Deploy replica from source HEAD

.dockerignore

@@ -0,0 +1,12 @@
+.git
+.gitignore
+__pycache__/
+*.pyc
+.venv/
+venv/
+.vscode/
+.idea/
+.DS_Store
+*.log
+docs/
+.claude/

.gitignore

@@ -0,0 +1,16 @@
+# macOS metadata
+.DS_Store
+
+# Editor scratch
+.vscode/
+.idea/
+*.swp
+
+# Static HTTP server logs (we don't ship them)
+*.log
+
+# Python
+__pycache__/
+*.pyc
+.venv/
+venv/

CONTEXT.md

@@ -0,0 +1,81 @@
+# Context glossary
+
+Canonical terms for this space. A glossary, not a spec — it defines what words mean,
+not how anything is built. Keep design/implementation detail in `DESIGN.md` and the
+code.
+
+## Speech-to-speech demo
+The product: a voice conversation you have with a model by tapping the orb and
+talking. "The demo" and "the space" refer to this same thing. It runs on Hugging
+Face's open `speech-to-speech` backend.
+
+## The pipeline
+The ordered path a turn travels, from your voice to the orb's reply. Order is
+meaningful — each stage consumes the previous one's output:
+
+`you speak → VAD → STT → VLM → TTS → orb replies`
+
+- **VAD** — voice activity detection. Decides *when* you are speaking, so the system
+  knows a turn has started and ended. Model: silero-vad.
+- **STT** — speech to text. Transcribes your speech into words. Model:
+  nvidia/parakeet-tdt-1.1b.
+- **VLM** — the vision-language model that composes the reply. Served via Cerebras.
+  Model: google/gemma-4-31B-it.
+- **TTS** — text to speech. Speaks the reply back in the chosen voice. Model:
+  Qwen/Qwen3-TTS-12Hz-1.7B-CustomVoice.
+
+## Builder
+A Hugging Face user credited with making the space, shown by HF username. Current
+builders: tfrere, A-Mahla and andito. Distinct from the *models'* authors (nvidia, google,
+Qwen, snakers4), who are credited per pipeline stage.
+
+## Powered by
+The infrastructure running the pipeline, named in the about panel: Hugging Face
+Inference Endpoints (hosting) and Cerebras (LLM inference). Distinct from "built by"
+(the people) and from the model authors (who trained each model).
+
+## Tool
+A function the model can call mid-conversation to do something the pipeline
+can't do on its own (look something up, look through the camera). Tools are
+declared to the backend in the session config; the model decides when to call
+one. Distinct from the *pipeline stages* (VAD/STT/VLM/TTS), which always run.
+
+## Tool executor
+The client-side component that runs a tool when the model calls it and returns
+the result to the backend, so the model can speak the answer. It is the missing
+half of the round-trip: the backend already emits the call, the executor runs it
+and replies. Distinct from the *tool* itself (the thing being run).
+
+## Web search tool
+A tool that looks something up on the web for the model. The model calls it with
+a query; the tool executor forwards the query to the search proxy and returns the
+results as the tool result. Activates only when a search key is available.
+
+## Camera snapshot tool
+A tool that lets the model look through the user's webcam. While enabled, a live
+self-view is shown in the page (bottom-left); when the model calls the tool, the
+executor captures a frame and sends it to the model as an image so the VLM can
+see it. Distinct from the *preview* (what the user sees) and the *snapshot* (the
+single frame sent to the model).
+
+## Search proxy
+The same-origin server route (`/search`) that holds the search key and calls the
+external search provider on the client's behalf, so the key never reaches the
+browser. Lives in the same container as the page. Distinct from the *s2s backend*
+(the separate load-balanced speech-to-speech service).
+
+## Tools panel
+The dialog opened from the "Tools" button in the top-right, holding one switch per
+tool (and the web-search key status). Turning a switch on/off declares or removes
+that tool on the live session. Distinct from *Settings* (connection, voice,
+instructions) and the *About panel* (project info).
+
+## Identity block
+The top-left corner of the topbar (replacing the old wordmark): the demo name, a
+one-line blurb, and the "powered by" / "built by" credits, shown directly rather
+than hidden behind a click.
+
+## About panel
+The popup opened from the (i) icon to the right of the identity block. Holds the
+general introduction to the speech-to-speech project (with a repo link) and the
+pipeline. Identity itself now lives in the corner, not here.

DESIGN.md

@@ -0,0 +1,205 @@
+# Design language
+
+The reference for keeping this app visually coherent as it grows. Read it before
+touching `style.css`, `index.html`, or any DOM-building code in `main.js`. Every
+rule here is already live in the codebase — this file explains the *why* so changes
+extend the system instead of drifting from it.
+
+---
+
+## The thesis: color belongs to the voice
+
+This is a voice app. The one thing in the room that should have color is the thing
+that is talking. So:
+
+- **The orb** carries saturated color. It glows, and the glow's hue changes with
+  conversational state.
+- **Everything else is monochrome** — a precise cool-grey dark canvas. Surfaces,
+  borders, buttons, panels, the transcript: all greyscale.
+- The **only** exceptions are tiny *role echoes* (a one-word mono label, a small
+  icon) that borrow the orb's state hue so the transcript reads in the same color
+  language the orb speaks. They are accents the size of a word, never fills.
+- **Brand logos keep their own color.** The Hugging Face mark (`#ffd21e`) and the
+  Cerebras mark (`#f15a29`) render in their brand colors in the identity credits and
+  the about panel — a deliberate, owner-approved exception. It applies to those two
+  logos only; do not generalize it to other chrome.
+
+If you find yourself adding a tinted background, a colored border, or a bright
+button anywhere outside the orb, stop — that color almost certainly belongs to the
+orb instead, or shouldn't exist.
+
+---
+
+## Color tokens
+
+All defined in `:root` in `style.css`. Use the variables, never raw hex in rules.
+
+### Canvas (the monochrome world)
+| Token | Value | Use |
+|---|---|---|
+| `--bg` | `#0a0b10` | Page background (a cool near-black) |
+| `--bg-elev` | `#13151c` | Raised surfaces: bubbles, panels, icon buttons |
+| `--bg-elev-2` | `#1b1e29` | Surfaces on surfaces: history bodies, inputs |
+| `--border` | `rgba(255,255,255,.08)` | Default hairline |
+| `--border-strong` | `rgba(255,255,255,.16)` | Emphasised hairline |
+| `--text` | `#f5f6fa` | Primary text; also the *primary button* fill |
+| `--text-dim` | `rgba(245,246,250,.65)` | Secondary text |
+| `--text-faint` | `rgba(245,246,250,.42)` | Captions, labels, footer |
+
+### Voice (the only saturated hues)
+These are the orb's state colors. They appear on the orb, and as small role echoes
+in the transcript — nowhere else.
+
+| Token | Value | Meaning |
+|---|---|---|
+| `--accent` / `--speaking` | `#8b7dff` violet | Assistant speaking |
+| `--accent-2` / `--listening` | `#22d3ee` cyan | You / listening |
+| `--processing` | `#f59e0b` amber | Thinking / tool call |
+| `--error` | `#ff6a75` | Error |
+| `--success` | `#34d399` | Ready / connected |
+
+### Role echoes (semantic aliases — use these in chat code)
+| Token | Maps to | Where it shows |
+|---|---|---|
+| `--voice-user` | cyan | `YOU` label + user bubble accents |
+| `--voice-assistant` | violet | `ASSISTANT` label + assistant accents |
+| `--voice-tool` | amber | `TOOL CALL` label, wrench icon |
+
+**Why this mapping:** it mirrors the orb exactly — when *you* speak the orb is cyan
+(`state-listening`), when the *assistant* speaks it's violet (`state-ai-speaking`),
+when it's working it's amber (`state-processing`). The transcript is a quiet replay
+of the orb's color story.
+
+### Orb state → glow (`.circle.state-*` → `--glow`)
+| State | Glow |
+|---|---|
+| `signed-out` | violet `#8b7dff` |
+| `authenticated` / `ready` | green `#34d399` |
+| `connecting` / `connected` / `starting` | yellow `#facc15` |
+| `listening` / `user-speaking` | cyan (`--listening`) |
+| `processing` | amber (`--processing`) |
+| `ai-speaking` | violet (`--speaking`) |
+| `error` | red (`--error`) |
+
+Adding a new state? Give it a `--glow`, and if it surfaces in the transcript, add a
+matching `--voice-*` alias rather than a one-off color.
+
+---
+
+## Typography
+
+Two faces, two jobs. Never reach for a third.
+
+- **Inter** — body and UI. Wordmark, buttons, inputs, panel titles, prose, history
+  message bodies. The workhorse; it should feel neutral and get out of the way.
+- **Geist Mono** (`--font-mono`) — the **machine voice**. Reserved for text the
+  *system* emits or identifiers it reports, never for human prose.
+
+### When mono is correct
+Mono signals "this is the machine talking or naming itself." Use it for:
+- the orb's status caption (`.circle-caption`)
+- role eyebrows (`YOU` / `ASSISTANT` / `TOOL CALL`)
+- tool-call names and argument JSON
+- the `·WebSocket` transport tag, bitrate readouts, connection identifiers
+- the empty-state label
+
+Mono text is set uppercase with `letter-spacing: ~0.1–0.14em` and weight `500`, so it
+reads as a typed status line, not a headline. Body copy, button labels, and
+explanatory `small` text stay **Inter** — putting prose in mono breaks the metaphor.
+
+The font is loaded in `index.html`; the stack falls back to system mono gracefully if
+the CDN is blocked.
+
+---
+
+## Layout
+
+- **One continuous canvas.** No dividers under the topbar or above the footer, no
+  panel chrome competing with content. The topbar and footer float over the stage.
+  Keep it that way — a new section earns a hairline (`--border`) only if it genuinely
+  needs separating.
+- **The orb is the hero and the center of gravity.** It sits dead-center on the
+  stage. Controls flank it (mic / stop), captions sit beneath. Don't crowd it.
+- **Hairlines, not boxes.** Separation comes from `1px` borders at 8–16% white and
+  from spacing, not from heavy fills or shadows. Shadows are soft and low
+  (`0 4px 18px rgba(0,0,0,.32)`), used only to lift floating elements (bubbles,
+  panels, modal).
+- **Radii:** `--radius-sm: 8px` (buttons, inputs, chips), `--radius-md: 14px`
+  (bubbles, message bodies, modal), `--radius-lg: 22px` (reserved). Pick by element
+  size; don't invent new values.
+- **Two reading surfaces for the transcript:** ephemeral bubbles top-right (desktop
+  only) that log and fade, and a slide-in history panel for review. On phones the
+  bubble stream is dropped and the panel goes full-screen — the panel is the single
+  source of truth there.
+
+---
+
+## Components
+
+- **Buttons.** Default (`.btn`) is a neutral elevated surface. The *primary* button
+  is **near-white on dark** (`--text` fill, `--bg` text) — the highest-contrast thing
+  on the page that *isn't* the orb. There is no colored button; emphasis comes from
+  contrast, not hue.
+- **Icon buttons** (`.icon-btn`) are `36px`, elevated surface, dim icon that brightens
+  on hover. Side controls (`.side-btn`) are circular, collapse to zero size until the
+  session is live (by width on desktop, by height in the mobile column).
+- **Chat bubbles & history messages** share one neutral surface. They are
+  distinguished by **side** (you = left, assistant = right) plus the **mono role
+  label** in the role-echo hue — not by tinted fills. Tool entries use the wrench icon
+  + mono + amber, on the same neutral surface.
+- **Badge** (new-message dot) is monochrome white — a signal, not a color accent.
+- **Focus** is visible and neutral: inputs focus to `--text-dim`; the orb uses a
+  `--glow`-colored outline (it's the orb, so color is allowed).
+
+---
+
+## Motion
+
+- **The orb is audio-reactive, not timer-driven.** Mic RMS (`--audio-level`) and the
+  assistant output level (`--ai-audio-level`) drive scale/opacity at display rate, so
+  every syllable moves it. This is the signature animation — keep new motion
+  subordinate to it.
+- **Quiet by default.** Breathing/glow throbs are slow (1.4–2.4s) and low-contrast.
+  Resist adding scattered micro-animations; an orchestrated moment beats many small
+  ones, and excess motion reads as AI-generated.
+- **First paint is frozen.** `body.booting` disables all transitions until the first
+  frame commits (stripped after one rAF in `main.js`). Anything new that would
+  otherwise animate-in on load must respect this.
+- Honor `prefers-reduced-motion` for any motion you add.
+
+---
+
+## Writing / copy voice
+
+- Sentence case, plain verbs, no filler. Tuned and quiet — match the minimal canvas.
+- Name things by what the user controls, not by the system's internals. A button says
+  exactly what it does, and keeps the same word through the flow.
+- **Empty states invite action** ("Tap the orb and start talking"), they don't just
+  set a mood.
+- **Errors state what happened and how to recover**, in the interface's voice — they
+  don't apologize and are never vague.
+- Mono labels are terse identifiers (`YOU`, `TOOL CALL`); prose stays in Inter.
+
+---
+
+## Responsive floor (non-negotiable)
+
+Every change ships meeting these:
+- Works down to a `360px`-wide phone. The `@media (max-width: 600px)` block already
+  handles the phone layout — extend it, don't fight it.
+- Visible keyboard focus on every interactive element.
+- `prefers-reduced-motion` respected.
+- Tap targets ≥ `44px`; `touch-action: manipulation` on anything tappable.
+
+---
+
+## Before you ship — the mirror check
+
+1. Is every saturated color either on the orb or a word-sized role echo? If a fill or
+   border is colored, remove that accessory.
+2. Is mono used only for machine/system text, and Inter for everything human?
+3. Does any new state have both a `--glow` and (if it appears in chat) a `--voice-*`
+   alias?
+4. Are separations hairlines + spacing, not boxes and heavy shadows?
+5. Did you add motion? Is it quieter than the orb and reduced-motion-safe?
+6. Remove one accessory. The minimal look survives on precision, not addition.

Dockerfile

@@ -0,0 +1,14 @@
+# Single container: serves the static front-end AND the /api/search proxy.
+# HF Spaces (sdk: docker) routes traffic to $PORT, default 7860.
+FROM python:3.11-slim
+
+WORKDIR /app
+
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+
+COPY . .
+
+EXPOSE 7860
+
+CMD ["uvicorn", "server:app", "--host", "0.0.0.0", "--port", "7860"]

README.md

@@ -1,10 +1,187 @@
 ---
-title: Hf Realtime Voice
-emoji: 🐨
-colorFrom: yellow
-colorTo: gray
+title: HF Realtime Voice
+emoji: 🎙️
+colorFrom: indigo
+colorTo: purple
 sdk: docker
+app_port: 7860
 pinned: false
+short_description: Voice chat over WebSocket against a HF speech-to-speech
+hf_oauth: true
 ---
 
-Check out the configuration reference at https://huggingface.co/docs/hub/spaces-config-reference
+# Minimal Conversation App (S2S backend, **WebSocket** transport)
+
+Drop-in alternative to [`amir-tfrere/minimal-conversation-app-s2s-backend`](https://huggingface.co/spaces/amir-tfrere/minimal-conversation-app-s2s-backend)
+that uses the **WebSocket** route of the Hugging Face speech-to-speech
+backend instead of the WebRTC SDP proxy. Same load balancer, same
+`/session` handshake, same UI, same orb. Just a different wire.
+
+## How it works
+
+1. App POSTs `<lb_url>/session` (empty JSON body).
+2. The LB picks a ready compute (round-robin) and returns:
+   ```json
+   {
+     "session_id": "...",
+     "websocket_url": "wss://<compute>/v1/realtime",
+     "connect_url": "wss://<compute>/v1/realtime?session_token=<JWT>",
+     "session_token": "<JWT>",
+     "pending_timeout_s": 60
+   }
+   ```
+3. App opens a WebSocket **directly** on `connect_url` (no rewrite to
+   `https://`; unlike the WebRTC client which POSTs an SDP offer).
+4. Server pushes `session.created` on connect. Client replies with
+   `session.update` (OpenAI Realtime **GA** schema: `session.audio.input`,
+   `session.audio.output`, `session.output_modalities`).
+5. Client streams mic audio as PCM16 16 kHz mono base64 chunks
+   (`input_audio_buffer.append`, one frame every ~40 ms).
+6. Server pushes `response.output_audio.delta` (PCM16 24 kHz mono base64)
+   and transcript deltas.
+
+The backend exposes one concurrent session per compute (same as WebRTC
+mode); the LB pins the session via a signed `session_token`.
+
+## Why WebSocket instead of WebRTC
+
+| | WebRTC (original) | WebSocket (this) |
+|---|---|---|
+| Transport | UDP + Opus 48 kHz + ICE/STUN | TCP + raw PCM16 |
+| NAT traversal | needs STUN, can fail on corporate / cellular | none, works everywhere TCP is allowed |
+| Audio quality | excellent (Opus, jitter buffer, FEC) | good (raw PCM, simple ring buffer) |
+| Latency | lowest (~50-150 ms) | low (~150-300 ms typical) |
+| Echo cancellation | browser AEC active on the WebRTC track | browser AEC active via `getUserMedia` constraints |
+| Debuggability | needs `chrome://webrtc-internals` | `wscat` / DevTools network tab |
+| Mobile data | sometimes blocked (UDP) | always works (HTTPS+WSS) |
+
+## Backend requirement
+
+This app talks to the WebSocket route `@app.websocket("/v1/realtime")`
+defined in
+[`websocket_router.py`](https://github.com/huggingface/speech-to-speech/blob/feat/webrtc-transport/src/speech_to_speech/api/openai_realtime/websocket_router.py)
+on the **`feat/webrtc-transport`** branch. The same compute serves both
+the WebRTC POST and the WebSocket upgrade on the same path; no backend
+change required.
+
+Smoke-test from the shell:
+
+```bash
+LB="https://kaa1l6rplzb1gg3y.us-east-1.aws.endpoints.huggingface.cloud"
+curl -X POST "$LB/session" -H "Content-Type: application/json" -d '{}'
+# -> { "connect_url": "wss://<compute>/v1/realtime?session_token=..." }
+# Feed connect_url into a wscat / websocat and you should get a
+# session.created event back immediately.
+```
+
+## Tools
+
+The assistant can call two tools mid-conversation (toggle them from the **Tools**
+button, top-right):
+
+- **Web search** — Google results via Serper.dev, proxied server-side so the key
+  never reaches the browser. Set `SERPER_API_KEY` as a Space secret. Without it,
+  the tool is disabled unless the user pastes their own key in the Tools panel.
+- **Camera** — while enabled, a live self-view shows bottom-left; when the model
+  calls the tool, the current frame is sent to the vision-language model so it can
+  see what you're showing it.
+
+## Connecting to a backend
+
+The app connects **directly** to a speech-to-speech server's realtime WebSocket —
+no load balancer, no `/session` step. Set the URL in two ways:
+
+- **`LOAD_BALANCER_URL` env** (served via `/api/config`) provides the default URL
+  shown in Settings — handy for the deployed Space.
+- **Settings → Speech-to-speech server URL** lets you override it: paste a full
+  `connect_url` (`wss://host/v1/realtime?...`) or a bare host like `localhost:8080`
+  (the app adds `/v1/realtime`).
+
+**Settings → Restart** reconnects with the current voice, instructions and URL.
+
+## Usage limits
+
+Conversation time is metered per UTC day by sign-in tier (see `limiter.py` /
+`auth.py`), but **only on the deployed Space** — metering turns on only when BOTH
+`LOAD_BALANCER_URL` and `SPACE_ID` (injected automatically by the HF Space
+runtime) are present. Running locally — even with `LOAD_BALANCER_URL` exported —
+leaves the app unmetered. Tunable via env:
+
+| Env | Default | What |
+|-----|---------|------|
+| `LIMIT_ANON_SEC` | `300` | Daily seconds for anonymous visitors (5 min) |
+| `LIMIT_FREE_SEC` | `600` | Daily seconds for signed-in non-PRO users (10 min) |
+| `UNLIMITED_ORGS` | _(adds to defaults)_ | Extra HF org names whose members get **unlimited** usage, like PRO |
+| `USAGE_HASH_SECRET` | _(random)_ | HMAC secret for hashing identity keys + signing the anon cookie |
+
+PRO members are always unlimited. Members of `cerebras`, `HuggingFaceM4`,
+`smolagents`, and `pollen-robotics` are unlimited out of the box (shown as
+"Team", not "PRO"); set `UNLIMITED_ORGS=my-team` to add more. Matched
+case-insensitively against the user's organisations from HF OAuth.
+
+## Run locally
+
+The app is now a small FastAPI server (it serves the front-end *and* the search
+proxy from one container).
+
+```bash
+pip install -r requirements.txt
+export SERPER_API_KEY=...        # optional; web search is disabled without it
+export LOAD_BALANCER_URL=...     # optional; default s2s server URL (set it in Settings otherwise)
+uvicorn server:app --reload --port 7860
+# or, matching production: docker build -t s2s . && docker run -p 7860:7860 -e SERPER_API_KEY=... -e LOAD_BALANCER_URL=... s2s
+```
+
+Then open <http://localhost:7860/>, click the orb, allow the mic, talk.
+
+> Browsers require **HTTPS or `localhost`** for `getUserMedia()` (mic + camera).
+> `127.0.0.1` and `localhost` both work; plain `http://192.168.x.y` does NOT.
+
+## Settings (stored in `localStorage`)
+
+| Key | What |
+|-----|------|
+| Load balancer URL | Base URL of your S2S deployment. App POSTs `<lb>/session`. |
+| Voice | Qwen3-TTS speaker name (Aiden, Ryan, Dylan, Eric, Ono_Anna, Serena, Sohee, Uncle_Fu, Vivian) |
+| Instructions | System prompt sent in `session.update` once the WS opens |
+
+LocalStorage keys are namespaced `s2s.ws.*` so this app's settings do
+NOT collide with the WebRTC variant.
+
+## Files
+
+| File | Role |
+|------|------|
+| `index.html` | Single page, orb + settings modal (identical UI to the WebRTC app) |
+| `main.js` | State machine, settings, tools, camera, noise-gate UI wiring |
+| `ui/chat.js` | `ChatView`: history panel, ephemeral bubbles, transcript/tool streaming |
+| `ui/account.js` | `Account`: HF login chip + popover, daily-limit modal |
+| `ui/dom.js` | Shared helpers: `$`, `escHtml`, `truncateError`, `DEBUG` |
+| `auth.py` | HF OAuth + per-request identity (tier, hashed keys) |
+| `limiter.py` | SQLite per-day talk-time budget (chunked server-clock reservation) |
+| `ws/s2s-ws-client.js` | WebSocket handshake + OpenAI Realtime GA protocol |
+| `ws/codec.js` | base64 <-> PCM helpers + transcript extraction (pure) |
+| `ws/orb-visualizer.js` | `OrbVisualiser`: FFT bands -> orb CSS custom properties |
+| `worklets/mic-capture.js` | AudioWorklet: 48 kHz Float32 -> 16 kHz Int16 PCM, posts ~40 ms chunks |
+| `worklets/audio-playback.js` | AudioWorklet: 24 kHz Float32 ring buffer -> 48 kHz, linear interp, fade in/out |
+| `style.css` | Orb animations, layout, dark theme (verbatim from the WebRTC app) |
+
+## Audio pipeline notes
+
+- **Input**: `getUserMedia({ echoCancellation, noiseSuppression, autoGainControl })`
+  feeds the `mic-capture` worklet at the `AudioContext` rate. The worklet
+  resamples to 16 kHz (boxcar lowpass + decimation on the 48 -> 16 fast
+  path, linear interpolation fallback for odd rates) and packs Int16 LE.
+- **Output**: `response.output_audio.delta` decodes to Int16 -> Float32
+  and is posted to the `audio-playback` worklet. The worklet maintains a
+  per-context ring buffer, linearly interpolates 24 -> 48, and applies
+  short 32-frame fades on entry/exit to suppress clicks.
+- **Barge-in**: when the server VAD detects user speech mid-response
+  (`input_audio_buffer.speech_started` while `ai-speaking`), the client
+  posts `{ kind: "clear" }` to the playback worklet to wipe the queue
+  immediately. The server itself cancels the in-flight response.
+
+## Credits
+
+- Backend: [huggingface/speech-to-speech](https://github.com/huggingface/speech-to-speech) on `feat/webrtc-transport`
+- UI verbatim from `amir-tfrere/minimal-conversation-app-s2s-backend` (Pollen Robotics × Hugging Face)

auth.py

@@ -0,0 +1,229 @@
+"""
+HF OAuth + per-request identity for the duration limiter.
+
+Login uses Hugging Face's native Spaces OAuth via `huggingface_hub`
+(`attach_huggingface_oauth` / `parse_huggingface_oauth`). The OAuth env
+(`OAUTH_CLIENT_ID`, ...) is injected by the platform when the Space README sets
+`hf_oauth: true`, so this only activates on a deployed Space — locally and in
+direct mode there's no OAuth and the limiter treats everyone as anonymous.
+
+Identity:
+  - signed in   -> tier 'pro' | 'free', keyed by hashed HF `sub`
+  - anonymous   -> tier 'anon', keyed by BOTH hashed client IP and a hashed
+                   signed-cookie id (OR-matched in the limiter)
+"""
+
+import logging
+import os
+import secrets
+
+import limiter
+
+logger = logging.getLogger("s2s.auth")
+
+# huggingface_hub adds these routes when OAuth is attached. Centralised so a
+# version change is a one-line fix; the paths are handed to the client via
+# /api/me rather than hardcoded there.
+OAUTH_LOGIN_PATH = "/oauth/huggingface/login"
+OAUTH_LOGOUT_PATH = "/oauth/huggingface/logout"
+
+ANON_COOKIE = "s2s_anon"
+_COOKIE_MAX_AGE = 60 * 60 * 24 * 30  # 30 days
+
+
+# Members of these orgs get unlimited usage (like PRO) out of the box. The
+# UNLIMITED_ORGS env adds to this set; it doesn't replace it.
+_DEFAULT_UNLIMITED_ORGS = {"cerebras", "huggingfacem4", "smolagents", "pollen-robotics"}
+
+
+def _unlimited_orgs() -> "set[str]":
+    """Org usernames whose members get unlimited usage (like PRO).
+
+    Defaults to {cerebras, HuggingFaceM4, smolagents}; the UNLIMITED_ORGS env
+    (comma/space-separated, e.g. `UNLIMITED_ORGS=my-team`) adds more. Matched
+    case-insensitively against the signed-in user's organisations."""
+    raw = os.environ.get("UNLIMITED_ORGS", "")
+    extra = {o.strip().lower() for o in raw.replace(",", " ").split() if o.strip()}
+    return _DEFAULT_UNLIMITED_ORGS | extra
+
+try:
+    from huggingface_hub import attach_huggingface_oauth, parse_huggingface_oauth
+    _OAUTH_IMPORTABLE = True
+except Exception as exc:  # pragma: no cover - import guard
+    logger.info("huggingface_hub OAuth unavailable (%s); sign-in disabled.", exc)
+    _OAUTH_IMPORTABLE = False
+
+# Set by attach(): True once OAuth is actually wired (importable + env present).
+oauth_enabled = False
+
+
+def attach(app) -> bool:
+    """Wire HF OAuth onto the app if it's importable and configured. Returns
+    whether sign-in is available."""
+    global oauth_enabled
+    if not _OAUTH_IMPORTABLE or not os.environ.get("OAUTH_CLIENT_ID"):
+        return False
+    try:
+        attach_huggingface_oauth(app)
+        oauth_enabled = True
+        logger.info("HF OAuth attached (sign-in enabled).")
+    except Exception as exc:  # pragma: no cover - defensive
+        logger.warning("Failed to attach HF OAuth: %r", exc)
+        oauth_enabled = False
+    return oauth_enabled
+
+
+def _field(obj, name, default=None):
+    """Read a field whether the user-info is an object or a dict."""
+    if obj is None:
+        return default
+    if isinstance(obj, dict):
+        return obj.get(name, default)
+    return getattr(obj, name, default)
+
+
+# Surface what we detect (orgs, tier) in logs and on /api/me when set. Handy for
+# verifying org gating on the live Space without guessing.
+AUTH_DEBUG = bool(os.environ.get("AUTH_DEBUG"))
+
+# whoami-v2 org lookups are cached for the process lifetime, keyed by token, so
+# /api/me + /api/session don't each hit the Hub.
+_orgs_cache: "dict[str, set[str]]" = {}
+
+
+def current_oauth(request):
+    """The parsed HF OAuth info (user_info + access_token), or None."""
+    if not oauth_enabled:
+        return None
+    try:
+        return parse_huggingface_oauth(request)
+    except Exception:
+        return None
+
+
+def current_user(request):
+    """The signed-in HF user-info, or None."""
+    return _field(current_oauth(request), "user_info")
+
+
+def _user_org_names(user) -> "set[str]":
+    """The user's organisations from the OAuth userinfo, by username/name/id."""
+    names = set()
+    for org in _field(user, "orgs", []) or []:
+        for key in ("preferred_username", "name", "sub"):
+            val = _field(org, key)
+            if val:
+                names.add(str(val).lower())
+    return names
+
+
+def _orgs_via_token(token: str) -> "set[str]":
+    """Fallback org lookup via the Hub `whoami-v2` API, using the user's OAuth
+    access token. Covers the case where the userinfo claim omits `orgs`."""
+    if not token:
+        return set()
+    if token in _orgs_cache:
+        return _orgs_cache[token]
+    names: "set[str]" = set()
+    try:
+        import httpx
+
+        resp = httpx.get(
+            "https://huggingface.co/api/whoami-v2",
+            headers={"Authorization": f"Bearer {token}"},
+            timeout=5.0,
+        )
+        resp.raise_for_status()
+        for org in resp.json().get("orgs", []) or []:
+            for key in ("name", "fullname"):
+                val = org.get(key)
+                if val:
+                    names.add(str(val).lower())
+    except Exception as exc:  # pragma: no cover - network/permission dependent
+        logger.info("whoami-v2 org lookup failed: %r", exc)
+    _orgs_cache[token] = names
+    return names
+
+
+def _org_names(user, token=None, allow=None) -> "set[str]":
+    """The user's org usernames from the OAuth userinfo claim. If that doesn't
+    already satisfy `allow`, fall back to the Hub `whoami-v2` API (the claim is
+    often empty or partial), so membership is resolved either way."""
+    names = _user_org_names(user)
+    if token and (allow is None or not (allow & names)):
+        names = names | _orgs_via_token(token)
+    return names
+
+
+def resolve_tier(user, token=None) -> str:
+    """Tier for a signed-in user: 'pro' (paying), 'org' (allow-listed org
+    member, unlimited), or 'free'. PRO wins over org if both apply."""
+    if bool(_field(user, "is_pro", False)):
+        return "pro"
+    allow = _unlimited_orgs()
+    names = _org_names(user, token, allow)
+    tier = "org" if (allow & names) else "free"
+    if AUTH_DEBUG:
+        logger.info("tier=%s orgs=%s allow=%s", tier, sorted(names), sorted(allow))
+    return tier
+
+
+def user_view(request) -> dict:
+    """Public profile for /api/me."""
+    info = current_oauth(request)
+    user = _field(info, "user_info")
+    if not user:
+        return {"loggedIn": False, "tier": "anon"}
+    token = _field(info, "access_token")
+    out = {
+        "loggedIn": True,
+        "username": _field(user, "preferred_username") or _field(user, "name") or "you",
+        "avatar": _field(user, "picture"),
+        "tier": resolve_tier(user, token),
+    }
+    if AUTH_DEBUG:
+        out["orgs"] = sorted(_org_names(user, token))
+    return out
+
+
+def _client_ip(request) -> str:
+    """Real client IP. On HF the app sits behind a proxy, so the user's address
+    is the first hop in X-Forwarded-For, not request.client.host."""
+    xff = request.headers.get("x-forwarded-for", "")
+    if xff:
+        return xff.split(",")[0].strip()
+    return request.client.host if request.client else "unknown"
+
+
+def resolve_identity(request):
+    """Resolve (tier, keys, set_cookie) for this request.
+
+    `keys` are the limiter usage_daily keys to debit (one for signed-in, two for
+    anonymous). `set_cookie` is a signed value to Set-Cookie when we minted a new
+    anonymous id, else None.
+    """
+    info = current_oauth(request)
+    user = _field(info, "user_info")
+    if user:
+        sub = _field(user, "sub") or _field(user, "preferred_username")
+        token = _field(info, "access_token")
+        return resolve_tier(user, token), [limiter.hash_key(f"sub:{sub}")], None
+
+    # Anonymous: key by IP and a signed cookie id, minting the cookie if absent.
+    ip = _client_ip(request)
+    cookie_id = limiter.verify_cookie(request.cookies.get(ANON_COOKIE, ""))
+    set_cookie = None
+    if not cookie_id:
+        cookie_id = secrets.token_urlsafe(18)
+        set_cookie = limiter.sign_cookie(cookie_id)
+    keys = [limiter.hash_key(f"ip:{ip}"), limiter.hash_key(f"cookie:{cookie_id}")]
+    return "anon", keys, set_cookie
+
+
+def set_anon_cookie(response, signed: str) -> None:
+    # The Space runs inside an iframe on huggingface.co, so the cookie lives in a
+    # cross-site context — it must be SameSite=None; Secure or the browser drops it.
+    response.set_cookie(
+        ANON_COOKIE, signed,
+        max_age=_COOKIE_MAX_AGE, httponly=True, samesite="none", secure=True,
+    )

docs/adr/0001-docker-space-with-search-proxy.md

@@ -0,0 +1,29 @@
+# Convert the static Space into a Docker app with a search proxy
+
+To give the model a web search tool, the executor (which runs in the browser of a
+public Space) needs a search key. A `sdk: static` Space serves files as-is with no
+runtime process, so it cannot hold a secret the browser uses without exposing it.
+We convert the Space from `sdk: static` to `sdk: docker`: a single container runs a
+small server (FastAPI + uvicorn) that both serves the existing front-end *unchanged*
+and exposes a same-origin `/search` proxy holding `SERPER_API_KEY` server-side. The
+whole app lives in that one container; the s2s speech-to-speech backend stays the
+separate load-balanced service it already is.
+
+## Considered options
+
+- **Stay static, user-supplied key only** — no owner key; search works only if each
+  user pastes their own. Rejected as the default because it leaves the deployed demo
+  with no working search.
+- **Separate proxy service** — same secrecy, but splits the app across two deploys.
+  Rejected: the app must live in one container.
+- **Key baked into client JS at build time** — would be readable in the served
+  bundle. Rejected: defeats the point.
+
+## Consequences
+
+- Deployment is no longer static: there is a Dockerfile and a server process; the
+  README front-matter changes from `sdk: static` to `sdk: docker`.
+- The client calls `/search` same-origin; the server reads the key from env. A user
+  may still supply their own key as a fallback, sent per-request to the proxy.
+- The front-end, audio pipeline, and s2s handshake are untouched — only the hosting
+  shape and the new route are added.

index.html

@@ -0,0 +1,363 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover" />
+    <title>Minimal Conversation · S2S backend (WebSocket)</title>
+    <link rel="preconnect" href="https://fonts.googleapis.com" />
+    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
+    <link
+      href="https://fonts.googleapis.com/css2?family=Geist+Mono:wght@400;500;600&family=Inter:wght@400;500;600;700;800&display=swap"
+      rel="stylesheet"
+    />
+    <link rel="stylesheet" href="style.css" />
+  </head>
+  <!--
+    `booting` disables transitions/animations until the first paint commits.
+    Without this the orb visibly fades/scales in on the very first frame
+    because `state-idle` and the generic `.ind` defaults differ. The
+    bootstrap script at the end of main.js strips the class after one rAF.
+  -->
+  <body class="booting">
+    <div id="app">
+      <header class="topbar">
+        <div class="brand">
+          <div class="ident">
+            <div class="ident-head">
+              <a class="ident-title" href="https://github.com/huggingface/speech-to-speech" target="_blank" rel="noopener">Speech-to-speech demo</a>
+              <button id="about-btn" class="about-btn" title="About this space" aria-label="About this space">
+                <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><line x1="12" y1="16" x2="12" y2="12"/><line x1="12" y1="8" x2="12.01" y2="8"/></svg>
+              </button>
+            </div>
+            <p class="ident-blurb">An open, real-time voice chat built on Hugging Face's speech-to-speech stack.</p>
+            <div class="ident-meta">
+              <span class="ident-row">
+                <span class="ident-label">Powered by</span>
+                <a href="https://huggingface.co/inference-endpoints" target="_blank" rel="noopener">Inference Endpoints</a>
+                <span class="sep" aria-hidden="true">·</span>
+                <a class="cerebras-credit" href="https://cerebras.ai" target="_blank" rel="noopener"><svg class="cerebras-mark" viewBox="0 0 50 50" aria-hidden="true"><path fill-rule="evenodd" clip-rule="evenodd" d="M29.4186 5.62713C24.2806 5.62713 19.353 7.6682 15.7199 11.3013C12.0868 14.9345 10.0457 19.862 10.0457 25C10.0457 30.1381 12.0868 35.0656 15.7199 38.6988C19.353 42.3319 24.2806 44.373 29.4186 44.373V47.2917C17.1061 47.2917 7.12695 37.3105 7.12695 24.998C7.12695 12.6855 17.104 2.7063 29.4165 2.7063V5.62505L29.4186 5.62713ZM39.3186 13.2875C37.7794 11.9809 35.9971 10.9915 34.0741 10.3761C32.1512 9.76067 30.1256 9.53147 28.1137 9.70166C26.1019 9.87185 24.1435 10.4381 22.3513 11.3677C20.559 12.2974 18.9683 13.5722 17.6704 15.1189C16.3726 16.6655 15.3933 18.4534 14.7888 20.3798C14.1844 22.3062 13.9667 24.3332 14.1483 26.344C14.33 28.3548 14.9073 30.3099 15.8472 32.0968C16.787 33.8838 18.0709 35.4673 19.6249 36.7563L17.7478 38.9938C15.9126 37.4545 14.3987 35.5687 13.2924 33.4442C12.1862 31.3197 11.5092 28.9981 11.3003 26.6119C11.0914 24.2258 11.3545 21.8219 12.0747 19.5374C12.7949 17.253 13.9581 15.1328 15.4978 13.298C17.0373 11.4628 18.9233 9.94877 21.0479 8.84247C23.1726 7.73618 25.4944 7.05923 27.8807 6.8503C30.267 6.64136 32.6711 6.90453 34.9557 7.62477C37.2403 8.34501 39.3607 9.50822 41.1957 11.048L39.3186 13.2875ZM34.6207 15.0459C31.9818 13.6829 28.9113 13.4172 26.0776 14.3068C23.2438 15.1964 20.876 17.1691 19.4895 19.7958C18.1029 22.4224 17.8099 25.4903 18.6741 28.332C19.5384 31.1736 21.4899 33.5589 24.104 34.9688L22.7374 37.5521C19.4721 35.7617 17.0418 32.7592 15.9707 29.1927C14.8996 25.6261 15.2737 21.7815 17.0123 18.4883C18.7509 15.1952 21.7146 12.7176 25.2637 11.5903C28.8129 10.463 32.663 10.7763 35.9832 12.4625L34.6207 15.0459ZM29.4165 17.7896C27.5042 17.7896 25.6702 18.5493 24.318 19.9015C22.9658 21.2537 22.2061 23.0877 22.2061 25C22.2061 26.9124 22.9658 28.7464 24.318 30.0986C25.6702 31.4508 27.5042 32.2105 29.4165 32.2105V35.1313C26.7296 35.1313 24.1526 34.0639 22.2527 32.1639C20.3527 30.2639 19.2853 27.687 19.2853 25C19.2853 22.3131 20.3527 19.7362 22.2527 17.8362C24.1526 15.9362 26.7296 14.8688 29.4165 14.8688V17.7896Z" fill="#F15A29"/><path d="M32.0981 22.5749C31.7875 22.2404 31.4295 21.9534 31.0356 21.7228C30.6925 21.519 30.3014 21.4097 29.9023 21.4062C29.371 21.4062 28.896 21.5041 28.4773 21.6978C28.0725 21.8802 27.7089 22.1425 27.4081 22.469C27.1074 22.7955 26.8758 23.1795 26.7273 23.5978C26.5731 24.0207 26.4981 24.4645 26.4981 24.9124C26.4981 25.3666 26.5731 25.8082 26.7273 26.227C26.877 26.6449 27.1091 27.0286 27.4096 27.3553C27.7102 27.682 28.0733 27.9451 28.4773 28.1291C28.8939 28.3228 29.3731 28.4207 29.9023 28.4207C30.3523 28.4207 30.771 28.3249 31.1564 28.1395C31.5481 27.952 31.8856 27.6707 32.146 27.3228L34.0794 29.4187C33.7877 29.7103 33.4544 29.9624 33.0752 30.1749C32.374 30.566 31.6108 30.8338 30.8189 30.9666C30.4648 31.0207 30.1585 31.0499 29.9023 31.0499C29.0617 31.0552 28.2271 30.9069 27.4398 30.6124C26.6954 30.3371 26.0144 29.914 25.4377 29.3687C24.8643 28.8208 24.4078 28.1624 24.096 27.4332C23.7572 26.6366 23.5883 25.778 23.6002 24.9124C23.6002 23.9874 23.7669 23.1478 24.096 22.3916C24.4085 21.6624 24.8627 21.0041 25.4356 20.4562C26.0148 19.9124 26.696 19.4895 27.4398 19.2145C28.2271 18.92 29.0617 18.7717 29.9023 18.777C30.6419 18.777 31.3856 18.9187 32.1356 19.202C32.8877 19.4895 33.5627 19.952 34.1023 20.5541L32.0981 22.5749Z" fill="#fff"/></svg>Cerebras</a>
+              </span>
+              <span class="ident-row">
+                <span class="ident-label">Built by</span>
+                <a class="hf-credit" href="https://huggingface.co" target="_blank" rel="noopener"><svg class="hf-mark" viewBox="0 0 24 24" fill="currentColor" aria-hidden="true"><path d="M12.025 1.13c-5.77 0-10.449 4.647-10.449 10.378 0 1.112.178 2.181.503 3.185.064-.222.203-.444.416-.577a.96.96 0 0 1 .524-.15c.293 0 .584.124.84.284.278.173.48.408.71.694.226.282.458.611.684.951v-.014c.017-.324.106-.622.264-.874s.403-.487.762-.543c.3-.047.596.06.787.203s.31.313.4.467c.15.257.212.468.233.542.01.026.653 1.552 1.657 2.54.616.605 1.01 1.223 1.082 1.912.055.537-.096 1.059-.38 1.572.637.121 1.294.187 1.967.187.657 0 1.298-.063 1.921-.178-.287-.517-.44-1.041-.384-1.581.07-.69.465-1.307 1.081-1.913 1.004-.987 1.647-2.513 1.657-2.539.021-.074.083-.285.233-.542.09-.154.208-.323.4-.467a1.08 1.08 0 0 1 .787-.203c.359.056.604.29.762.543s.247.55.265.874v.015c.225-.34.457-.67.683-.952.23-.286.432-.52.71-.694.257-.16.547-.284.84-.285a.97.97 0 0 1 .524.151c.228.143.373.388.43.625l.006.04a10.3 10.3 0 0 0 .534-3.273c0-5.731-4.678-10.378-10.449-10.378M8.327 6.583a1.5 1.5 0 0 1 .713.174 1.487 1.487 0 0 1 .617 2.013c-.183.343-.762-.214-1.102-.094-.38.134-.532.914-.917.71a1.487 1.487 0 0 1 .69-2.803m7.486 0a1.487 1.487 0 0 1 .689 2.803c-.385.204-.536-.576-.916-.71-.34-.12-.92.437-1.103.094a1.487 1.487 0 0 1 .617-2.013 1.5 1.5 0 0 1 .713-.174m-10.68 1.55a.96.96 0 1 1 0 1.921.96.96 0 0 1 0-1.92m13.838 0a.96.96 0 1 1 0 1.92.96.96 0 0 1 0-1.92M8.489 11.458c.588.01 1.965 1.157 3.572 1.164 1.607-.007 2.984-1.155 3.572-1.164.196-.003.305.12.305.454 0 .886-.424 2.328-1.563 3.202-.22-.756-1.396-1.366-1.63-1.32q-.011.001-.02.006l-.044.026-.01.008-.03.024q-.018.017-.035.036l-.032.04a1 1 0 0 0-.058.09l-.014.025q-.049.088-.11.19a1 1 0 0 1-.083.116 1.2 1.2 0 0 1-.173.18q-.035.029-.075.058a1.3 1.3 0 0 1-.251-.243 1 1 0 0 1-.076-.107c-.124-.193-.177-.363-.337-.444-.034-.016-.104-.008-.2.022q-.094.03-.216.087-.06.028-.125.063l-.13.074q-.067.04-.136.086a3 3 0 0 0-.135.096 3 3 0 0 0-.26.219 2 2 0 0 0-.12.121 2 2 0 0 0-.106.128l-.002.002a2 2 0 0 0-.09.132l-.001.001a1.2 1.2 0 0 0-.105.212q-.013.036-.024.073c-1.139-.875-1.563-2.317-1.563-3.203 0-.334.109-.457.305-.454m.836 10.354c.824-1.19.766-2.082-.365-3.194-1.13-1.112-1.789-2.738-1.789-2.738s-.246-.945-.806-.858-.97 1.499.202 2.362c1.173.864-.233 1.45-.685.64-.45-.812-1.683-2.896-2.322-3.295s-1.089-.175-.938.647 2.822 2.813 2.562 3.244-1.176-.506-1.176-.506-2.866-2.567-3.49-1.898.473 1.23 2.037 2.16c1.564.932 1.686 1.178 1.464 1.53s-3.675-2.511-4-1.297c-.323 1.214 3.524 1.567 3.287 2.405-.238.839-2.71-1.587-3.216-.642-.506.946 3.49 2.056 3.522 2.064 1.29.33 4.568 1.028 5.713-.624m5.349 0c-.824-1.19-.766-2.082.365-3.194 1.13-1.112 1.789-2.738 1.789-2.738s.246-.945.806-.858.97 1.499-.202 2.362c-1.173.864.233 1.45.685.64.451-.812 1.683-2.896 2.322-3.295s1.089-.175.938.647-2.822 2.813-2.562 3.244 1.176-.506 1.176-.506 2.866-2.567 3.49-1.898-.473 1.23-2.037 2.16c-1.564.932-1.686 1.178-1.464 1.53s3.675-2.511 4-1.297c.323 1.214-3.524 1.567-3.287 2.405.238.839 2.71-1.587 3.216-.642.506.946-3.49 2.056-3.522 2.064-1.29.33-4.568 1.028-5.713-.624"/></svg>Hugging Face</a>
+                <span class="sep" aria-hidden="true">·</span>
+                <a class="handle" href="https://huggingface.co/tfrere" target="_blank" rel="noopener">tfrere</a>
+                <span class="sep" aria-hidden="true">·</span>
+                <a class="handle" href="https://huggingface.co/A-Mahla" target="_blank" rel="noopener">A-Mahla</a>
+                <span class="sep" aria-hidden="true">·</span>
+                <a class="handle" href="https://huggingface.co/andito" target="_blank" rel="noopener">andito</a>
+              </span>
+            </div>
+          </div>
+        </div>
+        <div class="topbar-right">
+          <!-- HF login chip / sign-in pill. Populated by ui/account.js; only
+               shown when the deploy runs behind a load balancer with OAuth. -->
+          <div id="account" class="account" hidden></div>
+          <button id="about-btn-m" class="icon-btn about-btn-mobile" title="About this space" aria-label="About this space">
+            <svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><line x1="12" y1="16" x2="12" y2="12"/><line x1="12" y1="8" x2="12.01" y2="8"/></svg>
+          </button>
+          <button id="tools-btn" class="icon-btn" title="Tools" aria-label="Tools">
+            <svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M14.7 6.3a1 1 0 0 0 0 1.4l1.6 1.6a1 1 0 0 0 1.4 0l3.77-3.77a6 6 0 0 1-7.94 7.94l-6.91 6.91a2.12 2.12 0 0 1-3-3l6.91-6.91a6 6 0 0 1 7.94-7.94l-3.76 3.76z"/></svg>
+          </button>
+          <button id="chat-btn" class="icon-btn" title="Conversation history" aria-label="Conversation history">
+            <svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 15a2 2 0 0 1-2 2H7l-4 4V5a2 2 0 0 1 2-2h14a2 2 0 0 1 2 2z"/></svg>
+            <span id="chat-badge" class="chat-badge" aria-hidden="true"></span>
+          </button>
+          <button id="settings-btn" class="icon-btn" title="Settings" aria-label="Settings">
+            <svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="3"/><path d="M19.4 15a1.65 1.65 0 0 0 .33 1.82l.06.06a2 2 0 1 1-2.83 2.83l-.06-.06a1.65 1.65 0 0 0-1.82-.33 1.65 1.65 0 0 0-1 1.51V21a2 2 0 1 1-4 0v-.09A1.65 1.65 0 0 0 9 19.4a1.65 1.65 0 0 0-1.82.33l-.06.06a2 2 0 1 1-2.83-2.83l.06-.06a1.65 1.65 0 0 0 .33-1.82 1.65 1.65 0 0 0-1.51-1H3a2 2 0 1 1 0-4h.09A1.65 1.65 0 0 0 4.6 9a1.65 1.65 0 0 0-.33-1.82l-.06-.06a2 2 0 1 1 2.83-2.83l.06.06a1.65 1.65 0 0 0 1.82.33H9a1.65 1.65 0 0 0 1-1.51V3a2 2 0 1 1 4 0v.09a1.65 1.65 0 0 0 1 1.51 1.65 1.65 0 0 0 1.82-.33l.06-.06a2 2 0 1 1 2.83 2.83l-.06.06a1.65 1.65 0 0 0-.33 1.82V9c0 .66.39 1.25 1 1.51H21a2 2 0 1 1 0 4h-.09a1.65 1.65 0 0 0-1.51 1z"/></svg>
+          </button>
+        </div>
+      </header>
+
+      <main class="stage">
+        <div class="orb-wrap">
+          <div id="mic-gate" class="mic-gate">
+            <svg id="mic-gate-arc" class="mic-gate-arc" viewBox="0 0 100 100" aria-hidden="true">
+              <path id="mga-track" class="mga-track" fill="none" />
+              <path id="mga-fill" class="mga-fill" fill="none" />
+              <path id="mga-hit" class="mga-hit" fill="none" />
+              <circle id="mga-handle" class="mga-handle" r="3" />
+            </svg>
+            <button id="mic-btn" class="side-btn" type="button" aria-label="Mute" title="Mute" aria-hidden="true">
+              <svg class="mic-on" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round"><rect x="9" y="2" width="6" height="12" rx="3"/><path d="M5 10a7 7 0 0 0 14 0"/><line x1="12" y1="19" x2="12" y2="22"/></svg>
+              <svg class="mic-off" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round"><line x1="2" y1="2" x2="22" y2="22"/><path d="M9 5a3 3 0 0 1 6 0v4"/><path d="M9 10v1a3 3 0 0 0 5.1 2.1"/><path d="M19 10a7 7 0 0 1-1.24 3.97"/><path d="M5 10a7 7 0 0 0 11 5.67"/><line x1="12" y1="19" x2="12" y2="22"/></svg>
+            </button>
+          </div>
+
+          <button
+            id="main-circle"
+            class="circle state-idle"
+            type="button"
+            aria-label="Start voice conversation"
+          >
+            <span class="circle-glow" aria-hidden="true"></span>
+            <span class="circle-ring" aria-hidden="true"></span>
+            <span class="circle-ring-outer" aria-hidden="true"></span>
+            <span class="circle-core">
+              <span class="circle-indicator" aria-hidden="true">
+                <svg class="ind ind-mic" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">
+                  <rect x="9" y="2" width="6" height="12" rx="3" fill="currentColor" stroke="none"/>
+                  <path d="M5 10a7 7 0 0 0 14 0"/>
+                  <line x1="12" y1="19" x2="12" y2="22"/>
+                  <line x1="8" y1="22" x2="16" y2="22"/>
+                </svg>
+                <svg class="ind ind-error" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="9"/><line x1="12" y1="8" x2="12" y2="13"/><line x1="12" y1="16" x2="12" y2="16"/></svg>
+                <span class="ind ind-spinner"></span>
+                <span class="ind ind-thinking">
+                  <span class="dot"></span>
+                  <span class="dot"></span>
+                  <span class="dot"></span>
+                </span>
+                <span class="ind ind-bars">
+                  <span class="bar"></span>
+                  <span class="bar"></span>
+                  <span class="bar"></span>
+                  <span class="bar"></span>
+                  <span class="bar"></span>
+                </span>
+                <svg class="ind ind-voice" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">
+                  <path d="M3 10v4a1 1 0 0 0 1 1h3l5 4V5L7 9H4a1 1 0 0 0-1 1z" fill="currentColor" stroke="none"/>
+                  <path class="wave wave-1" d="M16 8a5 5 0 0 1 0 8"/>
+                  <path class="wave wave-2" d="M19 5a9 9 0 0 1 0 14"/>
+                </svg>
+              </span>
+            </span>
+          </button>
+
+          <button id="stop-btn" class="side-btn" type="button" aria-label="End" title="End" aria-hidden="true">
+            <svg viewBox="0 0 24 24" fill="currentColor"><rect x="6" y="6" width="12" height="12" rx="2"/></svg>
+          </button>
+        </div>
+
+        <p id="circle-caption" class="circle-caption" role="status">Tap to start</p>
+      </main>
+
+      <footer class="footer">
+        <span>
+          Powered by
+          <a href="https://github.com/huggingface/speech-to-speech" target="_blank" rel="noopener">huggingface/speech-to-speech</a>
+        </span>
+      </footer>
+    </div>
+
+    <!-- Ephemeral chat bubbles anchored to the top-right -->
+    <div id="bubble-stack" class="bubble-stack" aria-live="polite" aria-atomic="false"></div>
+
+    <!-- Webcam self-view, shown bottom-left while the camera tool is enabled -->
+    <div id="cam-pip" class="cam-pip" aria-hidden="true">
+      <video id="cam-video" class="cam-video" autoplay playsinline muted></video>
+      <span class="cam-flash" aria-hidden="true"></span>
+      <span class="cam-label">camera</span>
+    </div>
+
+    <!-- Conversation history panel (overlay) -->
+    <div id="chat-panel" class="chat-panel">
+      <div id="chat-panel-backdrop" class="chat-panel-backdrop"></div>
+      <div class="chat-panel-inner">
+        <header class="chat-panel-header">
+          <h3>Conversation</h3>
+          <button id="chat-panel-close" class="icon-btn" aria-label="Close">
+            <svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="6" x2="6" y2="18"/><line x1="6" y1="6" x2="18" y2="18"/></svg>
+          </button>
+        </header>
+        <div id="chat-history" class="chat-history"></div>
+      </div>
+    </div>
+
+    <dialog id="about-modal" class="modal about-modal">
+      <div class="modal-content">
+        <header class="modal-header">
+          <h2>About</h2>
+          <button id="about-close" class="icon-btn" aria-label="Close">
+            <svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="6" x2="6" y2="18"/><line x1="6" y1="6" x2="18" y2="18"/></svg>
+          </button>
+        </header>
+
+        <!-- General intro to the speech-to-speech project -->
+        <div class="about-intro">
+          <p>Speech-to-speech is Hugging Face's open framework for real-time voice agents. Rather than one end-to-end model, it chains four open models from the Hub (speech detection, transcription, a vision-language model, and synthesis), so any stage can be swapped or run locally. This demo wires that pipeline to hosted inference.</p>
+          <a class="about-repo" href="https://github.com/huggingface/speech-to-speech" target="_blank" rel="noopener">View the project on GitHub<svg class="ext" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M7 17 17 7"/><path d="M8 7h9v9"/></svg></a>
+        </div>
+
+        <!-- The backend, shown as the path a turn actually travels -->
+        <div class="about-pipeline">
+          <p class="pipeline-title">The pipeline</p>
+          <ol class="pipeline">
+            <li class="pipe-endpoint">You speak</li>
+            <li class="pipe-stage">
+              <span class="pipe-tag">VAD</span>
+              <span class="pipe-job">detects speech</span>
+              <a class="pipe-model" href="https://github.com/snakers4/silero-vad" target="_blank" rel="noopener">silero-vad<svg class="ext" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M7 17 17 7"/><path d="M8 7h9v9"/></svg></a>
+            </li>
+            <li class="pipe-stage">
+              <span class="pipe-tag">STT</span>
+              <span class="pipe-job">transcribes it</span>
+              <a class="pipe-model" href="https://huggingface.co/nvidia/parakeet-tdt-1.1b" target="_blank" rel="noopener">nvidia/parakeet-tdt-1.1b<svg class="ext" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M7 17 17 7"/><path d="M8 7h9v9"/></svg></a>
+            </li>
+            <li class="pipe-stage">
+              <span class="pipe-tag">VLM</span>
+              <span class="pipe-job">analyses and composes the reply <span class="pipe-note">· via <a class="cerebras-credit" href="https://cerebras.ai" target="_blank" rel="noopener"><svg class="cerebras-mark" viewBox="0 0 50 50" aria-hidden="true"><path fill-rule="evenodd" clip-rule="evenodd" d="M29.4186 5.62713C24.2806 5.62713 19.353 7.6682 15.7199 11.3013C12.0868 14.9345 10.0457 19.862 10.0457 25C10.0457 30.1381 12.0868 35.0656 15.7199 38.6988C19.353 42.3319 24.2806 44.373 29.4186 44.373V47.2917C17.1061 47.2917 7.12695 37.3105 7.12695 24.998C7.12695 12.6855 17.104 2.7063 29.4165 2.7063V5.62505L29.4186 5.62713ZM39.3186 13.2875C37.7794 11.9809 35.9971 10.9915 34.0741 10.3761C32.1512 9.76067 30.1256 9.53147 28.1137 9.70166C26.1019 9.87185 24.1435 10.4381 22.3513 11.3677C20.559 12.2974 18.9683 13.5722 17.6704 15.1189C16.3726 16.6655 15.3933 18.4534 14.7888 20.3798C14.1844 22.3062 13.9667 24.3332 14.1483 26.344C14.33 28.3548 14.9073 30.3099 15.8472 32.0968C16.787 33.8838 18.0709 35.4673 19.6249 36.7563L17.7478 38.9938C15.9126 37.4545 14.3987 35.5687 13.2924 33.4442C12.1862 31.3197 11.5092 28.9981 11.3003 26.6119C11.0914 24.2258 11.3545 21.8219 12.0747 19.5374C12.7949 17.253 13.9581 15.1328 15.4978 13.298C17.0373 11.4628 18.9233 9.94877 21.0479 8.84247C23.1726 7.73618 25.4944 7.05923 27.8807 6.8503C30.267 6.64136 32.6711 6.90453 34.9557 7.62477C37.2403 8.34501 39.3607 9.50822 41.1957 11.048L39.3186 13.2875ZM34.6207 15.0459C31.9818 13.6829 28.9113 13.4172 26.0776 14.3068C23.2438 15.1964 20.876 17.1691 19.4895 19.7958C18.1029 22.4224 17.8099 25.4903 18.6741 28.332C19.5384 31.1736 21.4899 33.5589 24.104 34.9688L22.7374 37.5521C19.4721 35.7617 17.0418 32.7592 15.9707 29.1927C14.8996 25.6261 15.2737 21.7815 17.0123 18.4883C18.7509 15.1952 21.7146 12.7176 25.2637 11.5903C28.8129 10.463 32.663 10.7763 35.9832 12.4625L34.6207 15.0459ZM29.4165 17.7896C27.5042 17.7896 25.6702 18.5493 24.318 19.9015C22.9658 21.2537 22.2061 23.0877 22.2061 25C22.2061 26.9124 22.9658 28.7464 24.318 30.0986C25.6702 31.4508 27.5042 32.2105 29.4165 32.2105V35.1313C26.7296 35.1313 24.1526 34.0639 22.2527 32.1639C20.3527 30.2639 19.2853 27.687 19.2853 25C19.2853 22.3131 20.3527 19.7362 22.2527 17.8362C24.1526 15.9362 26.7296 14.8688 29.4165 14.8688V17.7896Z" fill="#F15A29"/><path d="M32.0981 22.5749C31.7875 22.2404 31.4295 21.9534 31.0356 21.7228C30.6925 21.519 30.3014 21.4097 29.9023 21.4062C29.371 21.4062 28.896 21.5041 28.4773 21.6978C28.0725 21.8802 27.7089 22.1425 27.4081 22.469C27.1074 22.7955 26.8758 23.1795 26.7273 23.5978C26.5731 24.0207 26.4981 24.4645 26.4981 24.9124C26.4981 25.3666 26.5731 25.8082 26.7273 26.227C26.877 26.6449 27.1091 27.0286 27.4096 27.3553C27.7102 27.682 28.0733 27.9451 28.4773 28.1291C28.8939 28.3228 29.3731 28.4207 29.9023 28.4207C30.3523 28.4207 30.771 28.3249 31.1564 28.1395C31.5481 27.952 31.8856 27.6707 32.146 27.3228L34.0794 29.4187C33.7877 29.7103 33.4544 29.9624 33.0752 30.1749C32.374 30.566 31.6108 30.8338 30.8189 30.9666C30.4648 31.0207 30.1585 31.0499 29.9023 31.0499C29.0617 31.0552 28.2271 30.9069 27.4398 30.6124C26.6954 30.3371 26.0144 29.914 25.4377 29.3687C24.8643 28.8208 24.4078 28.1624 24.096 27.4332C23.7572 26.6366 23.5883 25.778 23.6002 24.9124C23.6002 23.9874 23.7669 23.1478 24.096 22.3916C24.4085 21.6624 24.8627 21.0041 25.4356 20.4562C26.0148 19.9124 26.696 19.4895 27.4398 19.2145C28.2271 18.92 29.0617 18.7717 29.9023 18.777C30.6419 18.777 31.3856 18.9187 32.1356 19.202C32.8877 19.4895 33.5627 19.952 34.1023 20.5541L32.0981 22.5749Z" fill="#fff"/></svg>Cerebras</a></span></span>
+              <a class="pipe-model" href="https://huggingface.co/google/gemma-4-31B-it" target="_blank" rel="noopener">google/gemma-4-31B-it<svg class="ext" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M7 17 17 7"/><path d="M8 7h9v9"/></svg></a>
+            </li>
+            <li class="pipe-stage">
+              <span class="pipe-tag">TTS</span>
+              <span class="pipe-job">speaks it back</span>
+              <a class="pipe-model" href="https://huggingface.co/Qwen/Qwen3-TTS-12Hz-1.7B-CustomVoice" target="_blank" rel="noopener">Qwen/Qwen3-TTS-12Hz-1.7B-CustomVoice<svg class="ext" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M7 17 17 7"/><path d="M8 7h9v9"/></svg></a>
+            </li>
+            <li class="pipe-endpoint">The orb replies</li>
+          </ol>
+        </div>
+      </div>
+    </dialog>
+
+    <dialog id="settings-modal" class="modal">
+      <form method="dialog" class="modal-content">
+        <header class="modal-header">
+          <h2>Settings</h2>
+          <button class="icon-btn" value="close" aria-label="Close">
+            <svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="6" x2="6" y2="18"/><line x1="6" y1="6" x2="18" y2="18"/></svg>
+          </button>
+        </header>
+
+        <div class="tab-panels">
+          <section class="tab-panel active" role="tabpanel">
+            <label class="field" id="conn-field">
+              <span id="conn-label">Speech-to-speech server URL</span>
+              <input id="lb-url" type="text" autocomplete="off" spellcheck="false" placeholder="http://localhost:port" />
+              <small id="conn-hint">
+                URL of your speech-to-speech server, e.g.
+                <code>http://localhost:8080</code> (the app adds <code>/v1/realtime</code>).
+              </small>
+            </label>
+
+            <div class="field-row">
+              <label class="field">
+                <span>Voice</span>
+                <select id="voice">
+                  <option value="Aiden" selected>Aiden</option>
+                  <option value="Ryan">Ryan</option>
+                  <option value="Dylan">Dylan</option>
+                  <option value="Eric">Eric</option>
+                  <option value="Ono_Anna">Ono_Anna</option>
+                  <option value="Serena">Serena</option>
+                  <option value="Sohee">Sohee</option>
+                  <option value="Uncle_Fu">Uncle_Fu</option>
+                  <option value="Vivian">Vivian</option>
+                </select>
+              </label>
+            </div>
+
+            <div class="field">
+              <span class="field-head">
+                Noise gate
+                <span id="gate-value" class="field-value">Off</span>
+              </span>
+              <div class="gate">
+                <div class="gate-track" aria-hidden="true">
+                  <div id="gate-meter-fill" class="gate-meter-fill"></div>
+                  <input
+                    id="noise-gate"
+                    type="range"
+                    min="-66"
+                    max="-3"
+                    step="1"
+                    value="-50"
+                    aria-label="Noise gate threshold"
+                  />
+                </div>
+                <div class="gate-ends">
+                  <span>Off</span>
+                  <span>−3 dB</span>
+                </div>
+              </div>
+              <small>
+                Mutes the mic below the handle so room noise isn't sent. Slide fully
+                left to turn it off; the bar shows your live input while in a call.
+              </small>
+            </div>
+
+            <label class="field">
+              <span>Instructions</span>
+              <textarea id="instructions" rows="5" placeholder="You are a friendly voice assistant..."></textarea>
+            </label>
+
+            <div class="field">
+              <button id="restart-conversation" type="button" class="btn primary wide" disabled>
+                Restart conversation with these settings
+              </button>
+              <small id="restart-hint">Connect first, then come back here to apply live changes.</small>
+            </div>
+          </section>
+        </div>
+
+        <footer class="modal-footer">
+          <button id="settings-save" type="submit" class="btn primary" value="save">Save</button>
+        </footer>
+      </form>
+    </dialog>
+
+    <dialog id="tools-modal" class="modal">
+      <div class="modal-content">
+        <header class="modal-header">
+          <h2>Tools</h2>
+          <button id="tools-close" class="icon-btn" aria-label="Close">
+            <svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="6" x2="6" y2="18"/><line x1="6" y1="6" x2="18" y2="18"/></svg>
+          </button>
+        </header>
+
+        <p class="tools-intro">Let the assistant act during the conversation. Changes apply live.</p>
+
+        <div class="tool-list">
+          <div class="tool-row" id="tool-web-row">
+            <div class="tool-info">
+              <span class="tool-name">Web search</span>
+              <span class="tool-desc">Look things up on Google, via Serper.</span>
+            </div>
+            <label class="switch">
+              <input id="tool-web" type="checkbox" />
+              <span class="switch-track" aria-hidden="true"></span>
+            </label>
+          </div>
+          <label class="field tools-key">
+            <span>Search API key</span>
+            <input id="search-key" type="password" autocomplete="off" spellcheck="false" />
+            <small id="tool-web-hint"></small>
+          </label>
+
+          <div class="tool-row tool-row-sep" id="tool-cam-row">
+            <div class="tool-info">
+              <span class="tool-name">Camera</span>
+              <span class="tool-desc">Let the assistant see through your webcam.</span>
+            </div>
+            <label class="switch">
+              <input id="tool-cam" type="checkbox" />
+              <span class="switch-track" aria-hidden="true"></span>
+            </label>
+          </div>
+          <small id="tool-cam-hint" class="tool-hint">A live preview shows bottom-left while the camera is on.</small>
+        </div>
+      </div>
+    </dialog>
+
+    <!-- Shown when the per-day conversation budget is spent (mid-call or at
+         start). Title / message / CTA / note are filled per tier by
+         ui/account.js. The hero is the HF mark — a friendly smiling face. -->
+    <dialog id="limit-modal" class="modal limit-modal">
+      <div class="modal-content limit-card">
+        <button id="limit-close" class="icon-btn limit-close" aria-label="Close">
+          <svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><line x1="18" y1="6" x2="6" y2="18"/><line x1="6" y1="6" x2="18" y2="18"/></svg>
+        </button>
+        <div class="limit-badge" aria-hidden="true">
+          <svg class="hf-logo" viewBox="0 0 95 88" fill="none" aria-hidden="true"><path fill="#FFD21E" d="M47.21 76.5a34.75 34.75 0 1 0 0-69.5 34.75 34.75 0 0 0 0 69.5Z"/><path fill="#FF9D0B" d="M81.96 41.75a34.75 34.75 0 1 0-69.5 0 34.75 34.75 0 0 0 69.5 0Zm-73.5 0a38.75 38.75 0 1 1 77.5 0 38.75 38.75 0 0 1-77.5 0Z"/><path fill="#3A3B45" d="M58.5 32.3c1.28.44 1.78 3.06 3.07 2.38a5 5 0 1 0-6.76-2.07c.61 1.15 2.55-.72 3.7-.32ZM34.95 32.3c-1.28.44-1.79 3.06-3.07 2.38a5 5 0 1 1 6.76-2.07c-.61 1.15-2.56-.72-3.7-.32Z"/><path fill="#FF323D" d="M46.96 56.29c9.83 0 13-8.76 13-13.26 0-2.34-1.57-1.6-4.09-.36-2.33 1.15-5.46 2.74-8.9 2.74-7.19 0-13-6.88-13-2.38s3.16 13.26 13 13.26Z"/><path fill="#3A3B45" fill-rule="evenodd" d="M39.43 54a8.7 8.7 0 0 1 5.3-4.49c.4-.12.81.57 1.24 1.28.4.68.82 1.37 1.24 1.37.45 0 .9-.68 1.33-1.35.45-.7.89-1.38 1.32-1.25a8.61 8.61 0 0 1 5 4.17c3.73-2.94 5.1-7.74 5.1-10.7 0-2.34-1.57-1.6-4.09-.36l-.14.07c-2.31 1.15-5.39 2.67-8.77 2.67s-6.45-1.52-8.77-2.67c-2.6-1.29-4.23-2.1-4.23.29 0 3.05 1.46 8.06 5.47 10.97Z" clip-rule="evenodd"/><path fill="#FF9D0B" d="M70.71 37a3.25 3.25 0 1 0 0-6.5 3.25 3.25 0 0 0 0 6.5ZM24.21 37a3.25 3.25 0 1 0 0-6.5 3.25 3.25 0 0 0 0 6.5ZM17.52 48c-1.62 0-3.06.66-4.07 1.87a5.97 5.97 0 0 0-1.33 3.76 7.1 7.1 0 0 0-1.94-.3c-1.55 0-2.95.59-3.94 1.66a5.8 5.8 0 0 0-.8 7 5.3 5.3 0 0 0-1.79 2.82c-.24.9-.48 2.8.8 4.74a5.22 5.22 0 0 0-.37 5.02c1.02 2.32 3.57 4.14 8.52 6.1 3.07 1.22 5.89 2 5.91 2.01a44.33 44.33 0 0 0 10.93 1.6c5.86 0 10.05-1.8 12.46-5.34 3.88-5.69 3.33-10.9-1.7-15.92-2.77-2.78-4.62-6.87-5-7.77-.78-2.66-2.84-5.62-6.25-5.62a5.7 5.7 0 0 0-4.6 2.46c-1-1.26-1.98-2.25-2.86-2.82A7.4 7.4 0 0 0 17.52 48Zm0 4c.51 0 1.14.22 1.82.65 2.14 1.36 6.25 8.43 7.76 11.18.5.92 1.37 1.31 2.14 1.31 1.55 0 2.75-1.53.15-3.48-3.92-2.93-2.55-7.72-.68-8.01.08-.02.17-.02.24-.02 1.7 0 2.45 2.93 2.45 2.93s2.2 5.52 5.98 9.3c3.77 3.77 3.97 6.8 1.22 10.83-1.88 2.75-5.47 3.58-9.16 3.58-3.81 0-7.73-.9-9.92-1.46-.11-.03-13.45-3.8-11.76-7 .28-.54.75-.76 1.34-.76 2.38 0 6.7 3.54 8.57 3.54.41 0 .7-.17.83-.6.79-2.85-12.06-4.05-10.98-8.17.2-.73.71-1.02 1.44-1.02 3.14 0 10.2 5.53 11.68 5.53.11 0 .2-.03.24-.1.74-1.2.33-2.04-4.9-5.2-5.21-3.16-8.88-5.06-6.8-7.33.24-.26.58-.38 1-.38 3.17 0 10.66 6.82 10.66 6.82s2.02 2.1 3.25 2.1c.28 0 .52-.1.68-.38.86-1.46-8.06-8.22-8.56-11.01-.34-1.9.24-2.85 1.31-2.85Z"/><path fill="#FFD21E" d="M38.6 76.69c2.75-4.04 2.55-7.07-1.22-10.84-3.78-3.77-5.98-9.3-5.98-9.3s-.82-3.2-2.69-2.9c-1.87.3-3.24 5.08.68 8.01 3.91 2.93-.78 4.92-2.29 2.17-1.5-2.75-5.62-9.82-7.76-11.18-2.13-1.35-3.63-.6-3.13 2.2.5 2.79 9.43 9.55 8.56 11-.87 1.47-3.93-1.71-3.93-1.71s-9.57-8.71-11.66-6.44c-2.08 2.27 1.59 4.17 6.8 7.33 5.23 3.16 5.64 4 4.9 5.2-.75 1.2-12.28-8.53-13.36-4.4-1.08 4.11 11.77 5.3 10.98 8.15-.8 2.85-9.06-5.38-10.74-2.18-1.7 3.21 11.65 6.98 11.76 7.01 4.3 1.12 15.25 3.49 19.08-2.12Z"/><path fill="#FF9D0B" d="M77.4 48c1.62 0 3.07.66 4.07 1.87a5.97 5.97 0 0 1 1.33 3.76 7.1 7.1 0 0 1 1.95-.3c1.55 0 2.95.59 3.94 1.66a5.8 5.8 0 0 1 .8 7 5.3 5.3 0 0 1 1.78 2.82c.24.9.48 2.8-.8 4.74a5.22 5.22 0 0 1 .37 5.02c-1.02 2.32-3.57 4.14-8.51 6.1-3.08 1.22-5.9 2-5.92 2.01a44.33 44.33 0 0 1-10.93 1.6c-5.86 0-10.05-1.8-12.46-5.34-3.88-5.69-3.33-10.9 1.7-15.92 2.78-2.78 4.63-6.87 5.01-7.77.78-2.66 2.83-5.62 6.24-5.62a5.7 5.7 0 0 1 4.6 2.46c1-1.26 1.98-2.25 2.87-2.82A7.4 7.4 0 0 1 77.4 48Zm0 4c-.51 0-1.13.22-1.82.65-2.13 1.36-6.25 8.43-7.76 11.18a2.43 2.43 0 0 1-2.14 1.31c-1.54 0-2.75-1.53-.14-3.48 3.91-2.93 2.54-7.72.67-8.01a1.54 1.54 0 0 0-.24-.02c-1.7 0-2.45 2.93-2.45 2.93s-2.2 5.52-5.97 9.3c-3.78 3.77-3.98 6.8-1.22 10.83 1.87 2.75 5.47 3.58 9.15 3.58 3.82 0 7.73-.9 9.93-1.46.1-.03 13.45-3.8 11.76-7-.29-.54-.75-.76-1.34-.76-2.38 0-6.71 3.54-8.57 3.54-.42 0-.71-.17-.83-.6-.8-2.85 12.05-4.05 10.97-8.17-.19-.73-.7-1.02-1.44-1.02-3.14 0-10.2 5.53-11.68 5.53-.1 0-.19-.03-.23-.1-.74-1.2-.34-2.04 4.88-5.2 5.23-3.16 8.9-5.06 6.8-7.33-.23-.26-.57-.38-.98-.38-3.18 0-10.67 6.82-10.67 6.82s-2.02 2.1-3.24 2.1a.74.74 0 0 1-.68-.38c-.87-1.46 8.05-8.22 8.55-11.01.34-1.9-.24-2.85-1.31-2.85Z"/><path fill="#FFD21E" d="M56.33 76.69c-2.75-4.04-2.56-7.07 1.22-10.84 3.77-3.77 5.97-9.3 5.97-9.3s.82-3.2 2.7-2.9c1.86.3 3.23 5.08-.68 8.01-3.92 2.93.78 4.92 2.28 2.17 1.51-2.75 5.63-9.82 7.76-11.18 2.13-1.35 3.64-.6 3.13 2.2-.5 2.79-9.42 9.55-8.55 11 .86 1.47 3.92-1.71 3.92-1.71s9.58-8.71 11.66-6.44c2.08 2.27-1.58 4.17-6.8 7.33-5.23 3.16-5.63 4-4.9 5.2.75 1.2 12.28-8.53 13.36-4.4 1.08 4.11-11.76 5.3-10.97 8.15.8 2.85 9.05-5.38 10.74-2.18 1.69 3.21-11.65 6.98-11.76 7.01-4.31 1.12-15.26 3.49-19.08-2.12Z"/></svg>
+        </div>
+        <h2 id="limit-title" class="limit-title">That's a wrap for now</h2>
+        <p id="limit-msg" class="limit-msg"></p>
+        <a id="limit-cta" class="btn primary wide limit-cta" href="#"></a>
+        <p id="limit-note" class="limit-note"></p>
+      </div>
+    </dialog>
+
+    <script type="module" src="main.js"></script>
+  </body>
+</html>

limiter.py

@@ -0,0 +1,276 @@
+"""
+Per-day talk-time budget for the speech-to-speech demo.
+
+Our server isn't in the audio path (the browser dials the compute WebSocket
+directly), so it can't cut a live stream. What it *can* do is meter time with a
+server-clock, chunked reservation:
+
+  - At grant we reserve the first chunk (CHUNK_SEC) and debit it from the day's
+    budget. A parallel grant therefore sees the budget already spent.
+  - The client heartbeats; each heartbeat extends the reservation one chunk at a
+    time until the daily budget runs out, then we report `expired` so the client
+    tears down.
+  - On a clean end (sendBeacon) we reconcile to the real elapsed time and refund
+    the unused chunk. A crash (no end, no heartbeats) is reaped by a sweep and
+    forfeits at most one chunk.
+
+All time is the server's clock. Budgets are per UTC day; a new day is simply a
+new row (no explicit reset). Logged-in users are keyed by a hashed HF `sub`;
+anonymous users by BOTH a hashed IP and a hashed signed-cookie id, OR-matched
+(spent = max of the two) so clearing one identifier doesn't reset the budget.
+
+Storage is SQLite at $USAGE_DB_PATH, else /data (persistent Spaces storage),
+else a /tmp fallback. On /tmp the budget is only per-uptime — flagged in logs.
+"""
+
+import hashlib
+import hmac
+import logging
+import math
+import os
+import sqlite3
+import tempfile
+import threading
+import time
+from datetime import datetime, timezone
+from pathlib import Path
+
+logger = logging.getLogger("s2s.limiter")
+
+# ── Tunables (env-overridable) ───────────────────────────────────────────────
+ANON_SEC = int(os.environ.get("LIMIT_ANON_SEC", "300"))   # 5 min/day, not signed in
+FREE_SEC = int(os.environ.get("LIMIT_FREE_SEC", "600"))   # 10 min/day, signed in, no PRO
+CHUNK_SEC = int(os.environ.get("RESERVE_CHUNK_SEC", "10"))  # reservation granularity
+HEARTBEAT_SEC = int(os.environ.get("HEARTBEAT_SEC", "5"))   # advertised client cadence
+REAP_AFTER_SEC = int(os.environ.get("SESSION_REAP_SEC", "15"))  # silence before sweep
+
+# Stable across restarts or the hashed keys (and signed cookies) rotate and the
+# budget effectively resets. Set it as a Space secret. Falls back to a per-boot
+# random value (keys then only hold within one uptime).
+_HASH_SECRET = (os.environ.get("USAGE_HASH_SECRET", "").strip() or os.urandom(32).hex()).encode()
+
+_lock = threading.Lock()
+_db_path: "Path | None" = None
+
+
+def budget_for(tier: str) -> "int | None":
+    """Daily second-budget for a tier, or None for unlimited.
+
+    Unlimited tiers: 'pro' (paying PRO members) and 'org' (members of an
+    allow-listed organisation, see UNLIMITED_ORGS in auth.py)."""
+    if tier in ("pro", "org"):
+        return None
+    if tier == "free":
+        return FREE_SEC
+    return ANON_SEC
+
+
+def hash_key(raw: str) -> str:
+    """HMAC a raw identifier (sub / ip / cookie id) into an opaque storage key."""
+    digest = hmac.new(_HASH_SECRET, raw.encode("utf-8"), hashlib.sha256).hexdigest()
+    return f"k_{digest}"
+
+
+def sign_cookie(value: str) -> str:
+    """`<id>.<sig>` so a forged anon-cookie id is rejected on read."""
+    sig = hmac.new(_HASH_SECRET, value.encode("utf-8"), hashlib.sha256).hexdigest()[:32]
+    return f"{value}.{sig}"
+
+
+def verify_cookie(signed: str) -> "str | None":
+    """Return the id if the signature checks out, else None."""
+    if not signed or "." not in signed:
+        return None
+    value, _, sig = signed.rpartition(".")
+    want = hmac.new(_HASH_SECRET, value.encode("utf-8"), hashlib.sha256).hexdigest()[:32]
+    return value if hmac.compare_digest(sig, want) else None
+
+
+def _today() -> str:
+    return datetime.now(timezone.utc).date().isoformat()
+
+
+def _resolve_db_path() -> Path:
+    explicit = os.environ.get("USAGE_DB_PATH", "").strip()
+    if explicit:
+        return Path(explicit)
+    data = Path("/data")
+    if data.is_dir() and os.access(data, os.W_OK):
+        return data / "s2s-usage.sqlite3"
+    logger.warning("No persistent /data — usage budget falls back to /tmp (per-uptime only).")
+    return Path(tempfile.gettempdir()) / "s2s-usage.sqlite3"
+
+
+def _connect() -> sqlite3.Connection:
+    con = sqlite3.connect(_db_path, timeout=5.0)
+    con.execute("PRAGMA journal_mode=WAL")
+    con.execute("PRAGMA busy_timeout=5000")
+    return con
+
+
+def init() -> None:
+    """Create the schema. Call once at startup."""
+    global _db_path
+    _db_path = _resolve_db_path()
+    with _lock, _connect() as con:
+        con.execute(
+            """CREATE TABLE IF NOT EXISTS usage_daily (
+                   user_key   TEXT NOT NULL,
+                   day        TEXT NOT NULL,
+                   spent_sec  INTEGER NOT NULL DEFAULT 0,
+                   updated_at INTEGER NOT NULL,
+                   PRIMARY KEY (user_key, day)
+               )"""
+        )
+        con.execute(
+            """CREATE TABLE IF NOT EXISTS sessions (
+                   session_id   TEXT PRIMARY KEY,
+                   keys         TEXT NOT NULL,   -- comma-joined usage_daily keys to debit
+                   day          TEXT NOT NULL,
+                   tier         TEXT NOT NULL,
+                   grant_ts     REAL NOT NULL,
+                   last_seen_ts REAL NOT NULL,
+                   reserved_sec INTEGER NOT NULL,
+                   ended        INTEGER NOT NULL DEFAULT 0
+               )"""
+        )
+    logger.info("Usage limiter ready at %s (anon=%ss free=%ss chunk=%ss)", _db_path, ANON_SEC, FREE_SEC, CHUNK_SEC)
+
+
+# ── Internal helpers (call under _lock) ───────────────────────────────────────
+
+def _spent(con, key: str, day: str) -> int:
+    row = con.execute(
+        "SELECT spent_sec FROM usage_daily WHERE user_key=? AND day=?", (key, day)
+    ).fetchone()
+    return int(row[0]) if row else 0
+
+
+def _spent_max(con, keys, day: str) -> int:
+    """OR-match: the most-spent identifier governs."""
+    return max((_spent(con, k, day) for k in keys), default=0)
+
+
+def _add(con, keys, day: str, delta: int) -> None:
+    now = int(time.time())
+    for k in keys:
+        cur = _spent(con, k, day)
+        nxt = max(0, cur + delta)
+        con.execute(
+            """INSERT INTO usage_daily (user_key, day, spent_sec, updated_at)
+               VALUES (?, ?, ?, ?)
+               ON CONFLICT(user_key, day) DO UPDATE SET
+                   spent_sec = excluded.spent_sec, updated_at = excluded.updated_at""",
+            (k, day, nxt, now),
+        )
+
+
+# ── Public API ────────────────────────────────────────────────────────────────
+
+def remaining(keys, tier: str) -> "int | None":
+    """Seconds left today for these keys (None = unlimited). No mutation."""
+    budget = budget_for(tier)
+    if budget is None:
+        return None
+    with _lock, _connect() as con:
+        return max(0, budget - _spent_max(con, keys, _today()))
+
+
+def begin(session_id: str, keys, tier: str) -> int:
+    """Reserve the first chunk for a new session and record it. Returns the
+    chunk reserved (0 if the budget is already exhausted — the first heartbeat
+    will then expire it). PRO (unlimited) is never tracked; don't call it here."""
+    day = _today()
+    budget = budget_for(tier)
+    now = time.time()
+    with _lock, _connect() as con:
+        avail = budget - _spent_max(con, keys, day) if budget is not None else CHUNK_SEC
+        chunk = max(0, min(CHUNK_SEC, avail))
+        if chunk:
+            _add(con, keys, day, chunk)
+        con.execute(
+            """INSERT OR REPLACE INTO sessions
+               (session_id, keys, day, tier, grant_ts, last_seen_ts, reserved_sec, ended)
+               VALUES (?, ?, ?, ?, ?, ?, ?, 0)""",
+            (session_id, ",".join(keys), day, tier, now, now, chunk),
+        )
+        return chunk
+
+
+def heartbeat(session_id: str) -> bool:
+    """Keep a session alive: extend the reservation toward `elapsed + 1 chunk`,
+    debiting the budget chunk by chunk. Returns True while alive, False once the
+    budget is spent (caller should tear down) or the session is unknown/ended."""
+    now = time.time()
+    with _lock, _connect() as con:
+        row = con.execute(
+            "SELECT keys, day, tier, grant_ts, reserved_sec, ended FROM sessions WHERE session_id=?",
+            (session_id,),
+        ).fetchone()
+        if not row or row[5]:
+            return False
+        keys = row[0].split(",")
+        day, tier, grant_ts, reserved = row[1], row[2], row[3], int(row[4])
+        budget = budget_for(tier)
+        elapsed = now - grant_ts
+
+        # Grow the reservation one chunk at a time until it covers elapsed + a
+        # one-chunk lookahead, or the budget runs dry.
+        while reserved < elapsed + CHUNK_SEC:
+            if budget is not None and _spent_max(con, keys, day) >= budget:
+                break
+            _add(con, keys, day, CHUNK_SEC)
+            reserved += CHUNK_SEC
+
+        alive = reserved > elapsed  # could we cover the time already elapsed?
+        con.execute(
+            "UPDATE sessions SET last_seen_ts=?, reserved_sec=?, ended=? WHERE session_id=?",
+            (now, reserved, 0 if alive else 1, session_id),
+        )
+        if not alive:
+            _reconcile(con, keys, day, grant_ts, reserved, end_ts=now)
+        return alive
+
+
+def end(session_id: str) -> None:
+    """Clean teardown: reconcile to actual elapsed time and refund the unused
+    reservation. Idempotent."""
+    now = time.time()
+    with _lock, _connect() as con:
+        row = con.execute(
+            "SELECT keys, day, grant_ts, reserved_sec, ended FROM sessions WHERE session_id=?",
+            (session_id,),
+        ).fetchone()
+        if not row or row[4]:
+            return
+        keys, day, grant_ts, reserved = row[0].split(","), row[1], row[2], int(row[3])
+        _reconcile(con, keys, day, grant_ts, reserved, end_ts=now)
+        con.execute("UPDATE sessions SET ended=1, last_seen_ts=? WHERE session_id=?", (now, session_id))
+
+
+def sweep() -> None:
+    """Reap sessions that went silent (crash / closed without a beacon): bill
+    their elapsed time, refund the rest, mark ended. Forfeits ≤ one chunk."""
+    now = time.time()
+    cutoff = now - REAP_AFTER_SEC
+    with _lock, _connect() as con:
+        stale = con.execute(
+            "SELECT session_id, keys, day, grant_ts, last_seen_ts, reserved_sec FROM sessions "
+            "WHERE ended=0 AND last_seen_ts < ?",
+            (cutoff,),
+        ).fetchall()
+        for session_id, keys_s, day, grant_ts, last_seen, reserved in stale:
+            _reconcile(con, keys_s.split(","), day, grant_ts, int(reserved), end_ts=last_seen)
+            con.execute("UPDATE sessions SET ended=1 WHERE session_id=?", (session_id,))
+        if stale:
+            logger.debug("swept %d stale session(s)", len(stale))
+
+
+def _reconcile(con, keys, day: str, grant_ts: float, reserved: int, end_ts: float) -> None:
+    """Refund reserved-but-unused time. Bill elapsed rounded up to a chunk,
+    capped at what was reserved."""
+    elapsed = max(0.0, end_ts - grant_ts)
+    billed = min(reserved, int(math.ceil(elapsed / CHUNK_SEC) * CHUNK_SEC))
+    refund = reserved - billed
+    if refund > 0:
+        _add(con, keys, day, -refund)

main.js

@@ -0,0 +1,1245 @@
+// @ts-check
+/**
+ * Minimal voice conversation app, talking to a Hugging Face speech-to-speech
+ * backend over **WebSocket** (drop-in alternative to the WebRTC variant).
+ *
+ * Click the orb -> we ask for the mic, POST a session on the LB, open a
+ * WebSocket on the routed compute endpoint, push session.update + mic
+ * audio, play back the TTS audio. The orb visually reflects the live
+ * state (idle, connecting, listening, user-speaking, processing,
+ * ai-speaking).
+ *
+ * The only meaningful difference vs. the WebRTC main.js is that the
+ * client owns its own AudioContext (no `attachOutputTrack`), so we hand
+ * it the MediaStream directly.
+ *
+ * @typedef {"idle" | "connecting" | "listening" | "user-speaking" | "processing" | "ai-speaking" | "error"} AppState
+ */
+
+import { S2sWsRealtimeClient } from "./ws/s2s-ws-client.js";
+import { $, truncateError, DEBUG } from "./ui/dom.js";
+import { ChatView } from "./ui/chat.js";
+import { Account } from "./ui/account.js";
+
+const DEFAULT_VOICE = "Aiden";
+const DEFAULT_INSTRUCTIONS =
+  "You are a friendly voice assistant. " +
+  "Keep replies short, warm, and spoken. Avoid long monologues.";
+
+// Appended to the user's instructions whenever at least one tool is enabled.
+// Stops the model from announcing capabilities ("Yes, I can search") and then
+// idling for the next turn — it should act immediately in the same response.
+const TOOL_USE_HINT =
+  " When the user's request calls for one of your tools, do not describe your " +
+  "capabilities or say you can do it and wait for another turn. Instead, say " +
+  'a brief acknowledgement like "Let me search for that..." and call the tool ' +
+  "right away in the same response.";
+
+const STORAGE_KEYS = {
+  // Direct s2s server URL, used only when the deploy has no LOAD_BALANCER_URL
+  // (in LB mode the browser never learns the LB address — it POSTs /api/session).
+  directUrl: "s2s.ws.directUrl",
+  voice: "s2s.ws.voice",
+  instructions: "s2s.ws.instructions",
+  tools: "s2s.ws.tools",
+  searchKey: "s2s.ws.searchKey",
+  noiseGate: "s2s.ws.noiseGate",
+};
+
+// ── Noise gate ──────────────────────────────────────────────────────────────
+// The Settings cursor sets the gate's open threshold in dBFS. Its leftmost
+// position is an OFF detent (gate disabled, pure passthrough); the rest of the
+// travel is the active threshold. The cursor shares the meter's dB axis, so the
+// handle sits on the level bar — raise it until room noise stops lighting it up.
+// The slider range IS the shared axis: the live meter fill and the threshold
+// thumb both map across [GATE_OFF_DB, GATE_MAX_DB], so the thumb sits exactly
+// where the gate cuts on the same scale as the level bar.
+const GATE_OFF_DB = -66; // slider minimum = off / bottom of the meter axis
+const GATE_MAX_DB = -3; // slider maximum = most aggressive / top of the meter axis
+const GATE_DEFAULT_DB = -50; // first-run default: a gentle gate, enabled
+
+/** @param {number} thresholdDb @returns {import("./ws/s2s-ws-client.js").NoiseGate} */
+function gateParams(thresholdDb) {
+  return { enabled: thresholdDb > GATE_OFF_DB, thresholdDb };
+}
+
+// ── Tools ─────────────────────────────────────────────────────────────────
+// Function tools we declare to the backend. The model decides when to call
+// one; the executor below runs it and returns the result (see runTool).
+/** @type {Record<string, import("./ws/s2s-ws-client.js").ToolDef>} */
+const TOOL_DEFS = {
+  web_search: {
+    type: "function",
+    name: "web_search",
+    description:
+      "Search the web for current or factual information you don't already know " +
+      "(news, prices, facts, documentation). Returns the top results with titles, " +
+      "snippets and URLs.",
+    parameters: {
+      type: "object",
+      properties: { query: { type: "string", description: "The search query." } },
+      required: ["query"],
+    },
+  },
+  camera_snapshot: {
+    type: "function",
+    name: "camera_snapshot",
+    description:
+      "Capture the current frame from the user's webcam so you can see what they " +
+      "are showing you. Use it whenever the user refers to something visual or " +
+      "asks you to look.",
+    parameters: { type: "object", properties: {}, required: [] },
+  },
+};
+
+/** Longest edge of the snapshot sent to the VLM, in px (keeps payload sane). */
+const SNAPSHOT_MAX_EDGE = 768;
+const SNAPSHOT_QUALITY = 0.7;
+
+function loadSettings() {
+  return {
+    directUrl: localStorage.getItem(STORAGE_KEYS.directUrl) || "",
+    voice: localStorage.getItem(STORAGE_KEYS.voice) || DEFAULT_VOICE,
+    instructions: localStorage.getItem(STORAGE_KEYS.instructions) || DEFAULT_INSTRUCTIONS,
+    noiseGate: loadGateThreshold(),
+  };
+}
+
+/** Stored gate threshold (dBFS), clamped to the slider range. Defaults to a
+ * gentle enabled gate (GATE_DEFAULT_DB) when the user hasn't set one yet. */
+function loadGateThreshold() {
+  const stored = localStorage.getItem(STORAGE_KEYS.noiseGate);
+  // getItem returns null when unset, and Number(null) === 0 (finite!), so guard
+  // the missing/empty case explicitly before coercing — otherwise the default
+  // never fires and 0 clamps to the slider max.
+  if (stored === null || stored === "") return GATE_DEFAULT_DB;
+  const raw = Number(stored);
+  if (!Number.isFinite(raw)) return GATE_DEFAULT_DB;
+  return Math.min(GATE_MAX_DB, Math.max(GATE_OFF_DB, Math.round(raw)));
+}
+
+/** @param {ReturnType<typeof loadSettings>} s */
+function saveSettings(s) {
+  localStorage.setItem(STORAGE_KEYS.directUrl, s.directUrl);
+  localStorage.setItem(STORAGE_KEYS.voice, s.voice);
+  localStorage.setItem(STORAGE_KEYS.instructions, s.instructions);
+  localStorage.setItem(STORAGE_KEYS.noiseGate, String(s.noiseGate));
+}
+
+/** @returns {{ web_search: boolean, camera_snapshot: boolean }} */
+function loadTools() {
+  try {
+    const raw = JSON.parse(localStorage.getItem(STORAGE_KEYS.tools) || "{}");
+    // Both tools default ON (web search still only activates when a key exists).
+    // We never call getUserMedia on page load — the camera only actually starts
+    // on a user gesture (conversation start), so a default-on flag doesn't
+    // silently resume the webcam; an explicit saved `false` is respected.
+    return {
+      web_search: raw.web_search ?? true,
+      camera_snapshot: raw.camera_snapshot ?? true,
+    };
+  } catch {
+    return { web_search: true, camera_snapshot: true };
+  }
+}
+
+function saveTools() {
+  localStorage.setItem(STORAGE_KEYS.tools, JSON.stringify(toolsEnabled));
+}
+
+/** @type {Record<AppState, { caption: string; disabled: boolean }>} */
+const STATE_VIEWS = {
+  idle:            { caption: "Tap to start",  disabled: false },
+  connecting:      { caption: "Connecting",    disabled: true  },
+  listening:       { caption: "",              disabled: false },
+  "user-speaking": { caption: "",              disabled: false },
+  processing:      { caption: "",              disabled: false },
+  "ai-speaking":   { caption: "",              disabled: false },
+  error:           { caption: "Tap to retry",  disabled: false },
+};
+
+/** @type {Record<AppState, string>} */
+const STATE_CLASS = {
+  idle: "state-idle",
+  connecting: "state-connecting",
+  listening: "state-listening",
+  "user-speaking": "state-user-speaking",
+  processing: "state-processing",
+  "ai-speaking": "state-ai-speaking",
+  error: "state-error",
+};
+
+/** @type {ReadonlySet<AppState>} */
+const LIVE_STATES = new Set(["listening", "user-speaking", "processing", "ai-speaking"]);
+
+/** @type {HTMLButtonElement} */
+const circleBtn = $("#main-circle");
+/** @type {HTMLParagraphElement} */
+const circleCaption = $("#circle-caption");
+/** @type {HTMLElement} */
+const orbWrap = $(".orb-wrap");
+/** @type {HTMLButtonElement} */
+const micBtn = $("#mic-btn");
+/** @type {HTMLButtonElement} */
+const stopBtn = $("#stop-btn");
+
+/** @type {HTMLButtonElement} */
+const settingsBtn = $("#settings-btn");
+/** @type {HTMLDialogElement} */
+const settingsModal = $("#settings-modal");
+
+/** @type {HTMLButtonElement} */
+const aboutBtn = $("#about-btn");
+/** @type {HTMLDialogElement} */
+const aboutModal = $("#about-modal");
+/** @type {HTMLButtonElement} */
+const aboutClose = $("#about-close");
+
+/** @type {HTMLButtonElement} */
+const toolsBtn = $("#tools-btn");
+/** @type {HTMLDialogElement} */
+const toolsModal = $("#tools-modal");
+/** @type {HTMLButtonElement} */
+const toolsClose = $("#tools-close");
+/** @type {HTMLInputElement} */
+const toolWebSwitch = $("#tool-web");
+/** @type {HTMLInputElement} */
+const toolCamSwitch = $("#tool-cam");
+/** @type {HTMLElement} */
+const toolWebRow = $("#tool-web-row");
+/** @type {HTMLElement} */
+const toolWebHint = $("#tool-web-hint");
+/** @type {HTMLElement} */
+const toolCamHint = $("#tool-cam-hint");
+/** @type {HTMLInputElement} */
+const searchKeyInput = $("#search-key");
+/** @type {HTMLElement} */
+const camPip = $("#cam-pip");
+/** @type {HTMLVideoElement} */
+const camVideo = $("#cam-video");
+
+/** @type {HTMLInputElement} */
+const inputLbUrl = $("#lb-url");
+/** @type {HTMLElement} */
+const connField = $("#conn-field");
+/** @type {HTMLElement} */
+const connHint = $("#conn-hint");
+/** @type {HTMLSelectElement} */
+const inputVoice = $("#voice");
+/** @type {HTMLTextAreaElement} */
+const inputInstructions = $("#instructions");
+/** @type {HTMLInputElement} */
+const inputNoiseGate = $("#noise-gate");
+/** @type {HTMLElement} */
+const gateValue = $("#gate-value");
+/** @type {HTMLElement} */
+const gateMeterFill = $("#gate-meter-fill");
+/** @type {HTMLElement} */
+const micGate = $("#mic-gate");
+const mgaArc = /** @type {SVGSVGElement} */ (document.querySelector("#mic-gate-arc"));
+const mgaTrack = /** @type {SVGPathElement} */ (document.querySelector("#mga-track"));
+const mgaFill = /** @type {SVGPathElement} */ (document.querySelector("#mga-fill"));
+const mgaHit = /** @type {SVGPathElement} */ (document.querySelector("#mga-hit"));
+const mgaHandle = /** @type {SVGCircleElement} */ (document.querySelector("#mga-handle"));
+/** @type {HTMLButtonElement} */
+const restartBtn = $("#restart-conversation");
+/** @type {HTMLElement} */
+const restartHint = $("#restart-hint");
+const settingsForm = /** @type {HTMLFormElement} */ (settingsModal.querySelector("form"));
+
+/** @type {AppState} */
+let currentState = "idle";
+let settings = loadSettings();
+
+// ── Connection target ────────────────────────────────────────────────────────
+// Two modes, decided by the deploy via /api/config:
+//   • LOAD_BALANCER_URL set  -> original flow: POST the same-origin /api/session
+//     proxy (the server forwards to the LB; the LB address is never sent here).
+//   • unset (allowDirect)    -> the user sets a speech-to-speech server URL and
+//     the browser connects to it directly (no load balancer, no /session).
+let lbMode = false;
+// Fail open: direct entry is allowed unless /api/config reports an LB URL. This
+// way a missing/unreachable config (e.g. static hosting) leaves the field
+// usable rather than locked.
+let allowDirect = true;
+
+// ── Tool state ──────────────────────────────────────────────────────────────
+let toolsEnabled = loadTools();
+// Whether the server holds a Serper key (learned from /api/config on load).
+let serverSearchKey = false;
+// A user-supplied key (fallback when the deploy has none). localStorage only.
+let userSearchKey = localStorage.getItem(STORAGE_KEYS.searchKey) || "";
+/** @type {MediaStream | null} */
+let cameraStream = null;
+
+/** Search is usable if the server has a key or the user supplied one. */
+function searchAvailable() {
+  return serverSearchKey || !!userSearchKey;
+}
+
+/** Tool definitions for the currently-enabled (and usable) tools. */
+function activeToolDefs() {
+  const defs = [];
+  if (toolsEnabled.web_search && searchAvailable()) defs.push(TOOL_DEFS.web_search);
+  if (toolsEnabled.camera_snapshot) defs.push(TOOL_DEFS.camera_snapshot);
+  return defs;
+}
+
+/** Instructions plus the hidden tool-use hint when any tool is active. */
+function effectiveInstructions() {
+  const base = settings.instructions;
+  return activeToolDefs().length ? base + TOOL_USE_HINT : base;
+}
+
+/** Push the active tool set to a live session so toggles apply mid-call. */
+function pushToolsToSession() {
+  if (!client || !LIVE_STATES.has(currentState)) return;
+  client.setTools(activeToolDefs());
+  // The hidden tool-use hint depends on whether any tool is active, so refresh
+  // instructions alongside the tool set.
+  client.updateSession({ instructions: effectiveInstructions() });
+}
+
+// ── Chat view ───────────────────────────────────────────────────────────────
+// Owns the history panel, the ephemeral bubbles, and all transcript/tool
+// streaming state. The client's events are forwarded to its on* methods.
+const chat = new ChatView();
+
+// ── Account / limiter ─────────────────────────────────────────────────────
+// Login chip + daily-limit modal (inert unless the deploy is in LB mode). The
+// server meters conversation time; the client just heartbeats a live session
+// and tears down when the server reports the budget is spent.
+const account = new Account();
+let limiterOn = false;
+let heartbeatTimer = 0;
+let trackedSessionId = "";
+let trackedTier = "";
+
+/** @type {S2sWsRealtimeClient | null} */
+let client = null;
+/** @type {MediaStream | null} */
+let micStream = null;
+let micMuted = false;
+
+/** @param {AppState} next */
+function setState(next) {
+  currentState = next;
+  const view = STATE_VIEWS[next];
+  circleBtn.disabled = view.disabled;
+  circleBtn.className = `circle ${STATE_CLASS[next]}`;
+  if (next !== "error") setCaption(view.caption);
+
+  const live = LIVE_STATES.has(next);
+  orbWrap.classList.toggle("live", live);
+  micBtn.setAttribute("aria-hidden", live ? "false" : "true");
+  stopBtn.setAttribute("aria-hidden", live ? "false" : "true");
+  micBtn.tabIndex = live ? 0 : -1;
+  stopBtn.tabIndex = live ? 0 : -1;
+
+  updateRestartAvailability();
+}
+
+function updateRestartAvailability() {
+  // Restart works from any settled state — it tears down a live call (if any)
+  // and reconnects with the current settings. Only block while mid-connect.
+  restartBtn.disabled = currentState === "connecting";
+  restartHint.hidden = false;
+  restartHint.textContent = LIVE_STATES.has(currentState)
+    ? "Reconnects now with the settings above."
+    : "Starts a conversation with the settings above.";
+}
+
+/**
+ * @param {string} text
+ * @param {"" | "error" | "muted"} [kind]
+ */
+function setCaption(text, kind = "") {
+  const trimmed = text.trim();
+  circleCaption.textContent = trimmed;
+  circleCaption.className = `circle-caption${kind ? ` ${kind}` : ""}${trimmed ? "" : " empty"}`;
+}
+
+function openSettings() {
+  syncConnectionUi();
+  inputVoice.value = settings.voice;
+  inputInstructions.value = settings.instructions;
+  syncGateUi();
+  updateRestartAvailability();
+  settingsModal.showModal();
+}
+
+/** dB position (clamped to the slider axis) as a 0..1 fraction of the track.
+ * @param {number} db */
+function dbToFraction(db) {
+  const clamped = Math.min(GATE_MAX_DB, Math.max(GATE_OFF_DB, db));
+  return (clamped - GATE_OFF_DB) / (GATE_MAX_DB - GATE_OFF_DB);
+}
+
+/** @param {number} f @returns {number} dB at a 0..1 position on the gate axis. */
+function fractionToDb(f) {
+  const clamped = Math.min(1, Math.max(0, f));
+  return Math.round(GATE_OFF_DB + clamped * (GATE_MAX_DB - GATE_OFF_DB));
+}
+
+// ── Radial gate arc (around the mic button, live during a call) ─────────────
+// A 270° arc with the gap facing the orb (right). Fraction 0 (=Off) sits at the
+// bottom-ish start; 1 (=max) at the top-ish end. The level fill and the
+// threshold handle ride this same axis, mirroring the Settings widget.
+const ARC_R = 40;
+// A ~200° arc centred on the left (180°) so the wide gap faces the orb (right).
+const ARC_SPAN_DEG = 200;
+const ARC_START_DEG = 180 - ARC_SPAN_DEG / 2; // lower-left start; Off end
+
+/** Point at fraction f (0..1) and radius r, in the 0..100 viewBox.
+ * @param {number} f @param {number} [r] */
+function arcPoint(f, r = ARC_R) {
+  const deg = ARC_START_DEG + f * ARC_SPAN_DEG;
+  const rad = (deg * Math.PI) / 180;
+  return { x: 50 + r * Math.cos(rad), y: 50 + r * Math.sin(rad) };
+}
+
+/** SVG path `d` for the full 0..1 arc (clockwise). */
+function fullArcD() {
+  const a = arcPoint(0);
+  const b = arcPoint(1);
+  const largeArc = ARC_SPAN_DEG > 180 ? 1 : 0;
+  return `M ${a.x} ${a.y} A ${ARC_R} ${ARC_R} 0 ${largeArc} 1 ${b.x} ${b.y}`;
+}
+
+/** One-time geometry: track, fill (dash-revealed) and the transparent hit band. */
+function initGateArc() {
+  const d = fullArcD();
+  mgaTrack.setAttribute("d", d);
+  mgaFill.setAttribute("d", d);
+  mgaHit.setAttribute("d", d);
+  // pathLength 100 lets us reveal the fill by fraction via dashoffset.
+  mgaFill.setAttribute("pathLength", "100");
+  mgaFill.style.strokeDasharray = "100 100";
+  mgaFill.style.strokeDashoffset = "100"; // empty until levels arrive
+  renderGateHandle();
+}
+
+/** Place the threshold bead on the arc at the stored threshold; flag off state. */
+function renderGateHandle() {
+  const off = settings.noiseGate <= GATE_OFF_DB;
+  const p = arcPoint(dbToFraction(settings.noiseGate));
+  mgaHandle.setAttribute("cx", String(p.x));
+  mgaHandle.setAttribute("cy", String(p.y));
+  micGate.classList.toggle("gate-off", off);
+}
+
+/** Paint a 0..1 live level onto the arc fill (and the Settings meter if open).
+ * Brightens the tick when the level crosses the threshold — i.e. the gate is
+ * actually open — but only when gating is enabled.
+ * @param {number} rms */
+function paintInputLevel(rms) {
+  const db = rms > 0 ? 20 * Math.log10(rms) : GATE_OFF_DB;
+  const f = dbToFraction(db);
+  mgaFill.style.strokeDashoffset = String(100 * (1 - f));
+  if (settingsModal.open) gateMeterFill.style.width = `${f * 100}%`;
+  const enabled = settings.noiseGate > GATE_OFF_DB;
+  micGate.classList.toggle("gate-open", enabled && f >= dbToFraction(settings.noiseGate));
+}
+
+/** The single place that commits a new gate threshold: updates both controls,
+ * persists, and applies live to the running session.
+ * @param {number} db */
+function setGateThreshold(db) {
+  settings.noiseGate = Math.min(GATE_MAX_DB, Math.max(GATE_OFF_DB, Math.round(db)));
+  const off = settings.noiseGate <= GATE_OFF_DB;
+  inputNoiseGate.value = String(settings.noiseGate);
+  gateValue.textContent = off ? "Off" : `${settings.noiseGate} dB`;
+  renderGateHandle();
+  localStorage.setItem(STORAGE_KEYS.noiseGate, String(settings.noiseGate));
+  if (client && LIVE_STATES.has(currentState)) {
+    client.setNoiseGate(gateParams(settings.noiseGate));
+  }
+}
+
+/** Reflect the stored gate threshold into the slider, label and arc handle. */
+function syncGateUi() {
+  inputNoiseGate.value = String(settings.noiseGate);
+  const off = settings.noiseGate <= GATE_OFF_DB;
+  gateValue.textContent = off ? "Off" : `${settings.noiseGate} dB`;
+  renderGateHandle();
+}
+
+// Drag along the arc band to set the threshold (a tap on the glyph still mutes).
+let gateDragging = false;
+/** @param {PointerEvent} e */
+function gatePointerToDb(e) {
+  const rect = mgaArc.getBoundingClientRect();
+  const cx = rect.left + rect.width / 2;
+  const cy = rect.top + rect.height / 2;
+  let deg = (Math.atan2(e.clientY - cy, e.clientX - cx) * 180) / Math.PI;
+  if (deg < 0) deg += 360;
+  // Map the on-arc angle to a fraction; angles in the right-side gap fall
+  // outside [0,1] and fractionToDb clamps them to the nearest end (just-below
+  // start -> Off, just-past end -> max).
+  const f = (deg - ARC_START_DEG) / ARC_SPAN_DEG;
+  return fractionToDb(f);
+}
+mgaHit.addEventListener("pointerdown", (e) => {
+  gateDragging = true;
+  mgaHit.setPointerCapture(e.pointerId);
+  setGateThreshold(gatePointerToDb(e));
+});
+mgaHit.addEventListener("pointermove", (e) => {
+  if (gateDragging) setGateThreshold(gatePointerToDb(e));
+});
+const endGateDrag = (/** @type {PointerEvent} */ e) => {
+  if (!gateDragging) return;
+  gateDragging = false;
+  try { mgaHit.releasePointerCapture(e.pointerId); } catch {}
+};
+mgaHit.addEventListener("pointerup", endGateDrag);
+mgaHit.addEventListener("pointercancel", endGateDrag);
+
+settingsBtn.addEventListener("click", openSettings);
+
+// About panel: native <dialog>, Esc closes for free; also close on the X and
+// on a click in the backdrop (a click whose target is the dialog itself).
+aboutBtn.addEventListener("click", () => aboutModal.showModal());
+// Mobile twin of the (i), living in the right-hand control cluster.
+$("#about-btn-m").addEventListener("click", () => aboutModal.showModal());
+aboutClose.addEventListener("click", () => aboutModal.close());
+aboutModal.addEventListener("click", (e) => {
+  if (e.target === aboutModal) aboutModal.close();
+});
+
+// ── Tools panel ───────────────────────────────────────────────────────────
+
+/** Reflect the current tool state into the panel controls. */
+function syncToolsUi() {
+  const avail = searchAvailable();
+  toolWebSwitch.checked = toolsEnabled.web_search && avail;
+  toolWebSwitch.disabled = !avail;
+  toolWebRow.classList.toggle("disabled", !avail);
+  toolCamSwitch.checked = toolsEnabled.camera_snapshot;
+
+  if (serverSearchKey) {
+    // Key lives server-side: show it as configured, never expose it.
+    searchKeyInput.value = "";
+    searchKeyInput.placeholder = "••••••••  · provided by the server";
+    searchKeyInput.disabled = true;
+    toolWebHint.textContent = "Ready. The search key is held server-side and never sent to your browser.";
+  } else {
+    searchKeyInput.disabled = false;
+    searchKeyInput.value = userSearchKey;
+    searchKeyInput.placeholder = "Paste a Serper key to enable web search";
+    toolWebHint.textContent = userSearchKey
+      ? "Using your key — stored in this browser only."
+      : "No server key configured. Add your own Serper key to enable web search.";
+  }
+}
+
+toolsBtn.addEventListener("click", () => { syncToolsUi(); toolsModal.showModal(); });
+toolsClose.addEventListener("click", () => toolsModal.close());
+toolsModal.addEventListener("click", (e) => {
+  if (e.target === toolsModal) toolsModal.close();
+});
+
+toolWebSwitch.addEventListener("change", () => {
+  if (toolWebSwitch.checked && !searchAvailable()) {
+    toolWebSwitch.checked = false; // guard: can't enable without a key
+    return;
+  }
+  toolsEnabled.web_search = toolWebSwitch.checked;
+  saveTools();
+  pushToolsToSession();
+});
+
+toolCamSwitch.addEventListener("change", async () => {
+  if (toolCamSwitch.checked) {
+    try {
+      // Flipping the switch always re-requests the camera, so a permission that
+      // was only dismissed earlier is asked again here.
+      await enableCamera();
+    } catch (err) {
+      toolCamSwitch.checked = false;
+      const denied = err instanceof Error && (err.name === "NotAllowedError" || err.name === "SecurityError");
+      toolCamHint.textContent = denied
+        ? "Camera blocked. Allow it from the camera icon in your browser's address bar — it switches on automatically."
+        : `Camera unavailable${err instanceof Error ? `: ${err.message}` : ""}`;
+      return;
+    }
+    toolsEnabled.camera_snapshot = true;
+    toolCamHint.textContent = "Camera on. The assistant can take a snapshot when it needs to see.";
+  } else {
+    disableCamera();
+    toolsEnabled.camera_snapshot = false;
+    toolCamHint.textContent = "Let the assistant see through your webcam.";
+  }
+  saveTools();
+  pushToolsToSession();
+});
+
+searchKeyInput.addEventListener("input", () => {
+  if (serverSearchKey) return;
+  userSearchKey = searchKeyInput.value.trim();
+  if (userSearchKey) localStorage.setItem(STORAGE_KEYS.searchKey, userSearchKey);
+  else localStorage.removeItem(STORAGE_KEYS.searchKey);
+
+  const avail = searchAvailable();
+  toolWebSwitch.disabled = !avail;
+  toolWebRow.classList.toggle("disabled", !avail);
+  // Losing the key disables a previously-enabled tool.
+  if (!avail && toolsEnabled.web_search) {
+    toolsEnabled.web_search = false;
+    toolWebSwitch.checked = false;
+    saveTools();
+    pushToolsToSession();
+  }
+  toolWebHint.textContent = userSearchKey
+    ? "Using your key — stored in this browser only."
+    : "No server key configured. Add your own Serper key to enable web search.";
+});
+
+// ── Camera ──────────────────────────────────────────────────────────────────
+
+async function enableCamera() {
+  if (cameraStream) return;
+  cameraStream = await navigator.mediaDevices.getUserMedia({
+    video: { facingMode: "user" },
+    audio: false,
+  });
+  camVideo.srcObject = cameraStream;
+  try { await camVideo.play(); } catch { /* autoplay quirks; muted video is fine */ }
+  camPip.classList.add("visible");
+  camPip.setAttribute("aria-hidden", "false");
+  // Lets the footer reflow to the bottom-right (and hide on mobile) while the
+  // webcam preview occupies the bottom of the stage.
+  document.body.classList.add("cam-on");
+}
+
+function disableCamera() {
+  if (cameraStream) {
+    for (const t of cameraStream.getTracks()) t.stop();
+    cameraStream = null;
+  }
+  camVideo.srcObject = null;
+  camPip.classList.remove("visible");
+  camPip.setAttribute("aria-hidden", "true");
+  document.body.classList.remove("cam-on");
+}
+
+/** Auto-start the webcam on arrival (the camera tool is on by default). If the
+ *  user declines the permission, switch the tool off and reflect it in the UI
+ *  rather than nagging. */
+async function autoStartCamera() {
+  if (!toolsEnabled.camera_snapshot || cameraStream) return;
+  try {
+    await enableCamera();
+  } catch (err) {
+    console.warn("[main] camera auto-start declined/failed:", err);
+    toolsEnabled.camera_snapshot = false;
+    saveTools();
+    syncToolsUi();
+  }
+}
+
+/** Track the browser's camera permission so a later re-grant (e.g. the user
+ *  unblocks it from the address bar after a denial) turns the camera back on
+ *  without another toggle, and a revoke turns it off. Best-effort: the
+ *  Permissions API doesn't support "camera" everywhere (e.g. Safari). */
+async function watchCameraPermission() {
+  try {
+    const status = await navigator.permissions?.query?.({ name: /** @type {any} */ ("camera") });
+    if (!status) return;
+    status.addEventListener("change", () => {
+      if (status.state === "granted") {
+        if (!toolsEnabled.camera_snapshot) { toolsEnabled.camera_snapshot = true; saveTools(); }
+        void autoStartCamera();
+        syncToolsUi();
+      } else if (status.state === "denied") {
+        disableCamera();
+        if (toolsEnabled.camera_snapshot) { toolsEnabled.camera_snapshot = false; saveTools(); }
+        syncToolsUi();
+      }
+    });
+  } catch {
+    // Permissions API unavailable for "camera" — the toggle still re-asks.
+  }
+}
+
+/**
+ * Grab the current webcam frame as a downscaled JPEG data URL. The preview is
+ * mirrored in CSS for a natural self-view, but we draw the raw (un-mirrored)
+ * video here so the model sees the scene in its true orientation.
+ * @returns {string | null}
+ */
+function captureSnapshot() {
+  if (!cameraStream || !camVideo.videoWidth) return null;
+  const vw = camVideo.videoWidth;
+  const vh = camVideo.videoHeight;
+  const scale = Math.min(1, SNAPSHOT_MAX_EDGE / Math.max(vw, vh));
+  const w = Math.max(1, Math.round(vw * scale));
+  const h = Math.max(1, Math.round(vh * scale));
+  const canvas = document.createElement("canvas");
+  canvas.width = w;
+  canvas.height = h;
+  const ctx = canvas.getContext("2d");
+  if (!ctx) return null;
+  ctx.drawImage(camVideo, 0, 0, w, h);
+  return canvas.toDataURL("image/jpeg", SNAPSHOT_QUALITY);
+}
+
+/** Brief shutter flash on the preview so the user sees a snapshot was taken. */
+function flashPreview() {
+  camPip.classList.remove("flash");
+  void camPip.offsetWidth; // reflow so the animation restarts
+  camPip.classList.add("flash");
+}
+
+// ── Tool executor ─────────────────────────────────────────────────────────
+// Runs the function the model called, returns the result, and asks for a
+// response so the model speaks it. Errors come back as the tool output too, so
+// the model can recover gracefully instead of the turn stalling.
+
+/**
+ * Run the function the model called, return its result to the backend, and ask
+ * for a follow-up response. We also hand the result back to the caller so it
+ * can be shown in the conversation once the tool has actually run.
+ * @param {string} name @param {string} argsJson @param {string} callId
+ * @returns {Promise<{ output: string, image?: string }>}
+ */
+async function runTool(name, argsJson, callId) {
+  if (!client) return { output: "" };
+  let args = /** @type {Record<string, unknown>} */ ({});
+  try { args = JSON.parse(argsJson || "{}"); } catch { /* keep {} */ }
+
+  if (DEBUG) console.debug(`[tool] run name=${name} callId=${JSON.stringify(callId)} args=${argsJson}`);
+  if (!callId) console.warn("[tool] empty call_id — the backend didn't tag the call, can't return a function_call_output");
+
+  /** @type {{ output: string, image?: string }} */
+  let result = { output: "" };
+  try {
+    if (name === "web_search") {
+      const query = typeof args.query === "string" ? args.query : "";
+      result.output = await execWebSearch(query);
+      // Return the result and let the bare response.create (below) trigger the
+      // spoken answer.
+      client.sendToolOutput(callId, result.output);
+    } else if (name === "camera_snapshot") {
+      const dataUrl = captureSnapshot();
+      if (dataUrl) {
+        if (DEBUG) console.debug(`[tool] camera_snapshot captured frame (${dataUrl.length} chars), sending image + output`);
+        result = { output: "Snapshot captured from the webcam and attached as an image.", image: dataUrl };
+        // Return the tool output; the frame itself rides along with the
+        // response.create below (sent right before it), so the model sees the
+        // snapshot in the very response it's about to speak.
+        client.sendToolOutput(callId, result.output);
+        flashPreview();
+      } else {
+        console.warn("[tool] camera_snapshot: no frame — camera off or not ready");
+        result.output = "The camera is not available right now.";
+        client.sendToolOutput(callId, result.output);
+      }
+    } else {
+      result.output = `Unknown tool: ${name}`;
+      client.sendToolOutput(callId, result.output);
+    }
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    result.output = `Tool failed: ${msg}`;
+    client.sendToolOutput(callId, result.output);
+  }
+  if (DEBUG) console.debug(`[tool] requesting model response after ${name}`);
+  // Camera: the captured frame rides with the response.create (sent just before
+  // it) so it's in context for the reply. Other tools: a bare create.
+  client.requestResponse(result.image ? { image: result.image } : undefined);
+  return result;
+}
+
+/** @param {string} query @returns {Promise<string>} */
+async function execWebSearch(query) {
+  if (!query) return "No query provided.";
+  /** @type {Record<string, string>} */
+  const body = { query };
+  // Only send a user key when there's no server key (server prefers its own).
+  if (!serverSearchKey && userSearchKey) body.key = userSearchKey;
+
+  const res = await fetch("api/search", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body),
+  });
+  if (!res.ok) {
+    let detail = String(res.status);
+    try { const j = await res.json(); if (j.detail) detail = j.detail; } catch {}
+    throw new Error(`search error (${detail})`);
+  }
+  const json = await res.json();
+  // Date-stamp the header so the model treats these as fresh realtime facts
+  // rather than its (older) training knowledge.
+  const today = new Date().toISOString().slice(0, 10);
+  /** @type {string[]} */
+  const lines = [`Google search result from ${today}:`];
+  if (json.answer) lines.push(`Answer: ${json.answer}`);
+  for (const r of json.results || []) {
+    lines.push(`- ${r.title}: ${r.snippet} (${r.url})`);
+  }
+  return lines.length > 1 ? lines.join("\n") : `${lines[0]}\nNo results found.`;
+}
+
+/** Learn server config (search key + connection target), then refresh the UI. */
+async function fetchConfig() {
+  try {
+    const res = await fetch("api/config");
+    if (res.ok) {
+      const json = await res.json();
+      serverSearchKey = !!json.search;
+      lbMode = !!json.lb;
+      // Lock to LB mode only when the deploy reports a load balancer.
+      allowDirect = json.allowDirect ?? !lbMode;
+      // The conversation-time limiter rides on the LB being present.
+      limiterOn = lbMode;
+    }
+    // Non-OK response: leave the fail-open default (allowDirect = true).
+  } catch {
+    // Config endpoint unreachable (e.g. static hosting): keep direct entry.
+  }
+  if (DEBUG) console.debug(`[ui] config: allowDirect=${allowDirect} lbMode=${lbMode}`);
+  // Login chip + remaining-budget (no-op / hidden when the limiter is off).
+  void account.refresh();
+  syncToolsUi();
+  syncConnectionUi();
+}
+
+/**
+ * Resolve where to connect, per the deploy's mode:
+ *   • LB mode  -> `{ sessionUrl }`, the client POSTs the same-origin /api/session
+ *     proxy and the server forwards to the LB (its address stays server-side).
+ *   • direct   -> `{ directUrl }`, connect straight to the s2s WebSocket.
+ * Throws a user-facing error if direct mode is on but no URL was entered.
+ * @returns {{ sessionUrl: string } | { directUrl: string }}
+ */
+function connectionTarget() {
+  if (!allowDirect) {
+    return { sessionUrl: "api/session" };
+  }
+  const directUrl = buildDirectWsUrl(settings.directUrl);
+  if (!directUrl) {
+    throw new Error("Enter a speech-to-speech server URL in Settings.");
+  }
+  return { directUrl };
+}
+
+/**
+ * Normalise a user-typed server address into a realtime WebSocket URL.
+ * Accepts bare hosts (`localhost:8080`), http(s) URLs, or ws(s) URLs, and adds
+ * the `/v1/realtime` path when none is given. A full connect URL (with path
+ * and/or query) is preserved as-is.
+ * @param {string} raw @returns {string}
+ */
+function buildDirectWsUrl(raw) {
+  let s = (raw || "").trim();
+  if (!s) return "";
+  if (!/^wss?:\/\//i.test(s)) {
+    if (/^https?:\/\//i.test(s)) {
+      s = s.replace(/^http/i, "ws"); // http→ws, https→wss
+    } else {
+      const isLocal = /^(localhost|127\.0\.0\.1|\[::1\])(:|\/|$)/i.test(s);
+      s = (isLocal ? "ws://" : "wss://") + s;
+    }
+  }
+  try {
+    const u = new URL(s);
+    if (u.pathname === "" || u.pathname === "/") u.pathname = "/v1/realtime";
+    return u.toString();
+  } catch {
+    return s;
+  }
+}
+
+/** Create + resume an AudioContext synchronously (must run inside the user
+ *  gesture so iOS lets it start). Returns null if construction fails. */
+function createResumedAudioContext() {
+  try {
+    const Ctx = window.AudioContext || /** @type {any} */ (window).webkitAudioContext;
+    const ctx = new Ctx({ latencyHint: "interactive" });
+    if (ctx.state === "suspended") void ctx.resume().catch(() => {});
+    return /** @type {AudioContext} */ (ctx);
+  } catch (err) {
+    console.warn("[main] AudioContext init failed:", err);
+    return null;
+  }
+}
+
+/** Read the editable settings out of the form. The URL field is only honoured
+ *  in direct mode (in LB mode it's locked and server-owned). */
+function readSettingsFromForm() {
+  return {
+    directUrl: allowDirect ? inputLbUrl.value.trim() : settings.directUrl,
+    voice: inputVoice.value || DEFAULT_VOICE,
+    instructions: inputInstructions.value.trim() || DEFAULT_INSTRUCTIONS,
+    noiseGate: readGateThreshold(),
+  };
+}
+
+/** Gate threshold (dBFS) currently shown on the slider, clamped to range. */
+function readGateThreshold() {
+  const v = Math.round(Number(inputNoiseGate.value));
+  if (!Number.isFinite(v)) return GATE_OFF_DB;
+  return Math.min(GATE_MAX_DB, Math.max(GATE_OFF_DB, v));
+}
+
+/** Adapt the connection field to the mode learned from /api/config. */
+function syncConnectionUi() {
+  if (allowDirect) {
+    // Direct mode: the user sets their own s2s server URL.
+    connField.hidden = false;
+    inputLbUrl.value = settings.directUrl;
+    inputLbUrl.placeholder = "http://localhost:port";
+    connHint.classList.remove("error");
+    connHint.textContent =
+      "URL of your speech-to-speech server, e.g. http://localhost:8080 (the app adds /v1/realtime).";
+  } else {
+    // LB mode: the load balancer URL is deployment-owned — hide it entirely so
+    // its address is never exposed in Settings.
+    connField.hidden = true;
+  }
+}
+
+/** True when the user must supply a server URL before connecting (direct mode
+ *  with nothing set). */
+function missingServerUrl() {
+  return allowDirect && !buildDirectWsUrl(settings.directUrl);
+}
+
+/** Open Settings and point the user at the empty server-URL field. */
+function promptServerUrl() {
+  if (settingsModal.open) syncConnectionUi();
+  else openSettings();
+  connHint.textContent = "Set the speech-to-speech server URL to start.";
+  connHint.classList.add("error");
+  inputLbUrl.focus();
+}
+
+settingsForm.addEventListener("submit", (event) => {
+  const submitter = /** @type {HTMLButtonElement | null} */ ((/** @type {SubmitEvent} */ (event)).submitter);
+  if (submitter?.value !== "save") return;
+
+  settings = readSettingsFromForm();
+  saveSettings(settings);
+
+  // Voice + instructions can apply to a live session without reconnecting; a
+  // changed connection URL only takes effect on the next restart.
+  if (client && LIVE_STATES.has(currentState)) {
+    client.updateSession({ voice: settings.voice, instructions: effectiveInstructions() });
+  }
+});
+
+// The noise gate applies live (worklet param), so tune it without a restart:
+// update the label/marker, persist, and push straight to the running client.
+inputNoiseGate.addEventListener("input", () => {
+  setGateThreshold(readGateThreshold());
+});
+
+restartBtn.addEventListener("click", async () => {
+  if (currentState === "connecting") return; // a connect is already underway
+  settings = readSettingsFromForm();
+  saveSettings(settings);
+  if (missingServerUrl()) { promptServerUrl(); return; } // keep settings open
+  settingsModal.close();
+  // Grab the AudioContext NOW, inside the click gesture — teardown() awaits, and
+  // creating it afterwards would fall outside the gesture (silent on iOS).
+  const audioContext = createResumedAudioContext();
+  try {
+    if (client) await teardown();
+    await doStart(audioContext);
+  } catch (err) {
+    await handleStartError(err);
+  }
+});
+
+circleBtn.addEventListener("click", async () => {
+  try {
+    if (currentState === "idle" || currentState === "error") {
+      if (missingServerUrl()) { promptServerUrl(); return; }
+      await doStart();
+    }
+  } catch (err) {
+    await handleStartError(err);
+  }
+});
+
+/** A failed start is either the daily limit (show the modal, return to idle) or
+ *  a real fault (surface it). doStart already closed any orphan AudioContext.
+ *  @param {any} err */
+async function handleStartError(err) {
+  if (err && err.code === "limit") {
+    await teardown();
+    account.showLimit(err.tier);
+    return;
+  }
+  onFatalError(err);
+}
+
+micBtn.addEventListener("click", () => {
+  if (!micStream || !client) return;
+  micMuted = !micMuted;
+  for (const track of micStream.getAudioTracks()) {
+    track.enabled = !micMuted;
+  }
+  client.setMuted(micMuted);
+  micBtn.classList.toggle("muted", micMuted);
+  micBtn.setAttribute("aria-label", micMuted ? "Unmute" : "Mute");
+  micBtn.title = micMuted ? "Unmute" : "Mute";
+});
+
+stopBtn.addEventListener("click", async () => {
+  await teardown();
+});
+
+/**
+ * Start a conversation. Pass a pre-created AudioContext when the caller already
+ * made one inside the tap/click gesture (required on iOS); otherwise one is
+ * created here, which is still inside the gesture for a direct orb tap.
+ * @param {AudioContext | null} [audioContext]
+ */
+async function doStart(audioContext = null) {
+  // Resolve the target before touching mic/audio so a misconfiguration (e.g.
+  // direct mode with no URL) fails fast with a clear message.
+  const target = connectionTarget();
+
+  chat.clear();
+  chat.reset();
+  setState("connecting");
+  setCaption("Asking for mic…", "muted");
+
+  // Create + resume the AudioContext SYNCHRONOUSLY, still inside the gesture.
+  // iOS Safari only starts an AudioContext from a user gesture; if we waited
+  // until after the getUserMedia / session-creation awaits below, it would stay
+  // suspended and the whole pipeline would be silent.
+  if (!audioContext) audioContext = createResumedAudioContext();
+
+  try {
+    micStream = await navigator.mediaDevices.getUserMedia({
+      audio: {
+        echoCancellation: true,
+        noiseSuppression: true,
+        autoGainControl: true,
+      },
+    });
+  } catch (err) {
+    if (audioContext) void audioContext.close().catch(() => {});
+    throw new Error(
+      `Microphone access denied${err instanceof Error ? `: ${err.message}` : ""}`,
+    );
+  }
+
+  // The webcam is started on arrival (autoStartCamera), so nothing to do here;
+  // a still-pending grant just means the snapshot tool isn't ready yet.
+
+  const c = new S2sWsRealtimeClient({
+    ...target,
+    voice: settings.voice,
+    instructions: effectiveInstructions(),
+    micStream,
+    tools: activeToolDefs(),
+    noiseGate: gateParams(settings.noiseGate),
+    ...(audioContext ? { audioContext } : {}),
+  });
+  client = c;
+
+  c.addEventListener("status", (e) => {
+    const detail = /** @type {CustomEvent<{ status: string }>} */ (e).detail;
+    onClientStatus(detail.status);
+  });
+  c.addEventListener("transcript", (e) => {
+    const d = /** @type {CustomEvent<{ role: "user" | "assistant"; text: string; partial: boolean; itemId?: string; responseId?: string }>} */ (e).detail;
+    chat.onTranscript(d);
+  });
+
+  c.addEventListener("response-finished", (e) => {
+    const detail = /** @type {CustomEvent<{ responseId: string; status: string; audible?: boolean; transcript?: string }>} */ (e).detail;
+    chat.onResponseFinished(detail);
+  });
+
+  c.addEventListener("toolcall", (e) => {
+    const { name, arguments: args, callId } = /** @type {CustomEvent<{ name: string; arguments: string; callId: string }>} */ (e).detail;
+    chat.onToolCall(name);
+    // Execute the tool, then push it to the conversation once the result is in,
+    // so the toggle shows both the call input and its output together.
+    void runTool(name, args, callId).then(({ output, image }) => {
+      chat.onToolResult(name, args, output, image);
+    });
+  });
+  c.addEventListener("error", (e) => {
+    const detail = /** @type {CustomEvent<{ error: unknown }>} */ (e).detail;
+    onFatalError(detail.error);
+  });
+  c.addEventListener("server-error", (e) => {
+    // Non-fatal: the backend reported an error mid-session. Log it, keep the
+    // socket and the conversation alive (the model can recover on its own).
+    const detail = /** @type {CustomEvent<{ error: unknown }>} */ (e).detail;
+    const msg = detail.error instanceof Error ? detail.error.message : String(detail.error);
+    console.warn("[main] server error (non-fatal):", msg);
+  });
+  c.addEventListener("session", (e) => {
+    const info = /** @type {CustomEvent<{ info: import("./ws/s2s-ws-client.js").WsSessionInfo }>} */ (e).detail.info;
+    console.log("[ws] session created:", info.sessionId);
+    // A metered tier (anon / free): heartbeat so the server can extend the
+    // reservation and tell us when the daily budget runs out. PRO isn't limited.
+    if (info.limited && info.sessionId) {
+      trackedSessionId = info.sessionId;
+      trackedTier = info.tier || "anon";
+      startHeartbeat(info.heartbeatSec || 5);
+    }
+  });
+  c.addEventListener("input-level", (e) => {
+    const { rms } = /** @type {CustomEvent<{ rms: number }>} */ (e).detail;
+    paintInputLevel(rms);
+  });
+
+  try {
+    await c.connect();
+  } catch (err) {
+    // The grant can be refused (402 → limit) or the dial can fail. In LB mode
+    // the AudioContext hasn't been adopted by the client yet (the session POST
+    // runs first), so close the one we created here to avoid leaking it.
+    if (audioContext) void audioContext.close().catch(() => {});
+    throw err;
+  }
+}
+
+// ── Conversation-time heartbeat ─────────────────────────────────────────────
+
+/** Ping the server every `sec` seconds so it can meter the live session; when
+ *  it reports the daily budget is spent, cut the call and show the limit modal.
+ *  @param {number} sec */
+function startHeartbeat(sec) {
+  stopHeartbeat();
+  heartbeatTimer = window.setInterval(async () => {
+    if (!trackedSessionId) return;
+    try {
+      const res = await fetch("api/session/heartbeat", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ sessionId: trackedSessionId }),
+        keepalive: true,
+      });
+      const json = await res.json().catch(() => ({}));
+      if (json.expired) await onLimitReached();
+    } catch (err) {
+      // A transient network blip shouldn't kill the call; the next tick retries.
+      if (DEBUG) console.debug("[ui] heartbeat failed:", err);
+    }
+  }, Math.max(1, sec) * 1000);
+}
+
+function stopHeartbeat() {
+  if (heartbeatTimer) {
+    clearInterval(heartbeatTimer);
+    heartbeatTimer = 0;
+  }
+}
+
+/** The server cut the live session: tear down and explain why. */
+async function onLimitReached() {
+  const tier = trackedTier;
+  stopHeartbeat();
+  await teardown();
+  account.showLimit(tier);
+}
+
+/** Tell the server a session ended so it reconciles + refunds the unused chunk.
+ *  Uses sendBeacon so it still fires when the tab is closing. */
+function endTrackedSession() {
+  if (!trackedSessionId) return;
+  const body = JSON.stringify({ sessionId: trackedSessionId });
+  try {
+    const blob = new Blob([body], { type: "application/json" });
+    if (!navigator.sendBeacon("api/session/end", blob)) {
+      void fetch("api/session/end", {
+        method: "POST", headers: { "Content-Type": "application/json" }, body, keepalive: true,
+      }).catch(() => {});
+    }
+  } catch {
+    // Best-effort; the server sweep reaps the session anyway.
+  }
+  trackedSessionId = "";
+  trackedTier = "";
+}
+
+/** @param {string} status */
+function onClientStatus(status) {
+  switch (status) {
+    case "creating-session":
+    case "connecting":
+      setState("connecting");
+      break;
+    case "connected":
+      setState("listening");
+      break;
+    case "user-speaking":
+      setState("user-speaking");
+      break;
+    case "processing":
+      setState("processing");
+      break;
+    case "ai-speaking":
+      setState("ai-speaking");
+      break;
+    case "closed":
+      // teardown() will move us to idle
+      break;
+    case "error":
+      setState("error");
+      break;
+  }
+}
+
+async function teardown() {
+  stopHeartbeat();
+  endTrackedSession();
+  chat.reset({ dismiss: true });
+  if (client) {
+    try {
+      await client.close();
+    } catch (err) {
+      console.warn("[main] error closing client:", err);
+    }
+    client = null;
+  }
+  if (micStream) {
+    for (const track of micStream.getTracks()) track.stop();
+    micStream = null;
+  }
+  // The webcam is independent of the call lifecycle (it runs while the user is
+  // on the page), so we leave it on here — only the camera toggle stops it.
+  micMuted = false;
+  micBtn.classList.remove("muted");
+  setState("idle");
+  // Refresh the chip's remaining-today after the budget moved.
+  if (limiterOn) void account.refresh();
+}
+
+/** @param {unknown} err */
+function onFatalError(err) {
+  console.error("[main] fatal:", err);
+  setState("error");
+  const message = err instanceof Error ? err.message : String(err);
+  setCaption(truncateError(message), "error");
+  void teardown().catch(() => {
+    setState("error");
+    setCaption(truncateError(message), "error");
+  });
+}
+
+setState("idle");
+chat.renderEmptyState();
+initGateArc();
+void fetchConfig();
+// Start the webcam as soon as the user lands (camera tool defaults on), and
+// react to later permission changes (re-grant after a denial re-enables it).
+void autoStartCamera();
+void watchCameraPermission();
+
+// Reconcile a live session if the tab is closed/hidden mid-call (no teardown).
+window.addEventListener("pagehide", () => endTrackedSession());
+
+requestAnimationFrame(() => {
+  document.body.classList.remove("booting");
+});

requirements.txt

@@ -0,0 +1,5 @@
+fastapi==0.115.6
+uvicorn[standard]==0.34.0
+httpx==0.28.1
+# [oauth] extra pulls authlib + itsdangerous for attach_huggingface_oauth.
+huggingface_hub[oauth]>=0.30,<1.0

server.py

@@ -0,0 +1,292 @@
+"""
+Tiny server for the speech-to-speech demo.
+
+The demo used to ship as a `sdk: static` Space, but the web-search tool needs a
+search key the browser must NOT see. A static Space has no runtime process, so it
+can't hold a secret the front-end uses. This server fixes that: it serves the
+unchanged front-end AND exposes a same-origin `/api/search` proxy that holds the
+Serper key server-side (see docs/adr/0001).
+
+Everything lives in one container; the speech-to-speech backend stays a separate,
+load-balanced service the browser talks to over WebSocket as before. The load
+balancer's address is a secret too (like the Serper key): the browser never sees
+it. `/api/session` proxies the session handshake server-side so only the
+per-session compute URL the LB hands back (which the browser must dial) is exposed.
+
+On the deployed Space the server also meters conversation time by HF login tier
+(anonymous / signed-in / PRO) — see `limiter.py` and `auth.py`. That whole feature
+is off unless BOTH `LOAD_BALANCER_URL` and `SPACE_ID` are set, so it runs only on
+the live Space, never locally (even with the LB exported for testing).
+
+Endpoints:
+  GET  /api/config           -> { search, lb, allowDirect, auth }
+  GET  /api/me               -> login + tier + remaining budget (LB mode only)
+  POST /api/search           -> { results, answer }  Google via Serper.dev
+  POST /api/session          -> proxies <LB>/session, reserves the first time chunk
+  POST /api/session/heartbeat-> extend the reservation; { expired }
+  POST /api/session/end      -> reconcile + refund (sendBeacon on teardown)
+  /*                         -> static files (index.html, main.js, ...)
+"""
+
+import asyncio
+import logging
+import os
+
+import httpx
+from fastapi import FastAPI, HTTPException, Request
+from fastapi.responses import JSONResponse
+from fastapi.staticfiles import StaticFiles
+from pydantic import BaseModel
+
+import auth
+import limiter
+
+logger = logging.getLogger("s2s.search")
+
+SERPER_KEY = os.environ.get("SERPER_API_KEY", "").strip()
+# Speech-to-speech load balancer URL. When set, the browser POSTs /api/session
+# (which proxies <lb>/session here, server-side) and connects to the URL the LB
+# returns (the original flow). The LB address itself is never sent to the browser.
+# When empty, the user may instead set a direct s2s server URL in Settings and the
+# browser connects to it straight (no load balancer).
+LOAD_BALANCER_URL = os.environ.get("LOAD_BALANCER_URL", "").strip()
+# HF injects SPACE_ID ("owner/space") into every Space runtime; it's absent
+# locally and on a plain `docker run`. We meter conversation time ONLY on the
+# deployed Space — i.e. when BOTH the LB is configured AND we're on a Space.
+# Off-Space (local dev, even with the LB exported) the app still proxies the LB,
+# but nothing is metered: no budget, no reservations, no sign-in gating.
+SPACE_ID = os.environ.get("SPACE_ID", "").strip()
+LIMITER_ENABLED = bool(LOAD_BALANCER_URL) and bool(SPACE_ID)
+SERPER_URL = "https://google.serper.dev/search"
+# Cap results so the tool output stays small enough to feed back to the model.
+MAX_RESULTS = 5
+HERE = os.path.dirname(os.path.abspath(__file__))
+
+app = FastAPI(title="s2s-demo")
+
+# Wire HF OAuth before the app serves (no-op unless the OAuth env is present).
+# Sign-in only matters when we're metering (prod Space), so gate it on that.
+AUTH_ENABLED = LIMITER_ENABLED and auth.attach(app)
+
+
+@app.on_event("startup")
+async def _startup():
+    """Stand up the usage DB and a periodic sweeper — metered (prod Space) only."""
+    if not LIMITER_ENABLED:
+        return
+    limiter.init()
+    asyncio.create_task(_sweeper())
+
+
+async def _sweeper():
+    while True:
+        await asyncio.sleep(limiter.REAP_AFTER_SEC)
+        try:
+            await asyncio.to_thread(limiter.sweep)
+        except Exception as exc:  # pragma: no cover - defensive
+            logger.warning("usage sweep failed: %r", exc)
+
+
+class SearchRequest(BaseModel):
+    query: str
+    # Optional user-supplied key (fallback when the deploy has no server key).
+    # Used for this request only; never stored.
+    key: str | None = None
+
+
+@app.get("/api/config")
+def config():
+    """Client bootstrap: whether web search is available, whether the deploy runs
+    behind a load balancer (so the browser uses the /api/session proxy + limiter),
+    whether HF sign-in is available, and whether the user may instead set a direct
+    s2s server URL. The LB address itself is intentionally NOT included."""
+    return {
+        "search": bool(SERPER_KEY),
+        "lb": bool(LOAD_BALANCER_URL),
+        "allowDirect": not LOAD_BALANCER_URL,
+        "auth": AUTH_ENABLED,
+    }
+
+
+@app.get("/api/me")
+async def me(request: Request):
+    """Login state, tier, and remaining daily budget. Only meaningful in LB mode;
+    sets the anonymous tracking cookie when first seen."""
+    if not LIMITER_ENABLED:
+        return {"enabled": False}
+    view = auth.user_view(request)
+    tier, keys, set_cookie = auth.resolve_identity(request)
+    unlimited = limiter.budget_for(tier) is None
+    rem = None if unlimited else await asyncio.to_thread(limiter.remaining, keys, tier)
+    out = {
+        "enabled": True,
+        "auth": AUTH_ENABLED,
+        **view,
+        "remainingSec": rem,
+        "limitSec": limiter.budget_for(tier),
+        "loginUrl": auth.OAUTH_LOGIN_PATH if AUTH_ENABLED else None,
+        "logoutUrl": auth.OAUTH_LOGOUT_PATH if AUTH_ENABLED else None,
+    }
+    resp = JSONResponse(out)
+    if set_cookie:
+        auth.set_anon_cookie(resp, set_cookie)
+    return resp
+
+
+@app.post("/api/search")
+async def search(req: SearchRequest):
+    """Proxy a Google search via Serper.dev. The key stays on the server unless
+    the user brought their own (then theirs is used for this request only)."""
+    query = (req.query or "").strip()
+    if not query:
+        raise HTTPException(status_code=400, detail="Empty query.")
+
+    key = (req.key or "").strip() or SERPER_KEY
+    if not key:
+        # No server key and the user didn't supply one — search is unavailable.
+        raise HTTPException(status_code=503, detail="Search is not configured.")
+
+    headers = {"X-API-KEY": key, "Content-Type": "application/json"}
+    payload = {"q": query, "num": MAX_RESULTS}
+    try:
+        async with httpx.AsyncClient(timeout=12.0) as http:
+            resp = await http.post(SERPER_URL, headers=headers, json=payload)
+    except httpx.RequestError as exc:
+        logger.warning("Serper unreachable: %r", exc)
+        raise HTTPException(status_code=502, detail="Search provider unreachable.")
+
+    if resp.status_code != 200:
+        # Serper's error body carries the real reason (e.g. "Not enough
+        # credits") and contains no key, so it's safe to log and relay.
+        body = resp.text[:300]
+        logger.warning("Serper error %s: %s", resp.status_code, body)
+        msg = None
+        try:
+            msg = resp.json().get("message")
+        except Exception:
+            pass
+        detail = f"Search provider error ({resp.status_code})"
+        if msg:
+            detail += f": {msg}"
+        raise HTTPException(status_code=502, detail=detail)
+
+    data = resp.json()
+    results = []
+    for item in (data.get("organic") or [])[:MAX_RESULTS]:
+        results.append(
+            {
+                "title": item.get("title", ""),
+                "snippet": item.get("snippet", ""),
+                "url": item.get("link", ""),
+            }
+        )
+
+    # A direct answer when Google has one — saves the model a hop.
+    box = data.get("answerBox") or {}
+    answer = box.get("answer") or box.get("snippet") or None
+    if not answer:
+        kg = data.get("knowledgeGraph") or {}
+        answer = kg.get("description") or None
+
+    return JSONResponse({"query": query, "answer": answer, "results": results})
+
+
+@app.post("/api/session")
+async def session(request: Request):
+    """Proxy the session handshake to the load balancer, keeping its URL secret,
+    and meter conversation time by tier.
+
+    The browser POSTs here (same-origin); we resolve the caller's tier, refuse if
+    today's budget is already spent (402), otherwise POST <LOAD_BALANCER_URL>/session
+    and relay the JSON back. The LB body carries a per-session `connect_url`
+    (compute host + short-lived token) the browser must dial directly — that one
+    URL is unavoidably exposed, but the stable load-balancer address is not. On a
+    successful grant we reserve the first time chunk against the day's budget."""
+    if not LOAD_BALANCER_URL:
+        # No LB configured — this deploy is direct-mode only; the browser should
+        # never call this. 404 so it's indistinguishable from a missing route.
+        raise HTTPException(status_code=404, detail="Not found.")
+
+    tier, keys, set_cookie = auth.resolve_identity(request)
+    # Metering runs only on the deployed Space; off-Space the LB still proxies but
+    # nothing is tracked. Within metering, unlimited tiers (pro, org) aren't either.
+    tracked = LIMITER_ENABLED and limiter.budget_for(tier) is not None
+
+    # Refuse before troubling the LB if the day's budget is already gone.
+    if tracked:
+        rem = await asyncio.to_thread(limiter.remaining, keys, tier)
+        if rem is not None and rem <= 0:
+            resp = JSONResponse(
+                {"tier": tier, "reason": "limit", "remainingSec": 0}, status_code=402
+            )
+            if set_cookie:
+                auth.set_anon_cookie(resp, set_cookie)
+            return resp
+
+    url = f"{LOAD_BALANCER_URL.rstrip('/')}/session"
+    try:
+        async with httpx.AsyncClient(timeout=15.0) as http:
+            lb = await http.post(url, headers={"Content-Type": "application/json"}, content="{}")
+    except httpx.RequestError as exc:
+        logger.warning("Load balancer unreachable: %r", exc)
+        raise HTTPException(status_code=502, detail="Speech service unreachable.")
+
+    if lb.status_code != 200:
+        # The LB's error body may name the reason (e.g. capacity); it carries no
+        # secret, so relay a trimmed copy.
+        logger.warning("Session handshake failed %s: %s", lb.status_code, lb.text[:300])
+        raise HTTPException(status_code=502, detail=f"Session handshake failed ({lb.status_code}).")
+
+    data = lb.json()
+    remaining = None
+    if tracked and data.get("session_id"):
+        await asyncio.to_thread(limiter.begin, data["session_id"], keys, tier)
+        remaining = await asyncio.to_thread(limiter.remaining, keys, tier)
+
+    data.update({
+        "tier": tier,
+        "limited": tracked,
+        "remainingSec": remaining,
+        "heartbeatSec": limiter.HEARTBEAT_SEC,
+    })
+    resp = JSONResponse(data)
+    if set_cookie:
+        auth.set_anon_cookie(resp, set_cookie)
+    return resp
+
+
+async def _session_id(request: Request) -> str:
+    """Pull `sessionId` from a JSON body, tolerating sendBeacon's blob posts."""
+    try:
+        data = await request.json()
+    except Exception:
+        return ""
+    return (data or {}).get("sessionId", "") if isinstance(data, dict) else ""
+
+
+@app.post("/api/session/heartbeat")
+async def session_heartbeat(request: Request):
+    """Extend the live reservation one chunk at a time. `expired` once the day's
+    budget is spent — the client then tears down."""
+    if not LIMITER_ENABLED:
+        raise HTTPException(status_code=404, detail="Not found.")
+    sid = await _session_id(request)
+    alive = bool(sid) and await asyncio.to_thread(limiter.heartbeat, sid)
+    return {"expired": not alive}
+
+
+@app.post("/api/session/end")
+async def session_end(request: Request):
+    """Clean teardown: reconcile to real elapsed time and refund the unused
+    chunk. Sent via navigator.sendBeacon, so it must succeed without a response."""
+    if not LIMITER_ENABLED:
+        raise HTTPException(status_code=404, detail="Not found.")
+    sid = await _session_id(request)
+    if sid:
+        await asyncio.to_thread(limiter.end, sid)
+    return {"ok": True}
+
+
+# Static front-end. Registered last so the /api routes win. `html=True` serves
+# index.html at "/". The repo is public anyway, so serving the dir is fine.
+app.mount("/", StaticFiles(directory=HERE, html=True), name="static")

style.css

@@ -0,0 +1,2509 @@
+:root {
+  --bg: #0a0b10;
+  --bg-elev: #13151c;
+  --bg-elev-2: #1b1e29;
+  --border: rgba(255, 255, 255, 0.08);
+  --border-strong: rgba(255, 255, 255, 0.16);
+  --text: #f5f6fa;
+  --text-dim: rgba(245, 246, 250, 0.65);
+  --text-faint: rgba(245, 246, 250, 0.42);
+
+  --accent: #8b7dff;
+  --accent-2: #22d3ee;
+  --listening: #22d3ee;
+  --speaking: #8b7dff;
+  --processing: #f59e0b;
+  --error: #ff6a75;
+  --success: #34d399;
+
+  /* Mono is the "machine voice": reserved for system text the app emits —
+   * the orb's status caption, tool calls, the transport tag. Body/UI stays
+   * Inter. */
+  --font-mono: "Geist Mono", ui-monospace, SFMono-Regular, "SF Mono", Menlo, monospace;
+
+  /* Thesis: color belongs to the voice. The chrome is monochrome; saturated
+   * hue appears only on the orb and on these tiny role echoes, which mirror
+   * the orb's own state colors (you listening = cyan, assistant = violet,
+   * tool = amber) so the transcript reads in the same color language. */
+  --voice-user: var(--accent-2);
+  --voice-assistant: var(--accent);
+  --voice-tool: var(--processing);
+
+  /* Smoothed mic RMS in [0..1], updated every frame from JS while a session
+   * is active. Used by audio-reactive circle states. */
+  --audio-level: 0;
+  /* Five log-spaced frequency bands extracted from the mic analyser;
+   * drive each bar's height independently for a real "spectrum" feel. */
+  --bar0: 0;
+  --bar1: 0;
+  --bar2: 0;
+  --bar3: 0;
+  --bar4: 0;
+
+  --radius-sm: 8px;
+  --radius-md: 14px;
+  --radius-lg: 22px;
+
+  --shadow-soft: 0 10px 40px rgba(0, 0, 0, 0.35);
+
+  color-scheme: dark;
+}
+
+* {
+  box-sizing: border-box;
+}
+
+html,
+body {
+  margin: 0;
+  padding: 0;
+  height: 100%;
+}
+
+body {
+  font-family: "Inter", system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif;
+  background: radial-gradient(ellipse at 50% 20%, #1a1c28 0%, var(--bg) 60%);
+  color: var(--text);
+  min-height: 100vh;
+  overflow-x: hidden;
+  -webkit-font-smoothing: antialiased;
+}
+
+button {
+  font-family: inherit;
+}
+
+a {
+  color: var(--text);
+  text-decoration: none;
+  border-bottom: 1px solid var(--border-strong);
+}
+a:hover {
+  border-bottom-color: var(--text);
+}
+
+#app {
+  display: grid;
+  grid-template-rows: auto 1fr auto;
+  min-height: 100vh;
+}
+
+.hidden {
+  display: none !important;
+}
+
+/* ─── Topbar ──────────────────────────────────────────────────────────── */
+
+/* Topbar is just a floating row of controls over the stage - no
+ * separator line, no background. Same story for the footer. Keeps the
+ * app feeling like one continuous canvas. */
+.topbar {
+  display: flex;
+  /* Top-align so the right control cluster sits up with the title instead of
+   * floating to the vertical middle of the tall identity block. */
+  align-items: flex-start;
+  justify-content: space-between;
+  padding: 18px 28px;
+  /* Default stacking (below the conversation panel, z 200) so the panel drawer
+   * covers the controls when it's open. */
+}
+
+.brand {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  font-weight: 600;
+  font-size: 14px;
+  letter-spacing: 0.01em;
+  color: var(--text-dim);
+}
+
+/* Transport tag rides the wordmark as a system label, not prose — mono,
+ * dimmed, the only mono in the topbar. */
+.brand-tag {
+  font-family: var(--font-mono);
+  font-weight: 500;
+  font-size: 11px;
+  letter-spacing: 0.02em;
+  opacity: 0.55;
+}
+
+.brand .brand-logo {
+  width: 26px;
+  height: 26px;
+  object-fit: contain;
+  flex: none;
+  filter: drop-shadow(0 1px 2px rgba(0, 0, 0, 0.45));
+  transition: transform 0.2s ease;
+}
+.brand .brand-logo:hover {
+  transform: translateY(-1px) rotate(-2deg);
+}
+
+/* Narrow viewports (typically the mobile shell iframe and phone-sized
+   browser windows): the full product name pushes the topbar's right
+   cluster off-screen. Keep the logo as the brand cue and drop the
+   wordmark - the orb already gives enough context. */
+@media (max-width: 600px) {
+  /* The full identity stack is too tall for a phone topbar. Show only the
+   * title + (i); the popup carries the blurb, credits and pipeline.
+   * `.brand` prefix raises specificity so this beats the later base
+   * `.ident-meta { display: flex }` rule regardless of source order. */
+  .brand .ident-blurb,
+  .brand .ident-meta {
+    display: none;
+  }
+  .ident-title {
+    font-size: 18px;
+  }
+  /* (i) moves into the right-hand control cluster on phones, leaving the
+   * title alone on the left. */
+  .brand .about-btn {
+    display: none;
+  }
+  .about-btn-mobile {
+    display: inline-flex;
+  }
+  /* Keep phone icons at the current compact size — the desktop bump above
+   * shouldn't leak into the mobile topbar. */
+  .topbar-right .icon-btn {
+    width: 36px;
+    height: 36px;
+  }
+  .topbar-right .icon-btn svg {
+    width: 18px;
+    height: 18px;
+  }
+  /* Keep the account control compact on phones: avatar-only chip, shorter pill. */
+  .account-chip {
+    height: 36px;
+    padding: 0 6px;
+  }
+  .account-handle {
+    display: none;
+  }
+  .signin-pill {
+    height: 36px;
+    padding: 0 12px;
+  }
+}
+
+.topbar-right {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+}
+
+/* The HF user pill: compact avatar + handle. Rendered as a flex row so
+ * the avatar stays aligned with the text baseline even when the text
+ * wraps on narrow viewports. */
+.hf-user {
+  display: inline-flex;
+  align-items: center;
+  gap: 8px;
+  font-size: 13px;
+  color: var(--text-dim);
+  padding: 4px 10px 4px 4px;
+  border-radius: 999px;
+  background: var(--bg-elev);
+  border: 1px solid var(--border);
+  line-height: 1;
+}
+
+.hf-avatar {
+  width: 24px;
+  height: 24px;
+  border-radius: 50%;
+  object-fit: cover;
+  background: color-mix(in srgb, var(--accent) 25%, var(--bg-elev-2));
+  /* Hidden until an actual URL loads (see `setHfAvatar` in main.ts).
+   * Keeps the initial login flash from showing a broken image icon. */
+  opacity: 0;
+  transition: opacity 0.25s ease;
+  flex: none;
+}
+.hf-avatar.loaded {
+  opacity: 1;
+}
+
+.hf-user-name {
+  white-space: nowrap;
+}
+
+/* ─── Transport pill ──────────────────────────────────────────────
+ * Surface the actual network path WebRTC picked for the robot peer
+ * connection (LAN, direct-through-NAT, or TURN-relayed). Lets the
+ * user spot at a glance when audio is going through the internet
+ * instead of staying on-prem.
+ */
+.transport-pill {
+  display: inline-flex;
+  align-items: center;
+  gap: 6px;
+  font-size: 12px;
+  font-weight: 500;
+  letter-spacing: 0.02em;
+  padding: 5px 10px;
+  border-radius: 999px;
+  background: var(--bg-elev);
+  border: 1px solid var(--border);
+  color: var(--text-dim);
+  user-select: none;
+  transition: background 0.2s ease, border-color 0.2s ease, color 0.2s ease;
+}
+
+.transport-pill .transport-dot {
+  width: 7px;
+  height: 7px;
+  border-radius: 50%;
+  background: currentColor;
+  box-shadow: 0 0 0 3px color-mix(in srgb, currentColor 25%, transparent);
+  flex: none;
+}
+
+/* Bitrate readout sits after the kind label. Dimmer + monospace so the
+ * kind (LAN / Direct / Relayed) stays the primary info and the numbers
+ * don't wiggle the layout as digits change. */
+.transport-pill .transport-bitrate {
+  font-family: var(--font-mono);
+  font-size: 11px;
+  font-weight: 500;
+  color: color-mix(in srgb, currentColor 75%, var(--text-dim));
+  opacity: 0.85;
+  padding-left: 6px;
+  border-left: 1px solid color-mix(in srgb, currentColor 25%, transparent);
+}
+.transport-pill .transport-bitrate:empty {
+  display: none;
+}
+
+.transport-pill.transport-checking {
+  color: var(--text-dim);
+}
+.transport-pill.transport-checking .transport-dot {
+  animation: transport-blink 1.2s ease-in-out infinite;
+}
+
+.transport-pill.transport-lan {
+  color: #4ade80;
+  border-color: color-mix(in srgb, #4ade80 35%, var(--border));
+  background: color-mix(in srgb, #4ade80 10%, var(--bg-elev));
+}
+
+.transport-pill.transport-direct {
+  color: #60a5fa;
+  border-color: color-mix(in srgb, #60a5fa 35%, var(--border));
+  background: color-mix(in srgb, #60a5fa 10%, var(--bg-elev));
+}
+
+.transport-pill.transport-relay {
+  color: #fbbf24;
+  border-color: color-mix(in srgb, #fbbf24 35%, var(--border));
+  background: color-mix(in srgb, #fbbf24 10%, var(--bg-elev));
+}
+
+@keyframes transport-blink {
+  0%, 100% { opacity: 1; }
+  50% { opacity: 0.35; }
+}
+
+.icon-btn {
+  background: var(--bg-elev);
+  border: 1px solid var(--border);
+  color: var(--text-dim);
+  width: 36px;
+  height: 36px;
+  border-radius: var(--radius-sm);
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  cursor: pointer;
+  touch-action: manipulation;
+  transition: background 0.15s, color 0.15s, border-color 0.15s;
+}
+.icon-btn:hover {
+  background: var(--bg-elev-2);
+  color: var(--text);
+  border-color: var(--border-strong);
+}
+/* Topbar control cluster reads a touch bigger on desktop. Phones keep the
+ * compact 36px (reset in the mobile media query). */
+.topbar-right .icon-btn {
+  width: 40px;
+  height: 40px;
+}
+.topbar-right .icon-btn svg {
+  width: 20px;
+  height: 20px;
+}
+
+/* ─── Account (HF login chip + sign-in pill + popover) ─────────────────────── */
+.account {
+  position: relative;
+  display: inline-flex;
+  align-items: center;
+}
+/* Signed-out: a compact pill that reads as the primary affordance. */
+.signin-pill {
+  display: inline-flex;
+  align-items: center;
+  gap: 7px;
+  height: 40px;
+  padding: 0 14px;
+  border-radius: var(--radius-sm);
+  border: 1px solid var(--border-strong);
+  background: var(--bg-elev);
+  color: var(--text);
+  font-size: 13px;
+  font-weight: 600;
+  text-decoration: none;
+  transition: background 0.15s, border-color 0.15s;
+}
+.signin-pill svg {
+  width: 16px;
+  height: 16px;
+  flex: none;
+}
+.signin-pill:hover {
+  background: var(--bg-elev-2);
+  border-color: var(--text);
+}
+/* Narrow viewports: collapse the pill to an icon-only square. */
+@media (max-width: 800px) {
+  .signin-pill {
+    gap: 0;
+    width: 40px;
+    padding: 0;
+    justify-content: center;
+  }
+  .signin-pill span {
+    display: none;
+  }
+}
+/* Signed-in: avatar + handle chip. */
+.account-chip {
+  display: inline-flex;
+  align-items: center;
+  gap: 8px;
+  height: 40px;
+  padding: 0 10px 0 6px;
+  border-radius: var(--radius-sm);
+  border: 1px solid var(--border);
+  background: var(--bg-elev);
+  color: var(--text-dim);
+  cursor: pointer;
+  transition: background 0.15s, color 0.15s, border-color 0.15s;
+}
+.account-chip:hover {
+  background: var(--bg-elev-2);
+  color: var(--text);
+  border-color: var(--border-strong);
+}
+.account-avatar {
+  width: 26px;
+  height: 26px;
+  border-radius: 50%;
+  object-fit: cover;
+  flex: none;
+}
+.account-avatar-fallback {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  background: var(--bg-elev-2);
+  color: var(--text);
+  font-size: 12px;
+  font-weight: 700;
+}
+.account-handle {
+  font-size: 13px;
+  font-weight: 600;
+  max-width: 12ch;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+.account-pro {
+  font-size: 10px;
+  font-weight: 700;
+  letter-spacing: 0.04em;
+  padding: 2px 5px;
+  border-radius: 5px;
+  background: var(--text);
+  color: var(--bg);
+}
+/* Org "Team" badge: same pill as PRO, accent-coloured so it reads as
+ * unlimited without claiming a paid PRO subscription. */
+.account-team {
+  background: var(--accent);
+  color: var(--bg);
+}
+.account-pop {
+  position: absolute;
+  top: calc(100% + 8px);
+  right: 0;
+  min-width: 200px;
+  padding: 6px;
+  border-radius: var(--radius-md);
+  border: 1px solid var(--border-strong);
+  background: var(--bg-elev);
+  box-shadow: var(--shadow-soft);
+  z-index: 50;
+}
+.account-pop[hidden] {
+  display: none;
+}
+.account-pop-row {
+  padding: 8px 10px;
+}
+.account-pop-name {
+  font-weight: 600;
+  font-size: 13px;
+}
+.account-pop-meta {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 10px;
+  padding-top: 0;
+  font-size: 12px;
+  color: var(--text-dim);
+}
+.account-tier {
+  font-weight: 600;
+  color: var(--text);
+}
+.account-pop-link {
+  display: block;
+  padding: 8px 10px;
+  border-radius: var(--radius-sm);
+  color: var(--text-dim);
+  font-size: 13px;
+  text-decoration: none;
+  transition: background 0.15s, color 0.15s;
+}
+.account-pop-link:hover {
+  background: var(--bg-elev-2);
+  color: var(--text);
+}
+.account-signout {
+  border-top: 1px solid var(--border);
+  margin-top: 4px;
+  padding-top: 10px;
+  border-radius: 0 0 var(--radius-sm) var(--radius-sm);
+}
+
+/* ─── Daily-limit modal ────────────────────────────────────────────────────── */
+.limit-modal {
+  width: min(400px, 92vw);
+}
+.limit-card {
+  position: relative;
+  align-items: center;
+  text-align: center;
+  gap: 14px;
+  padding: 34px 28px 26px;
+}
+.limit-close {
+  position: absolute;
+  top: 12px;
+  right: 12px;
+}
+/* HF smiling face (brand yellow) on a neutral badge — friendly, not a stop sign.
+ * The logo is the single pop of colour, so the badge itself stays quiet. */
+.limit-badge {
+  width: 66px;
+  height: 66px;
+  border-radius: 50%;
+  display: grid;
+  place-items: center;
+  margin: 2px auto 2px;
+  background: var(--bg-elev-2);
+  border: 1px solid var(--border-strong);
+  box-shadow: 0 0 0 6px rgba(255, 210, 30, 0.06);
+}
+.limit-badge .hf-logo {
+  width: 46px;
+  height: auto;
+}
+.limit-title {
+  margin: 0;
+  font-size: 20px;
+  font-weight: 700;
+  letter-spacing: 0;
+}
+.limit-msg {
+  color: var(--text-dim);
+  font-size: 14px;
+  line-height: 1.55;
+  margin: 0;
+  max-width: 30ch;
+}
+.limit-cta {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  gap: 8px;
+  margin-top: 4px;
+}
+.limit-cta .hf-logo {
+  width: 20px;
+  height: auto;
+  flex: none;
+}
+.limit-note {
+  margin: 0;
+  font-size: 12px;
+  color: var(--text-faint);
+}
+#limit-cta[hidden] {
+  display: none;
+}
+
+/* ─── Stage ───────────────────────────────────────────────────────────── */
+
+.stage {
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  justify-content: center;
+  padding: 24px 24px 32px;
+  gap: 20px;
+}
+
+/* ─── Central circle ──────────────────────────────────────────────────── */
+
+/* Wraps the orb and its two side controls so they stay aligned on one row. */
+.orb-wrap {
+  position: relative;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  gap: clamp(18px, 3vw, 32px);
+}
+
+.circle {
+  position: relative;
+  width: clamp(220px, 38vw, 320px);
+  aspect-ratio: 1 / 1;
+  border-radius: 50%;
+  border: none;
+  background: transparent;
+  padding: 0;
+  cursor: pointer;
+  outline: none;
+  display: grid;
+  place-items: center;
+  color: var(--glow, var(--accent));
+  transition: transform 0.18s ease, filter 0.18s ease;
+  -webkit-tap-highlight-color: transparent;
+  /* Treat taps as immediate clicks (no 300ms delay / double-tap-zoom). */
+  touch-action: manipulation;
+}
+.circle:hover {
+  filter: brightness(1.08);
+}
+.circle:active {
+  transform: scale(0.97);
+  filter: brightness(0.92);
+}
+.circle:focus-visible .circle-core {
+  outline: 2px solid var(--glow, var(--accent));
+  outline-offset: 6px;
+}
+.circle[disabled] {
+  cursor: default;
+  opacity: 0.75;
+}
+
+.circle-glow {
+  position: absolute;
+  inset: 0;
+  border-radius: 50%;
+  background: radial-gradient(circle at center, var(--glow, var(--accent)) 0%, transparent 65%);
+  filter: blur(28px);
+  opacity: 0.5;
+  transform: scale(1);
+  transition: opacity 0.25s, background 0.25s, transform 1.4s ease-in-out;
+  pointer-events: none;
+}
+
+/* Two nested circular rings: the inner tracks the core edge, the outer
+ * expands / fades to convey "audio radiating out" during speaking. */
+.circle-ring,
+.circle-ring-outer {
+  position: absolute;
+  top: 50%;
+  left: 50%;
+  border-radius: 50%;
+  transform: translate(-50%, -50%);
+  pointer-events: none;
+  transition: opacity 0.4s ease, border-color 0.4s ease, transform 0.3s ease;
+}
+.circle-ring {
+  width: 82%;
+  height: 82%;
+  border: 1.5px solid color-mix(in srgb, var(--glow, var(--accent)) 35%, transparent);
+  opacity: 0.35;
+}
+.circle-ring-outer {
+  width: 94%;
+  height: 94%;
+  border: 1px solid color-mix(in srgb, var(--glow, var(--accent)) 22%, transparent);
+  opacity: 0;
+}
+
+.circle-core {
+  position: relative;
+  width: 72%;
+  height: 72%;
+  border-radius: 50%;
+  background: radial-gradient(
+    circle at 35% 28%,
+    color-mix(in srgb, var(--glow, var(--accent)) 28%, transparent),
+    color-mix(in srgb, var(--glow, var(--accent)) 10%, transparent) 55%,
+    color-mix(in srgb, var(--glow, var(--accent)) 5%, transparent)
+  );
+  border: 2px solid color-mix(in srgb, var(--glow, var(--accent)) 40%, transparent);
+  display: grid;
+  place-items: center;
+  box-shadow:
+    0 0 32px color-mix(in srgb, var(--glow, var(--accent)) 22%, transparent),
+    inset 0 0 28px color-mix(in srgb, var(--glow, var(--accent)) 18%, transparent);
+  transition: background 0.4s ease, border-color 0.4s ease, box-shadow 0.4s ease, transform 0.4s ease;
+}
+
+/* Indicator slot: a single SVG / spinner / bar group is visible at a time,
+ * driven by the state class on `.circle`. */
+.circle-indicator {
+  position: relative;
+  width: 44%;
+  height: 44%;
+  display: grid;
+  place-items: center;
+  color: var(--glow, var(--accent));
+}
+.circle-indicator > .ind {
+  grid-area: 1 / 1;
+  opacity: 0;
+  transform: scale(0.85);
+  transition: opacity 0.25s ease, transform 0.25s ease;
+  pointer-events: none;
+}
+.circle-indicator > svg.ind {
+  width: 60%;
+  height: 60%;
+}
+
+/* Spinner: a rotating ring gap, CSS-only.
+ *
+ * Note: the base `.circle-indicator > .ind` rule forces `transform:
+ * scale(.85)` / `scale(1)` on every indicator to drive the show/hide
+ * transition. If we only rotate here, the browser has to interpolate
+ * between `scale(1)` and `rotate(360deg)` (two different transform
+ * functions), which produces a broken, barely-moving animation. So we
+ * include the scale explicitly in the keyframes and bump specificity
+ * with `!important` so the spinner always wins over the state rule. */
+.ind-spinner {
+  width: 48%;
+  height: 48%;
+  border: 3px solid currentColor;
+  border-right-color: transparent;
+  border-radius: 50%;
+  opacity: 0;
+  animation: ind-spin 0.9s linear infinite;
+}
+
+/* Thinking dots: 3 soft pulsing dots while the model is composing a
+ * response. Apple-style cadence: each dot scales up and brightens in
+ * turn, staggered by ~160 ms. Per-dot animation is on the child, so
+ * the parent's scale(.85 → 1) show/hide transform composes cleanly. */
+.ind-thinking {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  gap: 8px;
+  width: 60%;
+  height: 60%;
+}
+.ind-thinking .dot {
+  width: 10px;
+  height: 10px;
+  border-radius: 50%;
+  background: currentColor;
+  opacity: 0.3;
+  animation: thinking-dot 1.25s ease-in-out infinite;
+}
+.ind-thinking .dot:nth-child(1) { animation-delay: 0s; }
+.ind-thinking .dot:nth-child(2) { animation-delay: 0.16s; }
+.ind-thinking .dot:nth-child(3) { animation-delay: 0.32s; }
+
+/* Bars: 5 vertical pills driven by --bar0..--bar4 CSS vars. */
+.ind-bars {
+  display: flex;
+  align-items: center;
+  gap: 5px;
+  height: 42%;
+}
+.ind-bars .bar {
+  width: 4px;
+  min-height: 4px;
+  border-radius: 3px;
+  background: currentColor;
+  opacity: 0.7;
+  --h: var(--bar0, 0);
+  height: calc(4px + var(--h) * 36px);
+  transition: height 0.08s ease-out, opacity 0.08s ease-out;
+}
+.ind-bars .bar:nth-child(1) { --h: var(--bar0); }
+.ind-bars .bar:nth-child(2) { --h: var(--bar1); }
+.ind-bars .bar:nth-child(3) { --h: var(--bar2); }
+.ind-bars .bar:nth-child(4) { --h: var(--bar3); }
+.ind-bars .bar:nth-child(5) { --h: var(--bar4); }
+.ind-bars .bar {
+  opacity: calc(0.55 + 0.45 * var(--h));
+}
+
+/* Active indicator per state.
+ *
+ * Note: `ai-speaking` deliberately has NO indicator here. The orb
+ * itself becomes the indicator by pulsing on Reachy's voice (see the
+ * `--ai-audio-level` rules further down), which is a lot clearer and
+ * less confusing than reusing the mic-bars (which viewers would read
+ * as "you are speaking"). */
+.state-signed-out .ind-connect,
+.state-authenticated .ind-mic,
+.state-ready .ind-mic,
+.state-connecting .ind-spinner,
+.state-connected .ind-spinner,
+.state-auto-selecting .ind-spinner,
+.state-starting .ind-spinner,
+.state-processing .ind-thinking,
+.state-listening .ind-bars,
+.state-user-speaking .ind-bars,
+.state-ai-speaking .ind-voice,
+.state-error .ind-error {
+  opacity: 1;
+  transform: scale(1);
+}
+
+/* AI speaking indicator: speaker + two sound waves.
+ *
+ * Each wave pulses outward (opacity + stroke grow) with a quarter-
+ * beat offset so it reads as sound radiating out. Kept as a pure
+ * CSS animation so the icon is always visually alive even between
+ * syllables when --ai-audio-level momentarily dips. */
+.ind-voice .wave {
+  transform-origin: 50% 50%;
+  animation: voice-wave 1.35s ease-out infinite;
+}
+.ind-voice .wave-1 { animation-delay: 0s; }
+.ind-voice .wave-2 { animation-delay: 0.35s; }
+
+/* Idle indicators: a chain-link "connect" glyph for the signed-out
+ * step (invites the user to authenticate with HF) and a microphone
+ * once a session is ready. Both picked up by the generic
+ * `.circle-indicator > svg.ind` sizing rule (60% × 60% of the slot)
+ * and rely on per-state opacity transitions for show / hide. */
+.ind-connect,
+.ind-mic {
+  color: color-mix(in srgb, var(--glow, var(--accent)) 85%, white);
+}
+
+/* ─── Caption below the circle ────────────────────────────────────────── */
+
+/* The caption under the orb is meant to whisper, not shout: micro-label
+ * vibe, uppercase, letter-spaced, muted. Only appears for actionable /
+ * transitional states (see STATE_VIEWS). During a live conversation the
+ * orb alone carries the state so we collapse this row entirely. */
+.circle-caption {
+  margin: 0;
+  font-family: var(--font-mono);
+  font-size: 11px;
+  font-weight: 500;
+  letter-spacing: 0.14em;
+  text-transform: uppercase;
+  color: var(--text-faint);
+  min-height: 1.2em;
+  text-align: center;
+  opacity: 0.75;
+  transition: opacity 0.25s ease, color 0.25s ease, transform 0.25s ease,
+    min-height 0.25s ease;
+}
+.circle-caption.empty {
+  opacity: 0;
+  min-height: 0;
+  transform: translateY(-4px);
+  pointer-events: none;
+}
+.circle-caption.muted {
+  color: var(--text-faint);
+  opacity: 0.65;
+}
+.circle-caption.error {
+  color: var(--error);
+  opacity: 1;
+  letter-spacing: 0.08em;
+}
+
+/* ─── Tool-call toaster ───────────────────────────────────────────────── */
+
+/* A small, non-interactive pill that appears below the circle when the
+ * model invokes a tool (move_head, play_move). Sits just under the
+ * state caption, collapses to zero height when no toast is active. */
+.tool-toast {
+  display: inline-flex;
+  align-items: center;
+  gap: 8px;
+  margin-top: 10px;
+  padding: 6px 12px;
+  border-radius: 999px;
+  border: 1px solid var(--border-strong);
+  background: color-mix(in srgb, var(--bg-elev-2) 78%, transparent);
+  color: var(--text-dim);
+  font-size: 12px;
+  font-weight: 500;
+  letter-spacing: 0.01em;
+  line-height: 1;
+  white-space: nowrap;
+  max-width: 80vw;
+  overflow: hidden;
+  text-overflow: ellipsis;
+
+  opacity: 0;
+  transform: translateY(-4px) scale(0.96);
+  pointer-events: none;
+  transition: opacity 0.22s ease, transform 0.22s ease;
+}
+.tool-toast.visible {
+  opacity: 1;
+  transform: translateY(0) scale(1);
+}
+.tool-toast-icon {
+  width: 14px;
+  height: 14px;
+  flex: none;
+  color: color-mix(in srgb, var(--voice-tool) 80%, white);
+  animation: tool-toast-spin 3.2s linear infinite;
+  animation-play-state: paused;
+}
+.tool-toast.visible .tool-toast-icon {
+  animation-play-state: running;
+}
+.tool-toast-text {
+  display: inline-block;
+  overflow: hidden;
+  text-overflow: ellipsis;
+}
+@keyframes tool-toast-spin {
+  from { transform: rotate(0deg); }
+  to   { transform: rotate(360deg); }
+}
+
+/* ─── Side controls (mic / stop) ──────────────────────────────────────── */
+
+/* Mic button + its radial noise-gate arc. The wrapper centres the button; the
+   arc SVG is an absolute overlay larger than the button, revealed with the
+   live session (it has no layout footprint, so the idle collapse is unaffected). */
+.mic-gate {
+  position: relative;
+  flex: none;
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+}
+.mic-gate-arc {
+  position: absolute;
+  left: 50%;
+  top: 50%;
+  width: 80px;
+  height: 80px;
+  transform: translate(-50%, -50%);
+  pointer-events: none; /* only the hit-path below catches drags */
+  opacity: 0;
+  transition: opacity 0.25s ease;
+}
+.orb-wrap.live .mic-gate-arc { opacity: 1; }
+.mga-track {
+  stroke: rgba(255, 255, 255, 0.1); /* hairline; recedes until needed */
+  stroke-width: 1.5;
+  stroke-linecap: round;
+}
+.mga-fill {
+  stroke: var(--accent-2);
+  stroke-width: 2;
+  stroke-linecap: round;
+  opacity: 0.85;
+  transition: stroke-dashoffset 0.06s linear;
+}
+/* Threshold setpoint: a bead riding the ring. White with a thin dark outline so
+   it stays legible over the moving fill; it recolors to cyan with a soft glow
+   the moment the live level crosses it (the gate opening). */
+.mga-handle {
+  fill: var(--text);
+  stroke: none;
+  transition: fill 0.2s ease, filter 0.2s ease;
+}
+.mic-gate.gate-open .mga-handle {
+  fill: var(--accent-2);
+  filter: drop-shadow(0 0 3px var(--accent-2));
+}
+.mga-hit {
+  stroke: transparent;
+  stroke-width: 16;
+  pointer-events: none; /* enabled only while live (below) */
+  cursor: pointer;
+  touch-action: none;
+}
+/* Only catch drags during a live call; when idle the arc is hidden and must
+   not steal clicks near the collapsed mic button / orb. */
+.orb-wrap.live .mga-hit { pointer-events: stroke; }
+
+.side-btn {
+  flex: none;
+  width: 52px;
+  height: 52px;
+  border-radius: 50%;
+  border: 1px solid var(--border-strong);
+  /* Brighter background so the buttons actually stand out against the
+   * deep-blue stage gradient; previous var(--bg-elev) was too close to
+   * the page bg to be readable. */
+  background: color-mix(in srgb, var(--bg-elev-2) 80%, #2a2e3c);
+  color: var(--text);
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  cursor: pointer;
+  touch-action: manipulation;
+  box-shadow: 0 6px 16px rgba(0, 0, 0, 0.35),
+    inset 0 1px 0 rgba(255, 255, 255, 0.06);
+  /* Hidden by default: take up no space until the session is live. The
+   * `width: 0` collapse keeps the orb centered on the idle screen. */
+  opacity: 0;
+  transform: scale(0.55);
+  width: 0;
+  padding: 0;
+  pointer-events: none;
+  overflow: hidden;
+  transition: opacity 0.25s ease, transform 0.25s ease, width 0.25s ease,
+    background 0.15s, color 0.15s, border-color 0.15s;
+}
+.side-btn:hover {
+  background: color-mix(in srgb, var(--bg-elev-2) 60%, #323746);
+  border-color: var(--text-dim);
+}
+.side-btn svg {
+  width: 22px;
+  height: 22px;
+  flex: none;
+}
+.side-btn .mic-off { display: none; }
+.side-btn.muted {
+  color: #fff;
+  border-color: var(--error);
+  background: color-mix(in srgb, var(--error) 70%, #1a0e13);
+}
+.side-btn.muted .mic-on { display: none; }
+.side-btn.muted .mic-off { display: block; }
+
+/* Stop button: subtle warm tint so "end" reads as destructive. */
+#stop-btn:hover {
+  color: #fff;
+  border-color: color-mix(in srgb, var(--error) 60%, var(--border-strong));
+  background: color-mix(in srgb, var(--error) 25%, var(--bg-elev-2));
+}
+
+/* Reveal when the session is live: buttons flank the orb on a flex row. */
+.orb-wrap.live .side-btn {
+  opacity: 1;
+  transform: scale(1);
+  width: 52px;
+  pointer-events: auto;
+}
+
+/* Disable every transition / animation during the first paint so the
+ * orb doesn't fade-and-scale in when the page loads. `main.ts` removes
+ * the class after one animation frame. */
+body.booting,
+body.booting *,
+body.booting *::before,
+body.booting *::after {
+  transition: none !important;
+  animation-duration: 0s !important;
+  animation-delay: 0s !important;
+}
+
+/* ─── Circle animation keyframes ──────────────────────────────────────── */
+
+/* Slow, subtle breathing for "warm idle" states. */
+@keyframes breathe {
+  0%, 100% { transform: translate(-50%, -50%) scale(1); opacity: 0.4; }
+  50%      { transform: translate(-50%, -50%) scale(1.06); opacity: 0.15; }
+}
+
+/* Outer ring expanding and fading - conveys "I am producing audio". */
+@keyframes ring-out {
+  0%   { transform: translate(-50%, -50%) scale(1); opacity: 0.35; }
+  100% { transform: translate(-50%, -50%) scale(1.18); opacity: 0; }
+}
+
+/* Soft inner scale for the core while talking. */
+@keyframes core-breathe {
+  0%, 100% { transform: scale(1); }
+  50%      { transform: scale(1.04); }
+}
+
+/* Subtle glow throb used for "thinking" — dimmer than speaking. */
+@keyframes thinking {
+  0%, 100% { transform: scale(1); opacity: 0.7; }
+  50%      { transform: scale(0.96); opacity: 0.45; }
+}
+
+/* Individual dot pulse for the 3-dot processing indicator. */
+@keyframes thinking-dot {
+  0%, 60%, 100% { transform: scale(0.7); opacity: 0.3; }
+  30%           { transform: scale(1.15); opacity: 1; }
+}
+
+/* Sound-wave pulse: arc fades in, scales up slightly, fades out.
+ * The transform-origin is the speaker's center (roughly x=12), so
+ * the waves feel like they're emanating from the cone. */
+@keyframes voice-wave {
+  0%   { opacity: 0; transform: scale(0.7); }
+  30%  { opacity: 1; transform: scale(1); }
+  70%  { opacity: 0.2; transform: scale(1.12); }
+  100% { opacity: 0; transform: scale(0.7); }
+}
+
+@keyframes ind-spin {
+  /* Scale kept at 1 so we don't fight with the indicator's base
+   * show/hide transform (see `.ind-spinner` for the rationale). */
+  from { transform: scale(1) rotate(0deg); }
+  to   { transform: scale(1) rotate(360deg); }
+}
+
+/* ─── State-specific colors ──────────────────────────────────────────── */
+
+.circle.state-signed-out   { --glow: #8b7dff; }
+.circle.state-authenticated,
+.circle.state-ready        { --glow: #34d399; }
+.circle.state-connecting,
+.circle.state-connected,
+.circle.state-auto-selecting,
+.circle.state-starting     { --glow: #facc15; }
+.circle.state-listening,
+.circle.state-user-speaking { --glow: var(--listening); }
+.circle.state-processing   { --glow: var(--processing); }
+.circle.state-ai-speaking  { --glow: var(--speaking); }
+.circle.state-error        { --glow: var(--error); }
+
+/* Idle / ready: gentle breathing of the inner ring. Kept out of the
+ * `signed-out` state so the very first paint on page load stays quiet
+ * (the orb now shows the Reachy head silhouette, no need to also pulse). */
+.circle.state-authenticated .circle-ring,
+.circle.state-ready .circle-ring {
+  animation: breathe 2.4s ease-in-out infinite;
+}
+
+/* Connecting flows: subtle glow throb so the orb feels thoughtful
+ * while the session is being negotiated. Kept off `processing` on
+ * purpose - the 3 thinking dots already pulse, and layering another
+ * throb on top competes with them for attention. */
+.circle.state-connecting .circle-core,
+.circle.state-connected .circle-core,
+.circle.state-auto-selecting .circle-core,
+.circle.state-starting .circle-core {
+  animation: thinking 1.4s ease-in-out infinite;
+}
+
+/* User is speaking: the mic RMS drives scale + opacity via --audio-level. */
+.circle.state-user-speaking .circle-ring {
+  animation: none;
+  opacity: calc(0.25 + 0.55 * var(--audio-level));
+  transform: translate(-50%, -50%) scale(calc(1 + 0.08 * var(--audio-level)));
+  transition: transform 0.08s linear, opacity 0.08s linear;
+}
+.circle.state-user-speaking .circle-ring-outer {
+  opacity: calc(0.1 + 0.35 * var(--audio-level));
+  transform: translate(-50%, -50%) scale(calc(1 + 0.12 * var(--audio-level)));
+  transition: transform 0.08s linear, opacity 0.08s linear;
+}
+.circle.state-listening .circle-ring {
+  animation: breathe 2s ease-in-out infinite;
+}
+
+/* Assistant is speaking: the whole orb breathes in sync with Reachy's
+ * voice instead of running a fixed timer. `--ai-audio-level` (0-1) is
+ * updated at display rate by AiLevelMonitor from the OpenAI output
+ * track, so every syllable visibly moves the core + outer ring. This
+ * reads instantly as "the orb is the voice" and completely avoids the
+ * ambiguity of bars-vs-mic the user flagged. */
+.circle.state-ai-speaking .circle-core {
+  animation: none;
+  transform: scale(calc(1 + 0.09 * var(--ai-audio-level, 0)));
+  transition: transform 0.08s linear;
+}
+.circle.state-ai-speaking .circle-ring {
+  animation: none;
+  opacity: calc(0.3 + 0.5 * var(--ai-audio-level, 0));
+  transform: translate(-50%, -50%) scale(calc(1 + 0.05 * var(--ai-audio-level, 0)));
+  transition: transform 0.08s linear, opacity 0.08s linear;
+}
+.circle.state-ai-speaking .circle-ring-outer {
+  animation: none;
+  opacity: calc(0.15 + 0.55 * var(--ai-audio-level, 0));
+  transform: translate(-50%, -50%) scale(calc(1 + 0.18 * var(--ai-audio-level, 0)));
+  transition: transform 0.08s linear, opacity 0.08s linear;
+}
+.circle.state-ai-speaking .circle-glow {
+  opacity: calc(0.35 + 0.45 * var(--ai-audio-level, 0));
+  transition: opacity 0.08s linear;
+}
+
+/* ─── Robot picker ────────────────────────────────────────────────────── */
+
+.robot-picker {
+  width: min(420px, 92vw);
+  background: var(--bg-elev);
+  border: 1px solid var(--border);
+  border-radius: var(--radius-md);
+  padding: 14px 16px;
+  box-shadow: var(--shadow-soft);
+}
+
+.picker-title {
+  margin: 0 0 10px;
+  font-size: 11px;
+  font-weight: 600;
+  letter-spacing: 0.1em;
+  text-transform: uppercase;
+  color: var(--text-faint);
+}
+
+.robot-list {
+  display: flex;
+  flex-direction: column;
+  gap: 8px;
+}
+
+.robot-card {
+  display: flex;
+  justify-content: space-between;
+  align-items: center;
+  padding: 12px 14px;
+  border: 1px solid var(--border);
+  border-radius: var(--radius-sm);
+  background: var(--bg-elev-2);
+  cursor: pointer;
+  transition: border-color 0.15s, background 0.15s;
+}
+.robot-card:hover {
+  border-color: var(--border-strong);
+}
+.robot-card.selected {
+  border-color: var(--border-strong);
+  background: var(--bg-elev);
+}
+
+.robot-card .name {
+  font-weight: 600;
+  font-size: 14px;
+}
+.robot-card .id {
+  font-family: var(--font-mono);
+  font-size: 12px;
+  color: var(--text-faint);
+}
+
+.robot-empty {
+  padding: 14px;
+  text-align: center;
+  color: var(--text-faint);
+  font-size: 13px;
+}
+
+/* ─── Footer ──────────────────────────────────────────────────────────── */
+
+.footer {
+  padding: 12px 28px 18px;
+  font-size: 11px;
+  letter-spacing: 0.02em;
+  color: var(--text-faint);
+  display: flex;
+  justify-content: center;
+  opacity: 0.55;
+  transition: opacity 0.25s ease;
+}
+.footer:hover {
+  opacity: 0.9;
+}
+.footer a {
+  color: inherit;
+  text-decoration: none;
+  border-bottom: 1px dotted currentColor;
+}
+.footer a:hover {
+  color: var(--text-dim);
+}
+/* While the webcam preview sits bottom-left, push the credit to the
+ * bottom-right so the two don't collide. */
+body.cam-on .footer {
+  justify-content: flex-end;
+}
+
+/* ─── Modal ───────────────────────────────────────────────────────────── */
+
+.modal {
+  border: 1px solid var(--border);
+  border-radius: var(--radius-md);
+  padding: 0;
+  background: var(--bg-elev);
+  color: var(--text);
+  width: min(440px, 92vw);
+  box-shadow: var(--shadow-soft);
+}
+.modal::backdrop {
+  background: rgba(8, 9, 13, 0.65);
+  backdrop-filter: blur(4px);
+}
+
+.modal-content {
+  display: flex;
+  flex-direction: column;
+  gap: 16px;
+  padding: 22px 24px 20px;
+}
+
+.modal-header {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  margin-bottom: 4px;
+}
+.modal-header h2 {
+  margin: 0;
+  font-size: 16px;
+  font-weight: 600;
+  letter-spacing: 0.02em;
+}
+
+.field[hidden] { display: none; }
+.field {
+  display: flex;
+  flex-direction: column;
+  gap: 6px;
+  font-size: 13px;
+  font-weight: 500;
+  color: var(--text-dim);
+}
+.field > span {
+  color: var(--text);
+  font-weight: 600;
+  font-size: 12px;
+  letter-spacing: 0.04em;
+  text-transform: uppercase;
+}
+.field input,
+.field select,
+.field textarea {
+  font-family: inherit;
+  font-size: 14px;
+  color: var(--text);
+  background: var(--bg);
+  border: 1px solid var(--border);
+  border-radius: var(--radius-sm);
+  padding: 10px 12px;
+  outline: none;
+  transition: border-color 0.15s;
+  resize: vertical;
+}
+.field textarea {
+  min-height: 84px;
+}
+.field input:focus,
+.field select:focus,
+.field textarea:focus {
+  border-color: var(--text-dim);
+}
+.field small {
+  color: var(--text-faint);
+  font-size: 12px;
+  line-height: 1.4;
+}
+.field small.error { color: var(--error); }
+.field small code {
+  background: var(--bg);
+  padding: 1px 5px;
+  border-radius: 4px;
+  border: 1px solid var(--border);
+}
+
+/* Noise gate: a header with a live value, a level meter, and a range slider
+   that shares the meter's horizontal (dB) axis. */
+.field-head {
+  display: flex;
+  align-items: baseline;
+  justify-content: space-between;
+}
+.field-value {
+  font-weight: 500;
+  font-size: 12px;
+  letter-spacing: 0;
+  text-transform: none;
+  color: var(--text-dim);
+}
+/* The slider and the level meter are one widget: the range input is overlaid
+   on the meter track (its native track is transparent), so the live-level fill
+   shows through behind the thumb and the thumb itself is the threshold. */
+.gate {
+  display: flex;
+  flex-direction: column;
+  gap: 4px;
+}
+.gate-track {
+  position: relative;
+  height: 14px;
+  display: flex;
+  align-items: center;
+}
+.gate-track::before {
+  /* the visible meter track */
+  content: "";
+  position: absolute;
+  left: 0;
+  right: 0;
+  height: 8px;
+  border-radius: 999px;
+  background: var(--bg);
+  border: 1px solid var(--border);
+}
+.gate-meter-fill {
+  position: absolute;
+  left: 1px;
+  top: 50%;
+  transform: translateY(-50%);
+  height: 6px;
+  width: 0;
+  border-radius: 999px;
+  background: var(--accent-2);
+  transition: width 0.06s linear;
+  pointer-events: none;
+}
+.gate-ends {
+  display: flex;
+  justify-content: space-between;
+  font-size: 11px;
+  color: var(--text-faint);
+  letter-spacing: 0;
+  text-transform: none;
+}
+/* The range input sits transparently on top of the meter track. */
+.gate-track input[type="range"] {
+  position: relative;
+  z-index: 1;
+  width: 100%;
+  margin: 0;
+  -webkit-appearance: none;
+  appearance: none;
+  padding: 0;
+  border: none;
+  background: transparent;
+  height: 14px;
+  cursor: pointer;
+}
+.gate-track input[type="range"]::-webkit-slider-runnable-track {
+  height: 14px;
+  background: transparent;
+}
+.gate-track input[type="range"]::-moz-range-track {
+  height: 14px;
+  background: transparent;
+}
+.gate-track input[type="range"]::-webkit-slider-thumb {
+  -webkit-appearance: none;
+  appearance: none;
+  width: 6px;
+  height: 18px;
+  border-radius: 3px;
+  background: var(--text);
+  border: 2px solid var(--bg-elev);
+  box-shadow: 0 0 0 1px var(--border-strong);
+}
+.gate-track input[type="range"]::-moz-range-thumb {
+  width: 6px;
+  height: 18px;
+  border-radius: 3px;
+  background: var(--text);
+  border: 2px solid var(--bg-elev);
+  box-shadow: 0 0 0 1px var(--border-strong);
+}
+.gate-track input[type="range"]:focus { border: none; }
+
+.modal-footer {
+  display: flex;
+  justify-content: space-between;
+  gap: 12px;
+  padding-top: 6px;
+}
+
+.btn {
+  padding: 10px 16px;
+  border-radius: var(--radius-sm);
+  border: 1px solid var(--border-strong);
+  background: var(--bg-elev-2);
+  color: var(--text);
+  font-weight: 600;
+  font-size: 13px;
+  cursor: pointer;
+  transition: background 0.15s, border-color 0.15s, transform 0.05s;
+}
+.btn:hover {
+  border-color: var(--text);
+}
+.btn:active {
+  transform: translateY(1px);
+}
+.btn.primary {
+  background: var(--text);
+  border-color: var(--text);
+  color: var(--bg);
+}
+.btn.primary:hover {
+  background: #fff;
+  border-color: #fff;
+}
+.btn.ghost {
+  background: transparent;
+  border-color: var(--border);
+  color: var(--text-dim);
+}
+.btn.wide {
+  width: 100%;
+  padding: 12px 16px;
+}
+.btn[disabled] {
+  opacity: 0.45;
+  cursor: not-allowed;
+}
+.btn[disabled]:hover {
+  border-color: var(--border-strong);
+}
+
+/* ─── Settings tabs ───────────────────────────────────────────────────── */
+
+.tabs {
+  display: flex;
+  gap: 4px;
+  padding: 4px;
+  background: var(--bg);
+  border: 1px solid var(--border);
+  border-radius: var(--radius-sm);
+}
+.tab {
+  flex: 1;
+  padding: 8px 12px;
+  border: none;
+  background: transparent;
+  color: var(--text-dim);
+  font-family: inherit;
+  font-size: 13px;
+  font-weight: 600;
+  letter-spacing: 0.02em;
+  border-radius: calc(var(--radius-sm) - 3px);
+  cursor: pointer;
+  transition: background 0.15s, color 0.15s;
+}
+.tab:hover {
+  color: var(--text);
+}
+.tab.active {
+  background: var(--bg-elev-2);
+  color: var(--text);
+  box-shadow: 0 1px 2px rgba(0, 0, 0, 0.3);
+}
+
+.tab-panels {
+  display: flex;
+  flex-direction: column;
+}
+.tab-panel {
+  display: flex;
+  flex-direction: column;
+  gap: 16px;
+}
+.tab-panel[hidden] {
+  display: none;
+}
+
+/* Horizontal layout for Voice + Model. */
+.field-row {
+  display: grid;
+  grid-template-columns: 1fr 1fr;
+  gap: 12px;
+}
+
+/* ─── Chat button + badge ────────────────────────────────────────────── */
+
+#chat-btn {
+  position: relative;
+}
+
+.chat-badge {
+  position: absolute;
+  top: 6px;
+  right: 6px;
+  width: 7px;
+  height: 7px;
+  border-radius: 50%;
+  background: var(--text);
+  border: 1.5px solid var(--bg-elev);
+  opacity: 0;
+  transform: scale(0);
+  transition: opacity 0.2s ease, transform 0.2s ease;
+  pointer-events: none;
+}
+.chat-badge.visible {
+  opacity: 1;
+  transform: scale(1);
+}
+
+/* ─── Ephemeral bubble stack ─────────────────────────────────────────── */
+
+.bubble-stack {
+  position: fixed;
+  /* Clear the topbar control row so the first bubble doesn't sit at the same
+   * height as the buttons. */
+  top: 96px;
+  right: 28px;
+  width: min(300px, calc(100vw - 56px));
+  display: flex;
+  flex-direction: column;
+  gap: 8px;
+  pointer-events: none;
+  z-index: 100;
+}
+
+.bubble {
+  --bubble-dx: 10px;
+  pointer-events: auto;
+  padding: 10px 14px;
+  border-radius: var(--radius-md);
+  font-size: 13px;
+  line-height: 1.5;
+  border: 1px solid var(--border);
+  background: var(--bg-elev);
+  box-shadow: 0 4px 18px rgba(0, 0, 0, 0.32);
+  max-width: 100%;
+  word-break: break-word;
+  opacity: 0;
+  transform: translateX(var(--bubble-dx));
+  transition: opacity 0.22s ease, transform 0.22s ease;
+}
+.bubble.in {
+  opacity: 1;
+  transform: translateX(0);
+}
+.bubble.out {
+  opacity: 0;
+  transform: translateX(var(--bubble-dx));
+  pointer-events: none;
+  transition: opacity 0.3s ease, transform 0.3s ease;
+}
+
+/* Surfaces stay neutral; the side they sit on plus the mono role label
+ * carry the distinction. No tinted fills — color is the orb's job. */
+.bubble.user {
+  --bubble-dx: -10px;
+  align-self: flex-start;
+}
+.bubble.assistant {
+  --bubble-dx: 10px;
+  align-self: flex-end;
+}
+.bubble.tool {
+  --bubble-dx: -10px;
+  align-self: flex-start;
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  color: var(--text-dim);
+  font-family: var(--font-mono);
+  font-size: 12px;
+}
+.bubble.tool .bubble-tool-icon {
+  width: 13px;
+  height: 13px;
+  flex: none;
+  color: var(--voice-tool);
+}
+
+.bubble-role {
+  font-family: var(--font-mono);
+  font-size: 10px;
+  font-weight: 500;
+  letter-spacing: 0.1em;
+  text-transform: uppercase;
+  margin-bottom: 4px;
+  opacity: 0.7;
+}
+.bubble.user .bubble-role { color: var(--voice-user); }
+.bubble.assistant .bubble-role { color: var(--voice-assistant); }
+
+/* ─── Conversation history panel ─────────────────────────────────────── */
+
+.chat-panel {
+  position: fixed;
+  inset: 0;
+  z-index: 200;
+  pointer-events: none;
+}
+.chat-panel-backdrop {
+  position: absolute;
+  inset: 0;
+  background: rgba(8, 9, 13, 0.45);
+  backdrop-filter: blur(6px);
+  -webkit-backdrop-filter: blur(6px);
+  opacity: 0;
+  transition: opacity 0.25s ease;
+}
+.chat-panel.open .chat-panel-backdrop {
+  opacity: 1;
+  pointer-events: auto;
+}
+.chat-panel-inner {
+  position: absolute;
+  top: 0;
+  right: 0;
+  bottom: 0;
+  width: min(360px, 90vw);
+  background: var(--bg-elev);
+  border-left: 1px solid var(--border);
+  display: flex;
+  flex-direction: column;
+  transform: translateX(100%);
+  transition: transform 0.28s cubic-bezier(0.32, 0.72, 0, 1);
+  pointer-events: auto;
+  box-shadow: -8px 0 32px rgba(0, 0, 0, 0.35);
+}
+.chat-panel.open .chat-panel-inner {
+  transform: translateX(0);
+}
+.chat-panel-header {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  padding: 18px 20px;
+  border-bottom: 1px solid var(--border);
+  flex: none;
+}
+.chat-panel-header h3 {
+  margin: 0;
+  font-size: 14px;
+  font-weight: 600;
+  letter-spacing: 0.01em;
+}
+.chat-history {
+  flex: 1;
+  overflow-y: auto;
+  padding: 16px 20px;
+  display: flex;
+  flex-direction: column;
+  gap: 10px;
+  scroll-behavior: smooth;
+}
+.chat-history::-webkit-scrollbar { width: 3px; }
+.chat-history::-webkit-scrollbar-track { background: transparent; }
+.chat-history::-webkit-scrollbar-thumb { background: var(--border-strong); border-radius: 3px; }
+
+.chat-empty {
+  flex: 1;
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  justify-content: center;
+  gap: 6px;
+  color: var(--text-faint);
+  padding: 48px 0;
+  opacity: 0.65;
+}
+.chat-empty svg {
+  margin-bottom: 6px;
+  opacity: 0.8;
+}
+.chat-empty-title {
+  font-family: var(--font-mono);
+  font-size: 11px;
+  font-weight: 500;
+  letter-spacing: 0.14em;
+  text-transform: uppercase;
+}
+.chat-empty-hint {
+  font-size: 12px;
+  color: var(--text-faint);
+  opacity: 0.7;
+}
+
+/* ─── History messages ───────────────────────────────────────────────── */
+
+.hist-msg {
+  display: flex;
+  flex-direction: column;
+  gap: 3px;
+  max-width: 88%;
+}
+.hist-msg.user { align-self: flex-start; }
+.hist-msg.assistant { align-self: flex-end; }
+.hist-msg.tool { align-self: flex-start; max-width: 100%; }
+
+.hist-role {
+  font-family: var(--font-mono);
+  font-size: 10px;
+  font-weight: 500;
+  letter-spacing: 0.1em;
+  text-transform: uppercase;
+  color: var(--text-faint);
+  padding: 0 2px;
+}
+.hist-msg.user .hist-role { color: color-mix(in srgb, var(--voice-user) 75%, var(--text-faint)); }
+.hist-msg.assistant .hist-role { color: color-mix(in srgb, var(--voice-assistant) 75%, var(--text-faint)); }
+.hist-msg.tool .hist-role { color: color-mix(in srgb, var(--voice-tool) 75%, var(--text-faint)); }
+
+.hist-body {
+  padding: 9px 12px;
+  border-radius: var(--radius-md);
+  font-size: 13px;
+  line-height: 1.5;
+  border: 1px solid var(--border);
+  background: var(--bg-elev-2);
+  word-break: break-word;
+}
+/* Bodies share one neutral surface; alignment + the mono role label do the
+ * distinguishing, so the panel reads as one quiet column. */
+.hist-msg.user .hist-body.partial { opacity: 0.65; }
+
+/* ─── Tool call history item ─────────────────────────────────────────── */
+
+.hist-tool-header {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  padding: 8px 12px;
+  border-radius: var(--radius-md) var(--radius-md) 0 0;
+  background: color-mix(in srgb, var(--processing) 10%, var(--bg-elev-2));
+  border: 1px solid color-mix(in srgb, var(--processing) 22%, var(--border));
+  border-bottom: 1px solid color-mix(in srgb, var(--processing) 15%, var(--border));
+  cursor: pointer;
+  color: var(--text);
+  font-family: inherit;
+  font-size: 13px;
+  font-weight: 500;
+  width: 100%;
+  text-align: left;
+  transition: background 0.15s;
+}
+.hist-tool-header:only-child {
+  border-radius: var(--radius-md);
+  border-bottom: 1px solid color-mix(in srgb, var(--processing) 22%, var(--border));
+}
+.hist-tool-header:hover {
+  background: color-mix(in srgb, var(--processing) 16%, var(--bg-elev-2));
+}
+.hist-tool-icon {
+  width: 13px;
+  height: 13px;
+  flex: none;
+  color: var(--processing);
+}
+.hist-tool-name {
+  font-family: var(--font-mono);
+  font-size: 12px;
+  color: var(--voice-tool);
+  font-weight: 600;
+}
+.hist-tool-chevron {
+  margin-left: auto;
+  width: 13px;
+  height: 13px;
+  color: var(--text-faint);
+  transition: transform 0.2s ease;
+  flex: none;
+}
+.hist-tool-header[aria-expanded="true"] .hist-tool-chevron {
+  transform: rotate(180deg);
+}
+.hist-tool-body {
+  padding: 10px 12px 12px;
+  border-radius: 0 0 var(--radius-md) var(--radius-md);
+  background: var(--bg);
+  border: 1px solid color-mix(in srgb, var(--processing) 22%, var(--border));
+  border-top: none;
+  display: none;
+}
+.hist-tool-body.open { display: block; }
+.hist-tool-label {
+  font-family: var(--font-mono);
+  font-size: 10px;
+  letter-spacing: 0.08em;
+  text-transform: uppercase;
+  color: var(--text-faint);
+  margin: 8px 0 4px;
+}
+.hist-tool-label:first-child { margin-top: 0; }
+.hist-tool-block {
+  font-family: var(--font-mono);
+  font-size: 11px;
+  line-height: 1.65;
+  color: var(--text-dim);
+  white-space: pre-wrap;
+  word-break: break-word;
+  overflow-x: auto;
+}
+.hist-tool-output { color: var(--text); }
+
+/* ─── Phone layout ────────────────────────────────────────────────────────
+ * On phones the floating bubble stream overlaps the orb and there isn't room
+ * for it, so we drop it entirely and rely on the conversation panel (opened
+ * from the top-right chat button) as the single place to read the transcript.
+ * The badge still pulses there when new messages arrive while it's closed.
+ * We also stack the mic / stop controls above and below the orb (instead of
+ * left/right) so the wide live row never overflows, and let the panel take
+ * the full width. */
+@media (max-width: 600px) {
+  .bubble-stack {
+    display: none;
+  }
+
+  .topbar {
+    padding: 14px 16px;
+  }
+
+  .stage {
+    padding: 16px 12px 24px;
+  }
+
+  /* Stack vertically: mic above the orb, stop below it (DOM order is
+   * mic → circle → stop). */
+  .orb-wrap {
+    flex-direction: column;
+    gap: 14px;
+  }
+
+  .circle {
+    width: clamp(170px, 56vw, 240px);
+  }
+
+  /* In the column layout the side controls must collapse by HEIGHT, not
+   * width, so they take no vertical space until the session is live. */
+  .side-btn {
+    width: 44px;
+    height: 0;
+    transition: opacity 0.25s ease, transform 0.25s ease, height 0.25s ease,
+      background 0.15s, color 0.15s, border-color 0.15s;
+  }
+  .side-btn svg {
+    width: 19px;
+    height: 19px;
+  }
+  .orb-wrap.live .side-btn {
+    width: 44px;
+    height: 44px;
+  }
+  .mic-gate-arc { width: 70px; height: 70px; }
+
+  /* Full-screen conversation on phones — feels more deliberate than a
+   * narrow slide-over. It already spans top-to-bottom (inset 0); make it
+   * span edge-to-edge too and drop the now-pointless border/shadow. */
+  .chat-panel-inner {
+    width: 100vw;
+    border-left: none;
+    box-shadow: none;
+  }
+}
+
+/* ─── About panel ─────────────────────────────────────────────────────────
+ * Opened from the (i) by the wordmark. Reuses the <dialog> .modal shell.
+ * Strictly monochrome per DESIGN.md — the only "color" is the orb, never
+ * here. Machine identifiers (model IDs, role tags, usernames) ride Geist
+ * Mono; everything human stays Inter. */
+.about-modal {
+  /* Roomier on tablet/desktop; the 92vw cap keeps phones full-width. */
+  width: min(680px, 92vw);
+  max-height: 88vh;
+}
+.about-modal .modal-content {
+  max-height: 88vh;
+  overflow-y: auto;
+  gap: 20px;
+  padding: 26px 30px 24px;
+}
+.about-modal .modal-content::-webkit-scrollbar { width: 3px; }
+.about-modal .modal-content::-webkit-scrollbar-track { background: transparent; }
+.about-modal .modal-content::-webkit-scrollbar-thumb { background: var(--border-strong); border-radius: 3px; }
+
+/* Links here are quiet: no permanent underline (the global dotted rule is
+ * too loud for a dense credit block), brighten + underline on hover only. */
+.about-modal a {
+  color: var(--text);
+  border-bottom: none;
+  text-decoration: none;
+  transition: color 0.15s ease;
+}
+.about-modal a:hover {
+  color: #fff;
+}
+.about-intro a:hover {
+  text-decoration: underline;
+  text-underline-offset: 2px;
+}
+.about-modal .ext {
+  width: 12px;
+  height: 12px;
+  flex: none;
+  opacity: 0.5;
+}
+
+/* Title row: the demo name and the (i) read as one unit. */
+.ident-head {
+  display: flex;
+  align-items: center;
+  gap: 9px;
+}
+/* (i) trigger sits right after the title. A faint outline keeps it
+ * catchable without turning into a card; it fills in on hover. */
+.about-btn {
+  flex: none;
+  width: 34px;
+  height: 34px;
+  border-radius: 50%;
+  background: transparent;
+  border: 1px solid var(--border-strong);
+  color: var(--text-dim);
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  cursor: pointer;
+  touch-action: manipulation;
+  transition: background 0.15s ease, color 0.15s ease, border-color 0.15s ease;
+}
+.about-btn:hover {
+  background: var(--bg-elev);
+  border-color: var(--text-dim);
+  color: var(--text);
+}
+.about-btn svg {
+  width: 20px;
+  height: 20px;
+}
+
+/* The mobile twin of (i) lives in the right-hand control cluster and is
+ * hidden on desktop (the in-title one shows there instead). */
+.about-btn-mobile {
+  display: none;
+}
+
+/* ── Popup intro: a plain paragraph on the project + a repo link ── */
+.about-intro p {
+  margin: 0;
+  font-size: 14px;
+  line-height: 1.6;
+  color: var(--text-dim);
+}
+.about-repo {
+  display: inline-flex;
+  align-items: center;
+  gap: 5px;
+  margin-top: 12px;
+  font-size: 14px;
+  font-weight: 500;
+}
+
+/* ── Corner identity (replaces the wordmark) ──
+ * A compact stack in the topbar: title, one-line blurb, two meta rows.
+ * Monochrome; only the role/name identifiers ride the machine typeface. */
+.ident {
+  display: flex;
+  flex-direction: column;
+  gap: 10px;
+  min-width: 0;
+}
+/* Reset the global underlined-anchor styling inside the identity block. */
+.ident a {
+  border-bottom: none;
+  color: inherit;
+  transition: color 0.15s ease;
+}
+.ident a:hover {
+  color: var(--text);
+  text-decoration: underline;
+  text-underline-offset: 2px;
+}
+.ident-title {
+  font-size: 22px;
+  font-weight: 600;
+  letter-spacing: 0.005em;
+  line-height: 1.1;
+  color: var(--text);
+}
+.ident-blurb {
+  margin: 0;
+  max-width: 48ch;
+  font-size: 14.5px;
+  line-height: 1.5;
+  font-weight: 400;
+  color: var(--text-dim);
+}
+.ident-meta {
+  display: flex;
+  flex-direction: column;
+  gap: 7px;
+  font-size: 14px;
+  font-weight: 400;
+  color: var(--text-dim);
+}
+.ident-row {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  gap: 4px 8px;
+}
+.ident-label {
+  font-family: var(--font-mono);
+  font-size: 11px;
+  font-weight: 500;
+  letter-spacing: 0.1em;
+  text-transform: uppercase;
+  color: var(--text-faint);
+}
+
+/* Shared credit bits — now used in the corner identity block. */
+.sep {
+  color: var(--text-faint);
+  opacity: 0.6;
+}
+.hf-credit {
+  display: inline-flex;
+  align-items: center;
+  gap: 5px;
+}
+/* Brand marks keep their own color — a deliberate exception to the
+ * monochrome rule, for the HF and Cerebras logos only. */
+.hf-mark {
+  width: 14px;
+  height: 14px;
+  flex: none;
+  color: #ffd21e;
+}
+.cerebras-credit {
+  display: inline-flex;
+  align-items: center;
+  gap: 5px;
+}
+.cerebras-mark {
+  width: 14px;
+  height: 14px;
+  flex: none;
+}
+/* Usernames are identifiers, so they ride the machine typeface. */
+.handle {
+  font-family: var(--font-mono);
+  font-size: 13.5px;
+}
+
+/* ── Pipeline (the signal flow) ── */
+.about-pipeline {
+  border-top: 1px solid var(--border);
+  padding-top: 16px;
+}
+.pipeline-title {
+  margin: 0 0 14px;
+  font-family: var(--font-mono);
+  font-size: 11px;
+  font-weight: 500;
+  letter-spacing: 0.14em;
+  text-transform: uppercase;
+  color: var(--text-faint);
+}
+.pipeline {
+  list-style: none;
+  margin: 0;
+  padding: 0;
+  position: relative;
+}
+/* One continuous rail threading every node, dot centers at x=8.5px. */
+.pipeline::before {
+  content: "";
+  position: absolute;
+  left: 8px;
+  top: 7px;
+  bottom: 7px;
+  width: 1px;
+  background: var(--border-strong);
+}
+.pipeline > li {
+  position: relative;
+  padding-left: 30px;
+}
+/* Stages: solid node. Endpoints (you / orb): hollow node. */
+.pipe-stage::before {
+  content: "";
+  position: absolute;
+  left: 5px;
+  top: 4px;
+  width: 7px;
+  height: 7px;
+  border-radius: 50%;
+  background: var(--text-dim);
+}
+.pipe-endpoint::before {
+  content: "";
+  position: absolute;
+  left: 5px;
+  top: 3px;
+  width: 7px;
+  height: 7px;
+  border-radius: 50%;
+  border: 1px solid var(--text-faint);
+  background: var(--bg-elev);
+}
+.pipe-endpoint {
+  font-family: var(--font-mono);
+  font-size: 11px;
+  font-weight: 500;
+  letter-spacing: 0.12em;
+  text-transform: uppercase;
+  color: var(--text-faint);
+  padding-bottom: 12px;
+}
+.pipeline > li.pipe-endpoint:last-child {
+  padding-bottom: 0;
+}
+.pipe-stage {
+  padding-bottom: 16px;
+}
+.pipe-tag {
+  font-family: var(--font-mono);
+  font-size: 12px;
+  font-weight: 600;
+  letter-spacing: 0.08em;
+  color: var(--text);
+  margin-right: 9px;
+}
+.pipe-job {
+  font-size: 14px;
+  color: var(--text-dim);
+}
+/* Middot between the job and its model link, matching the separators
+ * used elsewhere. */
+.pipe-job::after {
+  content: "·";
+  margin: 0 7px;
+  color: var(--text-faint);
+}
+.pipe-note {
+  color: var(--text-faint);
+}
+/* The Cerebras link stays as quiet as the note; brightens + underlines on hover. */
+.pipe-note a {
+  color: inherit;
+}
+.pipe-note a:hover {
+  color: var(--text);
+  text-decoration: underline;
+  text-underline-offset: 2px;
+}
+.pipe-model {
+  display: inline-flex;
+  align-items: center;
+  gap: 4px;
+  margin-top: 4px;
+  font-family: var(--font-mono);
+  font-size: 12px;
+  color: var(--text-dim);
+  word-break: break-all;
+}
+.pipe-model:hover {
+  color: #fff;
+  text-decoration: underline;
+  text-underline-offset: 2px;
+}
+.pipe-model .ext {
+  width: 11px;
+  height: 11px;
+}
+
+/* "Interrupted" tag on an assistant reply the user barged in on. */
+.hist-note {
+  font-family: var(--font-mono);
+  font-size: 10px;
+  font-weight: 500;
+  letter-spacing: 0.1em;
+  text-transform: uppercase;
+  color: var(--text-faint);
+  padding: 0 2px;
+}
+.hist-msg.assistant .hist-note {
+  align-self: flex-end;
+}
+.hist-msg.interrupted .hist-body {
+  opacity: 0.7;
+}
+
+/* Captured webcam frame shown in the transcript (camera tool result). */
+.hist-image {
+  display: block;
+  width: 100%;
+  max-width: 240px;
+  border-radius: var(--radius-sm);
+  border: 1px solid var(--border);
+  margin-top: 2px;
+}
+
+/* ─── Tools panel ──────────────────────────────────────────────────────────
+ * Reuses the modal/field shell. Switches are monochrome (checked = near-white,
+ * the same high-contrast treatment as the primary button): color belongs to
+ * the voice, not the chrome. */
+.tools-intro {
+  margin: 0;
+  font-size: 13px;
+  line-height: 1.5;
+  color: var(--text-dim);
+}
+.tool-list {
+  display: flex;
+  flex-direction: column;
+}
+.tool-row {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 16px;
+  padding: 12px 0;
+}
+.tool-row-sep {
+  border-top: 1px solid var(--border);
+  margin-top: 4px;
+}
+.tool-info {
+  display: flex;
+  flex-direction: column;
+  gap: 3px;
+  min-width: 0;
+}
+.tool-name {
+  font-size: 14px;
+  font-weight: 600;
+  color: var(--text);
+}
+.tool-desc {
+  font-size: 12.5px;
+  color: var(--text-dim);
+}
+.tool-row.disabled .tool-name,
+.tool-row.disabled .tool-desc {
+  opacity: 0.5;
+}
+.tool-hint {
+  display: block;
+  font-size: 12px;
+  line-height: 1.4;
+  color: var(--text-faint);
+}
+.tools-key {
+  margin: 0 0 4px;
+}
+
+/* Toggle switch */
+.switch {
+  position: relative;
+  display: inline-flex;
+  flex: none;
+  width: 40px;
+  height: 24px;
+  cursor: pointer;
+}
+.switch input {
+  position: absolute;
+  inset: 0;
+  width: 100%;
+  height: 100%;
+  margin: 0;
+  opacity: 0;
+  cursor: pointer;
+}
+.switch-track {
+  position: absolute;
+  inset: 0;
+  border-radius: 999px;
+  background: var(--bg);
+  border: 1px solid var(--border-strong);
+  transition: background 0.15s, border-color 0.15s;
+}
+.switch-track::after {
+  content: "";
+  position: absolute;
+  top: 50%;
+  left: 3px;
+  transform: translateY(-50%);
+  width: 16px;
+  height: 16px;
+  border-radius: 50%;
+  background: var(--text-dim);
+  transition: transform 0.18s ease, background 0.15s;
+}
+.switch input:checked + .switch-track {
+  background: var(--text);
+  border-color: var(--text);
+}
+.switch input:checked + .switch-track::after {
+  transform: translate(16px, -50%);
+  background: var(--bg);
+}
+.switch input:focus-visible + .switch-track {
+  outline: 2px solid var(--text-dim);
+  outline-offset: 2px;
+}
+.switch input:disabled {
+  cursor: not-allowed;
+}
+.switch input:disabled + .switch-track {
+  opacity: 0.5;
+}
+
+/* ─── Webcam preview (camera tool) ──────────────────────────────────────────
+ * Floating self-view, bottom-left. Mirrored for the user; the frame sent to
+ * the model is drawn un-mirrored (see captureSnapshot). */
+.cam-pip {
+  position: fixed;
+  left: 20px;
+  bottom: 20px;
+  width: 280px;
+  aspect-ratio: 4 / 3;
+  border-radius: var(--radius-md);
+  overflow: hidden;
+  border: 1px solid var(--border-strong);
+  background: var(--bg-elev);
+  box-shadow: var(--shadow-soft);
+  z-index: 90;
+  opacity: 0;
+  transform: translateY(8px) scale(0.96);
+  pointer-events: none;
+  transition: opacity 0.22s ease, transform 0.22s ease;
+}
+.cam-pip.visible {
+  opacity: 1;
+  transform: none;
+}
+.cam-video {
+  display: block;
+  width: 100%;
+  height: 100%;
+  object-fit: cover;
+  transform: scaleX(-1); /* mirror the self-view only */
+  background: var(--bg);
+}
+.cam-label {
+  position: absolute;
+  left: 8px;
+  bottom: 6px;
+  font-family: var(--font-mono);
+  font-size: 9.5px;
+  letter-spacing: 0.14em;
+  text-transform: uppercase;
+  color: var(--text);
+  opacity: 0.8;
+  text-shadow: 0 1px 3px rgba(0, 0, 0, 0.7);
+}
+.cam-flash {
+  position: absolute;
+  inset: 0;
+  background: #fff;
+  opacity: 0;
+  pointer-events: none;
+}
+.cam-pip.flash .cam-flash {
+  animation: cam-flash 0.4s ease;
+}
+@keyframes cam-flash {
+  0% { opacity: 0; }
+  12% { opacity: 0.85; }
+  100% { opacity: 0; }
+}
+@media (max-width: 600px) {
+  /* Bottom-centred on phones. Auto margins centre it without touching the
+   * transform, so the slide/scale-in animation still works. */
+  .cam-pip {
+    left: 0;
+    right: 0;
+    margin-inline: auto;
+    bottom: 16px;
+    width: min(188px, 52vw);
+  }
+  /* The credit would sit under the centred preview, so drop it while the
+   * camera is on. */
+  body.cam-on .footer {
+    display: none;
+  }
+}
+@media (prefers-reduced-motion: reduce) {
+  .cam-pip {
+    transition: opacity 0.22s ease;
+    transform: none;
+  }
+  .cam-pip.flash .cam-flash {
+    animation: none;
+  }
+}
+
+/* ─── Desktop type scale ────────────────────────────────────────────────────
+ * A uniform step up (~+1px, title +2) for all UI text on larger screens.
+ * Scoped to min-width: 601px so it can't reach phones — the ≤600px layout
+ * keeps every size exactly as it was. */
+@media (min-width: 601px) {
+  .cam-label { font-size: 10.5px; }
+
+  .bubble-role,
+  .hist-role { font-size: 11px; }
+
+  .circle-caption,
+  .footer,
+  .chat-empty-title,
+  .hist-tool-block,
+  .ident-label,
+  .pipeline-title,
+  .pipe-endpoint { font-size: 12px; }
+
+  .field > span,
+  .field small,
+  .bubble.tool,
+  .chat-empty-hint,
+  .hist-tool-name,
+  .pipe-tag,
+  .pipe-model,
+  .tool-hint { font-size: 13px; }
+
+  .tool-desc { font-size: 13.5px; }
+
+  .btn,
+  .bubble,
+  .field,
+  .hist-body,
+  .hist-tool-header,
+  .tools-intro { font-size: 14px; }
+
+  .handle { font-size: 14.5px; }
+
+  .about-intro p,
+  .about-repo,
+  .brand,
+  .chat-panel-header h3,
+  .field textarea,
+  .ident-meta,
+  .pipe-job,
+  .tool-name { font-size: 15px; }
+
+  .ident-blurb { font-size: 15.5px; }
+
+  .modal-header h2 { font-size: 17px; }
+
+  .ident-title { font-size: 24px; }
+}

ui/account.js

@@ -0,0 +1,178 @@
+// @ts-check
+/**
+ * Account — the HF login chip and the daily-limit modal.
+ *
+ * Reads `/api/me` to learn the current tier (anonymous / signed-in / PRO) and
+ * remaining daily talk-time, renders a sign-in pill or a signed-in chip with a
+ * small popover (tier, remaining, sign out, upgrade), and shows the limit modal
+ * when a conversation is refused or cut. The time metering itself lives in
+ * main.js (heartbeat loop) + the server; this module is just the surface.
+ *
+ * Inert unless the deploy is in LB mode (`/api/me` → `{enabled:true}`).
+ */
+
+import { $, escHtml } from "./dom.js";
+
+const PRO_URL = "https://huggingface.co/subscribe/pro";
+
+// Official multi-color Hugging Face logo, used in the badge + sign-in CTA.
+const HF_MARK = `<svg class="hf-logo" viewBox="0 0 95 88" fill="none" aria-hidden="true"><path fill="#FFD21E" d="M47.21 76.5a34.75 34.75 0 1 0 0-69.5 34.75 34.75 0 0 0 0 69.5Z"/><path fill="#FF9D0B" d="M81.96 41.75a34.75 34.75 0 1 0-69.5 0 34.75 34.75 0 0 0 69.5 0Zm-73.5 0a38.75 38.75 0 1 1 77.5 0 38.75 38.75 0 0 1-77.5 0Z"/><path fill="#3A3B45" d="M58.5 32.3c1.28.44 1.78 3.06 3.07 2.38a5 5 0 1 0-6.76-2.07c.61 1.15 2.55-.72 3.7-.32ZM34.95 32.3c-1.28.44-1.79 3.06-3.07 2.38a5 5 0 1 1 6.76-2.07c-.61 1.15-2.56-.72-3.7-.32Z"/><path fill="#FF323D" d="M46.96 56.29c9.83 0 13-8.76 13-13.26 0-2.34-1.57-1.6-4.09-.36-2.33 1.15-5.46 2.74-8.9 2.74-7.19 0-13-6.88-13-2.38s3.16 13.26 13 13.26Z"/><path fill="#3A3B45" fill-rule="evenodd" d="M39.43 54a8.7 8.7 0 0 1 5.3-4.49c.4-.12.81.57 1.24 1.28.4.68.82 1.37 1.24 1.37.45 0 .9-.68 1.33-1.35.45-.7.89-1.38 1.32-1.25a8.61 8.61 0 0 1 5 4.17c3.73-2.94 5.1-7.74 5.1-10.7 0-2.34-1.57-1.6-4.09-.36l-.14.07c-2.31 1.15-5.39 2.67-8.77 2.67s-6.45-1.52-8.77-2.67c-2.6-1.29-4.23-2.1-4.23.29 0 3.05 1.46 8.06 5.47 10.97Z" clip-rule="evenodd"/><path fill="#FF9D0B" d="M70.71 37a3.25 3.25 0 1 0 0-6.5 3.25 3.25 0 0 0 0 6.5ZM24.21 37a3.25 3.25 0 1 0 0-6.5 3.25 3.25 0 0 0 0 6.5ZM17.52 48c-1.62 0-3.06.66-4.07 1.87a5.97 5.97 0 0 0-1.33 3.76 7.1 7.1 0 0 0-1.94-.3c-1.55 0-2.95.59-3.94 1.66a5.8 5.8 0 0 0-.8 7 5.3 5.3 0 0 0-1.79 2.82c-.24.9-.48 2.8.8 4.74a5.22 5.22 0 0 0-.37 5.02c1.02 2.32 3.57 4.14 8.52 6.1 3.07 1.22 5.89 2 5.91 2.01a44.33 44.33 0 0 0 10.93 1.6c5.86 0 10.05-1.8 12.46-5.34 3.88-5.69 3.33-10.9-1.7-15.92-2.77-2.78-4.62-6.87-5-7.77-.78-2.66-2.84-5.62-6.25-5.62a5.7 5.7 0 0 0-4.6 2.46c-1-1.26-1.98-2.25-2.86-2.82A7.4 7.4 0 0 0 17.52 48Zm0 4c.51 0 1.14.22 1.82.65 2.14 1.36 6.25 8.43 7.76 11.18.5.92 1.37 1.31 2.14 1.31 1.55 0 2.75-1.53.15-3.48-3.92-2.93-2.55-7.72-.68-8.01.08-.02.17-.02.24-.02 1.7 0 2.45 2.93 2.45 2.93s2.2 5.52 5.98 9.3c3.77 3.77 3.97 6.8 1.22 10.83-1.88 2.75-5.47 3.58-9.16 3.58-3.81 0-7.73-.9-9.92-1.46-.11-.03-13.45-3.8-11.76-7 .28-.54.75-.76 1.34-.76 2.38 0 6.7 3.54 8.57 3.54.41 0 .7-.17.83-.6.79-2.85-12.06-4.05-10.98-8.17.2-.73.71-1.02 1.44-1.02 3.14 0 10.2 5.53 11.68 5.53.11 0 .2-.03.24-.1.74-1.2.33-2.04-4.9-5.2-5.21-3.16-8.88-5.06-6.8-7.33.24-.26.58-.38 1-.38 3.17 0 10.66 6.82 10.66 6.82s2.02 2.1 3.25 2.1c.28 0 .52-.1.68-.38.86-1.46-8.06-8.22-8.56-11.01-.34-1.9.24-2.85 1.31-2.85Z"/><path fill="#FFD21E" d="M38.6 76.69c2.75-4.04 2.55-7.07-1.22-10.84-3.78-3.77-5.98-9.3-5.98-9.3s-.82-3.2-2.69-2.9c-1.87.3-3.24 5.08.68 8.01 3.91 2.93-.78 4.92-2.29 2.17-1.5-2.75-5.62-9.82-7.76-11.18-2.13-1.35-3.63-.6-3.13 2.2.5 2.79 9.43 9.55 8.56 11-.87 1.47-3.93-1.71-3.93-1.71s-9.57-8.71-11.66-6.44c-2.08 2.27 1.59 4.17 6.8 7.33 5.23 3.16 5.64 4 4.9 5.2-.75 1.2-12.28-8.53-13.36-4.4-1.08 4.11 11.77 5.3 10.98 8.15-.8 2.85-9.06-5.38-10.74-2.18-1.7 3.21 11.65 6.98 11.76 7.01 4.3 1.12 15.25 3.49 19.08-2.12Z"/><path fill="#FF9D0B" d="M77.4 48c1.62 0 3.07.66 4.07 1.87a5.97 5.97 0 0 1 1.33 3.76 7.1 7.1 0 0 1 1.95-.3c1.55 0 2.95.59 3.94 1.66a5.8 5.8 0 0 1 .8 7 5.3 5.3 0 0 1 1.78 2.82c.24.9.48 2.8-.8 4.74a5.22 5.22 0 0 1 .37 5.02c-1.02 2.32-3.57 4.14-8.51 6.1-3.08 1.22-5.9 2-5.92 2.01a44.33 44.33 0 0 1-10.93 1.6c-5.86 0-10.05-1.8-12.46-5.34-3.88-5.69-3.33-10.9 1.7-15.92 2.78-2.78 4.63-6.87 5.01-7.77.78-2.66 2.83-5.62 6.24-5.62a5.7 5.7 0 0 1 4.6 2.46c1-1.26 1.98-2.25 2.87-2.82A7.4 7.4 0 0 1 77.4 48Zm0 4c-.51 0-1.13.22-1.82.65-2.13 1.36-6.25 8.43-7.76 11.18a2.43 2.43 0 0 1-2.14 1.31c-1.54 0-2.75-1.53-.14-3.48 3.91-2.93 2.54-7.72.67-8.01a1.54 1.54 0 0 0-.24-.02c-1.7 0-2.45 2.93-2.45 2.93s-2.2 5.52-5.97 9.3c-3.78 3.77-3.98 6.8-1.22 10.83 1.87 2.75 5.47 3.58 9.15 3.58 3.82 0 7.73-.9 9.93-1.46.1-.03 13.45-3.8 11.76-7-.29-.54-.75-.76-1.34-.76-2.38 0-6.71 3.54-8.57 3.54-.42 0-.71-.17-.83-.6-.8-2.85 12.05-4.05 10.97-8.17-.19-.73-.7-1.02-1.44-1.02-3.14 0-10.2 5.53-11.68 5.53-.1 0-.19-.03-.23-.1-.74-1.2-.34-2.04 4.88-5.2 5.23-3.16 8.9-5.06 6.8-7.33-.23-.26-.57-.38-.98-.38-3.18 0-10.67 6.82-10.67 6.82s-2.02 2.1-3.24 2.1a.74.74 0 0 1-.68-.38c-.87-1.46 8.05-8.22 8.55-11.01.34-1.9-.24-2.85-1.31-2.85Z"/><path fill="#FFD21E" d="M56.33 76.69c-2.75-4.04-2.56-7.07 1.22-10.84 3.77-3.77 5.97-9.3 5.97-9.3s.82-3.2 2.7-2.9c1.86.3 3.23 5.08-.68 8.01-3.92 2.93.78 4.92 2.28 2.17 1.51-2.75 5.63-9.82 7.76-11.18 2.13-1.35 3.64-.6 3.13 2.2-.5 2.79-9.42 9.55-8.55 11 .86 1.47 3.92-1.71 3.92-1.71s9.58-8.71 11.66-6.44c2.08 2.27-1.58 4.17-6.8 7.33-5.23 3.16-5.63 4-4.9 5.2.75 1.2 12.28-8.53 13.36-4.4 1.08 4.11-11.76 5.3-10.97 8.15.8 2.85 9.05-5.38 10.74-2.18 1.69 3.21-11.65 6.98-11.76 7.01-4.31 1.12-15.26 3.49-19.08-2.12Z"/></svg>`;
+
+/** @param {number} sec @returns {string} "m:ss" */
+function fmt(sec) {
+  const s = Math.max(0, Math.round(sec));
+  return `${Math.floor(s / 60)}:${String(s % 60).padStart(2, "0")}`;
+}
+
+export class Account {
+  constructor() {
+    /** @type {HTMLElement} */
+    this._root = $("#account");
+    /** @type {HTMLDialogElement} */
+    this._modal = $("#limit-modal");
+    this._modalTitle = $("#limit-title");
+    this._modalMsg = $("#limit-msg");
+    this._modalNote = $("#limit-note");
+    /** @type {HTMLAnchorElement} */
+    this._modalCta = /** @type {any} */ ($("#limit-cta"));
+
+    /** @type {{enabled:boolean, auth?:boolean, loggedIn?:boolean, username?:string, avatar?:string, tier?:string, remainingSec?:number|null, limitSec?:number|null, loginUrl?:string|null, logoutUrl?:string|null}} */
+    this._me = { enabled: false };
+    this._popoverOpen = false;
+
+    $("#limit-close").addEventListener("click", () => this._modal.close());
+    this._modal.addEventListener("click", (e) => {
+      if (e.target === this._modal) this._modal.close();
+    });
+    // Close the popover on an outside click.
+    document.addEventListener("click", (e) => {
+      if (this._popoverOpen && !this._root.contains(/** @type {Node} */ (e.target))) {
+        this._closePopover();
+      }
+    });
+  }
+
+  get tier() {
+    return this._me.tier || "anon";
+  }
+
+  /** Fetch `/api/me` and (re)render the chip. Safe to call repeatedly (load,
+   *  after the OAuth redirect, after a conversation ends). */
+  async refresh() {
+    try {
+      const res = await fetch("api/me");
+      this._me = res.ok ? await res.json() : { enabled: false };
+    } catch {
+      this._me = { enabled: false };
+    }
+    this._render();
+  }
+
+  _render() {
+    const me = this._me;
+    if (!me.enabled) {
+      this._root.hidden = true;
+      this._root.innerHTML = "";
+      return;
+    }
+    this._root.hidden = false;
+
+    if (!me.loggedIn) {
+      // Signed-out: a sign-in pill (only when OAuth is actually available).
+      if (me.auth && me.loginUrl) {
+        this._root.innerHTML = `<a class="signin-pill" href="${escHtml(me.loginUrl)}" title="Sign in for more time"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M15 3h4a2 2 0 0 1 2 2v14a2 2 0 0 1-2 2h-4"/><polyline points="10 17 15 12 10 7"/><line x1="15" y1="12" x2="3" y2="12"/></svg><span>Sign in</span></a>`;
+      } else {
+        this._root.innerHTML = "";
+        this._root.hidden = true;
+      }
+      return;
+    }
+
+    // Signed-in: avatar + handle chip that toggles a popover.
+    const isPro = me.tier === "pro";
+    // Org members get unlimited usage too, but aren't PRO — don't brand them so.
+    const isUnlimited = isPro || me.tier === "org";
+    const avatar = me.avatar
+      ? `<img class="account-avatar" src="${escHtml(me.avatar)}" alt="" />`
+      : `<span class="account-avatar account-avatar-fallback">${escHtml((me.username || "?")[0].toUpperCase())}</span>`;
+    const remaining =
+      isUnlimited || me.remainingSec == null
+        ? "Unlimited"
+        : `${fmt(me.remainingSec)} left today`;
+    const tierLabel = isPro ? "PRO" : isUnlimited ? "Team" : "Free";
+
+    this._root.innerHTML = `
+      <button id="account-chip" class="account-chip" aria-haspopup="true" aria-expanded="false">
+        ${avatar}
+        <span class="account-handle">${escHtml(me.username || "you")}</span>
+        ${isPro
+          ? '<span class="account-pro">PRO</span>'
+          : me.tier === "org"
+            ? '<span class="account-pro account-team">TEAM</span>'
+            : ""}
+      </button>
+      <div id="account-pop" class="account-pop" hidden>
+        <div class="account-pop-row account-pop-name">${escHtml(me.username || "you")}</div>
+        <div class="account-pop-row account-pop-meta">
+          <span class="account-tier">${tierLabel}</span>
+          <span class="account-remaining">${escHtml(remaining)}</span>
+        </div>
+        ${isUnlimited ? "" : `<a class="account-pop-link" href="${PRO_URL}" target="_blank" rel="noopener">Upgrade to PRO</a>`}
+        <a class="account-pop-link account-signout" href="${escHtml(me.logoutUrl || "#")}">Sign out</a>
+      </div>`;
+
+    const chip = $("#account-chip");
+    chip.addEventListener("click", (e) => {
+      e.stopPropagation();
+      this._popoverOpen ? this._closePopover() : this._openPopover();
+    });
+  }
+
+  _openPopover() {
+    const pop = document.getElementById("account-pop");
+    const chip = document.getElementById("account-chip");
+    if (!pop || !chip) return;
+    pop.hidden = false;
+    chip.setAttribute("aria-expanded", "true");
+    this._popoverOpen = true;
+  }
+
+  _closePopover() {
+    const pop = document.getElementById("account-pop");
+    const chip = document.getElementById("account-chip");
+    if (pop) pop.hidden = true;
+    if (chip) chip.setAttribute("aria-expanded", "false");
+    this._popoverOpen = false;
+  }
+
+  /**
+   * Show the limit modal for a tier — used both when a conversation is refused
+   * at start (402) and when a live one is cut (heartbeat `expired`).
+   * @param {string} [tier]
+   */
+  showLimit(tier = this.tier) {
+    const canSignIn = this._me.auth && this._me.loginUrl;
+    this._modalTitle.textContent = "Thanks for chatting!";
+    if (tier === "anon") {
+      this._modalMsg.textContent =
+        "Guest conversations run for 5 minutes. Sign in with Hugging Face to get 10 minutes a day for free, and PRO members chat with no limit at all.";
+      this._modalNote.textContent = "Your free minutes refresh tomorrow.";
+      if (canSignIn) {
+        this._modalCta.innerHTML = `${HF_MARK}<span>Sign in with Hugging Face</span>`;
+        this._modalCta.href = /** @type {string} */ (this._me.loginUrl);
+        this._modalCta.hidden = false;
+      } else {
+        this._modalCta.hidden = true;
+      }
+    } else {
+      // Signed-in, non-PRO.
+      this._modalMsg.textContent =
+        "You've enjoyed your 10 minutes for today. Go PRO for unlimited conversations and to support open source AI.";
+      this._modalNote.textContent = "Or come back tomorrow. Your minutes reset daily.";
+      this._modalCta.innerHTML = "<span>Upgrade to PRO</span>";
+      this._modalCta.href = PRO_URL;
+      this._modalCta.hidden = false;
+    }
+    if (!this._modal.open) this._modal.showModal();
+  }
+}

ui/chat.js

@@ -0,0 +1,425 @@
+// @ts-check
+/**
+ * ChatView — owns the whole conversation surface: the slide-in history panel,
+ * the ephemeral on-orb bubbles, and all the transcript/tool/streaming
+ * bookkeeping. main.js wires the realtime client's events straight to the
+ * `on*` methods here and otherwise doesn't touch chat state.
+ *
+ * Two parallel surfaces share one shape (see `_buildMessageEl`):
+ *   - ephemeral bubbles  (`.bubble` / `.bubble-*`)  fade on a timer
+ *   - persistent history (`.hist-msg` / `.hist-*`)  the durable panel log
+ *
+ * Keying:
+ *   - user transcripts by the server's `item_id` — a speculative continuation
+ *     REUSES it, so both segments land in one row/bubble; deltas are CUMULATIVE
+ *     (each carries the full sentence so far), so we replace text wholesale.
+ *   - assistant transcripts by `response_id`, so a cancelled speculative reply
+ *     can be marked interrupted without erasing what was already shown.
+ */
+
+import { $, escHtml, DEBUG } from "./dom.js";
+
+const WRENCH_PATH = `<path d="M14.7 6.3a1 1 0 0 0 0 1.4l1.6 1.6a1 1 0 0 0 1.4 0l3.77-3.77a6 6 0 0 1-7.94 7.94l-6.91 6.91a2.12 2.12 0 0 1-3-3l6.91-6.91a6 6 0 0 1 7.94-7.94l-3.76 3.76z"/>`;
+const CHAT_BUBBLE_SVG = `<svg width="28" height="28" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"><path d="M21 15a2 2 0 0 1-2 2H7l-4 4V5a2 2 0 0 1 2-2h14a2 2 0 0 1 2 2z"/></svg>`;
+const EMPTY_STATE_HTML = `<div id="chat-empty" class="chat-empty">${CHAT_BUBBLE_SVG}<span class="chat-empty-title">No messages yet</span><span class="chat-empty-hint">Tap the orb and start talking</span></div>`;
+
+export class ChatView {
+  constructor() {
+    /** @type {HTMLButtonElement} */
+    this._chatBtn = $("#chat-btn");
+    /** @type {HTMLSpanElement} */
+    this._chatBadge = $("#chat-badge");
+    /** @type {HTMLDivElement} */
+    this._chatPanel = $("#chat-panel");
+    /** @type {HTMLDivElement} */
+    this._chatPanelBackdrop = $("#chat-panel-backdrop");
+    /** @type {HTMLButtonElement} */
+    this._chatPanelClose = $("#chat-panel-close");
+    /** @type {HTMLDivElement} */
+    this._chatHistory = $("#chat-history");
+    /** @type {HTMLDivElement} */
+    this._bubbleStack = $("#bubble-stack");
+
+    this._panelOpen = false;
+    this._scrollQueued = false;
+
+    // ── User transcript state (keyed by item_id) ───────────────────────────
+    /** @type {Map<string, HTMLElement>} */
+    this._userHistByItem = new Map();
+    /** @type {HTMLElement | null} */
+    this._activeUserBubble = null;
+    this._activeUserItemId = "";
+    // Monotonic counter for synthesizing unique keys when the server omits an
+    // item_id / response_id, so id-less messages never collapse onto each other.
+    this._anonSeq = 0;
+
+    // ── Assistant transcript state (keyed by response_id) ──────────────────
+    /** @type {Map<string, { bubble: HTMLElement, hist: HTMLElement }>} */
+    this._asstByResp = new Map();
+
+    // ── Ephemeral bubble auto-dismiss ──────────────────────────────────────
+    // Per-element expiry (epoch ms). A bubble fades once its expiry passes —
+    // but only in stack order (see _reapBubbles). Refreshing the expiry keeps a
+    // bubble alive while it updates (e.g. the live user utterance).
+    /** @type {WeakMap<HTMLElement, number>} */
+    this._bubbleExpiry = new WeakMap();
+    // Single pending reaper handle: one timer for the whole stack (not one per
+    // bubble) so dismissal is strictly oldest-first regardless of per-bubble delays.
+    this._reaperHandle = 0;
+
+    this._chatBtn.addEventListener("click", () => (this._panelOpen ? this._closePanel() : this._openPanel()));
+    this._chatPanelClose.addEventListener("click", () => this._closePanel());
+    this._chatPanelBackdrop.addEventListener("click", () => this._closePanel());
+    document.addEventListener("keydown", (e) => {
+      if (e.key === "Escape" && this._panelOpen) this._closePanel();
+    });
+  }
+
+  // ── Panel ───────────────────────────────────────────────────────────────
+
+  _openPanel() {
+    this._panelOpen = true;
+    this._chatPanel.classList.add("open");
+    this._chatBadge.classList.remove("visible");
+    this._scrollToBottom();
+  }
+
+  _closePanel() {
+    this._panelOpen = false;
+    this._chatPanel.classList.remove("open");
+  }
+
+  // Coalesce scroll-to-bottom: a burst of cumulative transcript deltas would
+  // otherwise queue one rAF per delta, all writing the same scrollTop.
+  _scrollToBottom() {
+    if (!this._panelOpen || this._scrollQueued) return;
+    this._scrollQueued = true;
+    requestAnimationFrame(() => {
+      this._scrollQueued = false;
+      this._chatHistory.scrollTop = this._chatHistory.scrollHeight;
+    });
+  }
+
+  _markUnread() {
+    if (this._panelOpen) {
+      this._scrollToBottom();
+      return;
+    }
+    this._chatBadge.classList.add("visible");
+  }
+
+  // ── Shared rendering ──────────────────────────────────────────────────────
+
+  /**
+   * Build a role-labelled message element. Ephemeral bubbles and persistent
+   * history rows share the same shape and differ only in their class prefix
+   * (`bubble`/`bubble-*` vs `hist-msg`/`hist-*`).
+   * @param {{ container: string, prefix: string, role: "user"|"assistant", text: string, partial?: boolean }} o
+   * @returns {HTMLElement}
+   */
+  _buildMessageEl({ container, prefix, role, text, partial = false }) {
+    const el = document.createElement("div");
+    el.className = `${container} ${role}`;
+    const label = role === "user" ? "You" : "Assistant";
+    el.innerHTML = `<div class="${prefix}-role">${label}</div><div class="${prefix}-body${partial ? " partial" : ""}">${escHtml(text)}</div>`;
+    return el;
+  }
+
+  // ── Ephemeral bubbles ───────────────────────────────────────────────────
+
+  /** @param {"user"|"assistant"|"tool"} role @param {string} text @returns {HTMLElement} */
+  _spawnBubble(role, text) {
+    let el;
+    if (role === "tool") {
+      el = document.createElement("div");
+      el.className = "bubble tool";
+      el.innerHTML = `<svg class="bubble-tool-icon" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">${WRENCH_PATH}</svg><span class="bubble-tool-text">${escHtml(text)}</span>`;
+    } else {
+      el = this._buildMessageEl({ container: "bubble", prefix: "bubble", role, text });
+    }
+    this._bubbleStack.appendChild(el);
+    // Cap the stack at 3, but never evict the bubble the caller is still
+    // actively updating (the live user bubble) — drop the next-oldest instead.
+    const visible = /** @type {HTMLElement[]} */ ([...this._bubbleStack.querySelectorAll(".bubble:not(.out)")]);
+    if (visible.length > 3) {
+      this._dismissBubble(visible.find((b) => b !== this._activeUserBubble) ?? visible[0]);
+    }
+    requestAnimationFrame(() => el.classList.add("in"));
+    return el;
+  }
+
+  /** @param {HTMLElement} el @param {string} text */
+  _updateBubbleText(el, text) {
+    const t = el.querySelector(".bubble-body");
+    if (t) t.textContent = text;
+  }
+
+  /** @param {HTMLElement} el */
+  _dismissBubble(el) {
+    if (!el || el.classList.contains("out")) return; // idempotent
+    this._bubbleExpiry.delete(el);
+    el.classList.remove("in");
+    el.classList.add("out");
+    const remove = () => el.remove();
+    el.addEventListener("transitionend", remove, { once: true });
+    // Fallback: transitionend never fires if the bubble's visual state didn't
+    // change (dismissed pre-paint) or the tab is backgrounded. The transition
+    // is 0.3s, so force removal a little after.
+    setTimeout(remove, 400);
+  }
+
+  /**
+   * Fade bubbles whose expiry has passed — strictly oldest-first. We walk the
+   * stack top (oldest) to bottom (newest) and stop at the first bubble still
+   * alive: nothing newer may leave while an older bubble is still on screen. A
+   * bubble that keeps updating pushes its own expiry forward, so it (and
+   * everything behind it) stays put until it finally goes quiet.
+   */
+  _reapBubbles() {
+    this._reaperHandle = 0;
+    const now = Date.now();
+    const visible = /** @type {HTMLElement[]} */ ([...this._bubbleStack.querySelectorAll(".bubble:not(.out)")]);
+    let nextWake = Infinity;
+    for (const el of visible) {
+      const exp = this._bubbleExpiry.get(el) ?? now; // no expiry recorded → treat as due
+      if (exp <= now) {
+        this._dismissBubble(el);
+      } else {
+        // Oldest survivor isn't due yet; stop so nothing newer leaves before it.
+        nextWake = exp;
+        break;
+      }
+    }
+    if (nextWake !== Infinity) {
+      this._reaperHandle = setTimeout(() => this._reapBubbles(), Math.max(50, nextWake - Date.now()));
+    }
+  }
+
+  /**
+   * (Re)arm a bubble's auto-dismiss by pushing its expiry out by `delay`.
+   * Calling it again resets the countdown — so a bubble that keeps updating
+   * stays on screen and only fades once it goes quiet. Removal is ordered by the
+   * shared reaper, so the oldest bubble always disappears first.
+   * @param {HTMLElement} el @param {number} [delay]
+   */
+  _bumpDismiss(el, delay = 4000) {
+    this._bubbleExpiry.set(el, Date.now() + delay);
+    if (!this._reaperHandle) this._reaperHandle = setTimeout(() => this._reapBubbles(), delay);
+  }
+
+  // ── History ───────────────────────────────────────────────────────────────
+
+  /** Render the empty-state placeholder into the history panel. */
+  renderEmptyState() {
+    this._chatHistory.innerHTML = EMPTY_STATE_HTML;
+  }
+
+  /** Reset the panel to the empty state and clear the unread badge. */
+  clear() {
+    this.renderEmptyState();
+    this._chatBadge.classList.remove("visible");
+  }
+
+  /** @param {"user"|"assistant"} role @param {string} text @param {boolean} partial @returns {HTMLElement} */
+  _appendHistMsg(role, text, partial) {
+    const empty = this._chatHistory.querySelector(".chat-empty");
+    if (empty) empty.remove();
+    const el = this._buildMessageEl({ container: "hist-msg", prefix: "hist", role, text, partial });
+    this._chatHistory.appendChild(el);
+    this._scrollToBottom();
+    return el;
+  }
+
+  /** @param {HTMLElement | null} el @param {string} text @param {boolean} partial */
+  _updateHistMsg(el, text, partial) {
+    if (!el) return;
+    const body = /** @type {HTMLElement | null} */ (el.querySelector(".hist-body"));
+    if (!body) return;
+    body.textContent = text;
+    body.classList.toggle("partial", partial);
+    this._scrollToBottom();
+  }
+
+  /**
+   * Append a tool-call row to the conversation. We only add it once the tool
+   * has run, so the expandable toggle carries BOTH the call input and its result.
+   * @param {string} name @param {string} argsJson @param {string} output
+   */
+  _appendHistTool(name, argsJson, output) {
+    const empty = this._chatHistory.querySelector(".chat-empty");
+    if (empty) empty.remove();
+    let pretty = argsJson;
+    try { pretty = JSON.stringify(JSON.parse(argsJson), null, 2); } catch {}
+    const el = document.createElement("div");
+    el.className = "hist-msg tool";
+    el.innerHTML = `
+      <div class="hist-role">Tool call</div>
+      <button class="hist-tool-header" aria-expanded="false">
+        <svg class="hist-tool-icon" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">${WRENCH_PATH}</svg>
+        <span class="hist-tool-name">${escHtml(name)}</span>
+        <svg class="hist-tool-chevron" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 12 15 18 9"/></svg>
+      </button>
+      <div class="hist-tool-body">
+        <div class="hist-tool-label">Input</div>
+        <div class="hist-tool-block">${escHtml(pretty)}</div>
+        <div class="hist-tool-label">Output</div>
+        <div class="hist-tool-block hist-tool-output">${escHtml(output || "(no output)")}</div>
+      </div>
+    `;
+    const header = /** @type {HTMLButtonElement} */ (el.querySelector(".hist-tool-header"));
+    const body = /** @type {HTMLDivElement} */ (el.querySelector(".hist-tool-body"));
+    header.addEventListener("click", () => {
+      const expanded = header.getAttribute("aria-expanded") === "true";
+      header.setAttribute("aria-expanded", String(!expanded));
+      body.classList.toggle("open", !expanded);
+    });
+    this._chatHistory.appendChild(el);
+    this._scrollToBottom();
+  }
+
+  /** Tag an assistant history row as interrupted (user barged in mid-reply).
+   *  @param {HTMLElement | null} hist */
+  _markHistInterrupted(hist) {
+    if (!hist || hist.querySelector(".hist-note")) return;
+    hist.classList.add("interrupted");
+    const note = document.createElement("div");
+    note.className = "hist-note";
+    note.textContent = "Interrupted";
+    hist.appendChild(note);
+  }
+
+  /** Render a captured webcam frame in the transcript (the camera tool result).
+   *  @param {string} dataUrl */
+  _appendHistImage(dataUrl) {
+    const empty = this._chatHistory.querySelector(".chat-empty");
+    if (empty) empty.remove();
+    const el = document.createElement("div");
+    el.className = "hist-msg tool";
+    el.innerHTML = `<div class="hist-role">Snapshot</div><img class="hist-image" alt="Webcam snapshot sent to the model" />`;
+    const img = /** @type {HTMLImageElement} */ (el.querySelector("img"));
+    img.src = dataUrl;
+    this._chatHistory.appendChild(el);
+    this._scrollToBottom();
+  }
+
+  /**
+   * Reset all streaming bookkeeping for session start / teardown. Pass
+   * `dismiss` to also fade any bubbles still on screen.
+   * @param {{ dismiss?: boolean }} [opts]
+   */
+  reset(opts) {
+    if (opts?.dismiss) {
+      if (this._activeUserBubble) this._dismissBubble(this._activeUserBubble);
+      for (const { bubble } of this._asstByResp.values()) this._dismissBubble(bubble);
+    }
+    this._userHistByItem.clear();
+    this._activeUserBubble = null;
+    this._activeUserItemId = "";
+    this._asstByResp.clear();
+  }
+
+  // ── Client event handlers ─────────────────────────────────────────────────
+
+  /**
+   * A streamed transcript delta (user or assistant).
+   * @param {{ role: "user" | "assistant"; text: string; partial: boolean; itemId?: string; responseId?: string }} d
+   */
+  onTranscript(d) {
+    if (DEBUG) console.debug(`[ui] transcript role=${d.role} partial=${d.partial} item=${d.itemId} resp=${d.responseId} text=${JSON.stringify(d.text)}`);
+
+    if (d.role === "user") {
+      // Group by item_id: a speculative continuation reuses the same id, so it
+      // updates the same row/bubble. A missing id falls back to the active item
+      // (same utterance) or a fresh unique key, never a shared sentinel that
+      // would collapse distinct turns into one row.
+      const id = d.itemId || this._activeUserItemId || `_u${++this._anonSeq}`;
+      const text = d.text;
+
+      let hist = this._userHistByItem.get(id);
+      if (!hist) {
+        hist = this._appendHistMsg("user", text, d.partial);
+        this._userHistByItem.set(id, hist);
+      } else {
+        this._updateHistMsg(hist, text, d.partial);
+      }
+
+      // One ephemeral bubble per active item. Purely timer-based: the timer is
+      // refreshed on every delta, so it stays while the user keeps talking and
+      // fades a few seconds after they stop — no dependency on a response ever
+      // arriving, so it can never get stuck.
+      if (this._activeUserItemId !== id || !this._activeUserBubble) {
+        this._activeUserBubble = this._spawnBubble("user", text);
+        this._activeUserItemId = id;
+      } else {
+        this._updateBubbleText(this._activeUserBubble, text);
+      }
+      this._bumpDismiss(this._activeUserBubble, 6000);
+      this._markUnread();
+    } else if (d.role === "assistant") {
+      // Assistant transcript arrives once, as the full text, keyed by
+      // response_id so a cancelled speculative response can be removed later. A
+      // missing id gets a unique key so two id-less replies never collide.
+      const rid = d.responseId || `_a${++this._anonSeq}`;
+      const entry = this._asstByResp.get(rid);
+      if (!entry) {
+        const bubble = this._spawnBubble("assistant", d.text);
+        this._asstByResp.set(rid, { bubble, hist: this._appendHistMsg("assistant", d.text, false) });
+        this._bumpDismiss(bubble);
+      } else {
+        this._updateBubbleText(entry.bubble, d.text);
+        this._updateHistMsg(entry.hist, d.text, false);
+        this._bumpDismiss(entry.bubble);
+      }
+      this._markUnread();
+    }
+  }
+
+  /**
+   * A response closed (completed or cancelled).
+   * @param {{ responseId: string; status: string; audible?: boolean; transcript?: string }} detail
+   */
+  onResponseFinished(detail) {
+    const { responseId, status, audible, transcript } = detail;
+    if (DEBUG) console.debug(`[ui] response-finished resp=${responseId} status=${status} audible=${audible} known=${this._asstByResp.has(responseId)}`);
+    // Without an id we can't target a specific response; the bubble will
+    // auto-dismiss on its own timer regardless.
+    if (!responseId) return;
+    const entry = this._asstByResp.get(responseId);
+
+    if (status === "cancelled") {
+      // Keep every transcript that was received — mark it interrupted rather
+      // than erasing it. If the `*.transcript.done` never fired, build the row
+      // from the text carried in response.done.
+      let hist = entry?.hist ?? null;
+      if (!hist && transcript) {
+        hist = this._appendHistMsg("assistant", transcript, false);
+      } else if (hist && transcript) {
+        this._updateHistMsg(hist, transcript, false);
+      }
+      if (hist) this._markHistInterrupted(hist);
+      this._asstByResp.delete(responseId);
+      return;
+    }
+
+    // Any other terminal close (completed / failed / incomplete / …): just
+    // release the map entry. The bubble already auto-dismisses on its timer and
+    // the history row persists as the conversation log. Crucially we do NOT
+    // touch user state here — that lifecycle is fully independent.
+    this._asstByResp.delete(responseId);
+  }
+
+  /** The model called a tool — show an ephemeral "running" bubble.
+   *  @param {string} name */
+  onToolCall(name) {
+    this._bumpDismiss(this._spawnBubble("tool", name));
+    this._markUnread();
+  }
+
+  /** The tool finished — append its call+result row (and any captured image).
+   *  @param {string} name @param {string} argsJson @param {string} output @param {string} [image] */
+  onToolResult(name, argsJson, output, image) {
+    this._appendHistTool(name, argsJson, output);
+    if (image) this._appendHistImage(image); // show the captured frame below the call
+    this._markUnread();
+  }
+}

ui/dom.js

@@ -0,0 +1,37 @@
+// @ts-check
+/** Small shared helpers used across the UI modules: a strict query selector,
+ *  HTML escaping for text we drop into innerHTML, error-string trimming, and
+ *  the opt-in debug flag. */
+
+/** Opt-in tracing: `localStorage.setItem("s2s.debug", "1")` then reload. */
+export const DEBUG = (() => {
+  try {
+    return localStorage.getItem("s2s.debug") === "1";
+  } catch {
+    return false;
+  }
+})();
+
+/**
+ * Query a single element, throwing if it's missing (so a broken selector fails
+ * loudly at startup rather than as a later null-deref).
+ * @template {HTMLElement} T
+ * @param {string} selector
+ * @returns {T}
+ */
+export function $(selector) {
+  const el = document.querySelector(selector);
+  if (!el) throw new Error(`Missing element: ${selector}`);
+  return /** @type {T} */ (el);
+}
+
+/** @param {string} s @returns {string} */
+export function escHtml(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+
+/** Trim a long error message to fit the orb caption. @param {string} text */
+export function truncateError(text) {
+  if (text.length <= 90) return text;
+  return text.slice(0, 87) + "…";
+}

worklets/audio-playback.js

@@ -0,0 +1,171 @@
+// @ts-check
+/**
+ * AudioWorkletProcessor that plays back Float32 mono samples received from
+ * the main thread, upsampling whatever incoming rate the server uses
+ * (typically 24 kHz PCM16) to the AudioContext rate (typically 48 kHz).
+ *
+ * Lifecycle / messaging:
+ *
+ *   main -> worklet:
+ *     { kind: "config", inputRate: 24000 }              one-shot at startup
+ *     { kind: "audio", samples: Float32Array }          (transferable) per chunk
+ *     { kind: "clear" }                                 wipe queue (barge-in)
+ *
+ *   worklet -> main:
+ *     { kind: "stats", queuedMs, played }               every ~250 ms
+ *     { kind: "underrun" }                              every time the queue
+ *                                                      runs dry mid-playback
+ *
+ * Underrun strategy: output silence. We do NOT hold the last sample (that
+ * tends to produce audible clicks/buzzes when long gaps appear between
+ * TTS chunks). A short ramp-out + ramp-in at boundaries would be nicer but
+ * the server's 30 ms cadence makes underruns visible only at end of turn.
+ */
+
+const STATS_INTERVAL_FRAMES = 12000;
+const FADE_FRAMES = 32;
+
+class AudioPlaybackProcessor extends AudioWorkletProcessor {
+  constructor() {
+    super();
+    this._inputRate = 24000;
+    this._stepRatio = this._inputRate / sampleRate;
+    this._queue = [];
+    this._readIdx = 0;
+    this._fracPos = 0;
+    this._playing = false;
+    this._framesSinceStats = 0;
+    this._totalPlayed = 0;
+    this._fadeIn = 0;
+    this._fadeOut = 0;
+    this._lastSample = 0;
+
+    this.port.onmessage = (e) => {
+      const data = e.data;
+      if (!data || typeof data !== "object") return;
+      switch (data.kind) {
+        case "config":
+          if (typeof data.inputRate === "number" && data.inputRate > 0) {
+            this._inputRate = data.inputRate;
+            this._stepRatio = this._inputRate / sampleRate;
+          }
+          break;
+        case "audio":
+          if (data.samples instanceof Float32Array && data.samples.length > 0) {
+            this._queue.push(data.samples);
+            if (!this._playing) {
+              this._playing = true;
+              this._fadeIn = FADE_FRAMES;
+              this._fadeOut = 0;
+            }
+          }
+          break;
+        case "clear":
+          this._queue.length = 0;
+          this._readIdx = 0;
+          this._fracPos = 0;
+          this._fadeOut = FADE_FRAMES;
+          break;
+      }
+    };
+  }
+
+  _queuedSamples() {
+    let total = -this._readIdx;
+    for (const buf of this._queue) total += buf.length;
+    return Math.max(0, total);
+  }
+
+  /** Linear-interp read at the current fractional position. */
+  _readInterpolated() {
+    if (this._queue.length === 0) return null;
+    const head = this._queue[0];
+    const idx = this._readIdx;
+    const frac = this._fracPos;
+
+    let a = head[idx];
+    let b;
+    if (idx + 1 < head.length) {
+      b = head[idx + 1];
+    } else if (this._queue.length > 1) {
+      b = this._queue[1][0];
+    } else {
+      b = a;
+    }
+    return a + (b - a) * frac;
+  }
+
+  /** Advance the read position by `stepRatio`; pop consumed buffers. */
+  _advance() {
+    this._fracPos += this._stepRatio;
+    while (this._fracPos >= 1) {
+      this._fracPos -= 1;
+      this._readIdx += 1;
+    }
+    while (this._queue.length > 0 && this._readIdx >= this._queue[0].length) {
+      this._readIdx -= this._queue[0].length;
+      this._queue.shift();
+    }
+  }
+
+  process(_, outputs) {
+    const channels = outputs[0];
+    if (!channels || channels.length === 0) return true;
+    const out = channels[0];
+    const stereo = channels.length > 1 ? channels[1] : null;
+
+    for (let i = 0; i < out.length; i++) {
+      let sample = 0;
+
+      if (this._playing) {
+        const v = this._readInterpolated();
+        if (v === null) {
+          // Underrun: try to ramp out cleanly to avoid clicks.
+          sample = this._lastSample * Math.max(0, 1 - 1 / FADE_FRAMES);
+          this._lastSample = sample;
+          if (Math.abs(sample) < 1e-4) {
+            this._playing = false;
+            this._lastSample = 0;
+            this.port.postMessage({ kind: "underrun" });
+          }
+        } else {
+          sample = v;
+          this._lastSample = v;
+          this._advance();
+        }
+
+        if (this._fadeIn > 0) {
+          const gain = 1 - this._fadeIn / FADE_FRAMES;
+          sample *= gain;
+          this._fadeIn -= 1;
+        }
+        if (this._fadeOut > 0) {
+          const gain = this._fadeOut / FADE_FRAMES;
+          sample *= gain;
+          this._fadeOut -= 1;
+          if (this._fadeOut === 0) {
+            this._playing = false;
+            this._lastSample = 0;
+          }
+        }
+
+        this._totalPlayed += 1;
+      }
+
+      out[i] = sample;
+      if (stereo) stereo[i] = sample;
+    }
+
+    this._framesSinceStats += out.length;
+    if (this._framesSinceStats >= STATS_INTERVAL_FRAMES) {
+      this._framesSinceStats = 0;
+      const queuedSamples = this._queuedSamples();
+      const queuedMs = (queuedSamples / this._inputRate) * 1000;
+      this.port.postMessage({ kind: "stats", queuedMs, played: this._totalPlayed });
+    }
+
+    return true;
+  }
+}
+
+registerProcessor("audio-playback", AudioPlaybackProcessor);

worklets/mic-capture.js

@@ -0,0 +1,159 @@
+// @ts-check
+/**
+ * AudioWorkletProcessor that resamples the AudioContext rate (typically 48 kHz)
+ * down to 16 kHz, packs the result as little-endian Int16 PCM, and posts it
+ * back to the main thread in fixed-size chunks.
+ *
+ * The Hugging Face speech-to-speech WebSocket route expects the
+ * `input_audio_buffer.append` payload at 16 kHz PCM16 mono.
+ *
+ * Design notes:
+ *   - 48 -> 16 is an exact 3:1 ratio so we use a 3-tap boxcar average as a
+ *     cheap low-pass before decimating. Good enough for voice STT; we lose
+ *     a tiny bit of >8 kHz content which the pipeline discards anyway.
+ *   - Output frames are emitted at the cadence dictated by `chunkMs`
+ *     (default 40 ms = 640 samples = 1280 bytes). The OpenAI Realtime
+ *     server batches incoming audio so the cadence is flexible; 20-100 ms
+ *     is the sweet spot.
+ *   - Float -> Int16 saturates to [-1, 1] before scaling.
+ *   - Optional noise gate: per-chunk RMS decides open/closed against a
+ *     threshold; the gain ramps (fast attack, hold, slow release) so word
+ *     onsets aren't clipped and quiet tails don't click. The gate only
+ *     affects the audio we SEND; the main-thread visualiser taps the raw
+ *     mic separately. We post the chunk RMS up every frame so the Settings
+ *     mic meter can show the live level against the threshold.
+ */
+
+const TARGET_RATE = 16000;
+const DEFAULT_CHUNK_MS = 40;
+// Gate envelope timing (fixed; only the threshold is user-tunable).
+const GATE_ATTACK_MS = 5; // open almost instantly so word onsets survive
+const GATE_HOLD_MS = 250; // stay open this long after the level drops back under
+const GATE_RELEASE_MS = 80; // then fade closed over this long (no click)
+
+class MicCaptureProcessor extends AudioWorkletProcessor {
+  constructor(options) {
+    super();
+    const chunkMs = options?.processorOptions?.chunkMs ?? DEFAULT_CHUNK_MS;
+    this._inputRate = sampleRate;
+    this._ratio = this._inputRate / TARGET_RATE;
+    this._chunkSamples16k = Math.round((TARGET_RATE * chunkMs) / 1000);
+    this._scratch = new Float32Array(0);
+    this._decimated = new Float32Array(this._chunkSamples16k);
+    this._enabled = true;
+
+    // Noise gate state. Disabled by default (pure passthrough).
+    this._gateEnabled = false;
+    this._thresholdLin = 0; // linear amplitude; signal RMS must exceed this to open
+    this._gateGain = 1; // smoothed gain currently applied
+    this._holdRemaining = 0; // samples left before the gate may start closing
+    this._attackCoef = Math.exp(-1 / ((GATE_ATTACK_MS / 1000) * TARGET_RATE));
+    this._releaseCoef = Math.exp(-1 / ((GATE_RELEASE_MS / 1000) * TARGET_RATE));
+    this._holdSamples = Math.round((GATE_HOLD_MS / 1000) * TARGET_RATE);
+
+    this.port.onmessage = (e) => {
+      const data = e.data;
+      if (data?.kind === "enable") this._enabled = !!data.value;
+      else if (data?.kind === "gate") {
+        this._gateEnabled = !!data.enabled;
+        // dB -> linear amplitude. When off, threshold 0 keeps the gate open.
+        this._thresholdLin = data.enabled ? Math.pow(10, data.thresholdDb / 20) : 0;
+      }
+    };
+  }
+
+  /**
+   * Append `incoming` to the internal scratch buffer, then emit as many
+   * full output chunks as we have material for.
+   * @param {Float32Array} incoming
+   */
+  _ingest(incoming) {
+    if (incoming.length === 0) return;
+    const next = new Float32Array(this._scratch.length + incoming.length);
+    next.set(this._scratch, 0);
+    next.set(incoming, this._scratch.length);
+    this._scratch = next;
+    this._maybeEmit();
+  }
+
+  _maybeEmit() {
+    const r = this._ratio;
+    const n = this._chunkSamples16k;
+    const needIn = Math.ceil(n * r);
+    const dec = this._decimated;
+    while (this._scratch.length >= needIn) {
+      // 1. Decimate to 16 kHz floats and accumulate energy for the gate/meter.
+      let sumSq = 0;
+      if (Math.abs(r - 3) < 1e-6) {
+        // 48 kHz -> 16 kHz fast path with boxcar lowpass.
+        for (let i = 0; i < n; i++) {
+          const idx = i * 3;
+          const s = (this._scratch[idx] + this._scratch[idx + 1] + this._scratch[idx + 2]) / 3;
+          dec[i] = s;
+          sumSq += s * s;
+        }
+      } else {
+        // Generic path: linear interpolation. Slower but works at any rate
+        // (e.g. some Windows boxes report sampleRate=44100).
+        for (let i = 0; i < n; i++) {
+          const srcPos = i * r;
+          const idx = Math.floor(srcPos);
+          const frac = srcPos - idx;
+          const a = this._scratch[idx];
+          const b = this._scratch[idx + 1] ?? a;
+          const s = a + (b - a) * frac;
+          dec[i] = s;
+          sumSq += s * s;
+        }
+      }
+      const rms = Math.sqrt(sumSq / n);
+
+      // 2. Decide the gate target for this chunk, then ramp sample-by-sample.
+      let target = 1;
+      if (this._gateEnabled) {
+        if (rms >= this._thresholdLin) {
+          this._holdRemaining = this._holdSamples; // re-arm the hold
+        } else if (this._holdRemaining > 0) {
+          this._holdRemaining -= n; // coasting through the hold window
+        } else {
+          target = 0;
+        }
+      }
+
+      // 3. Apply the (smoothed) gain and pack to Int16.
+      const out = new Int16Array(n);
+      let gain = this._gateGain;
+      for (let i = 0; i < n; i++) {
+        const coef = target > gain ? this._attackCoef : this._releaseCoef;
+        gain = target + (gain - target) * coef;
+        const s = dec[i] * gain;
+        const clamped = s < -1 ? -1 : s > 1 ? 1 : s;
+        out[i] = clamped < 0 ? clamped * 0x8000 : clamped * 0x7fff;
+      }
+      this._gateGain = gain;
+
+      // Shift the scratch buffer to keep only the trailing unused samples.
+      const consumed = Math.floor(n * r);
+      this._scratch = this._scratch.slice(consumed);
+
+      // Live input level for the Settings meter (raw RMS, pre-gate).
+      this.port.postMessage({ kind: "level", rms });
+
+      if (this._enabled) {
+        this.port.postMessage(out.buffer, [out.buffer]);
+      }
+      // When disabled (mic muted) we silently consume input so the worklet
+      // stays alive and the buffer never grows unbounded.
+    }
+  }
+
+  process(inputs) {
+    const input = inputs[0];
+    if (!input || input.length === 0 || !input[0]) return true;
+    const mono = input[0];
+    if (mono.length > 0) this._ingest(mono);
+    return true;
+  }
+}
+
+registerProcessor("mic-capture", MicCaptureProcessor);

ws/codec.js

@@ -0,0 +1,57 @@
+// @ts-check
+/**
+ * Pure, stateless helpers for the WebSocket realtime client: base64 <-> PCM
+ * conversion for the audio frames on the wire, transcript extraction from a
+ * `response.done` payload, and a tiny URL helper. Kept separate from the client
+ * so the protocol/state logic stays readable.
+ */
+
+/** @param {string} url */
+export function trimTrailingSlash(url) {
+  return url.endsWith("/") ? url.slice(0, -1) : url;
+}
+
+/**
+ * Pull the assistant transcript out of a `response.done` payload. The text
+ * lives in `response.output[].content[].transcript` (audio) or `.text`. Used as
+ * the source of truth for interrupted replies, where the dedicated
+ * `*.transcript.done` event may never arrive.
+ * @param {any} response
+ * @returns {string}
+ */
+export function extractResponseTranscript(response) {
+  const output = response?.output;
+  if (!Array.isArray(output)) return "";
+  /** @type {string[]} */
+  const parts = [];
+  for (const item of output) {
+    for (const part of item?.content ?? []) {
+      const text = part?.transcript ?? part?.text;
+      if (typeof text === "string" && text.trim()) parts.push(text.trim());
+    }
+  }
+  return parts.join(" ").trim();
+}
+
+/** @param {ArrayBuffer} buf */
+export function base64FromArrayBuffer(buf) {
+  const bytes = new Uint8Array(buf);
+  // Chunked encoding so we don't blow up the call stack on long buffers.
+  let binary = "";
+  const chunk = 0x8000;
+  for (let i = 0; i < bytes.length; i += chunk) {
+    binary += String.fromCharCode.apply(null, /** @type {number[]} */ (
+      /** @type {unknown} */ (bytes.subarray(i, i + chunk))
+    ));
+  }
+  return btoa(binary);
+}
+
+/** @param {string} b64 */
+export function base64ToBytes(b64) {
+  const binary = atob(b64);
+  const len = binary.length;
+  const out = new Uint8Array(len);
+  for (let i = 0; i < len; i++) out[i] = binary.charCodeAt(i);
+  return out;
+}

ws/orb-visualizer.js

@@ -0,0 +1,98 @@
+// @ts-check
+/**
+ * Orb spectrum visualiser. Each animation frame it reads two AnalyserNodes (the
+ * mic input and the TTS output) and maps the low-frequency speech energy onto
+ * the orb's CSS custom properties:
+ *   - `--bar0`..`--bar4`   the 5-band level meter
+ *   - `--ai-audio-level`   the global "Reachy talks" glow / scale pulse
+ *
+ * The bottom of the FFT is where speech energy lives, so the band edges stay
+ * low — that keeps the bars dancing on voice rather than on noise. While the AI
+ * is speaking we source the bars from the OUTPUT analyser so the orb pulses with
+ * Reachy's voice instead of sitting dead while the user is silent.
+ */
+
+// Exported so the client can size its AnalyserNodes to match our buffer.
+export const VIS_FFT_SIZE = 256;
+const VIS_BAND_COUNT = 5;
+const VIS_BAND_EDGES = [2, 5, 9, 16, 28, 52];
+const VIS_ATTACK = 0.6; // weight for new sample on upswing (snappy)
+const VIS_RELEASE = 0.18; // weight for new sample on decay (gentle fade)
+
+export class OrbVisualiser {
+  /**
+   * @param {AnalyserNode} micAnalyser
+   * @param {AnalyserNode} outAnalyser
+   * @param {() => boolean} isAiSpeaking Source the bars from the AI output when
+   *   true, otherwise from the mic.
+   */
+  constructor(micAnalyser, outAnalyser, isAiSpeaking) {
+    this._mic = micAnalyser;
+    this._out = outAnalyser;
+    this._isAiSpeaking = isAiSpeaking;
+    this._buf = new Uint8Array(micAnalyser.frequencyBinCount);
+    this._bands = new Float32Array(VIS_BAND_COUNT);
+    this._aiLevel = 0;
+    /** @type {number | null} */
+    this._frame = null;
+  }
+
+  /** Begin the rAF loop (idempotent). */
+  start() {
+    if (this._frame !== null) return;
+    const root = document.documentElement;
+    const tick = () => {
+      this._frame = requestAnimationFrame(tick);
+      this._update(root);
+    };
+    this._frame = requestAnimationFrame(tick);
+  }
+
+  /** Stop the loop and clear the CSS vars so the orb returns to rest. */
+  stop() {
+    if (this._frame !== null) {
+      cancelAnimationFrame(this._frame);
+      this._frame = null;
+    }
+    const root = document.documentElement;
+    for (let i = 0; i < VIS_BAND_COUNT; i++) root.style.removeProperty(`--bar${i}`);
+    root.style.removeProperty("--ai-audio-level");
+  }
+
+  /** @param {HTMLElement} root */
+  _update(root) {
+    // Mic bars: split FFT into 5 log-ish bands, smooth, write CSS vars.
+    const source = this._isAiSpeaking() ? this._out : this._mic;
+    source.getByteFrequencyData(this._buf);
+
+    for (let b = 0; b < VIS_BAND_COUNT; b++) {
+      const lo = VIS_BAND_EDGES[b];
+      const hi = VIS_BAND_EDGES[b + 1];
+      let sum = 0;
+      let n = 0;
+      for (let i = lo; i < hi && i < this._buf.length; i++) {
+        sum += this._buf[i];
+        n += 1;
+      }
+      const target = n > 0 ? sum / (n * 255) : 0;
+      const prev = this._bands[b];
+      const k = target > prev ? VIS_ATTACK : VIS_RELEASE;
+      const next = prev + (target - prev) * k;
+      this._bands[b] = next;
+      root.style.setProperty(`--bar${b}`, next.toFixed(3));
+    }
+
+    // Global AI audio level: peak of the output analyser, used by the CSS to
+    // make the orb's glow / scale react to Reachy's voice.
+    this._out.getByteFrequencyData(this._buf);
+    let peak = 0;
+    const limit = Math.min(this._buf.length, VIS_BAND_EDGES[VIS_BAND_COUNT]);
+    for (let i = 0; i < limit; i++) {
+      if (this._buf[i] > peak) peak = this._buf[i];
+    }
+    const aiTarget = peak / 255;
+    const k = aiTarget > this._aiLevel ? VIS_ATTACK : VIS_RELEASE;
+    this._aiLevel = this._aiLevel + (aiTarget - this._aiLevel) * k;
+    root.style.setProperty("--ai-audio-level", this._aiLevel.toFixed(3));
+  }
+}

ws/s2s-ws-client.js

@@ -0,0 +1,899 @@
+// @ts-check
+/**
+ * Minimal WebSocket client for the Hugging Face speech-to-speech load balancer.
+ *
+ * Two-step handshake (same /session route as the WebRTC client):
+ *
+ *   1. POST `<lb_url>/session` -> JSON `{ connect_url: wss://<compute>/v1/realtime?session_token=<JWT>, ... }`
+ *   2. Open a WebSocket directly on `connect_url` (no rewrite, unlike the WebRTC client).
+ *
+ * Once the socket is open we follow the OpenAI Realtime GA WebSocket
+ * protocol:
+ *
+ *   - Server pushes `session.created` immediately after upgrade.
+ *   - We send `session.update` (GA schema: `session.audio.{input,output}`,
+ *     `session.output_modalities`, ...).
+ *   - We stream mic audio as PCM16 16 kHz mono base64 chunks via
+ *     `input_audio_buffer.append`.
+ *   - The server pushes `response.output_audio.delta` (PCM16 24 kHz mono
+ *     base64) and transcript deltas.
+ *
+ * Audio is handled internally via two AudioWorklet processors so the
+ * client owns the full mic-in / speaker-out pipeline. The main app only
+ * sees high-level lifecycle events (`status`, `transcript`, `error`,
+ * `session`), the same shape as the WebRTC client.
+ *
+ * @typedef {"idle" | "creating-session" | "connecting" | "connected" |
+ *           "user-speaking" | "processing" | "ai-speaking" | "closed" | "error"
+ * } WsStatus
+ *
+ * @typedef {Object} WsSessionInfo
+ * @property {string} sessionId
+ * @property {string} connectUrl
+ * @property {string} websocketUrl
+ * @property {string} sessionToken
+ * @property {number} pendingTimeoutS
+ * @property {string} [tier] Login tier from the session proxy ("anon"|"free"|"pro").
+ * @property {boolean} [limited] Whether this session is metered (heartbeat needed).
+ * @property {number} [heartbeatSec] Suggested heartbeat cadence in seconds.
+ * @property {number} [remainingSec] Daily budget left after this grant (display).
+ *
+ * @typedef {Object} WsClientOptions
+ * @property {string} [sessionUrl] URL to POST for the session handshake (returns
+ *   `{ connect_url, ... }`). Usually a same-origin proxy like `api/session` so the
+ *   load-balancer address stays server-side. Provide this OR `directUrl`.
+ * @property {string} [loadBalancerUrl] Load-balancer base URL. Legacy/direct
+ *   alternative to `sessionUrl`: the client POSTs `<lb>/session` itself. Prefer
+ *   `sessionUrl` so the LB address isn't exposed to the browser.
+ * @property {string} [directUrl] Full WebSocket URL of an s2s realtime endpoint
+ *   (e.g. `ws://localhost:8080/v1/realtime`). When set, the client skips the
+ *   session POST and dials it directly — no load balancer in between.
+ * @property {string} voice
+ * @property {string} instructions
+ * @property {MediaStream} micStream
+ * @property {AudioContext} [audioContext] Pre-created (and resumed) context.
+ *   iOS Safari only lets an AudioContext start from within a user gesture, so
+ *   the caller creates/resumes it synchronously on the orb tap and hands it
+ *   here; otherwise it stays suspended (silent) after the mic/session awaits.
+ * @property {ToolDef[]} [tools] Function tools declared to the backend in the
+ *   initial `session.update`. The model decides when to call them; the caller
+ *   executes and replies via `sendToolOutput` + `requestResponse`.
+ * @property {NoiseGate} [noiseGate] Client-side noise gate applied to the mic
+ *   before it's sent. Tunable live via `setNoiseGate`.
+ *
+ * @typedef {Object} NoiseGate
+ * @property {boolean} enabled
+ * @property {number} thresholdDb Open threshold in dBFS (e.g. -45).
+ *
+ * @typedef {Object} ToolDef
+ * @property {"function"} type
+ * @property {string} name
+ * @property {string} description
+ * @property {object} parameters JSON Schema for the call arguments.
+ *
+ * @typedef {Object} TranscriptEvent
+ * @property {"user" | "assistant"} role
+ * @property {string} text
+ * @property {boolean} partial
+ */
+
+import {
+  base64FromArrayBuffer,
+  base64ToBytes,
+  extractResponseTranscript,
+  trimTrailingSlash,
+} from "./codec.js";
+import { OrbVisualiser, VIS_FFT_SIZE } from "./orb-visualizer.js";
+
+// The s2s pipeline runs internally at 16 kHz mono PCM. The WebRTC transport
+// resamples to 48 kHz for Opus, but the WebSocket transport emits the
+// native pipeline rate. We don't (can't) override it via `audio.output.format`
+// because the server's pydantic validator rejects the whole `session.update`
+// as soon as a sub-field shape it doesn't know about appears.
+const OUTPUT_SAMPLE_RATE = 16000;
+const MIC_CHUNK_MS = 40;
+
+export class S2sWsRealtimeClient extends EventTarget {
+  /** @param {WsClientOptions} options */
+  constructor(options) {
+    super();
+    /** @type {WsClientOptions} */
+    this.options = options;
+    /** @type {ToolDef[]} Function tools declared to the backend. */
+    this._tools = options.tools ?? [];
+    /** @type {string} Direct realtime WS URL (set => skip the LB session POST). */
+    this._directUrl = options.directUrl ?? "";
+    /** @type {string} Where to POST for the session handshake. Prefer the
+     *  explicit `sessionUrl`; fall back to `<loadBalancerUrl>/session` for callers
+     *  that still pass the LB address directly. */
+    this._sessionUrl = options.sessionUrl
+      ? options.sessionUrl
+      : options.loadBalancerUrl
+        ? `${trimTrailingSlash(options.loadBalancerUrl)}/session`
+        : "";
+    /** @type {NoiseGate} Mic noise gate; off by default. */
+    this._noiseGate = options.noiseGate ?? { enabled: false, thresholdDb: -45 };
+    /** @type {WebSocket | null} */
+    this._ws = null;
+    /** @type {AudioContext | null} */
+    this._ctx = null;
+    /** @type {MediaStreamAudioSourceNode | null} */
+    this._micSrc = null;
+    /** @type {AudioWorkletNode | null} */
+    this._captureNode = null;
+    /** @type {AudioWorkletNode | null} */
+    this._playbackNode = null;
+    /** @type {GainNode | null} */
+    this._captureSink = null;
+    /** @type {AnalyserNode | null} */
+    this._micAnalyser = null;
+    /** @type {AnalyserNode | null} */
+    this._outAnalyser = null;
+    /** @type {OrbVisualiser | null} */
+    this._visualiser = null;
+    /** @type {WsStatus} */
+    this._status = "idle";
+    this._aiSpeaking = false;
+    /** @type {Set<string>} response_ids that have actually played audio, so the
+     * UI can tell a barge-in cut (keep it) from a never-heard speculative
+     * response (drop it). */
+    this._audibleResponses = new Set();
+    /** @type {Map<string, string>} The CURRENT assistant transcript segment per
+     * response, accumulated from streamed deltas (reset on each segment's done). */
+    this._asstTranscriptByResp = new Map();
+    /** @type {Map<string, string>} Completed assistant transcript segments per
+     * response, space-joined. A single response can emit several
+     * `*.transcript.done` events; we concatenate them until response.done. */
+    this._asstFullByResp = new Map();
+    this._muted = false;
+    // ── Response lock ────────────────────────────────────────────────────
+    // The backend allows only ONE response in flight: creating a second while
+    // one is active fails with `conversation_already_has_active_response`. So
+    // we serialize response.create. `_openResponses` counts responses the
+    // server has confirmed (response.created) but not yet finished
+    // (response.done) — it's cumulative, so every create maps to one done.
+    // `_createInFlight` covers the window after we send a create but before its
+    // response.created echo. Any requestResponse() made while locked is queued
+    // and replayed, one at a time, as each response.done frees the slot.
+    this._openResponses = 0;
+    this._createInFlight = false;
+    /** @type {{ image?: string }[]} Pending response.create payloads, one per
+     * queued requestResponse(). A payload may carry an image to send just
+     * before its create (so the frame travels with the create, not eagerly). */
+    this._createQueue = [];
+    /** @type {Promise<void> | null} */
+    this._readyPromise = null;
+    this._sessionConfigured = false;
+    this._debug = (() => { try { return localStorage.getItem("s2s.debug") === "1"; } catch { return false; } })();
+  }
+
+  get status() {
+    return this._status;
+  }
+
+  /** @param {WsStatus} status */
+  _setStatus(status) {
+    if (this._status === status) return;
+    this._status = status;
+    this.dispatchEvent(new CustomEvent("status", { detail: { status } }));
+  }
+
+  /** Full assistant transcript so far for a response: the completed segments
+   *  plus the in-progress one, all space-joined.
+   *  @param {string} rid @returns {string} */
+  _asstDisplay(rid) {
+    const full = this._asstFullByResp.get(rid) || "";
+    const seg = this._asstTranscriptByResp.get(rid) || "";
+    if (!seg) return full;
+    return full ? `${full} ${seg}` : seg;
+  }
+
+  _markAudible() {
+    if (this._status === "ai-speaking") return;
+    if (this._status === "closed" || this._status === "error") return;
+    this._setStatus("ai-speaking");
+  }
+
+  /**
+   * Full handshake. Resolves once the WS is open AND the audio pipeline is
+   * ready to send/receive samples.
+   * @returns {Promise<void>}
+   */
+  async connect() {
+    if (this._ws) throw new Error("Already connected");
+
+    let connectUrl;
+    if (this._directUrl) {
+      // Direct mode: no load balancer, no /session POST — dial the realtime
+      // endpoint straight away (e.g. a local s2s server).
+      connectUrl = this._directUrl;
+      this._setStatus("connecting");
+    } else {
+      if (!this._sessionUrl) {
+        throw new Error("No session endpoint or direct URL configured");
+      }
+      this._setStatus("creating-session");
+      const session = await this._createSession();
+      this.dispatchEvent(new CustomEvent("session", { detail: { info: session } }));
+      connectUrl = session.connectUrl;
+      this._setStatus("connecting");
+    }
+
+    // Spin up the AudioContext + worklets in parallel with the WS dial.
+    const audioReady = this._setupAudio();
+    const wsReady = this._openWebSocket(connectUrl);
+    await Promise.all([audioReady, wsReady]);
+  }
+
+  /**
+   * @returns {Promise<WsSessionInfo>}
+   */
+  async _createSession() {
+    const url = this._sessionUrl;
+    console.log("[ws] POST", url);
+    const response = await fetch(url, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: "{}",
+    });
+    if (response.status === 402) {
+      // The session proxy refused: today's per-tier time budget is spent. Surface
+      // it as a typed error so the UI shows the limit modal, not a crash.
+      const body = await response.json().catch(() => ({}));
+      const err = /** @type {Error & { code?: string; tier?: string }} */ (
+        new Error("Daily conversation limit reached")
+      );
+      err.code = "limit";
+      err.tier = body?.tier;
+      throw err;
+    }
+    if (!response.ok) {
+      const text = await response.text().catch(() => "");
+      throw new Error(`/session failed (${response.status}): ${text}`);
+    }
+    const json = await response.json();
+    return {
+      sessionId: json.session_id,
+      connectUrl: json.connect_url,
+      websocketUrl: json.websocket_url,
+      sessionToken: json.session_token,
+      pendingTimeoutS: json.pending_timeout_s,
+      tier: json.tier,
+      limited: json.limited,
+      heartbeatSec: json.heartbeatSec,
+      remainingSec: json.remainingSec,
+    };
+  }
+
+  async _setupAudio() {
+    // Prefer a context the caller already created + resumed inside the tap
+    // gesture (required on iOS). Fall back to creating one here for callers
+    // that don't (desktop is lenient about the gesture timing).
+    // Most desktops give us 48 kHz, mobiles can give 44.1/24/16 kHz; the
+    // capture worklet handles any rate (linear interp fallback).
+    const ctx = this.options.audioContext ?? new AudioContext({ latencyHint: "interactive" });
+    this._ctx = ctx;
+
+    // Resume if still suspended. This is best-effort here — on iOS the resume
+    // that actually counts is the one the caller did synchronously on tap.
+    if (ctx.state === "suspended") {
+      try {
+        await ctx.resume();
+      } catch (err) {
+        console.warn("[ws] AudioContext resume failed:", err);
+      }
+    }
+
+    // The worklets live at the repo root, one level up from this module.
+    const base = new URL("../worklets/", import.meta.url);
+    await ctx.audioWorklet.addModule(new URL("mic-capture.js", base).href);
+    await ctx.audioWorklet.addModule(new URL("audio-playback.js", base).href);
+
+    const captureNode = new AudioWorkletNode(ctx, "mic-capture", {
+      numberOfInputs: 1,
+      numberOfOutputs: 0,
+      processorOptions: { chunkMs: MIC_CHUNK_MS },
+    });
+    captureNode.port.onmessage = (e) => {
+      const data = e.data;
+      if (data instanceof ArrayBuffer) {
+        this._onMicChunk(data);
+      } else if (data?.kind === "level") {
+        // Raw pre-gate mic RMS for the Settings meter.
+        this.dispatchEvent(new CustomEvent("input-level", { detail: { rms: data.rms } }));
+      }
+    };
+    // Push the initial gate config now that the worklet exists.
+    captureNode.port.postMessage({ kind: "gate", ...this._noiseGate });
+    this._captureNode = captureNode;
+
+    const micSrc = ctx.createMediaStreamSource(this.options.micStream);
+    micSrc.connect(captureNode);
+    this._micSrc = micSrc;
+
+    // Mic analyser: tap the mic in parallel with the worklet so we get the
+    // raw (un-resampled, un-clipped) signal for the visualiser.
+    const micAnalyser = ctx.createAnalyser();
+    micAnalyser.fftSize = VIS_FFT_SIZE;
+    micAnalyser.smoothingTimeConstant = 0;
+    micSrc.connect(micAnalyser);
+    this._micAnalyser = micAnalyser;
+
+    const playbackNode = new AudioWorkletNode(ctx, "audio-playback", {
+      numberOfInputs: 0,
+      numberOfOutputs: 1,
+      outputChannelCount: [1],
+    });
+    playbackNode.port.postMessage({ kind: "config", inputRate: OUTPUT_SAMPLE_RATE });
+    playbackNode.port.onmessage = (e) => this._onPlaybackMessage(e.data);
+
+    // Output analyser sits between the playback worklet and the speakers.
+    const outAnalyser = ctx.createAnalyser();
+    outAnalyser.fftSize = VIS_FFT_SIZE;
+    outAnalyser.smoothingTimeConstant = 0.3;
+    playbackNode.connect(outAnalyser);
+    outAnalyser.connect(ctx.destination);
+    this._outAnalyser = outAnalyser;
+    this._playbackNode = playbackNode;
+
+    this._visualiser = new OrbVisualiser(micAnalyser, outAnalyser, () => this._aiSpeaking);
+    this._visualiser.start();
+  }
+
+  /** @param {string} connectUrl */
+  _openWebSocket(connectUrl) {
+    return new Promise((resolve, reject) => {
+      const ws = new WebSocket(connectUrl);
+      ws.binaryType = "arraybuffer";
+      this._ws = ws;
+
+      const onceOpen = () => {
+        ws.removeEventListener("open", onceOpen);
+        ws.removeEventListener("error", onceErr);
+        resolve();
+      };
+      const onceErr = (e) => {
+        ws.removeEventListener("open", onceOpen);
+        ws.removeEventListener("error", onceErr);
+        reject(new Error(`WebSocket failed to open: ${e?.type ?? "error"}`));
+      };
+      ws.addEventListener("open", onceOpen);
+      ws.addEventListener("error", onceErr);
+
+      ws.addEventListener("message", (e) => this._onWsMessage(e.data));
+      ws.addEventListener("close", (e) => this._onWsClose(e));
+      ws.addEventListener("error", (e) => {
+        console.error("[ws] socket error", e);
+      });
+    });
+  }
+
+  /**
+   * @param {{ kind: string; queuedMs?: number; played?: number }} data
+   */
+  _onPlaybackMessage(data) {
+    if (data?.kind === "underrun") {
+      // Server stopped sending audio mid-response. Most likely the turn
+      // ended cleanly (a response.done usually arrives just before/after
+      // this). We let the state machine fall back to "connected" via the
+      // response.done event handler.
+    }
+  }
+
+  /**
+   * Mic worklet just sent us a ~40 ms PCM16 16 kHz mono chunk.
+   * Base64-encode and forward via the WS.
+   * @param {ArrayBuffer} pcm16Buffer
+   */
+  _onMicChunk(pcm16Buffer) {
+    if (!this._ws || this._ws.readyState !== WebSocket.OPEN) return;
+    if (!this._sessionConfigured) return; // Server rejects audio before session.update.
+    if (this._muted) return;
+    const b64 = base64FromArrayBuffer(pcm16Buffer);
+    this._send({ type: "input_audio_buffer.append", audio: b64 });
+  }
+
+  /**
+   * @param {string | ArrayBuffer | Blob} raw
+   */
+  async _onWsMessage(raw) {
+    let text;
+    if (typeof raw === "string") {
+      text = raw;
+    } else if (raw instanceof ArrayBuffer) {
+      text = new TextDecoder("utf-8").decode(raw);
+    } else if (raw instanceof Blob) {
+      text = await raw.text();
+    } else {
+      return;
+    }
+
+    let event;
+    try {
+      event = JSON.parse(text);
+    } catch {
+      return;
+    }
+
+    const type = event?.type;
+    if (typeof type !== "string") return;
+    // Opt-in event tracing for diagnosing turn/transcript issues. Enable with
+    // `localStorage.setItem("s2s.debug", "1")` in the browser console.
+    if (this._debug) {
+      const extra = type.startsWith("conversation.item.input_audio_transcription")
+        ? ` item=${event.item_id} ci=${event.content_index} ${event.delta ?? event.transcript ?? ""}`
+        : type.startsWith("response.")
+          ? ` resp=${event.response_id ?? event.response?.id ?? ""} status=${event.response?.status ?? ""} ${event.transcript ?? ""}`
+          : "";
+      console.debug(`[ws] ${type}${extra}`);
+    }
+
+    switch (type) {
+      case "session.created":
+        // Server-side defaults for the s2s pipeline are already what we
+        // want (server_vad, whisper-1 transcription, PCM16 16k in / 24k
+        // out). We only push the user-tunable bits: voice + instructions.
+        this._sendSessionUpdate();
+        this._sessionConfigured = true;
+        if (this._status === "connecting") this._setStatus("connected");
+        break;
+
+      case "session.updated":
+        // Acknowledged by server, nothing to do.
+        break;
+
+      case "input_audio_buffer.speech_started":
+        // User started speaking — stop any audio still playing OR queued, every
+        // time. We clear unconditionally (not just when `_aiSpeaking`): after a
+        // reply or a tool result the worklet's ring buffer can still be draining
+        // even though we already flipped `_aiSpeaking` off, and that tail would
+        // otherwise keep playing over the user's barge-in.
+        this._playbackNode?.port.postMessage({ kind: "clear" });
+        this._aiSpeaking = false;
+        this._setStatus("user-speaking");
+        break;
+
+      case "input_audio_buffer.speech_stopped":
+        if (this._status === "user-speaking") this._setStatus("processing");
+        break;
+
+      case "response.created":
+        // A response now owns the slot — count it and clear our create guard
+        // (this confirms either our create or a server-initiated one).
+        this._openResponses++;
+        this._createInFlight = false;
+        if (this._status === "connected" || this._status === "user-speaking") {
+          this._setStatus("processing");
+        }
+        break;
+
+      case "response.output_item.added":
+        if (this._status === "connected" || this._status === "user-speaking") {
+          this._setStatus("processing");
+        }
+        break;
+
+      case "response.audio.delta":
+      case "response.output_audio.delta": {
+        this._pushAudioDelta(event.delta);
+        const rid = event.response_id ?? event.response?.id;
+        if (rid) this._audibleResponses.add(rid);
+        if (!this._aiSpeaking) {
+          this._aiSpeaking = true;
+          this._markAudible();
+        }
+        break;
+      }
+
+      case "response.content_part.added": {
+        const part = event.part;
+        if (part?.type === "audio" || part?.type === "output_audio") {
+          this._markAudible();
+        }
+        break;
+      }
+
+      case "response.done": {
+        this._aiSpeaking = false;
+        // This response freed the slot (completion OR cancellation both arrive
+        // as response.done). Decrement and, if a create was waiting, replay it.
+        this._openResponses = Math.max(0, this._openResponses - 1);
+        if (this._status === "ai-speaking" || this._status === "processing") {
+          this._setStatus("connected");
+        }
+        // A response closes here for BOTH normal completion and cancellation
+        // (the s2s server signals a speculative-turn interrupt as
+        // `response.done` with status "cancelled" — there is no separate
+        // `response.cancelled` event). Surface the id + status so the UI can
+        // drop a cancelled response's transcript and commit a completed one.
+        const status = event.response?.status ?? "completed";
+        const responseId = event.response?.id ?? "";
+        // Did this response ever play audio? Distinguishes a barge-in cut (the
+        // user heard part of it) from a speculative response that never played.
+        const audible = responseId ? this._audibleResponses.has(responseId) : false;
+        this._audibleResponses.delete(responseId);
+        // Pull whatever transcript the response carries, falling back to the
+        // segments we concatenated from the `*.transcript.done` events (plus any
+        // in-progress delta). For an interrupted reply the response payload may
+        // be empty, so this is the last chance to capture the text.
+        const transcript =
+          extractResponseTranscript(event.response) ||
+          this._asstDisplay(responseId) ||
+          "";
+        // Response finished — clear both transcript accumulators for it.
+        this._asstTranscriptByResp.delete(responseId);
+        this._asstFullByResp.delete(responseId);
+        this.dispatchEvent(new CustomEvent("response-finished", {
+          detail: { responseId, status, audible, transcript },
+        }));
+        // The slot is free now — replay a queued create (e.g. a tool follow-up
+        // that arrived while this response was still running).
+        this._flushQueuedCreate();
+        break;
+      }
+
+      case "response.function_call_arguments.done": {
+        const name = typeof event.name === "string" ? event.name : "";
+        const args = typeof event.arguments === "string" ? event.arguments : "{}";
+        const callId = typeof event.call_id === "string" ? event.call_id : "";
+        if (name) {
+          this.dispatchEvent(new CustomEvent("toolcall", {
+            detail: { name, arguments: args, callId },
+          }));
+        } else {
+          // A nameless call can't be executed, so no function_call_output is
+          // ever sent and the model would wait forever for a result. The
+          // backend shouldn't emit these; warn loudly rather than stall silently.
+          console.warn(`[ws] function_call_arguments.done with no name (call_id=${callId}); cannot run tool — turn may stall`);
+        }
+        break;
+      }
+
+      case "conversation.item.input_audio_transcription.delta": {
+        const delta = typeof event.delta === "string" ? event.delta : "";
+        if (delta) {
+          // `itemId` is REUSED across a speculative continuation, so the UI
+          // groups both segments into one message. The delta carries the full
+          // cumulative transcript so far (not an increment).
+          this.dispatchEvent(
+            new CustomEvent("transcript", {
+              detail: {
+                role: "user",
+                text: delta,
+                partial: true,
+                itemId: typeof event.item_id === "string" ? event.item_id : "",
+              },
+            }),
+          );
+        }
+        break;
+      }
+
+      case "conversation.item.input_audio_transcription.completed": {
+        const transcript = typeof event.transcript === "string" ? event.transcript : "";
+        if (transcript) {
+          this.dispatchEvent(
+            new CustomEvent("transcript", {
+              detail: {
+                role: "user",
+                text: transcript,
+                partial: false,
+                itemId: typeof event.item_id === "string" ? event.item_id : "",
+              },
+            }),
+          );
+        }
+        break;
+      }
+
+      case "response.audio_transcript.delta":
+      case "response.output_audio_transcript.delta": {
+        // Stream the assistant transcript live: accumulate the incremental
+        // deltas and push the running text to the UI. Every transcribe event we
+        // receive reaches the conversation, so an interrupted reply already has
+        // its partial text even if the `.done` never fires.
+        this._markAudible();
+        const rid = typeof event.response_id === "string" ? event.response_id : "";
+        const delta = typeof event.delta === "string" ? event.delta : "";
+        if (delta) {
+          this._asstTranscriptByResp.set(rid, (this._asstTranscriptByResp.get(rid) || "") + delta);
+          // Show completed segments + the segment streaming in right now.
+          this.dispatchEvent(
+            new CustomEvent("transcript", {
+              detail: { role: "assistant", text: this._asstDisplay(rid), partial: true, responseId: rid },
+            }),
+          );
+        }
+        break;
+      }
+
+      case "response.audio_transcript.done":
+      case "response.output_audio_transcript.done": {
+        const rid = typeof event.response_id === "string" ? event.response_id : "";
+        // This is ONE completed segment. A response can emit several; concatenate
+        // them, space-separated, until response.done clears the accumulator.
+        const segment =
+          (typeof event.transcript === "string" && event.transcript) ||
+          this._asstTranscriptByResp.get(rid) ||
+          "";
+        this._asstTranscriptByResp.delete(rid); // segment finished; next one starts fresh
+        if (segment) {
+          const prev = this._asstFullByResp.get(rid) || "";
+          this._asstFullByResp.set(rid, prev ? `${prev} ${segment}` : segment);
+        }
+        const full = this._asstFullByResp.get(rid) || "";
+        if (full) {
+          this.dispatchEvent(
+            new CustomEvent("transcript", {
+              detail: { role: "assistant", text: full, partial: false, responseId: rid },
+            }),
+          );
+        }
+        break;
+      }
+
+      case "error": {
+        const err = event.error;
+        console.error("[ws] server error:", err);
+        // The "another response is already active" race: our optimistic create
+        // collided with a still-running response. Don't surface it — clear the
+        // in-flight guard and re-queue, so the create replays on the next
+        // response.done (never retried immediately, which would just collide
+        // again).
+        if (err?.type === "conversation_already_has_active_response" ||
+            err?.code === "conversation_already_has_active_response") {
+          if (this._createInFlight) {
+            this._createInFlight = false;
+            // Re-queue a BARE create: any image on the original payload was
+            // already sent before this (rejected) create, so don't resend it.
+            this._createQueue.push({});
+          }
+          break;
+        }
+        // Every other server error is non-fatal: surface it for logging but
+        // NEVER tear the socket down. Only transport failures (close / failed
+        // open) are fatal, and those come through their own paths.
+        this.dispatchEvent(
+          new CustomEvent("server-error", { detail: { error: new Error(err?.message ?? "Server error") } }),
+        );
+        break;
+      }
+    }
+  }
+
+  /** @param {string} b64 */
+  _pushAudioDelta(b64) {
+    if (!this._playbackNode) return;
+    if (!b64) return;
+    const bytes = base64ToBytes(b64);
+    const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+    const samples = new Float32Array(bytes.byteLength / 2);
+    for (let i = 0; i < samples.length; i++) {
+      const s = view.getInt16(i * 2, true);
+      samples[i] = s < 0 ? s / 0x8000 : s / 0x7fff;
+    }
+    this._playbackNode.port.postMessage({ kind: "audio", samples }, [samples.buffer]);
+  }
+
+  /** @param {CloseEvent} ev */
+  _onWsClose(ev) {
+    console.log("[ws] socket closed:", ev.code, ev.reason);
+    if (this._status === "closed" || this._status === "error") return;
+    if (ev.code === 1000) {
+      this._setStatus("closed");
+    } else {
+      this.dispatchEvent(
+        new CustomEvent("error", {
+          detail: { error: new Error(`WebSocket closed (${ev.code}) ${ev.reason || ""}`.trim()) },
+        }),
+      );
+      this._setStatus("error");
+    }
+  }
+
+  _sendSessionUpdate() {
+    // Minimal payload: only the bits the user is allowed to configure.
+    // The s2s server already defaults to server_vad, whisper-1
+    // transcription, 16 kHz PCM input and 24 kHz PCM output, so we don't
+    // need (and must not send) `audio.input.format`, `audio.input.transcription`,
+    // `audio.input.turn_detection` or `audio.output.format`: the pydantic
+    // validator on the server rejects the whole event if any unknown or
+    // future-shaped sub-field shows up.
+    /** @type {Record<string, any>} */
+    const session = {
+      type: "realtime",
+      instructions: this.options.instructions,
+      audio: {
+        output: { voice: this.options.voice },
+      },
+    };
+    // Tools are declared here; the backend already accepts them in
+    // session.update and emits response.function_call_arguments.done when the
+    // model decides to call one. Only include the keys when we actually have
+    // tools — the server's pydantic validator is strict about shapes.
+    if (this._tools.length) {
+      session.tools = this._tools;
+      session.tool_choice = "auto";
+    }
+    this._send({ type: "session.update", session });
+  }
+
+  /** Update voice/instructions on a live session without tearing down. */
+  /** @param {{ voice?: string; instructions?: string }} patch */
+  updateSession(patch) {
+    /** @type {Record<string, any>} */
+    const session = { type: "realtime" };
+    if (patch.instructions) session.instructions = patch.instructions;
+    if (patch.voice) session.audio = { output: { voice: patch.voice } };
+    if (Object.keys(session).length > 1) {
+      this._send({ type: "session.update", session });
+    }
+  }
+
+  /**
+   * Replace the declared tool set on a live session (e.g. the user flipped a
+   * tool switch mid-conversation). Always sends `tools` — an empty array
+   * clears them — so toggling the last tool off actually removes it.
+   * @param {ToolDef[]} tools
+   */
+  setTools(tools) {
+    this._tools = tools;
+    this._send({
+      type: "session.update",
+      session: { type: "realtime", tools, tool_choice: tools.length ? "auto" : "none" },
+    });
+  }
+
+  /**
+   * Return a tool's result to the model. Pairs with the `toolcall` event's
+   * `callId`. Caller follows this with `requestResponse()` so the model speaks.
+   * @param {string} callId
+   * @param {string} output Plain text / JSON string the model will read.
+   */
+  sendToolOutput(callId, output) {
+    if (!callId) return; // Can't target a result without the call id.
+    this._send({
+      type: "conversation.item.create",
+      item: { type: "function_call_output", call_id: callId, output },
+    });
+  }
+
+  /**
+   * Add an image to the conversation as user content, so the vision-language
+   * model can see it (used by the camera tool). `dataUrl` is a
+   * `data:image/jpeg;base64,...` string.
+   * @param {string} dataUrl
+   */
+  sendUserImage(dataUrl) {
+    this._send({
+      type: "conversation.item.create",
+      item: {
+        type: "message",
+        role: "user",
+        content: [{ type: "input_image", image_url: dataUrl }],
+      },
+    });
+  }
+
+  /**
+   * Ask the model to generate a response now (after feeding tool results).
+   * Serialized: if a response is already in flight we queue this request and
+   * replay it once the active response finishes, so we never trip the
+   * backend's `conversation_already_has_active_response` guard.
+   *
+   * @param {{ image?: string }} [opts] Optional `image` (a data URL) sent as a
+   *   user `input_image` immediately before this response.create — so the frame
+   *   travels with the create (and is deferred together with it if queued),
+   *   rather than being added to the conversation eagerly. Used by the camera
+   *   tool so the model sees the snapshot in the response it's about to speak.
+   */
+  requestResponse(opts = {}) {
+    if (this._responseActive()) {
+      this._createQueue.push(opts);
+      if (this._debug) console.debug(`[ws] response.create queued (a response is active); pending=${this._createQueue.length}`);
+      return;
+    }
+    this._createResponseNow(opts);
+  }
+
+  /** True while a response occupies the single backend slot. */
+  _responseActive() {
+    return this._openResponses > 0 || this._createInFlight;
+  }
+
+  /** Send a response.create immediately and arm the in-flight guard. Any image
+   *  on the payload is added as user content right before the create.
+   *  @param {{ image?: string }} [opts] */
+  _createResponseNow(opts = {}) {
+    if (!this._ws || this._ws.readyState !== WebSocket.OPEN) return;
+    if (opts.image) this.sendUserImage(opts.image);
+    this._createInFlight = true;
+    this._send({ type: "response.create" });
+  }
+
+  /** Replay one queued response.create if the slot is now free. Called on every
+   *  response.done, so queued creates drain one-per-completion. */
+  _flushQueuedCreate() {
+    if (this._createQueue.length > 0 && !this._responseActive()) {
+      const opts = this._createQueue.shift();
+      if (this._debug) console.debug(`[ws] replaying queued response.create; remaining=${this._createQueue.length}`);
+      this._createResponseNow(opts);
+    }
+  }
+
+  /** @param {boolean} muted */
+  setMuted(muted) {
+    this._muted = muted;
+  }
+
+  /**
+   * Update the mic noise gate live (the user moved the Settings cursor).
+   * @param {NoiseGate} gate
+   */
+  setNoiseGate(gate) {
+    this._noiseGate = gate;
+    this._captureNode?.port.postMessage({ kind: "gate", ...gate });
+  }
+
+  /** @param {Record<string, unknown>} event */
+  _send(event) {
+    if (!this._ws || this._ws.readyState !== WebSocket.OPEN) return;
+    this._ws.send(JSON.stringify(event));
+  }
+
+  async close() {
+    this._visualiser?.stop();
+    this._visualiser = null;
+    try {
+      if (this._ws && this._ws.readyState <= WebSocket.OPEN) {
+        this._ws.close(1000, "client closed");
+      }
+    } catch {
+      // ignored
+    }
+    this._ws = null;
+
+    try {
+      this._captureNode?.port.close?.();
+    } catch {
+      // ignored
+    }
+    try {
+      this._micSrc?.disconnect();
+    } catch {
+      // ignored
+    }
+    try {
+      this._captureNode?.disconnect();
+    } catch {
+      // ignored
+    }
+    try {
+      this._micAnalyser?.disconnect();
+    } catch {
+      // ignored
+    }
+    try {
+      this._outAnalyser?.disconnect();
+    } catch {
+      // ignored
+    }
+    try {
+      this._playbackNode?.disconnect();
+    } catch {
+      // ignored
+    }
+    try {
+      await this._ctx?.close();
+    } catch {
+      // ignored
+    }
+    this._ctx = null;
+    this._captureNode = null;
+    this._playbackNode = null;
+    this._micSrc = null;
+    this._micAnalyser = null;
+    this._outAnalyser = null;
+    this._setStatus("closed");
+  }
+}