dsh-guarded-live-voice

A guarded DeepSeek Harness voice foundation with an exact-session Host boundary
and a lazy browser disclosure UI. Live microphone and audio remain disabled.

Current status

Milestone two adds the browser-side consent surface to the milestone-one Host
boundary:

• a lazy DSH browser module with composer-control and disclosure-panel slots;
• structured Host-to-browser boot data containing only the non-secret WebSocket
  route;
• exact live-session and workspace binding, including id-reuse detection;
• a visible disclosure of destination, exported context, execution authority,
  unknown provider retention, session, workspace, and expiry;
• an explicit button gesture as the included UI path for consuming the hidden,
  expiring, one-shot challenge;
• credential resolution only after that user-visible client-attested acceptance;
• loopback, same-origin, trusted-Host, payload, and connection-count fences;
• fail-closed protocol parsing and deterministic socket, timer, and session
  cleanup; and
• bounded proposal parsing with no execution authority.

Milestone three groundwork adds an internal, configuration-only Qwen session
transport with deterministic fake-provider coverage. It can send only one fixed
text-only, manual-turn configuration event and exposes no audio, transcript,
instruction, tool, DSH context, raw socket, or send capability. The provider
must confirm the exact requested model, session identity, modalities, and turn
detection before the transport reports readiness.

The registered plugin and installed package do not request microphone access,
transmit audio or text, open a Qwen provider connection, perform transcription
or playback, or insert a proposal into the composer. The internal transport is
not exported from the package root and is not called by apply. Binary
WebSocket frames remain rejected. Version 0.2.0 is a development milestone, not
a marketplace-ready voice product.

The disclosure flow is user-visible, but it is not cryptographic proof that a
human accepted it. The one-shot challenge proves control of that local client
connection only. Loopback, Host, Origin, and Sec-Fetch-Site checks mitigate
remote access, DNS rebinding, and cross-site requests; they do not authenticate
a human or resist a malicious same-user local process.

Safety boundary

The registered plugin sends no data to Qwen because it opens no provider
connection. A future audio milestone is designed to exclude DSH history, files,
workspace instructions, memory, and project context. Its provider output may
create only bounded proposal data for the exact bound session. Composer
integration is not implemented yet; when added, it must fill the ordinary draft
without submitting a message, calling a tool, writing a custom session event, or
executing work.

Development

Requirements: Node.js 22.19+ and pnpm 11.7.

pnpm install
pnpm check

pnpm check runs strict Host and browser TypeScript checking, deterministic
tests, Host and browser builds, package linting, browser-bundle materialization,
and a dry-run package-content check.

Development configuration

The bundle inserts a guarded-live-voice Cordis row. A profile override will
need an Alibaba Cloud Model Studio workspace id before provider authorization:

- id: guarded-live-voice
  name: dsh-guarded-live-voice
  config:
    credentialRef: DASHSCOPE_API_KEY
    dashscopeWorkspaceId: your-workspace-id
    model: qwen-audio-3.0-realtime-plus
    route: /guarded-voice
    trustedHosts: localhost,127.0.0.1,[::1]
    maxConnections: 8

After accepted disclosure, the registered plugin validates the allowlisted
endpoint and credential availability only; it does not connect to Qwen. The
internal configuration-only transport will remain outside the public package API
until it is composed behind the same exact authority and consumed-consent
boundary.

Configure the credential through DSH's credential provider. Never put a secret
value in cordis.patch.yml, browser storage, an issue, or a log.

License and provenance

MIT licensed. This repository is a clean-room implementation with new public
history. It does not contain private product source, assets, identifiers, or
repository history.