draken 0.1.6 → 0.3.0

package/runtime/pi/package.json

@@ -0,0 +1,12 @@
+{
+  "name": "draken-private-pi-runtime",
+  "version": "1.0.0",
+  "private": true,
+  "description": "Pinned private summarization runtime; installed only by draken setup",
+  "dependencies": {
+    "@earendil-works/pi-coding-agent": "1.5.0"
+  },
+  "engines": {
+    "node": ">=22.19.0"
+  }
+}

package/tray/macos.js

@@ -0,0 +1,72 @@
+/* Native menu-bar helper, run by /usr/bin/osascript -l JavaScript.
+ * No Apple Events to other apps, shell commands, provider state or network access. */
+ObjC.import('AppKit');
+ObjC.import('Foundation');
+
+function run() {
+  var environment = $.NSProcessInfo.processInfo.environment;
+  var statePath = ObjC.unwrap(environment.objectForKey('DRAKEN_TRAY_STATE'));
+  var assets = ObjC.unwrap(environment.objectForKey('DRAKEN_TRAY_ASSETS'));
+  var app = $.NSApplication.sharedApplication;
+  app.setActivationPolicy($.NSApplicationActivationPolicyAccessory);
+  var tray = $.NSStatusBar.systemStatusBar.statusItemWithLength($.NSVariableStatusItemLength);
+  var menu = $.NSMenu.alloc.init;
+  menu.autoenablesItems = false;
+  var items = {}, lastPhase = '', timer;
+  function emit(value) {
+    $.NSFileHandle.fileHandleWithStandardOutput.writeData($(JSON.stringify(value) + '\n').dataUsingEncoding($.NSUTF8StringEncoding));
+  }
+  function update() {
+    var bytes = $.NSData.dataWithContentsOfFile($(statePath));
+    if (Number(bytes.length) > 16384) throw new Error('Invalid tray state');
+    var state = JSON.parse(ObjC.unwrap($.NSString.alloc.initWithDataEncoding(bytes, $.NSUTF8StringEncoding)));
+    if (state.quit || Math.abs(Date.now() - state.updated) > 15000) { app.terminate(null); return; }
+    if (state.version !== 1 || ['running', 'stopped', 'starting', 'stopping', 'error'].indexOf(state.phase) < 0) throw new Error('Invalid tray state');
+    tray.button.toolTip = $(state.title + '\n' + state.detail);
+    items.status.title = $(state.title);
+    items.detail.title = $(state.detail || 'Server connectivity only — not model readiness');
+    items.open.enabled = !!state.canOpen;
+    items.start.enabled = !!state.canStart;
+    items.stop.enabled = !!state.canStop;
+    items.quit.title = $(state.owned ? 'Quit tray and stop Draken' : 'Quit tray (leave server running)');
+    if (lastPhase !== state.phase) {
+      var image = $.NSImage.alloc.initWithContentsOfFile($(assets + '/' + state.phase + '.png'));
+      image.size = $.NSMakeSize(20, 20);
+      image.template = false;
+      tray.button.image = image;
+      lastPhase = state.phase;
+    }
+  }
+  ObjC.registerSubclass({ name: 'DrakenTrayDelegate', superclass: 'NSObject', methods: {
+    'clicked:': { types: ['void', ['id']], implementation: function(sender) {
+      emit({ type: 'action', action: ObjC.unwrap(sender.representedObject) });
+    } },
+    'tick:': { types: ['void', ['id']], implementation: function() {
+      try { update(); } catch (error) { app.terminate(null); }
+    } }
+  } });
+  var delegate = $.DrakenTrayDelegate.alloc.init;
+  function item(id, title, enabled) {
+    var value = $.NSMenuItem.alloc.initWithTitleActionKeyEquivalent($(title), enabled ? 'clicked:' : null, $(''));
+    value.target = delegate;
+    value.representedObject = $(id);
+    value.enabled = enabled;
+    items[id] = value;
+    menu.addItem(value);
+  }
+  item('status', 'Draken — Starting', false);
+  item('detail', 'Checking server', false);
+  menu.addItem($.NSMenuItem.separatorItem);
+  item('open', 'Open Draken', true);
+  item('start', 'Start Draken (current settings)', true);
+  item('stop', 'Stop Draken (ends active calls)', true);
+  menu.addItem($.NSMenuItem.separatorItem);
+  item('quit', 'Quit tray', true);
+  tray.menu = menu;
+  update();
+  timer = $.NSTimer.timerWithTimeIntervalTargetSelectorUserInfoRepeats(0.5, delegate, 'tick:', null, true);
+  $.NSRunLoop.mainRunLoop.addTimerForMode(timer, $.NSRunLoopCommonModes);
+  app.finishLaunching;
+  emit({ type: 'ready' });
+  app.run;
+}

package/tray/windows.ps1

@@ -0,0 +1,104 @@
+# Native notification-area helper. Executed as fixed packaged PowerShell code;
+# never evaluates presentation data or changes execution/application-control policy.
+$ErrorActionPreference = 'Stop'
+[Console]::Out.WriteLine('{"type":"progress","phase":"configuring-output"}')
+[Console]::Out.Flush()
+[Console]::OutputEncoding = [System.Text.UTF8Encoding]::new($false)
+$ProgressPreference = 'SilentlyContinue'
+$PSModuleAutoLoadingPreference = 'None'
+# Load only the required system module, not user module discovery (which can
+# spend 30+ seconds scanning a fresh Windows profile before the first cmdlet).
+Import-Module ($PSHOME + '\Modules\Microsoft.PowerShell.Utility\Microsoft.PowerShell.Utility.psd1') -ErrorAction Stop
+[Console]::Out.WriteLine('{"type":"progress","phase":"loading-frameworks"}')
+[Console]::Out.Flush()
+Add-Type -AssemblyName System.Windows.Forms
+Add-Type -AssemblyName System.Drawing
+if (-not [System.Windows.Forms.SystemInformation]::UserInteractive) { throw 'An interactive Windows desktop is required' }
+$statePath = $env:DRAKEN_TRAY_STATE
+$assets = $env:DRAKEN_TRAY_ASSETS
+$tray = [System.Windows.Forms.NotifyIcon]::new()
+$menu = [System.Windows.Forms.ContextMenuStrip]::new()
+$items = @{}
+$icons = @{}
+$timer = [System.Windows.Forms.Timer]::new()
+
+function Emit($value) {
+    [Console]::Out.WriteLine(($value | ConvertTo-Json -Compress))
+    [Console]::Out.Flush()
+}
+function Add-Item($id, $text, $actionable) {
+    $item = [System.Windows.Forms.ToolStripMenuItem]::new()
+    $item.Text = $text
+    $item.Tag = $id
+    $item.Enabled = $actionable
+    if ($actionable) {
+        $item.add_Click({ param($sender, $eventArgs) Emit @{type='action'; action=[string]$sender.Tag} })
+    }
+    $items[$id] = $item
+    [void]$menu.Items.Add($item)
+}
+function Update-State {
+    # Allow atomic replacement while the parent publishes the next heartbeat.
+    $share = [System.IO.FileShare]::ReadWrite -bor [System.IO.FileShare]::Delete
+    $stream = [System.IO.FileStream]::new($statePath, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read, $share)
+    $reader = $null
+    try {
+        if ($stream.Length -gt 16384) { throw 'Invalid tray state' }
+        $reader = [System.IO.StreamReader]::new($stream, [System.Text.Encoding]::UTF8)
+        $state = $reader.ReadToEnd() | ConvertFrom-Json
+    } finally {
+        if ($null -ne $reader) { $reader.Dispose() } else { $stream.Dispose() }
+    }
+    $now = [DateTimeOffset]::UtcNow.ToUnixTimeMilliseconds()
+    if ($state.quit -or [Math]::Abs($now - [double]$state.updated) -gt 15000) {
+        $timer.Stop()
+        [System.Windows.Forms.Application]::ExitThread()
+        return
+    }
+    if ($state.version -ne 1 -or -not $icons.ContainsKey([string]$state.phase)) { throw 'Invalid tray state' }
+    $tray.Icon = $icons[[string]$state.phase]
+    $title = [string]$state.title
+    $tray.Text = $title.Substring(0, [Math]::Min(63, $title.Length))
+    $items.status.Text = $title
+    $items.detail.Text = if ($state.detail) { [string]$state.detail } else { 'Server connectivity only - not model readiness' }
+    $items.open.Enabled = [bool]$state.canOpen
+    $items.start.Enabled = [bool]$state.canStart
+    $items.stop.Enabled = [bool]$state.canStop
+    $items.quit.Text = if ($state.owned) { 'Quit tray and stop Draken' } else { 'Quit tray (leave server running)' }
+}
+try {
+    Emit @{type='progress'; phase='creating-menu'}
+    foreach ($phase in @('running','stopped','starting','stopping','error')) {
+        $icons[$phase] = [System.Drawing.Icon]::new([System.IO.Path]::Combine($assets, ($phase + '.ico')))
+    }
+    Add-Item 'status' 'Draken - Starting' $false
+    Add-Item 'detail' 'Checking server' $false
+    [void]$menu.Items.Add([System.Windows.Forms.ToolStripSeparator]::new())
+    Add-Item 'open' 'Open Draken' $true
+    Add-Item 'start' 'Start Draken (current settings)' $true
+    Add-Item 'stop' 'Stop Draken (ends active calls)' $true
+    [void]$menu.Items.Add([System.Windows.Forms.ToolStripSeparator]::new())
+    Add-Item 'quit' 'Quit tray' $true
+    $tray.ContextMenuStrip = $menu
+    $tray.add_DoubleClick({ if ($items.open.Enabled) { Emit @{type='action'; action='open'} } })
+    Update-State
+    Emit @{type='progress'; phase='showing-icon'}
+    $tray.Visible = $true
+    $timer.Interval = 500
+    $timer.add_Tick({
+        try { Update-State } catch {
+            $timer.Stop()
+            [System.Windows.Forms.Application]::ExitThread()
+        }
+    })
+    $timer.Start()
+    Emit @{type='ready'}
+    [System.Windows.Forms.Application]::Run()
+} finally {
+    $timer.Stop()
+    $timer.Dispose()
+    $tray.Visible = $false
+    $tray.Dispose()
+    $menu.Dispose()
+    foreach ($icon in $icons.Values) { $icon.Dispose() }
+}

package/voice/realtime/README.md

@@ -0,0 +1,84 @@
+# Experimental subscription-backed live voice
+
+This is Draken’s native WebRTC voice backend, using the official **Codex 0.166.0 App Server** and a separate native ChatGPT sign-in to the same paid account. The browser has one persistent audio connection to OpenAI. It does not start pi, local transcription, or local synthesis for each question.
+
+**Experimental, not a stable public embedding API.** Account/workspace access and future compatibility can change. A paid plan or successful SDP alone does not establish usable voice. There is no Platform API-key or alternative-provider fallback. This is the only voice engine. The local speech engine has been removed; only its historical call records remain readable.
+
+## Operator setup
+
+From a development checkout:
+
+```sh
+npm run voice:realtime:setup
+npm run voice:realtime:login         # owner completes native ChatGPT device sign-in
+npm run voice:realtime:check         # structural check only, no microphone/model
+npm run voice:realtime:probe -- --allow-provider
+
+# After qualification, launch the server:
+npm start
+```
+
+No mode setting is required. Existing `DRAKEN_VOICE_MODE=native` is accepted, but `local` and unknown values are rejected rather than silently changing an old audio-privacy choice. `.env` is not loaded automatically. For an existing installation, stop active calls/model runs, back up its database and retain its existing authentication/TLS settings before restarting. Do not regenerate a sync to enable voice.
+
+Node/npm must be on the operator’s PATH. A pi-managed runtime may already exist at `$HOME/.local/share/pi-node/current/bin`; no OS package installation is necessary if that runtime works.
+
+The pinned helper and its separate credentials live under `~/.draken/realtime/`, outside the repository. Authentication/refresh belongs to the official helper. This implementation never reads or converts pi’s credential. The browser receives no provider token. No inherited API keys, proxy/provider overrides, pi ownership variables or Node preload settings reach the helper. Custom account `config.toml` files and unqualified non-default workspace regions fail closed. Trusted operators/tests may override `DRAKEN_CODEX_BIN` and `DRAKEN_CODEX_HOME`; the exact helper-version and native-auth checks still apply.
+
+## Audio proof, not just a handshake
+
+The opt-in probe requires two real spoken-input fixtures, both roles’ transcripts, and nonzero received audio on one connection. It reports setup separately from turn-to-first-audio timing and confirms browser cleanup and helper exit separately. It uses synthetic data, not the microphone or Draken database. Its temporary server is loopback-only, capability-header authenticated, same-origin/Host restricted, with a ten-second lease and ninety-second lifetime. Reports are private under `~/.draken/realtime/reports/`; no recordings, SDP or tokens are saved.
+
+`nativeLoginPresent` and `readyForProbe` describe local prerequisites, not entitlement. The structural check always reports `audioVerified: false`; it does not reuse an earlier success. A successful current provider probe is the account-specific audio proof. Local-peer tests are not a substitute.
+
+## Read-only architecture
+
+- `rpc.mjs`: bounded private stdio RPC, correlation, deadlines/abort, sanitized errors, and unconditional denial of server-initiated tools/approvals. Unix shutdown targets the launcher/native-child process group, with escalation and exit confirmation.
+- `native.mjs`: native-only account check, ephemeral thread, early-SDP-safe negotiation, text append and cleanup. Call creation uses the Codex backend; the sideband uses the official helper’s default route rather than a guessed override.
+- `backend.mjs`: an authenticated, owned loopback Responses-compatible **text-only adapter**, not a proxy to a coding model. Without an explicit callback it denies inference. A callback may return only one assistant text message, never executable tool items. Incoming instructions, tool schemas and arbitrary options are not forwarded. Catalog probes are denied without being mistaken for work execution. Requests, body size, concurrency and callback duration are bounded.
+- Sandbox/feature flags are additional precautions. The primary execution boundary is that there is **no backing coding-model inference or function-call output**, and every RPC execution/approval request is rejected. `clientManagedHandoffs` alone is not an execution-disable switch.
+- `peer.mjs`: one audio track, persistent WebRTC/data channel, received-energy meter, explicit input replacement, immediate local mute/hang-up, late-SDP rejection and complete track/context cleanup. A muted decoder starts Chromium’s receiver; only the Web Audio graph is audible. No automatic capture or reconnection.
+
+### Frozen evidence, not another model call
+
+`src/voice/live-context.ts` supplies a bounded frozen briefing, saved notes, prior-sync decisions and source excerpts at call start. Historical discussion remains durable and is returned as up to eight dated, bounded quotes only when the current user explicitly asks to recall older discussion; keyword matching can select older relevant messages. A request for the last recorded question selects the last user message, not the assistant’s closing question. Old requests are never injected as an active conversation at startup. The persistent provider session retains this call’s own ongoing conversation. Initial packets are at most 24,000 UTF-8 bytes. Retained bracketed source markers always have supplied excerpts; unavailable markers are replaced explicitly. Excerpts preserve source roles and visibly omit their middles when needed, retaining closing qualifications rather than only a prefix.
+
+Current questions proactively receive bounded context before typed input or when a spoken transcript completes, without depending on model delegation. Ordinary questions automatically use the hybrid historical index described in [MEMORY.md](../../MEMORY.md); explicit E/C requests retain the snapshot path. Spoken context delivery can race the beginning of a reply, so it is not a claim-validation gate. Requests about what was just said in this call do not automatically inject older snapshot discussion.
+
+`src/voice/continuation.ts` tracks one pending answer per real user message. Ordinary developer context is background, not a reliable request to resume speech. After context delivery, a pending answer gets at most one official `thread/realtime/appendSpeech` completion cue. This is application control for the original question, not another user message, tool execution, or another speech/model provider. A response already in progress is allowed to finish; a normal completed reply is not repeated. Short English lookup promises (the default response language), including the reported “I’ll check what’s recorded”, keep the turn pending, as do brief acknowledgements and backchannels such as “Mm-hmm” on a real question. A final transcript part is not necessarily a completed answer. Simple social replies do not restart a lookup conversation. This conservative recognizer is not a semantic answer-quality validator or a guarantee for every language/phrasing. The prompt also requires actual follow-through and forbids speaking the control text.
+
+Each turn has its own cancellation signal and identity, including repeated identical questions. Stop, first transcript of newer input, call end and helper failure cancel timers and old retrieval ownership. Results delivered after cancellation cannot send a completion cue; already-sent provider work cannot be recalled, so local Stop still mutes immediately. Acknowledgements (including delayed or duplicated events) never authorize another cue. A failed completion request or the fixed 45-second completion deadline produces a visible failure without further automatic attempts. Normal transcript/playback qualifications and explicit review boundaries remain unchanged.
+
+If the voice model delegates a lookup, `src/voice/live.ts` runs deterministic retrieval over that same frozen snapshot. The delegation text is an untrusted query, not instructions. No shell, files, network searches or pi model calls are available. Handoff packets are at most 3,500 UTF-8 bytes, below the pinned helper’s approximately 1,000-token handoff limit. Explicit source requests take priority. This is bounded lexical retrieval, not a comprehensive search.
+
+**Native speech may paraphrase.** It does not validate a complete JSON answer before speech is played. The UI says **Sources supplied**, not “verified citations.” An assistant’s claim is not independent test evidence, truncated output cannot establish a final suite pass, and an unverified deployment is not proof of a failed or absent deployment. These remain model instructions and human-review obligations, not a proof of semantic correctness.
+
+### Main call UI, history and cleanup
+
+`client/src/voice/live-session.ts` owns the native call, capture, polling and controls. The existing image-only dragon follows received audio energy through the read-only playback contract. Live motion is energy-driven, not phoneme-aligned. Speaker-safe input gating is the default; Headphone mode allows spoken interruption. Mute releases microphone tracks, typed questions work without microphone permission, and hang-up/page exit stops local media immediately.
+
+**Stop reply cuts local playback and requests a remote stop.** It is not confirmation of immediate provider cancellation or accounting. A new typed question can continue within the same provider turn, so playback must not wait forever for another `turn.created`. A brief old tail or acknowledgment can precede the new reply. Physical echo, Bluetooth routing and device behavior still need hands-on qualification.
+
+`live_calls` / `live_messages` are additive tables. Legacy history is retained. Live records are ordered by message initiation, not invented question–answer pairing; streams may overlap. They distinguish generated/interrupted text and observed audio energy from **exact playback**, which is not confirmed. Generated speech and proposals are not agreement. Transcript memory is explicitly marked as such. Calls cannot write decisions, finish syncs or advance coverage.
+
+There is one call at a time, a 90-second disconnect lease, a 30-minute limit and at most 60 user messages. The main voice session allows at most 120 delegated lookup requests per call, independently of the user-message limit; these are local data lookups, not additional pi model calls. The text-only adapter defaults to eight requests when no limit is supplied and accepts only integer limits from 1 to 120. Rejected authentication and catalog probes do not consume that allowance; an admitted lookup still counts if its body or callback fails. A new call cannot start until helper cleanup is confirmed. Reload never resumes capture automatically; server recovery marks unfinished native history interrupted. LAN APIs retain the dashboard’s authentication and same-origin restrictions. Trusted HTTPS remains necessary for LAN microphones.
+
+## Verification
+
+```sh
+npm test
+npm run test:realtime:browser         # real LOCAL peer-to-peer audio, synthetic service
+npm run test:live:browser             # main controller, local peers/API doubles
+npm run test:realtime:native          # real pinned helper; unusable synthetic auth, loopback only
+
+# Explicit account/provider use, synthetic data and injected audio, no real mic:
+DRAKEN_TEST_STATIC_DIR=/path/to/staged/frontend \
+  npm run test:live:real -- --allow-provider
+
+# One spoken question → acknowledgement → delayed synthetic lookup → spoken answer:
+DRAKEN_TEST_STATIC_DIR=/path/to/staged/frontend \
+  node tests/voice-continuation-real.cjs --allow-provider
+```
+
+The main-controller tests cover permission denial, late microphone permission, speaker/headphone gating, mute/replacement, immediate stop, same-provider-turn resumption, late SDP, page exit and no capture after reload. The optional real-helper checks verify both denied inference and tool-looking text remaining plain text, with zero executed tools. Real-provider UI qualification exercises spoken input/interruption, typing, dragon motion, mute/unmute, stop/resume and cleanup on one connection. Use synthetic records for regression tests; any additional private-history qualification needs separate approval. Never use production history as a test scratchpad. Qualification must wait for a substantive answer, not mistake an acknowledgment plus an audio pause for completion. First audio may be an acknowledgment; it is not a measure of time to a fully grounded answer.
+
+No unlimited usage, exact quota pool, idle accounting, impact on coding allowances, provider-retention policy, ChatGPT latency parity or future API stability is promised. Audio and bounded context go to OpenAI. No raw audio is persisted locally. Linux/Chromium is the tested combination; physical devices and other browsers are not claimed verified.

package/voice/realtime/backend.mjs

@@ -0,0 +1,81 @@
+import http from 'node:http';
+import { randomUUID } from 'node:crypto';
+
+/** No proxying: this endpoint can emit only one assistant TEXT message.
+ * Model tool schemas, instructions and arbitrary request options are never
+ * forwarded to a provider. The host callback is a separately bounded read-only
+ * service; its return value cannot become a function call in the native agent.
+ */
+export async function createReadOnlyBackend({ answer, authorize = () => false, onBlocked = () => {}, maxRequests = 8 } = {}) {
+  if (!Number.isSafeInteger(maxRequests) || maxRequests < 1 || maxRequests > 120) {
+    throw new Error('Native backing request limit must be an integer between 1 and 120.');
+  }
+  const active = new Set(); let used = 0, stopped = false;
+  const server = http.createServer(async (req, res) => {
+    let controller, timer;
+    let removeAbort = () => {};
+    const stopBody = () => { if (!req.complete) req.destroy(); };
+    try {
+      // Admission is inside the error boundary too: URL/auth failures must not
+      // escape this async listener and terminate the hosting Draken process.
+      if (answer && !authorize(req.headers)) { req.resume(); res.writeHead(403); res.end('{}'); return; }
+      let pathname;
+      try { pathname = new URL(req.url, 'http://localhost').pathname; }
+      catch { req.resume(); res.writeHead(400, { 'Content-Type': 'application/json', Connection: 'close' }); res.end('{}'); return; }
+      // Native ChatGPT auth always probes catalog metadata. Deny discovery without
+      // mistaking it for execution; the helper has built-in metadata.
+      if (req.method === 'GET' && pathname === '/v1/models') { req.resume(); res.writeHead(403); res.end('{}'); return; }
+      if (stopped || !answer || req.method !== 'POST' || pathname !== '/v1/responses' || active.size || ++used > maxRequests) {
+        req.resume(); res.writeHead(403, { 'Content-Type': 'application/json', Connection: 'close' });
+        res.end(JSON.stringify({ error: { code: 'draken_voice_read_only', message: 'No backing execution allowed.' } })); await onBlocked(); return;
+      }
+      controller = new AbortController(); active.add(controller);
+      timer = setTimeout(() => controller.abort(), 45_000);
+      controller.signal.addEventListener('abort', stopBody, { once: true });
+      res.on('close', () => { if (!res.writableEnded) controller.abort(); });
+      if (req.headers['content-encoding']) throw new Error('Encoded backend request is not supported.');
+      req.setEncoding('utf8'); let body = '';
+      for await (const chunk of req) { body += chunk; if (body.length > 300_000 || controller.signal.aborted) throw new Error('Backend request exceeds its limit.'); }
+      const value = JSON.parse(body);
+      if (!Array.isArray(value.input) || value.input.length > 256) throw new Error('Invalid backend input.');
+      const text = await Promise.race([
+        Promise.resolve().then(() => answer(value.input, controller.signal)),
+        new Promise((_, reject) => {
+          const abort = () => reject(new Error('Backend request cancelled.'));
+          removeAbort = () => controller.signal.removeEventListener('abort', abort);
+          controller.signal.addEventListener('abort', abort, { once: true });
+          if (controller.signal.aborted) abort();
+        }),
+      ]);
+      if (controller.signal.aborted || stopped) throw new Error('Backend request cancelled.');
+      if (typeof text !== 'string' || !text.trim() || text.length > 8000) throw new Error('Invalid backend text.');
+      const id = `resp_${randomUUID()}`, itemId = `msg_${randomUUID()}`;
+      const part = { type: 'output_text', text, annotations: [] };
+      const item = { id: itemId, type: 'message', role: 'assistant', phase: 'final_answer', status: 'completed', content: [part] };
+      let sequence = 0;
+      res.writeHead(200, { 'Content-Type': 'text/event-stream', 'Cache-Control': 'no-store', Connection: 'close' });
+      const event = (type, fields) => res.write(`event: ${type}\ndata: ${JSON.stringify({ type, sequence_number: sequence++, ...fields })}\n\n`);
+      event('response.created', { response: { id, object: 'response', status: 'in_progress', output: [] } });
+      event('response.output_item.added', { output_index: 0, item: { ...item, status: 'in_progress', content: [] } });
+      event('response.content_part.added', { item_id: itemId, output_index: 0, content_index: 0, part: { ...part, text: '' } });
+      event('response.output_text.delta', { item_id: itemId, output_index: 0, content_index: 0, delta: text });
+      event('response.output_text.done', { item_id: itemId, output_index: 0, content_index: 0, text });
+      event('response.content_part.done', { item_id: itemId, output_index: 0, content_index: 0, part });
+      event('response.output_item.done', { output_index: 0, item });
+      event('response.completed', { response: { id, object: 'response', status: 'completed', output: [item] } });
+      res.end();
+    } catch {
+      req.resume();
+      if (res.destroyed || res.writableEnded) return;
+      if (!res.headersSent) res.writeHead(502, { 'Content-Type': 'application/json', Connection: 'close' });
+      res.end(JSON.stringify({ error: { code: 'draken_voice_backend_failed', message: 'No reliable read-only answer was available.' } }));
+    } finally {
+      clearTimeout(timer); removeAbort();
+      if (controller) { controller.signal.removeEventListener('abort', stopBody); active.delete(controller); }
+    }
+  });
+  server.requestTimeout = 50_000; server.headersTimeout = 5000;
+  await new Promise((resolve, reject) => { server.once('error', reject); server.listen(0, '127.0.0.1', resolve); });
+  return { url: `http://127.0.0.1:${server.address().port}/v1`,
+    async close() { stopped = true; for (const controller of active) controller.abort(); server.closeAllConnections(); await new Promise(resolve => server.close(resolve)); } };
+}

package/voice/realtime/native.mjs

@@ -0,0 +1,210 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { timingSafeEqual } from 'node:crypto';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { NativeRpc } from './rpc.mjs';
+import { createReadOnlyBackend } from './backend.mjs';
+
+export const CODEX_VERSION = '0.166.0';
+export const realtimeRoot = path.join(os.homedir(), '.draken', 'realtime');
+export function codexExecutable(root, platform = process.platform, arch = process.arch) {
+  if (platform !== 'win32') return path.join(root, 'runtime', 'node_modules', '.bin', 'codex');
+  const target = { x64: 'x86_64', arm64: 'aarch64' }[arch];
+  if (!target) throw new Error('Native voice requires Windows x64 or arm64.');
+  // The pinned official optional package contains the actual executable. Own
+  // that process directly: killing a Node/.cmd wrapper on Windows can orphan it.
+  return path.join(root, 'runtime', 'node_modules', '@openai', `codex-win32-${arch}`, 'vendor', `${target}-pc-windows-msvc`, 'bin', 'codex.exe');
+}
+export const defaultBinary = codexExecutable(realtimeRoot);
+export const defaultHome = path.join(realtimeRoot, 'account');
+const exec = promisify(execFile);
+
+// Positive allowlist: no API keys, pi session ownership, cloud credentials,
+// proxy overrides, provider URLs, NODE_OPTIONS, or user agent configuration.
+export function helperEnvironment(home, source = process.env) {
+  const env = { CODEX_HOME: home, HOME: home, USERPROFILE: home,
+    APPDATA: path.join(home, 'AppData', 'Roaming'), LOCALAPPDATA: path.join(home, 'AppData', 'Local'), RUST_LOG: 'off' };
+  for (const key of ['PATH', 'LANG', 'LC_ALL', 'SYSTEMROOT', 'WINDIR', 'TEMP', 'TMP']) if (source[key]) env[key] = source[key];
+  return env;
+}
+export function hasNativeLogin(home) {
+  try {
+    const value = JSON.parse(fs.readFileSync(path.join(home, 'auth.json'), 'utf8'));
+    return !value.OPENAI_API_KEY && (!value.auth_mode || value.auth_mode === 'chatgpt') &&
+      ['access_token', 'refresh_token', 'id_token'].every(key => typeof value.tokens?.[key] === 'string' && value.tokens[key].length > 0);
+  } catch { return false; }
+}
+export async function nativeStatus({ binary = defaultBinary, home = defaultHome } = {}) {
+  let installed = false;
+  try {
+    const { stdout } = await exec(binary, ['--version'], { env: helperEnvironment(home), timeout: 5000, maxBuffer: 4096 });
+    installed = stdout.trim() === `codex-cli ${CODEX_VERSION}`;
+  } catch { /* Report a structural status only; never leak subprocess output. */ }
+  return { installed, expectedVersion: CODEX_VERSION, nativeLoginPresent: hasNativeLogin(home),
+    readyForProbe: installed && hasNativeLogin(home), audioVerified: false };
+}
+
+/** The backing endpoint is owned by Draken, never a coding-model provider.
+ * By default it denies every inference; an explicit read-only host callback may
+ * return text through backend.mjs. It cannot return executable tool messages.
+ * Feature flags and sandboxing are additional precautions, not that boundary.
+ */
+export function helperArguments(denyUrl) {
+  const config = {
+    forced_login_method: 'chatgpt', cli_auth_credentials_store: 'file',
+    check_for_update_on_startup: false, approval_policy: 'on-request', sandbox_mode: 'read-only',
+    allow_login_shell: false, project_doc_max_bytes: 0, web_search: 'disabled',
+    model_provider: 'draken_readonly', model: 'gpt-5.4',
+    'model_providers.draken_readonly.name': 'Draken voice: no backend execution',
+    'model_providers.draken_readonly.base_url': denyUrl,
+    'model_providers.draken_readonly.wire_api': 'responses',
+    'model_providers.draken_readonly.requires_openai_auth': true,
+    'model_providers.draken_readonly.request_max_retries': 0,
+    'model_providers.draken_readonly.stream_max_retries': 0,
+    'features.realtime_conversation': true, 'features.shell_tool': false,
+    'features.unified_exec': false, 'features.code_mode': false, 'features.js_repl': false,
+    'features.apply_patch_freeform': false, 'features.apps': false, 'features.plugins': false,
+    'features.hooks': false, 'features.codex_hooks': false, 'features.plugin_hooks': false,
+    'features.multi_agent': false, 'features.multi_agent_v2': false, 'features.collab': false,
+    'features.computer_use': false, 'features.browser_use': false, 'features.memories': false,
+    'features.remote_models': false, 'features.api_key_model_discovery': false,
+    'features.enable_request_compression': false,
+    'features.shell_snapshot': false, 'features.shell_snapshot_v2': false,
+    'features.skip_host_skill_discovery': true, 'features.plugin_discovery_prefetch': false,
+    'features.skill_mcp_dependency_install': false, 'features.image_generation': false,
+    'features.worktrees': false, 'features.goals': false, 'features.remote_control': false,
+    'history.persistence': 'none', 'analytics.enabled': false, 'feedback.enabled': false,
+    // Call creation uses native Codex auth, never pi's direct-token credential.
+    // The WebRTC control socket is a DIFFERENT endpoint: leave it at the
+    // official helper's default. Pointing it at this call-creation origin fails.
+    experimental_realtime_webrtc_call_base_url: 'https://chatgpt.com/backend-api/codex',
+  };
+  return [...Object.entries(config).flatMap(([key, value]) => ['-c', `${key}=${JSON.stringify(value)}`]), 'app-server', '--stdio'];
+}
+
+export class NativeVoice {
+  #rpc;
+  #deny;
+  #thread;
+  #closed = false;
+  #opened = false;
+  #closing;
+  #listeners = new Set();
+  #home;
+  #binary;
+  #answer;
+  #cleanup;
+  #unsubscribe;
+  constructor({ binary = defaultBinary, home = defaultHome, answer } = {}) { this.#binary = binary; this.#home = home; this.#answer = answer; }
+  subscribe(listener) { this.#listeners.add(listener); return () => this.#listeners.delete(listener); }
+  #emit(event) { for (const listener of this.#listeners) { try { listener(event); } catch { void this.close(); } } }
+  async open(sdp, { signal, prompt, initialItems, onReady } = {}) {
+    if (this.#closed || this.#opened) throw new Error('A native voice instance can open only once.');
+    this.#opened = true;
+    if (typeof sdp !== 'string' || sdp.length > 64_000 || !sdp.startsWith('v=0') || (sdp.match(/^m=audio /gm) || []).length !== 1 || /^m=video /m.test(sdp)) throw new Error('One audio track and a bounded SDP offer are required.');
+    const status = await nativeStatus({ binary: this.#binary, home: this.#home });
+    if (!status.installed) throw new Error(`Install the pinned Codex ${CODEX_VERSION} helper first.`);
+    if (!status.nativeLoginPresent) throw new Error('A separate native ChatGPT sign-in is required. Run npm run voice:realtime:login. The pi login is not copied or converted.');
+    if (fs.existsSync(path.join(this.#home, 'config.toml'))) throw new Error('Use the dedicated voice account directory without a custom Codex config.');
+    if (signal?.aborted || this.#closed) throw new Error('Native voice setup cancelled.');
+    const abort = () => { void this.close(); };
+    signal?.addEventListener('abort', abort, { once: true });
+    this.#cleanup = () => signal?.removeEventListener('abort', abort);
+    try {
+      this.#deny = await createReadOnlyBackend({ answer: this.#answer, maxRequests: 120,
+        authorize: headers => {
+          // Native auth already accompanies the helper's backing requests. Match
+          // it locally without another secret in argv or a header that could be
+          // forwarded to OpenAI. Refresh remains owned by the official helper.
+          try {
+            const value = JSON.parse(fs.readFileSync(path.join(this.#home, 'auth.json'), 'utf8'));
+            if (value.OPENAI_API_KEY || (value.auth_mode && value.auth_mode !== 'chatgpt') || !['access_token', 'refresh_token', 'id_token'].every(key => typeof value.tokens?.[key] === 'string' && value.tokens[key])) return false;
+            const expected = Buffer.from(`Bearer ${value.tokens.access_token}`), actual = Buffer.from(headers.authorization || '');
+            return actual.length === expected.length && timingSafeEqual(actual, expected);
+          } catch { return false; }
+        }, onBlocked: () => { this.#emit({ method: 'draken/blocked', params: {} }); void this.close(); } });
+      if (this.#closed || signal?.aborted) { await this.#deny.close(); throw new Error('Native voice setup cancelled.'); }
+      const cwd = path.join(this.#home, 'empty-workspace'); fs.mkdirSync(cwd, { recursive: true, mode: 0o700 });
+      this.#rpc = new NativeRpc(this.#binary, helperArguments(this.#deny.url), { cwd, env: helperEnvironment(this.#home) });
+      this.#unsubscribe = this.#rpc.subscribe(event => {
+        if (event.method === 'turn/started' && !this.#answer) { this.#emit({ method: 'draken/blocked', params: {} }); void this.close(); return; }
+        if (event.method === 'draken/closed') { this.#emit(event); void this.close(); return; }
+        if (event.method.startsWith('thread/realtime/') && event.params?.threadId === this.#thread) {
+          // SDP never enters the general event stream or a saved report.
+          if (event.method !== 'thread/realtime/sdp') this.#emit(event);
+        }
+      });
+      await this.#rpc.request('initialize', { clientInfo: { name: 'draken', title: 'Draken read-only voice', version: '0.1.6' }, capabilities: { experimentalApi: true } }, { signal });
+      this.#rpc.notify('initialized');
+      const account = await this.#rpc.request('account/read', { refreshToken: false }, { signal });
+      if (account.account?.type !== 'chatgpt') throw new Error('Native ChatGPT authentication is required; API-key fallback is disabled.');
+      if (account.workspaceRouting?.backendOrigin && account.workspaceRouting.backendOrigin !== 'https://chatgpt.com') throw new Error('This prototype has not qualified the selected workspace region. No audio was sent.');
+      const result = await this.#rpc.request('thread/start', { ephemeral: true, cwd, environments: [], dynamicTools: [],
+        baseInstructions: 'This is a read-only voice transport. Never execute commands, edit files, use tools, or start background work.',
+        model: 'gpt-5.4', modelProvider: 'draken_readonly', approvalPolicy: 'on-request', sandbox: 'read-only' }, { signal });
+      this.#thread = result.thread?.id;
+      if (typeof this.#thread !== 'string' || !this.#thread || result.modelProvider !== 'draken_readonly') throw new Error('Native helper did not preserve the no-execution model boundary.');
+      onReady?.();
+      // Subscribe before issuing start: the SDP notification may precede its RPC response.
+      const answer = new Promise((resolve, reject) => {
+        const timer = setTimeout(() => { cleanup(); reject(new Error('Native voice SDP timed out.')); }, 45_000);
+        const off = this.#rpc.subscribe(event => {
+          if (event.method === 'draken/closed') { cleanup(); reject(new Error('Native voice connection closed during setup.')); }
+          if (event.params?.threadId !== this.#thread) return;
+          if (event.method === 'thread/realtime/error' || event.method === 'thread/realtime/closed') { cleanup(); reject(new Error('Native voice access failed. No fallback provider was used.')); }
+          if (event.method === 'thread/realtime/sdp') {
+            cleanup(); const value = event.params.sdp;
+            if (typeof value !== 'string' || value.length > 64_000 || !value.startsWith('v=0')) reject(new Error('Invalid native voice SDP answer.'));
+            else resolve(value);
+          }
+        });
+        const cleanup = () => { clearTimeout(timer); off(); };
+      });
+      const start = this.#rpc.request('thread/realtime/start', { threadId: this.#thread, outputModality: 'audio', version: 'v3',
+        model: 'gpt-live-1-codex', voice: 'cove', includeStartupContext: false, clientManagedHandoffs: !this.#answer,
+        flushTranscriptTailOnSessionEnd: false, delegationAckFiller: false,
+        ...(initialItems ? { initialItems } : {}),
+        prompt: prompt || 'You are Draken, an AI voice test. Answer briefly using only supplied facts. You cannot execute work or delegate tasks. The export tests passed; deployment has not been checked. Never claim deployment was verified.',
+        transport: { type: 'webrtc', sdp } }, { signal, timeoutMs: 45_000 });
+      const [remoteSdp] = await Promise.all([answer, start]);
+      if (this.#closed || signal?.aborted) throw new Error('Native voice setup cancelled.');
+      return remoteSdp;
+    } catch (error) { await this.close(); throw error; }
+  }
+  async text(text) {
+    if (!this.#thread || this.#closed || typeof text !== 'string' || !text.trim() || text.length > 2000) throw new Error('Cannot send this native voice question.');
+    await this.#rpc.request('thread/realtime/appendText', { threadId: this.#thread, role: 'user', text });
+  }
+  async context(text) {
+    if (!this.#thread || this.#closed || typeof text !== 'string' || !text.trim() || Buffer.byteLength(text, 'utf8') > 8192) throw new Error('Cannot supply this native voice context.');
+    // In v3 this becomes session context, without the user-text prefix.
+    await this.#rpc.request('thread/realtime/appendText', { threadId: this.#thread, role: 'developer', text });
+  }
+  async continueAnswer(question) {
+    if (!this.#thread || this.#closed || typeof question !== 'string' || !question.trim() || question.length > 2000) throw new Error('Cannot continue this native voice answer.');
+    // Official V3 speakable-context operation, not a fabricated user message.
+    // Ordinary developer context is only background data and may not resume speech.
+    const text = `DRAKEN_LOOKUP_READY — application control, not words to read aloud or a new user utterance. The read-only lookup is complete for this pending question: ${JSON.stringify([...question].slice(0, 500).join(''))} (bounded reminder; the original question is already in this call). Finish answering it now from the supplied context, briefly, with its uncertainty. If lookup failed, explain that instead. Do not merely acknowledge or promise to check; do not repeat an answer already completed. Do not answer an older question if the user has since interrupted or moved on.`;
+    await this.#rpc.request('thread/realtime/appendSpeech', { threadId: this.#thread, text });
+  }
+  close() {
+    if (this.#closing) return this.#closing;
+    this.#closed = true;
+    this.#closing = Promise.resolve().then(() => this.#closeResources());
+    return this.#closing;
+  }
+  async #closeResources() {
+    this.#cleanup?.(); this.#unsubscribe?.();
+    if (this.#thread && this.#rpc && !this.#rpc.closed) {
+      try { await this.#rpc.request('thread/realtime/stop', { threadId: this.#thread }, { timeoutMs: 1500 }); } catch { /* Terminate below, even if stop was rejected. */ }
+    }
+    this.#rpc?.close();
+    const exited = !this.#rpc || await this.#rpc.waitForExit();
+    await this.#deny?.close();
+    this.#emit({ method: 'draken/closed', params: { reason: exited ? 'Native voice connection closed.' : 'Native helper exit could not be confirmed.', helperExited: exited } });
+    this.#listeners.clear();
+    return { helperExited: exited };
+  }
+}

package/voice/realtime/peer.d.mts

@@ -0,0 +1,15 @@
+export class VoicePeer {
+  constructor(options?: { onClose?: (reason: string) => void; onEvent?: (event: Record<string, any>) => void });
+  readonly closed: boolean;
+  readonly inputActive: boolean;
+  readonly clock: number;
+  readonly audioState: AudioContextState;
+  readonly level: number;
+  open(input: MediaStream, negotiate: (offer: string, signal: AbortSignal) => Promise<string>): Promise<void>;
+  muteOutput(muted: boolean): void;
+  gateInput(enabled: boolean): void;
+  stopInput(): void;
+  replaceInput(stream: MediaStream): Promise<void>;
+  resume(): Promise<void>;
+  close(reason?: string): void;
+}