@ateam-ai-mobile/ui 0.1.7 → 0.1.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ateam-ai-mobile/ui",
-  "version": "0.1.7",
+  "version": "0.1.8",
   "description": "Prebuilt ADAS chat experience for React Native — full-screen chat, chips, widget views. Built on @ateam-ai-mobile/core + @ateam-ai-mobile/plugin-runtime.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -9,8 +9,8 @@
     "build": "tsup"
   },
   "dependencies": {
-    "@ateam-ai-mobile/core": "0.1.7",
-    "@ateam-ai-mobile/plugin-runtime": "0.1.7",
+    "@ateam-ai-mobile/core": "0.1.8",
+    "@ateam-ai-mobile/plugin-runtime": "0.1.8",
     "zustand": "^5.0.0"
   },
   "peerDependencies": {

package/src/plugin/Plugin.tsx

@@ -86,9 +86,10 @@ export default function Plugin({ id, manifest, commandBufferRef, props: enginePr
   const bridge = useNativeBridge(id, connectorId, commandBufferRef);
   // ONE runtime contract — the SAME resolver every surface uses, so this drawer/
   // fullscreen mount gates device/native + deviceState identically to the
-  // embedded mount and the tools path. Memoized so the plugin Component doesn't
-  // re-render on a fresh object every pass (useApi effects key off prop identity);
-  // `plugin` is in deps so state-domain fallback picks up the bundle once loaded.
+  // embedded mount. Memoized so the plugin Component doesn't re-render on a fresh
+  // object every pass (useApi effects key off prop identity). The manifest is the
+  // sole authority here (it is a required prop); `plugin` is read by the resolver
+  // only when there is no manifest, so the loaded bundle never widens its grants.
   const { device, native, deviceState, voice } = useMemo(
     () => resolvePluginRuntimeProps({ pluginId: id, manifest: manifest as any, plugin: plugin as any }),
     [id, manifest, plugin],

package/src/voice/voiceSession.ts

@@ -28,6 +28,7 @@ import {
   callDeviceTool,
   ensureDeviceToolsLoaded,
   listDeviceTools,
+  hasDeviceTool,
   PLATFORM_VOICE_CALLER,
   type VoiceSessionProvider,
   type VoiceCaller,
@@ -35,6 +36,7 @@ import {
   type VoiceState,
   type VoiceTranscriptEntry,
   type VoiceStartOptions,
+  type VoicePersona,
   type VoiceEvent,
   type VoiceSubscription,
 } from '@ateam-ai-mobile/plugin-runtime';
@@ -237,12 +239,17 @@ interface InternalState {
   userSpeaking: boolean;
   /** Epoch ms of the last speaking:false, or null before the first utterance. */
   lastUserSpeechEndedAt: number | null;
+  /** The last device-tool call the model made (name + when), or null. */
+  lastDeviceTool: { name: string; at: number } | null;
   /** The WebView should be mounted (a session is wanted / live). */
   mounted: boolean;
   /** The WebView source, computed ONCE at start() so state changes (transcript,
    *  partials) never remount the WebView and drop the session. */
   webViewSource: { uri: string } | null;
   skillSlug?: string;
+  /** Per-call persona override ({ name, style }) — sent to the voice page on the
+   *  session URL and declared on POST /session; the server layers it. */
+  persona?: VoicePersona;
 }
 
 const IDLE: InternalState = {
@@ -255,6 +262,7 @@ const IDLE: InternalState = {
   muted: false,
   userSpeaking: false,
   lastUserSpeechEndedAt: null,
+  lastDeviceTool: null,
   mounted: false,
   webViewSource: null,
   skillSlug: undefined,
@@ -279,6 +287,44 @@ class VoiceSessionManager implements VoiceSessionProvider {
    */
   private owner: VoiceCaller | null = null;
 
+  /** EVERY start() still in its pre-mount awaits (tool preload, token refresh).
+   *  The session is not 'connecting' yet, so a stop() arriving now would otherwise
+   *  be an idle no-op — and a start would then mount a call for a screen that has
+   *  already gone. A set, not one slot: two concurrent starts must BOTH be
+   *  cancellable. stop() cancels every pending start of its caller (the platform:
+   *  all of them); another plugin's stop cancels none. */
+  private pendingStarts = new Set<{ caller: VoiceCaller; cancelled: boolean }>();
+
+  /**
+   * The device-tool names Core ALLOWED for this voice session — Core's sanitized
+   * allowset, delivered to the phone in a `deviceToolAllowset` message.
+   * Authorization gates against THIS (necessary, alongside the registry's can-do).
+   *
+   * WHY (GPT gate 1, corrected): the phone only PROPOSES its available tools
+   * (sendDeviceToolList); CORE is the session authority and decides which are
+   * accepted (session.device_tools). Freezing the phone's own proposal would let
+   * a tool Core REJECTED still run locally. So the authz set is populated from
+   * Core's accepted set, never from listDeviceTools(). Until Core's set arrives
+   * this is null and every call FAILS CLOSED. Pinned once per session; the live
+   * registry (which drifts via lazy loads / host registration / tenant changes)
+   * never feeds it.
+   */
+  private frozenTools: Set<string> | null = null;
+
+  /** The voice `sessionId` the current allowset is BOUND to. Authorization
+   *  requires it to equal the active session's id (state.sessionId), so a stale
+   *  allowset from a previous/other session is refused. */
+  private frozenSessionId: string | null = null;
+
+  /** A CLEAN call (skills:'none') started by a plugin offers and runs ONLY that
+   *  plugin's own device tools — not other solutions' tools that happen to be
+   *  registered on the same phone. null = every registered tool (a normal call,
+   *  or the platform's). Set by every start(); like `owner`, kept after stop.
+   *  ONE identity: the caller is the TRUSTED manifest pluginId gateVoice stamps,
+   *  and the bundleManager registers a plugin's tools under that same id (never
+   *  the bundle's own short `id`), so exact equality is the whole check. */
+  private toolScope: string | null = null;
+
   /** The platform (built-in sheet, mic indicator, session host) sees and
    *  controls any session — it is the user's own surface. A plugin caller may
    *  only touch a session it owns. */
@@ -326,6 +372,12 @@ class VoiceSessionManager implements VoiceSessionProvider {
       return this.waitForConnect();
     }
 
+    if (opts?.skills === 'none' && opts?.skillSlug) {
+      throw new Error("voice: skills:'none' (a clean call) cannot also hand the mic to a skill (skillSlug).");
+    }
+    const ticket = { caller, cancelled: false };
+    this.pendingStarts.add(ticket);
+
     // Device tools only exist once their bundle is evaluated; a user who goes
     // straight to voice can otherwise ask for a tool the phone never loaded.
     // Best-effort — a failure just means no device tools this time.
@@ -344,8 +396,27 @@ class VoiceSessionManager implements VoiceSessionProvider {
       // error rather than us blocking the call.
     }
 
-    // Idle → this caller becomes the owner of the new session.
+    this.pendingStarts.delete(ticket);
+    if (ticket.cancelled) throw new Error('voice: stopped before the session started');
+    // Another start() may have mounted a session while we awaited — attach to it
+    // (or be refused) exactly as the entry checks would have, never mount twice.
+    // (Re-read: the awaits above can change it; the entry checks' narrowing can't.)
+    const after = this.getInternal().callState;
+    if (after === 'connected') {
+      if (!this.canAccess(caller)) throw this.foreignError();
+      return this.realSnapshot();
+    }
+    if (after === 'connecting') {
+      if (!this.canAccess(caller)) throw this.foreignError();
+      return this.waitForConnect();
+    }
+
+    // Idle → this caller becomes the owner of the new session. A NEW session
+    // re-freezes its tool set on the next tool-list request.
     this.owner = caller;
+    this.toolScope = opts?.skills === 'none' && typeof caller === 'string' ? caller : null;
+    this.frozenTools = null;
+    this.frozenSessionId = null;
     const skillSlug = opts?.skillSlug;
     this.setState({
       callState: 'connecting',
@@ -356,7 +427,8 @@ class VoiceSessionManager implements VoiceSessionProvider {
       muted: false,
       mounted: true,
       skillSlug,
-      webViewSource: { uri: this.buildUri(skillSlug) },
+      persona: opts?.persona,
+      webViewSource: { uri: this.buildUri(skillSlug, opts?.persona, opts?.skills) },
     });
     return this.waitForConnect();
   }
@@ -365,8 +437,18 @@ class VoiceSessionManager implements VoiceSessionProvider {
     // A plugin may not hang up another solution's live call. (Idle stop is a
     // harmless no-op for anyone.)
     if (this.state.callState !== 'idle' && !this.canAccess(caller)) throw this.foreignError();
+    // Starts still before their mount: cancel ALL of this caller's (the platform:
+    // everyone's) — another plugin must not be able to abort someone's call.
+    for (const t of [...this.pendingStarts]) {
+      if (caller === PLATFORM_VOICE_CALLER || caller === t.caller) {
+        t.cancelled = true;
+        this.pendingStarts.delete(t);
+      }
+    }
     this.webView?.injectJavaScript?.('window.hangUp && window.hangUp(); true;');
     this.rejectPending(new Error('voice: session stopped before it connected'));
+    this.frozenTools = null; // the session's authorized set ends with the session
+    this.frozenSessionId = null;
     this.setState({
       ...IDLE,
       // keep the transcript of the call that just ended for any reader still up
@@ -393,10 +475,9 @@ class VoiceSessionManager implements VoiceSessionProvider {
 
   /**
    * Stream a silent observation into the live session — tell the model without
-   * asking it to speak. The cheap, high-frequency channel (safe once or twice a
-   * second) behind a future props.voice.observe(); today the host uses it to run
-   * the real-device stream proof (VOICE_RT_STREAM_DEVICE_PROOF) before the gated
-   * plugin API is added. Owner-scoped like every other control.
+   * asking it to speak. The cheap channel behind the gated props.voice.observe();
+   * every item stays in the model's context for the call, so a caller sends only
+   * material changes. Owner-scoped like every other control.
    */
   observe(text: string, caller: VoiceCaller = PLATFORM_VOICE_CALLER): void {
     if (this.state.callState !== 'connected') {
@@ -424,6 +505,8 @@ class VoiceSessionManager implements VoiceSessionProvider {
       listening: !!s.userPartial,
       userSpeaking: s.userSpeaking,
       lastUserSpeechEndedAt: s.lastUserSpeechEndedAt,
+      lastDeviceTool: s.lastDeviceTool,
+      authorizedSessionId: this.frozenSessionId,
       lastError: s.error,
     };
   }
@@ -431,7 +514,8 @@ class VoiceSessionManager implements VoiceSessionProvider {
   private foreignSnapshot(): VoiceSnapshot {
     return {
       state: 'idle', sessionId: null, muted: false, speaking: false, listening: false,
-      userSpeaking: false, lastUserSpeechEndedAt: null, lastError: null,
+      userSpeaking: false, lastUserSpeechEndedAt: null, lastDeviceTool: null,
+      authorizedSessionId: null, lastError: null,
     };
   }
 
@@ -451,12 +535,21 @@ class VoiceSessionManager implements VoiceSessionProvider {
 
   // ── WebView plumbing ─────────────────────────────────────────
 
-  private buildUri(skillSlug?: string): string {
+  private buildUri(skillSlug?: string, persona?: VoicePersona, skills?: VoiceStartOptions['skills']): string {
     const token = getToken();
     const tenant = getTenant();
     const actorId = getUser()?.actorId || '';
     const skillParam = skillSlug ? `&skillSlug=${encodeURIComponent(skillSlug)}` : '';
-    return `${getVoiceApiUrl()}/app?mode=mini&embedded=rn&authToken=${encodeURIComponent(token || '')}&tenant=${encodeURIComponent(tenant)}&actorId=${encodeURIComponent(actorId)}${skillParam}`;
+    // Declared start option, carried on the same URL as tenant/authToken; the
+    // voice page forwards it as POST /session `persona`, where it's sanitized.
+    const p = persona && (persona.name || persona.style)
+      ? { ...(persona.name ? { name: persona.name } : {}), ...(persona.style ? { style: persona.style } : {}) }
+      : null;
+    const personaParam = p ? `&persona=${encodeURIComponent(JSON.stringify(p))}` : '';
+    // Clean call: only the one reduce-only value is ever sent; anything else is
+    // not a request at all (the server accepts only 'none' too).
+    const skillsParam = skills === 'none' ? '&skills=none' : '';
+    return `${getVoiceApiUrl()}/app?mode=mini&embedded=rn&authToken=${encodeURIComponent(token || '')}&tenant=${encodeURIComponent(tenant)}&actorId=${encodeURIComponent(actorId)}${skillParam}${personaParam}${skillsParam}`;
   }
 
   /** Handle a postMessage from the WebView. `event` is the RN WebView event. */
@@ -523,6 +616,31 @@ class VoiceSessionManager implements VoiceSessionProvider {
         this.sendDeviceToolList(data.correlationId);
         break;
       }
+      // CORE's ALLOWSET for this session — what the model may ASK for. Core sends
+      // it (even empty, on purpose) at session start. It is a NECESSARY gate, not
+      // the whole story: a call must be in the allowset AND the device must
+      // actually have the tool (the registry check inside callDeviceTool) — Core
+      // says what may be asked, the device decides what it will do.
+      //
+      // Origin-checked (only the voice app may set it) and pinned ONCE per session
+      // (a later message cannot widen it). An EMPTY allowset (arrived) refuses
+      // everything but is distinct from NEVER-arrived (frozenTools stays null);
+      // both fail closed here — we never fall back to the phone's own registry,
+      // which is the seam this closes.
+      case 'deviceToolAllowset': {
+        const sender = originOf(event?.nativeEvent?.url);
+        const expected = originOf(getVoiceApiUrl());
+        if (!sender || !expected || sender !== expected) break;
+        // Bind the allowset to its sessionId. Pin (or REPLACE for a different
+        // session) but never WIDEN within the same session — a second allowset
+        // for the same sessionId is ignored. Requires a string sessionId, so an
+        // allowset without one never authorizes anything (fail closed).
+        if (Array.isArray(data.tools) && typeof data.sessionId === 'string' && data.sessionId !== this.frozenSessionId) {
+          this.frozenTools = new Set(data.tools.filter((n: unknown) => typeof n === 'string'));
+          this.frozenSessionId = data.sessionId;
+        }
+        break;
+      }
       case 'device-tool-call': {
         const sender = originOf(event?.nativeEvent?.url);
         const expected = originOf(getVoiceApiUrl());
@@ -530,15 +648,72 @@ class VoiceSessionManager implements VoiceSessionProvider {
           console.warn(`[voiceSession] REFUSED device tool call from "${sender || 'unknown origin'}" (expected "${expected}")`);
           break;
         }
+        if (data.name) this.setState({ lastDeviceTool: { name: data.name, at: Date.now() } });
+        // AUTHORIZATION against the FROZEN session set, not the live registry
+        // (GPT gate 1). A tool that appeared after connect — the drift case — is
+        // refused here, before execution, even if it is registered right now.
+        if (!this.isToolAuthorized(data.name)) {
+          // Both refuse (fail closed), but they are DIFFERENT answers to the model:
+          // NOT-YET-TOLD (Core's allowset hasn't arrived) is transient — retry;
+          // TOLD-AND-DENIED (allowset present, tool not in it / wrong session /
+          // unregistered) is final. Same refusal, different sentence.
+          const notReady = this.frozenTools === null;
+          console.warn(`[voiceSession] REFUSED "${data.name}" — ${notReady ? 'allowset not received yet' : 'not authorized for this session'}`);
+          this.postDeviceToolRefusal(data.correlationId, data.name, notReady);
+          break;
+        }
         void this.runDeviceTool(data);
         break;
       }
     }
   }
 
-  /** Answer "what device tools do you have?" — the client is the authority. */
+  /**
+   * Final authorization = Core's frozen allowset ∩ the current valid local
+   * registry, bound to the ACTIVE session. All must hold:
+   *  - a Core allowset arrived and is bound to THIS session (frozenSessionId ===
+   *    the active state.sessionId) — a missing or stale/wrong-session allowset
+   *    fails closed;
+   *  - the tool is IN that allowset (Core approved it); AND
+   *  - the tool is STILL registered locally right now (removed-after-approval is
+   *    refused; a lazily-added tool Core never approved is refused) — and, on a
+   *    clean call, registered by the call's owner.
+   * No fallback to the live registry alone, ever.
+   */
+  private isToolAuthorized(name: unknown): boolean {
+    if (typeof name !== 'string') return false;
+    if (this.frozenTools === null || this.frozenSessionId === null) return false;
+    if (this.frozenSessionId !== this.state.sessionId) return false;
+    if (!this.frozenTools.has(name)) return false;
+    return hasDeviceTool(name, this.toolScope ?? undefined); // still registered locally right now
+  }
+
+  /** Tell the mini-app the call was refused — a stated reason, never a silent drop.
+   *  `notReady` distinguishes a transient "allowset not here yet" (retry) from a
+   *  final "not allowed in this session". */
+  private postDeviceToolRefusal(correlationId: string, name: string, notReady: boolean): void {
+    const payload = notReady
+      ? {
+          correlationId, ok: false, reason: 'not_ready',
+          error: 'The voice session is still starting up — its tool allowset has not arrived yet. Try again in a moment.',
+        }
+      : {
+          correlationId, ok: false, reason: 'not_authorized',
+          error: `"${name}" is not available in this voice session.`,
+        };
+    this.webView?.injectJavaScript?.(
+      `window.__adasDeviceToolResult && window.__adasDeviceToolResult(${JSON.stringify(
+        JSON.stringify(payload),
+      )}); true;`,
+    );
+  }
+
+  /** PROPOSE the phone's available tools — this is an offer to Core, not the
+   *  authorization set. Core sanitizes it and returns the accepted set in a
+   *  `deviceToolAllowset` message, which is what actually gates execution. */
   private sendDeviceToolList(correlationId: string): void {
-    const tools = listDeviceTools().map(t => ({
+    const scope = this.toolScope;
+    const tools = listDeviceTools().filter(t => scope === null || t.pluginId === scope).map(t => ({
       name: t.name,
       description: t.description,
       input_schema: t.input_schema,
@@ -619,6 +794,10 @@ class VoiceSessionManager implements VoiceSessionProvider {
     this.rejectPending(new Error('voice: reset'));
     this.state = { ...IDLE };
     this.owner = null;
+    this.toolScope = null;
+    this.pendingStarts.clear();
+    this.frozenTools = null;
+    this.frozenSessionId = null;
     this.listeners.clear();
     this.webView = null;
   }