[DEV SecOps] verdict: PASS
verified at 303728e579461ff7e2475875075307b84c26cc75

Categories:

• prompt-injection: no findings. Scanned changed docs, code comments/string literals, test fixtures, and commit title/body against DEV trigger fixture plus hidden Unicode controls.
• dependency / lockfile: no findings. No package manifests or lockfiles changed; no new third-party dependency introduced.
• CI / workflow injection: no findings. No workflow/CI files changed; no new pull_request_target, secrets exposure, direct github.event/input interpolation, or runner changes.
• generated/copied code provenance: no blocker. New code is small in-repo Python API/registry/dispatch/tests/docs; no vendored/minified/copied blob observed. The parity helper is test-only and not production dispatch code.
• secret exposure: no findings. Diff scan found no tokens, private keys, API-key assignments, or credential material.
• ops/security regression: no findings. Built-in STT provider names are reserved in both registry and dispatcher, plugin exceptions/non-dict results are converted to error envelopes, and plugin dispatch only uses already enabled/discovered local plugins for non-built-in provider names.

Read-only checks used:

• pinned PR metadata with gh-as cc and verified head SHA before inspection
• read PR diff, changed-file list, commit metadata/message body
• static diff scans for prompt-injection triggers, hidden Unicode steering controls, secrets, risky network/shell/eval patterns
• git diff --check and file-category inventory against base 1e71b71

Residual risk:

• Plugin providers can execute arbitrary local plugin code once installed/enabled; that is existing Hermes plugin trust model, not introduced as remote code execution by this PR.

[DEV SecOps] verdict: PASS
verified at 303728e579461ff7e2475875075307b84c26cc75

• Prompt-injection: no findings. Scanned PR body, commit message, changed docs/tests/comments/string literals against DEV trigger fixture plus hidden Unicode controls; no instruction-bearing payloads found.
• Dependencies/lockfiles: no findings. No package manifests or lockfiles changed; no new dependency registry verification required.
• CI/workflow injection: no findings. No workflow/CI files changed; no new pull_request_target, secrets.*, self-hosted runner labels, or ${{ inputs.* }}/${{ github.event.* }} in run: blocks.
• Generated/copied code provenance: no findings. New provider/registry/tests/docs are first-party plugin-hook code patterned after existing Hermes provider/registry architecture; no vendored blobs, minified payloads, or unexplained copied code detected.
• Secret exposure: no findings. Added examples mention environment variable names (*_API_KEY) only; no literal credentials or private key material found.
• Ops/security regression: no blocking finding. Runtime addition is an opt-in STT plugin dispatch path for non-built-in provider names; built-in names are guarded at registration and dispatch, plugin exceptions/non-dict returns are contained in error envelopes. Residual risk: future concrete STT plugin implementations remain arbitrary enabled plugin code and need their own review.

Read-only checks used: gh-as cc pr view, gh-as cc pr diff, pinned-object git fetch/git diff --check, static prompt-injection/hidden-Unicode/secret/risky-pattern scan. Did not execute PR code or tests.

Thanks for the review @keegoid-codex — both findings were valid. Addressed in force-pushed commit a658b7e5d (rebased onto current main first; clean rebase, zero per-file overlap with the 35 commits that landed since branch point).

CAT-1 fix #1: language argument never reaches plugins

Added a per-provider config namespace stt.<provider> that mirrors how built-ins read stt.openai.model / stt.mistral.model. The dispatcher now forwards both model and language from this section. Caller's explicit model= argument still wins.

stt:
  provider: my-stt
  my-stt:
    model: whisper-large-v3
    language: ja          # forwarded as language= to transcribe()

Implementation in tools/transcription_tools.py (the public entry point):

plugin_cfg = stt_config.get(provider, {}) if isinstance(stt_config.get(provider), dict) else {}
plugin_language = plugin_cfg.get("language")
plugin_model = model or plugin_cfg.get("model")
plugin_result = _dispatch_to_plugin_provider(
    file_path, provider,
    model=plugin_model,
    language=plugin_language,
)

CAT-1 fix #2: is_available() ignored

Added an availability gate in _dispatch_to_plugin_provider between provider lookup and the transcribe() call. When is_available() returns False (or raises — defensively treated as False so a buggy plugin can't break dispatch for everyone), the dispatcher returns a clean unavailability envelope identifying the plugin instead of falling through to the generic "No STT provider available" message. The user explicitly opted into this plugin via stt.provider — surfacing the plugin's own unavailability is more actionable.

try:
    available = plugin_provider.is_available()
except Exception as exc:
    logger.warning("STT plugin provider '%s' is_available() raised: %s — treating as unavailable", key, exc, exc_info=True)
    available = False
if not available:
    return {
        "success": False,
        "transcript": "",
        "error": f"STT plugin '{key}' is not available — check that its required credentials / dependencies are configured.",
        "provider": key,
    }

Test coverage added

9 new tests in tests/tools/test_transcription_plugin_dispatch.py:

• TestAvailabilityGate (4 tests):
  • test_unavailable_plugin_returns_envelope_not_none
  • test_available_plugin_dispatches_normally
  • test_is_available_raising_treated_as_unavailable
  • test_unavailable_plugin_at_transcribe_audio_level (end-to-end via the public transcribe_audio())
• TestLanguageForwardingFromConfig (5 tests):
  • test_language_read_from_provider_namespaced_config
  • test_model_from_provider_namespaced_config
  • test_caller_model_overrides_config_model
  • test_missing_provider_namespace_passes_none
  • test_non_dict_provider_namespace_does_not_crash

Plus a new parity scenario plugin-installed-unavailable in the subprocess-pinned harness: on origin/main it returns no_provider_error (no plugin hook); on this PR it returns the cleaner plugin_unavailable envelope.

Verification

• tests/agent/test_transcription_registry.py tests/hermes_cli/test_plugins_transcription_registration.py tests/tools/test_transcription_plugin_dispatch.py → 58 / 58 pass (was 49; +9 new for the codex findings)
• tests/tools/test_transcription_tools.py → 95 / 95 pass (no regressions in the existing built-in tests)
• scripts/run_tests.sh against the affected files → 153 / 153 pass in CI-parity mode
• Parity harness → 10 scenarios, 8 OK + 2 expected DIFFs (no_provider_error → plugin, no_provider_error → plugin_unavailable)
• Ruff on all touched files → clean
• E2E with real transcribe_audio() calls confirms unavailability envelope, language forwarding, caller-model-override, and is_available() exception path
• Git identity verified: commits authored by kshitijk4poor <82637225+kshitijk4poor@users.noreply.github.com>

Rebase note

Rebased onto origin/main (35 commits ahead; zero overlap with files in this PR — none of the recent commits touched tools/transcription_tools.py, agent/transcription_registry.py, agent/transcription_provider.py, hermes_cli/plugins.py, or the new test files). Clean rebase, no conflicts.

The previously-failing CI test (tests/hermes_cli/test_web_server.py::TestPtyWebSocket::test_pub_broadcasts_to_events_subscribers) was a pre-existing PTY-WebSocket flake — passes locally on origin/main in isolation. Hoping the new CI run is greener.

Updated docs in website/docs/user-guide/features/tts.md to document the resolution order, the per-provider config namespace, and the unavailability behavior.

Merged via PR #31907 — #31907

Your commit was cherry-picked onto current main with your authorship preserved in git log (commit 2cd952e11). Thanks for the design and the careful test coverage — the parity harness was particularly useful as a template.

On top of your plugin hook, the salvage PR also adds the symmetric stt.providers.<name>: type: command registry mirroring the TTS registry from #17843, so the STT and TTS extension surfaces are now structurally identical:

1. Built-in dispatch (always wins)
2. <tool>.providers.<name>: type: command runner
3. Plugin-registered provider via register_<tool>_provider()
4. Error

This unblocks the 4 in-flight community STT PRs (#25721, #24703, #9380, #21540) — 3 of which (plain HTTPS) can now ship as config-only entries, with the Python hook reserved for the one PR (#21540, Gemini SDK) that genuinely needs it.