feat(even-g2): adapt CanvasTTY for glasses with local pairing and voice control

.github/workflows/ci.yml

@@ -26,6 +26,8 @@ jobs:
         run: npm run audit:secrets
       - name: Run tests
         run: npm test
+      - name: Test Even G2 companion
+        run: npm run test:even
       - name: Type-check
         run: npm run typecheck
       - name: Build production bundles

README.md

@@ -56,6 +56,10 @@ npm run dev
 | [Runtime plugin authoring](docs/plugins.md) | [Typed plugin SDK](docs/plugin-api.d.ts) |
 | [Changelog](CHANGELOG.md) | [MIT license](LICENSE) |
 
+## Even G2 companion
+
+The opt-in **Settings → Controls → Even G2** integration adapts CanvasTTY's terminal and AI-agent workflows to Even G2 glasses. Pair with six digits on the same local network, approve access on the computer, then read responses on the glasses HUD, dictate through local Nemotron speech recognition, and create, rename or close shared sessions. The companion includes a More agents picker and supports the desktop's provider list. Its source lives in `integrations/even-g2` and builds with the desktop. See [setup, distribution status and acceptance limits](docs/even-g2.md); a compatible public installer and Even Hub approval are still pending.
+
 ## Runtime plugins
 
 CanvasTTY includes a permissioned runtime for ready-to-run static GitHub packages: HOME widgets, canvas apps, and separate sandboxed windows. The host SDK now supports persistent user-selected music-library grants, seekable local audio streams, and bounded playlist import/export for full player plugins. See the [authoring and security guide](docs/plugins.md), [manifest schema](docs/canvastty-plugin.schema.json), and [TypeScript SDK declarations](docs/plugin-api.d.ts).
@@ -78,6 +82,7 @@ Every browser command produces a redacted local activity record. Persistent JSON
 
 ```bash
 npm test
+npm run test:even
 npm run typecheck
 npm run build
 ```

docs/even-g2-browser-voice-next.md

@@ -0,0 +1,9 @@
+# Even G2 browser and speech scope
+
+The implemented companion reads and controls shared terminal sessions, creates supported agent sessions and submits push-to-talk dictation. Its Browser action opens the existing browser on the computer.
+
+Full browser navigation from the glasses is future work: readable-page extraction, element selection, scrolling, typed/voice interaction, explicit confirmations and return to the original terminal would need their own interaction and safety contracts. No webpage screenshot or link-selection HUD is advertised as implemented.
+
+Speech recognition currently runs locally on the Mac through the bundled transcribe.cpp/Nemotron path or a supported Handy installation. G2 PCM enters the recognition helper directly. External speech applications such as Wispr Flow are not integrated, and G2 audio is not exposed as a general OS microphone by this feature.
+
+Future browser or speech-provider integrations should preserve per-session grants, require real microphone acknowledgements and include physical glasses acceptance. See [the current setup and limitations](even-g2.md).

docs/even-g2-onboarding-progress.md

@@ -0,0 +1,30 @@
+# Even G2 acceptance record
+
+## Current flow
+
+Install a compatible desktop build and Even App companion, enable Even G2 in CanvasTTY Controls, enter six digits and approve scoped device access on the computer. Local discovery uses eight reserved Bonjour names. No separately operated relay is required. The integration never changes the device's VPN or firewall settings.
+
+## Reported physical acceptance
+
+On 14 September 2026 the user confirmed connection, microphone input, terminal interaction and session creation on their Mac/Android/Even G2 setup. The subsequent More agents menu was also user-confirmed. These reports do not establish fresh-machine installation, detached-USB operation or background/reconnect behavior.
+
+## Version 0.5.6 packaging correction
+
+The 0.5.5 store review rejected a dynamic local URL template despite the intended hosts being listed in the manifest. Version 0.5.6 writes the eight origins as complete literals and validates emitted bundle URLs against the manifest before packing. The handoff records 622 desktop and 47 companion tests, type checks, builds, secret audit, and a negative control that rejects the former packaged frontend.
+
+The corrected package was submitted for Even Hub review on 15 September 2026; approval is pending. A fresh 0.5.6 phone installation and physical voice run were not performed. The submitted package is immutable for this Git publication task.
+
+## Integration with current upstream
+
+Pi and OMP remain available in the desktop launcher and are included in the companion's provider lists and More agents picker. Their phone buttons and glasses selection routes are covered by the provider-enumerating tests. Source/CI results for this updated branch must be distinguished from the earlier submitted binary and hardware acceptance.
+
+## Remaining acceptance
+
+- Fresh phone install and complete pairing/voice flow for the next distributed artifact.
+- Clean Mac installation; Intel Mac and other desktop platform device coverage.
+- USB-detached operation, phone lock/background, reconnect and shutdown.
+- Mixed-agent interactive acceptance for the newly added upstream providers.
+- Device-specific transport key isolation and revocation semantics before broad distribution.
+- Full browser navigation from glasses, which is outside the implemented terminal workflow.
+
+See [the setup guide](even-g2.md) and [browser scope](even-g2-browser-voice-next.md).

docs/even-g2.md

@@ -0,0 +1,77 @@
+# Even G2 local companion
+
+CanvasTTY's **Settings → Controls → Even G2** connects the desktop to an installed Even App companion. Both live in this repository. The desktop retains the original CanvasTTY name, application ID, and desktop version. The companion version is **0.5.6**. Integration is off by default.
+
+## Connect
+
+1. Build this integration branch of CanvasTTY and install its matching companion through an available Even Hub test channel. Open the companion in Even App with the glasses connected to the phone. The ordinary upstream release does not yet include this integration.
+2. Put the Mac and phone on the same local network. In CanvasTTY, open **Settings → Controls → Even G2 → Connect Even G2**. Existing valid settings open the connection code directly. The Access tab lets you choose a project folder, shared sessions and permissions.
+3. Enter the **six digits** shown on Mac into the companion’s Code field. Tap **Connect computer**.
+4. Approve the pending connection on Mac. The companion saves its connection using Even App storage. No camera, QR, domain, account with a relay service, ADB, USB forwarding or separately launched tunnel is required for app traffic.
+
+The code is valid for two minutes. The generic companion discovers one of eight reserved local Bonjour names, then verifies the PIN with SRP-6a before receiving the encrypted connection key. No address or key is entered manually. Older CT- tokens and eight-digit codes are rejected.
+
+Local discovery currently targets macOS and requires local name resolution on the phone. The reported physical acceptance used Wi-Fi with the phone VPN off. VPN compatibility is not established. The integration itself never modifies VPN settings.
+
+The desktop listens only on the selected interface's private IPv4 and ULA IPv6 addresses, never an all-interface or public listener. Bonjour advertises a bound private IPv4 address when available, otherwise the selected bound address. The integration does not modify a VPN, OS firewall or router. A selected address still has to be reachable from the phone; guest-network isolation or unavailable IP families can prevent access.
+
+## Create sessions
+
+The phone offers every CanvasTTY hotbar provider: Terminal, Codex, Claude, Qwen Code, Kimi, OpenCode, Hermes, Grok Build, OMP and Pi. On glasses, New Codex and New Terminal retain their direct actions. More agents opens the other agent providers: swipe to choose, click to create, double-click to cancel. Holding while this picker is open does not start dictation.
+
+Creation uses the existing desktop launcher, the shared project folder and the normal launch profile. Each provider still needs its CLI and authentication on the Mac. The integration does not install providers or bypass their login.
+
+## Speech
+
+Recognition runs on Mac. An existing Handy installation/model remains supported, including Nemotron Streaming 3.5. On a new supported Mac, **Access → Voice on this Mac → Prepare Nemotron 3.5** downloads the pinned 716 MiB model, shows progress and checks its SHA-256 before enabling it. Cancel and retry are available.
+
+The packaged native helper uses **transcribe.cpp 0.2.3** and is built for Apple Silicon or Intel macOS. It receives bounded mono PCM16 at 16 kHz through stdin and returns a transcript; it does not record the OS microphone, download while transcribing, or write dictation history. The model stays local. Bundled recognition currently targets macOS; the existing Windows speech path remains unavailable in this preview.
+
+On the glasses, hold to dictate and release to submit. Rename Terminal opens a separate name preview: dictate, review, select Save and click. Name text is never sent as a terminal command. Closing a terminal also requires confirmation. The project-browser action currently opens the existing browser on Mac; full browser navigation from glasses is a separate unfinished feature.
+
+## Connection protection
+
+- The six-digit code authenticates an SRP-6a exchange using the pinned secure-remote-password implementation (2048-bit group, SHA-256). Neither the code nor a reusable PIN-derived encryption key is sent. The client verifies the server proof before accepting the encrypted connection key. Each two-minute offer accepts at most ten handshake starts; a proof can be redeemed once.
+- Mac approval remains mandatory. Persisted bearer credentials are stored only in Even App storage; the desktop stores token hashes and scopes. Identity files use private permissions.
+- Subsequent requests, responses and PCM are AES-GCM encrypted over local HTTP. Computer identity, packet ID and direction are authenticated. The app rejects public, credential-bearing and malformed connection addresses.
+- Existing per-session grants, freshness checks, revocation and request-id replay protection remain enforced. Unknown microphone commands block overlapping native operations; a completed rejection permits a new explicit hold. No recording starts automatically on reconnect.
+- Code bootstrap and ordinary API bodies are bounded. Address probes carry no bearer credential. An uncertain mutation is not automatically repeated at another address.
+
+The generic package declares eight exact local HTTP origins (`canvastty.local:3481` through `canvastty-8.local:3481`), matching the desktop discovery service. There are no network wildcards or machine-specific IPs in the release manifest. Private-build networking and public store review remain separate acceptance gates.
+
+## Build
+
+Use the Node version required by the pinned Vite packages and npm workspaces:
+
+```sh
+npm ci
+npm test
+npm run test:even
+npm run build
+npx electron-builder --dir --mac --arm64 --publish never
+npm run pack:even
+```
+
+The macOS build downloads a pinned native runtime archive, verifies its hash, compiles the small helper with the matching pinned C header, and packages the runtime/licenses from `artifacts/companion-speech`. Use `CANVASTTY_SPEECH_ARCH=x64` for a matching Intel build. No user models, credentials or local profiles go into the distribution.
+
+Output: `integrations/even-g2/release/canvastty-even-g2-0.5.6.ehpk`. Packing validates the emitted JS/HTML/CSS URLs against `network.whitelist` and writes a `.network-check.json` report alongside the package. No per-computer build variable is needed. The packer's explicit `--fixed-origin` option remains for legacy development only; the normal package uses code-based local pairing.
+
+For isolated desktop testing, provide an absolute `CANVASTTY_USER_DATA_DIR` before launch. The process removes that variable from launched terminals. Changes do not migrate another installation's sessions.
+
+## Acceptance and distribution
+
+The local implementation's 0.5.6 handoff records 622 desktop tests and 47 companion tests, type checking, production builds, a secret scan and successful packaging. Its network preflight rejects the former 0.5.5 dynamic URL template and accepts the eight literal origins in the 0.5.6 bundle. The integration branch is tested again after updating to upstream main; use the PR's CI for its current results.
+
+The user confirmed local pairing, microphone input, terminal interaction, session creation and the More agents menu on their Mac/Android/Even G2 setup before the packaging correction. A new physical install or voice run for 0.5.6 was not performed. Clean-Mac onboarding, USB-detached operation, phone lock/background/reconnect, Intel Mac and other desktop OS device acceptance remain unverified. Pi and OMP were added when integrating current upstream; their glasses menu routes have automated coverage, not fresh device acceptance.
+
+Companion 0.5.6 was submitted for Even Hub review on 15 September 2026. Store approval is pending. GitHub source review is independent of that process. The submitted package is retained separately; rebuilding this branch after upstream integration produces a different artifact and does not replace the store submission.
+
+There is no published compatible installer yet. Build from this branch with the commands above. The Mac bundle uses ad-hoc signing without notarization; it has not been validated as a frictionless install on a clean Mac. Do not direct users to an ordinary CanvasTTY release as a compatible G2 build.
+
+## Security review boundaries
+
+Pairing authenticates the short code and separate device grants control API operations. The current local transport distributes one persistent computer encryption key to paired clients. Revoking a device's API token does not rotate that shared transport key, so per-device confidentiality and forward secrecy are not claimed. An upstream security review should address that trust model before broad distribution. User profiles, pairing state and keys are excluded from source and package contents.
+
+The speech runtime and vendored ABI header include the upstream MIT license; packaging copies the runtime's third-party license directory. The ASR model is downloaded separately after user action and is not committed or bundled. Its model card and terms should be reviewed for the intended distribution.
+
+References: [Even Hub test modes](https://hub.evenrealities.com/docs/test), [transcribe.cpp](https://github.com/handy-computer/transcribe.cpp).

electron-builder.yml

@@ -17,6 +17,10 @@ asar: true
 asarUnpack:
   - node_modules/node-pty/**/*
 extraResources:
+  - from: integrations/even-g2/dist
+    to: even-g2-web
+  - from: src/main/services/companion/asr_worker.py
+    to: companion/asr_worker.py
   - from: src/agent-browser
     to: agent-browser
     filter:
@@ -66,6 +70,9 @@ portable:
   artifactName: ${productName}-${version}-windows-${arch}-portable.${ext}
 
 mac:
+  extraResources:
+    - from: artifacts/companion-speech/${arch}
+      to: companion/speech
   icon: build/icon.png
   category: public.app-category.developer-tools
   # A free distribution has no Developer ID identity. Sign the bundle explicitly

integrations/even-g2/.gitignore

@@ -0,0 +1,9 @@
+node_modules/
+dist/
+*.ehpk
+.env
+.env.*
+!.env.example
+.DS_Store
+coverage/
+release/

integrations/even-g2/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 howdeploy
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

integrations/even-g2/README.md

@@ -0,0 +1,18 @@
+# CanvasTTY for Even G2
+
+This companion adapts CanvasTTY's terminal and agent workflows to Even G2 glasses. It includes a phone connection/control interface, glasses HUD, push-to-talk dictation, session creation, rename/close confirmations and a More agents picker. The desktop integration is opt-in under **Settings → Controls → Even G2**.
+
+Use six-digit local pairing on the same network, then approve access on the Mac. Speech recognition runs locally with Nemotron through the bundled helper or an existing supported Handy installation. Each agent still requires its own installed CLI and account on the computer.
+
+See [setup, transport, permissions, speech and acceptance](../../docs/even-g2.md). Run commands from the repository root:
+
+```sh
+npm ci
+npm run test:even
+npm run build
+npm run pack:even
+```
+
+The packer produces `integrations/even-g2/release/canvastty-even-g2-0.5.6.ehpk`. The generic package uses eight literal local discovery origins; packaging rejects undeclared URLs before producing the archive. No machine-specific address is needed.
+
+Version 0.5.6 is submitted for Even Hub review. A public store release and a compatible public desktop installer are not yet available. The source branch includes integration with newer upstream providers; its rebuilt package is separate from the submitted artifact. The companion UI is currently Russian; a complete English localization is not claimed.

integrations/even-g2/app.json

@@ -0,0 +1,35 @@
+{
+  "package_id": "ai.nexcore.canvastty.g2.home",
+  "edition": "202601",
+  "supported_languages": [
+    "en"
+  ],
+  "name": "CanvasTTY G2",
+  "version": "0.5.6",
+  "min_app_version": "2.2.9",
+  "min_sdk_version": "0.0.14",
+  "entrypoint": "index.html",
+  "icon": "app-icon.png",
+  "author": "NEXCORE",
+  "description": "Companion for CanvasTTY: shared sessions, paged answers and voice from Even G2.",
+  "permissions": [
+    {
+      "name": "g2-microphone",
+      "desc": "Glasses microphone during explicit push-to-talk"
+    },
+    {
+      "name": "network",
+      "desc": "Connect to the configured CanvasTTY bridge.",
+      "whitelist": [
+        "http://canvastty.local:3481",
+        "http://canvastty-2.local:3481",
+        "http://canvastty-3.local:3481",
+        "http://canvastty-4.local:3481",
+        "http://canvastty-5.local:3481",
+        "http://canvastty-6.local:3481",
+        "http://canvastty-7.local:3481",
+        "http://canvastty-8.local:3481"
+      ]
+    }
+  ]
+}