diff --git a/.env.example b/.env.example index 04206ab25..b3de4cefa 100644 --- a/.env.example +++ b/.env.example @@ -61,8 +61,15 @@ CESIUM_ION_TOKEN= # ChatGPT/Codex OAuth session; the browser still receives only a short-lived # Realtime client secret. Do not prefix with VITE_. OPENAI_API_KEY= -# Optional: forbid API-key voice sessions. Select ChatGPT OAuth in Provider -# Settings; missing or expired Codex sign-in then fails closed. +# Typed chat uses Chat Completions, independently of the voice model. It can +# only bill OPENAI_API_KEY, so GEV_PREFER_CODEX_OAUTH below turns it off. +OPENAI_CHAT_MODEL=gpt-4.1-mini +# Typed chat requests (/api/openai/chat) per IP per minute, counted apart from +# voice. Unset, it takes GEV_RATELIMIT_OPENAI_PER_MIN's cap; 0 disables it. +# Not a billing cap. +# GEV_RATELIMIT_OPENAI_CHAT_PER_MIN=30 +# Optional: forbid API-key voice sessions and OpenAI typed chat. Select ChatGPT +# OAuth in Provider Settings; missing or expired Codex sign-in then fails closed. # GEV_PREFER_CODEX_OAUTH=true OPENAI_REALTIME_MODEL=gpt-realtime-2 # Cheaper voice tier, used when the GEV MIC panel's MINI toggle is on. @@ -300,6 +307,12 @@ OVERPASS_UPSTREAMS= # Unset, no page may frame it. Other pages of the app can never be framed. # GEV_EMBED_FRAME_ANCESTORS= +# Gemini typed chat uses generateContent; voice continues to use Gemini Live. +GEMINI_CHAT_MODEL=gemini-3.5-flash-lite +# Typed chat requests (/api/gemini/chat) per IP per minute. Unset, it takes +# GEV_RATELIMIT_GEMINI_PER_MIN's cap (default 30); 0 disables it. +# GEV_RATELIMIT_GEMINI_CHAT_PER_MIN=30 + # Optional keyless Radio Browser coverage: up to 8 ISO alpha-2 countries. # Each reserves up to 40 stations within the existing 750-station directory. # Restart after changing. Leave blank for the existing global selection. diff --git a/README.md b/README.md index a7ee408f5..4d352a4c0 100644 --- a/README.md +++ b/README.md @@ -362,9 +362,11 @@ _Why cockpit mode exists: you're riding a real aircraft over real terrain — an ## 🎙️ Talk to It -The standalone app offers **OpenAI** and **Gemini** in the GEV MIC provider chooser. OpenAI is the initial default; your choice is saved in this browser. To use Gemini, add `GEMINI_API_KEY` in Provider Settings or your local `.env` file, then select Gemini. `GEMINI_LIVE_MODEL` defaults to `gemini-3.8-live`. The permanent key stays on the local server, which issues a constrained, single-use session credential. +The standalone app offers **OpenAI** and **Gemini** under **AI Provider** in Settings, one choice shared by voice and chat. OpenAI is the initial default; your choice is saved in this browser. To use Gemini, add `GEMINI_API_KEY` in Provider Settings or your local `.env` file, then select Gemini. `GEMINI_LIVE_MODEL` defaults to `gemini-3.8-live`. The permanent key stays on the local server, which issues a constrained, single-use session credential. -Changing provider ends the current conversation. If voice is on, the new provider starts with the same open-mic or push-to-talk mode; a held Space key is not carried over. Gemini uses the same map actions and captions, but has no OpenAI cost meter or MINI tier. When Gemini reports that its session has expired, start voice again for a new conversation. The provider chooser does not change the OpenAI-backed AI HUD summary. +Changing provider ends the current conversation. If voice is on, the new provider starts with the same open-mic or push-to-talk mode; a held Space key is not carried over. Gemini uses the same map actions and captions, but has no OpenAI cost meter or MINI tier. When Gemini reports that its session has expired, start voice again for a new conversation. The AI Provider setting does not change the OpenAI-backed AI HUD summary. + +Next to the mic, **CHAT** opens a typed chat with silent replies. It uses the selected provider and the same map actions, and never asks for the microphone. OpenAI chat needs an API key (`OPENAI_CHAT_MODEL`), so it is off while `GEV_PREFER_CODEX_OAUTH` pins OpenAI to ChatGPT OAuth; Gemini chat uses a separate text model (`GEMINI_CHAT_MODEL`). Chat and voice panels share the left panels' glass surface and sit above the dock or dock to the right. > Voice can use an **OpenAI API key** or, on the same machine, an opt-in signed-in **ChatGPT/Codex OAuth** session. The API-key path remains the default. Selecting ChatGPT OAuth in Provider Settings reuses an existing local sign-in or starts the Codex browser sign-in flow and selects OAuth when it completes. The OpenAI key still drives the **AI HUD summary**: a terse, five-word intelligence-style readout of the current view that regenerates as you move. diff --git a/SECURITY.md b/SECURITY.md index 01abdbac0..4dceaed6f 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -86,6 +86,7 @@ The data proxies under `server/providers/` are written so the browser cannot tur Allowing `maps.googleapis.com` in `script-src` also trusts its JSONP endpoints, which can bypass the script allowlist if an HTML-injection bug exists; this is an accepted limitation of loading the Maps JavaScript API, alongside the existing `'unsafe-eval'` allowance. - **Full Content-Security-Policy.** The dev and preview servers send a real CSP (`script-src 'self' 'unsafe-eval' blob:` plus the YouTube, Facebook and X scripts the Nepal event's embedded media loads, with a matching `frame-src` for their players and posts: no inline script and no other script origin; `blob:` covers the object URLs Cesium's bundled workers bootstrap through in the built app), alongside the existing `X-Frame-Options: DENY` and `frame-ancestors 'none'`. `'unsafe-eval'` stays because Knockout, bundled inside Cesium's widgets package, resolves the global object with `eval` at load time and the globe does not initialize without it; styles permit `'unsafe-inline'` and Google Fonts because Vite's dev client injects `