Picks up the shared Plugin Runtime fix that nests nsjail worker cgroups
under the Runtime's own cgroup so the Pod memory limit bounds every
sandbox (LANG-287, langbot-app/langbot-plugin-sdk#207).
Co-authored-by: Claude Opus 5.5 <[email protected]>
Co-authored-by: multica-agent <[email protected]>
* feat(speech): implement TTS and STT model layer and pipeline stages (LANG-251)
Co-authored-by: multica-agent <[email protected]>
* fix(speech): fix invoke signatures and provider lookup in speech stages and model testing
Co-authored-by: multica-agent <[email protected]>
* feat(speech): rename STT to ASR, improve TTS voice parameter handling and failure recovery
Co-authored-by: multica-agent <[email protected]>
* fix(persistence, lint, web): fix migration revision id, legacy table check, ruff duplicates, and frontend types
Co-authored-by: multica-agent <[email protected]>
* fix(speech): restore migration and CI contracts
Co-authored-by: multica-agent <[email protected]>
* fix(pipeline,ui): fix select dropdown width gap, add speech to guided tour, and configure show_if for speech options
Co-authored-by: multica-agent <[email protected]>
* feat(speech,openclaw): support silk audio transcoding, graceful fallback, duration estimation, and multi-lang deploy docs
Co-authored-by: multica-agent <[email protected]>
* fix(audio): enhance ffmpeg executable detection via venv and imageio_ffmpeg
Co-authored-by: multica-agent <[email protected]>
* fix(provider): improve LiteLLM error classification and avoid falling back to Unknown error
Co-authored-by: multica-agent <[email protected]>
* fix(openclaw): serialize voice_item attributes and improve transcoding fallback logging
Co-authored-by: multica-agent <[email protected]>
* fix(audio,openclaw): handle transient TMPDIR deletion and add size attribute to voice_item
Co-authored-by: multica-agent <[email protected]>
* fix(openclaw): download and convert inbound voice messages and align voice sending protocol
Co-authored-by: multica-agent <[email protected]>
* fix(models): redesign add model popover tabs layout and include ASR/TTS models in provider counts and scanning
Co-authored-by: multica-agent <[email protected]>
* fix(audio): decrypt and transcode wecombot voice to mp3, align openclaw weixin voice delivery
Co-authored-by: multica-agent <[email protected]>
* fix(wecombot): transcode outbound voice to silk and support voice_delivery mode
Co-authored-by: multica-agent <[email protected]>
* fix(discord,web): map audio attachments to voice for ASR, prefer base64 voice in webui
Co-authored-by: multica-agent <[email protected]>
* fix(telegram): deliver voice replies in streaming and non-streaming modes with quote origin
Co-authored-by: multica-agent <[email protected]>
* feat(dingtalk): route voice messages through pipeline ASR and send TTS replies as voice
Inbound DingTalk audio now arrives as a Voice component with its duration,
so the pipeline speech recognition switch decides how it is transcribed.
DingTalk's own recognition text is used only when the audio cannot be
downloaded.
Outbound Voice components are transcoded to ogg/opus, uploaded as voice
media and sent as native sampleAudio messages in both the omni and legacy
adapters. Audio over 60 seconds, or audio that cannot be transcoded or is
rejected as a voice message, is sent as a file instead. Voice parts no longer
leak into the reply text as "[Voice]".
Also estimate ogg durations from the granule position and ignore non-audio
MIME hints when extracting voice bytes, so ffmpeg can probe the input.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-authored-by: multica-agent <[email protected]>
* fix(ci): include speech model counts in provider responses and fix lint/image build
- Copy every count returned by get_provider_model_counts into the provider
payload instead of indexing asr_count/tts_count, and update the test fakes
to return the speech model counts.
- Install libc6-dev in the runtime image so the pilk audio extra can compile.
- Apply ruff and prettier formatting required by the lint jobs.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-authored-by: multica-agent <[email protected]>
* test(e2e): expect the speech step in the pipeline setup guide
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-authored-by: multica-agent <[email protected]>
---------
Co-authored-by: multica-agent <[email protected]>
Co-authored-by: Claude Opus 5.5 <[email protected]>
The declared floor was python-multipart>=0.0.27 while uv.lock resolves 0.0.32.
0.0.27 falls inside four published advisories, so any resolve that honours the
floor rather than the lock can land on a vulnerable release:
- GHSA-5rvq-cxj2-64vf / GHSA-6jv3-5f52-599m / GHSA-vffw-93wf-4j4q (quadratic-time
querystring DoS, semicolon field-separator and Content-Disposition parameter
smuggling), fixed in 0.0.30
- GHSA-v9pg-7xvm-68hf (negative Content-Length buffers the entire body), fixed in
0.0.31
The locked 0.0.32 has no known advisories. Raising the floor to match the lock
costs nothing and keeps the two from drifting apart.
Reachability, for the record: multipart parsing happens on the skills and plugin
local-upload routes, both of which require USER_TOKEN_OR_API_KEY with
RESOURCE_MANAGE, so this is an authenticated-admin DoS rather than an anonymous
one.
The resolved version is unchanged; only the requirement metadata moves.
Co-authored-by: multica-agent <[email protected]>
Set client_info_tag='langbot' on the Valkey Search vector store's glide
client, so CLIENT SETINFO LIB-NAME reports GlidePy(langbot) and operators
can attribute Valkey usage to LangBot. client_name is unchanged.
client_info_tag was added in valkey-glide 2.5.2, so raise the floor from
>=2.4.1 to >=2.5.2 (pyproject, install hint, docs) and regenerate uv.lock.
Carries the plugin worker process label: workers now show `--tag
author/plugin_name` in ps/htop, including the nsjail supervisor row.
Verified locally: the published wheel hash matches the pin, the shared runtime
launches workers with the tag, plugins register and knowledge retrieval is
unaffected.
Pick up the shared-worker startup and installation-binding fixes released as
langbot-plugin 0.7.5 (tag v0.7.5), so Core deployments stop installing the
0.7.4 wheel that cannot launch shared pool workers and drops the installation
binding on plugin dispatches and relays.
