always transcribe in the source language, and let tasks call the API

Three changes that Transcribe Audio needs.

Whisper's translate mode only ever outputs English, so it cannot honour
"translate into <language>" for anything else — it answered Portuguese audio with
a rough English rendering instead of a transcript. The translate decision is gone
and transcription is always faithful to the detected language; spokenLanguages
now only breaks ties on clips Whisper is unsure about.

Script tasks get OFFICER_API_URL / OFFICER_API_HOST / OFFICER_AUTH_TOKEN so they
can call Officer's own endpoints rather than reimplementing server-side work.
Requests go to 127.0.0.1 so nothing depends on DNS or the proxy, but origin
validation matches Host against PUBLIC_URL, hence the separate host variable.

`inline` accepts "ask", which offers both affordances in the runner — Run here
streams into the modal, Run as job queues it. Useful when the same task can take
a second or an hour depending on whether it was pointed at a file or a library.
Existing true/false values behave exactly as before.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/servers/api/stt/transcribe.ts

@@ -1,13 +1,11 @@
-// Whisper transcription with language-aware translation.
+// Whisper transcription, always in the audio's own language.
 //
-// Strategy: detect the audio's language, then transcribe in that language.
-// Only ask Whisper to translate (which is English-only) when the detected
-// language is NOT one the user speaks — i.e. they wouldn't understand the
-// raw transcript anyway.
+// Detect the language first, then transcribe in it. Whisper's translate mode is English-only, so it
+// cannot honour "translate into <language>" for anything else — rather than silently returning a
+// rough English rendering of Portuguese audio, transcription is always faithful to the source.
 //
-// The detection must win when Whisper is confident. Biasing toward the user's spoken languages
-// unconditionally means a user who speaks only English forces `language=en` onto every recording,
-// and Whisper answers non-English audio with a rough, unmarked translation instead of a transcript.
+// The detection must win when Whisper is confident. `spokenLanguages` only breaks ties on clips
+// Whisper is genuinely unsure about, where its low-confidence guess defaults to English.
 
 type TranscribeArgs = {
   file: File | Blob;
@@ -18,7 +16,6 @@ type TranscribeArgs = {
 export type TranscribeResult = {
   text: string;
   detectedLanguage: string;
-  translated: boolean;
 };
 
 // Above this probability Whisper's own detection is taken as authoritative. Below it the clip is
@@ -88,21 +85,17 @@ export async function transcribeAudio({
     detectedLanguage = LANG_NAME_TO_ISO[raw] ?? raw;
   }
 
-  // Step 2: translate only when the user doesn't speak the detected language
-  const translated = spokenLanguages.length > 0 && !spokenLanguages.includes(detectedLanguage);
-
-  // Step 3: full transcription
+  // Step 2: transcribe in the detected language
   const transcribeForm = new FormData();
   transcribeForm.append('file', file);
   transcribeForm.append('temperature', '0.0');
   transcribeForm.append('temperature_inc', '0.2');
   transcribeForm.append('response_format', 'text');
   transcribeForm.append('language', detectedLanguage);
-  if (translated) transcribeForm.append('translate', 'true');
 
   const res = await fetch(`${base}/inference`, { method: 'POST', body: transcribeForm });
   if (!res.ok) throw new Error(`Transcription failed (${res.status})`);
   const text = (await res.text()).trim();
 
-  return { text, detectedLanguage, translated };
+  return { text, detectedLanguage };
 }

src/servers/api/tasks/execute-script.ts

@@ -4,6 +4,7 @@ import { tmpdir } from 'node:os';
 import { getTaskByDirName } from './task-files';
 import { getOwnerHomeDir, DATA_PATH } from '../../data-path';
 import { killTree } from './process-tree';
+import { buildTaskApiEnv } from './task-api-env';
 
 // Script-job event stream. `stdout`/`stderr` are high-frequency (live-only + persisted to the log
 // file); `started`/`exit`/`error` are structural and get buffered for viewer replay.
@@ -16,7 +17,9 @@ export type ScriptEvent =
 
 export type ExecuteScriptParams = {
   jobId: string;
+  userId: number;
   email: string;
+  username?: string | null;
   taskDirName: string;
   inputs: Record<string, string>;
   cwd?: string;
@@ -66,7 +69,7 @@ export const jobLogPath = (jobId: string) => join(DATA_PATH, 'jobs', `${jobId}.l
 // output to a durable log file. Resolves with the process exit code; throws only on spawn failure or
 // when aborted (the manager maps those to failed/stopped).
 export async function executeScript(params: ExecuteScriptParams): Promise<{ exitCode: number }> {
-  const { jobId, email, inputs, abortSignal, emit } = params;
+  const { jobId, userId, email, username, inputs, abortSignal, emit } = params;
 
   const task = await getTaskByDirName(params.taskDirName);
   if (!task) throw new Error(`Task not found: ${params.taskDirName}`);
@@ -83,7 +86,8 @@ export async function executeScript(params: ExecuteScriptParams): Promise<{ exit
   const cwd = params.cwd ? (isAbsolute(params.cwd) ? params.cwd : join(homeDir, params.cwd)) : homeDir;
 
   const spawnCmd = cmd;
-  const spawnEnv = { ...(process.env as Record<string, string>), ...inputEnv };
+  const apiEnv = await buildTaskApiEnv({ id: userId, email, username });
+  const spawnEnv = { ...(process.env as Record<string, string>), ...apiEnv, ...inputEnv };
   const spawnCwd = cwd;
 
   mkdirSync(join(DATA_PATH, 'jobs'), { recursive: true });

src/servers/api/tasks/pipeline-job-manager.ts

@@ -179,7 +179,9 @@ function launch(jobId: string, mode: JobMode, params: StartJobParams) {
     mode === 'script'
       ? executeScript({
           jobId,
+          userId: params.userId,
           email: params.email,
+          username: params.username,
           taskDirName: params.taskDirName,
           inputs: params.inputs,
           cwd: params.cwd,

src/servers/api/tasks/task-api-env.ts

@@ -0,0 +1,31 @@
+import { sign } from '@@/jwt';
+
+const { PORT = '5000', PUBLIC_URL } = process.env;
+
+const PUBLIC_HOST = (() => {
+  try {
+    return PUBLIC_URL ? new URL(PUBLIC_URL).host : undefined;
+  } catch {
+    return undefined;
+  }
+})();
+
+type TaskApiUser = { id: number; email: string; username?: string | null };
+
+// Environment that lets a script task call Officer's own API instead of reimplementing server-side
+// work (transcription, for one — the endpoint already handles language detection and caching).
+//
+// Requests go to 127.0.0.1 so a task never depends on DNS or the reverse proxy being up. Origin
+// validation matches the Host header against PUBLIC_URL though, so a bare localhost request is
+// rejected — hence OFFICER_API_HOST, which scripts must pass as an explicit Host header:
+//
+//   curl -H "Authorization: Bearer $OFFICER_AUTH_TOKEN" -H "Host: $OFFICER_API_HOST" \
+//        "$OFFICER_API_URL/api/file-browser/transcribe"
+export async function buildTaskApiEnv(user: TaskApiUser): Promise<Record<string, string>> {
+  const token = await sign({ id: user.id, email: user.email, username: user.username ?? '' }, '12h');
+  return {
+    OFFICER_API_URL: `http://127.0.0.1:${PORT}`,
+    OFFICER_API_HOST: PUBLIC_HOST ?? `127.0.0.1:${PORT}`,
+    OFFICER_AUTH_TOKEN: token,
+  };
+}

src/servers/api/tasks/task-executor.ts

@@ -3,6 +3,7 @@ import { join, isAbsolute } from 'node:path';
 import { mkdirSync, writeFileSync, chmodSync, rmSync, readdirSync, readFileSync } from 'node:fs';
 import { getTaskByDirName } from './task-files';
 import { getOwnerHomeDir } from '../../data-path';
+import { buildTaskApiEnv } from './task-api-env';
 
 type WSData = {
   userId: number;
@@ -157,7 +158,7 @@ function buildArgs(inputs: Record<string, string>, argsOrder?: string[] | null):
 }
 
 async function handleRun(ws: ServerWebSocket<WSData>, msg: RunMessage) {
-  const { email } = ws.data;
+  const { userId, email, username } = ws.data;
 
   // Resolve task from the file-backed store
   const task = await getTaskByDirName(msg.taskDirName);
@@ -197,7 +198,8 @@ async function handleRun(ws: ServerWebSocket<WSData>, msg: RunMessage) {
   const cwd = msg.cwd ? (isAbsolute(msg.cwd) ? msg.cwd : join(homeDir, msg.cwd)) : homeDir;
 
   const spawnCmd = cmd;
-  const spawnEnv = { ...(process.env as Record<string, string>), ...inputEnv };
+  const apiEnv = await buildTaskApiEnv({ id: userId, email, username });
+  const spawnEnv = { ...(process.env as Record<string, string>), ...apiEnv, ...inputEnv };
   const spawnCwd = cwd;
 
   const cleanup = () => {

src/servers/api/tasks/task-files.ts

@@ -14,7 +14,9 @@ export type TaskFrontmatter = {
   category: string | null; // groups the task into a context-menu submenu; null falls back to 'Other'
   version: number;
   mode: string;
-  inline: boolean; // quick/interactive tasks run in the modal instead of as a background job
+  // How the task runs: false = background job, true = ephemerally in the modal, 'ask' = the modal
+  // offers the choice per run.
+  inline: boolean | 'ask';
   language: string | null;
   args: string[] | null;
   tags: string[] | null;
@@ -40,7 +42,7 @@ export type TaskSummary = {
   description: string | null;
   category: string | null;
   mode: string;
-  inline: boolean;
+  inline: boolean | 'ask';
   version: number;
   trigger: unknown;
 };
@@ -112,7 +114,7 @@ function parseTaskMd(raw: string): { fm: TaskFrontmatter; body: string } {
       category: parsed.category == null ? null : String(parsed.category),
       version,
       mode: parsed.mode == null ? 'agentic' : String(parsed.mode),
-      inline: parsed.inline === true,
+      inline: parsed.inline === 'ask' ? 'ask' : parsed.inline === true,
       language: parsed.language == null ? null : String(parsed.language),
       args: asArray(parsed.args),
       tags: asArray(parsed.tags),