@ateam-ai-mobile/plugin-runtime 0.1.7 → 0.1.8

package/src/sdk/device-state.ts

@@ -13,7 +13,8 @@
  *                         VERB names: takePhoto, getCurrent, scanBarcode,
  *                         readOnce, authenticate, pickImage.
  *                         Returns a BARE value. THROWS when it cannot.
- *                         Declared in the manifest as `native: { camera: true }`.
+ *                         Declared in the manifest as `capabilities: { camera: true }`
+ *                         (the legacy `native: {}` field is still honoured).
  *                         Lives in '@adas/plugin-sdk'.
  *
  *   props.deviceState.*   SEMANTIC. "What is true right now, and how well do
@@ -163,17 +164,19 @@ export type RestrictionState =
  * never raw sensor streams." If you find yourself wanting an event per frame
  * or per GPS fix, you are in the wrong layer.
  */
-export interface StateEvent<TName extends string = string> {
+export interface StateEvent<TName extends string = string, TPayload = unknown> {
   domain: DeviceBridgeDomain;
   name: TName;
   /** Epoch ms. */
   timestamp: number;
   /**
    * OPEN: per-event payload schemas are not specified anywhere in the three
-   * design docs. Typed `unknown` rather than `any` so a consumer is forced to
-   * narrow it rather than read a field that may not exist.
+   * design docs. Defaults to `unknown` rather than `any` so a consumer is forced
+   * to narrow it rather than read a field that may not exist. A domain that
+   * decides its schemas (spatial — see `SpatialStateEvent`) passes `TPayload`,
+   * which is the freeze's own second parameter, dropped here until one did.
    */
-  payload?: unknown;
+  payload?: TPayload;
 }
 
 export interface Subscription {
@@ -192,7 +195,9 @@ export type StateListener<TName extends string = string> = (
  * connectivity, capability, interaction and environment only. Rather than mint
  * names those docs deliberately did not mint, their events are typed against
  * the naming RULE. A wrong-shaped name is a compile error; the specific
- * vocabulary stays open, as the docs left it.
+ * vocabulary stays open, as the docs left it — except where a DECISION closes
+ * it (spatial, see `SpatialEvent`), and that list is checked against the rule
+ * through `AssertConforming`.
  */
 export type ConformingEventName =
   | `${string}Changed`
@@ -202,6 +207,13 @@ export type ConformingEventName =
   | `${string}Unavailable`
   | `${string}StateStale`;
 
+/**
+ * A closed list of names, checked against the naming rule at compile time.
+ * Wrap a decided vocabulary in this and a name like `turnCompleted` stops
+ * compiling instead of reaching a plugin.
+ */
+export type AssertConforming<T extends ConformingEventName> = T;
+
 // ── Errors ────────────────────────────────────────────────────────────────
 
 /** FROZEN (API_FREEZE §12). */
@@ -373,12 +385,88 @@ export interface SpatialSnapshot {
   quality: StateQuality;
 }
 
+/**
+ * DECISION (not frozen) — the spatial event vocabulary. Six names, all ending
+ * in a suffix the naming rule allows, which `AssertConforming` enforces.
+ *
+ * Drawn from the architecture doc's spatial candidates (meaningful movement,
+ * meaningful turn, location quality degraded/recovered, state became stale)
+ * and named after the SNAPSHOT fields they report, so an event and a read use
+ * one vocabulary: `lastMeaningfulTurnChanged` is `changes.lastMeaningfulTurnDeg`
+ * changing. The names an earlier note floated (`turnCompleted`, `arrived`,
+ * `headingLost`) are rejected — the first two fail the rule, and "arrived" is a
+ * destination, which the vocabulary's Governance puts above Device Bridge.
+ */
+export type SpatialEvent = AssertConforming<
+  | 'movementStarted'
+  | 'movementStopped'
+  | 'lastMeaningfulTurnChanged'
+  | 'positionConfidenceChanged'
+  | 'positionChanged'
+  | 'spatialStateStale'
+>;
+
+/** A spatial event: the frozen envelope, with its payload always present. */
+type SpatialEventOf<TName extends SpatialEvent, TPayload> =
+  StateEvent<TName, TPayload> & { domain: 'spatial'; payload: TPayload };
+
+/**
+ * DECISION — what each spatial event carries. Only the facts of the
+ * transition, in the snapshot's own field names; everything else is one
+ * `getSnapshot()` away, which keeps two shapes of the same fact from drifting.
+ *
+ * `timestamp` on the envelope is when the transition was RECOGNISED. Where a
+ * hold delays that on purpose, `since` carries the true onset.
+ */
+export type SpatialStateEvent =
+  /** `movement.state` became `moving` and held (navigation: 3 s). */
+  | SpatialEventOf<'movementStarted', {
+      previous: 'stationary' | 'unknown';
+      speedMps: number | null;
+      bearingDeg: number | null;
+      since: number;
+    }>
+  /** `moving` → `stationary`, held (navigation: 5 s). Never fired on moving →
+   *  `unknown`: losing the speed is not evidence of stopping. */
+  | SpatialEventOf<'movementStopped', { previous: 'moving'; since: number }>
+  /** A new completed turn. Signed: positive = clockwise = right. */
+  | SpatialEventOf<'lastMeaningfulTurnChanged', { lastMeaningfulTurnDeg: number; timestamp: number }>
+  /** The GPS fix band (high ≤10 m, medium ≤50 m, else low) changed and held.
+   *  The fix alone — a compass calibration change is not a position event. */
+  | SpatialEventOf<'positionConfidenceChanged', {
+      level: ConfidenceLevel;
+      previous: ConfidenceLevel;
+      accuracyM: number | null;
+      direction: 'dropped' | 'recovered';
+    }>
+  /** Moved at least max(profile floor, 2 × accuracyM) from the last reported
+   *  position, so GPS jitter never fires it. The session's first fix fires
+   *  with `previous: null`. */
+  | SpatialEventOf<'positionChanged', {
+      position: SpatialPoint;
+      previous: SpatialPoint | null;
+      distanceM: number | null;
+    }>
+  /** `quality.freshness.state` became `stale`. Once; re-armed by a fresh read. */
+  | SpatialEventOf<'spatialStateStale', { observedAt: number | null; ageMs: number | null }>;
+
 export interface SpatialDomain {
   getSnapshot(): Promise<SpatialSnapshot>;
   start(options: StartOptions<SpatialIntent>): Promise<StateSession>;
   stop(sessionId?: string): Promise<void>;
-  /** OPEN: no frozen spatial event vocabulary; rule-conforming names only. */
-  subscribe(listener: StateListener<ConformingEventName>): Subscription;
+  /**
+   * DECISION: the six `SpatialEvent`s, typed per name — narrow on `e.name` and
+   * `e.payload` is that event's shape.
+   *
+   * Events flow only while a spatial session is open; subscribing opens no
+   * sensor. They are derived from the same snapshot `getSnapshot()` returns: a
+   * listener that re-reads inside the callback sees the snapshot its event came
+   * from. A state change must hold, on at least two fixes, before it fires.
+   *
+   * From a device tool's `ctx.deviceState` this refuses (RESTRICTED): a call
+   * has no lifetime to own the listener.
+   */
+  subscribe(listener: (event: SpatialStateEvent) => void): Subscription;
 }
 
 // ═════════════════════════════════════════════════════════════════════════
@@ -1213,8 +1301,10 @@ export interface DeviceToolContextV2Extension {
  *  - Multi-consumer session ownership / reference counting.
  *  - MediaHandle → bytes resolution, and expiry behaviour.
  *  - Whether `visual.capture()` may use a different intent from the session.
- *  - Event vocabularies for visual, activity, spatial, deviceContext.
- *  - Per-event payload schemas for every domain.
+ *  - Event vocabularies for visual, activity, deviceContext. (Spatial's is a
+ *    DECISION, recorded at `SpatialEvent`, not a reading of the docs.)
+ *  - Per-event payload schemas for every domain but spatial
+ *    (`SpatialStateEvent`, likewise a DECISION).
  *  - Background/foreground semantics for activity and connectivity (specified
  *    only for visual).
  *  - Numeric thresholds for fresh/aging/stale, and for "materially changed".

package/src/sdk/index.ts

@@ -35,6 +35,12 @@ export type {
   VisionLabel,
   VisionObject,
   VisionFrameQuality,
+  MapsAPI,
+  MapsCoordinate,
+  MapsAddress,
+  MapsPlace,
+  MapsRoute,
+  MapsRouteStep,
   BiometricsAPI,
   BiometricsAPIv2,
   NativeCapabilities,
@@ -57,6 +63,7 @@ export type {
   VoiceSnapshot,
   VoiceTranscriptEntry,
   VoiceStartOptions,
+  VoicePersona,
   VoiceEvent,
   VoiceSubscription,
   VoiceCaller,

package/src/sdk/registration.ts

@@ -54,7 +54,8 @@ export function registerTools(
   id: string,
   config: {
     capabilities?: NativeCapabilities;
-    /** L3 DeviceState domains the tools may read via ctx.deviceState (e.g. ['visual']). */
+    /** L3 DeviceState domains the tools read via ctx.deviceState (e.g. ['visual']).
+     *  For a remote bundle the MANIFEST grants them — see RegisteredToolsPlugin. */
     stateDomains?: DeviceBridgeDomain[];
     tools: DeviceToolDefinition[];
   },

package/src/sdk/types.ts

@@ -352,6 +352,139 @@ export interface VisionAPI {
   assessQuality(frameId: string): Promise<VisionFrameQuality>;
 }
 
+// ── Maps — where is X, what is here, how do I walk there ──
+//
+// One-shot verbs that THROW, like vision — not a state domain. Following a
+// route over time (progress, off-route, "turn left in 20 m") is the reasoning
+// loop's job over deviceState.spatial; this layer answers each question once.
+//
+// NOT ON-DEVICE — the opposite of vision, and the thing not to get wrong when
+// describing a feature built on it. Every call sends the query and the
+// coordinates you pass to a map service over the network: Apple's (MapKit /
+// CLGeocoder) on iOS, the platform geocoder on Android. So the `maps` flag
+// means exactly one thing: "this plugin may send place queries to Apple Maps".
+//
+// IT NEVER READS THE USER'S LOCATION. Every coordinate is the caller's — take a
+// fix from `location.getCurrent` or `deviceState.spatial` and pass it in. That
+// keeps `maps` from becoming a second, differently-gated door to where the
+// user is.
+//
+// FOUND NOTHING IS AN ANSWER; COULD NOT LOOK THROWS. `[]` / `null` mean the
+// service looked and there is nothing. Anything else THROWS, with a code:
+//   UNAVAILABLE  this app build has no AdaMaps module (needs a native rebuild),
+//                or the platform has none — search/route are iOS only (MapKit)
+//                and refuse by name on Android. Also the service's own failures.
+//   OFFLINE      the map service could not be reached.
+//   THROTTLED    Apple is rate-limiting this app. A burst of queries is what
+//                trips it — search once per intent, not once per frame.
+// And one refusal that is not a failure to look:
+//   INVALID_ARGUMENT  the call itself is malformed — an empty query, a
+//                coordinate that is not { latitude, longitude } finite numbers in
+//                range (`{ lat, lng }` refuses), a limit or radius out of range.
+//                Nothing was sent; fix the call rather than retrying it.
+
+/** The same `{ latitude, longitude }` `location.getCurrent` returns, so a fix
+ *  passes straight in. */
+export interface MapsCoordinate {
+  latitude: number;
+  longitude: number;
+}
+
+/** A postal address, field by field. `null` = the map data has no value — never
+ *  an empty string, which would read as a street with no name. */
+export interface MapsAddress {
+  /** The placemark's own name — a building, or often number + street. */
+  name: string | null;
+  street: string | null;
+  streetNumber: string | null;
+  /** Neighbourhood / sub-locality. */
+  district: string | null;
+  city: string | null;
+  /** State / province / administrative area. */
+  region: string | null;
+  postalCode: string | null;
+  country: string | null;
+  /** ISO 3166-1 alpha-2, e.g. "GB". */
+  isoCountryCode: string | null;
+}
+
+export interface MapsPlace {
+  /** What the map calls it ("Boots", "10 Downing St"). Null when unnamed. */
+  name: string | null;
+  coordinate: MapsCoordinate;
+  address: MapsAddress;
+  /** Apple's point-of-interest category as a vocabulary term ("Pharmacy",
+   *  "Cafe", "PublicTransport") — NOT free text. Null for a plain address, or
+   *  when the service gives none. */
+  category: string | null;
+  /** Straight-line metres from `opts.near`, when you passed one — NOT walking
+   *  distance (ask `route` for that). Null without `near`. */
+  distanceM: number | null;
+}
+
+export interface MapsRouteStep {
+  /** Apple's instruction ("Turn right onto Baker St"). The FIRST step is usually
+   *  an origin step with an empty instruction — kept, not dropped, so step
+   *  indexes line up with Apple's. */
+  instructions: string;
+  distanceM: number;
+  /** An advisory Apple attaches to this step. Null when there is none. */
+  notice: string | null;
+  polyline: MapsCoordinate[];
+}
+
+export interface MapsRoute {
+  mode: 'walking';
+  distanceM: number;
+  /** Apple's estimate for the whole route. */
+  expectedTravelTimeMs: number;
+  steps: MapsRouteStep[];
+  /** The whole route, start to end. */
+  polyline: MapsCoordinate[];
+}
+
+export interface MapsAPI {
+  /** Can this build search and route? True when the AdaMaps module is in the
+   *  binary (iOS). False on Android and on an older build — `reverseGeocode`
+   *  does not need the module and may still work there. */
+  isSupported(): Promise<boolean>;
+  /**
+   * Find places by free text — "pharmacy", "10 Downing Street".
+   *
+   * `near` centres the search on a coordinate YOU supply, within `radiusM`
+   * (default 3000, above 0 and at most 100 000). On iOS 18+ results are
+   * confined to that area; before 18 it is a strong hint and a farther result
+   * can come back — each result's `distanceM` says how far. At most `limit`
+   * results (default 8, from 1; more than 25 is capped at 25).
+   *
+   * Network, Apple's servers. `[]` = Apple looked and found nothing. iOS only:
+   * throws UNAVAILABLE on Android or a build without AdaMaps.
+   */
+  search(query: string, opts?: { near?: MapsCoordinate; radiusM?: number; limit?: number }): Promise<MapsPlace[]>;
+  /**
+   * What is at a coordinate — its address and name.
+   *
+   * iOS AND Android (the platform geocoder); needs no AdaMaps module. The
+   * result's `coordinate` is the point you asked about, and its
+   * `category` / `distanceM` are null. `null` = nothing there.
+   *
+   * Network, not on-device. iOS reports a rate limit and a lost connection as
+   * the SAME error, so OFFLINE here can also mean "too many requests". Android's
+   * geocoder refuses without location permission (UNAVAILABLE) — that is the
+   * platform's rule, not a location read.
+   */
+  reverseGeocode(at: MapsCoordinate): Promise<MapsPlace | null>;
+  /**
+   * A walking route between two coordinates YOU supply.
+   *
+   * `null` = Apple found no route — never a fake 0 m route, which would read as
+   * "you have arrived". Walking is the only mode; any other refuses by name.
+   * Network, Apple's servers. iOS only: throws UNAVAILABLE on Android or a build
+   * without AdaMaps.
+   */
+  route(from: MapsCoordinate, to: MapsCoordinate, opts?: { mode?: 'walking' }): Promise<MapsRoute | null>;
+}
+
 export interface BluetoothAPI {
   /** Is BLE hardware present and permitted? */
   isSupported(): Promise<boolean>;
@@ -420,6 +553,9 @@ export interface PluginNative {
   bluetooth: BluetoothAPI;
   /** SHAPE ONLY in this build — see VisionAPI. On-device image understanding. */
   vision: VisionAPI;
+  /** Place search, reverse geocoding, walking routes — see MapsAPI. Sends
+   *  queries to Apple's map servers; NOT on-device. */
+  maps: MapsAPI;
 }
 
 // ── Native capability flags (manifest declaration) ──────────
@@ -438,6 +574,9 @@ export interface NativeCapabilities {
   /** On-device image understanding (OCR, labels, frame quality). Refuses by
    *  name until the native module lands — see VisionAPI. */
   vision?: boolean;
+  /** Place search, reverse geocoding, walking routes. Means "may send place
+   *  queries to Apple Maps" — network, not on-device. See MapsAPI. */
+  maps?: boolean;
   /** The live voice SESSION (props.voice). A privacy surface — a declaring
    *  plugin can read the conversation transcript — so it is gated like any
    *  other capability, and coupled to the platform's unsuppressable mic
@@ -570,8 +709,9 @@ export interface PluginManifest {
   channels?: string[] | { events: string[]; actions: string[] };
   capabilities?: Record<string, unknown>;
   /** L3 DeviceState domains this plugin reads (props.deviceState), as Core passes
-   *  them through from the bundle's declaration. Absent → fall back to the loaded
-   *  bundle's own `stateDomains`. Read via resolvePluginRuntimeProps. */
+   *  them through from the solution's declaration. Absent → NO domains (fail
+   *  closed): the loaded bundle's own `stateDomains` is never consulted when a
+   *  manifest exists. Read via resolvePluginRuntimeProps. */
   stateDomains?: DeviceBridgeDomain[];
   _source?: string;
   _connectorId?: string;
@@ -616,6 +756,9 @@ export interface DeviceToolContext {
    * the same gating a UI plugin's `props.deviceState` gets. This is what lets an
    * EXTERNAL tool (e.g. Ada Guide's `guide.observe`) read `ctx.deviceState.visual`
    * over the public surface, with no SDK-internal access.
+   *
+   * `subscribe` refuses (RESTRICTED) on every domain: a call has no lifetime to
+   * own a subscription, and the engines outlive it. Read instead.
    */
   deviceState: DeviceState;
   /** Cooperative cancellation: caller cancelled, or the session went away. */
@@ -639,9 +782,10 @@ export interface RegisteredToolsPlugin {
   type: 'tools';
   capabilities?: NativeCapabilities;
   /**
-   * L3 DeviceState domains this plugin's tools may read via `ctx.deviceState`
-   * (e.g. `['visual']`). Undeclared domains answer "not declared". Same
-   * mechanism as a UI plugin's manifest `stateDomains`.
+   * L3 DeviceState domains this plugin's tools read via `ctx.deviceState` (e.g.
+   * `['visual']`). For a remote bundle this is the author's statement, not a
+   * grant: the tools get the manifest's `stateDomains` (resolvePluginGrants),
+   * and a domain declared here but not there is denied with a warning.
    */
   stateDomains?: DeviceBridgeDomain[];
   tools: DeviceToolDefinition[];

package/src/sdk/voice.ts

@@ -52,12 +52,50 @@ export interface VoiceSnapshot {
   /** The last error, if `state === 'error'`; also carries a refusal reason when
    *  this surface was handed to a plugin that did not declare `voice`. */
   lastError: string | null;
+  /** The most recent LOCAL device-tool call the model made through the session
+   *  (name + epoch ms), or null if none yet. Diagnostic: proves whether the
+   *  model's call_device_tool actually reached the phone vs was never made. */
+  lastDeviceTool: { name: string; at: number } | null;
+  /** The sessionId the Core allowset is bound to. Diagnostic: authorization
+   *  requires it to equal `sessionId`; a mismatch is why tools refuse. */
+  authorizedSessionId: string | null;
 }
 
 export interface VoiceStartOptions {
   /** Hand the mic to a specific skill on connect (voice /session → takeMic),
    *  exactly as `sys.focusUiPlugin("platform:voice", { skillSlug })` does. */
   skillSlug?: string;
+  /**
+   * A PER-CALL persona override, same shape as the authored
+   * `solution.voice.persona` ({ name, style }). Declared on the voice
+   * session-create call (POST /session `persona`); the server sanitizes it
+   * (name/style only, length-capped) and layers it OVER the solution's authored
+   * persona for THIS call only — prompt-layer, so it can never touch caller
+   * verification or tool allow-lists. Set once at session start and constant
+   * for the call, so it adds no per-turn prompt pushes.
+   *
+   * Use it when a plugin needs its own voice persona without owning a skill
+   * (e.g. a guide HUD). A solution-wide persona belongs in solution.voice.
+   */
+  persona?: VoicePersona;
+  /**
+   * `'none'` = a CLEAN call: the voice gets none of the workspace's skills — no
+   * skill manifest, no skill tools, no platform welcome line, no mid-call
+   * skill-state prompt refresh — only the voice basics, this call's persona and
+   * the CALLING plugin's own device tools (other solutions' tools registered on
+   * the same phone are neither offered nor run). For a plugin that owns its conversation (e.g.
+   * a guide HUD). Reduce-only: it can remove what the voice gets, never add.
+   * Absent = the workspace's skills, as today. Not combinable with `skillSlug`.
+   */
+  skills?: 'none';
+}
+
+/** The authored persona shape (solution.voice.persona). */
+export interface VoicePersona {
+  /** The name the voice uses for itself ("You are <name> …"). */
+  name?: string;
+  /** Free-text style/behaviour guidance rendered under the identity line. */
+  style?: string;
 }
 
 /**

package/src/tools/loader.ts

@@ -14,6 +14,7 @@ import { listPlugins, getPlugin, getNativeBundleUrl, getNativeBundleHash } from
 import { bundleManager } from '../bundles/bundleManager';
 import { listDeviceTools } from './registry';
 import { getBundleStorage, selectOwnedCacheEntries } from '../bundles/storage';
+import { resolvePluginGrants } from '../pluginRuntime';
 import { getTenant } from '@ateam-ai-mobile/core';
 
 let inflight: Promise<string[]> | null = null;
@@ -54,9 +55,9 @@ export async function ensureDeviceToolsLoaded({ force = false } = {}): Promise<s
         // a fact about a server process, not about this phone — the bundle we
         // already downloaded still has the tools in it.
         //
-        // So fall back to what is on disk. Re-evaluating a cached bundle
-        // re-registers whatever it declares, and a bundle with no tools is a
-        // no-op, so this is safe to do blind.
+        // So fall back to what is on disk: re-evaluate this tenant's cached
+        // bundles under the trusted declaration recorded when a manifest last
+        // loaded them (see loadFromDiskCache).
         const recovered = await loadFromDiskCache();
         if (recovered.length > 0) {
           console.log(`[deviceTools] catalog listed none — recovered from cache: ${recovered.join(', ')}`);
@@ -75,11 +76,14 @@ export async function ensureDeviceToolsLoaded({ force = false } = {}): Promise<s
             return;
           }
           try {
+            // The manifest is the authority on what the tools may touch — the
+            // same grants its rendered surface gets, never the bundle's claim.
             await bundleManager.loadTools(
               m.id,
               bundleUrl,
               m.version || '1.0.0',
               getNativeBundleHash(m) || undefined,
+              resolvePluginGrants({ pluginId: m.id, manifest: m }),
             );
           } catch (err: any) {
             console.warn(`[deviceTools] ${m.id} failed to load:`, err?.message || String(err));
@@ -127,6 +131,14 @@ export async function ensureDeviceToolsLoaded({ force = false } = {}): Promise<s
  * An entry with no recorded tenant predates the stamp. Its owner is unknown,
  * which means untrusted — skip it and let the normal catalog path re-download
  * it under a real hash gate.
+ *
+ * GRANTS COME FROM THE RECORDED MANIFEST, NEVER THE BUNDLE. With no manifest
+ * here, the tools register under the `trusted` declaration (pluginId +
+ * capabilities + stateDomains) the bundle manager recorded on the entry when a
+ * manifest last loaded these bytes. An entry without one — written before the
+ * record existed, or never loaded under a manifest — is skipped (fail closed):
+ * the only other source is the bundle's own claim, and the catalog path
+ * registers it properly once its connector answers.
  */
 async function loadFromDiskCache(): Promise<string[]> {
   try {
@@ -145,11 +157,17 @@ async function loadFromDiskCache(): Promise<string[]> {
     if (skipped > 0) {
       console.log(`[deviceTools] disk-cache recovery: ${mine.length} for "${tenant}", skipped ${skipped} not owned by it`);
     }
-    if (mine.length === 0) return [];
+    const declared = mine.filter((e) => !!e.trusted?.pluginId);
+    if (declared.length < mine.length) {
+      console.log(
+        `[deviceTools] disk-cache recovery: skipped ${mine.length - declared.length} with no recorded manifest grant (fail closed)`,
+      );
+    }
+    if (declared.length === 0) return [];
 
-    await Promise.all(mine.map(async (e: any) => {
+    await Promise.all(declared.map(async (e) => {
       try {
-        await bundleManager.loadTools('cache:' + e.bundleUrl, e.bundleUrl, e.version, e.bundleHash);
+        await bundleManager.loadTools(e.trusted!.pluginId, e.bundleUrl, e.version, e.bundleHash, e.trusted!);
       } catch {
         // A cached bundle that no longer loads is not worth failing a call over.
       }

package/src/tools/registry.ts

@@ -14,7 +14,7 @@
  */
 import { createNativeBridge } from '../bridge/native';
 import { getPluginNative, gatePluginNative } from '../host';
-import { gateDeviceState } from '../deviceStateHost';
+import { gateDeviceState, withoutSubscribe } from '../deviceStateHost';
 import type { DeviceToolContext, DeviceToolDefinition, NativeCapabilities } from '../sdk/types';
 import type { DeviceBridgeDomain } from '../sdk/device-state';
 
@@ -62,7 +62,8 @@ export function setDeviceToolContextProvider(
  * Default context: the plugin's own bridge + a capability-gated Device Bridge +
  * the L3 DeviceState gated to the domains the plugin declared. All three are the
  * SAME gated objects the plugin gets when it renders — a tool reaches nothing a
- * UI plugin couldn't.
+ * UI plugin couldn't. (One thing less: `callDeviceTool` takes `subscribe` away,
+ * because a call has no lifetime to own one.)
  */
 function defaultContext(
   pluginId: string,
@@ -120,8 +121,11 @@ export function unregisterDeviceTools(pluginId: string): void {
   }
 }
 
-export function hasDeviceTool(name: string): boolean {
-  return registry.has(name);
+/** Is `name` registered — and, given `pluginId`, registered BY that plugin?
+ *  (A clean voice call only lets its owner's own tools run.) */
+export function hasDeviceTool(name: string, pluginId?: string): boolean {
+  const entry = registry.get(name);
+  return !!entry && (pluginId === undefined || entry.pluginId === pluginId);
 }
 
 export function listDeviceTools(): DeviceToolSummary[] {
@@ -152,8 +156,11 @@ export async function callDeviceTool(
 
   try {
     const build = contextProvider || defaultContext;
+    const built = build(entry.pluginId, entry.capabilities, entry.stateDomains);
     const ctx: DeviceToolContext = {
-      ...build(entry.pluginId, entry.capabilities, entry.stateDomains),
+      ...built,
+      // Whoever built the context, a call cannot own a subscription.
+      deviceState: withoutSubscribe(built.deviceState),
       signal: opts.signal,
     };
 

package/src/voiceHost.ts

@@ -62,6 +62,8 @@ function deniedVoice(why: string): VoiceAPI {
         listening: false,
         userSpeaking: false,
         lastUserSpeechEndedAt: null,
+        lastDeviceTool: null,
+        authorizedSessionId: null,
         lastError: why,
       };
     },