@lamplitisles/kepos-speech
Kepos Speech 插件，用于在 DeepSeek Harness Web 中使用阿里巴巴和字节跳动的中文语音合成及短音频识别功能
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add github:LamplitIsles/kepos-speech#76ef81f1190531772480df699044b86fb8ccacc3Kepos Speech 以 @lamplitisles/kepos-speech 发布，当前版本为 0.1.0。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
@lamplitisles/kepos-speech is a DeepSeek Harness Web plugin for Chinese
speech synthesis and short-audio recognition. It adds one optional audio-only
[[tts:text]]...[[/tts:text]] block to a finalized assistant reply, prepares
the resulting MP3, and replaces the block with the browser's native audio
player. The Host service also exposes bounded, synchronous Qwen ASR to trusted
in-process callers.
Locally transcribed user turns use a 🎙️ prefix and can end in a recognized
expression label such as [neutral]. The Speech system prompt defines both as
voice metadata: the marker identifies the source, and the label is an
audio-level ASR classification rather than message content or a claim about the
speaker's inner state.
Source: https://github.com/LamplitIsles/kepos-speech.
dsh plugin --profile <profile> add @lamplitisles/kepos-speech
The package is pinned to the DSH 0.1.2-alpha.3 contract family and contains
the Host entry, browser loader, and cordis.patch.yml bundle patch.
Open the native Kepos Speech Plugin Settings card from a local loopback
DSH Web session and choose Alibaba or ByteDance for tagged TTS output. The
editable Voice IDs default to Maia and
zh_female_sajiaoxuemei_uranus_bigtts; provider-supported IDs up to 128
characters are accepted. The DashScope key is shared by Alibaba TTS and the
fixed Qwen ASR path. The Volcengine key is used only for ByteDance TTS. Both
credential fields are write-only and are stored by DSH as
KEPOS_SPEECH_DASHSCOPE_API_KEY and KEPOS_SPEECH_VOLCENGINE_API_KEY.
The provider selector controls TTS output only. Qwen ASR is the sole recognition provider and accepts one non-empty supported audio attachment up to the documented 10 MB encoded bound. It returns complete text and optional audio-level language and speech-expression annotations; it does not persist audio or transcript content.
When mounted, the plugin publishes the optional Cordis service
ctx.get("keposSpeech"). A Host plugin can consume the exported
KeposSpeechService contract:
const speech = ctx.get("keposSpeech");
if (speech) {
const audio = await speech.synthesize({ sessionId, text }, signal);
// audio.mediaType === "audio/mpeg"; audio.data is bounded MP3 bytes
const transcript = await speech.transcribe({
sessionId,
mediaType: "audio/ogg",
data: attachmentBytes,
language: "zh"
}, signal);
// transcript.text plus optional language/expression annotations
}
The service validates the live session and shares the workspace cache with
browser TTS. It is optional, is removed with the plugin lifecycle, and is not a
public transcription or synthesis route. Browser synthesis uses the
authenticated /kepos-speech/synthesize RPC and same-origin
/kepos-speech/audio/... artifacts.
Each prepared passage is keyed by normalized text, provider profile, and cache
format, then written atomically as
.dsh/kepos-speech/audio/<sha256>.mp3 below the active session workspace. A
refresh or remount resolves the session again and reuses the bounded artifact;
there is no browsing, migration, eviction, or cache-management UI.
The tag-only workflow in .github/workflows/release.yml verifies the exact
package that it publishes. Before the first automated release, a maintainer
must bootstrap a distinct prerelease version, then prepare the first stable
version:
Create or confirm the @lamplitisles npm scope and manually publish the
initial @lamplitisles/kepos-speech@0.1.0-beta.0 package so the package
identity exists. Set package.json to 0.1.0-beta.0, run the bootstrap checks
below from a maintainer workstation, and publish with local npm
authentication:
bun install --frozen-lockfile
bun run typecheck
bun run test
bun run build
GITHUB_REF_NAME=v0.1.0-beta.0 bun run release:check
npm publish --access public --tag beta
This prerelease is deliberately distinct from the later stable 0.1.0;
do not manually publish 0.1.0.
Change package.json to version 0.1.0 and commit that change, then
configure npm Trusted Publishing for
@lamplitisles/kepos-speech, repository
LamplitIsles/kepos-speech, workflow
.github/workflows/release.yml, and the GitHub npm environment.
Create the protected GitHub npm environment with the required approval
policy.
For the first stable trusted publish, rerun the checks with the stable version,
push the committed version change, and create the tag with the supported og
operation (og tag --help describes this as “Create and push a tag”):
bun install --frozen-lockfile
bun run typecheck
bun run test
bun run build
GITHUB_REF_NAME=v0.1.0 bun run release:check
og push
og tag v0.1.0
For each subsequent release, update package.json to the intended version,
run the local checks, push the committed change with og push, and create its
semantic version tag with og tag v<version> (for example, og tag v0.2.0-beta.1). Tags must be v<semver> (for example v0.1.0 or
v0.2.0-beta.1). Every purely numeric prerelease segment must be 0 or a
non-zero number without leading zeroes: v1.2.3-0 and v1.2.3-alpha01 are
valid, while v1.2.3-01, v1.2.3-0.01, and v1.2.3-alpha.01 are rejected.
Build metadata such as v1.2.3+build.1 is accepted. Stable tags publish to
npm as latest; prerelease tags publish as beta. The verify job performs an
immutable install, typecheck, tests, build, packed-artifact validation, and the
disposable DSH package smoke check before uploading the tarball consumed by the
publish job. Publishing uses npm OIDC provenance in the protected npm
environment with id-token: write; no npm token or repository secret is
configured or required for automated releases. The one-time bootstrap
publication uses the maintainer's local npm authentication only.
bun install --frozen-lockfile
bun run typecheck
bun run test
bun run build
GITHUB_REF_NAME=v0.1.0 bun run release:check
bun run pack-smoke
The smoke test uses test-owned temporary directories and never modifies a live DSH profile, credential, or production service.