feat(asr-pipeline): merge PR #1 webauth/CSRF/locking hardening and web_password fallback

2026-11-02 06:37:33 -08:00
parent 9debd1c47d
commit 3c70861463
44 changed files with 4354 additions and 333 deletions
@@ -0,0 +1,16 @@
+# 现网路径快照。模板参数 %I 与旧 asr-refine 路径保持原样，不要在本仓库直接启用。
+[Unit]
+Description=Prepare or publish Web-reviewed ASR draft %I
+After=network-online.target asr-review-web.service
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+WorkingDirectory=/home/claw/claude-workspace/OBSIDIAN/asr-pipeline
+EnvironmentFile=/home/claw/claude-workspace/OBSIDIAN/bin/.asr-refine.env
+Environment=PYTHONDONTWRITEBYTECODE=1
+Environment=PATH=/usr/local/bin:/usr/bin:/bin
+ExecStart=/home/claw/claude-workspace/OBSIDIAN/asr-pipeline/bin/asr-refine revise %I
+TimeoutStartSec=900
+UMask=0077
+MemoryMax=512M
@@ -0,0 +1,31 @@
+# 现网路径快照。ExecStart / EnvironmentFile / 工作目录保持原样，不要在本仓库直接启用。
+[Unit]
+Description=Persistent ASR recording intake and review UI
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+WorkingDirectory=/home/claw/claude-workspace/OBSIDIAN/asr-pipeline
+Environment=PYTHONDONTWRITEBYTECODE=1
+Environment=PATH=/usr/local/bin:/usr/bin:/bin
+ExecStart=/home/claw/claude-workspace/OBSIDIAN/asr-pipeline/.venv/bin/python -m asrpipe.control_web
+Environment=PYTHONPATH=/home/claw/claude-workspace/OBSIDIAN/asr-pipeline
+Environment=ASR_RECORDINGS_ROOT=/home/claw/claude-workspace/OBSIDIAN/recordings
+Restart=on-failure
+RestartSec=3
+TimeoutStopSec=10
+UMask=0077
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=read-only
+ReadWritePaths=/home/claw/claude-workspace/OBSIDIAN/asr-pipeline/state
+ReadWritePaths=/home/claw/claude-workspace/OBSIDIAN/logs
+ReadWritePaths=/home/claw/claude-workspace/OBSIDIAN/recordings/inbox
+ReadWritePaths=/home/claw/claude-workspace/OBSIDIAN/recordings/state
+MemoryMax=192M
+TasksMax=32
+
+[Install]
+WantedBy=default.target
@@ -0,0 +1,15 @@
+# 现网路径快照。EnvironmentFile 与 ExecStart 指向旧目录，保持原样，不要在本仓库直接启用。
+[Unit]
+Description=Refine new ASR transcripts into Obsidian drafts (standalone, no agent CLI)
+After=network-online.target
+
+[Service]
+Type=oneshot
+# Credentials only. The program needs no agent CLI, no login state, no OAuth —
+# just this token and a network route. Token rotation = edit this one file.
+EnvironmentFile=/home/claw/claude-workspace/OBSIDIAN/bin/.asr-refine.env
+Environment=PATH=/usr/local/bin:/usr/bin:/bin
+ExecStart=/home/claw/claude-workspace/OBSIDIAN/asr-pipeline/bin/asr-refine run-all
+# A long meeting is ~90 chunks; S2 is parallel but S4 is one serial strong-model
+# call, so allow a generous window for a batch of transcripts.
+TimeoutStartSec=3600
@@ -0,0 +1,14 @@
+[Unit]
+Description=Watch Obsidian .asr-inbox for new finished transcripts
+
+[Path]
+# Fires when a finished transcript file is mv'd into .asr-inbox/ (dir mtime changes).
+# Markers under .state/ and staging in .incoming/ live in subdirs, so they don't refire.
+PathModified=/home/claw/obsidian-vault/.asr-inbox
+# 2026-07-25: switched from obsidian-asr-refine.service (headless `claude -p`) to the
+# standalone pipeline. The old unit + obsidian-asr-refine.sh are kept intact; to roll
+# back, point Unit= back at obsidian-asr-refine.service and daemon-reload.
+Unit=obsidian-asr-refine-native.service
+
+[Install]
+WantedBy=default.target
@@ -0,0 +1,20 @@
+# 现网路径快照。ExecStart 与 MEETING_ASR_BACKEND 保持原样，不要在本仓库直接启用。
+[Unit]
+Description=Obsidian Meeting Recording Watcher (audio inbox -> ASR -> bridge to .asr-inbox)
+After=network-online.target
+
+[Service]
+Type=simple
+ExecStart=/usr/bin/python3 /home/claw/claude-workspace/OBSIDIAN/recordings/bin/meeting-watch.py
+Restart=always
+RestartSec=10
+WorkingDirectory=/home/claw/claude-workspace/OBSIDIAN/recordings
+Environment=PYTHONUNBUFFERED=1
+Environment=MEETING_INBOX_BASE=/home/claw/claude-workspace/OBSIDIAN/recordings
+Environment=MEETING_WEBHOOK_URL=http://127.0.0.1:8644/webhooks/meeting-recording
+# ASR backend trial (2026-06-26): route live pipeline through VibeVoice 分角色.
+# Revert: remove this line (or set =qwen3) + daemon-reload + restart.
+Environment=MEETING_ASR_BACKEND=qwen3cam
+
+[Install]
+WantedBy=default.target