chore(workspace): add hardened startup/security workflows and skill suite

skills/whisper-local-safe/SKILL.md

@@ -0,0 +1,30 @@
+---
+name: whisper-local-safe
+description: Local audio transcription via whisper.cpp server on the LAN. Use when transcribing voice notes or audio files with the local whisper-server (no external API), with automatic endpoint fallback and plain text output.
+---
+
+# Whisper Local Safe
+
+Use this skill to transcribe local audio files against:
+
+- `http://192.168.153.113:18801`
+- `http://192.168.153.117:18801`
+
+## Run
+
+```bash
+skills/whisper-local-safe/scripts/transcribe-local.sh /path/to/audio.m4a
+```
+
+Optional env vars:
+
+- `WHISPER_BASE_URL` (override endpoint)
+- `WHISPER_MODEL` (default `base`)
+- `WHISPER_LANGUAGE` (default `auto`)
+- `WHISPER_OUTPUT` (path for transcript output)
+
+## Behavior
+
+- Tries `whisper.cpp` endpoint first: `/inference`
+- Falls back to OpenAI-style endpoint: `/v1/audio/transcriptions`
+- Returns transcript text to stdout and optional output file

skills/whisper-local-safe/scripts/transcribe-local.sh

@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+AUDIO_FILE="${1:-}"
+if [[ -z "$AUDIO_FILE" || ! -f "$AUDIO_FILE" ]]; then
+  echo "Usage: $0 /path/to/audio-file" >&2
+  exit 1
+fi
+
+WHISPER_BASE_URL="${WHISPER_BASE_URL:-http://192.168.153.117:18801}"
+WHISPER_MODEL="${WHISPER_MODEL:-base}"
+WHISPER_LANGUAGE="${WHISPER_LANGUAGE:-auto}"
+WHISPER_OUTPUT="${WHISPER_OUTPUT:-}"
+
+TMP_JSON="$(mktemp)"
+trap 'rm -f "$TMP_JSON"' EXIT
+
+# 1) whisper.cpp style
+if curl -fsS -m 120 \
+  -F "file=@${AUDIO_FILE}" \
+  -F "model=${WHISPER_MODEL}" \
+  -F "language=${WHISPER_LANGUAGE}" \
+  "${WHISPER_BASE_URL}/inference" >"$TMP_JSON" 2>/dev/null; then
+  :
+# 2) OpenAI style fallback
+elif curl -fsS -m 120 \
+  -H "Accept: application/json" \
+  -F "file=@${AUDIO_FILE}" \
+  -F "model=${WHISPER_MODEL}" \
+  "${WHISPER_BASE_URL}/v1/audio/transcriptions" >"$TMP_JSON" 2>/dev/null; then
+  :
+else
+  echo "Transcription request failed at ${WHISPER_BASE_URL}" >&2
+  exit 2
+fi
+
+TEXT="$(grep -o '"text"[[:space:]]*:[[:space:]]*"[^"]*"' "$TMP_JSON" | sed 's/.*"text"[[:space:]]*:[[:space:]]*"//; s/"$//')"
+if [[ -z "$TEXT" ]]; then
+  # fallback: print raw json if text field parsing failed
+  cat "$TMP_JSON"
+  exit 0
+fi
+
+echo "$TEXT"
+if [[ -n "$WHISPER_OUTPUT" ]]; then
+  printf '%s\n' "$TEXT" > "$WHISPER_OUTPUT"
+fi