@oh-my-pi/pi-coding-agent 17.1.0 → 17.1.2

package/src/live/attestation.ts

@@ -0,0 +1,91 @@
+import { deviceCheckGenerateToken } from "@oh-my-pi/pi-natives";
+
+const CHATGPT_BUNDLE_ID = "com.openai.codex";
+const APP_SESSION_ID = crypto.randomUUID();
+
+type DeviceCheckResult = {
+	supported: boolean;
+	tokenBase64?: string | null;
+	latencyMs?: number | null;
+};
+
+function cborHeader(major: number, value: number): Buffer {
+	if (!Number.isSafeInteger(value) || value < 0) throw new Error(`Invalid CBOR length: ${value}`);
+	if (value < 24) return Buffer.from([major + value]);
+	if (value <= 0xff) return Buffer.from([major + 24, value]);
+	if (value <= 0xffff) {
+		const output = Buffer.allocUnsafe(3);
+		output[0] = major + 25;
+		output.writeUInt16BE(value, 1);
+		return output;
+	}
+	if (value <= 0xffff_ffff) {
+		const output = Buffer.allocUnsafe(5);
+		output[0] = major + 26;
+		output.writeUInt32BE(value, 1);
+		return output;
+	}
+	throw new Error(`CBOR length is too large: ${value}`);
+}
+
+function cborUnsigned(value: number): Buffer {
+	return cborHeader(0, value);
+}
+
+function cborText(value: string): Buffer {
+	const text = Buffer.from(value, "utf8");
+	return Buffer.concat([cborHeader(96, text.length), text]);
+}
+
+function cborMap(entries: ReadonlyArray<readonly [Buffer, Buffer]>): Buffer {
+	const values: Buffer[] = [cborHeader(160, entries.length)];
+	for (const [key, value] of entries) values.push(key, value);
+	return Buffer.concat(values);
+}
+
+function attestationSignals(): Buffer {
+	const resolved = Intl.DateTimeFormat().resolvedOptions();
+	const locale = (resolved.locale || "unknown").slice(0, 64);
+	const timezone = (resolved.timeZone || "unknown").slice(0, 64);
+	const preferredLanguages = Buffer.concat([cborHeader(128, 1), cborText(locale)]);
+	return cborMap([
+		[cborUnsigned(0), cborUnsigned(1)],
+		[cborUnsigned(1), preferredLanguages],
+		[cborUnsigned(2), cborText(locale)],
+		[cborUnsigned(3), cborText(timezone)],
+		[cborUnsigned(4), cborUnsigned(0)],
+		[cborUnsigned(5), cborUnsigned(1)],
+		[cborUnsigned(6), cborText(APP_SESSION_ID.slice(0, 128))],
+	]);
+}
+
+function buildClientAttestation(result: DeviceCheckResult): string {
+	const entries: Array<readonly [Buffer, Buffer]> = [];
+	if (result.supported && result.tokenBase64) {
+		entries.push([cborText("token"), cborText(result.tokenBase64)]);
+	} else {
+		entries.push([cborText("error_code"), cborUnsigned(result.supported ? 4 : 3)]);
+	}
+	entries.push([cborText("bundle_id"), cborText(CHATGPT_BUNDLE_ID)]);
+	const signals = attestationSignals();
+	entries.push([cborText("f"), Buffer.concat([cborHeader(64, signals.length), signals])]);
+	if (result.latencyMs !== undefined && result.latencyMs !== null) {
+		const latency = Buffer.allocUnsafe(9);
+		latency[0] = 0xfb;
+		latency.writeDoubleBE(result.latencyMs, 1);
+		entries.push([cborText("t"), latency]);
+	}
+	return `v1.${cborMap(entries).toString("base64url")}`;
+}
+
+/** Generates the Codex DeviceCheck attestation envelope sent as `x-oai-attestation` on ChatGPT-OAuth requests. */
+export async function generateCodexAttestation(): Promise<string | undefined> {
+	if (process.platform !== "darwin" || process.arch !== "arm64") return undefined;
+	let result: DeviceCheckResult;
+	try {
+		result = await deviceCheckGenerateToken();
+	} catch {
+		return undefined;
+	}
+	return JSON.stringify({ v: 1, s: 0, t: buildClientAttestation(result) });
+}

package/src/live/controller.ts

@@ -1,10 +1,11 @@
 import * as os from "node:os";
 import type { AgentMessage } from "@oh-my-pi/pi-agent-core";
 import type { AssistantMessage } from "@oh-my-pi/pi-ai";
+import { AudioCapture } from "@oh-my-pi/pi-natives";
 import { prompt } from "@oh-my-pi/pi-utils";
 import type { AgentSession } from "../session/agent-session";
 import type { AgentSessionEvent } from "../session/agent-session-events";
-import { type StreamingRecordingHandle, startStreamingRecording } from "../stt/recorder";
+import { LIVE_DELEGATION_MESSAGE_TYPE } from "../session/messages";
 import agentFinalMessageTemplate from "./prompts/agent-final-message.md" with { type: "text" };
 import liveInstructionsTemplate from "./prompts/live-instructions.md" with { type: "text" };
 import {
@@ -15,13 +16,22 @@ import {
 	type LiveServerEvent,
 } from "./protocol";
 import { CodexLiveTransport } from "./transport";
-import type { LivePhase, LiveTranscript } from "./visualizer";
+import type { LivePhase } from "./visualizer";
 
-const DEFAULT_VOICE = "marin";
+const DEFAULT_VOICE = "sol";
 const OUTPUT_ACTIVE_LEVEL = 0.015;
 const MIN_BARGE_IN_LEVEL = 0.04;
 const OUTPUT_ECHO_RATIO = 0.65;
 
+/** Incremental or final transcript for one realtime conversational turn. */
+export interface LiveTranscript {
+	role: "user" | "assistant";
+	text: string;
+	/** Monotonic role-local turn number used to coalesce streaming updates. */
+	turn: number;
+	final: boolean;
+}
+
 /** UI notifications emitted during a live session. */
 export interface LiveSessionCallbacks {
 	/** Reports connection and activity phase changes. */
@@ -42,7 +52,7 @@ export interface LiveSessionControllerOptions {
 	callbacks: LiveSessionCallbacks;
 	/** Extracts visible assistant text using the caller's normal UI rules. */
 	extractAssistantText(message: AssistantMessage): string;
-	/** Realtime output voice, defaulting to marin. */
+	/** Realtime output voice, defaulting to sol. */
 	voice?: string;
 }
 
@@ -85,7 +95,7 @@ export class LiveSessionController {
 	readonly #voice: string;
 
 	#transport: CodexLiveTransport | undefined;
-	#recorder: StreamingRecordingHandle | undefined;
+	#recorder: AudioCapture | undefined;
 	#unsubscribeSession: (() => void) | undefined;
 	#sendChain: Promise<void> = Promise.resolve();
 	#stopPromise: Promise<void> | undefined;
@@ -102,6 +112,8 @@ export class LiveSessionController {
 	#assistantTranscript = "";
 	#userTranscriptFinal = false;
 	#assistantTranscriptFinal = false;
+	#userTranscriptTurn = 0;
+	#assistantTranscriptTurn = 0;
 	#lastTranscript: LiveTranscript | undefined;
 
 	constructor(options: LiveSessionControllerOptions) {
@@ -161,20 +173,21 @@ export class LiveSessionController {
 			if (this.#stopped) {
 				throw this.#failure ?? new Error("The live session stopped before recording began.");
 			}
-			const recorder = await startStreamingRecording(samples => this.#handleMicrophoneAudio(samples));
+			const recorder = new AudioCapture(16_000, (error, samples) => {
+				if (error) {
+					this.#reportFailure(error);
+					return;
+				}
+				this.#handleMicrophoneAudio(samples);
+			});
 			if (this.#stopped) {
-				if (recorder) {
-					try {
-						await recorder.stop();
-					} catch {
-						// Preserve the failure that stopped startup.
-					}
+				try {
+					recorder.stop();
+				} catch {
+					// Preserve the failure that stopped startup.
 				}
 				throw this.#failure ?? new Error("The live session stopped while recording began.");
 			}
-			if (!recorder) {
-				throw new Error("Live mode needs a streaming audio recorder; run `omp setup speech` and try again.");
-			}
 			this.#recorder = recorder;
 			this.#refreshAudioPhase();
 		} catch (cause) {
@@ -216,7 +229,7 @@ export class LiveSessionController {
 		this.#recorder = undefined;
 		if (recorder) {
 			try {
-				await recorder.stop();
+				recorder.stop();
 			} catch (cause) {
 				cleanupError = errorFrom(cause);
 			}
@@ -288,7 +301,17 @@ export class LiveSessionController {
 		if (!request) return;
 		this.#activeDelegationId = event.item.id;
 		this.#emitPhase("working");
-		void this.#session.sendUserMessage(request).catch(cause => this.#reportFailure(errorFrom(cause)));
+		void this.#session
+			.sendCustomMessage(
+				{
+					customType: LIVE_DELEGATION_MESSAGE_TYPE,
+					content: request,
+					display: true,
+					attribution: "agent",
+				},
+				{ triggerTurn: true },
+			)
+			.catch(cause => this.#reportFailure(errorFrom(cause)));
 	}
 
 	#handleSessionEvent(event: AgentSessionEvent): void {
@@ -354,7 +377,12 @@ export class LiveSessionController {
 		const current = role === "user" ? this.#userTranscript : this.#assistantTranscript;
 		const wasFinal = role === "user" ? this.#userTranscriptFinal : this.#assistantTranscriptFinal;
 		let next: string;
-		if (wasFinal && current !== text && !text.startsWith(current) && !current.endsWith(text)) {
+		if (!current) {
+			this.#startTranscriptTurn(role);
+			next = text;
+		} else if (wasFinal) {
+			if (text === current || current.endsWith(text)) return;
+			this.#startTranscriptTurn(role);
 			next = text;
 		} else if (text.startsWith(current)) {
 			next = text;
@@ -369,20 +397,45 @@ export class LiveSessionController {
 	#finishTranscript(role: LiveTranscript["role"], text: string): void {
 		if (!text) return;
 		const current = role === "user" ? this.#userTranscript : this.#assistantTranscript;
-		const next = current.startsWith(text) && current.length > text.length ? current : text;
+		const wasFinal = role === "user" ? this.#userTranscriptFinal : this.#assistantTranscriptFinal;
+		if (!current) {
+			this.#startTranscriptTurn(role);
+		} else if (wasFinal) {
+			if (text === current) return;
+			this.#startTranscriptTurn(role);
+		}
+		const next = !wasFinal && current.startsWith(text) && current.length > text.length ? current : text;
 		this.#storeTranscript(role, next, true);
 	}
 
+	#startTranscriptTurn(role: LiveTranscript["role"]): void {
+		if (role === "user") {
+			this.#userTranscriptTurn += 1;
+		} else {
+			this.#assistantTranscriptTurn += 1;
+		}
+	}
+
 	#storeTranscript(role: LiveTranscript["role"], text: string, final: boolean): void {
+		const normalized = text.trim();
+		if (!normalized) return;
+		const turn = role === "user" ? this.#userTranscriptTurn : this.#assistantTranscriptTurn;
 		if (role === "user") {
-			this.#userTranscript = text;
+			this.#userTranscript = normalized;
 			this.#userTranscriptFinal = final;
 		} else {
-			this.#assistantTranscript = text;
+			this.#assistantTranscript = normalized;
 			this.#assistantTranscriptFinal = final;
 		}
-		if (this.#lastTranscript?.role === role && this.#lastTranscript.text === text) return;
-		this.#emitTranscript({ role, text });
+		if (
+			this.#lastTranscript?.role === role &&
+			this.#lastTranscript.turn === turn &&
+			this.#lastTranscript.text === normalized &&
+			this.#lastTranscript.final === final
+		) {
+			return;
+		}
+		this.#emitTranscript({ role, turn, text: normalized, final });
 	}
 
 	#queueSend(message: LiveClientMessage): void {

package/src/live/protocol.test.ts

@@ -95,12 +95,12 @@ describe("Frameless Bidi server events", () => {
 });
 
 describe("Frameless Bidi client payloads", () => {
-	test("builds the exact multipart call session JSON", () => {
+	test("builds the exact live call session JSON", () => {
 		const payload = buildLiveSessionPayload("Be concise.", "marin");
 
-		expect(LIVE_MODEL).toBe("gpt-live-1-boulder-alpha");
+		expect(LIVE_MODEL).toBe("gpt-live-1-codex");
 		expect(JSON.stringify(payload)).toBe(
-			'{"model":"gpt-live-1-boulder-alpha","instructions":"Be concise.","audio":{"output":{"voice":"marin"}},"delegation":{"type":"client"}}',
+			'{"model":"gpt-live-1-codex","instructions":"Be concise.","audio":{"output":{"voice":"marin"}},"delegation":{"type":"client"}}',
 		);
 	});
 

package/src/live/protocol.ts

@@ -1,5 +1,5 @@
 /** Frameless Bidi model used by Codex Desktop live calls. */
-export const LIVE_MODEL: "gpt-live-1-boulder-alpha" = "gpt-live-1-boulder-alpha";
+export const LIVE_MODEL: "gpt-live-1-codex" = "gpt-live-1-codex";
 
 /** Maximum UTF-8 payload size accepted by each context append. */
 export const CONTEXT_CHUNK_BYTES = 500;

package/src/live/transport.ts

@@ -4,13 +4,10 @@ import {
 	CODEX_BASE_URL,
 	CODEX_CLIENT_VERSION,
 	getCodexAccountId,
-	OPENAI_HEADER_VALUES,
 	OPENAI_HEADERS,
 } from "@oh-my-pi/pi-catalog/wire/codex";
-import type { Browser, HTTPRequest, Page } from "puppeteer-core";
-import { launchHeadlessBrowser } from "../tools/browser/launch";
-import audioWorkletSource from "./audio-worklet.txt" with { type: "text" };
-import browserRuntimeSource from "./browser-runtime.txt" with { type: "text" };
+import { LiveWebRtcPeer } from "@oh-my-pi/pi-natives";
+import { generateCodexAttestation } from "./attestation";
 import {
 	buildLiveSessionPayload,
 	type LiveClientMessage,
@@ -20,37 +17,19 @@ import {
 
 const SIGNALING_URL = `${CODEX_BASE_URL}/codex/realtime/calls?intent=quicksilver&architecture=avas`;
 const MAX_ERROR_BODY_LENGTH = 2_048;
-const MAX_HOST_AUDIO_SAMPLES = 32_000;
 const SIDEBAND_CONNECT_ATTEMPTS = 5;
 const SIDEBAND_CONNECT_TIMEOUT_MS = 15_000;
 const LIVE_PROVIDER = "openai-codex";
-const LIVE_CALL_ID_PATTERN = /^rtc_[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}$/i;
+const LIVE_ORIGINATOR = "Codex Desktop";
+const LIVE_CALL_ID_PATTERN = /^rtc_[\w-]+$/;
 
 type Lifecycle = "idle" | "connecting" | "connected" | "closing" | "closed";
 
-type BrowserLiveApi = {
-	start(workletSource: string): Promise<string>;
-	acceptAnswer(sdp: string): Promise<void>;
-	waitForOpen(): Promise<void>;
-	send(payload: string): void;
-	pushAudio(payload: string): void;
-	setMuted(muted: boolean): void;
-	close(): Promise<void>;
-};
-
-declare global {
-	var ompCodexLive: BrowserLiveApi;
-}
-
-interface QueuedAudio {
-	payload: string;
-	sampleCount: number;
-}
-
 interface LiveSignalingResult {
 	answer: string;
 	callId: string;
 	access: OAuthAccess;
+	attestation: string | undefined;
 }
 
 class LiveSignalingError extends Error {
@@ -81,7 +60,7 @@ export interface LiveTransportOptions {
 	signal?: AbortSignal;
 }
 
-/** Extracts the server-assigned `rtc_<uuid>` call ID from a signaling Location header. */
+/** Extracts the server-assigned `rtc_*` call ID from a signaling Location header. */
 export function parseLiveCallId(location: string | null): string | undefined {
 	if (!location) return undefined;
 	return location
@@ -92,23 +71,30 @@ export function parseLiveCallId(location: string | null): string | undefined {
 
 /** Builds the Frameless Bidi sideband WebSocket URL for an accepted Codex call. */
 export function buildLiveSidebandUrl(callId: string): string {
-	const url = new URL(`${CODEX_BASE_URL}/codex/${encodeURIComponent(callId)}`);
-	url.protocol = url.protocol === "http:" ? "ws:" : "wss:";
+	const url = new URL(`https://api.openai.com/v1/live/${encodeURIComponent(callId)}`);
+	url.protocol = "wss:";
 	return url.toString();
 }
 
-function liveSessionHeaders(access: OAuthAccess, sessionId: string): Record<string, string> {
+function liveSessionHeaders(
+	access: OAuthAccess,
+	sessionId: string,
+	realtimeSessionId: string,
+	attestation: string | undefined,
+): Record<string, string> {
 	const headers: Record<string, string> = {
 		Authorization: `Bearer ${access.accessToken}`,
 		"OpenAI-Alpha": "quicksilver=v2",
-		"x-session-id": sessionId,
-		[OPENAI_HEADERS.ORIGINATOR]: OPENAI_HEADER_VALUES.ORIGINATOR_CODEX,
+		"User-Agent": `Codex Desktop/${CODEX_CLIENT_VERSION}`,
+		"x-session-id": realtimeSessionId,
+		[OPENAI_HEADERS.ORIGINATOR]: LIVE_ORIGINATOR,
 		[OPENAI_HEADERS.VERSION]: CODEX_CLIENT_VERSION,
 		[OPENAI_HEADERS.SCOPED_SESSION_ID]: sessionId,
 		[OPENAI_HEADERS.THREAD_ID]: sessionId,
 	};
 	const accountId = access.accountId ?? getCodexAccountId(access.accessToken);
 	if (accountId) headers[OPENAI_HEADERS.ACCOUNT_ID] = accountId;
+	if (attestation) headers["x-oai-attestation"] = attestation;
 	return headers;
 }
 
@@ -128,23 +114,16 @@ function abortReason(signal: AbortSignal | undefined): Error {
 	return new DOMException("Live connection aborted", "AbortError");
 }
 
-function encodePcm(samples: Float32Array): string {
-	return Buffer.from(samples.buffer, samples.byteOffset, samples.byteLength).toString("base64");
-}
-
-/** Headless-Chromium WebRTC transport for a Codex Frameless Bidi live session. */
+/** Native WebRTC transport for a Codex Frameless Bidi live session. */
 export class CodexLiveTransport {
 	readonly #options: LiveTransportOptions;
-	#browser: Browser | undefined;
-	#page: Page | undefined;
+	#peer: LiveWebRtcPeer | undefined;
+	readonly #realtimeSessionId = crypto.randomUUID();
 	#sideband: Bun.WebSocket | undefined;
 	#state: Lifecycle = "idle";
 	#connectPromise: Promise<void> | undefined;
 	#closePromise: Promise<void> | undefined;
 	#sendTail: Promise<void> = Promise.resolve();
-	#audioQueue: QueuedAudio[] = [];
-	#queuedAudioSamples = 0;
-	#audioPumpRunning = false;
 	#muted = false;
 	#unexpectedFailureReported = false;
 	readonly #abortListener: () => void;
@@ -157,7 +136,7 @@ export class CodexLiveTransport {
 		if (!options.signal?.aborted) options.signal?.addEventListener("abort", this.#abortListener, { once: true });
 	}
 
-	/** Establish the browser peer, perform Codex signaling, and wait for the data channel. */
+	/** Establish the native peer, perform Codex signaling, and wait for the data channel. */
 	connect(): Promise<void> {
 		if (this.#state === "connected") return Promise.resolve();
 		if (this.#connectPromise) return this.#connectPromise;
@@ -174,49 +153,42 @@ export class CodexLiveTransport {
 	}
 
 	async #connect(): Promise<void> {
-		const browser = await launchHeadlessBrowser({
-			headless: true,
-			args: ["--autoplay-policy=no-user-gesture-required"],
-			ignoreDefaultArgs: ["--mute-audio"],
-		});
-		this.#browser = browser;
-		if (this.#state !== "connecting") throw abortReason(this.#options.signal);
-		const page = await browser.newPage();
-		this.#page = page;
-		await page.setRequestInterception(true);
-		const serveBlankPage = (request: HTTPRequest): void => {
-			void request
-				.respond({ status: 200, contentType: "text/html", body: "<!doctype html><title>Codex Live</title>" })
-				.catch(() => {});
-		};
-		page.on("request", serveBlankPage);
-		try {
-			await page.goto("http://localhost/", { waitUntil: "domcontentloaded" });
-		} finally {
-			page.off("request", serveBlankPage);
-			await page.setRequestInterception(false);
-		}
-		await page.exposeFunction("__ompLiveServerEvent", (payload: string) => this.#handleServerEvent(payload));
-		await page.exposeFunction("__ompLiveOutputLevel", (level: number) => this.#handleOutputLevel(level));
-		await page.exposeFunction("__ompLiveFailure", (message: string) => this.#handleBrowserFailure(message));
-		await page.evaluate(source => Function(source)(), browserRuntimeSource);
-		const offer = await page.evaluate(source => globalThis.ompCodexLive.start(source), audioWorkletSource);
+		const peer = new LiveWebRtcPeer(
+			(error, payload) => {
+				if (error) {
+					this.#handlePeerFailure(error.message);
+				} else {
+					this.#handleServerEvent(payload);
+				}
+			},
+			(error, level) => {
+				if (error) {
+					this.#handlePeerFailure(error.message);
+				} else {
+					this.#handleOutputLevel(level);
+				}
+			},
+			(error, message) => this.#handlePeerFailure(error?.message ?? message),
+		);
+		this.#peer = peer;
+		const offer = await peer.createOffer();
 		if (this.#state !== "connecting") throw abortReason(this.#options.signal);
 		const signaling = await this.#signal(offer);
-		await page.evaluate(sdp => globalThis.ompCodexLive.acceptAnswer(sdp), signaling.answer);
-		await page.evaluate(muted => globalThis.ompCodexLive.setMuted(muted), this.#muted);
-		await page.evaluate(() => globalThis.ompCodexLive.waitForOpen());
+		await peer.acceptAnswer(signaling.answer);
+		peer.setMuted(this.#muted);
+		await peer.waitForOpen();
 		if (this.#state !== "connecting") throw abortReason(this.#options.signal);
-		await this.#connectSideband(signaling.callId, signaling.access);
+		await this.#connectSideband(signaling.callId, signaling.access, signaling.attestation);
 		if (this.#state !== "connecting") throw abortReason(this.#options.signal);
 		this.#state = "connected";
 	}
 
 	async #signal(offer: string): Promise<LiveSignalingResult> {
+		const attestation = await generateCodexAttestation();
 		return await withOAuthAccess(
 			this.#options.authStorage,
 			LIVE_PROVIDER,
-			access => this.#signalWithAccess(offer, access),
+			access => this.#signalWithAccess(offer, access, attestation),
 			{
 				sessionId: this.#options.sessionId,
 				signal: this.#options.signal,
@@ -226,10 +198,14 @@ export class CodexLiveTransport {
 		);
 	}
 
-	async #signalWithAccess(offer: string, access: OAuthAccess): Promise<LiveSignalingResult> {
+	async #signalWithAccess(
+		offer: string,
+		access: OAuthAccess,
+		attestation: string | undefined,
+	): Promise<LiveSignalingResult> {
 		const headers = new Headers({
-			...liveSessionHeaders(access, this.#options.sessionId),
-			Accept: "application/sdp",
+			...liveSessionHeaders(access, this.#options.sessionId, this.#realtimeSessionId, attestation),
+			Accept: "*/*",
 			"Content-Type": "application/json",
 		});
 		const fetchImpl = wrapFetchForProxy(fetch, LIVE_PROVIDER);
@@ -247,20 +223,21 @@ export class CodexLiveTransport {
 			const detail = boundedErrorBody(responseBody, response.statusText);
 			throw new LiveSignalingError(response.status, `Codex live signaling failed (${response.status}): ${detail}`);
 		}
-		const answer = responseBody.trim();
-		if (!answer) throw new LiveSignalingError(response.status, "Codex live signaling returned an empty SDP answer");
+		const answer = responseBody;
+		if (!answer.trim())
+			throw new LiveSignalingError(response.status, "Codex live signaling returned an empty SDP answer");
 		const callId = parseLiveCallId(response.headers.get("location"));
 		if (!callId) {
 			throw new LiveSignalingError(response.status, "Codex live signaling returned no valid call ID");
 		}
-		return { answer, callId, access };
+		return { answer, callId, access, attestation };
 	}
 
-	async #connectSideband(callId: string, access: OAuthAccess): Promise<void> {
+	async #connectSideband(callId: string, access: OAuthAccess, attestation: string | undefined): Promise<void> {
 		let failure = new Error("Codex live sideband connection failed");
 		for (let attempt = 0; attempt < SIDEBAND_CONNECT_ATTEMPTS; attempt++) {
 			try {
-				await this.#openSideband(callId, access);
+				await this.#openSideband(callId, access, attestation);
 				return;
 			} catch (cause) {
 				failure = cause instanceof Error ? cause : new Error(String(cause));
@@ -271,10 +248,10 @@ export class CodexLiveTransport {
 		throw failure;
 	}
 
-	async #openSideband(callId: string, access: OAuthAccess): Promise<void> {
+	async #openSideband(callId: string, access: OAuthAccess, attestation: string | undefined): Promise<void> {
 		const url = buildLiveSidebandUrl(callId);
 		const options = {
-			headers: liveSessionHeaders(access, this.#options.sessionId),
+			headers: liveSessionHeaders(access, this.#options.sessionId, this.#realtimeSessionId, attestation),
 			proxy: getProxyForProvider(LIVE_PROVIDER),
 		} satisfies Bun.WebSocketOptions;
 		const socket: Bun.WebSocket = Reflect.construct(WebSocket, [url, options]);
@@ -377,7 +354,7 @@ export class CodexLiveTransport {
 		} catch {}
 	}
 
-	#handleBrowserFailure(message: string): void {
+	#handlePeerFailure(message: string): void {
 		this.#reportFailure(message);
 	}
 
@@ -405,52 +382,19 @@ export class CodexLiveTransport {
 		return operation;
 	}
 
-	/** Queue 16 kHz mono Float32 PCM for continuous browser-side resampling and playback. */
+	/** Queue 16 kHz mono Float32 PCM for native Opus transmission. */
 	pushAudio(samples: Float32Array): void {
 		if (this.#state !== "connected" || this.#muted || samples.length === 0) return;
-		const retained =
-			samples.length > MAX_HOST_AUDIO_SAMPLES ? samples.subarray(samples.length - MAX_HOST_AUDIO_SAMPLES) : samples;
-		const queued = { payload: encodePcm(retained), sampleCount: retained.length };
-		this.#audioQueue.push(queued);
-		this.#queuedAudioSamples += queued.sampleCount;
-		while (this.#queuedAudioSamples > MAX_HOST_AUDIO_SAMPLES && this.#audioQueue.length > 1) {
-			const stale = this.#audioQueue.shift();
-			if (stale) this.#queuedAudioSamples -= stale.sampleCount;
-		}
-		if (!this.#audioPumpRunning) void this.#pumpAudio();
+		this.#peer?.pushAudio(samples);
 	}
 
-	async #pumpAudio(): Promise<void> {
-		this.#audioPumpRunning = true;
-		try {
-			while (this.#state === "connected" && !this.#muted) {
-				const queued = this.#audioQueue.shift();
-				if (!queued) break;
-				this.#queuedAudioSamples -= queued.sampleCount;
-				const page = this.#page;
-				if (!page) break;
-				await page.evaluate(payload => globalThis.ompCodexLive.pushAudio(payload), queued.payload);
-			}
-		} catch {
-			this.#audioQueue.length = 0;
-			this.#queuedAudioSamples = 0;
-		} finally {
-			this.#audioPumpRunning = false;
-			if (this.#audioQueue.length > 0 && this.#state === "connected" && !this.#muted) void this.#pumpAudio();
-		}
-	}
-
-	/** Enable or disable the browser audio source and discard queued input when muted. */
+	/** Enable or disable the native audio source and discard partial input when muted. */
 	async setMuted(muted: boolean): Promise<void> {
 		this.#muted = muted;
-		this.#audioQueue.length = 0;
-		this.#queuedAudioSamples = 0;
-		const page = this.#page;
-		if (!page || this.#state !== "connected") return;
-		await page.evaluate(value => globalThis.ompCodexLive.setMuted(value), muted);
+		if (this.#state === "connected") this.#peer?.setMuted(muted);
 	}
 
-	/** Stop audio, WebRTC, the page, and Chromium. Safe to call repeatedly. */
+	/** Stop sideband signaling and the native WebRTC media peer. Safe to call repeatedly. */
 	close(): Promise<void> {
 		if (this.#closePromise) return this.#closePromise;
 		this.#state = "closing";
@@ -461,28 +405,16 @@ export class CodexLiveTransport {
 
 	async #close(): Promise<void> {
 		this.#options.signal?.removeEventListener("abort", this.#abortListener);
-		this.#audioQueue.length = 0;
-		this.#queuedAudioSamples = 0;
 		const sideband = this.#sideband;
-		const page = this.#page;
-		const browser = this.#browser;
+		const peer = this.#peer;
 		this.#sideband = undefined;
-		this.#page = undefined;
-		this.#browser = undefined;
+		this.#peer = undefined;
 		if (sideband && (sideband.readyState === WebSocket.OPEN || sideband.readyState === WebSocket.CONNECTING)) {
 			sideband.close(1000, "done");
 		}
-		if (page) {
-			try {
-				await page.evaluate(() => globalThis.ompCodexLive?.close());
-			} catch {}
-			try {
-				await page.close();
-			} catch {}
-		}
-		if (browser) {
+		if (peer) {
 			try {
-				await browser.close();
+				await peer.close();
 			} catch {}
 		}
 		this.#state = "closed";