studio-engine 0.122.0 → 0.123.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cd0f77b33c7833a6cb5061bc17b11baad3db5ad3b2e6ad232b31cc363d124e49
-  data.tar.gz: 942b24a25b2dbdb8d7e1af5a918c323718fcb2438eced8b46dd1593f1563d9a0
+  metadata.gz: b205f173a74b9bb8df878abf6b1e991cdc68b4a24d149ee0dbf5ea98d5d49ead
+  data.tar.gz: 01b80bee0be70951eb51e4e151639ab65c096972374b12ef5d2941b58411d2c0
 SHA512:
-  metadata.gz: 2d81f612a81ddb2d5e9ccdf6c85d4e4cea1bd47043ba5e0c9732202f55e39489b44059646e8f42848530525c2c4c8f23ecd299afeb322b43adb3dd3bb513ff1a
-  data.tar.gz: 3f6a3214f4a5a80cfc2c73453dd0429161f28879ba3bd41857160ab02c2f70bb633213d317c19d9026e786afb7d99c37ddc5e6e1da2793d8edf495fa976f216d
+  metadata.gz: 94aae578a81075f61b21504530ef3998b0b5db37b90876f7038445e3a90938645130833c7ce9c163ec247870843afc99a4e1d24d59deeeff27db1bf6bbcbb428
+  data.tar.gz: 13d649f6aa168b162fa6b18b6c098cd97e5c2b385964337f127f09de9f323773803c22d363ee7c9b159801b894e95c9e13d7385fec2ec83133ac4c0191e0af88

data/CHANGELOG.md

@@ -4,6 +4,84 @@ The format is [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This pro
 
 ## Unreleased
 
+## 0.123.0 — 2026-11-03
+
+### Added
+
+- **Hold to talk in the shared agent chat.** `render "studio/agent_chat/chat", ..., voice: true`
+  puts the microphone chip and a hold-to-talk button in the composer's mic slot,
+  with the approved privacy line under it (`Studio::AgentChat::VOICE_PRIVACY`;
+  `voice_copy: { privacy:, recorder:, chip: }` overrides). Off by default, and
+  shown only where `Studio.voice_transcription` is on. Moved from the hub's
+  `chat/_voice` and `voice_chat.js` (new: `studio/agent_chat_voice`, the lazy
+  `agent-chat-voice` controller). Two fixes on the way: a new hold clears the last
+  take's line, and a take recorded during transcription waits its turn. A failed
+  send now adds the words after a typed draft instead of losing them.
+  [`docs/AGENT_CHAT.md`](docs/AGENT_CHAT.md) carries the adoption checklist.
+- **`Studio.voice_chat_allowed`**, a callable taking the signed-in user (default:
+  anyone signed in). It decides who sees the mic, who may post to
+  `POST /voice/takes` (a JSON `403 {error, reason: "not_allowed"}` otherwise), and
+  whether the proxy forwards a message's `voice`. A signed-out visitor is never
+  allowed, whatever the hook says.
+- **`studio:voice-recorder:hint`**, on the recorder: `{ kind, text }` for a line
+  while it records. A blank `copy.recording[kind]` now blanks that line.
+- **`Studio.agent_chat_allowed`**, the chat's server-side gate: a callable taking
+  the user, nil when signed out (default: everyone, so a public chat is unchanged).
+  `Studio::AgentChatsController` answers a refused viewer a JSON `403 {error, reason:
+  "not_allowed"}` on both calls before any hub call, and the chat partial renders
+  nothing for them. The footer's Chat link follows it unless
+  `site_footer_chat_allowed` is set, and a user it refuses may not talk by voice.
+- **The proxy carries `voice`.** `POST /agent_chat/messages` and
+  `Studio::AgentChat.post_message(voice:)` forward `{check, score, duration_ms}`
+  to the hub, and never a name: the hub names the speaker. A malformed `voice` is
+  a `422`. When the hub answers what it kept, the proxy answers `{turn, voice}`.
+- **A public refresh hook on the chat.** Dispatch `studio:agent-chat:refresh` on
+  the chat's section, optionally with `{detail: {turn}}`: the turn shows at once
+  and the chat polls now; a poll in flight is followed by one more.
+- **The footer's standard Chat link.** `Studio.site_footer_chat_path` (a path or a
+  callable taking the view), `site_footer_chat_label` (default "Chat") and
+  `site_footer_chat_allowed` (a callable taking the viewer, nil when signed out;
+  default `Studio.agent_chat_allowed`) add a plain link at the end of the Contact
+  column, or a Contact column if the facts have none. No path, no link.
+  [`docs/SITE_FOOTER.md`](docs/SITE_FOOTER.md), *The Chat link*.
+- **`Studio::UserSession` and `studio_user_sessions`.** One row per signed-in browser
+  session: user, admin, started, last seen. A new row after 30 idle minutes; at most one
+  write per 5 minutes, and no query between writes. No IP and no user agent. An app with
+  the migration records automatically.
+- **A standard Sessions tab on the admin models page** when the table exists.
+
+### Changed
+
+- **The admin models page is one table per tab.** The title and tabs share one sticky
+  row and the open tab is highlighted. `/admin/models` shows the first tab; a page's `h1`
+  is now always "Models". `studio/admin_models/index` and `PREVIEW_LIMIT` are gone.
+- **`/admin/style` has one sticky header row.** The title and the section tabs
+  share it, and the tab highlight follows the section in view
+  (`studio/style_section_nav`). The intro paragraph is gone; the version sits at
+  the row's right.
+- **`GET /admin/theme` redirects to `/admin/style#theme`.** The route and the
+  `admin_theme_path` helper stay, and so do the save endpoints. A form save now
+  lands on the style guide. The standalone page's logos, semantic tokens and type
+  moved to the Theme section; its button and component specimens were already in
+  Tricks.
+
+### Removed
+
+- **`/admin/design_system` and `admin_design_system_path`.** The route only
+  redirected to `/admin/style`. No app links it.
+- **`theme_settings/edit` and the `themeEditor` factory** (`window.themeEditor`).
+  `dsThemeEditor` is the one editor.
+
+### Fixed
+
+- **The microphone help's Close never submits a surrounding form.** It is a plain
+  button now, not `<form method="dialog">`, which the parser drops inside a form.
+- **A hold-to-talk recorder stops when a held key loses focus**, instead of recording
+  to the cap and sending a take on its own, and a right-click or control-click no
+  longer starts a take.
+- **The emoji swap no longer clips a large glyph.** Its box is `max(1.25rem, 1.25em)` tall and
+  `max(1.5rem, 1.25em)` wide, so a 24px emoji fits.
+
 ## 0.122.0 — 2026-11-01
 
 ### Added

data/README.md

@@ -43,7 +43,7 @@ resolved.
 - **Branded loader**: `studio_loader`, `studio_loader_pending` and `studio_loader_overlay` draw the app's own icon in its theme colours for page loads, long waits and pending buttons, in the style `config.loader` names (Breathe by default). See [`docs/LOADER.md`](docs/LOADER.md).
 - **Public user page**: `/u/:username` shows a user's avatar and username (nothing else), and unfurls with their avatar, falling back to the site image. Link any username to it with `link_to_user_profile(user)` or `studio_user_profile_path(user)`. Opt in with `config.draw_public_user_routes = true`. See [`docs/PUBLIC_USER_PAGE.md`](docs/PUBLIC_USER_PAGE.md).
 - **Transactional emails**: `Studio::EmailCatalog` — every email an app sends, its type, a live preview, and its banner — plus the shared `/admin/emails` page. Every app inherits the standard emails and their artwork on day one, and can register its own workflows and upload its own banners. See [Transactional emails](#transactional-emails).
-- **Site footer**: `<%= studio_site_footer %>` in the layout renders the public site's footer. It is on by default: with nothing configured it prints the app's name, logo and the legal links the app has routes for, and no address. `config.site_footer` declares the app's own facts (brand, social profiles, link columns, an address with a live map, legal links), every part optional; `config.site_footer_address` adds a location in one setting; `config.site_footer = false` turns the footer off. Leaflet is vendored and served by the engine. See [`docs/SITE_FOOTER.md`](docs/SITE_FOOTER.md).
+- **Site footer**: `<%= studio_site_footer %>` in the layout renders the public site's footer. It is on by default: with nothing configured it prints the app's name, logo and the legal links the app has routes for, and no address. `config.site_footer` declares the app's own facts (brand, social profiles, link columns, an address with a live map, legal links), every part optional; `config.site_footer_address` adds a location in one setting; `config.site_footer = false` turns the footer off; `config.site_footer_chat_path` adds a standard Chat link to the Contact column. Leaflet is vendored and served by the engine. See [`docs/SITE_FOOTER.md`](docs/SITE_FOOTER.md).
 - **Booking**: a simple scheduler on Google Calendar appointment schedules, with or without the footer. With `config.booking_url`, `studio_booking_frame` embeds Google's booking page, `studio_booking_link` opens it in a popup, and `config.draw_booking_routes = true` draws `/schedule` (or name the app's own page with `config.booking_path`). `config.booking_crop` crops the frame to the slot picker at rest, from numbers `bin/booking-crop-measure` reads off the app's own schedule. See [`docs/BOOKING.md`](docs/BOOKING.md).
 - **Voice profile**: an opt-in row on `/profile` ("Set up your voice"): the person reads three phrases with a live level meter, their device turns each take into a speaker embedding (WeSpeaker via transformers.js), and only the averaged vector is saved on their user, never audio. `Studio::VoiceMatch.identify(embedding, among: User.all, model:)` answers who is speaking. Turn it on with `config.voice_profile = true` after installing the migration. See [`docs/VOICE_PROFILE.md`](docs/VOICE_PROFILE.md).
 - **Voice capture**: the microphone chip (names the microphone a page records from, picks another, Chrome help dialog), one level meter, and a record button that refuses a silent take and hands a heard one to the page as a `studio:voice-recorder:take` event with the blob; it uploads nothing. Render `studio/voice/microphone_chip` and `studio/voice/recorder`. See [`docs/VOICE_CAPTURE.md`](docs/VOICE_CAPTURE.md).
@@ -249,7 +249,7 @@ Set `Studio.draw_survey_routes = true` to add the public survey pages (`/surveys
 
 **Magic links need the `studio_links` table.** Install it with `bin/rails studio_engine:install:migrations && bin/rails db:migrate` (install all of them) before enabling `:magic_link` — never by hand-copying the migration, which collides with the task's own copy on `class CreateStudioLinks`. Without the table, the first sign-in raises `Studio::Link::MissingTable`.
 
-Set `Studio.agent_chat_souls = %w[alex]` to add the shared agent chat's proxy (`POST /agent_chat/messages`, `GET /agent_chat/turns`), which forwards to the McRitchie Studio hub with the app's `AGENT_CHAT_TOKEN`; then `render "studio/agent_chat/chat", soul: "alex", name: "Alex", portrait: ...` on any page ([`docs/AGENT_CHAT.md`](docs/AGENT_CHAT.md)).
+Set `Studio.agent_chat_souls = %w[alex]` to add the shared agent chat's proxy (`POST /agent_chat/messages`, `GET /agent_chat/turns`), which forwards to the McRitchie Studio hub with the app's `AGENT_CHAT_TOKEN`; then `render "studio/agent_chat/chat", soul: "alex", name: "Alex", portrait: ...` on any page, with `voice: true` for hold to talk in the composer ([`docs/AGENT_CHAT.md`](docs/AGENT_CHAT.md)).
 
 In non-production local requests, this also draws `/_studio/local_emails`, a local email inbox for agent/worktree proof flows. Set `LOCAL_EMAIL_CAPTURE=1` or run with `AGENT_WORKTREE=1` to record outbox rows without sending real email.
 

data/app/controllers/concerns/studio/admin_models.rb

@@ -2,7 +2,6 @@ module Studio
   module AdminModels
     extend ActiveSupport::Concern
 
-    PREVIEW_LIMIT = 10
     PER_PAGE = 25
     TEAM_SORTS = {
       "team" => "LOWER(teams.name)",
@@ -10,27 +9,22 @@ module Studio
       "league" => "LOWER(COALESCE(teams.league, ''))"
     }.freeze
     SHARED_TABLE_KEYS = %w[teams arenas].freeze
+    SESSIONS_CONFIG = { label: "Sessions", description: "Signed-in sessions, most recent first" }.freeze
 
     included do
       before_action :set_model_config, only: :show
       helper Studio::AdminModelsTableHelper
-      helper_method :team_sort_url, :team_sort_indicator, :team_sport_emoji,
+      helper_method :admin_model_configs, :team_sort_url, :team_sort_indicator, :team_sport_emoji,
                     :team_record_json, :admin_models_table_partial
     end
 
+    # The first tab. Each model has its own tab and page (#show); this page is that
+    # first one, so /admin/models always shows a table.
     def index
-      @sections = admin_model_configs.map do |key, config|
-        scope = admin_model_scope_for(key)
-        {
-          key: key,
-          label: config.fetch(:label),
-          description: config.fetch(:description),
-          count: scope.count,
-          records: scope.limit(PREVIEW_LIMIT)
-        }
-      end
-
-      render "studio/admin_models/index"
+      @key = admin_model_configs.keys.first.to_s
+      @config = admin_model_configs.fetch(@key)
+      @scope = admin_model_scope(@key)
+      show
     end
 
     def show
@@ -47,11 +41,23 @@ module Studio
     def set_model_config
       @key = params[:key].to_s
       @config = admin_model_configs.fetch(@key) { raise ActiveRecord::RecordNotFound }
-      @scope = admin_model_scope_for(@key)
+      @scope = admin_model_scope(@key)
     end
 
+    # The host's models, with the engine's standard ones after its Users tab. A host
+    # adds a model by adding it to MODELS and answering it in #admin_model_scope_for.
     def admin_model_configs
-      self.class::MODELS
+      configs = self.class::MODELS.to_a
+      return configs.to_h unless Studio::UserSession.available?
+
+      at = (configs.index { |key, _| key.to_s == "users" } || -1) + 1
+      configs.insert(at, ["sessions", SESSIONS_CONFIG]).to_h
+    end
+
+    def admin_model_scope(key)
+      return Studio::UserSession.includes(:user).recent if key.to_s == "sessions"
+
+      admin_model_scope_for(key)
     end
 
     def admin_model_scope_for(_key)
@@ -107,6 +113,8 @@ module Studio
     end
 
     def admin_models_table_partial(key)
+      return "studio/admin_models/sessions_table" if key.to_s == "sessions"
+
       shared_table_keys = if self.class.const_defined?(:SHARED_TABLE_KEYS, false)
         self.class::SHARED_TABLE_KEYS
       else

data/app/controllers/concerns/studio/error_handling.rb

@@ -21,6 +21,7 @@ module Studio
       rescue_from "Sluggable::SlugRefused", with: :handle_slug_refused
 
       before_action :require_authentication
+      after_action :track_user_session
 
       helper_method :current_user, :logged_in?, :sso_user_available?, :sso_display_name, :sso_source_app, :sso_hub_logo, :admin?,
                     :onchain_session?, :wallet_context, :client_session_payload
@@ -28,6 +29,18 @@ module Studio
 
     private
 
+    # The signed-in person, not whoever an admin is impersonating. A signed-out
+    # request stops at the cookie: it runs no query it would not otherwise run. A
+    # request must not fail because its bookkeeping did.
+    def track_user_session
+      return unless session[Studio.session_key]
+
+      user = respond_to?(:true_user, true) ? true_user : current_user
+      Studio::UserSession.track(session, user) if user
+    rescue StandardError => e
+      Rails.logger&.warn("[user_session] #{e.class}: #{e.message}")
+    end
+
     def current_user
       return @current_user if defined?(@current_user)
       @current_user = User.find_by(id: session[Studio.session_key])

data/app/controllers/studio/agent_chats_controller.rb

@@ -5,12 +5,18 @@ module Studio
   # to its own app; this controller forwards its two calls to the hub through
   # Studio::AgentChat:
   #
-  #   POST /agent_chat/messages  soul, text         -> 201 {turn}
+  #   POST /agent_chat/messages  soul, text, voice  -> 201 {turn, voice}
   #   GET  /agent_chat/turns     soul, after, limit -> 200 {turns, pending}
   #
   # Drawn by Studio.routes only for an app that names a soul
   # (Studio.agent_chat_souls).
   #
+  # WHO MAY USE IT: Studio.agent_chat_allowed, asked of the viewer on both calls.
+  # A refused viewer is a JSON 403 {error, reason: "not_allowed"} before any hub
+  # call and before an anon cookie is minted. These routes skip sign-in, so hiding
+  # a link is not the gate; with the app's token set the hub answers whoever gets
+  # through here.
+  #
   # WHAT THE BROWSER MAY CHOOSE, AND WHAT IT MAY NOT:
   #
   #   soul    only from the app's allow-list (Studio.agent_chat_souls); off the
@@ -27,6 +33,10 @@ module Studio
   #           POST that still holds the cookie sends both, so the hub folds the
   #           anonymous thread into the person's; the cookie is then deleted.
   #   ip      never: request.remote_ip, which the hub caps on.
+  #   voice   only what a take measured, {check, score, duration_ms}
+  #           (Studio::AgentChat.voice_param), and only from a user
+  #           Studio.voice_chat_allowed? lets talk; anyone else's words go as
+  #           typed. Never a name: the hub names the speaker.
   #
   # The host's ApplicationController is the base, so its session, current_user
   # and CSRF protection hold: the POST must carry the page's authenticity token
@@ -43,8 +53,10 @@ module Studio
     ANON_COOKIE = :studio_agent_chat_anon
     ANON_TTL = 1.year
     UNAVAILABLE = "Can't reach the chat right now. Try again in a moment."
+    NOT_ALLOWED = "This chat isn't open to you yet."
 
     before_action :no_store
+    before_action :require_chat_allowed
     before_action :resolve_soul
 
     def create
@@ -56,11 +68,13 @@ module Studio
       end
 
       who = person(mint: true, fold: true)
-      turn = Studio::AgentChat.post_message(soul: @soul, text: text, person: who, ip: request.remote_ip)
+      turn = Studio::AgentChat.post_message(soul: @soul, text: text, person: who, ip: request.remote_ip,
+                                            voice: spoken_voice)
       # A signed-in post that carried the anon token has folded that thread into
       # the person's: the token is spent. Kept on any failure, for the retry.
       cookies.delete(ANON_COOKIE) if who.key?(:email) && who.key?(:anon_token)
-      render json: { turn: turn }, status: :created
+      # `voice` is what the hub kept, so the page says who the agent was told spoke.
+      render json: { turn: turn.except("voice"), voice: turn["voice"] }.compact, status: :created
     rescue Studio::AgentChat::Error => e
       render_hub_error(e)
     end
@@ -80,6 +94,19 @@ module Studio
 
     private
 
+    # The message's `voice`, for a user who may talk; nil otherwise.
+    def spoken_voice
+      params[:voice] if Studio.voice_chat_allowed?(viewer)
+    end
+
+    def viewer
+      respond_to?(:current_user, true) ? current_user : nil
+    end
+
+    def require_chat_allowed
+      render_error(NOT_ALLOWED, :forbidden, reason: "not_allowed") unless Studio.agent_chat_allowed?(viewer)
+    end
+
     def no_store
       response.headers["Cache-Control"] = "no-store"
     end
@@ -128,7 +155,7 @@ module Studio
     # in docs/GOOGLE_AUTH_SETUP.md) counts. Anyone else chats as an
     # anonymous visitor.
     def verified_email
-      user = respond_to?(:current_user, true) ? current_user : nil
+      user = viewer
       return nil unless user
 
       hook = Studio.agent_chat_verified_email

data/app/controllers/studio/voice_takes_controller.rb

@@ -19,6 +19,11 @@ module Studio
   # CSRF-protected (send the page's token as X-CSRF-Token), JSON, no-store.
   # The speaker is matched only against the signed-in user's own saved voice.
   #
+  # ALLOWED USERS ONLY (Studio.voice_chat_allowed; by default anyone signed in):
+  # anyone else is a JSON 403 {error, reason: "not_allowed"}, before the rate
+  # limit counts or anything is read. Hiding the microphone is not the gate; each
+  # take is a paid call.
+  #
   # RATE-LIMITED per user (Studio.voice_takes_rate_limit, 20 takes in 10
   # minutes): over it, a JSON 429 {error, reason: "rate_limited", retry_after}
   # and a Retry-After header, before anything is read or transcribed.
@@ -31,11 +36,13 @@ module Studio
     before_action :require_authentication
     protect_from_forgery with: :exception
     before_action :no_store
+    before_action :require_voice_allowed
     before_action :limit_takes
 
     CANT_HEAR = "I couldn't hear any words in that. Check your microphone and try again."
     UNAVAILABLE = "I couldn't transcribe that just now. Try again in a moment."
     TOO_MANY = "That's a lot of recordings in a short time. Wait a moment, then try again."
+    NOT_ALLOWED = "Voice isn't available on your account yet. Type instead for now."
 
     # The counter's fallback when the app's Rails.cache counts nothing (a
     # NullStore, as many apps run in development): per process, so a limit
@@ -81,6 +88,10 @@ module Studio
 
     private
 
+    def require_voice_allowed
+      refuse(NOT_ALLOWED, :forbidden, reason: "not_allowed") unless Studio.voice_chat_allowed?(current_user)
+    end
+
     # The per-user limit, a fixed window: the window's number is in the key, so
     # its end (retry_after) is known exactly. Rails' own rate_limit macro fixes
     # to:/within: when the class loads and counts nothing on a NullStore; this

data/app/controllers/style_controller.rb

@@ -6,14 +6,11 @@
 # The view is a bare content wrapper that renders inside each host's
 # application.html.erb, so it inherits that app's navbar + theme automatically.
 #
-# Reached at /admin/style (helper admin_style_path). The legacy /admin/design_system
-# route redirects here and keeps its admin_design_system_path helper resolving, so a
-# shipped host sidebar link that still points at the old helper keeps working.
+# Reached at /admin/style (helper admin_style_path).
 class StyleController < ApplicationController
   before_action :require_admin
 
-  # Load the live theme so the Theme section (the landing section, folded in from
-  # /admin/theme) shows this app's saved colors + the CSRF-protected editor.
+  # Load the live theme so the Theme section (the landing section) shows this app's saved colors + the CSRF-protected editor.
   # Best-effort: the section renders from Studio.theme_config defaults when no
   # ThemeSetting row exists, so a load hiccup must not take the whole page down.
   def index

data/app/controllers/theme_settings_controller.rb

@@ -1,10 +1,11 @@
+# The role colours' save endpoints. The editor lives on the style guide
+# (style/_theme), so GET /admin/theme sends an admin there; the route and its
+# name stay, because hosts link and register them.
 class ThemeSettingsController < ApplicationController
   before_action :require_admin
 
   def edit
-    @theme_setting = ThemeSetting.current
-    @defaults = Studio.theme_config
-    @preview_css = Studio::ThemeResolver.new(@theme_setting.resolved_colors).to_css
+    redirect_to editor_path
   end
 
   def update
@@ -18,10 +19,7 @@ class ThemeSettingsController < ApplicationController
   rescue StandardError => e
     return render(json: { error: e.message }, status: :unprocessable_entity) if request.format.json?
 
-    @defaults = Studio.theme_config
-    @preview_css = Studio::ThemeResolver.new(@theme_setting.resolved_colors).to_css
-    flash.now[:alert] = "Error saving theme: #{e.message}"
-    render :edit, status: :unprocessable_entity
+    redirect_to editor_path, alert: "Error saving theme: #{e.message}"
   end
 
   def regenerate
@@ -31,12 +29,14 @@ class ThemeSettingsController < ApplicationController
 
   private
 
+  def editor_path = admin_style_path(anchor: "theme")
+
   # The style guide saves by fetch and asks for JSON: a 204 is its proof of the
   # write. A form post is redirected back to the editor.
   def done(notice)
     return head(:no_content) if request.format.json?
 
-    redirect_to admin_theme_path, notice: notice
+    redirect_to editor_path, notice: notice
   end
 
   def theme_params

data/app/helpers/studio/agent_chat_helper.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+module Studio
+  # The agent chat's voice option (docs/AGENT_CHAT.md, "Talking by voice").
+  module AgentChatHelper
+    # The signed-in user on this page, or nil. A page whose controller has no
+    # current_user is a signed-out page.
+    def studio_agent_chat_viewer
+      respond_to?(:current_user) ? current_user : nil
+    end
+
+    # Whether this viewer gets the microphone: the app turned takes on (no route
+    # otherwise) and Studio.voice_chat_allowed lets them talk. Never a signed-out
+    # visitor: POST /voice/takes is sign-in only.
+    def studio_agent_chat_voice?
+      return false unless Studio.voice_transcription && respond_to?(:studio_voice_takes_path)
+
+      Studio.voice_chat_allowed?(studio_agent_chat_viewer)
+    end
+
+    # The embedder the page runs on a take (Studio::VoiceMatch.browser_config),
+    # as JSON, or nil. Only for a user whose saved voice came from the app's own
+    # embedder: anything else answers embedder_mismatch or no_profile on the
+    # server, so downloading the model would buy nothing.
+    def studio_agent_chat_embedder(user)
+      return nil unless user.respond_to?(:voice_embedding) && user.respond_to?(:voice_embedding_model)
+      return nil if user.voice_embedding.blank?
+
+      name = Studio.voice_embedder.to_s
+      return nil unless user.voice_embedding_model.to_s == Studio::VoiceMatch.model_id(name)
+
+      Studio::VoiceMatch.browser_config(name).to_json
+    rescue ArgumentError, KeyError
+      nil
+    end
+  end
+end

data/app/javascript/studio/agent_chat.js

@@ -18,6 +18,12 @@
 //            until the app answers 201; a refusal shows its reason above them.
 //   FOLLOW   the thread stays at its end while the reader is within FOLLOW_PX of
 //            it, and always after their own send (the hub's chat_follow rule).
+//   REFRESH  the public hook for code outside the chat (studio/agent_chat_voice, a
+//            host's own composer): dispatch studio:agent-chat:refresh on the
+//            chat's section, optionally with {detail: {turn}}, a turn the app
+//            just answered. The turn shows at once, the chat follows it, and it
+//            polls now; a poll already in flight is followed by one more, so a
+//            refresh is never swallowed.
 //   TYPING   the typing line shows while the hub says an answer is pending:
 //            "thinking", then "typing" once a turn's status is "typing".
 //
@@ -31,6 +37,7 @@ export const IDLE_MS = 30000
 export const OFFLINE_MS = 15000
 export const FOLLOW_PX = 20
 export const LIMIT = 50
+export const REFRESH_EVENT = "studio:agent-chat:refresh"
 const UNSETTLED = new Set(["pending", "typing"])
 
 export function settled(turn) {
@@ -123,7 +130,7 @@ export function mountAgentChat(root, {
   const soul = root.dataset.agentChatSoul
   const name = root.dataset.agentChatName || "The agent"
 
-  const state = { turns: [], pending: false, waitingSince: null, offline: false, inFlight: false, sending: false, timer: null, alive: true, following: true }
+  const state = { turns: [], pending: false, waitingSince: null, offline: false, inFlight: false, pollAgain: false, sending: false, timer: null, alive: true, following: true }
 
   const onScroll = () => { state.following = isFollowing(log) }
   log.addEventListener("scroll", onScroll, { passive: true })
@@ -199,10 +206,40 @@ export function mountAgentChat(root, {
       setOffline(true)
     } finally {
       state.inFlight = false
-      schedule()
+      if (state.pollAgain) {
+        state.pollAgain = false
+        if (state.alive) poll()
+      } else {
+        schedule()
+      }
     }
   }
 
+  // The public refresh hook (REFRESH above). Returns poll's promise, or nothing
+  // when the poll in flight will be followed by another.
+  function refresh({ turn } = {}) {
+    if (!state.alive) return undefined
+    if (turn) {
+      state.turns = mergeTurns(state.turns, [turn])
+      state.pending = true
+      state.following = true
+      state.waitingSince = now()
+      setOffline(false)
+      render()
+      toEnd()
+    }
+    if (state.inFlight) {
+      state.pollAgain = true
+      return undefined
+    }
+    clearTimer(state.timer)
+    return poll()
+  }
+
+  function onRefresh(event) {
+    refresh(event.detail || {})
+  }
+
   async function submit(event) {
     if (event) event.preventDefault()
     const text = (input.value || "").trim()
@@ -264,6 +301,7 @@ export function mountAgentChat(root, {
   form && form.addEventListener("submit", submit)
   input && input.addEventListener("keydown", onKeydown)
   retry && retry.addEventListener("click", onRetry)
+  root.addEventListener(REFRESH_EVENT, onRefresh)
   doc && doc.addEventListener && doc.addEventListener("visibilitychange", onVisible)
   root.dataset.agentChatReady = "true"
   poll()
@@ -271,6 +309,7 @@ export function mountAgentChat(root, {
   return {
     state,
     poll,
+    refresh,
     submit,
     destroy() {
       state.alive = false
@@ -279,6 +318,7 @@ export function mountAgentChat(root, {
       form && form.removeEventListener("submit", submit)
       input && input.removeEventListener("keydown", onKeydown)
       retry && retry.removeEventListener("click", onRetry)
+      root.removeEventListener(REFRESH_EVENT, onRefresh)
       doc && doc.removeEventListener && doc.removeEventListener("visibilitychange", onVisible)
       delete root.dataset.agentChatReady
     }