Repository navigation
feat: S1 — Live API ephemeral token endpoint - #30
Merged
Merged
Conversation
- drop the duplicate Gemini voice entry now tracked by the v2 voice spec - drop the cast win animation item from the v2 queue - check off the global definition-of-done gates shipped with v1 Commit-generated-by: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Ashley Childress <6563688+anchildress1@users.noreply.github.com>
- add POST /api/voice/token minting single-use v1alpha tokens scoped to the Live model - keep the long-lived key out of every response and log; reuse the debug-log mask as the single masking implementation - guard against key burn with fixed-window limits: 10/min per session, 60/min global - warn once per window on global exhaustion so abuse is visible without log flooding - share the Live model constant so the client connects with what the token locks - cover mint, leak, failure, and limiter paths with 39 server tests; gate the limiter at 100/95 and the route at 90/85 coverage Generated-by: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Ashley Childress <6563688+anchildress1@users.noreply.github.com>
- ignore CHANGELOG.md so format runs stop rewriting generated bullet style Generated-by: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Ashley Childress <6563688+anchildress1@users.noreply.github.com>
Generated-by: Codex <noreply@openai.com> Signed-off-by: Ashley Childress <6563688+anchildress1@users.noreply.github.com>
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What 🎫
Implements S1 from
docs/v2-implementation-checklist.md(R2 indocs/v2-voice-requirements.md): the existing Cloud Run server mints short-lived Gemini Live API ephemeral tokens so the browser can open the Oracle's voice session without ever seeing the long-lived key.How
POST /api/voice/token→authTokens.createonv1alpha(@google/genai2.8.0)liveConnectConstraintsLIVE_MODELlives in sharedsrc/lib/voice/config.ts— S2's client must connect with the same constant the token locks{ token }; error logs masked through the one exportedmaskApiKey(no second copy of the secrecy rule)retry-after; denied requests never reach the SDK; global trips warn once per windowDecisions ⚖️
gemini-3.1-flash-live-preview(current per June 2026 docs) — single swappable constant; S2 validates at first real connect alongside the Gacrux/Kore voice question/debugstream tee deferred to S2:DebugEvent.partis turn-scoped today; the voice debug taxonomy gets designed once with S2's event contractCHANGELOG.mdadded to.prettierignore— Release Please owns it; format runs kept rewriting its bullet styleProof ✅
make ai-checksexit 0 (format, lint, typecheck, full suite, build)🤖 Generated with Claude Code