Handy/src-tauri/Cargo.toml
Viren Mohindra 58cda3f3b3
fix: sha256 verification to prevent corrupt partial download loop (#1095)
* fix: add SHA256 verification to prevent corrupt partial download loop

Fixes issue #858 — corrupt .partial files caused an infinite loop where
a failed/cancelled download would resume from EOF, pass extraction, and
loop forever with no way to recover without manual file deletion.

Three-part fix:
- Add sha2 crate and compute_sha256() helper; verify hash post-download
  before extraction/rename for all 15 built-in models. Hash mismatch
  deletes the .partial so the next attempt starts fresh.
- Delete .partial on extraction failure (independent of checksums) so
  corrupt archives can't re-enter the loop via the same path.
- Emit model-download-failed event from the command handler so all
  callers (ModelsSettings, Onboarding) get consistent error feedback
  via a central store listener rather than per-caller return-value checks.

SHA256 hashes hardcoded alongside each model's URL in ModelInfo.
Custom models (sha256: None) skip verification silently.

* chore: remove doc comment from sha256 field

Doc comments on exported specta types propagate into bindings.ts as
inline JSDoc — not useful in generated TS. Removing at the source.

* test: add SHA256 verification unit tests

Extracts inline verify logic into ModelManager::verify_sha256() and
covers all four branches:
- None expected hash → skipped (custom models)
- Matching hash → ok, file kept
- Mismatched hash → error returned, partial file deleted
- Unreadable file → error returned

Ensures corrupt partial downloads are always cleaned up so the next
attempt starts fresh.

* chore: cargo fmt

* fix: clear cancel flag on sha256 failure, spawn_blocking for hash, fallback cleanup

- remove cancel_flags entry on sha256 failure to prevent a stale flag
  from immediately cancelling the next retry attempt (HIGH)
- add fallback state cleanup in modelStore when result.status != ok,
  so spinner clears even if model-download-failed event is missed (HIGH)
- run compute_sha256 in spawn_blocking to avoid stalling the async
  executor while hashing large model files (up to 1.6 GB) (MEDIUM)

* emit some more events for the ui to pick up

* add translations + format

---------

Co-authored-by: CJ Pais <cj@cjpais.com>
2026-03-21 14:19:26 +08:00

122 lines
3.6 KiB
TOML

[package]
name = "handy"
version = "0.7.12"
description = "Handy"
authors = ["cjpais"]
edition = "2021"
license = "MIT"
default-run = "handy"
[profile.dev]
incremental = true # Compile your binary in smaller steps.
# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
[lib]
# The `_lib` suffix may seem redundant but it is necessary
# to make the lib name unique and wouldn't conflict with the bin name.
# This seems to be only an issue on Windows, see https://github.com/rust-lang/cargo/issues/8519
name = "handy_app_lib"
crate-type = ["staticlib", "cdylib", "rlib"]
# [[bin]]
# name = "cli"
# path = "src/audio_toolkit/bin/cli.rs"
[build-dependencies]
tauri-build = { version = "2", features = [] }
serde_json = "1"
serde = { version = "1", features = ["derive"] }
[dependencies]
once_cell = "1"
tauri = { version = "2.10.2", features = [
"protocol-asset",
"macos-private-api",
"tray-icon",
'image-png',
] }
tauri-plugin-log = "2.7.1"
tauri-plugin-opener = "2.5.2"
tauri-plugin-store = "2.4.1"
tauri-plugin-os = "2.3.2"
tauri-plugin-clipboard-manager = "2.3.2"
tauri-plugin-macos-permissions = "2.3.0"
tauri-plugin-process = "2.3.1"
rusqlite_migration = "2.3"
tauri-plugin-fs = "2.4.4"
serde = { version = "1", features = ["derive"] }
serde_json = "1"
rdev = { git = "https://github.com/rustdesk-org/rdev" }
cpal = "0.16.0"
anyhow = "1.0.95"
rubato = "0.16.2"
hound = "3.5.1"
log = "0.4.25"
env_filter = "0.1.0"
tokio = "1.43.0"
vad-rs = { git = "https://github.com/cjpais/vad-rs", default-features = false }
enigo = "0.6.1"
rodio = { git = "https://github.com/cjpais/rodio.git" }
reqwest = { version = "0.12", features = ["json", "stream"] }
futures-util = "0.3"
rustfft = "6.4.0"
strsim = "0.11.0"
natural = "0.5.0"
regex = "1"
chrono = "0.4"
rusqlite = { version = "0.37", features = ["bundled"] }
tar = "0.4.44"
flate2 = "1.0"
sha2 = "0.10"
transcribe-rs = { version = "0.3.2", features = ["whisper-cpp", "onnx"] }
handy-keys = "0.2.4"
ferrous-opencc = "0.2.3"
clap = { version = "4", features = ["derive"] }
specta = "=2.0.0-rc.22"
specta-typescript = "0.0.9"
tauri-specta = { version = "=2.0.0-rc.21", features = ["derive", "typescript"] }
tauri-plugin-dialog = "2.6"
[target.'cfg(unix)'.dependencies]
signal-hook = "0.3"
[target.'cfg(not(any(target_os = "android", target_os = "ios")))'.dependencies]
tauri-plugin-autostart = "2.5.1"
tauri-plugin-global-shortcut = "2.3.1"
tauri-plugin-single-instance = "2.3.2"
tauri-plugin-updater = "2.10.0"
[target.'cfg(windows)'.dependencies]
transcribe-rs = { version = "0.3.2", features = ["whisper-vulkan", "ort-directml"] }
windows = { version = "0.61.3", features = [
"Win32_Media_Audio_Endpoints",
"Win32_System_Com_StructuredStorage",
"Win32_System_Variant",
"Win32_Foundation",
"Win32_UI_WindowsAndMessaging",
] }
winreg = "0.55"
[target.'cfg(target_os = "macos")'.dependencies]
tauri-nspanel = { git = "https://github.com/ahkohd/tauri-nspanel", branch = "v2.1" }
transcribe-rs = { version = "0.3.2", features = ["whisper-metal"] }
[target.'cfg(target_os = "linux")'.dependencies]
gtk-layer-shell = { version = "0.8", features = ["v0_6"] }
gtk = "0.18"
transcribe-rs = { version = "0.3.2", features = ["whisper-vulkan"] }
[patch.crates-io]
tauri-runtime = { git = "https://github.com/cjpais/tauri.git", branch = "handy-2.10.2" }
tauri-runtime-wry = { git = "https://github.com/cjpais/tauri.git", branch = "handy-2.10.2" }
tauri-utils = { git = "https://github.com/cjpais/tauri.git", branch = "handy-2.10.2" }
[dev-dependencies]
tempfile = "3"
[profile.release]
lto = true
codegen-units = 1
strip = true
panic = "unwind"