feat(codex): add provider-native voice mode

[PengLx]

What Changed

• add a microphone control to persisted Codex threads in the web and desktop clients
• negotiate Codex app-server realtime v3 sessions through typed T3 RPCs
• send only SDP through T3 while microphone and response audio travel directly over WebRTC
• clean up voice sessions on stop, route/provider changes, peer failure, and provider shutdown
• document browser security, provider, mobile, and remote-connection behavior

Why

Codex now exposes provider-native realtime voice, but T3 Code had no way to start it from the current thread. This adds the smallest provider-bound path: the existing Codex process owns the realtime session, T3 routes signaling, and clients own ephemeral media. Raw audio is neither proxied through the T3 WebSocket nor persisted by T3.

This is distinct from global prompt dictation in #5213: voice here is a live two-way Codex session attached to the current thread. Signed macOS builds also need the microphone entitlement tracked in #5321; this PR intentionally does not duplicate that contributor's separate platform change.

UI Changes

Before — persisted Codex thread composer

After — idle microphone action

Rendered live control — connection, mute, and end controls

The control has no animation or timing behavior. The live-state screenshot renders the real composer component without capturing microphone audio.

Surface Decisions

• Web: supported; remote pages require HTTPS for browser microphone access
• Desktop: supported through the web renderer; signed macOS microphone access depends on fix(desktop): allow microphone access #5321
• Mobile: native iOS and Android controls are intentionally not included in this focused PR
• Providers: Codex implements the optional adapter capability; Claude, Cursor, Grok, and OpenCode remain unsupported
• Connections: local, relay, and tunnel signaling use the existing environment RPC path; media remains direct WebRTC client-to-OpenAI

Verification

• vp test run on 6 focused files: 141 tests passed
• targeted typecheck for contracts, client-runtime, server, and web
• targeted lint and formatting checks for changed files
• isolated real-client UI pass for idle, rendered-live-control, narrow-layout, and denied-permission states; no microphone audio was captured

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes
• No animation or timing behavior requires a video; the live interaction state is shown above

Built with Codex (gpt-5.6-sol) in the Codex harness through T3 Code.

Note

Add provider-native voice mode to Codex

• Adds startRealtimeVoice and stopRealtimeVoice to CodexSessionRuntime to manage WebRTC SDP negotiation with Codex via JSON-RPC, including concurrent-start protection, timeouts, and error handling.
• Introduces useCodexRealtimeVoice hook and ComposerVoiceControl UI component to manage microphone access, ICE gathering, and connection state for server-backed Codex threads.
• Adds WebSocket RPC endpoints provider.realtimeVoice.start and provider.realtimeVoice.stop to ws.ts with AuthOrchestrationOperateScope required.
• Risk: CodexSessionRuntime now defaults realtimeVoiceNegotiationTimeoutMs to 20000ms and realtimeVoiceStopTimeoutMs to 3000ms; failure to meet these time bounds will result in timeout errors.

^{Macroscope summarized 5ff77a9.}

---

Note

Medium Risk
Introduces a new authenticated RPC path and substantial Codex runtime concurrency/cleanup logic around realtime negotiation; audio bypasses T3 but mis-handled stop/start races could leave stale sessions or block retries.

Overview
Adds live Codex voice for web/desktop: the composer gets a microphone control that runs a WebRTC session (mic + oai-events data channel) while only SDP goes through new provider.realtimeVoice.start / stop RPCs with orchestration operate scope.

On the server, Codex-only optional adapter hooks route through ProviderService (session recovery on start, no-op stop when inactive). CodexSessionRuntime negotiates Codex realtime v3 (thread/realtime/start / stop) with guarded concurrent starts, answer/stop timeouts, notification handling, and cleanup on stop, interrupt, or runtime close.

The web useCodexRealtimeVoice hook owns peer connection, ICE gathering, mute, and autoplay recovery; ComposerVoiceControl is wired from ChatComposer for Codex threads (version ≥ 0.145.0). Contracts bound SDP size; docs note direct client↔OpenAI audio and no native mobile UI yet.

^{Reviewed by Cursor Bugbot for commit 5ff77a9. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b0445dd4-1a9b-4276-a16e-06a31d8aa447

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

One consistency issue found in apps/web/src/components/chat/ComposerVoiceControl.tsx: the call-site text colors never reach the lucide icons because Button's ghost variant pins --control-icon-color, so the error/destructive tones (including the red microphone documented in docs/user/providers-codex.md) render as muted foreground. See inline comments.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

Reviewed the new Codex realtime voice service surface (contracts, ProviderService, CodexAdapter, CodexSessionRuntime, ws handlers, client atoms) against the Effect service conventions. Imports, service wiring, dependency acquisition, and the new ProviderRealtimeVoiceError (multi-value operation discriminator with a message derived from structural attributes) all look consistent. Two error-modeling findings below.

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

Reviewed the new composer voice control and its call site. The icon-color indirection flagged on the previous run is now fixed ([--control-icon-color:currentColor] is applied on all three buttons). Two remaining findings below: a control that renders enabled but is inert on draft routes, and a status dot bypassing the semantic color token.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR introduces a substantial live voice workflow across browser microphone/WebRTC handling, new authenticated RPCs, provider routing, and Codex session lifecycle coordination. It also changes an authentication package and handles sensitive microphone/audio flows, so the production blast radius warrants human review.

^{You can add or adjust custom eligibility rules. Learn more.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 3 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit ac1563e. Configure here.}

[macroscopeapp]

One finding: the new realtime-voice RPC boundary discards the underlying failure instead of preserving it as cause. Everything else in the changed Effect service scope (namespace subpath imports, Schema.TaggedErrorClass failures with structured attributes and attribute-derived messages, the requireSession + mapCodexRuntimeError pass-through pattern in CodexAdapter, and dependency acquisition in makeCodexSessionRuntime / makeProviderService) follows the conventions.

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

One finding: the live voice control can be unmounted while the session is still streaming. See the inline comment.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

One finding on the new composer voice placement logic. The earlier icon-color, bg-success token, and route-gate items from previous runs look addressed.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

Reviewed the web UI changes (ComposerVoiceControl, its ChatComposer mount points, and useCodexRealtimeVoice). Icon-color indirection, the bg-success token, the render gate, and the duplicate live-control case from earlier rounds all look resolved. One layout nit remains on the new fallback row.

^{Posted via Macroscope — UI Consistency}

[t3dotgg]

Note

🤖 GPT-5.6 Sol responding on behalf of Theo

We're closing this PR as we clean up the T3 Code backlog. Thank you for taking the time to put this together.

We are not adding provider-native voice mode. The provider protocol and client support cost is too high for this path in the current product set.

If you believe we closed this in error, please reopen the PR and leave a comment explaining what we missed.

[PengLx]

What Changed

• add a microphone control to persisted Codex threads in the web and desktop clients
• negotiate Codex app-server realtime v3 sessions through typed T3 RPCs
• send only SDP through T3 while microphone and response audio travel directly over WebRTC
• clean up voice sessions on stop, route/provider changes, peer failure, and provider shutdown
• document browser security, provider, mobile, and remote-connection behavior

Why

Codex now exposes provider-native realtime voice, but T3 Code had no way to start it from the current thread. This adds the smallest provider-bound path: the existing Codex process owns the realtime session, T3 routes signaling, and clients own ephemeral media. Raw audio is neither proxied through the T3 WebSocket nor persisted by T3.

This is distinct from global prompt dictation in #5213: voice here is a live two-way Codex session attached to the current thread. Signed macOS builds also need the microphone entitlement tracked in #5321; this PR intentionally does not duplicate that contributor's separate platform change.

UI Changes

Before — persisted Codex thread composer

After — idle microphone action

Rendered live control — connection, mute, and end controls

The control has no animation or timing behavior. The live-state screenshot renders the real composer component without capturing microphone audio.

Surface Decisions

• Web: supported; remote pages require HTTPS for browser microphone access
• Desktop: supported through the web renderer; signed macOS microphone access depends on fix(desktop): allow microphone access #5321
• Mobile: native iOS and Android controls are intentionally not included in this focused PR
• Providers: Codex implements the optional adapter capability; Claude, Cursor, Grok, and OpenCode remain unsupported
• Connections: local, relay, and tunnel signaling use the existing environment RPC path; media remains direct WebRTC client-to-OpenAI

Verification

• vp test run on 6 focused files: 141 tests passed
• targeted typecheck for contracts, client-runtime, server, and web
• targeted lint and formatting checks for changed files
• isolated real-client UI pass for idle, rendered-live-control, narrow-layout, and denied-permission states; no microphone audio was captured

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes
• No animation or timing behavior requires a video; the live interaction state is shown above

Built with Codex (gpt-5.6-sol) in the Codex harness through T3 Code.

Note

Add provider-native voice mode to Codex

• Adds startRealtimeVoice and stopRealtimeVoice to CodexSessionRuntime to manage WebRTC SDP negotiation with Codex via JSON-RPC, including concurrent-start protection, timeouts, and error handling.
• Introduces useCodexRealtimeVoice hook and ComposerVoiceControl UI component to manage microphone access, ICE gathering, and connection state for server-backed Codex threads.
• Adds WebSocket RPC endpoints provider.realtimeVoice.start and provider.realtimeVoice.stop to ws.ts with AuthOrchestrationOperateScope required.
• Risk: CodexSessionRuntime now defaults realtimeVoiceNegotiationTimeoutMs to 20000ms and realtimeVoiceStopTimeoutMs to 3000ms; failure to meet these time bounds will result in timeout errors.

^{Macroscope summarized 5ff77a9.}

---

Note

Medium Risk
Introduces a new authenticated RPC path and substantial Codex runtime concurrency/cleanup logic around realtime negotiation; audio bypasses T3 but mis-handled stop/start races could leave stale sessions or block retries.

Overview
Adds live Codex voice for web/desktop: the composer gets a microphone control that runs a WebRTC session (mic + oai-events data channel) while only SDP goes through new provider.realtimeVoice.start / stop RPCs with orchestration operate scope.

On the server, Codex-only optional adapter hooks route through ProviderService (session recovery on start, no-op stop when inactive). CodexSessionRuntime negotiates Codex realtime v3 (thread/realtime/start / stop) with guarded concurrent starts, answer/stop timeouts, notification handling, and cleanup on stop, interrupt, or runtime close.

The web useCodexRealtimeVoice hook owns peer connection, ICE gathering, mute, and autoplay recovery; ComposerVoiceControl is wired from ChatComposer for Codex threads (version ≥ 0.145.0). Contracts bound SDP size; docs note direct client↔OpenAI audio and no native mobile UI yet.

^{Reviewed by Cursor Bugbot for commit 5ff77a9. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b0445dd4-1a9b-4276-a16e-06a31d8aa447

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

One consistency issue found in apps/web/src/components/chat/ComposerVoiceControl.tsx: the call-site text colors never reach the lucide icons because Button's ghost variant pins --control-icon-color, so the error/destructive tones (including the red microphone documented in docs/user/providers-codex.md) render as muted foreground. See inline comments.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

Reviewed the new Codex realtime voice service surface (contracts, ProviderService, CodexAdapter, CodexSessionRuntime, ws handlers, client atoms) against the Effect service conventions. Imports, service wiring, dependency acquisition, and the new ProviderRealtimeVoiceError (multi-value operation discriminator with a message derived from structural attributes) all look consistent. Two error-modeling findings below.

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

Reviewed the new composer voice control and its call site. The icon-color indirection flagged on the previous run is now fixed ([--control-icon-color:currentColor] is applied on all three buttons). Two remaining findings below: a control that renders enabled but is inert on draft routes, and a status dot bypassing the semantic color token.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR introduces a substantial live voice workflow across browser microphone/WebRTC handling, new authenticated RPCs, provider routing, and Codex session lifecycle coordination. It also changes an authentication package and handles sensitive microphone/audio flows, so the production blast radius warrants human review.

^{You can add or adjust custom eligibility rules. Learn more.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 3 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit ac1563e. Configure here.}

[macroscopeapp]

One finding: the new realtime-voice RPC boundary discards the underlying failure instead of preserving it as cause. Everything else in the changed Effect service scope (namespace subpath imports, Schema.TaggedErrorClass failures with structured attributes and attribute-derived messages, the requireSession + mapCodexRuntimeError pass-through pattern in CodexAdapter, and dependency acquisition in makeCodexSessionRuntime / makeProviderService) follows the conventions.

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

One finding: the live voice control can be unmounted while the session is still streaming. See the inline comment.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

One finding on the new composer voice placement logic. The earlier icon-color, bg-success token, and route-gate items from previous runs look addressed.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

Reviewed the web UI changes (ComposerVoiceControl, its ChatComposer mount points, and useCodexRealtimeVoice). Icon-color indirection, the bg-success token, the render gate, and the duplicate live-control case from earlier rounds all look resolved. One layout nit remains on the new fallback row.

^{Posted via Macroscope — UI Consistency}

[t3dotgg]

Note

🤖 GPT-5.6 Sol responding on behalf of Theo

We're closing this PR as we clean up the T3 Code backlog. Thank you for taking the time to put this together.

We are not adding provider-native voice mode. The provider protocol and client support cost is too high for this path in the current product set.

If you believe we closed this in error, please reopen the PR and leave a comment explaining what we missed.

[PengLx]

What Changed

• add a microphone control to persisted Codex threads in the web and desktop clients
• negotiate Codex app-server realtime v3 sessions through typed T3 RPCs
• send only SDP through T3 while microphone and response audio travel directly over WebRTC
• clean up voice sessions on stop, route/provider changes, peer failure, and provider shutdown
• document browser security, provider, mobile, and remote-connection behavior

Why

Codex now exposes provider-native realtime voice, but T3 Code had no way to start it from the current thread. This adds the smallest provider-bound path: the existing Codex process owns the realtime session, T3 routes signaling, and clients own ephemeral media. Raw audio is neither proxied through the T3 WebSocket nor persisted by T3.

This is distinct from global prompt dictation in #5213: voice here is a live two-way Codex session attached to the current thread. Signed macOS builds also need the microphone entitlement tracked in #5321; this PR intentionally does not duplicate that contributor's separate platform change.

UI Changes

Before — persisted Codex thread composer

After — idle microphone action

Rendered live control — connection, mute, and end controls

The control has no animation or timing behavior. The live-state screenshot renders the real composer component without capturing microphone audio.

Surface Decisions

• Web: supported; remote pages require HTTPS for browser microphone access
• Desktop: supported through the web renderer; signed macOS microphone access depends on fix(desktop): allow microphone access #5321
• Mobile: native iOS and Android controls are intentionally not included in this focused PR
• Providers: Codex implements the optional adapter capability; Claude, Cursor, Grok, and OpenCode remain unsupported
• Connections: local, relay, and tunnel signaling use the existing environment RPC path; media remains direct WebRTC client-to-OpenAI

Verification

• vp test run on 6 focused files: 141 tests passed
• targeted typecheck for contracts, client-runtime, server, and web
• targeted lint and formatting checks for changed files
• isolated real-client UI pass for idle, rendered-live-control, narrow-layout, and denied-permission states; no microphone audio was captured

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes
• No animation or timing behavior requires a video; the live interaction state is shown above

Built with Codex (gpt-5.6-sol) in the Codex harness through T3 Code.

Note

Add provider-native voice mode to Codex

• Adds startRealtimeVoice and stopRealtimeVoice to CodexSessionRuntime to manage WebRTC SDP negotiation with Codex via JSON-RPC, including concurrent-start protection, timeouts, and error handling.
• Introduces useCodexRealtimeVoice hook and ComposerVoiceControl UI component to manage microphone access, ICE gathering, and connection state for server-backed Codex threads.
• Adds WebSocket RPC endpoints provider.realtimeVoice.start and provider.realtimeVoice.stop to ws.ts with AuthOrchestrationOperateScope required.
• Risk: CodexSessionRuntime now defaults realtimeVoiceNegotiationTimeoutMs to 20000ms and realtimeVoiceStopTimeoutMs to 3000ms; failure to meet these time bounds will result in timeout errors.

^{Macroscope summarized 5ff77a9.}

---

Note

Medium Risk
Introduces a new authenticated RPC path and substantial Codex runtime concurrency/cleanup logic around realtime negotiation; audio bypasses T3 but mis-handled stop/start races could leave stale sessions or block retries.

Overview
Adds live Codex voice for web/desktop: the composer gets a microphone control that runs a WebRTC session (mic + oai-events data channel) while only SDP goes through new provider.realtimeVoice.start / stop RPCs with orchestration operate scope.

On the server, Codex-only optional adapter hooks route through ProviderService (session recovery on start, no-op stop when inactive). CodexSessionRuntime negotiates Codex realtime v3 (thread/realtime/start / stop) with guarded concurrent starts, answer/stop timeouts, notification handling, and cleanup on stop, interrupt, or runtime close.

The web useCodexRealtimeVoice hook owns peer connection, ICE gathering, mute, and autoplay recovery; ComposerVoiceControl is wired from ChatComposer for Codex threads (version ≥ 0.145.0). Contracts bound SDP size; docs note direct client↔OpenAI audio and no native mobile UI yet.

^{Reviewed by Cursor Bugbot for commit 5ff77a9. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b0445dd4-1a9b-4276-a16e-06a31d8aa447

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

One consistency issue found in apps/web/src/components/chat/ComposerVoiceControl.tsx: the call-site text colors never reach the lucide icons because Button's ghost variant pins --control-icon-color, so the error/destructive tones (including the red microphone documented in docs/user/providers-codex.md) render as muted foreground. See inline comments.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

Reviewed the new Codex realtime voice service surface (contracts, ProviderService, CodexAdapter, CodexSessionRuntime, ws handlers, client atoms) against the Effect service conventions. Imports, service wiring, dependency acquisition, and the new ProviderRealtimeVoiceError (multi-value operation discriminator with a message derived from structural attributes) all look consistent. Two error-modeling findings below.

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

Reviewed the new composer voice control and its call site. The icon-color indirection flagged on the previous run is now fixed ([--control-icon-color:currentColor] is applied on all three buttons). Two remaining findings below: a control that renders enabled but is inert on draft routes, and a status dot bypassing the semantic color token.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR introduces a substantial live voice workflow across browser microphone/WebRTC handling, new authenticated RPCs, provider routing, and Codex session lifecycle coordination. It also changes an authentication package and handles sensitive microphone/audio flows, so the production blast radius warrants human review.

^{You can add or adjust custom eligibility rules. Learn more.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 3 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit ac1563e. Configure here.}

[macroscopeapp]

One finding: the new realtime-voice RPC boundary discards the underlying failure instead of preserving it as cause. Everything else in the changed Effect service scope (namespace subpath imports, Schema.TaggedErrorClass failures with structured attributes and attribute-derived messages, the requireSession + mapCodexRuntimeError pass-through pattern in CodexAdapter, and dependency acquisition in makeCodexSessionRuntime / makeProviderService) follows the conventions.

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

One finding: the live voice control can be unmounted while the session is still streaming. See the inline comment.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

One finding on the new composer voice placement logic. The earlier icon-color, bg-success token, and route-gate items from previous runs look addressed.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

Reviewed the web UI changes (ComposerVoiceControl, its ChatComposer mount points, and useCodexRealtimeVoice). Icon-color indirection, the bg-success token, the render gate, and the duplicate live-control case from earlier rounds all look resolved. One layout nit remains on the new fallback row.

^{Posted via Macroscope — UI Consistency}

[t3dotgg]

Note

🤖 GPT-5.6 Sol responding on behalf of Theo

We're closing this PR as we clean up the T3 Code backlog. Thank you for taking the time to put this together.

We are not adding provider-native voice mode. The provider protocol and client support cost is too high for this path in the current product set.

If you believe we closed this in error, please reopen the PR and leave a comment explaining what we missed.

[PengLx]

What Changed

• add a microphone control to persisted Codex threads in the web and desktop clients
• negotiate Codex app-server realtime v3 sessions through typed T3 RPCs
• send only SDP through T3 while microphone and response audio travel directly over WebRTC
• clean up voice sessions on stop, route/provider changes, peer failure, and provider shutdown
• document browser security, provider, mobile, and remote-connection behavior

Why

Codex now exposes provider-native realtime voice, but T3 Code had no way to start it from the current thread. This adds the smallest provider-bound path: the existing Codex process owns the realtime session, T3 routes signaling, and clients own ephemeral media. Raw audio is neither proxied through the T3 WebSocket nor persisted by T3.

This is distinct from global prompt dictation in #5213: voice here is a live two-way Codex session attached to the current thread. Signed macOS builds also need the microphone entitlement tracked in #5321; this PR intentionally does not duplicate that contributor's separate platform change.

UI Changes

Before — persisted Codex thread composer

After — idle microphone action

Rendered live control — connection, mute, and end controls

The control has no animation or timing behavior. The live-state screenshot renders the real composer component without capturing microphone audio.

Surface Decisions

• Web: supported; remote pages require HTTPS for browser microphone access
• Desktop: supported through the web renderer; signed macOS microphone access depends on fix(desktop): allow microphone access #5321
• Mobile: native iOS and Android controls are intentionally not included in this focused PR
• Providers: Codex implements the optional adapter capability; Claude, Cursor, Grok, and OpenCode remain unsupported
• Connections: local, relay, and tunnel signaling use the existing environment RPC path; media remains direct WebRTC client-to-OpenAI

Verification

• vp test run on 6 focused files: 141 tests passed
• targeted typecheck for contracts, client-runtime, server, and web
• targeted lint and formatting checks for changed files
• isolated real-client UI pass for idle, rendered-live-control, narrow-layout, and denied-permission states; no microphone audio was captured

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes
• No animation or timing behavior requires a video; the live interaction state is shown above

Built with Codex (gpt-5.6-sol) in the Codex harness through T3 Code.

Note

Add provider-native voice mode to Codex

• Adds startRealtimeVoice and stopRealtimeVoice to CodexSessionRuntime to manage WebRTC SDP negotiation with Codex via JSON-RPC, including concurrent-start protection, timeouts, and error handling.
• Introduces useCodexRealtimeVoice hook and ComposerVoiceControl UI component to manage microphone access, ICE gathering, and connection state for server-backed Codex threads.
• Adds WebSocket RPC endpoints provider.realtimeVoice.start and provider.realtimeVoice.stop to ws.ts with AuthOrchestrationOperateScope required.
• Risk: CodexSessionRuntime now defaults realtimeVoiceNegotiationTimeoutMs to 20000ms and realtimeVoiceStopTimeoutMs to 3000ms; failure to meet these time bounds will result in timeout errors.

^{Macroscope summarized 5ff77a9.}

---

Note

Medium Risk
Introduces a new authenticated RPC path and substantial Codex runtime concurrency/cleanup logic around realtime negotiation; audio bypasses T3 but mis-handled stop/start races could leave stale sessions or block retries.

Overview
Adds live Codex voice for web/desktop: the composer gets a microphone control that runs a WebRTC session (mic + oai-events data channel) while only SDP goes through new provider.realtimeVoice.start / stop RPCs with orchestration operate scope.

On the server, Codex-only optional adapter hooks route through ProviderService (session recovery on start, no-op stop when inactive). CodexSessionRuntime negotiates Codex realtime v3 (thread/realtime/start / stop) with guarded concurrent starts, answer/stop timeouts, notification handling, and cleanup on stop, interrupt, or runtime close.

The web useCodexRealtimeVoice hook owns peer connection, ICE gathering, mute, and autoplay recovery; ComposerVoiceControl is wired from ChatComposer for Codex threads (version ≥ 0.145.0). Contracts bound SDP size; docs note direct client↔OpenAI audio and no native mobile UI yet.

^{Reviewed by Cursor Bugbot for commit 5ff77a9. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b0445dd4-1a9b-4276-a16e-06a31d8aa447

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

One consistency issue found in apps/web/src/components/chat/ComposerVoiceControl.tsx: the call-site text colors never reach the lucide icons because Button's ghost variant pins --control-icon-color, so the error/destructive tones (including the red microphone documented in docs/user/providers-codex.md) render as muted foreground. See inline comments.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

Reviewed the new Codex realtime voice service surface (contracts, ProviderService, CodexAdapter, CodexSessionRuntime, ws handlers, client atoms) against the Effect service conventions. Imports, service wiring, dependency acquisition, and the new ProviderRealtimeVoiceError (multi-value operation discriminator with a message derived from structural attributes) all look consistent. Two error-modeling findings below.

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

Reviewed the new composer voice control and its call site. The icon-color indirection flagged on the previous run is now fixed ([--control-icon-color:currentColor] is applied on all three buttons). Two remaining findings below: a control that renders enabled but is inert on draft routes, and a status dot bypassing the semantic color token.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR introduces a substantial live voice workflow across browser microphone/WebRTC handling, new authenticated RPCs, provider routing, and Codex session lifecycle coordination. It also changes an authentication package and handles sensitive microphone/audio flows, so the production blast radius warrants human review.

^{You can add or adjust custom eligibility rules. Learn more.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 3 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit ac1563e. Configure here.}

[macroscopeapp]

One finding: the new realtime-voice RPC boundary discards the underlying failure instead of preserving it as cause. Everything else in the changed Effect service scope (namespace subpath imports, Schema.TaggedErrorClass failures with structured attributes and attribute-derived messages, the requireSession + mapCodexRuntimeError pass-through pattern in CodexAdapter, and dependency acquisition in makeCodexSessionRuntime / makeProviderService) follows the conventions.

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

One finding: the live voice control can be unmounted while the session is still streaming. See the inline comment.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

One finding on the new composer voice placement logic. The earlier icon-color, bg-success token, and route-gate items from previous runs look addressed.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

Reviewed the web UI changes (ComposerVoiceControl, its ChatComposer mount points, and useCodexRealtimeVoice). Icon-color indirection, the bg-success token, the render gate, and the duplicate live-control case from earlier rounds all look resolved. One layout nit remains on the new fallback row.

^{Posted via Macroscope — UI Consistency}

[t3dotgg]

Note

🤖 GPT-5.6 Sol responding on behalf of Theo

We're closing this PR as we clean up the T3 Code backlog. Thank you for taking the time to put this together.

We are not adding provider-native voice mode. The provider protocol and client support cost is too high for this path in the current product set.

If you believe we closed this in error, please reopen the PR and leave a comment explaining what we missed.

[PengLx]

What Changed

• add a microphone control to persisted Codex threads in the web and desktop clients
• negotiate Codex app-server realtime v3 sessions through typed T3 RPCs
• send only SDP through T3 while microphone and response audio travel directly over WebRTC
• clean up voice sessions on stop, route/provider changes, peer failure, and provider shutdown
• document browser security, provider, mobile, and remote-connection behavior

Why

Codex now exposes provider-native realtime voice, but T3 Code had no way to start it from the current thread. This adds the smallest provider-bound path: the existing Codex process owns the realtime session, T3 routes signaling, and clients own ephemeral media. Raw audio is neither proxied through the T3 WebSocket nor persisted by T3.

This is distinct from global prompt dictation in #5213: voice here is a live two-way Codex session attached to the current thread. Signed macOS builds also need the microphone entitlement tracked in #5321; this PR intentionally does not duplicate that contributor's separate platform change.

UI Changes

Before — persisted Codex thread composer

After — idle microphone action

Rendered live control — connection, mute, and end controls

The control has no animation or timing behavior. The live-state screenshot renders the real composer component without capturing microphone audio.

Surface Decisions

• Web: supported; remote pages require HTTPS for browser microphone access
• Desktop: supported through the web renderer; signed macOS microphone access depends on fix(desktop): allow microphone access #5321
• Mobile: native iOS and Android controls are intentionally not included in this focused PR
• Providers: Codex implements the optional adapter capability; Claude, Cursor, Grok, and OpenCode remain unsupported
• Connections: local, relay, and tunnel signaling use the existing environment RPC path; media remains direct WebRTC client-to-OpenAI

Verification

• vp test run on 6 focused files: 141 tests passed
• targeted typecheck for contracts, client-runtime, server, and web
• targeted lint and formatting checks for changed files
• isolated real-client UI pass for idle, rendered-live-control, narrow-layout, and denied-permission states; no microphone audio was captured

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes
• No animation or timing behavior requires a video; the live interaction state is shown above

Built with Codex (gpt-5.6-sol) in the Codex harness through T3 Code.

Note

Add provider-native voice mode to Codex

• Adds startRealtimeVoice and stopRealtimeVoice to CodexSessionRuntime to manage WebRTC SDP negotiation with Codex via JSON-RPC, including concurrent-start protection, timeouts, and error handling.
• Introduces useCodexRealtimeVoice hook and ComposerVoiceControl UI component to manage microphone access, ICE gathering, and connection state for server-backed Codex threads.
• Adds WebSocket RPC endpoints provider.realtimeVoice.start and provider.realtimeVoice.stop to ws.ts with AuthOrchestrationOperateScope required.
• Risk: CodexSessionRuntime now defaults realtimeVoiceNegotiationTimeoutMs to 20000ms and realtimeVoiceStopTimeoutMs to 3000ms; failure to meet these time bounds will result in timeout errors.

^{Macroscope summarized 5ff77a9.}

---

Note

Medium Risk
Introduces a new authenticated RPC path and substantial Codex runtime concurrency/cleanup logic around realtime negotiation; audio bypasses T3 but mis-handled stop/start races could leave stale sessions or block retries.

Overview
Adds live Codex voice for web/desktop: the composer gets a microphone control that runs a WebRTC session (mic + oai-events data channel) while only SDP goes through new provider.realtimeVoice.start / stop RPCs with orchestration operate scope.

On the server, Codex-only optional adapter hooks route through ProviderService (session recovery on start, no-op stop when inactive). CodexSessionRuntime negotiates Codex realtime v3 (thread/realtime/start / stop) with guarded concurrent starts, answer/stop timeouts, notification handling, and cleanup on stop, interrupt, or runtime close.

The web useCodexRealtimeVoice hook owns peer connection, ICE gathering, mute, and autoplay recovery; ComposerVoiceControl is wired from ChatComposer for Codex threads (version ≥ 0.145.0). Contracts bound SDP size; docs note direct client↔OpenAI audio and no native mobile UI yet.

^{Reviewed by Cursor Bugbot for commit 5ff77a9. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b0445dd4-1a9b-4276-a16e-06a31d8aa447

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

One consistency issue found in apps/web/src/components/chat/ComposerVoiceControl.tsx: the call-site text colors never reach the lucide icons because Button's ghost variant pins --control-icon-color, so the error/destructive tones (including the red microphone documented in docs/user/providers-codex.md) render as muted foreground. See inline comments.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

Reviewed the new Codex realtime voice service surface (contracts, ProviderService, CodexAdapter, CodexSessionRuntime, ws handlers, client atoms) against the Effect service conventions. Imports, service wiring, dependency acquisition, and the new ProviderRealtimeVoiceError (multi-value operation discriminator with a message derived from structural attributes) all look consistent. Two error-modeling findings below.

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

Reviewed the new composer voice control and its call site. The icon-color indirection flagged on the previous run is now fixed ([--control-icon-color:currentColor] is applied on all three buttons). Two remaining findings below: a control that renders enabled but is inert on draft routes, and a status dot bypassing the semantic color token.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR introduces a substantial live voice workflow across browser microphone/WebRTC handling, new authenticated RPCs, provider routing, and Codex session lifecycle coordination. It also changes an authentication package and handles sensitive microphone/audio flows, so the production blast radius warrants human review.

^{You can add or adjust custom eligibility rules. Learn more.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 3 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit ac1563e. Configure here.}

[macroscopeapp]

One finding: the new realtime-voice RPC boundary discards the underlying failure instead of preserving it as cause. Everything else in the changed Effect service scope (namespace subpath imports, Schema.TaggedErrorClass failures with structured attributes and attribute-derived messages, the requireSession + mapCodexRuntimeError pass-through pattern in CodexAdapter, and dependency acquisition in makeCodexSessionRuntime / makeProviderService) follows the conventions.

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

One finding: the live voice control can be unmounted while the session is still streaming. See the inline comment.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

One finding on the new composer voice placement logic. The earlier icon-color, bg-success token, and route-gate items from previous runs look addressed.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

Reviewed the web UI changes (ComposerVoiceControl, its ChatComposer mount points, and useCodexRealtimeVoice). Icon-color indirection, the bg-success token, the render gate, and the duplicate live-control case from earlier rounds all look resolved. One layout nit remains on the new fallback row.

^{Posted via Macroscope — UI Consistency}

[t3dotgg]

Note

🤖 GPT-5.6 Sol responding on behalf of Theo

We're closing this PR as we clean up the T3 Code backlog. Thank you for taking the time to put this together.

We are not adding provider-native voice mode. The provider protocol and client support cost is too high for this path in the current product set.

If you believe we closed this in error, please reopen the PR and leave a comment explaining what we missed.

[PengLx]

What Changed

• add a microphone control to persisted Codex threads in the web and desktop clients
• negotiate Codex app-server realtime v3 sessions through typed T3 RPCs
• send only SDP through T3 while microphone and response audio travel directly over WebRTC
• clean up voice sessions on stop, route/provider changes, peer failure, and provider shutdown
• document browser security, provider, mobile, and remote-connection behavior

Why

Codex now exposes provider-native realtime voice, but T3 Code had no way to start it from the current thread. This adds the smallest provider-bound path: the existing Codex process owns the realtime session, T3 routes signaling, and clients own ephemeral media. Raw audio is neither proxied through the T3 WebSocket nor persisted by T3.

This is distinct from global prompt dictation in #5213: voice here is a live two-way Codex session attached to the current thread. Signed macOS builds also need the microphone entitlement tracked in #5321; this PR intentionally does not duplicate that contributor's separate platform change.

UI Changes

Before — persisted Codex thread composer

After — idle microphone action

Rendered live control — connection, mute, and end controls

The control has no animation or timing behavior. The live-state screenshot renders the real composer component without capturing microphone audio.

Surface Decisions

• Web: supported; remote pages require HTTPS for browser microphone access
• Desktop: supported through the web renderer; signed macOS microphone access depends on fix(desktop): allow microphone access #5321
• Mobile: native iOS and Android controls are intentionally not included in this focused PR
• Providers: Codex implements the optional adapter capability; Claude, Cursor, Grok, and OpenCode remain unsupported
• Connections: local, relay, and tunnel signaling use the existing environment RPC path; media remains direct WebRTC client-to-OpenAI

Verification

• vp test run on 6 focused files: 141 tests passed
• targeted typecheck for contracts, client-runtime, server, and web
• targeted lint and formatting checks for changed files
• isolated real-client UI pass for idle, rendered-live-control, narrow-layout, and denied-permission states; no microphone audio was captured

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes
• No animation or timing behavior requires a video; the live interaction state is shown above

Built with Codex (gpt-5.6-sol) in the Codex harness through T3 Code.

Note

Add provider-native voice mode to Codex

• Adds startRealtimeVoice and stopRealtimeVoice to CodexSessionRuntime to manage WebRTC SDP negotiation with Codex via JSON-RPC, including concurrent-start protection, timeouts, and error handling.
• Introduces useCodexRealtimeVoice hook and ComposerVoiceControl UI component to manage microphone access, ICE gathering, and connection state for server-backed Codex threads.
• Adds WebSocket RPC endpoints provider.realtimeVoice.start and provider.realtimeVoice.stop to ws.ts with AuthOrchestrationOperateScope required.
• Risk: CodexSessionRuntime now defaults realtimeVoiceNegotiationTimeoutMs to 20000ms and realtimeVoiceStopTimeoutMs to 3000ms; failure to meet these time bounds will result in timeout errors.

^{Macroscope summarized 5ff77a9.}

---

Note

Medium Risk
Introduces a new authenticated RPC path and substantial Codex runtime concurrency/cleanup logic around realtime negotiation; audio bypasses T3 but mis-handled stop/start races could leave stale sessions or block retries.

Overview
Adds live Codex voice for web/desktop: the composer gets a microphone control that runs a WebRTC session (mic + oai-events data channel) while only SDP goes through new provider.realtimeVoice.start / stop RPCs with orchestration operate scope.

On the server, Codex-only optional adapter hooks route through ProviderService (session recovery on start, no-op stop when inactive). CodexSessionRuntime negotiates Codex realtime v3 (thread/realtime/start / stop) with guarded concurrent starts, answer/stop timeouts, notification handling, and cleanup on stop, interrupt, or runtime close.

The web useCodexRealtimeVoice hook owns peer connection, ICE gathering, mute, and autoplay recovery; ComposerVoiceControl is wired from ChatComposer for Codex threads (version ≥ 0.145.0). Contracts bound SDP size; docs note direct client↔OpenAI audio and no native mobile UI yet.

^{Reviewed by Cursor Bugbot for commit 5ff77a9. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b0445dd4-1a9b-4276-a16e-06a31d8aa447

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

One consistency issue found in apps/web/src/components/chat/ComposerVoiceControl.tsx: the call-site text colors never reach the lucide icons because Button's ghost variant pins --control-icon-color, so the error/destructive tones (including the red microphone documented in docs/user/providers-codex.md) render as muted foreground. See inline comments.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

Reviewed the new Codex realtime voice service surface (contracts, ProviderService, CodexAdapter, CodexSessionRuntime, ws handlers, client atoms) against the Effect service conventions. Imports, service wiring, dependency acquisition, and the new ProviderRealtimeVoiceError (multi-value operation discriminator with a message derived from structural attributes) all look consistent. Two error-modeling findings below.

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

Reviewed the new composer voice control and its call site. The icon-color indirection flagged on the previous run is now fixed ([--control-icon-color:currentColor] is applied on all three buttons). Two remaining findings below: a control that renders enabled but is inert on draft routes, and a status dot bypassing the semantic color token.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR introduces a substantial live voice workflow across browser microphone/WebRTC handling, new authenticated RPCs, provider routing, and Codex session lifecycle coordination. It also changes an authentication package and handles sensitive microphone/audio flows, so the production blast radius warrants human review.

^{You can add or adjust custom eligibility rules. Learn more.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 3 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit ac1563e. Configure here.}

[macroscopeapp]

One finding: the new realtime-voice RPC boundary discards the underlying failure instead of preserving it as cause. Everything else in the changed Effect service scope (namespace subpath imports, Schema.TaggedErrorClass failures with structured attributes and attribute-derived messages, the requireSession + mapCodexRuntimeError pass-through pattern in CodexAdapter, and dependency acquisition in makeCodexSessionRuntime / makeProviderService) follows the conventions.

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

One finding: the live voice control can be unmounted while the session is still streaming. See the inline comment.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

One finding on the new composer voice placement logic. The earlier icon-color, bg-success token, and route-gate items from previous runs look addressed.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

Reviewed the web UI changes (ComposerVoiceControl, its ChatComposer mount points, and useCodexRealtimeVoice). Icon-color indirection, the bg-success token, the render gate, and the duplicate live-control case from earlier rounds all look resolved. One layout nit remains on the new fallback row.

^{Posted via Macroscope — UI Consistency}

[t3dotgg]

Note

🤖 GPT-5.6 Sol responding on behalf of Theo

We're closing this PR as we clean up the T3 Code backlog. Thank you for taking the time to put this together.

We are not adding provider-native voice mode. The provider protocol and client support cost is too high for this path in the current product set.

If you believe we closed this in error, please reopen the PR and leave a comment explaining what we missed.

[PengLx]

What Changed

• add a microphone control to persisted Codex threads in the web and desktop clients
• negotiate Codex app-server realtime v3 sessions through typed T3 RPCs
• send only SDP through T3 while microphone and response audio travel directly over WebRTC
• clean up voice sessions on stop, route/provider changes, peer failure, and provider shutdown
• document browser security, provider, mobile, and remote-connection behavior

Why

Codex now exposes provider-native realtime voice, but T3 Code had no way to start it from the current thread. This adds the smallest provider-bound path: the existing Codex process owns the realtime session, T3 routes signaling, and clients own ephemeral media. Raw audio is neither proxied through the T3 WebSocket nor persisted by T3.

This is distinct from global prompt dictation in #5213: voice here is a live two-way Codex session attached to the current thread. Signed macOS builds also need the microphone entitlement tracked in #5321; this PR intentionally does not duplicate that contributor's separate platform change.

UI Changes

Before — persisted Codex thread composer

After — idle microphone action

Rendered live control — connection, mute, and end controls

The control has no animation or timing behavior. The live-state screenshot renders the real composer component without capturing microphone audio.

Surface Decisions

• Web: supported; remote pages require HTTPS for browser microphone access
• Desktop: supported through the web renderer; signed macOS microphone access depends on fix(desktop): allow microphone access #5321
• Mobile: native iOS and Android controls are intentionally not included in this focused PR
• Providers: Codex implements the optional adapter capability; Claude, Cursor, Grok, and OpenCode remain unsupported
• Connections: local, relay, and tunnel signaling use the existing environment RPC path; media remains direct WebRTC client-to-OpenAI

Verification

• vp test run on 6 focused files: 141 tests passed
• targeted typecheck for contracts, client-runtime, server, and web
• targeted lint and formatting checks for changed files
• isolated real-client UI pass for idle, rendered-live-control, narrow-layout, and denied-permission states; no microphone audio was captured

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes
• No animation or timing behavior requires a video; the live interaction state is shown above

Built with Codex (gpt-5.6-sol) in the Codex harness through T3 Code.

Note

Add provider-native voice mode to Codex

• Adds startRealtimeVoice and stopRealtimeVoice to CodexSessionRuntime to manage WebRTC SDP negotiation with Codex via JSON-RPC, including concurrent-start protection, timeouts, and error handling.
• Introduces useCodexRealtimeVoice hook and ComposerVoiceControl UI component to manage microphone access, ICE gathering, and connection state for server-backed Codex threads.
• Adds WebSocket RPC endpoints provider.realtimeVoice.start and provider.realtimeVoice.stop to ws.ts with AuthOrchestrationOperateScope required.
• Risk: CodexSessionRuntime now defaults realtimeVoiceNegotiationTimeoutMs to 20000ms and realtimeVoiceStopTimeoutMs to 3000ms; failure to meet these time bounds will result in timeout errors.

^{Macroscope summarized 5ff77a9.}

---

Note

Medium Risk
Introduces a new authenticated RPC path and substantial Codex runtime concurrency/cleanup logic around realtime negotiation; audio bypasses T3 but mis-handled stop/start races could leave stale sessions or block retries.

Overview
Adds live Codex voice for web/desktop: the composer gets a microphone control that runs a WebRTC session (mic + oai-events data channel) while only SDP goes through new provider.realtimeVoice.start / stop RPCs with orchestration operate scope.

On the server, Codex-only optional adapter hooks route through ProviderService (session recovery on start, no-op stop when inactive). CodexSessionRuntime negotiates Codex realtime v3 (thread/realtime/start / stop) with guarded concurrent starts, answer/stop timeouts, notification handling, and cleanup on stop, interrupt, or runtime close.

The web useCodexRealtimeVoice hook owns peer connection, ICE gathering, mute, and autoplay recovery; ComposerVoiceControl is wired from ChatComposer for Codex threads (version ≥ 0.145.0). Contracts bound SDP size; docs note direct client↔OpenAI audio and no native mobile UI yet.

^{Reviewed by Cursor Bugbot for commit 5ff77a9. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b0445dd4-1a9b-4276-a16e-06a31d8aa447

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

One consistency issue found in apps/web/src/components/chat/ComposerVoiceControl.tsx: the call-site text colors never reach the lucide icons because Button's ghost variant pins --control-icon-color, so the error/destructive tones (including the red microphone documented in docs/user/providers-codex.md) render as muted foreground. See inline comments.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

Reviewed the new Codex realtime voice service surface (contracts, ProviderService, CodexAdapter, CodexSessionRuntime, ws handlers, client atoms) against the Effect service conventions. Imports, service wiring, dependency acquisition, and the new ProviderRealtimeVoiceError (multi-value operation discriminator with a message derived from structural attributes) all look consistent. Two error-modeling findings below.

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

Reviewed the new composer voice control and its call site. The icon-color indirection flagged on the previous run is now fixed ([--control-icon-color:currentColor] is applied on all three buttons). Two remaining findings below: a control that renders enabled but is inert on draft routes, and a status dot bypassing the semantic color token.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR introduces a substantial live voice workflow across browser microphone/WebRTC handling, new authenticated RPCs, provider routing, and Codex session lifecycle coordination. It also changes an authentication package and handles sensitive microphone/audio flows, so the production blast radius warrants human review.

^{You can add or adjust custom eligibility rules. Learn more.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 3 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit ac1563e. Configure here.}

[macroscopeapp]

One finding: the new realtime-voice RPC boundary discards the underlying failure instead of preserving it as cause. Everything else in the changed Effect service scope (namespace subpath imports, Schema.TaggedErrorClass failures with structured attributes and attribute-derived messages, the requireSession + mapCodexRuntimeError pass-through pattern in CodexAdapter, and dependency acquisition in makeCodexSessionRuntime / makeProviderService) follows the conventions.

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

One finding: the live voice control can be unmounted while the session is still streaming. See the inline comment.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

One finding on the new composer voice placement logic. The earlier icon-color, bg-success token, and route-gate items from previous runs look addressed.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

Reviewed the web UI changes (ComposerVoiceControl, its ChatComposer mount points, and useCodexRealtimeVoice). Icon-color indirection, the bg-success token, the render gate, and the duplicate live-control case from earlier rounds all look resolved. One layout nit remains on the new fallback row.

^{Posted via Macroscope — UI Consistency}

[t3dotgg]

Note

🤖 GPT-5.6 Sol responding on behalf of Theo

We're closing this PR as we clean up the T3 Code backlog. Thank you for taking the time to put this together.

We are not adding provider-native voice mode. The provider protocol and client support cost is too high for this path in the current product set.

If you believe we closed this in error, please reopen the PR and leave a comment explaining what we missed.

[PengLx]

What Changed

• add a microphone control to persisted Codex threads in the web and desktop clients
• negotiate Codex app-server realtime v3 sessions through typed T3 RPCs
• send only SDP through T3 while microphone and response audio travel directly over WebRTC
• clean up voice sessions on stop, route/provider changes, peer failure, and provider shutdown
• document browser security, provider, mobile, and remote-connection behavior

Why

Codex now exposes provider-native realtime voice, but T3 Code had no way to start it from the current thread. This adds the smallest provider-bound path: the existing Codex process owns the realtime session, T3 routes signaling, and clients own ephemeral media. Raw audio is neither proxied through the T3 WebSocket nor persisted by T3.

This is distinct from global prompt dictation in #5213: voice here is a live two-way Codex session attached to the current thread. Signed macOS builds also need the microphone entitlement tracked in #5321; this PR intentionally does not duplicate that contributor's separate platform change.

UI Changes

Before — persisted Codex thread composer

After — idle microphone action

Rendered live control — connection, mute, and end controls

The control has no animation or timing behavior. The live-state screenshot renders the real composer component without capturing microphone audio.

Surface Decisions

• Web: supported; remote pages require HTTPS for browser microphone access
• Desktop: supported through the web renderer; signed macOS microphone access depends on fix(desktop): allow microphone access #5321
• Mobile: native iOS and Android controls are intentionally not included in this focused PR
• Providers: Codex implements the optional adapter capability; Claude, Cursor, Grok, and OpenCode remain unsupported
• Connections: local, relay, and tunnel signaling use the existing environment RPC path; media remains direct WebRTC client-to-OpenAI

Verification

• vp test run on 6 focused files: 141 tests passed
• targeted typecheck for contracts, client-runtime, server, and web
• targeted lint and formatting checks for changed files
• isolated real-client UI pass for idle, rendered-live-control, narrow-layout, and denied-permission states; no microphone audio was captured

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes
• No animation or timing behavior requires a video; the live interaction state is shown above

Built with Codex (gpt-5.6-sol) in the Codex harness through T3 Code.

Note

Add provider-native voice mode to Codex

• Adds startRealtimeVoice and stopRealtimeVoice to CodexSessionRuntime to manage WebRTC SDP negotiation with Codex via JSON-RPC, including concurrent-start protection, timeouts, and error handling.
• Introduces useCodexRealtimeVoice hook and ComposerVoiceControl UI component to manage microphone access, ICE gathering, and connection state for server-backed Codex threads.
• Adds WebSocket RPC endpoints provider.realtimeVoice.start and provider.realtimeVoice.stop to ws.ts with AuthOrchestrationOperateScope required.
• Risk: CodexSessionRuntime now defaults realtimeVoiceNegotiationTimeoutMs to 20000ms and realtimeVoiceStopTimeoutMs to 3000ms; failure to meet these time bounds will result in timeout errors.

^{Macroscope summarized 5ff77a9.}

---

Note

Medium Risk
Introduces a new authenticated RPC path and substantial Codex runtime concurrency/cleanup logic around realtime negotiation; audio bypasses T3 but mis-handled stop/start races could leave stale sessions or block retries.

Overview
Adds live Codex voice for web/desktop: the composer gets a microphone control that runs a WebRTC session (mic + oai-events data channel) while only SDP goes through new provider.realtimeVoice.start / stop RPCs with orchestration operate scope.

On the server, Codex-only optional adapter hooks route through ProviderService (session recovery on start, no-op stop when inactive). CodexSessionRuntime negotiates Codex realtime v3 (thread/realtime/start / stop) with guarded concurrent starts, answer/stop timeouts, notification handling, and cleanup on stop, interrupt, or runtime close.

The web useCodexRealtimeVoice hook owns peer connection, ICE gathering, mute, and autoplay recovery; ComposerVoiceControl is wired from ChatComposer for Codex threads (version ≥ 0.145.0). Contracts bound SDP size; docs note direct client↔OpenAI audio and no native mobile UI yet.

^{Reviewed by Cursor Bugbot for commit 5ff77a9. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b0445dd4-1a9b-4276-a16e-06a31d8aa447

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

One consistency issue found in apps/web/src/components/chat/ComposerVoiceControl.tsx: the call-site text colors never reach the lucide icons because Button's ghost variant pins --control-icon-color, so the error/destructive tones (including the red microphone documented in docs/user/providers-codex.md) render as muted foreground. See inline comments.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

Reviewed the new Codex realtime voice service surface (contracts, ProviderService, CodexAdapter, CodexSessionRuntime, ws handlers, client atoms) against the Effect service conventions. Imports, service wiring, dependency acquisition, and the new ProviderRealtimeVoiceError (multi-value operation discriminator with a message derived from structural attributes) all look consistent. Two error-modeling findings below.

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

Reviewed the new composer voice control and its call site. The icon-color indirection flagged on the previous run is now fixed ([--control-icon-color:currentColor] is applied on all three buttons). Two remaining findings below: a control that renders enabled but is inert on draft routes, and a status dot bypassing the semantic color token.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR introduces a substantial live voice workflow across browser microphone/WebRTC handling, new authenticated RPCs, provider routing, and Codex session lifecycle coordination. It also changes an authentication package and handles sensitive microphone/audio flows, so the production blast radius warrants human review.

^{You can add or adjust custom eligibility rules. Learn more.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 3 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit ac1563e. Configure here.}

[macroscopeapp]

One finding: the new realtime-voice RPC boundary discards the underlying failure instead of preserving it as cause. Everything else in the changed Effect service scope (namespace subpath imports, Schema.TaggedErrorClass failures with structured attributes and attribute-derived messages, the requireSession + mapCodexRuntimeError pass-through pattern in CodexAdapter, and dependency acquisition in makeCodexSessionRuntime / makeProviderService) follows the conventions.

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

One finding: the live voice control can be unmounted while the session is still streaming. See the inline comment.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

One finding on the new composer voice placement logic. The earlier icon-color, bg-success token, and route-gate items from previous runs look addressed.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

Reviewed the web UI changes (ComposerVoiceControl, its ChatComposer mount points, and useCodexRealtimeVoice). Icon-color indirection, the bg-success token, the render gate, and the duplicate live-control case from earlier rounds all look resolved. One layout nit remains on the new fallback row.

^{Posted via Macroscope — UI Consistency}

[t3dotgg]

Note

🤖 GPT-5.6 Sol responding on behalf of Theo

We're closing this PR as we clean up the T3 Code backlog. Thank you for taking the time to put this together.

We are not adding provider-native voice mode. The provider protocol and client support cost is too high for this path in the current product set.

If you believe we closed this in error, please reopen the PR and leave a comment explaining what we missed.