7 Commits

Include renames

Author	SHA1	Message	Date
devv-shayan	8f5710e7cb	fix(voice): track OAuth login lifecycle and storage readiness	2026-10-04 17:24:30 +05:00
devv-shayan	6c88b78140	Merge upstream main into ChatGPT Realtime OAuth	2026-10-04 12:29:54 +05:00
3 people	7aa9bbd3be	fix(server): gate cost/log endpoints against cross-site requests and ship a full CSP ... The cost-bearing endpoints (/api/realtime/token, /api/openai/hud-summary, /api/google/nearby-places) and the voice debug log refuse cross-site browser requests: a foreign or opaque Origin, a Sec-Fetch-Site other than same-origin/none, or proxy forwarding headers. Loopback tools without an Origin and the LAN opt-in keep working. The dev and preview servers send one shared Content-Security-Policy, and embed-mode framing rewrites only the frame-ancestors directive of it. Salvaged from #242 onto current main. Co-authored-by: Sameh Khamis <[email protected]> Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>	2026-10-02 19:56:42 -07:00
devv-shayan	881e24485c	feat(voice): add ChatGPT OAuth auth option	2026-09-27 20:58:08 +05:00
Sameh Khamis	1a1cbadf5b	refactor: separate voice controls and configurable Realtime connections	2026-09-13 21:54:51 -07:00
Sameh Khamis	5223b6df5b	style: format extracted local services	2026-09-12 13:01:49 -07:00
Sameh Khamis	638902296a	refactor: separate local voice handlers and instructions	2026-09-12 12:59:39 -07:00