@ateam-ai-mobile/ui 0.1.7 → 0.1.8

package/dist/index.mjs

@@ -2664,6 +2664,7 @@ import {
   callDeviceTool,
   ensureDeviceToolsLoaded,
   listDeviceTools,
+  hasDeviceTool,
   PLATFORM_VOICE_CALLER
 } from "@ateam-ai-mobile/plugin-runtime";
 var CONNECT_TIMEOUT_MS = 3e4;
@@ -2814,6 +2815,7 @@ var IDLE = {
   muted: false,
   userSpeaking: false,
   lastUserSpeechEndedAt: null,
+  lastDeviceTool: null,
   mounted: false,
   webViewSource: null,
   skillSlug: void 0
@@ -2835,6 +2837,40 @@ var VoiceSessionManager = class {
      * conversation just because it declared voice.
      */
     this.owner = null;
+    /** EVERY start() still in its pre-mount awaits (tool preload, token refresh).
+     *  The session is not 'connecting' yet, so a stop() arriving now would otherwise
+     *  be an idle no-op — and a start would then mount a call for a screen that has
+     *  already gone. A set, not one slot: two concurrent starts must BOTH be
+     *  cancellable. stop() cancels every pending start of its caller (the platform:
+     *  all of them); another plugin's stop cancels none. */
+    this.pendingStarts = /* @__PURE__ */ new Set();
+    /**
+     * The device-tool names Core ALLOWED for this voice session — Core's sanitized
+     * allowset, delivered to the phone in a `deviceToolAllowset` message.
+     * Authorization gates against THIS (necessary, alongside the registry's can-do).
+     *
+     * WHY (GPT gate 1, corrected): the phone only PROPOSES its available tools
+     * (sendDeviceToolList); CORE is the session authority and decides which are
+     * accepted (session.device_tools). Freezing the phone's own proposal would let
+     * a tool Core REJECTED still run locally. So the authz set is populated from
+     * Core's accepted set, never from listDeviceTools(). Until Core's set arrives
+     * this is null and every call FAILS CLOSED. Pinned once per session; the live
+     * registry (which drifts via lazy loads / host registration / tenant changes)
+     * never feeds it.
+     */
+    this.frozenTools = null;
+    /** The voice `sessionId` the current allowset is BOUND to. Authorization
+     *  requires it to equal the active session's id (state.sessionId), so a stale
+     *  allowset from a previous/other session is refused. */
+    this.frozenSessionId = null;
+    /** A CLEAN call (skills:'none') started by a plugin offers and runs ONLY that
+     *  plugin's own device tools — not other solutions' tools that happen to be
+     *  registered on the same phone. null = every registered tool (a normal call,
+     *  or the platform's). Set by every start(); like `owner`, kept after stop.
+     *  ONE identity: the caller is the TRUSTED manifest pluginId gateVoice stamps,
+     *  and the bundleManager registers a plugin's tools under that same id (never
+     *  the bundle's own short `id`), so exact equality is the whole check. */
+    this.toolScope = null;
     this.injectedTrackHook = INJECT_TRACK_HOOK;
   }
   /** The platform (built-in sheet, mic indicator, session host) sees and
@@ -2870,6 +2906,11 @@ var VoiceSessionManager = class {
       if (!this.canAccess(caller)) throw this.foreignError();
       return this.waitForConnect();
     }
+    if (opts?.skills === "none" && opts?.skillSlug) {
+      throw new Error("voice: skills:'none' (a clean call) cannot also hand the mic to a skill (skillSlug).");
+    }
+    const ticket = { caller, cancelled: false };
+    this.pendingStarts.add(ticket);
     try {
       await ensureDeviceToolsLoaded();
     } catch (e) {
@@ -2879,7 +2920,21 @@ var VoiceSessionManager = class {
       if (tokenNeedsRefresh(getToken2())) await refreshToken();
     } catch {
     }
+    this.pendingStarts.delete(ticket);
+    if (ticket.cancelled) throw new Error("voice: stopped before the session started");
+    const after = this.getInternal().callState;
+    if (after === "connected") {
+      if (!this.canAccess(caller)) throw this.foreignError();
+      return this.realSnapshot();
+    }
+    if (after === "connecting") {
+      if (!this.canAccess(caller)) throw this.foreignError();
+      return this.waitForConnect();
+    }
     this.owner = caller;
+    this.toolScope = opts?.skills === "none" && typeof caller === "string" ? caller : null;
+    this.frozenTools = null;
+    this.frozenSessionId = null;
     const skillSlug = opts?.skillSlug;
     this.setState({
       callState: "connecting",
@@ -2890,14 +2945,23 @@ var VoiceSessionManager = class {
       muted: false,
       mounted: true,
       skillSlug,
-      webViewSource: { uri: this.buildUri(skillSlug) }
+      persona: opts?.persona,
+      webViewSource: { uri: this.buildUri(skillSlug, opts?.persona, opts?.skills) }
     });
     return this.waitForConnect();
   }
   stop(caller = PLATFORM_VOICE_CALLER) {
     if (this.state.callState !== "idle" && !this.canAccess(caller)) throw this.foreignError();
+    for (const t of [...this.pendingStarts]) {
+      if (caller === PLATFORM_VOICE_CALLER || caller === t.caller) {
+        t.cancelled = true;
+        this.pendingStarts.delete(t);
+      }
+    }
     this.webView?.injectJavaScript?.("window.hangUp && window.hangUp(); true;");
     this.rejectPending(new Error("voice: session stopped before it connected"));
+    this.frozenTools = null;
+    this.frozenSessionId = null;
     this.setState({
       ...IDLE,
       // keep the transcript of the call that just ended for any reader still up
@@ -2918,10 +2982,9 @@ var VoiceSessionManager = class {
   }
   /**
    * Stream a silent observation into the live session — tell the model without
-   * asking it to speak. The cheap, high-frequency channel (safe once or twice a
-   * second) behind a future props.voice.observe(); today the host uses it to run
-   * the real-device stream proof (VOICE_RT_STREAM_DEVICE_PROOF) before the gated
-   * plugin API is added. Owner-scoped like every other control.
+   * asking it to speak. The cheap channel behind the gated props.voice.observe();
+   * every item stays in the model's context for the call, so a caller sends only
+   * material changes. Owner-scoped like every other control.
    */
   observe(text, caller = PLATFORM_VOICE_CALLER) {
     if (this.state.callState !== "connected") {
@@ -2943,6 +3006,8 @@ var VoiceSessionManager = class {
       listening: !!s.userPartial,
       userSpeaking: s.userSpeaking,
       lastUserSpeechEndedAt: s.lastUserSpeechEndedAt,
+      lastDeviceTool: s.lastDeviceTool,
+      authorizedSessionId: this.frozenSessionId,
       lastError: s.error
     };
   }
@@ -2955,6 +3020,8 @@ var VoiceSessionManager = class {
       listening: false,
       userSpeaking: false,
       lastUserSpeechEndedAt: null,
+      lastDeviceTool: null,
+      authorizedSessionId: null,
       lastError: null
     };
   }
@@ -2971,12 +3038,15 @@ var VoiceSessionManager = class {
     return this.canAccess(caller) ? this.state.transcript.slice() : [];
   }
   // ── WebView plumbing ─────────────────────────────────────────
-  buildUri(skillSlug) {
+  buildUri(skillSlug, persona, skills) {
     const token = getToken2();
     const tenant = getTenant5();
     const actorId = getUser2()?.actorId || "";
     const skillParam = skillSlug ? `&skillSlug=${encodeURIComponent(skillSlug)}` : "";
-    return `${getVoiceApiUrl2()}/app?mode=mini&embedded=rn&authToken=${encodeURIComponent(token || "")}&tenant=${encodeURIComponent(tenant)}&actorId=${encodeURIComponent(actorId)}${skillParam}`;
+    const p = persona && (persona.name || persona.style) ? { ...persona.name ? { name: persona.name } : {}, ...persona.style ? { style: persona.style } : {} } : null;
+    const personaParam = p ? `&persona=${encodeURIComponent(JSON.stringify(p))}` : "";
+    const skillsParam = skills === "none" ? "&skills=none" : "";
+    return `${getVoiceApiUrl2()}/app?mode=mini&embedded=rn&authToken=${encodeURIComponent(token || "")}&tenant=${encodeURIComponent(tenant)}&actorId=${encodeURIComponent(actorId)}${skillParam}${personaParam}${skillsParam}`;
   }
   /** Handle a postMessage from the WebView. `event` is the RN WebView event. */
   handleMessage(event) {
@@ -3040,6 +3110,27 @@ var VoiceSessionManager = class {
         this.sendDeviceToolList(data.correlationId);
         break;
       }
+      // CORE's ALLOWSET for this session — what the model may ASK for. Core sends
+      // it (even empty, on purpose) at session start. It is a NECESSARY gate, not
+      // the whole story: a call must be in the allowset AND the device must
+      // actually have the tool (the registry check inside callDeviceTool) — Core
+      // says what may be asked, the device decides what it will do.
+      //
+      // Origin-checked (only the voice app may set it) and pinned ONCE per session
+      // (a later message cannot widen it). An EMPTY allowset (arrived) refuses
+      // everything but is distinct from NEVER-arrived (frozenTools stays null);
+      // both fail closed here — we never fall back to the phone's own registry,
+      // which is the seam this closes.
+      case "deviceToolAllowset": {
+        const sender = originOf(event?.nativeEvent?.url);
+        const expected = originOf(getVoiceApiUrl2());
+        if (!sender || !expected || sender !== expected) break;
+        if (Array.isArray(data.tools) && typeof data.sessionId === "string" && data.sessionId !== this.frozenSessionId) {
+          this.frozenTools = new Set(data.tools.filter((n) => typeof n === "string"));
+          this.frozenSessionId = data.sessionId;
+        }
+        break;
+      }
       case "device-tool-call": {
         const sender = originOf(event?.nativeEvent?.url);
         const expected = originOf(getVoiceApiUrl2());
@@ -3047,14 +3138,64 @@ var VoiceSessionManager = class {
           console.warn(`[voiceSession] REFUSED device tool call from "${sender || "unknown origin"}" (expected "${expected}")`);
           break;
         }
+        if (data.name) this.setState({ lastDeviceTool: { name: data.name, at: Date.now() } });
+        if (!this.isToolAuthorized(data.name)) {
+          const notReady = this.frozenTools === null;
+          console.warn(`[voiceSession] REFUSED "${data.name}" \u2014 ${notReady ? "allowset not received yet" : "not authorized for this session"}`);
+          this.postDeviceToolRefusal(data.correlationId, data.name, notReady);
+          break;
+        }
         void this.runDeviceTool(data);
         break;
       }
     }
   }
-  /** Answer "what device tools do you have?" — the client is the authority. */
+  /**
+   * Final authorization = Core's frozen allowset ∩ the current valid local
+   * registry, bound to the ACTIVE session. All must hold:
+   *  - a Core allowset arrived and is bound to THIS session (frozenSessionId ===
+   *    the active state.sessionId) — a missing or stale/wrong-session allowset
+   *    fails closed;
+   *  - the tool is IN that allowset (Core approved it); AND
+   *  - the tool is STILL registered locally right now (removed-after-approval is
+   *    refused; a lazily-added tool Core never approved is refused) — and, on a
+   *    clean call, registered by the call's owner.
+   * No fallback to the live registry alone, ever.
+   */
+  isToolAuthorized(name) {
+    if (typeof name !== "string") return false;
+    if (this.frozenTools === null || this.frozenSessionId === null) return false;
+    if (this.frozenSessionId !== this.state.sessionId) return false;
+    if (!this.frozenTools.has(name)) return false;
+    return hasDeviceTool(name, this.toolScope ?? void 0);
+  }
+  /** Tell the mini-app the call was refused — a stated reason, never a silent drop.
+   *  `notReady` distinguishes a transient "allowset not here yet" (retry) from a
+   *  final "not allowed in this session". */
+  postDeviceToolRefusal(correlationId, name, notReady) {
+    const payload = notReady ? {
+      correlationId,
+      ok: false,
+      reason: "not_ready",
+      error: "The voice session is still starting up \u2014 its tool allowset has not arrived yet. Try again in a moment."
+    } : {
+      correlationId,
+      ok: false,
+      reason: "not_authorized",
+      error: `"${name}" is not available in this voice session.`
+    };
+    this.webView?.injectJavaScript?.(
+      `window.__adasDeviceToolResult && window.__adasDeviceToolResult(${JSON.stringify(
+        JSON.stringify(payload)
+      )}); true;`
+    );
+  }
+  /** PROPOSE the phone's available tools — this is an offer to Core, not the
+   *  authorization set. Core sanitizes it and returns the accepted set in a
+   *  `deviceToolAllowset` message, which is what actually gates execution. */
   sendDeviceToolList(correlationId) {
-    const tools = listDeviceTools().map((t) => ({
+    const scope = this.toolScope;
+    const tools = listDeviceTools().filter((t) => scope === null || t.pluginId === scope).map((t) => ({
       name: t.name,
       description: t.description,
       input_schema: t.input_schema
@@ -3132,6 +3273,10 @@ var VoiceSessionManager = class {
     this.rejectPending(new Error("voice: reset"));
     this.state = { ...IDLE };
     this.owner = null;
+    this.toolScope = null;
+    this.pendingStarts.clear();
+    this.frozenTools = null;
+    this.frozenSessionId = null;
     this.listeners.clear();
     this.webView = null;
   }