feat(voice): add Codex subscription billing to native GPT-Live

[TheSmokeDev]

What does this PR do?

Adds an explicit ChatGPT/Codex subscription option to the native GPT-Live mode merged in #108137. Set voice.gpt_live.auth: subscription to use the Hermes host's existing Codex OAuth sign-in. API billing remains the default; subscription authentication or transport failures never select the API route or chained STT/TTS.

The server keeps the OAuth bearer and matching account identity private. The desktop uses the subscription WebRTC event format and returns Hermes replies through the corresponding context-append protocol. Hermes remains the agent, with the conversation's existing model, tools, memory and approvals.

Related Issue

Builds on the native GPT-Live mode merged in #108137.

Type of Change

• New feature (non-breaking explicit billing option)

Changes Made

• Reuse hermes_cli.auth_codex.resolve_codex_runtime_credentials; keep API and subscription model/voice settings separate.
• Add the Codex WebRTC request/SDP response format, real call/delegation IDs, captured transcript fragments and 500-byte UTF-8 context appends. Do not follow authenticated redirects or expose provider error bodies.
• Fetch authoritative voice status before opening an engine. Unknown or unavailable subscription status fails closed; resolved API mode retains its existing chained fallback.
• Ignore repeated delegation IDs and label subscription transcript timing as local arrival so the existing five-minute context window still expires.
• Document configuration and the subscription access requirement. No new dependency, plugin, tool, worker stack or login flow.

How to Test

1. scripts/run_tests.sh tests/tools/test_voice_live_subscription.py tests/tui_gateway/test_voice_live_delegation.py -j 1 -q — 12 passed on Windows, Python 3.11.13.
2. Desktop targeted regression: cd apps/desktop && npx vitest run src/lib/voice-live-subscription.test.ts --project ui. The same committed test file passed 3 cases locally with existing Vitest 4.1.10 and a temporary Node/module-alias configuration. It exercises the actual session/start-selection code with fake media and mocked network boundaries. The full desktop workspace configuration/build/typecheck was not run locally because this worktree has no installed workspace dependencies.
3. Red-on-base proof: the 7 new Python cases called the API resolver on the unmodified base; the renderer cases found duplicate dispatch, no subscription event handling, and discarded auth metadata. The five-minute transcript case also failed before its arrival-time fix. Ruff and git diff --check pass.
4. Manual provider/microphone test remains to be run: sign in through hermes auth, select subscription mode, start native Desktop voice, delegate a request to Hermes, hear the answer, mute/unmute and close. Repeat with explicit API mode. No live provider or microphone calls were made for this PR's local tests.

Checklist

• Read the contribution guide and searched overlapping PRs.
• Conventional, signed-off SmokeDev commit; one native Live feature.
• Focused behavioral regressions and existing API/delegation regressions pass.
• Updated operating docs and cli-config.yaml.example.
• Considered cross-platform behavior: browser WebRTC and existing Python OAuth/HTTP dependencies; no shell or OS-specific runtime changes.
• Full Python/desktop suites and live provider/microphone smoke test.

Protocol Evidence

Wire shapes were verified against OpenAI Codex commit c4017a87aacc7558002b7cb510025e967c1d765e: WebRTC call exchange, frameless events, context appends/history, and subscription model/headers.

Signed-off-by: SmokeDev degensmoke@gmail.com

[kvnloo]

Comment assumes head 31df979d718bf76fa9baf05f344dc4a590edbb93; void if moved.

KEEP — Native GPT-Live Codex subscription billing

• Explicit voice.gpt_live.auth: subscription reusing host Codex OAuth (API remains default; subscription auth/transport failures fail closed — no silent API route or chained STT/TTS) is the right billing option on the native GPT-Live mode merged in feat(voice): GPT-Live voice chat mode — full-duplex voice frontend delegating to Hermes (Desktop) #108137.
• Hermes stays the agent (model/tools/memory/approvals); server keeps OAuth bearer private; Desktop uses subscription WebRTC event + context-append shapes — scoped to Live auth, not a new duplex core.
• Prefer this as the subscription-auth native GPT-Live vehicle; peer complementary fix is feat(desktop): hang up GPT-Live after idle timeout #111102 (idle hangup / cost safety) — neither replaces the other (shared files, different axes).

CHECK

• GitHub reports MERGEABLE but mergeStateStatus: BLOCKED with empty live status rollup — refresh scripts/run_tests.sh tests/tools/test_voice_live_subscription.py tests/tui_gateway/test_voice_live_delegation.py + Desktop Vitest voice-live-subscription.test.ts + typecheck/lint before merge desk. Manual provider/mic smoke still open per PR body.
• Peer feat(desktop): hang up GPT-Live after idle timeout #111102 (@ cc1a414db19de1afa65f09b428f70b59caf1e014) adds idle hangup on overlapping voice-live.ts / tools/voice_live.py / config/docs. Prefer rebase this onto feat(desktop): hang up GPT-Live after idle timeout #111102 after that lands (or rebase feat(desktop): hang up GPT-Live after idle timeout #111102 if this lands first); do not close feat(desktop): hang up GPT-Live after idle timeout #111102 into this PR or absorb its idle/delegation-pause work here.
• Shared surface with Fresh feat(voice): add Codex OAuth STT, TTS, and live voice #106640: use-composer-voice* + Codex auth family — conflict/ordering on rebase possible; do not absorb Fresh sentence-based Codex providers or Rank1 duplex ABC into this PR.
• Wrong-face: not Rank1 duplex ABC (feat(voice): add realtime provider session contract #95147/[RFC] RealtimeVoiceProvider ABC — four competing duplex-voice PRs need an interface, not a merge queue #77111), not Rank3 lifetimes (fix(desktop): isolate voice turn lifetimes #95180), not spoken-anchor (fix(desktop): don't re-speak replies after hydrate rewrites durable ids #109077/fix(desktop): stop replaying a turn when the spoken anchor is rewritten #110326), not occluded metering (fix(desktop): finish voice turns while the window is minimized or occluded #110981/desktop(voice): keep wake-word conversations alive while occluded, auto-end after silence, Spanish stop phrases #110230), not cascaded TTS (feat(tts): add Groq Orpheus as a first-class TTS provider #98105), not local-whisper CUDA hygiene.
• Do not fold Muse metas or Rank1/2/3/Fresh/TTS-hooks/spoken-anchor redo targets into this PR.

One-click close / ordering

• Close competing native GPT-Live Codex subscription auth duplicates only after this lands and they are true duplicates; otherwise rebase them onto this tip.
• Do not close feat(desktop): hang up GPT-Live after idle timeout #111102, feat(voice): add Codex OAuth STT, TTS, and live voice #106640, feat(desktop): add ElevenLabs realtime voice transcription #94113, feat(voice): add realtime provider session contract #95147, Discord voice mode has extreme latency or poor STT accuracy #94462, feat(tts): add Groq Orpheus as a first-class TTS provider #98105, fix(desktop): finish voice turns while the window is minimized or occluded #110981, desktop(voice): keep wake-word conversations alive while occluded, auto-end after silence, Spanish stop phrases #110230, fix(desktop): don't re-speak replies after hydrate rewrites durable ids #109077, or fix(desktop): stop replaying a turn when the spoken anchor is rewritten #110326 into this PR.
• If feat(desktop): hang up GPT-Live after idle timeout #111102 or feat(voice): add Codex OAuth STT, TTS, and live voice #106640 land first and touch voice-live* / composer-voice / auth_codex, rebase here afterward and cite that merge SHA.

Landing-evidence

• When merged, please reply with the merge commit SHA on main (not “completed”).

[whyyagswhy]

Independent current-main and live-provider verification for head 31df979d718bf76fa9baf05f344dc4a590edbb93.

One rebase fix is required: after replaying this PR onto NousResearch/hermes-agent@784d5c3f9c, Desktop tsc --noEmit fails because notifyError now requires its localized fallback/title argument. I opened the one-line fix against the author's branch: TheSmokeDev#17

After that fix:

• current-main TypeScript, focused ESLint, Windows-footgun check, compatibility-pointer check, and full Desktop production build pass;
• 206 related Python web/auth/voice tests pass;
• 8 focused current-main Desktop tests pass;
• current OpenAI Codex main (4701aa4b4239c70063ab6f2fcb835324f9c109f4) still matches this PR's gpt-live-1-codex, /backend-api/codex/realtime/calls, quicksilver=v2, AVAS, frameless events, and 500-byte context-append contracts.

I also ran the missing live subscription canary with an existing Codex OAuth sign-in, without refreshing or changing the auth store:

1. Real Chromium negotiated a WebRTC answer and opened oai-events.
2. Synthesized speech produced 56 characters of input_transcript.added fragments, a provider-issued delegation.created, output_transcript.added, and clean session.closed.
3. The returned renderer payload contained no token, account, or authorization fields.

This closes the PR body's manual provider/protocol uncertainty for the subscription handshake, transcription, and delegation legs. It does not claim a human microphone/speaker UX check.

[l0cka]

Tested this feature replayed onto 77ecc72: 331 related Python tests passed (23 skipped), 9 focused Desktop tests passed, and Desktop typechecks/production build passed. Found a subscription context-expiry edge case during silence; submitted the minimal two-file fix and red/green regression to your feature branch: TheSmokeDev#18 . Two broader voice-prefs tests also fail on unmodified main and were left untouched. No new live-provider or human mic validation of this PR is claimed.

[TheSmokeDev]

@l0cka merged via TheSmokeDev#18 — head is now 9a3f694. Clean find: arrival-clocked fragments never aged out during silence, so the window anchor froze. Thanks for shipping the red/green regression with the fix.