261 — incl. ``/system/info``,
which blanks the version display).
The Docker image sets ``OMNIVOICE_SERVER_MODE=1`` to opt out of the gate.
Network exposure then rests on the operator's port mapping plus the
optional share PIN (``NetworkAccessMiddleware`` still 401s unauthenticated
non-loopback clients whenever a PIN is set). The desktop build never sets
this, so its loopback boundary — including denying LAN share guests access
to admin routes — is unchanged. Read at call time so it stays testable.
"""
return os.environ.get("OMNIVOICE_SERVER_MODE", "").strip().lower() in _TRUTHY
def require_loopback(request: Request) -> None:
"""Reject any request whose `client.host` is not a loopback address.
@@ -35,7 +60,14 @@ def require_loopback(request: Request) -> None:
Returns None on success (FastAPI dependency convention). Raises 403
on rejection — the response body is `{"detail": "loopback origin required"}`
so existing tests for `/system/set-env` keep passing without modification.
In server mode (Docker, see `_server_mode`) the gate is a no-op: the
loopback origin is unenforceable there and exposure is governed by the
deployment's port mapping + the optional share PIN instead.
"""
host = request.client.host if request.client else None
if host not in _LOOPBACK_HOSTS:
raise HTTPException(status_code=403, detail="loopback origin required")
if host in _LOOPBACK_HOSTS:
return
if _server_mode():
return
raise HTTPException(status_code=403, detail="loopback origin required")
+4 -5
View File
@@ -404,12 +404,11 @@ async def dub_transcribe_stream(job_id: str):
else:
from services.asr_backend import get_active_asr_backend
try:
# The PyTorch-Whisper backend lazily builds its own pipeline
# when no preloaded `_asr_pipe` is present (issue #255), so it
# no longer needs OMNIVOICE_PRELOAD_TTS_ASR=1 — don't reject it
# here; any load failure surfaces per-chunk with a real cause.
_asr_backend = get_active_asr_backend(asr_pipe=getattr(_model, "_asr_pipe", None))
if _asr_backend.id == "pytorch-whisper" and getattr(_model, "_asr_pipe", None) is None:
preflight_error = (
"No ASR backend is ready. Install WhisperX/faster-whisper/MLX Whisper "
"or set OMNIVOICE_PRELOAD_TTS_ASR=1 before launch to use the PyTorch fallback."
)
except Exception as e:
from core.failure import build_failure
f = build_failure(e, stage="transcribe-preflight", include_diagnostic=False)
+3
View File
@@ -1,5 +1,6 @@
import os
import sys
import platform
import uuid
import psutil
import asyncio
@@ -181,6 +182,7 @@ def system_info():
"device": get_best_device(),
"python": sys.version.split()[0],
"platform": sys.platform,
"arch": platform.machine(),
"ffmpeg_ok": bool(_ffmpeg),
"ffmpeg_path": _ffmpeg or "",
"proxy_url": os.environ.get("HTTP_PROXY") or os.environ.get("http_proxy") or "",
@@ -207,6 +209,7 @@ def system_info():
"device": "cpu",
"python": sys.version.split()[0],
"platform": sys.platform,
"arch": platform.machine(),
"proxy_url": "",
"share_enabled": network_share.get_state().enabled,
"share_port": network_share.get_state().share_port,
+1
View File
@@ -37,6 +37,7 @@ class SystemInfoResponse(BaseModel):
device: str = "cpu"
python: str = ""
platform: str = ""
arch: str = ""
error: str | None = None
ffmpeg_ok: bool = False
ffmpeg_path: str = ""
+1 -1
View File
@@ -12,4 +12,4 @@ from importlib.metadata import PackageNotFoundError, version
try:
APP_VERSION = version("omnivoice")
except PackageNotFoundError: # non-installed source checkout
APP_VERSION = "0.3.1"
APP_VERSION = "0.3.4"
+26 -16
View File
@@ -577,22 +577,32 @@ class PyTorchWhisperBackend(ASRBackend):
def _ensure_pipe(self):
if self._pipe is not None:
return
# Fall back to grabbing the TTS model's ASR head.
import asyncio
from services.model_manager import get_model
try:
loop = asyncio.get_running_loop()
if loop.is_running():
raise RuntimeError(
"PyTorchWhisperBackend needs the ASR pipe — pass it via constructor "
"when calling from an async context."
)
model = loop.run_until_complete(get_model())
except RuntimeError:
model = asyncio.run(get_model())
self._pipe = getattr(model, "_asr_pipe", None)
if self._pipe is None:
raise RuntimeError("Loaded TTS model has no `_asr_pipe` attribute.")
# Build a standalone transformers Whisper pipeline on demand. This runs
# on PyTorch's own stack (cuDNN 9 ships with torch), so it works as a
# fallback on machines where WhisperX / faster-whisper can't load
# cuDNN 8 (the `cudnn_ops_infer64_8.dll` failure, issue #255) — and it
# needs neither OMNIVOICE_PRELOAD_TTS_ASR=1 nor a loaded TTS model.
# When the TTS model already has an ASR head, dub_core passes it via the
# constructor and this path is skipped.
import torch
from transformers import pipeline as hf_pipeline
from services.model_manager import get_best_device
model_name = os.environ.get(
"OMNIVOICE_PYTORCH_ASR_MODEL", "openai/whisper-large-v3-turbo"
)
device = get_best_device()
asr_dtype = torch.float16 if str(device).startswith("cuda") else torch.float32
logger.info(
"PyTorchWhisperBackend: loading standalone ASR pipeline %s on %s",
model_name, device,
)
self._pipe = hf_pipeline(
"automatic-speech-recognition",
model=model_name,
dtype=asr_dtype,
device_map=device,
)
def transcribe(self, audio_path: str, *, word_timestamps: bool = True) -> dict:
import soundfile as sf
+7
View File
@@ -29,6 +29,13 @@ ENV HF_HOME=/app/omnivoice_data/huggingface
# Allow bare imports (from core.config, from services.*, etc.) when
# uvicorn is started as `backend.main:app` from WORKDIR /app.
ENV PYTHONPATH=/app/backend
# Headless server deployment: relax the desktop-only loopback origin gate.
# Docker's network NAT rewrites the client host to the bridge gateway, so the
# gate would otherwise 403 the operator out of /system/* and /api/settings/*
# ("Loopback origin required", issue #261). Exposure is governed by the
# operator's `-p` port mapping plus the optional share PIN. Desktop builds
# never set this, so their loopback boundary is unchanged.
ENV OMNIVOICE_SERVER_MODE=1
# Install system dependencies (FFmpeg is critical for torchaudio/scene splitting)
RUN apt-get update && apt-get install -y --no-install-recommends \
+9
View File
@@ -46,6 +46,12 @@ services:
# OMNIVOICE_BIND_HOST=0.0.0.0 here only opens the container's own
# interface. The backend default is 127.0.0.1 (see backend/main.py).
- OMNIVOICE_BIND_HOST=0.0.0.0
# Headless server: relax the desktop-only loopback origin gate so the
# web UI's /system/* and /api/settings/* routes work through Docker's
# NAT (issue #261). Already baked into the image; shown here so it's
# discoverable. If you front the container with your own auth proxy on
# loopback, set this to 0 to re-enable the strict gate.
- OMNIVOICE_SERVER_MODE=1
healthcheck:
test: ["CMD", "curl", "-sf", "http://localhost:3900/health"]
interval: 30s
@@ -76,6 +82,9 @@ services:
# service above. The host-side `127.0.0.1:3900:3900` mapping keeps
# LAN reachability off by default.
- OMNIVOICE_BIND_HOST=0.0.0.0
# See the CPU service above — relaxes the loopback origin gate for the
# headless Docker deployment (issue #261). Set to 0 to re-enable it.
- OMNIVOICE_SERVER_MODE=1
healthcheck:
test: ["CMD", "curl", "-sf", "http://localhost:3900/health"]
interval: 30s
+9
View File
@@ -118,6 +118,15 @@ Two paths are worth persisting across container restarts:
The running version is now shown in **Settings → About → Version** (read live
from the backend), so the web UI no longer displays a dash in Docker.
- **Checking which version is running:** `docker exec omnivoice python -c "import importlib.metadata; print(importlib.metadata.version('omnivoice'))"`, or hit the `/health` endpoint — it returns `{"status": "ok", "device": ..., "version": "0.3.x"}`.
- **"Loopback origin required" errors (and a blank version):** the desktop
build restricts the `/system/*` and `/api/settings/*` routes to a loopback
origin, but Docker's NAT makes every request look non-loopback, so the gate
used to 403 the whole admin UI (issue #261). The image now ships with
`OMNIVOICE_SERVER_MODE=1`, which relaxes that gate for the headless
deployment — exposure is instead governed by your `-p` port mapping (keep the
`127.0.0.1:` prefix to stay local) plus the optional share PIN. If you front
the container with your own auth proxy on loopback, set `OMNIVOICE_SERVER_MODE=0`
to re-enable the strict gate.
- **Media-preview 404 in LAN mode:** see the [LAN access](#lan-access) section
above — the `window.location.host` fix shipped in v0.3.
- **GPU not detected:** verify `docker run --rm --gpus all nvidia/cuda:12.8.0-base-ubuntu22.04 nvidia-smi` succeeds first.
+18 -1
View File
@@ -121,7 +121,24 @@ falling back to faster-whisper`.
path and is still fast. If you want the latest CT2 wheels, run `uv sync`
from a fresh source checkout.
## 10. IndexTTS / CosyVoice / ChatterboxTTS clash
## 10. Windows: `Could not locate cudnn_ops_infer64_8.dll` during transcription
**Symptom:** on Windows + NVIDIA, transcription/dubbing fails and the backend
log shows `Could not locate cudnn_ops_infer64_8.dll`. Settings → Models shows
WhisperX or faster-whisper selected.
**Cause:** WhisperX and faster-whisper run on **CTranslate2**, which needs
**cuDNN 8**, but PyTorch 2.8 ships cuDNN 9. OmniVoice side-loads a cuDNN-8 copy
from `.venv\Lib\site-packages\cudnn8_compat\`; if that folder is missing
(some upgrade paths don't install it), CTranslate2 can't find the DLL.
**Fix:** switch the ASR backend to **PyTorch Whisper** in **Settings → Models**.
It runs on PyTorch's own stack (cuDNN 9, bundled with torch) and needs no
cuDNN-8 DLL — it loads its Whisper pipeline on demand (no extra env var). To
keep using faster-whisper/WhisperX instead, reinstall to restore the bundled
`cudnn8_compat` libraries.
## 11. IndexTTS / CosyVoice / ChatterboxTTS clash
**Symptom:** installing one of these engines breaks the others — e.g. after
installing CosyVoice, IndexTTS errors out with import conflicts.
+1 -1
View File
@@ -1,7 +1,7 @@
{
"name": "omnivoice-studio",
"private": true,
"version": "0.3.1",
"version": "0.3.4",
"type": "module",
"scripts": {
"dev": "vite",
+1 -1
View File
@@ -2878,7 +2878,7 @@ dependencies = [
[[package]]
name = "omnivoice-studio"
version = "0.3.1"
version = "0.3.4"
dependencies = [
"dirs-next",
"enigo",
+1 -1
View File
@@ -1,6 +1,6 @@
[package]
name = "omnivoice-studio"
version = "0.3.1"
version = "0.3.4"
description = "OmniVoice Studio AI voice cloning & dubbing desktop app"
authors = ["Debpalash"]
license = "AGPL-3.0"
+1 -1
View File
@@ -1,7 +1,7 @@
{
"$schema": "../node_modules/@tauri-apps/cli/config.schema.json",
"productName": "OmniVoice Studio",
"version": "0.3.1",
"version": "0.3.4",
"identifier": "com.debpalash.omnivoice-studio",
"build": {
"frontendDist": "../dist",
+1
View File
@@ -60,6 +60,7 @@ export interface SystemInfo {
app_version?: string;
python?: string;
platform?: string;
arch?: string;
device?: string;
data_dir?: string;
outputs_dir?: string;
+1 -1
View File
@@ -1355,7 +1355,7 @@ export default function Settings() {
<Row label={t('about.version')} value={appVersion || info?.app_version || '—'} mono />
<Row label={t('about.tauri_runtime')} value={tauriVersion || (isTauri() ? '—' : t('about.web_preview'))} mono />
<Row label={t('about.platform')} value={info?.platform || '—'} />
<Row label={t('about.architecture')} value={typeof navigator !== 'undefined' ? (navigator.userAgentData?.platform || navigator.platform || '—') : '—'} mono />
<Row label={t('about.architecture')} value={info?.arch || '—'} mono />
<Row label={t('about.python')} value={info?.python || '—'} mono />
<Row label={t('about.compute_device')} value={info?.device || '—'} mono />
<Row label={t('about.gpu_active')} value={hw?.gpu_active
+1 -1
View File
@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
[project]
name = "omnivoice"
version = "0.3.1"
version = "0.3.4"
description = "OmniVoice: Towards Omnilingual Zero-Shot Text-to-Speech with Diffusion Language Models"
readme = "README.md"
# Source-available under FSL-1.1-ALv2 (see LICENSE); each release converts to
+55
View File
@@ -0,0 +1,55 @@
"""`require_loopback` gate contract (issue #261).
The gate must stay strict on the desktop build (non-loopback 403, which is the
PR #81 trust boundary), but become a no-op in the headless Docker server mode,
where Docker's NAT makes the loopback origin unenforceable and exposure is
governed by the port mapping + the share PIN instead.
"""
from types import SimpleNamespace
import pytest
from fastapi import HTTPException
from api.dependencies import require_loopback
def _req(host):
"""Minimal stand-in for a Starlette Request — the gate only reads client.host."""
return SimpleNamespace(client=SimpleNamespace(host=host) if host else None)
@pytest.fixture(autouse=True)
def _clear_server_mode(monkeypatch):
# Start each test from the desktop default regardless of the ambient env.
monkeypatch.delenv("OMNIVOICE_SERVER_MODE", raising=False)
@pytest.mark.parametrize("host", ["127.0.0.1", "::1", "localhost"])
def test_loopback_always_allowed(host):
require_loopback(_req(host)) # must not raise
def test_non_loopback_rejected_by_default():
with pytest.raises(HTTPException) as exc:
require_loopback(_req("172.17.0.1")) # Docker bridge gateway
assert exc.value.status_code == 403
assert "loopback" in str(exc.value.detail).lower()
def test_missing_client_rejected_by_default():
with pytest.raises(HTTPException):
require_loopback(_req(None))
@pytest.mark.parametrize("val", ["1", "true", "TRUE", "yes", "on"])
def test_server_mode_allows_non_loopback(monkeypatch, val):
monkeypatch.setenv("OMNIVOICE_SERVER_MODE", val)
require_loopback(_req("172.17.0.1")) # must not raise
require_loopback(_req("127.0.0.1")) # loopback still fine
@pytest.mark.parametrize("val", ["0", "false", "no", "", "off"])
def test_falsey_server_mode_keeps_gate_strict(monkeypatch, val):
monkeypatch.setenv("OMNIVOICE_SERVER_MODE", val)
with pytest.raises(HTTPException):
require_loopback(_req("10.0.0.5"))
+83
View File
@@ -0,0 +1,83 @@
"""PyTorch-Whisper backend must work as a standalone fallback (issue #255).
On machines where WhisperX / faster-whisper can't load cuDNN 8
(`cudnn_ops_infer64_8.dll` missing), the PyTorch-Whisper backend should build
its own transformers pipeline on demand without OMNIVOICE_PRELOAD_TTS_ASR=1
and without loading the full TTS model.
"""
import sys
import types
import pytest
from services import asr_backend as ab
def test_is_available_when_transformers_present():
ok, msg = ab.PyTorchWhisperBackend.is_available()
assert ok is True
assert msg == "ready"
def test_reuses_constructor_pipe_without_building(monkeypatch):
sentinel = object()
be = ab.PyTorchWhisperBackend(asr_pipe=sentinel)
def _boom(*a, **k):
raise AssertionError("must not build a pipeline when one was passed in")
# transformers.pipeline is imported lazily inside _ensure_pipe.
fake_tf = types.ModuleType("transformers")
fake_tf.pipeline = _boom
monkeypatch.setitem(sys.modules, "transformers", fake_tf)
be._ensure_pipe()
assert be._pipe is sentinel
def test_lazy_builds_standalone_pipeline(monkeypatch):
"""No preloaded pipe → build a standalone transformers ASR pipeline, with no
call into the TTS model loader (get_model)."""
captured = {}
def fake_pipeline(task, **kw):
captured["task"] = task
captured["kw"] = kw
return lambda *a, **k: {"chunks": []}
fake_tf = types.ModuleType("transformers")
fake_tf.pipeline = fake_pipeline
monkeypatch.setitem(sys.modules, "transformers", fake_tf)
monkeypatch.setattr("services.model_manager.get_best_device", lambda: "cpu")
# Guard: building the standalone pipe must NOT pull in the full TTS model.
import services.model_manager as mm
def _no_get_model(*a, **k):
raise AssertionError("standalone ASR build must not call get_model()")
monkeypatch.setattr(mm, "get_model", _no_get_model, raising=False)
be = ab.PyTorchWhisperBackend(asr_pipe=None)
be._ensure_pipe()
assert be._pipe is not None
assert captured["task"] == "automatic-speech-recognition"
assert captured["kw"]["model"] # a concrete model name was chosen
def test_pytorch_asr_model_overridable_via_env(monkeypatch):
captured = {}
def fake_pipeline(task, **kw):
captured["kw"] = kw
return object()
fake_tf = types.ModuleType("transformers")
fake_tf.pipeline = fake_pipeline
monkeypatch.setitem(sys.modules, "transformers", fake_tf)
monkeypatch.setattr("services.model_manager.get_best_device", lambda: "cpu")
monkeypatch.setenv("OMNIVOICE_PYTORCH_ASR_MODEL", "openai/whisper-small")
ab.PyTorchWhisperBackend(asr_pipe=None)._ensure_pipe()
assert captured["kw"]["model"] == "openai/whisper-small"
+4
View File
@@ -37,6 +37,10 @@ def test_system_info_smoke(client):
# running version from here so it shows the real version, not a dash (#249).
from core.version import APP_VERSION
assert body["app_version"] == APP_VERSION
# Settings → About → Architecture must reflect the SERVER's machine, not the
# client browser's navigator.platform (which showed "Win32" in Docker, #262).
import platform as _pf
assert body["arch"] == _pf.machine()
def test_health_exposes_version(client):
Generated
+1 -1
View File
@@ -3058,7 +3058,7 @@ wheels = [
[[package]]
name = "omnivoice"
version = "0.3.1"
version = "0.3.4"
source = { editable = "." }
dependencies = [
{ name = "accelerate" },