Merge upstream/main into pr/google-street-view

Conflicts with upstream's Street Level provider composition and share-state codec, resolved: - Street View's switch moves from its own share option (`g`) to upstream's provider-switch field (`r`, e.g. `0.r.google-1`); a link without it keeps Street View off. Docs and the browser gate follow. - createApplicationStreetLevel keeps upstream's injectable provider list; its default, once the application supplies its Street Level source, is Mapillary plus Google Street View. Without that source there are none, as upstream intends. - The coverage hint keeps upstream's empty-composition message and joins every switched-on provider's hint otherwise. - CHANGELOG, README and SECURITY keep both sides' entries. Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-11-04 10:24:02 +00:00 · 2026-10-12 11:32:05 +01:00
commit 76db4114ff
@@ -347,7 +347,7 @@ case "${OPENSKY_AUTH_MODE}" in
    echo "OpenSky auth: disabled (anonymous mode)"
    ;;
 esac
-[[ -n "${OPENAI_API_KEY}" ]] && echo "OpenAI key (voice + HUD summary): configured" || echo "OpenAI key (voice + HUD summary): not set — GEV MIC disabled"
+[[ -n "${OPENAI_API_KEY}" ]] && echo "OpenAI key (voice + HUD summary): configured" || echo "OpenAI key (voice + HUD summary): not set — GEV MIC off unless a Codex ChatGPT sign-in is selected in Provider Settings (experimental)"
 [[ -n "${AISSTREAM_API_KEY}" ]] && echo "AISStream key (live vessels): configured" || echo "AISStream key (live vessels): not set — ships layer empty"
 if [[ -n "${GOOGLE_MAPS_API_KEY}" ]]; then
  echo "Startup map: Google Photorealistic 3D Tiles (direct)"
@@ -36,6 +36,10 @@
  "src/main.js",
  "docs/APPLICATION.md",
  "scripts/qa-application.mjs",
+  "scripts/qa-voice-auth.mjs",
+  "scripts/qa-voice-auth-focus.mjs",
+  "src/codexOauthRealtime.test.mjs",
+  "src/voice/cloudVoiceAuth.test.mjs",
  "scripts/qa-panel-resize.mjs",
  "scripts/qa-panelDrag.mjs",
  "src/tooling/panelResizeQa.test.mjs",
@@ -295,6 +295,7 @@
      "server/providers/common/request.js",
      "server/providers/common/source-root.js",
      "server/providers/openai.js",
+      "server/providers/openai/codex-auth.js",
      "server/providers/openai/constants.js",
      "server/providers/openai/debug-log.js",
      "server/providers/openai/hud-summary.js",
@@ -551,6 +552,7 @@
      "src/contextModePolicy.js",
      "src/data/detectionPolicy.js",
      "src/data/installationFeedback.js",
+      "src/data/idSwitches.js",
      "src/data/layerState.js",
      "src/data/layerStateCoordinator.js",
      "src/data/layerStateTokenReservations.json",
@@ -799,6 +801,7 @@
      "src/data/cockpitContactDot.js",
      "src/data/contactMatch.js",
      "src/data/iconOrientation.js",
+      "src/data/idSwitches.js",
      "src/data/layerState.js",
      "src/data/layerStateTokenReservations.json",
      "src/data/modelVisualAnchor.js",
@@ -841,6 +844,7 @@
      "src/data/cockpitContactDot.js",
      "src/data/contactMatch.js",
      "src/data/iconOrientation.js",
+      "src/data/idSwitches.js",
      "src/data/layerState.js",
      "src/data/layerStateTokenReservations.json",
      "src/data/modelVisualAnchor.js",
@@ -878,6 +882,7 @@
      "src/data/cockpitContactDot.js",
      "src/data/contactMatch.js",
      "src/data/iconOrientation.js",
+      "src/data/idSwitches.js",
      "src/data/layerState.js",
      "src/data/layerStateCoordinator.js",
      "src/data/layerStateTokenReservations.json",
@@ -933,6 +938,7 @@
    "exports": ["./layers/recent-imagery"],
    "modules": [
      "src/layers/recentImagery/index.js",
+      "src/layers/recentImagery/source.js",
      "src/layers/recentImagery/model.js",
      "src/layers/recentImagery/catalog.js",
      "src/layers/recentImagery/rendering.js",
@@ -1203,6 +1209,7 @@
      "src/layers/streetLevel/groundCast.js",
      "src/layers/streetLevel/meshSampler.js",
      "src/layers/streetLevel/pickRouter.js",
+      "src/data/idSwitches.js",
      "src/layers/streetLevel/params.js",
      "src/layers/streetLevel/registry.js",
      "src/layers/streetLevel/filter.js",
@@ -1253,6 +1260,7 @@
    "exports": ["./layers/radio"],
    "modules": [
      "src/data/iconOrientation.js",
+      "src/data/idSwitches.js",
      "src/data/layerState.js",
      "src/data/layerStateTokenReservations.json",
      "src/data/radioCountry.js",
@@ -1361,6 +1369,7 @@
    "modules": [
      "src/voice/realtimeController.js",
      "src/voice/realtimeBackend.js",
+      "src/voice/cloudVoiceAuth.js",
      "src/voice/control.js",
      "src/voice/layerSummary.js",
      "src/voice/voiceCost.js",
@@ -1438,6 +1447,7 @@
      "src/annotations/worldAnnotationRenderer.js",
      "src/app/catalog.js",
      "src/app/constructCatalog.js",
+      "src/app/sourceComposition.js",
      "src/app/controls.js",
      "src/app/data.js",
      "src/app/errors.js",
@@ -1539,6 +1549,7 @@
      "src/data/installationFeedback.js",
      "src/data/issPass.js",
      "src/data/labelArbiter.js",
+      "src/data/idSwitches.js",
      "src/data/layerState.js",
      "src/data/layerStateCoordinator.js",
      "src/data/layerStateTokenReservations.json",
@@ -1976,6 +1987,7 @@
      "src/voice/resultDisplay.js",
      "src/voice/gevRealtime.js",
      "src/voice/layerSummary.js",
+      "src/voice/cloudVoiceAuth.js",
      "src/voice/realtimeBackend.js",
      "src/voice/realtimeController.js",
      "src/voice/voiceCost.js",
@@ -1996,6 +2008,7 @@
      "src/annotations/drawTool.js",
      "src/data/routeSteps.js",
      "src/layers/directions/index.js",
+      "src/layers/directions/source.js",
      "src/data/directions.js",
      "src/app/layers/directions.js",
      "src/search/coordinateGeocoder.js",
@@ -2130,6 +2143,7 @@
      "src/ui/localSdrPresentation.js",
      "src/app/layers/recentImagery.js",
      "src/layers/recentImagery/index.js",
+      "src/layers/recentImagery/source.js",
      "src/layers/recentImagery/model.js",
      "src/layers/recentImagery/catalog.js",
      "src/layers/recentImagery/rendering.js",
@@ -2230,6 +2244,7 @@
      "src/annotations/resolver.js",
      "src/app/catalog.js",
      "src/app/constructCatalog.js",
+      "src/app/sourceComposition.js",
      "src/layers/wind/index.js",
      "src/layers/wind/model.js",
      "src/layers/wind/fields.js",
@@ -2289,6 +2304,7 @@
      "src/data/issPass.js",
      "src/data/satellitePass.js",
      "src/data/labelArbiter.js",
+      "src/data/idSwitches.js",
      "src/data/layerState.js",
      "src/data/layerStateTokenReservations.json",
      "src/data/localGeojson.js",
@@ -2579,6 +2595,7 @@
      "src/services/groundFloor.js",
      "src/data/routeSteps.js",
      "src/layers/directions/index.js",
+      "src/layers/directions/source.js",
      "src/services/terrainHeights.js",
      "src/data/terrainHeights.js",
      "src/data/groundFloor.js",
@@ -2667,6 +2684,7 @@
      "src/data/modelEligibility.js",
      "src/app/layers/recentImagery.js",
      "src/layers/recentImagery/index.js",
+      "src/layers/recentImagery/source.js",
      "src/layers/recentImagery/model.js",
      "src/layers/recentImagery/catalog.js",
      "src/layers/recentImagery/rendering.js",
@@ -2813,6 +2831,7 @@
    "exports": ["./ui/share-restoration"],
    "modules": [
      "src/data/installationFeedback.js",
+      "src/data/idSwitches.js",
      "src/data/layerState.js",
      "src/data/layerStateCoordinator.js",
      "src/data/layerStateTokenReservations.json",
@@ -2926,9 +2945,27 @@
    ],
    "external": []
  },
+  "directions-source": {
+    "exports": ["./layers/directions/source"],
+    "modules": ["src/layers/directions/source.js"],
+    "external": []
+  },
+  "recent-imagery-source": {
+    "exports": ["./layers/recent-imagery/source"],
+    "modules": [
+      "src/layers/recentImagery/source.js",
+      "src/layers/recentImagery/catalog.js",
+      "src/layers/recentImagery/model.js"
+    ],
+    "external": []
+  },
  "directions-layer": {
    "exports": ["./layers/directions"],
-    "modules": ["src/layers/directions/index.js", "src/data/routeSteps.js"],
+    "modules": [
+      "src/layers/directions/index.js",
+      "src/layers/directions/source.js",
+      "src/data/routeSteps.js"
+    ],
    "external": ["cesium"]
  },
  "radio-browser-source": {
@@ -3315,6 +3352,7 @@
      "src/tools/queries/brief.js",
      "src/tools/queries/maritime.js",
      "src/tools/queries/share.js",
+      "src/data/idSwitches.js",
      "src/data/layerState.js",
      "src/data/layerStateTokenReservations.json",
      "src/sources/gbfsStations.js",
@@ -3437,6 +3475,7 @@
    "exports": ["./view"],
    "modules": [
      "src/view/index.js",
+      "src/data/idSwitches.js",
      "src/data/layerState.js",
      "src/data/layerStateTokenReservations.json"
    ],
@@ -632,11 +632,17 @@ async function main() {
        target,
        '.panel-collapse-btn[data-collapse-target="street-level-panel"]',
      );
-      await settle(
-        target,
-        () =>
-          getComputedStyle(document.getElementById('sl-body')).display ===
-          'flex',
+      assert.ok(
+        await settle(
+          target,
+          () =>
+            !document
+              .getElementById('street-level-panel')
+              .classList.contains('collapsed') &&
+            getComputedStyle(document.getElementById('sl-body')).display ===
+              'flex',
+        ),
+        'Street Level panel did not expand before the timeout',
      );
    };
    await expandStrip();
@@ -1797,7 +1803,8 @@ async function main() {
            credit: false,
            button: false,
          });
-          const option = `${STREET_LEVEL_TOKEN}.g.1`;
+          // Street View rides the shared provider-switch field (r).
+          const option = `${STREET_LEVEL_TOKEN}.r.google-1`;
          assert.ok(
            await settle(
              page,
@@ -0,0 +1,328 @@
+#!/usr/bin/env node
+/**
+ * Check auth-mode keyboard focus with the real settings template and controls.
+ * Run: node --test --test-reporter=spec scripts/qa-voice-auth-focus.mjs
+ * Sign-in responses are fixtures. No credentials or live login are used.
+ */
+import assert from 'node:assert/strict';
+import { existsSync } from 'node:fs';
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { createServer } from 'node:http';
+import { after, before, test } from 'node:test';
+import puppeteer from 'puppeteer';
+
+const root = new URL('../', import.meta.url);
+const template = await readFile(
+  new URL('src/ui/templates/provider-settings.html', root),
+  'utf8',
+);
+const assets = new Set([
+  '/src/keySetup.js',
+  '/src/voice/cloudVoiceAuth.js',
+  '/src/ui/surfaceKeyboard.js',
+  '/src/ui/styles/provider-settings.css',
+]);
+const observations = [];
+let server;
+let browser;
+let origin;
+
+before(async () => {
+  server = createServer(async (req, res) => {
+    const pathname = new URL(req.url, 'http://localhost').pathname;
+    if (pathname === '/') {
+      res.setHeader('Content-Type', 'text/html; charset=utf-8');
+      res.end(`<!doctype html><html><head><meta charset="utf-8">
+        <title>Voice auth keyboard focus test</title>
+        <link rel="stylesheet" href="/src/ui/styles/provider-settings.css">
+        </head><body>${template}</body></html>`);
+      return;
+    }
+    if (!assets.has(pathname)) {
+      res.statusCode = 404;
+      res.end();
+      return;
+    }
+    try {
+      res.setHeader(
+        'Content-Type',
+        pathname.endsWith('.css') ? 'text/css' : 'text/javascript',
+      );
+      res.end(await readFile(new URL(pathname.slice(1), root)));
+    } catch {
+      res.statusCode = 500;
+      res.end('Could not load the test asset');
+    }
+  });
+  await new Promise((resolve, reject) => {
+    server.once('error', reject);
+    server.listen(0, '127.0.0.1', resolve);
+  });
+  origin = `http://127.0.0.1:${server.address().port}`;
+  const chrome = '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome';
+  browser = await puppeteer.launch({
+    headless: true,
+    executablePath:
+      process.env.PUPPETEER_EXECUTABLE_PATH ||
+      (existsSync(chrome) ? chrome : await puppeteer.executablePath()),
+  });
+});
+
+after(async () => {
+  await browser?.close();
+  if (server?.listening) await new Promise((resolve) => server.close(resolve));
+  const output = new URL('.gev-logs/voice-auth-focus/', root);
+  await mkdir(output, { recursive: true });
+  await writeFile(
+    new URL('results.json', output),
+    `${JSON.stringify(observations, null, 2)}\n`,
+  );
+});
+
+const scenarios = [
+  {
+    name: 'OAuth to API key',
+    initial: 'oauth',
+    expected: 'api-key',
+    flow: 'unused',
+  },
+  {
+    name: 'API key to existing OAuth',
+    initial: 'api-key',
+    expected: 'oauth',
+    flow: 'existing',
+  },
+  {
+    name: 'API key to OAuth ready at login launch',
+    initial: 'api-key',
+    expected: 'oauth',
+    flow: 'login-ready',
+  },
+  {
+    name: 'API key to OAuth ready after polling',
+    initial: 'api-key',
+    expected: 'oauth',
+    flow: 'poll-ready',
+  },
+];
+
+async function mountSettings(page, scenario) {
+  await page.goto(`${origin}/?setup=1`, {
+    waitUntil: 'domcontentloaded',
+  });
+  await page.evaluate(async ({ initial, flow }) => {
+    localStorage.clear();
+    localStorage.setItem('godsEyeView.voice.cloudAuth', initial);
+    window.__focusTestCalls = [];
+    let statusReads = 0;
+    const fetchImpl = async (url) => {
+      window.__focusTestCalls.push(url);
+      let payload;
+      let status = 200;
+      if (url === '/api/setup/status') {
+        payload = {
+          setCount: 0,
+          total: 1,
+          keys: [
+            {
+              id: 'openai',
+              title: 'OPENAI',
+              tier: 'metered',
+              set: false,
+              unlocks: 'Voice control',
+              envVars: ['OPENAI_API_KEY'],
+              getUrl: 'https://example.invalid/',
+            },
+          ],
+        };
+      } else if (url === '/api/realtime/oauth-status') {
+        statusReads += 1;
+        if (flow === 'deferred') {
+          return await new Promise((resolve) => {
+            window.__resolveOAuthStatus = (available) =>
+              resolve(
+                new Response(
+                  JSON.stringify({ available, error: 'Fixture failure' }),
+                  {
+                    status: available ? 200 : 503,
+                  },
+                ),
+              );
+          });
+        }
+        payload = {
+          available:
+            flow === 'existing' || (flow === 'poll-ready' && statusReads > 1),
+        };
+      } else if (url === '/api/realtime/oauth-login') {
+        const available = flow === 'login-ready';
+        status = available ? 200 : 202;
+        payload = { available, pending: !available, started: !available };
+      } else {
+        throw new Error(`Unexpected request: ${url}`);
+      }
+      return new Response(JSON.stringify(payload), { status });
+    };
+    const { initKeySetup } = await import('/src/keySetup.js');
+    window.__focusTestSettings = await initKeySetup({ fetchImpl });
+  }, scenario);
+  await page.waitForFunction(
+    () =>
+      document.getElementById('key-setup').classList.contains('visible') &&
+      document.activeElement.matches('input[data-env-var]'),
+  );
+}
+
+for (const scenario of scenarios) {
+  for (const key of ['Enter', 'Space', 'Mouse click']) {
+    test(`${scenario.name} keeps keyboard focus after ${key}`, async (t) => {
+      const page = await browser.newPage();
+      try {
+        await mountSettings(page, scenario);
+
+        if (key !== 'Mouse click') {
+          // Tab from the initial key field to the real auth button.
+          await page.keyboard.press('Tab');
+          assert.equal(
+            await page.evaluate(() =>
+              document.activeElement.matches('[data-cloud-voice-auth-toggle]'),
+            ),
+            true,
+            'Keyboard navigation must reach the auth toggle before activation',
+          );
+        }
+        await page.evaluate(() => {
+          const toggle = document.querySelector(
+            '[data-cloud-voice-auth-toggle]',
+          );
+          window.__originalFocusToggle = toggle;
+          window.__focusAtActivation = null;
+          toggle.addEventListener(
+            'click',
+            () => {
+              window.__focusAtActivation = document.activeElement === toggle;
+            },
+            { capture: true, once: true },
+          );
+        });
+        if (key === 'Mouse click') {
+          await page.waitForFunction(
+            () =>
+              getComputedStyle(document.getElementById('key-setup')).opacity ===
+              '1',
+          );
+          await page.click('[data-cloud-voice-auth-toggle]');
+        } else {
+          await page.keyboard.press(key);
+        }
+        await page.waitForFunction(
+          (expected) =>
+            localStorage.getItem('godsEyeView.voice.cloudAuth') === expected &&
+            !document.querySelector('[data-cloud-voice-auth-toggle]')
+              .disabled &&
+            document
+              .querySelector('[data-cloud-voice-auth-toggle]')
+              .getAttribute('aria-disabled') !== 'true',
+          {},
+          scenario.expected,
+        );
+        const selection = await page.evaluate(() => ({
+          focusOnToggleAtActivation: window.__focusAtActivation,
+          focusOnToggle:
+            document.activeElement ===
+            document.querySelector('[data-cloud-voice-auth-toggle]'),
+          activeTag: document.activeElement.tagName,
+          originalToggleConnected: window.__originalFocusToggle.isConnected,
+          requests: window.__focusTestCalls,
+        }));
+        await page.keyboard.press('Tab');
+        const nextTab = await page.evaluate(() => ({
+          focusOnSave: document.activeElement.matches('[data-key-setup-apply]'),
+          activeLabel:
+            document.activeElement.getAttribute('aria-label') ||
+            document.activeElement.textContent.trim(),
+        }));
+        const observed = { scenario: scenario.name, key, selection, nextTab };
+        observations.push(observed);
+        t.diagnostic(JSON.stringify(observed));
+        assert.equal(
+          selection.focusOnToggle,
+          true,
+          'Auth selection must keep focus on its usable toggle',
+        );
+        assert.equal(
+          nextTab.focusOnSave,
+          true,
+          'Tab must continue to SAVE KEYS rather than restart at Close',
+        );
+      } finally {
+        await page.close();
+      }
+    });
+  }
+}
+
+for (const available of [true, false]) {
+  test(`pending OAuth ${available ? 'success' : 'failure'} blocks repeats without moving focus or losing a key draft`, async () => {
+    const page = await browser.newPage();
+    try {
+      await mountSettings(page, { initial: 'api-key', flow: 'deferred' });
+      await page.type('input[data-env-var]', 'test-draft-only');
+      await page.keyboard.press('Tab');
+      await page.keyboard.press('Enter');
+      await page.waitForFunction(
+        () => typeof window.__resolveOAuthStatus === 'function',
+      );
+      assert.equal(
+        await page.evaluate(() =>
+          document.activeElement.matches('[data-cloud-voice-auth-toggle]'),
+        ),
+        true,
+      );
+      await page.keyboard.press('Enter');
+      await page.keyboard.press('Space');
+      assert.equal(
+        await page.evaluate(
+          () =>
+            window.__focusTestCalls.filter(
+              (url) => url === '/api/realtime/oauth-status',
+            ).length,
+        ),
+        1,
+      );
+      await page.keyboard.press('Tab');
+      assert.equal(
+        await page.evaluate(() =>
+          document.activeElement.matches('[data-key-setup-apply]'),
+        ),
+        true,
+      );
+      await page.evaluate(
+        (available) => window.__resolveOAuthStatus(available),
+        available,
+      );
+      await page.waitForFunction(
+        () =>
+          document
+            .querySelector('[data-cloud-voice-auth-toggle]')
+            .getAttribute('aria-disabled') === 'false',
+      );
+      const observed = await page.evaluate(() => ({
+        mode: localStorage.getItem('godsEyeView.voice.cloudAuth'),
+        focusOnSave: document.activeElement.matches('[data-key-setup-apply]'),
+        draft: document.querySelector('input[data-env-var]').value,
+        requests: window.__focusTestCalls,
+      }));
+      observations.push({ scenario: 'pending OAuth', available, observed });
+      assert.equal(observed.mode, available ? 'oauth' : 'api-key');
+      assert.equal(
+        observed.focusOnSave,
+        true,
+        'Completing a request must not take focus from another control',
+      );
+      assert.equal(observed.draft, 'test-draft-only');
+    } finally {
+      await page.close();
+    }
+  });
+}
@@ -0,0 +1,291 @@
+#!/usr/bin/env node
+/**
+ * Live Realtime auth acceptance with a prerecorded Chromium microphone.
+ * Run against the local dev server after configuring the selected credential:
+ * node scripts/qa-voice-auth.mjs http://127.0.0.1:4189 oauth microphone.wav
+ * Use a short spoken reply request with three seconds of leading silence.
+ * Saves only usage, transport metadata, and screenshots; never credentials.
+ */
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import puppeteer from 'puppeteer';
+
+const root = fileURLToPath(new URL('../', import.meta.url));
+const url = new URL(process.argv[2] || 'http://127.0.0.1:4189');
+const auth = process.argv[3] || 'oauth';
+assert.ok(['oauth', 'api-key'].includes(auth), 'Choose oauth or api-key');
+assert.ok(
+  ['127.0.0.1', 'localhost', '[::1]'].includes(url.hostname),
+  'Use a local server',
+);
+assert.ok(process.argv[4], 'Provide a prerecorded microphone WAV');
+const wav = path.resolve(process.argv[4]);
+assert.ok(fs.existsSync(wav), 'Microphone WAV must exist');
+url.searchParams.set('welcome', '0');
+url.searchParams.set('setup', '1');
+const output = path.join(root, '.gev-logs', 'voice-auth');
+fs.mkdirSync(output, { recursive: true });
+const executablePath =
+  process.env.PUPPETEER_EXECUTABLE_PATH ||
+  (fs.existsSync('/Applications/Google Chrome.app/Contents/MacOS/Google Chrome')
+    ? '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'
+    : puppeteer.executablePath());
+const browser = await puppeteer.launch({
+  headless: true,
+  executablePath,
+  args: [
+    '--no-sandbox',
+    '--disable-setuid-sandbox',
+    '--use-fake-device-for-media-stream',
+    `--use-file-for-fake-audio-capture=${wav}%noloop`,
+    '--autoplay-policy=no-user-gesture-required',
+    '--disable-background-timer-throttling',
+    '--window-size=1440,900',
+  ],
+});
+const result = {
+  ok: false,
+  auth,
+  input: 'prerecorded microphone',
+  mints: [],
+  negotiations: [],
+};
+let page;
+const readSession = () =>
+  page.evaluate(async () => {
+    const voice = window.__godsEyeView.voiceCommands;
+    const stats = voice.pc ? [...(await voice.pc.getStats()).values()] : [];
+    const input = stats.find(
+      (entry) => entry.type === 'outbound-rtp' && entry.kind === 'audio',
+    );
+    const source = stats.find(
+      (entry) => entry.type === 'media-source' && entry.kind === 'audio',
+    );
+    const audio = stats.find(
+      (entry) => entry.type === 'inbound-rtp' && entry.kind === 'audio',
+    );
+    const meter = document.getElementById('gev-voice-cost-value');
+    return {
+      ...window.__voiceAuthEvidence,
+      connection: voice.pc?.connectionState,
+      microphoneEnabled: voice.stream
+        ?.getAudioTracks()
+        .every((track) => track.enabled),
+      inputBytes: input?.bytesSent || 0,
+      inputAudioEnergy: source?.totalAudioEnergy ?? null,
+      outputBytes: audio?.bytesReceived || 0,
+      outputAudioEnergy: audio?.totalAudioEnergy || 0,
+      playbackTime: voice.audioEl?.currentTime || 0,
+      meter: {
+        text: meter?.textContent,
+        usage: meter?.title,
+        visible: Boolean(meter?.getClientRects().length),
+      },
+    };
+  });
+try {
+  await browser
+    .defaultBrowserContext()
+    .overridePermissions(url.origin, ['microphone']);
+  page = await browser.newPage();
+  await page.setViewport({ width: 1440, height: 900 });
+  page.on('response', (response) => {
+    const route = new URL(response.url()).pathname;
+    if (route === '/api/realtime/token')
+      result.mints.push({
+        status: response.status(),
+        auth: response.headers()['x-gev-voice-auth'],
+        model: response.headers()['x-gev-voice-model'],
+      });
+    if (
+      route === '/v1/realtime/calls' &&
+      response.request().method() === 'POST'
+    )
+      result.negotiations.push({ status: response.status() });
+  });
+  // Observe the application's real transport. Do not replace fetch or replies.
+  await page.evaluateOnNewDocument(() => {
+    window.__voiceAuthEvidence = {
+      speechStopped: 0,
+      transcripts: [],
+      replies: [],
+      responses: [],
+      errors: [],
+      eventCounts: {},
+    };
+    const create = RTCPeerConnection.prototype.createDataChannel;
+    RTCPeerConnection.prototype.createDataChannel = function (...args) {
+      const channel = create.apply(this, args);
+      channel.addEventListener('message', ({ data }) => {
+        let event;
+        try {
+          event = JSON.parse(data);
+        } catch {
+          return;
+        }
+        const evidence = window.__voiceAuthEvidence;
+        evidence.eventCounts[event.type] =
+          (evidence.eventCounts[event.type] || 0) + 1;
+        if (event.type === 'input_audio_buffer.speech_stopped')
+          evidence.speechStopped += 1;
+        if (
+          event.type === 'conversation.item.input_audio_transcription.completed'
+        )
+          evidence.transcripts.push(event.transcript);
+        if (event.type === 'response.output_audio_transcript.done')
+          evidence.replies.push(event.transcript);
+        if (event.type === 'response.done')
+          evidence.responses.push({
+            status: event.response?.status,
+            inputTokens: event.response?.usage?.input_tokens,
+            outputTokens: event.response?.usage?.output_tokens,
+          });
+        if (event.type === 'error')
+          evidence.errors.push({ code: event.error?.code });
+      });
+      return channel;
+    };
+  });
+  await page.goto(url.href, { waitUntil: 'domcontentloaded', timeout: 30_000 });
+  await page.waitForFunction(
+    () =>
+      window.__godsEyeView?.voiceCommands &&
+      document.getElementById('loading-screen')?.classList.contains('hidden'),
+    { timeout: 45_000 },
+  );
+  await page.waitForSelector('[data-cloud-voice-auth-toggle]', {
+    visible: true,
+  });
+  await page.waitForFunction(
+    () =>
+      getComputedStyle(document.getElementById('key-setup')).opacity === '1',
+  );
+  const selected = await page.evaluate(
+    () => localStorage.getItem('godsEyeView.voice.cloudAuth') || 'api-key',
+  );
+  if (selected !== auth) {
+    await page.click('[data-cloud-voice-auth-toggle]');
+    await page.waitForFunction(
+      (mode) => localStorage.getItem('godsEyeView.voice.cloudAuth') === mode,
+      { timeout: 125_000 },
+      auth,
+    );
+  }
+  await page.click('[data-key-setup-close]');
+  await page.click('#gev-voice-button');
+  await page.waitForFunction(
+    () =>
+      window.__godsEyeView.voiceCommands.dc?.readyState === 'open' ||
+      window.__godsEyeView.voiceCommands.status === 'error',
+    { timeout: 35_000 },
+  );
+  assert.equal(
+    await page.evaluate(
+      () => window.__godsEyeView.voiceCommands.dc?.readyState,
+    ),
+    'open',
+    'Realtime channel must open',
+  );
+  await page.waitForFunction(
+    () =>
+      window.__voiceAuthEvidence.speechStopped > 0 &&
+      window.__voiceAuthEvidence.responses.some(
+        (response) =>
+          response.status === 'completed' && response.outputTokens > 0,
+      ),
+    { timeout: 45_000 },
+  );
+  await page.waitForFunction(
+    () =>
+      window.__voiceAuthEvidence.eventCounts['output_audio_buffer.stopped'] > 0,
+    { timeout: 30_000 },
+  );
+  result.session = await readSession();
+  assert.ok(
+    result.session.inputBytes > 0 && result.session.outputBytes > 0,
+    'Audio must flow in both directions',
+  );
+  assert.ok(
+    result.session.outputAudioEnergy > 0 && result.session.playbackTime > 0,
+    'Reply audio must play',
+  );
+  assert.equal(
+    result.session.meter.text === 'COST UNKNOWN',
+    auth === 'oauth',
+    'Use the correct accounting display',
+  );
+  await page.screenshot({ path: path.join(output, `${auth}-usage.png`) });
+  await page.click('#key-setup-chip');
+  await page.waitForSelector('[data-cloud-voice-auth-toggle]', {
+    visible: true,
+  });
+  await page.waitForFunction(
+    () =>
+      getComputedStyle(document.getElementById('key-setup')).opacity === '1',
+  );
+  await page.screenshot({ path: path.join(output, `${auth}-settings.png`) });
+  await page.click('[data-key-setup-close]');
+  result.stopped = await page.evaluate(() => {
+    const voice = window.__godsEyeView.voiceCommands;
+    const pc = voice.pc;
+    const tracks = voice.stream?.getTracks() || [];
+    voice.session.stop();
+    return (
+      pc.connectionState === 'closed' &&
+      tracks.every((track) => track.readyState === 'ended')
+    );
+  });
+  assert.ok(result.stopped, 'Stop must close the peer and microphone tracks');
+  await page.click('#gev-voice-button');
+  await page.waitForFunction(
+    () =>
+      window.__godsEyeView.voiceCommands.dc?.readyState === 'open' ||
+      window.__godsEyeView.voiceCommands.status === 'error',
+    { timeout: 35_000 },
+  );
+  assert.equal(
+    await page.evaluate(
+      () => window.__godsEyeView.voiceCommands.dc?.readyState,
+    ),
+    'open',
+    'Reconnect must work',
+  );
+  assert.equal(
+    result.mints.length,
+    2,
+    'Reconnect must request a fresh client secret',
+  );
+  assert.ok(
+    result.mints.every(
+      (mint) =>
+        mint.status === 200 &&
+        mint.auth === (auth === 'oauth' ? 'codex-oauth' : 'env'),
+    ),
+  );
+  assert.ok(result.negotiations.every((entry) => entry.status === 201));
+  result.ok = true;
+} catch (error) {
+  result.error = error.message;
+  if (page) {
+    result.session = await readSession().catch(() => null);
+    result.detail = await page
+      .$eval('#gev-voice-detail', (element) => element.textContent)
+      .catch(() => null);
+    await page
+      .screenshot({ path: path.join(output, `${auth}-failure.png`) })
+      .catch(() => {});
+  }
+} finally {
+  await page
+    ?.evaluate(() => window.__godsEyeView?.voiceCommands?.session?.stop())
+    .catch(() => {});
+  await browser.close();
+  fs.writeFileSync(
+    path.join(output, `${auth}-result.json`),
+    `${JSON.stringify(result, null, 2)}\n`,
+  );
+}
+console.log(JSON.stringify(result, null, 2));
+if (!result.ok) process.exitCode = 1;
@@ -176,7 +176,9 @@ export function buildCapabilitySummary(
        ? 'Google Photorealistic 3D Tiles through Cesium ion; Bing and world-terrain stacks available'
        : 'Esri World Imagery (keyless satellite basemap) with keyless terrain',
    flights,
-    voice: configured('OPENAI_API_KEY') ? 'available' : 'off until an OpenAI key is added',
+    voice: configured('OPENAI_API_KEY')
+      ? 'available'
+      : 'off until an OpenAI key is added, or a Codex ChatGPT sign-in is selected in Provider Settings (experimental)',
    vessels: configured('AISSTREAM_API_KEY') ? 'live AISStream feed' : 'off until an AISStream key is added',
    fires: configured('FIRMS_MAP_KEY') ? 'live NASA FIRMS feed' : 'off until a FIRMS key is added',
    traffic: configured('TOMTOM_API_KEY') ? 'live TomTom flow' : 'built-in traffic simulation',