@ateam-ai-mobile/ui 0.1.7 → 0.1.8

package/dist/index.d.mts

@@ -3,7 +3,7 @@ import { Message, JobProgress, UIAction, AdasSession, TenantMembership, HandoffE
 import * as React$1 from 'react';
 import React__default, { ReactNode } from 'react';
 import * as _ateam_ai_mobile_plugin_runtime from '@ateam-ai-mobile/plugin-runtime';
-import { PluginSurfaceMeta, PlatformPluginManifest, VoiceState, VoiceTranscriptEntry, VoiceSessionProvider, VoiceStartOptions, VoiceCaller, VoiceSnapshot, VoiceEvent, VoiceSubscription } from '@ateam-ai-mobile/plugin-runtime';
+import { PluginSurfaceMeta, PlatformPluginManifest, VoiceState, VoiceTranscriptEntry, VoiceSessionProvider, VoicePersona, VoiceStartOptions, VoiceCaller, VoiceSnapshot, VoiceEvent, VoiceSubscription } from '@ateam-ai-mobile/plugin-runtime';
 import * as zustand from 'zustand';
 
 interface AdasChatScreenProps {
@@ -394,6 +394,11 @@ interface InternalState {
     userSpeaking: boolean;
     /** Epoch ms of the last speaking:false, or null before the first utterance. */
     lastUserSpeechEndedAt: number | null;
+    /** The last device-tool call the model made (name + when), or null. */
+    lastDeviceTool: {
+        name: string;
+        at: number;
+    } | null;
     /** The WebView should be mounted (a session is wanted / live). */
     mounted: boolean;
     /** The WebView source, computed ONCE at start() so state changes (transcript,
@@ -402,6 +407,9 @@ interface InternalState {
         uri: string;
     } | null;
     skillSlug?: string;
+    /** Per-call persona override ({ name, style }) — sent to the voice page on the
+     *  session URL and declared on POST /session; the server layers it. */
+    persona?: VoicePersona;
 }
 declare class VoiceSessionManager implements VoiceSessionProvider {
     private state;
@@ -419,6 +427,40 @@ declare class VoiceSessionManager implements VoiceSessionProvider {
      * conversation just because it declared voice.
      */
     private owner;
+    /** EVERY start() still in its pre-mount awaits (tool preload, token refresh).
+     *  The session is not 'connecting' yet, so a stop() arriving now would otherwise
+     *  be an idle no-op — and a start would then mount a call for a screen that has
+     *  already gone. A set, not one slot: two concurrent starts must BOTH be
+     *  cancellable. stop() cancels every pending start of its caller (the platform:
+     *  all of them); another plugin's stop cancels none. */
+    private pendingStarts;
+    /**
+     * The device-tool names Core ALLOWED for this voice session — Core's sanitized
+     * allowset, delivered to the phone in a `deviceToolAllowset` message.
+     * Authorization gates against THIS (necessary, alongside the registry's can-do).
+     *
+     * WHY (GPT gate 1, corrected): the phone only PROPOSES its available tools
+     * (sendDeviceToolList); CORE is the session authority and decides which are
+     * accepted (session.device_tools). Freezing the phone's own proposal would let
+     * a tool Core REJECTED still run locally. So the authz set is populated from
+     * Core's accepted set, never from listDeviceTools(). Until Core's set arrives
+     * this is null and every call FAILS CLOSED. Pinned once per session; the live
+     * registry (which drifts via lazy loads / host registration / tenant changes)
+     * never feeds it.
+     */
+    private frozenTools;
+    /** The voice `sessionId` the current allowset is BOUND to. Authorization
+     *  requires it to equal the active session's id (state.sessionId), so a stale
+     *  allowset from a previous/other session is refused. */
+    private frozenSessionId;
+    /** A CLEAN call (skills:'none') started by a plugin offers and runs ONLY that
+     *  plugin's own device tools — not other solutions' tools that happen to be
+     *  registered on the same phone. null = every registered tool (a normal call,
+     *  or the platform's). Set by every start(); like `owner`, kept after stop.
+     *  ONE identity: the caller is the TRUSTED manifest pluginId gateVoice stamps,
+     *  and the bundleManager registers a plugin's tools under that same id (never
+     *  the bundle's own short `id`), so exact equality is the whole check. */
+    private toolScope;
     /** The platform (built-in sheet, mic indicator, session host) sees and
      *  controls any session — it is the user's own surface. A plugin caller may
      *  only touch a session it owns. */
@@ -438,10 +480,9 @@ declare class VoiceSessionManager implements VoiceSessionProvider {
     prompt(input: string, caller?: VoiceCaller): void;
     /**
      * Stream a silent observation into the live session — tell the model without
-     * asking it to speak. The cheap, high-frequency channel (safe once or twice a
-     * second) behind a future props.voice.observe(); today the host uses it to run
-     * the real-device stream proof (VOICE_RT_STREAM_DEVICE_PROOF) before the gated
-     * plugin API is added. Owner-scoped like every other control.
+     * asking it to speak. The cheap channel behind the gated props.voice.observe();
+     * every item stays in the model's context for the call, so a caller sends only
+     * material changes. Owner-scoped like every other control.
      */
     observe(text: string, caller?: VoiceCaller): void;
     getSnapshot(caller?: VoiceCaller): VoiceSnapshot;
@@ -452,7 +493,26 @@ declare class VoiceSessionManager implements VoiceSessionProvider {
     private buildUri;
     /** Handle a postMessage from the WebView. `event` is the RN WebView event. */
     handleMessage(event: any): void;
-    /** Answer "what device tools do you have?" — the client is the authority. */
+    /**
+     * Final authorization = Core's frozen allowset ∩ the current valid local
+     * registry, bound to the ACTIVE session. All must hold:
+     *  - a Core allowset arrived and is bound to THIS session (frozenSessionId ===
+     *    the active state.sessionId) — a missing or stale/wrong-session allowset
+     *    fails closed;
+     *  - the tool is IN that allowset (Core approved it); AND
+     *  - the tool is STILL registered locally right now (removed-after-approval is
+     *    refused; a lazily-added tool Core never approved is refused) — and, on a
+     *    clean call, registered by the call's owner.
+     * No fallback to the live registry alone, ever.
+     */
+    private isToolAuthorized;
+    /** Tell the mini-app the call was refused — a stated reason, never a silent drop.
+     *  `notReady` distinguishes a transient "allowset not here yet" (retry) from a
+     *  final "not allowed in this session". */
+    private postDeviceToolRefusal;
+    /** PROPOSE the phone's available tools — this is an offer to Core, not the
+     *  authorization set. Core sanitizes it and returns the accepted set in a
+     *  `deviceToolAllowset` message, which is what actually gates execution. */
     private sendDeviceToolList;
     /** Run a device tool and post the outcome back into the WebView. */
     private runDeviceTool;

package/dist/index.d.ts

@@ -3,7 +3,7 @@ import { Message, JobProgress, UIAction, AdasSession, TenantMembership, HandoffE
 import * as React$1 from 'react';
 import React__default, { ReactNode } from 'react';
 import * as _ateam_ai_mobile_plugin_runtime from '@ateam-ai-mobile/plugin-runtime';
-import { PluginSurfaceMeta, PlatformPluginManifest, VoiceState, VoiceTranscriptEntry, VoiceSessionProvider, VoiceStartOptions, VoiceCaller, VoiceSnapshot, VoiceEvent, VoiceSubscription } from '@ateam-ai-mobile/plugin-runtime';
+import { PluginSurfaceMeta, PlatformPluginManifest, VoiceState, VoiceTranscriptEntry, VoiceSessionProvider, VoicePersona, VoiceStartOptions, VoiceCaller, VoiceSnapshot, VoiceEvent, VoiceSubscription } from '@ateam-ai-mobile/plugin-runtime';
 import * as zustand from 'zustand';
 
 interface AdasChatScreenProps {
@@ -394,6 +394,11 @@ interface InternalState {
     userSpeaking: boolean;
     /** Epoch ms of the last speaking:false, or null before the first utterance. */
     lastUserSpeechEndedAt: number | null;
+    /** The last device-tool call the model made (name + when), or null. */
+    lastDeviceTool: {
+        name: string;
+        at: number;
+    } | null;
     /** The WebView should be mounted (a session is wanted / live). */
     mounted: boolean;
     /** The WebView source, computed ONCE at start() so state changes (transcript,
@@ -402,6 +407,9 @@ interface InternalState {
         uri: string;
     } | null;
     skillSlug?: string;
+    /** Per-call persona override ({ name, style }) — sent to the voice page on the
+     *  session URL and declared on POST /session; the server layers it. */
+    persona?: VoicePersona;
 }
 declare class VoiceSessionManager implements VoiceSessionProvider {
     private state;
@@ -419,6 +427,40 @@ declare class VoiceSessionManager implements VoiceSessionProvider {
      * conversation just because it declared voice.
      */
     private owner;
+    /** EVERY start() still in its pre-mount awaits (tool preload, token refresh).
+     *  The session is not 'connecting' yet, so a stop() arriving now would otherwise
+     *  be an idle no-op — and a start would then mount a call for a screen that has
+     *  already gone. A set, not one slot: two concurrent starts must BOTH be
+     *  cancellable. stop() cancels every pending start of its caller (the platform:
+     *  all of them); another plugin's stop cancels none. */
+    private pendingStarts;
+    /**
+     * The device-tool names Core ALLOWED for this voice session — Core's sanitized
+     * allowset, delivered to the phone in a `deviceToolAllowset` message.
+     * Authorization gates against THIS (necessary, alongside the registry's can-do).
+     *
+     * WHY (GPT gate 1, corrected): the phone only PROPOSES its available tools
+     * (sendDeviceToolList); CORE is the session authority and decides which are
+     * accepted (session.device_tools). Freezing the phone's own proposal would let
+     * a tool Core REJECTED still run locally. So the authz set is populated from
+     * Core's accepted set, never from listDeviceTools(). Until Core's set arrives
+     * this is null and every call FAILS CLOSED. Pinned once per session; the live
+     * registry (which drifts via lazy loads / host registration / tenant changes)
+     * never feeds it.
+     */
+    private frozenTools;
+    /** The voice `sessionId` the current allowset is BOUND to. Authorization
+     *  requires it to equal the active session's id (state.sessionId), so a stale
+     *  allowset from a previous/other session is refused. */
+    private frozenSessionId;
+    /** A CLEAN call (skills:'none') started by a plugin offers and runs ONLY that
+     *  plugin's own device tools — not other solutions' tools that happen to be
+     *  registered on the same phone. null = every registered tool (a normal call,
+     *  or the platform's). Set by every start(); like `owner`, kept after stop.
+     *  ONE identity: the caller is the TRUSTED manifest pluginId gateVoice stamps,
+     *  and the bundleManager registers a plugin's tools under that same id (never
+     *  the bundle's own short `id`), so exact equality is the whole check. */
+    private toolScope;
     /** The platform (built-in sheet, mic indicator, session host) sees and
      *  controls any session — it is the user's own surface. A plugin caller may
      *  only touch a session it owns. */
@@ -438,10 +480,9 @@ declare class VoiceSessionManager implements VoiceSessionProvider {
     prompt(input: string, caller?: VoiceCaller): void;
     /**
      * Stream a silent observation into the live session — tell the model without
-     * asking it to speak. The cheap, high-frequency channel (safe once or twice a
-     * second) behind a future props.voice.observe(); today the host uses it to run
-     * the real-device stream proof (VOICE_RT_STREAM_DEVICE_PROOF) before the gated
-     * plugin API is added. Owner-scoped like every other control.
+     * asking it to speak. The cheap channel behind the gated props.voice.observe();
+     * every item stays in the model's context for the call, so a caller sends only
+     * material changes. Owner-scoped like every other control.
      */
     observe(text: string, caller?: VoiceCaller): void;
     getSnapshot(caller?: VoiceCaller): VoiceSnapshot;
@@ -452,7 +493,26 @@ declare class VoiceSessionManager implements VoiceSessionProvider {
     private buildUri;
     /** Handle a postMessage from the WebView. `event` is the RN WebView event. */
     handleMessage(event: any): void;
-    /** Answer "what device tools do you have?" — the client is the authority. */
+    /**
+     * Final authorization = Core's frozen allowset ∩ the current valid local
+     * registry, bound to the ACTIVE session. All must hold:
+     *  - a Core allowset arrived and is bound to THIS session (frozenSessionId ===
+     *    the active state.sessionId) — a missing or stale/wrong-session allowset
+     *    fails closed;
+     *  - the tool is IN that allowset (Core approved it); AND
+     *  - the tool is STILL registered locally right now (removed-after-approval is
+     *    refused; a lazily-added tool Core never approved is refused) — and, on a
+     *    clean call, registered by the call's owner.
+     * No fallback to the live registry alone, ever.
+     */
+    private isToolAuthorized;
+    /** Tell the mini-app the call was refused — a stated reason, never a silent drop.
+     *  `notReady` distinguishes a transient "allowset not here yet" (retry) from a
+     *  final "not allowed in this session". */
+    private postDeviceToolRefusal;
+    /** PROPOSE the phone's available tools — this is an offer to Core, not the
+     *  authorization set. Core sanitizes it and returns the accepted set in a
+     *  `deviceToolAllowset` message, which is what actually gates execution. */
     private sendDeviceToolList;
     /** Run a device tool and post the outcome back into the WebView. */
     private runDeviceTool;

package/dist/index.js

@@ -2837,6 +2837,7 @@ var IDLE = {
   muted: false,
   userSpeaking: false,
   lastUserSpeechEndedAt: null,
+  lastDeviceTool: null,
   mounted: false,
   webViewSource: null,
   skillSlug: void 0
@@ -2858,6 +2859,40 @@ var VoiceSessionManager = class {
      * conversation just because it declared voice.
      */
     this.owner = null;
+    /** EVERY start() still in its pre-mount awaits (tool preload, token refresh).
+     *  The session is not 'connecting' yet, so a stop() arriving now would otherwise
+     *  be an idle no-op — and a start would then mount a call for a screen that has
+     *  already gone. A set, not one slot: two concurrent starts must BOTH be
+     *  cancellable. stop() cancels every pending start of its caller (the platform:
+     *  all of them); another plugin's stop cancels none. */
+    this.pendingStarts = /* @__PURE__ */ new Set();
+    /**
+     * The device-tool names Core ALLOWED for this voice session — Core's sanitized
+     * allowset, delivered to the phone in a `deviceToolAllowset` message.
+     * Authorization gates against THIS (necessary, alongside the registry's can-do).
+     *
+     * WHY (GPT gate 1, corrected): the phone only PROPOSES its available tools
+     * (sendDeviceToolList); CORE is the session authority and decides which are
+     * accepted (session.device_tools). Freezing the phone's own proposal would let
+     * a tool Core REJECTED still run locally. So the authz set is populated from
+     * Core's accepted set, never from listDeviceTools(). Until Core's set arrives
+     * this is null and every call FAILS CLOSED. Pinned once per session; the live
+     * registry (which drifts via lazy loads / host registration / tenant changes)
+     * never feeds it.
+     */
+    this.frozenTools = null;
+    /** The voice `sessionId` the current allowset is BOUND to. Authorization
+     *  requires it to equal the active session's id (state.sessionId), so a stale
+     *  allowset from a previous/other session is refused. */
+    this.frozenSessionId = null;
+    /** A CLEAN call (skills:'none') started by a plugin offers and runs ONLY that
+     *  plugin's own device tools — not other solutions' tools that happen to be
+     *  registered on the same phone. null = every registered tool (a normal call,
+     *  or the platform's). Set by every start(); like `owner`, kept after stop.
+     *  ONE identity: the caller is the TRUSTED manifest pluginId gateVoice stamps,
+     *  and the bundleManager registers a plugin's tools under that same id (never
+     *  the bundle's own short `id`), so exact equality is the whole check. */
+    this.toolScope = null;
     this.injectedTrackHook = INJECT_TRACK_HOOK;
   }
   /** The platform (built-in sheet, mic indicator, session host) sees and
@@ -2893,6 +2928,11 @@ var VoiceSessionManager = class {
       if (!this.canAccess(caller)) throw this.foreignError();
       return this.waitForConnect();
     }
+    if (opts?.skills === "none" && opts?.skillSlug) {
+      throw new Error("voice: skills:'none' (a clean call) cannot also hand the mic to a skill (skillSlug).");
+    }
+    const ticket = { caller, cancelled: false };
+    this.pendingStarts.add(ticket);
     try {
       await (0, import_plugin_runtime13.ensureDeviceToolsLoaded)();
     } catch (e) {
@@ -2902,7 +2942,21 @@ var VoiceSessionManager = class {
       if (tokenNeedsRefresh((0, import_core22.getToken)())) await (0, import_core22.refreshToken)();
     } catch {
     }
+    this.pendingStarts.delete(ticket);
+    if (ticket.cancelled) throw new Error("voice: stopped before the session started");
+    const after = this.getInternal().callState;
+    if (after === "connected") {
+      if (!this.canAccess(caller)) throw this.foreignError();
+      return this.realSnapshot();
+    }
+    if (after === "connecting") {
+      if (!this.canAccess(caller)) throw this.foreignError();
+      return this.waitForConnect();
+    }
     this.owner = caller;
+    this.toolScope = opts?.skills === "none" && typeof caller === "string" ? caller : null;
+    this.frozenTools = null;
+    this.frozenSessionId = null;
     const skillSlug = opts?.skillSlug;
     this.setState({
       callState: "connecting",
@@ -2913,14 +2967,23 @@ var VoiceSessionManager = class {
       muted: false,
       mounted: true,
       skillSlug,
-      webViewSource: { uri: this.buildUri(skillSlug) }
+      persona: opts?.persona,
+      webViewSource: { uri: this.buildUri(skillSlug, opts?.persona, opts?.skills) }
     });
     return this.waitForConnect();
   }
   stop(caller = import_plugin_runtime13.PLATFORM_VOICE_CALLER) {
     if (this.state.callState !== "idle" && !this.canAccess(caller)) throw this.foreignError();
+    for (const t of [...this.pendingStarts]) {
+      if (caller === import_plugin_runtime13.PLATFORM_VOICE_CALLER || caller === t.caller) {
+        t.cancelled = true;
+        this.pendingStarts.delete(t);
+      }
+    }
     this.webView?.injectJavaScript?.("window.hangUp && window.hangUp(); true;");
     this.rejectPending(new Error("voice: session stopped before it connected"));
+    this.frozenTools = null;
+    this.frozenSessionId = null;
     this.setState({
       ...IDLE,
       // keep the transcript of the call that just ended for any reader still up
@@ -2941,10 +3004,9 @@ var VoiceSessionManager = class {
   }
   /**
    * Stream a silent observation into the live session — tell the model without
-   * asking it to speak. The cheap, high-frequency channel (safe once or twice a
-   * second) behind a future props.voice.observe(); today the host uses it to run
-   * the real-device stream proof (VOICE_RT_STREAM_DEVICE_PROOF) before the gated
-   * plugin API is added. Owner-scoped like every other control.
+   * asking it to speak. The cheap channel behind the gated props.voice.observe();
+   * every item stays in the model's context for the call, so a caller sends only
+   * material changes. Owner-scoped like every other control.
    */
   observe(text, caller = import_plugin_runtime13.PLATFORM_VOICE_CALLER) {
     if (this.state.callState !== "connected") {
@@ -2966,6 +3028,8 @@ var VoiceSessionManager = class {
       listening: !!s.userPartial,
       userSpeaking: s.userSpeaking,
       lastUserSpeechEndedAt: s.lastUserSpeechEndedAt,
+      lastDeviceTool: s.lastDeviceTool,
+      authorizedSessionId: this.frozenSessionId,
       lastError: s.error
     };
   }
@@ -2978,6 +3042,8 @@ var VoiceSessionManager = class {
       listening: false,
       userSpeaking: false,
       lastUserSpeechEndedAt: null,
+      lastDeviceTool: null,
+      authorizedSessionId: null,
       lastError: null
     };
   }
@@ -2994,12 +3060,15 @@ var VoiceSessionManager = class {
     return this.canAccess(caller) ? this.state.transcript.slice() : [];
   }
   // ── WebView plumbing ─────────────────────────────────────────
-  buildUri(skillSlug) {
+  buildUri(skillSlug, persona, skills) {
     const token = (0, import_core22.getToken)();
     const tenant = (0, import_core22.getTenant)();
     const actorId = (0, import_core22.getUser)()?.actorId || "";
     const skillParam = skillSlug ? `&skillSlug=${encodeURIComponent(skillSlug)}` : "";
-    return `${(0, import_core22.getVoiceApiUrl)()}/app?mode=mini&embedded=rn&authToken=${encodeURIComponent(token || "")}&tenant=${encodeURIComponent(tenant)}&actorId=${encodeURIComponent(actorId)}${skillParam}`;
+    const p = persona && (persona.name || persona.style) ? { ...persona.name ? { name: persona.name } : {}, ...persona.style ? { style: persona.style } : {} } : null;
+    const personaParam = p ? `&persona=${encodeURIComponent(JSON.stringify(p))}` : "";
+    const skillsParam = skills === "none" ? "&skills=none" : "";
+    return `${(0, import_core22.getVoiceApiUrl)()}/app?mode=mini&embedded=rn&authToken=${encodeURIComponent(token || "")}&tenant=${encodeURIComponent(tenant)}&actorId=${encodeURIComponent(actorId)}${skillParam}${personaParam}${skillsParam}`;
   }
   /** Handle a postMessage from the WebView. `event` is the RN WebView event. */
   handleMessage(event) {
@@ -3063,6 +3132,27 @@ var VoiceSessionManager = class {
         this.sendDeviceToolList(data.correlationId);
         break;
       }
+      // CORE's ALLOWSET for this session — what the model may ASK for. Core sends
+      // it (even empty, on purpose) at session start. It is a NECESSARY gate, not
+      // the whole story: a call must be in the allowset AND the device must
+      // actually have the tool (the registry check inside callDeviceTool) — Core
+      // says what may be asked, the device decides what it will do.
+      //
+      // Origin-checked (only the voice app may set it) and pinned ONCE per session
+      // (a later message cannot widen it). An EMPTY allowset (arrived) refuses
+      // everything but is distinct from NEVER-arrived (frozenTools stays null);
+      // both fail closed here — we never fall back to the phone's own registry,
+      // which is the seam this closes.
+      case "deviceToolAllowset": {
+        const sender = originOf(event?.nativeEvent?.url);
+        const expected = originOf((0, import_core22.getVoiceApiUrl)());
+        if (!sender || !expected || sender !== expected) break;
+        if (Array.isArray(data.tools) && typeof data.sessionId === "string" && data.sessionId !== this.frozenSessionId) {
+          this.frozenTools = new Set(data.tools.filter((n) => typeof n === "string"));
+          this.frozenSessionId = data.sessionId;
+        }
+        break;
+      }
       case "device-tool-call": {
         const sender = originOf(event?.nativeEvent?.url);
         const expected = originOf((0, import_core22.getVoiceApiUrl)());
@@ -3070,14 +3160,64 @@ var VoiceSessionManager = class {
           console.warn(`[voiceSession] REFUSED device tool call from "${sender || "unknown origin"}" (expected "${expected}")`);
           break;
         }
+        if (data.name) this.setState({ lastDeviceTool: { name: data.name, at: Date.now() } });
+        if (!this.isToolAuthorized(data.name)) {
+          const notReady = this.frozenTools === null;
+          console.warn(`[voiceSession] REFUSED "${data.name}" \u2014 ${notReady ? "allowset not received yet" : "not authorized for this session"}`);
+          this.postDeviceToolRefusal(data.correlationId, data.name, notReady);
+          break;
+        }
         void this.runDeviceTool(data);
         break;
       }
     }
   }
-  /** Answer "what device tools do you have?" — the client is the authority. */
+  /**
+   * Final authorization = Core's frozen allowset ∩ the current valid local
+   * registry, bound to the ACTIVE session. All must hold:
+   *  - a Core allowset arrived and is bound to THIS session (frozenSessionId ===
+   *    the active state.sessionId) — a missing or stale/wrong-session allowset
+   *    fails closed;
+   *  - the tool is IN that allowset (Core approved it); AND
+   *  - the tool is STILL registered locally right now (removed-after-approval is
+   *    refused; a lazily-added tool Core never approved is refused) — and, on a
+   *    clean call, registered by the call's owner.
+   * No fallback to the live registry alone, ever.
+   */
+  isToolAuthorized(name) {
+    if (typeof name !== "string") return false;
+    if (this.frozenTools === null || this.frozenSessionId === null) return false;
+    if (this.frozenSessionId !== this.state.sessionId) return false;
+    if (!this.frozenTools.has(name)) return false;
+    return (0, import_plugin_runtime13.hasDeviceTool)(name, this.toolScope ?? void 0);
+  }
+  /** Tell the mini-app the call was refused — a stated reason, never a silent drop.
+   *  `notReady` distinguishes a transient "allowset not here yet" (retry) from a
+   *  final "not allowed in this session". */
+  postDeviceToolRefusal(correlationId, name, notReady) {
+    const payload = notReady ? {
+      correlationId,
+      ok: false,
+      reason: "not_ready",
+      error: "The voice session is still starting up \u2014 its tool allowset has not arrived yet. Try again in a moment."
+    } : {
+      correlationId,
+      ok: false,
+      reason: "not_authorized",
+      error: `"${name}" is not available in this voice session.`
+    };
+    this.webView?.injectJavaScript?.(
+      `window.__adasDeviceToolResult && window.__adasDeviceToolResult(${JSON.stringify(
+        JSON.stringify(payload)
+      )}); true;`
+    );
+  }
+  /** PROPOSE the phone's available tools — this is an offer to Core, not the
+   *  authorization set. Core sanitizes it and returns the accepted set in a
+   *  `deviceToolAllowset` message, which is what actually gates execution. */
   sendDeviceToolList(correlationId) {
-    const tools = (0, import_plugin_runtime13.listDeviceTools)().map((t) => ({
+    const scope = this.toolScope;
+    const tools = (0, import_plugin_runtime13.listDeviceTools)().filter((t) => scope === null || t.pluginId === scope).map((t) => ({
       name: t.name,
       description: t.description,
       input_schema: t.input_schema
@@ -3155,6 +3295,10 @@ var VoiceSessionManager = class {
     this.rejectPending(new Error("voice: reset"));
     this.state = { ...IDLE };
     this.owner = null;
+    this.toolScope = null;
+    this.pendingStarts.clear();
+    this.frozenTools = null;
+    this.frozenSessionId = null;
     this.listeners.clear();
     this.webView = null;
   }