Add private local Reachy camera viewer

CHANGELOG.md

@@ -24,6 +24,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 - Realtime client, silence playback asset, and tests for Realtime audio and power-state behavior.
 - Optional on-demand Reachy camera tool with local diagnostics and Realtime image input.
 - Authenticated, non-cacheable one-frame snapshot route for explicit image sharing.
+- Opt-in Robot-tab live viewer for the daemon's existing local WebRTC camera feed, with explicit Awake-only policy, muted audio, no public STUN dependency, and automatic disconnect on privacy/background transitions.
 - Privacy-controlled daemon-local face following that runs only during an active post-wake conversation.
 - Optional wake-time DOA orientation using Reachy's local microphone-array direction estimate.
 - Curated Realtime robot tools for look direction, authentic recorded emotions, and three recorded dance styles.
@@ -49,7 +50,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 - App-off no longer waits on the daemon response from inside the process being stopped, removing a ten-second shutdown cycle and traceback.
 - Realtime interruption tracks locally buffered audio after server generation finishes, immediately flushes Reachy playback, and truncates the unplayed OpenAI conversation audio.
 - Camera access defaults to off and captures only one fresh JPEG per explicit Realtime visual-tool call.
-- Camera capture waits for a completed tool item, deduplicates call IDs, and remains blocked in Meeting/Sleep.
+- Camera capture waits for a completed tool item, deduplicates call IDs, and remains blocked in Meeting/Sleep; authenticated snapshots and local diagnostics now enforce and recheck the same privacy boundary while waiting for a frame.
+- The local viewer closes both media sessions and signaling sockets, accepts only Reachy's named camera producer, and fails closed when runtime status disappears or the voice app stops.
 - Awake now runs Reachy's physical wake-up motion instead of only enabling motor torque.
 - Meeting and Sleep stop active playback and microphone capture before disabling motors.
 - Meeting/Sleep action cancellation now restarts Reachy's playback backend when returning to Standby/Awake.
@@ -64,7 +66,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ### Verified
 
-- Ruff passes and 64 automated tests pass.
+- Ruff passes and 70 automated tests pass.
 - Realtime session creation, audio response, configurable reasoning, and Hermes tool delegation succeed against the live API.
 - ElevenLabs TTS/STT round trip succeeds.
 - Reachy power states, clean app stop/restart, API soak tests, motor mode, and daemon health pass on the reference Reachy Mini Lite deployment.

README.md

@@ -70,7 +70,7 @@ Pipeline mode supports selectable STT, TTS, agent model, voice, and continued co
 - Curated Realtime embodiment tools for looking, emotions, and authentic recorded Reachy dances.
 - Optional daemon-local face following, active only after the wake phrase for the current conversation.
 - Optional wake-time microphone-array direction finding so Reachy turns once toward the speaker locally.
-- Privacy-preserving on-demand camera: one JPEG is captured only when a visual request needs it.
+- Privacy-preserving cameras: one JPEG is captured only when a visual request needs it, while an independent opt-in UI viewer connects directly to Reachy's local WebRTC feed.
 - Selectable ElevenLabs Scribe/TTS models and account voices without storing provider keys on Reachy.
 - Stable Hermes memory scope plus rotating conversation sessions after inactivity.
 - Listening, processing, speaking, and error cues with optional voice-state motion.
@@ -202,7 +202,7 @@ Press **Test connection**, save, then say:
 The in-app UI is organized into three keyboard-accessible tabs:
 
 - **Dashboard** — live state, power/privacy modes, app lifecycle, and the latest conversation.
-- **Robot** — safe manual look directions, curated emotions, three recorded dances, stop movement, and a local camera diagnostic.
+- **Robot** — safe manual look directions, curated emotions, three recorded dances, stop movement, and an opt-in local WebRTC camera viewer.
 - **Settings** — Hermes bridge, voice, embodiment, privacy, and advanced timing configuration.
 
 Manual controls use the same serialized semantic action worker as Realtime; the browser cannot submit raw joints, arbitrary move names, shell commands, or host actions. A manual movement from Standby first completes Reachy's native wake motion and leaves it Awake. The server rejects additional taps while an action is active, rechecks privacy immediately before physical execution, and blocks all movement during Meeting/Sleep. **Stop movement** stays available out of band, cancels the active move plus queued work without changing power mode or initiating a new pose, and preserves the voice playback pipeline. The UI is intended only for a trusted LAN/VPN.
@@ -220,7 +220,7 @@ The Dashboard is also a Progressive Web App. Android Chrome exposes an **Install
 
 The settings server stays available in these modes. **Stop voice app** exits the app and releases its resources. **Shut down Pi** requires typing `SHUTDOWN` in the UI before the host power-off command is scheduled.
 
-Camera access is disabled by default. When enabled in Realtime mode, the model can request a single fresh frame for prompts such as “What do you see?” or “Look at this object.” Frames are not streamed continuously and the local camera test reports only JPEG metadata, not image content.
+Camera access is disabled by default and split into two independent controls. **On-demand camera** allows Realtime to request one fresh frame for prompts such as “What do you see?”; it never creates a continuous cloud stream. **Local live camera** enables an explicit Start button in the Robot tab. That viewer uses the same daemon-local WebRTC producer as Reachy Mini Control, disables the remote audio track, uses no public STUN service, and sends video directly from Reachy to the current browser—not through Hermes or OpenAI. It is available only while Reachy is Awake and disconnects when the Robot tab is left, the page is backgrounded, or power enters Standby, Meeting, or Sleep. The local camera test still reports only JPEG metadata, not image content.
 
 Local face following is a separate opt-in. It uses Reachy SDK 1.9 daemon-side tracking only after **Hey Hermes** and stops when that conversation ends or Meeting/Sleep begins. Tracking frames are not forwarded to Hermes or OpenAI. Optional DOA uses the microphone array's local angle estimate once after wake detection, then discards it after orienting the head.
 
@@ -297,7 +297,7 @@ uv build --wheel
 reachy-mini-app-assistant check .
 ```
 
-Current automated suite: **64 tests**.
+Current automated suite: **70 tests**.
 
 The implementation plan and status are in [`plan.md`](plan.md). Changes are recorded in [`CHANGELOG.md`](CHANGELOG.md).
 

SECURITY.md

@@ -42,6 +42,8 @@ The local `set_reachy_power_mode` Realtime tool can select only Standby, Awake,
 
 The snapshot API returns image bytes only after bearer-token authentication and explicit confirmation, and sets `Cache-Control: no-store`. The unauthenticated local camera test returns metadata only.
 
+The optional local live viewer does not create a Hermes camera endpoint. After an explicit user action while Reachy is Awake, the browser connects directly to the daemon's existing GStreamer WebRTC producer on port 8443—the same feed used by Reachy Mini Control. The UI disables the audio track, uses no public STUN service, and closes its session on tab exit, page backgrounding, Standby, Meeting, or Sleep. The `camera_feed_enabled` setting controls this UI, but it does not disable Reachy's upstream daemon producer or prevent another authorized Reachy Control client from connecting; network access to the daemon and signaling port remains the real trust boundary.
+
 ## Operational controls
 
 - Keep `security.redact_secrets` enabled in Hermes.

THIRD_PARTY_NOTICES.md

@@ -0,0 +1,43 @@
+# Third-party notices for the local camera viewer
+
+The Reachy Mini Hermes browser camera viewer includes an unmodified bundled copy
+of `gstwebrtc-api.js`, sourced from Pollen Robotics' Reachy Mini Control desktop
+application and originally maintained by the GStreamer project:
+
+- Project: https://gitlab.freedesktop.org/gstreamer/gst-plugins-rs/-/tree/main/net/webrtc/gstwebrtc-api
+- License: Mozilla Public License 2.0
+- Copyright: Copyright (C) 2022 Igalia S.L.
+- Author: Loïc Le Page
+
+The bundle contains `webrtc-adapter`:
+
+- Project: https://github.com/webrtcHacks/adapter
+- License: BSD 3-Clause
+- Copyright: Copyright (c) 2014 The WebRTC project authors; Copyright (c) 2018 The adapter.js project authors
+
+BSD 3-Clause license terms:
+
+> Redistribution and use in source and binary forms, with or without modification,
+> are permitted provided that the following conditions are met:
+>
+> 1. Redistributions of source code must retain the above copyright notice, this
+>    list of conditions and the following disclaimer.
+> 2. Redistributions in binary form must reproduce the above copyright notice,
+>    this list of conditions and the following disclaimer in the documentation
+>    and/or other materials provided with the distribution.
+> 3. Neither the name of the copyright holder nor the names of its contributors
+>    may be used to endorse or promote products derived from this software without
+>    specific prior written permission.
+>
+> THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+> ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+> WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+> DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR
+> ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+> (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+> LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+> ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+> (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+> SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+The original license notices remain intact at the top of the distributed JavaScript bundle.

index.html

@@ -30,7 +30,7 @@
         </div>
         <div class="proof" aria-label="Project facts">
           <span><strong>Local</strong> pre-wake audio</span>
-          <span><strong>64</strong> automated tests</span>
+          <span><strong>70</strong> automated tests</span>
           <span><strong>Apache-2.0</strong> licensed</span>
         </div>
       </div>
@@ -109,9 +109,9 @@
       <article class="feature feature-camera">
         <div class="feature-index">02</div>
         <div class="feature-copy">
-          <p class="feature-tag">ON-DEMAND CAMERA</p>
-          <h3>Look only when asked.</h3>
-          <p>For an explicit visual request, Reachy captures one fresh, bounded JPEG and adds it to the active Realtime conversation. No continuous cloud video. Meeting and Sleep block camera capture.</p>
+          <p class="feature-tag">LOCAL LIVE + ON-DEMAND CAMERA</p>
+          <h3>Stream locally. Share one frame only when asked.</h3>
+          <p>The Robot tab can connect directly to Reachy's existing local WebRTC feed without routing video through Hermes or OpenAI. Separately, an explicit visual request captures one bounded JPEG for Realtime. Meeting and Sleep block both app-controlled paths.</p>
         </div>
         <div class="camera-panel" aria-hidden="true">
           <div class="viewfinder"><i></i><i></i><i></i><i></i><span>ONE FRAME</span></div>

pyproject.toml

@@ -9,7 +9,7 @@ description = "Talk to your Hermes Agent through Reachy Mini with the Hey Hermes
 readme = "README.md"
 requires-python = ">=3.11"
 license = "Apache-2.0"
-license-files = ["LICENSE"]
+license-files = ["LICENSE", "THIRD_PARTY_NOTICES.md"]
 authors = [{ name = "Tim Verhoogt and contributors" }]
 dependencies = [
     "httpx>=0.28,<1",

reachy_mini_hermes/config.py

@@ -53,6 +53,7 @@ class AppConfig:
     motion_enabled: bool = True
     barge_in_enabled: bool = True
     camera_enabled: bool = False
+    camera_feed_enabled: bool = False
     face_tracking_enabled: bool = False
     face_tracking_weight: float = 0.65
     doa_enabled: bool = False

reachy_mini_hermes/main.py

@@ -50,6 +50,7 @@ class SettingsUpdate(BaseModel):
     motion_enabled: bool | None = None
     barge_in_enabled: bool | None = None
     camera_enabled: bool | None = None
+    camera_feed_enabled: bool | None = None
     face_tracking_enabled: bool | None = None
     face_tracking_weight: float | None = Field(default=None, ge=0, le=1)
     doa_enabled: bool | None = None

reachy_mini_hermes/runtime.py

@@ -431,8 +431,13 @@ class HermesVoiceRuntime:
         jpeg = self.camera_snapshot()
         return {"bytes": len(jpeg), "content_type": "image/jpeg"}
 
+    def _assert_camera_allowed(self) -> None:
+        if self._effective_power_mode() in {"meeting", "sleep"} or self._privacy_requested.is_set():
+            raise RuntimeError("Camera capture is blocked in the current privacy mode")
+
     def camera_snapshot(self) -> bytes:
         """Capture one bounded JPEG for an explicitly authenticated request."""
+        self._assert_camera_allowed()
         jpeg = self._capture_camera_jpeg()
         with self._status_lock:
             self._status.camera_captures += 1
@@ -446,8 +451,10 @@ class HermesVoiceRuntime:
             raise RuntimeError("Reachy camera capture is unavailable")
         with self._camera_lock:
             for _ in range(20):
+                self._assert_camera_allowed()
                 frame = capture()
                 if frame:
+                    self._assert_camera_allowed()
                     if not isinstance(frame, (bytes, bytearray, memoryview)):
                         raise RuntimeError("Reachy camera returned an unsupported JPEG payload")
                     jpeg = bytes(frame)

reachy_mini_hermes/static/camera.js

@@ -0,0 +1,233 @@
+(() => {
+  "use strict";
+
+  const byId = (id) => document.getElementById(id);
+  const state = {
+    api: null,
+    session: null,
+    stream: null,
+    producersListener: null,
+    connectionListener: null,
+    producerId: null,
+    enabled: false,
+    powerMode: "unknown",
+    requested: false,
+  };
+
+  function setUi(status, message, kind = "") {
+    byId("camera-live-status").textContent = status;
+    const messageElement = byId("camera-message");
+    messageElement.textContent = message;
+    messageElement.className = `message ${kind}`;
+  }
+
+  function updateButtons() {
+    const active = Boolean(state.session || state.stream);
+    const allowed = state.enabled && state.powerMode === "awake";
+    byId("camera-live-start").disabled = active || !allowed;
+    byId("camera-live-stop").disabled = !active;
+    byId("camera-live-fullscreen").disabled = !state.stream;
+  }
+
+  function detachStream() {
+    const video = byId("reachy-camera-video");
+    byId("camera-viewer").classList.remove("live");
+    video.pause();
+    video.srcObject = null;
+    if (state.stream) {
+      state.stream.getTracks().forEach((track) => track.stop());
+      state.stream = null;
+    }
+  }
+
+  function cleanupConnection() {
+    detachStream();
+    if (state.session) {
+      try {
+        state.session.close();
+      } catch {
+        // The signaling session may already be closed.
+      }
+      state.session = null;
+    }
+    if (state.api) {
+      try {
+        if (state.producersListener) state.api.unregisterProducersListener(state.producersListener);
+        if (state.connectionListener) state.api.unregisterConnectionListener(state.connectionListener);
+        // GstWebRTCAPI does not expose a public close method. This pinned bundle's
+        // channel owns the signaling WebSocket; closing it prevents one idle socket
+        // from leaking on every Start/Stop cycle.
+        if (typeof state.api._channel?.close === "function") state.api._channel.close();
+      } catch {
+        // The signaling channel may already be closed.
+      }
+    }
+    state.api = null;
+    state.producersListener = null;
+    state.connectionListener = null;
+    state.producerId = null;
+    updateButtons();
+  }
+
+  function stop(message = "Live camera stopped.") {
+    const wasActive = state.requested || state.session || state.stream;
+    state.requested = false;
+    cleanupConnection();
+    if (wasActive) setUi("Off", message);
+  }
+
+  function policyMessage() {
+    if (!state.enabled) return "Enable Local live camera in Settings first.";
+    if (state.powerMode === "meeting" || state.powerMode === "sleep") {
+      return `Camera viewing is blocked in ${state.powerMode}.`;
+    }
+    if (state.powerMode !== "awake") return "Wake Reachy before starting the live camera.";
+    return "Press Start live camera to connect directly to Reachy's local WebRTC feed.";
+  }
+
+  function setPolicy({ enabled, powerMode }) {
+    state.enabled = Boolean(enabled);
+    state.powerMode = powerMode || "unknown";
+    if (!state.enabled || state.powerMode !== "awake") {
+      if (state.requested || state.session || state.stream) stop(policyMessage());
+      else setUi("Off", policyMessage());
+    } else if (!state.requested && !state.session && !state.stream) {
+      setUi("Ready", policyMessage());
+    }
+    updateButtons();
+  }
+
+  function isReachyCameraProducer(producer) {
+    const name = String(producer?.meta?.name || "").trim().toLowerCase();
+    return name === "reachymini" || name === "reachy-mini-camera";
+  }
+
+  function attachSession(api, producer) {
+    if (!state.requested || state.session || !isReachyCameraProducer(producer)) return;
+    const session = api.createConsumerSession(producer.id);
+    if (!session) return;
+    state.session = session;
+    state.producerId = producer.id;
+
+    session.addEventListener("error", (event) => {
+      const message = event?.message || "WebRTC camera stream failed";
+      state.requested = false;
+      cleanupConnection();
+      setUi("Error", message, "error");
+    });
+    session.addEventListener("closed", () => {
+      const requested = state.requested;
+      state.session = null;
+      detachStream();
+      updateButtons();
+      if (requested) setUi("Offline", "Camera connection closed. Press Start to reconnect.", "error");
+    });
+    session.addEventListener("streamsChanged", () => {
+      if (!state.requested || !session.streams?.length) return;
+      const stream = session.streams[0];
+      stream.getAudioTracks().forEach((track) => {
+        track.enabled = false;
+      });
+      state.stream = stream;
+      const video = byId("reachy-camera-video");
+      byId("camera-viewer").classList.add("live");
+      video.srcObject = stream;
+      video.play().then(() => {
+        setUi("Live", "Local camera connected. No frames are sent to Hermes or OpenAI.", "ok");
+        updateButtons();
+      }).catch((error) => {
+        setUi("Paused", `Camera connected, but playback was blocked: ${String(error)}`, "error");
+      });
+    });
+    session.connect();
+  }
+
+  function start() {
+    if (!state.enabled || state.powerMode !== "awake") {
+      setUi("Blocked", policyMessage(), "error");
+      updateButtons();
+      return;
+    }
+    if (window.location.protocol === "https:") {
+      setUi(
+        "Unavailable",
+        "This robot exposes local WebRTC over ws://. Open its direct LAN HTTP dashboard until a trusted WSS proxy is configured.",
+        "error",
+      );
+      return;
+    }
+    if (typeof window.RTCPeerConnection !== "function" || !window.GstWebRTCAPI) {
+      setUi("Unsupported", "This browser does not provide the required WebRTC camera support.", "error");
+      return;
+    }
+
+    cleanupConnection();
+    state.requested = true;
+    setUi("Connecting", "Connecting directly to Reachy's local camera…");
+    updateButtons();
+
+    try {
+      const api = new window.GstWebRTCAPI({
+        signalingServerUrl: `ws://${window.location.hostname}:8443`,
+        reconnectionTimeout: 0,
+        meta: { name: "reachy-hermes-ui" },
+        // The viewer and robot are on the same LAN; avoid sending ICE queries to public STUN services.
+        webrtcConfig: { iceServers: [] },
+      });
+      state.api = api;
+      state.connectionListener = {
+        connected: () => setUi("Connecting", "Camera signaling connected; waiting for video…"),
+        disconnected: () => {
+          if (!state.requested) return;
+          state.requested = false;
+          cleanupConnection();
+          setUi("Offline", "Camera signaling disconnected. Press Start to reconnect.", "error");
+        },
+      };
+      state.producersListener = {
+        producerAdded: (producer) => {
+          if (!isReachyCameraProducer(producer)) return;
+          attachSession(api, producer);
+        },
+        producerRemoved: (producer) => {
+          if (!state.requested || producer?.id !== state.producerId) return;
+          state.requested = false;
+          cleanupConnection();
+          setUi("Offline", "Reachy's camera producer stopped.", "error");
+        },
+      };
+      api.registerConnectionListener(state.connectionListener);
+      api.registerProducersListener(state.producersListener);
+    } catch (error) {
+      state.requested = false;
+      cleanupConnection();
+      setUi("Error", `Could not connect to Reachy's camera: ${String(error)}`, "error");
+    }
+  }
+
+  async function fullscreen() {
+    const viewer = byId("camera-viewer");
+    try {
+      if (document.fullscreenElement) await document.exitFullscreen();
+      else await viewer.requestFullscreen();
+    } catch (error) {
+      setUi("Live", `Fullscreen could not open: ${String(error)}`, "error");
+    }
+  }
+
+  byId("camera-live-start").addEventListener("click", start);
+  byId("camera-live-stop").addEventListener("click", () => stop());
+  byId("camera-live-fullscreen").addEventListener("click", fullscreen);
+  window.addEventListener("pagehide", () => stop("Camera stopped because the page closed."));
+  document.addEventListener("visibilitychange", () => {
+    if (document.hidden) stop("Camera stopped while the app was in the background.");
+  });
+
+  window.ReachyCamera = {
+    setPolicy,
+    stop,
+    isActive: () => Boolean(state.requested || state.session || state.stream),
+  };
+  setUi("Off", "Reading camera policy…");
+  updateButtons();
+})();

reachy_mini_hermes/static/index.html

@@ -134,14 +134,27 @@
         <p class="muted action-status">Last action: <strong id="last-robot-action">—</strong><span id="robot-action-error"></span></p>
       </section>
 
-      <section class="card">
-        <p class="label">Private diagnostic</p>
-        <h2>Camera</h2>
-        <p class="muted">Capture one frame locally to verify the camera. The image is not returned to this page or sent to Hermes.</p>
-        <div class="actions left-actions">
+      <section class="card camera-card">
+        <div class="section-heading">
+          <div><p class="label">Private local viewer</p><h2>Reachy camera</h2></div>
+          <span id="camera-live-status" class="badge">Off</span>
+        </div>
+        <p class="muted">Connect directly to the same local WebRTC camera feed used by Reachy Mini Control. Video remains between this browser and Reachy; it is never sent to Hermes or OpenAI.</p>
+        <div id="camera-viewer" class="camera-viewer">
+          <video id="reachy-camera-video" autoplay playsinline muted aria-label="Live Reachy camera feed"></video>
+          <div class="camera-placeholder" aria-hidden="true">
+            <span class="camera-placeholder-icon">●</span>
+            <span>Camera off</span>
+          </div>
+        </div>
+        <div class="actions camera-actions">
+          <button type="button" id="camera-live-start">Start live camera</button>
+          <button type="button" id="camera-live-stop" class="secondary" disabled>Stop camera</button>
+          <button type="button" id="camera-live-fullscreen" class="secondary" disabled>Fullscreen</button>
           <button type="button" id="camera-test-button" class="secondary">Capture one local test frame</button>
         </div>
-        <p id="camera-message" class="message" role="status"></p>
+        <p class="muted compact-note">The live viewer is opt-in, works only while Reachy is Awake, and stops when you leave this tab, background the app, enter Meeting, or enter Sleep.</p>
+        <p id="camera-message" class="message" role="status" aria-live="polite"></p>
       </section>
     </div>
 
@@ -203,6 +216,7 @@
               <label class="toggle-row"><span><strong>Turn toward wake phrase</strong><small>Use one local microphone-array direction estimate after wake</small></span><input id="doa_enabled" name="doa_enabled" type="checkbox" /></label>
               <label class="toggle-row"><span><strong>Interruption</strong><small>Pipeline wake-phrase interruption or natural Realtime barge-in</small></span><input id="barge_in_enabled" name="barge_in_enabled" type="checkbox" checked /></label>
               <label class="toggle-row"><span><strong>On-demand camera</strong><small>Realtime captures one frame only for an explicit visual request</small></span><input id="camera_enabled" name="camera_enabled" type="checkbox" /></label>
+              <label class="toggle-row"><span><strong>Local live camera</strong><small>Allow this UI to connect directly to Reachy's local WebRTC video while Awake</small></span><input id="camera_feed_enabled" name="camera_feed_enabled" type="checkbox" /></label>
             </div>
           </details>
 
@@ -236,6 +250,8 @@
       </section>
     </div>
   </main>
+  <script src="/static/gstwebrtc-api.js"></script>
+  <script src="/static/camera.js"></script>
   <script src="/static/main.js"></script>
 </body>
 </html>

reachy_mini_hermes/static/main.js

@@ -2,7 +2,7 @@ const $ = (id) => document.getElementById(id);
 const fields = [
   "bridge_url", "api_key", "model", "conversation_mode", "language", "stt_provider", "stt_model",
   "tts_provider", "tts_model", "tts_voice", "continuous_conversation",
-  "motion_enabled", "barge_in_enabled", "camera_enabled", "face_tracking_enabled", "face_tracking_weight",
+  "motion_enabled", "barge_in_enabled", "camera_enabled", "camera_feed_enabled", "face_tracking_enabled", "face_tracking_weight",
   "doa_enabled", "robot_tools_enabled", "realtime_model", "realtime_voice", "realtime_reasoning_effort",
   "end_silence_seconds", "max_utterance_seconds", "vad_min_rms", "vad_noise_multiplier",
   "wake_keyword_threshold", "wake_keyword_score",
@@ -23,6 +23,9 @@ function activateTab(name, focus = false, recordHistory = false) {
     button.setAttribute("aria-selected", String(active));
     button.tabIndex = active ? 0 : -1;
   });
+  if (target.dataset.tab !== "robot" && window.ReachyCamera?.isActive()) {
+    window.ReachyCamera.stop("Camera stopped when leaving the Robot tab.");
+  }
   document.querySelectorAll("[data-panel]").forEach((panel) => {
     panel.hidden = panel.dataset.panel !== target.dataset.tab;
   });
@@ -191,6 +194,10 @@ function updateStatus(payload) {
   if (["error", "configuration_error"].includes(state)) dot.classList.add("error");
   fillConfig(payload.config);
   currentConfig = payload.config || currentConfig;
+  window.ReachyCamera?.setPolicy({
+    enabled: Boolean(payload.config?.camera_feed_enabled),
+    powerMode,
+  });
 }
 
 function modelLabel(model) {
@@ -296,6 +303,9 @@ async function refreshStatus() {
     if (!response.ok) throw new Error(`HTTP ${response.status}`);
     updateStatus(await response.json());
   } catch (error) {
+    if (window.ReachyCamera?.isActive()) {
+      window.ReachyCamera.stop("Camera stopped because Hermes status is unavailable.");
+    }
     $("runtime-state").textContent = "Disconnected";
     $("runtime-detail").textContent = String(error);
     $("status-dot").className = "status-dot error";
@@ -446,6 +456,9 @@ $("robot-stop-button").addEventListener("click", async () => {
 
 async function setPowerMode(mode, durationMinutes = 60) {
   const message = $("power-message");
+  if (mode !== "awake" && window.ReachyCamera?.isActive()) {
+    window.ReachyCamera.stop(`Camera stopped before switching to ${mode}.`);
+  }
   message.textContent = `Switching to ${mode}…`;
   try {
     const response = await fetch("/api/power", {
@@ -470,6 +483,9 @@ document.querySelectorAll("[data-power]").forEach((button) => {
 
 $("app-off-button").addEventListener("click", async () => {
   if (!window.confirm("Stop the voice app? Restart it later from Reachy Control.")) return;
+  if (window.ReachyCamera?.isActive()) {
+    window.ReachyCamera.stop("Camera stopped before stopping the voice app.");
+  }
   await fetch("/api/app-off", {
     method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ confirm: "off" }),
   });

reachy_mini_hermes/static/service-worker.js

@@ -1,9 +1,11 @@
-const CACHE_NAME = "reachy-hermes-shell-v1";
+const CACHE_NAME = "reachy-hermes-shell-v4";
 const APP_SHELL = [
   "/",
   "/#dashboard",
   "/manifest.webmanifest",
   "/static/style.css",
+  "/static/gstwebrtc-api.js",
+  "/static/camera.js",
   "/static/main.js",
   "/static/icon-192.png",
   "/static/icon-512.png",

reachy_mini_hermes/static/style.css

@@ -79,6 +79,16 @@ button:disabled, select:disabled { opacity: .46; cursor: not-allowed; transform:
 .readiness { margin: 12px 0 0; padding: 10px 12px; border-left: 3px solid var(--accent2); border-radius: 8px; color: #d8d2ff; background: #7b61ff16; font-size: .88rem; font-weight: 700; }
 .compact-note { margin: -4px 0 12px; font-size: .82rem; }
 .danger-zone { border-color: #ff5d6c55; }
+.camera-card { overflow: hidden; }
+.camera-viewer { position: relative; aspect-ratio: 16 / 9; margin-top: 18px; overflow: hidden; border: 1px solid var(--line); border-radius: 16px; background: #020203; }
+.camera-viewer video { position: absolute; inset: 0; width: 100%; height: 100%; object-fit: contain; background: #000; opacity: 0; transition: opacity .2s ease; }
+.camera-viewer.live video { opacity: 1; }
+.camera-placeholder { position: absolute; inset: 0; display: grid; place-content: center; justify-items: center; gap: 10px; color: var(--muted); text-transform: uppercase; letter-spacing: .12em; font-size: .72rem; }
+.camera-viewer.live .camera-placeholder { display: none; }
+.camera-placeholder-icon { width: 46px; height: 46px; display: grid; place-content: center; border: 1px solid var(--line); border-radius: 50%; color: #7b61ff; box-shadow: 0 0 28px #7b61ff44; }
+.camera-actions { margin-top: 16px; }
+.camera-viewer:fullscreen { border: 0; border-radius: 0; background: #000; }
+.camera-viewer:fullscreen video { object-fit: contain; }
 .install-card { border-color: #7b61ff66; background: linear-gradient(135deg, #17142aee, #191821e8); }
 .install-card .actions { margin-top: 16px; }
 .install-card details { margin-top: 14px; }

tests/test_camera_ui.py

@@ -0,0 +1,54 @@
+from __future__ import annotations
+
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+STATIC = ROOT / "reachy_mini_hermes" / "static"
+
+
+def test_robot_tab_contains_explicit_local_live_camera_controls() -> None:
+    html = (STATIC / "index.html").read_text()
+
+    assert 'id="reachy-camera-video"' in html
+    assert 'id="camera-live-start"' in html
+    assert 'id="camera-live-stop"' in html
+    assert 'id="camera-live-fullscreen"' in html
+    assert 'id="camera_feed_enabled"' in html
+    assert "never sent to Hermes or OpenAI" in html
+    assert html.index('/static/gstwebrtc-api.js') < html.index('/static/camera.js')
+    assert html.index('/static/camera.js') < html.index('/static/main.js')
+
+
+def test_camera_viewer_uses_local_webrtc_without_public_stun_or_audio() -> None:
+    camera = (STATIC / "camera.js").read_text()
+
+    assert 'signalingServerUrl: `ws://${window.location.hostname}:8443`' in camera
+    assert "webrtcConfig: { iceServers: [] }" in camera
+    assert "stun:" not in camera
+    assert "track.enabled = false" in camera
+    assert 'state.powerMode !== "awake"' in camera
+    assert 'window.addEventListener("pagehide"' in camera
+    assert 'document.addEventListener("visibilitychange"' in camera
+    assert 'state.api._channel?.close' in camera
+    assert 'name === "reachymini"' in camera
+    assert 'producer?.id !== state.producerId' in camera
+    assert "No frames are sent to Hermes or OpenAI" in camera
+
+
+def test_live_camera_is_opt_in_and_stops_for_privacy_transitions() -> None:
+    main = (STATIC / "main.js").read_text()
+    config = (ROOT / "reachy_mini_hermes" / "config.py").read_text()
+    notices = (ROOT / "THIRD_PARTY_NOTICES.md").read_text()
+    bundled_api = (STATIC / "gstwebrtc-api.js").read_text()[:1000]
+
+    assert "camera_feed_enabled: bool = False" in config
+    assert "enabled: Boolean(payload.config?.camera_feed_enabled)" in main
+    assert 'mode !== "awake" && window.ReachyCamera?.isActive()' in main
+    assert "Camera stopped because Hermes status is unavailable" in main
+    assert "Camera stopped before stopping the voice app" in main
+    assert "Camera stopped when leaving the Robot tab" in main
+    assert "MPL-2.0" in bundled_api
+    assert "BSD 3-Clause" in bundled_api
+    assert "Mozilla Public License 2.0" in notices
+    assert "Redistribution and use in source and binary forms" in notices
+    assert 'THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"' in notices

tests/test_config.py

@@ -39,6 +39,7 @@ def test_embodiment_features_are_explicit_and_privacy_bounded_by_default() -> No
     config = AppConfig()
 
     assert config.face_tracking_enabled is False
+    assert config.camera_feed_enabled is False
     assert config.face_tracking_weight == 0.65
     assert config.doa_enabled is False
     assert config.robot_tools_enabled is True

tests/test_pwa.py

@@ -37,6 +37,8 @@ def test_service_worker_caches_only_the_app_shell_and_bypasses_api() -> None:
     assert 'request.method !== "GET"' in worker
     assert 'caches.match("/")' in worker
     assert "/static/main.js" in worker
+    assert "/static/camera.js" in worker
+    assert "/static/gstwebrtc-api.js" in worker
     assert "/static/style.css" in worker
 
 

tests/test_runtime_power.py

@@ -357,6 +357,36 @@ def test_camera_test_captures_locally_without_returning_image() -> None:
     assert runtime.status()["camera_captures"] == 1
 
 
+@pytest.mark.parametrize("mode", ["meeting", "sleep"])
+def test_local_camera_capture_is_blocked_in_privacy_modes(mode: str) -> None:
+    runtime = HermesVoiceRuntime(FakeRobot(), threading.Event())
+    runtime._power_mode = mode
+    runtime._meeting_until = float("inf") if mode == "meeting" else 0.0
+    runtime._privacy_requested.set()
+
+    with pytest.raises(RuntimeError, match="privacy"):
+        runtime.camera_snapshot()
+
+    assert runtime.status()["camera_captures"] == 0
+
+
+def test_camera_capture_rechecks_privacy_after_frame_arrives() -> None:
+    robot = FakeRobot()
+    runtime = HermesVoiceRuntime(robot, threading.Event())
+
+    def enter_sleep_during_capture() -> bytes:
+        runtime._power_mode = "sleep"
+        runtime._privacy_requested.set()
+        return b"late-frame"
+
+    robot.media.get_frame_jpeg = enter_sleep_during_capture  # type: ignore[method-assign]
+
+    with pytest.raises(RuntimeError, match="privacy"):
+        runtime.camera_snapshot()
+
+    assert runtime.status()["camera_captures"] == 0
+
+
 def test_camera_capture_requires_completed_output_item() -> None:
     completed: dict[str, object] = {
         "item": {