Speak the prompt, sign in with the plan you already pay for

Two things landed that change how you start a turn. You can say the prompt out loud on every surface, transcribed locally by whisper.cpp with no key. And you can sign in to Claude Pro/Max or ChatGPT natively, hold several accounts per plan, and let Empryo rotate to the next one when a plan runs dry mid-session. The desktop transcript got rebuilt as one thread while all that was going on.

Press Ctrl+Y in the TUI, click the mic in the desktop composer, or run empryo --headless --voice and speak the prompt. The engine lives in @empryo/core: one recorder, one transcription path, three surfaces.

• Transcription runs through whisper.cpp on your machine by default. No API key, no audio leaving the box. /voice installs a model and shows what each size costs in disk and accuracy; a cloud key is the fallback, not the requirement, and an auth failure on the cloud path falls back to local whisper when a model is installed.
• A VU bar shows your level while you record, on the REC row in the TUI and in the desktop chip. The desktop adds push-to-talk and heals the mic when the device disappears mid-session.
• The shortcut is yours to move. voice.key in config remaps it, and the same keybind grammar now parses shortcuts on every surface.
• Windows recording works, ALSA is the Linux fallback, an orphaned mic process gets swept, and recording errors land in /errors with the real message instead of vanishing.
• voice.command and voice.baseURL sit behind repo trust, so a cloned repo cannot point your microphone at its own endpoint.

--login claude and --login codex run the OAuth flow in Empryo itself. No addon, no proxy daemon; Empryo holds the credentials. codex-device swaps the browser callback for a device code when port 1455 is taken. /login is now an account picker on the TUI, the desktop, and the setup wizard, and the native lanes appear in the model pickers under one grouped Subscriptions provider. The CLIProxyAPI route keeps its own name: /proxy.

Token refresh is built for more than one process. A cross-process lease means two Empryo windows refreshing the same grant do not race each other, a peer's fresh token gets adopted instead of re-fetched, and a grant the provider has actually killed gets a verdict instead of a retry loop. Signing out sticks: a refresh that lands late cannot resurrect a signed-out grant.

One plan hits its window limit and the turn used to die with it. Now:

• Each lane holds several accounts, org-scoped for Claude. When a plan reports spent, Empryo benches it for that model and rotates to the next account mid-session; the turn continues on the new grant. A dead grant falls over to the next account instead of failing the turn.
• Rotation is visible. Native usage meters show each account's window, the desktop Subscriptions panel lists every account with its state, and both surfaces manage accounts (add, remove, reorder) without touching a config file.
• API keys got the same treatment (#186): a provider can hold several keys, and a spent key rotates like a spent plan.

Every voice in a turn used to render as its own block. Now the turn is one spine: your message, the model's thinking, tool calls, subagent replies, and the answer interleave on a single rail in the order they happened. Machine detail folds behind a divider and the turn's accounting follows it there. A token ticker runs live during the turn, hands off to the settled total when it ends, and shows the cache hit rate next to it. The waiting line stages from "waiting for model" to "thinking" the way the TUI does, on the rail gutter where it belongs.

Smaller desktop work in the same round: review and fork actions on the turn, a tab switch that glides instead of snapping ink across the screen, a dither backdrop derived from your OS wallpaper, and a stash popover that scrolls.

A consistency round pinned down rules that used to drift: content keeps top gravity on every terminal size, offsets follow one law, an ask is recorded in the transcript like any other exchange, and usage reads in words. Tab pills float on the canvas with an ember ramp on the active tab that doubles as the context-fill gauge. Kitty image cards stopped gambling: a closed card is a one-liner, reopening rearms the placement, and vision images render at a fixed size with a click-to-view panel instead of stretching the tree. Restoring a session no longer replays old system banners.

proxySoul Undertow is a new monochrome night-tide theme. Under it and every other theme, tool categories now derive their hues from the theme itself, so each theme gets its own distinct family instead of borrowing status colors. The logo wears the theme on every surface, headless syntax highlighting follows the active theme, and empryo.com share cards come themed with a ?theme= link.

• Diffing a large file trims the common prefix and suffix before the LCS pass, so the line counts are exact instead of approximate (#172).
• A running proxy daemon with a missing config gets healed instead of orphaned, and the codex bootstrap is buffered.
• Linux secret storage is probed for a live secret service instead of trusting that the binary exists.
• Bare Esc or Ctrl+C cancels --voice in headless; arrow keys and other escape sequences no longer do.