fix(voice): track OAuth login lifecycle and storage readiness

server/providers/openai.js

@@ -7,6 +7,7 @@ import {
   createRealtimeTokenHandler,
 } from './openai/realtime.js';
 import { sameSiteGated } from './common/same-site.js';
+import { createCodexOAuthLogin } from './openai/codex-auth.js';
 
 /**
  * Vite plugin: OpenAI Realtime ephemeral client secret.
@@ -19,6 +20,7 @@ function openAiRealtimeProxy({
   annotationGuidance,
   realtime = {},
 } = {}) {
+  const oauthLogin = createCodexOAuthLogin(realtime);
   function install(middlewares) {
     // Cost-bearing and log endpoints refuse cross-site browser requests
     // (see server/providers/common/same-site.js and SECURITY.md).
@@ -38,12 +40,12 @@ function openAiRealtimeProxy({
 
     middlewares.use(
       '/api/realtime/oauth-status',
-      createRealtimeOAuthStatusHandler(realtime),
+      sameSiteGated(createRealtimeOAuthStatusHandler({ oauthLogin })),
     );
 
     middlewares.use(
       '/api/realtime/oauth-login',
-      createRealtimeOAuthLoginHandler(realtime),
+      sameSiteGated(createRealtimeOAuthLoginHandler({ oauthLogin })),
     );
   }
 
@@ -51,10 +53,13 @@ function openAiRealtimeProxy({
     name: 'openai-realtime-proxy',
     configureServer(server) {
       install(server.middlewares);
+      server.httpServer?.once('close', oauthLogin.dispose);
     },
     configurePreviewServer(server) {
       install(server.middlewares);
+      server.httpServer?.once('close', oauthLogin.dispose);
     },
+    closeBundle: oauthLogin.dispose,
   };
 }