@ateam-ai-mobile/ui 0.1.7 → 0.1.9

package/dist/index.mjs

@@ -2664,6 +2664,7 @@ import {
   callDeviceTool,
   ensureDeviceToolsLoaded,
   listDeviceTools,
+  hasDeviceTool,
   PLATFORM_VOICE_CALLER
 } from "@ateam-ai-mobile/plugin-runtime";
 var CONNECT_TIMEOUT_MS = 3e4;
@@ -2799,6 +2800,11 @@ var buildObserveScript = (text) => `
   }
 })(${JSON.stringify(text)}); true;
 `;
+var DEVICE_TOOL_ERROR_MAX = 200;
+function clipError(message) {
+  const chars = Array.from(message);
+  return chars.length > DEVICE_TOOL_ERROR_MAX ? chars.slice(0, DEVICE_TOOL_ERROR_MAX - 1).join("") + "\u2026" : message;
+}
 function originOf(url) {
   if (!url) return null;
   const m = /^([a-z][a-z0-9+.-]*:\/\/[^/?#]+)/i.exec(url);
@@ -2814,6 +2820,7 @@ var IDLE = {
   muted: false,
   userSpeaking: false,
   lastUserSpeechEndedAt: null,
+  deviceToolCalls: [],
   mounted: false,
   webViewSource: null,
   skillSlug: void 0
@@ -2835,6 +2842,45 @@ var VoiceSessionManager = class {
      * conversation just because it declared voice.
      */
     this.owner = null;
+    /** EVERY start() still in its pre-mount awaits (tool preload, token refresh).
+     *  The session is not 'connecting' yet, so a stop() arriving now would otherwise
+     *  be an idle no-op — and a start would then mount a call for a screen that has
+     *  already gone. A set, not one slot: two concurrent starts must BOTH be
+     *  cancellable. stop() cancels every pending start of its caller (the platform:
+     *  all of them); another plugin's stop cancels none. */
+    this.pendingStarts = /* @__PURE__ */ new Set();
+    /**
+     * The device-tool names Core ALLOWED for this voice session — Core's sanitized
+     * allowset, delivered to the phone in a `deviceToolAllowset` message.
+     * Authorization gates against THIS (necessary, alongside the registry's can-do).
+     *
+     * WHY (GPT gate 1, corrected): the phone only PROPOSES its available tools
+     * (sendDeviceToolList); CORE is the session authority and decides which are
+     * accepted (session.device_tools). Freezing the phone's own proposal would let
+     * a tool Core REJECTED still run locally. So the authz set is populated from
+     * Core's accepted set, never from listDeviceTools(). Until Core's set arrives
+     * this is null and every call FAILS CLOSED. Pinned once per session; the live
+     * registry (which drifts via lazy loads / host registration / tenant changes)
+     * never feeds it.
+     */
+    this.frozenTools = null;
+    /** The voice `sessionId` the current allowset is BOUND to. Authorization
+     *  requires it to equal the active session's id (state.sessionId), so a stale
+     *  allowset from a previous/other session is refused. */
+    this.frozenSessionId = null;
+    /** A CLEAN call (skills:'none') started by a plugin offers and runs ONLY that
+     *  plugin's own device tools — not other solutions' tools that happen to be
+     *  registered on the same phone. null = every registered tool (a normal call,
+     *  or the platform's). Set by every start(); like `owner`, kept after stop.
+     *  ONE identity: the caller is the TRUSTED manifest pluginId gateVoice stamps,
+     *  and the bundleManager registers a plugin's tools under that same id (never
+     *  the bundle's own short `id`), so exact equality is the whole check. */
+    this.toolScope = null;
+    /** Bumped whenever a session begins or ends. A device-tool call remembers the
+     *  epoch it arrived in, and its outcome is recorded only if that session is
+     *  still the current one — a tool that finishes after hang-up (or after a new
+     *  call started) must not show up as the new session's last call. */
+    this.sessionEpoch = 0;
     this.injectedTrackHook = INJECT_TRACK_HOOK;
   }
   /** The platform (built-in sheet, mic indicator, session host) sees and
@@ -2864,12 +2910,17 @@ var VoiceSessionManager = class {
   async start(opts, caller = PLATFORM_VOICE_CALLER) {
     if (this.state.callState === "connected") {
       if (!this.canAccess(caller)) throw this.foreignError();
-      return this.realSnapshot();
+      return this.realSnapshot(caller);
     }
     if (this.state.callState === "connecting") {
       if (!this.canAccess(caller)) throw this.foreignError();
-      return this.waitForConnect();
+      return this.waitForConnect(caller);
+    }
+    if (opts?.skills === "none" && opts?.skillSlug) {
+      throw new Error("voice: skills:'none' (a clean call) cannot also hand the mic to a skill (skillSlug).");
     }
+    const ticket = { caller, cancelled: false };
+    this.pendingStarts.add(ticket);
     try {
       await ensureDeviceToolsLoaded();
     } catch (e) {
@@ -2879,7 +2930,22 @@ var VoiceSessionManager = class {
       if (tokenNeedsRefresh(getToken2())) await refreshToken();
     } catch {
     }
+    this.pendingStarts.delete(ticket);
+    if (ticket.cancelled) throw new Error("voice: stopped before the session started");
+    const after = this.getInternal().callState;
+    if (after === "connected") {
+      if (!this.canAccess(caller)) throw this.foreignError();
+      return this.realSnapshot(caller);
+    }
+    if (after === "connecting") {
+      if (!this.canAccess(caller)) throw this.foreignError();
+      return this.waitForConnect(caller);
+    }
     this.owner = caller;
+    this.toolScope = opts?.skills === "none" && typeof caller === "string" ? caller : null;
+    this.frozenTools = null;
+    this.frozenSessionId = null;
+    this.sessionEpoch++;
     const skillSlug = opts?.skillSlug;
     this.setState({
       callState: "connecting",
@@ -2888,16 +2954,29 @@ var VoiceSessionManager = class {
       aiPartial: "",
       userPartial: "",
       muted: false,
+      // A session that ended from inside the voice page (not via stop()) left
+      // its calls here; the new session starts with none.
+      deviceToolCalls: [],
       mounted: true,
       skillSlug,
-      webViewSource: { uri: this.buildUri(skillSlug) }
+      persona: opts?.persona,
+      webViewSource: { uri: this.buildUri(skillSlug, opts?.persona, opts?.skills) }
     });
-    return this.waitForConnect();
+    return this.waitForConnect(caller);
   }
   stop(caller = PLATFORM_VOICE_CALLER) {
     if (this.state.callState !== "idle" && !this.canAccess(caller)) throw this.foreignError();
+    for (const t of [...this.pendingStarts]) {
+      if (caller === PLATFORM_VOICE_CALLER || caller === t.caller) {
+        t.cancelled = true;
+        this.pendingStarts.delete(t);
+      }
+    }
     this.webView?.injectJavaScript?.("window.hangUp && window.hangUp(); true;");
     this.rejectPending(new Error("voice: session stopped before it connected"));
+    this.frozenTools = null;
+    this.frozenSessionId = null;
+    this.sessionEpoch++;
     this.setState({
       ...IDLE,
       // keep the transcript of the call that just ended for any reader still up
@@ -2918,10 +2997,9 @@ var VoiceSessionManager = class {
   }
   /**
    * Stream a silent observation into the live session — tell the model without
-   * asking it to speak. The cheap, high-frequency channel (safe once or twice a
-   * second) behind a future props.voice.observe(); today the host uses it to run
-   * the real-device stream proof (VOICE_RT_STREAM_DEVICE_PROOF) before the gated
-   * plugin API is added. Owner-scoped like every other control.
+   * asking it to speak. The cheap channel behind the gated props.voice.observe();
+   * every item stays in the model's context for the call, so a caller sends only
+   * material changes. Owner-scoped like every other control.
    */
   observe(text, caller = PLATFORM_VOICE_CALLER) {
     if (this.state.callState !== "connected") {
@@ -2931,9 +3009,11 @@ var VoiceSessionManager = class {
     this.webView?.injectJavaScript?.(buildObserveScript(text));
   }
   getSnapshot(caller = PLATFORM_VOICE_CALLER) {
-    return this.canAccess(caller) ? this.realSnapshot() : this.foreignSnapshot();
+    return this.canAccess(caller) ? this.realSnapshot(caller) : this.foreignSnapshot();
   }
-  realSnapshot() {
+  /** The snapshot for a caller that may access the session. Everything is the
+   *  session's, except `lastDeviceTool`, which is scoped to the caller's tools. */
+  realSnapshot(caller) {
     const s = this.state;
     return {
       state: s.callState,
@@ -2943,9 +3023,23 @@ var VoiceSessionManager = class {
       listening: !!s.userPartial,
       userSpeaking: s.userSpeaking,
       lastUserSpeechEndedAt: s.lastUserSpeechEndedAt,
+      lastDeviceTool: this.lastDeviceToolFor(caller),
+      authorizedSessionId: this.frozenSessionId,
       lastError: s.error
     };
   }
+  /**
+   * The last finished device-tool call THIS caller may see. The platform (the
+   * user's own surface) sees every call. A plugin sees only calls to tools it
+   * registered — even on a session it owns, the model can call another
+   * solution's tool (a normal call offers every registered tool), and that
+   * tool's name and error are not this plugin's to read.
+   */
+  lastDeviceToolFor(caller) {
+    const calls = this.state.deviceToolCalls;
+    if (caller === PLATFORM_VOICE_CALLER) return calls.length ? calls[calls.length - 1].call : null;
+    return calls.find((r) => r.owner === caller)?.call ?? null;
+  }
   foreignSnapshot() {
     return {
       state: "idle",
@@ -2955,6 +3049,8 @@ var VoiceSessionManager = class {
       listening: false,
       userSpeaking: false,
       lastUserSpeechEndedAt: null,
+      lastDeviceTool: null,
+      authorizedSessionId: null,
       lastError: null
     };
   }
@@ -2971,12 +3067,15 @@ var VoiceSessionManager = class {
     return this.canAccess(caller) ? this.state.transcript.slice() : [];
   }
   // ── WebView plumbing ─────────────────────────────────────────
-  buildUri(skillSlug) {
+  buildUri(skillSlug, persona, skills) {
     const token = getToken2();
     const tenant = getTenant5();
     const actorId = getUser2()?.actorId || "";
     const skillParam = skillSlug ? `&skillSlug=${encodeURIComponent(skillSlug)}` : "";
-    return `${getVoiceApiUrl2()}/app?mode=mini&embedded=rn&authToken=${encodeURIComponent(token || "")}&tenant=${encodeURIComponent(tenant)}&actorId=${encodeURIComponent(actorId)}${skillParam}`;
+    const p = persona && (persona.name || persona.style) ? { ...persona.name ? { name: persona.name } : {}, ...persona.style ? { style: persona.style } : {} } : null;
+    const personaParam = p ? `&persona=${encodeURIComponent(JSON.stringify(p))}` : "";
+    const skillsParam = skills === "none" ? "&skills=none" : "";
+    return `${getVoiceApiUrl2()}/app?mode=mini&embedded=rn&authToken=${encodeURIComponent(token || "")}&tenant=${encodeURIComponent(tenant)}&actorId=${encodeURIComponent(actorId)}${skillParam}${personaParam}${skillsParam}`;
   }
   /** Handle a postMessage from the WebView. `event` is the RN WebView event. */
   handleMessage(event) {
@@ -3040,6 +3139,27 @@ var VoiceSessionManager = class {
         this.sendDeviceToolList(data.correlationId);
         break;
       }
+      // CORE's ALLOWSET for this session — what the model may ASK for. Core sends
+      // it (even empty, on purpose) at session start. It is a NECESSARY gate, not
+      // the whole story: a call must be in the allowset AND the device must
+      // actually have the tool (the registry check inside callDeviceTool) — Core
+      // says what may be asked, the device decides what it will do.
+      //
+      // Origin-checked (only the voice app may set it) and pinned ONCE per session
+      // (a later message cannot widen it). An EMPTY allowset (arrived) refuses
+      // everything but is distinct from NEVER-arrived (frozenTools stays null);
+      // both fail closed here — we never fall back to the phone's own registry,
+      // which is the seam this closes.
+      case "deviceToolAllowset": {
+        const sender = originOf(event?.nativeEvent?.url);
+        const expected = originOf(getVoiceApiUrl2());
+        if (!sender || !expected || sender !== expected) break;
+        if (Array.isArray(data.tools) && typeof data.sessionId === "string" && data.sessionId !== this.frozenSessionId) {
+          this.frozenTools = new Set(data.tools.filter((n) => typeof n === "string"));
+          this.frozenSessionId = data.sessionId;
+        }
+        break;
+      }
       case "device-tool-call": {
         const sender = originOf(event?.nativeEvent?.url);
         const expected = originOf(getVoiceApiUrl2());
@@ -3047,40 +3167,100 @@ var VoiceSessionManager = class {
           console.warn(`[voiceSession] REFUSED device tool call from "${sender || "unknown origin"}" (expected "${expected}")`);
           break;
         }
-        void this.runDeviceTool(data);
+        void this.handleDeviceToolCall(data);
         break;
       }
     }
   }
-  /** Answer "what device tools do you have?" — the client is the authority. */
+  /**
+   * One device-tool call, arrival to outcome: validate → authorize → run. The
+   * answer goes back to the mini-app (the model reads it) AND becomes
+   * `lastDeviceTool` — the same object, recorded only once it is known, so a
+   * refused call never looks like one that ran.
+   */
+  async handleDeviceToolCall(data) {
+    const { correlationId, name, args, timeoutMs } = data || {};
+    const at = Date.now();
+    const epoch = this.sessionEpoch;
+    const toolName = typeof name === "string" ? name : "";
+    const sessionOwner = this.owner;
+    const owner = typeof sessionOwner === "string" && toolName && hasDeviceTool(toolName, sessionOwner) ? sessionOwner : null;
+    let answer;
+    if (!toolName) {
+      answer = { ok: false, reason: "invalid", error: "The device tool call named no tool." };
+    } else if (!correlationId) {
+      answer = {
+        ok: false,
+        reason: "invalid",
+        error: `The call to "${toolName}" carried no correlationId, so it could not be answered.`
+      };
+    } else if (!this.isToolAuthorized(toolName)) {
+      const notReady = this.frozenTools === null;
+      console.warn(`[voiceSession] REFUSED "${toolName}" \u2014 ${notReady ? "allowset not received yet" : "not authorized for this session"}`);
+      answer = notReady ? {
+        ok: false,
+        reason: "not_ready",
+        error: "The voice session is still starting up \u2014 its tool allowset has not arrived yet. Try again in a moment."
+      } : { ok: false, reason: "not_authorized", error: `"${toolName}" is not available in this voice session.` };
+    } else {
+      answer = await this.runDeviceTool(toolName, args, timeoutMs);
+    }
+    if (correlationId) this.postDeviceToolResult({ correlationId, ...answer });
+    if (epoch !== this.sessionEpoch) return;
+    const ms = Math.max(0, Date.now() - at);
+    const call = answer.ok ? { name: toolName, at, ms, ok: true, reason: null, error: null } : { name: toolName, at, ms, ok: false, reason: answer.reason, error: clipError(answer.error) };
+    this.setState({
+      deviceToolCalls: [...this.state.deviceToolCalls.filter((r) => r.owner !== owner), { owner, call }]
+    });
+  }
+  /**
+   * Final authorization = Core's frozen allowset ∩ the current valid local
+   * registry, bound to the ACTIVE session. All must hold:
+   *  - a Core allowset arrived and is bound to THIS session (frozenSessionId ===
+   *    the active state.sessionId) — a missing or stale/wrong-session allowset
+   *    fails closed;
+   *  - the tool is IN that allowset (Core approved it); AND
+   *  - the tool is STILL registered locally right now (removed-after-approval is
+   *    refused; a lazily-added tool Core never approved is refused) — and, on a
+   *    clean call, registered by the call's owner.
+   * No fallback to the live registry alone, ever.
+   */
+  isToolAuthorized(name) {
+    if (typeof name !== "string") return false;
+    if (this.frozenTools === null || this.frozenSessionId === null) return false;
+    if (this.frozenSessionId !== this.state.sessionId) return false;
+    if (!this.frozenTools.has(name)) return false;
+    return hasDeviceTool(name, this.toolScope ?? void 0);
+  }
+  /** Answer the mini-app's pending device-tool request (a call's outcome, or the
+   *  tool list) — it resolves the request with this payload by correlationId. */
+  postDeviceToolResult(payload) {
+    this.webView?.injectJavaScript?.(
+      `window.__adasDeviceToolResult && window.__adasDeviceToolResult(${JSON.stringify(
+        JSON.stringify(payload)
+      )}); true;`
+    );
+  }
+  /** PROPOSE the phone's available tools — this is an offer to Core, not the
+   *  authorization set. Core sanitizes it and returns the accepted set in a
+   *  `deviceToolAllowset` message, which is what actually gates execution. */
   sendDeviceToolList(correlationId) {
-    const tools = listDeviceTools().map((t) => ({
+    const scope = this.toolScope;
+    const tools = listDeviceTools().filter((t) => scope === null || t.pluginId === scope).map((t) => ({
       name: t.name,
       description: t.description,
       input_schema: t.input_schema
     }));
-    this.webView?.injectJavaScript?.(
-      `window.__adasDeviceToolResult && window.__adasDeviceToolResult(${JSON.stringify(
-        JSON.stringify({ correlationId, ok: true, tools })
-      )}); true;`
-    );
+    this.postDeviceToolResult({ correlationId, ok: true, tools });
   }
-  /** Run a device tool and post the outcome back into the WebView. */
-  async runDeviceTool(data) {
-    const { correlationId, name, args, timeoutMs } = data || {};
-    if (!correlationId || typeof name !== "string") return;
-    let payload;
+  /** Run an authorized device tool. Never throws: every failure is an answer. */
+  async runDeviceTool(name, args, timeoutMs) {
     try {
       const outcome = await callDeviceTool(name, args || {}, { timeoutMs });
-      payload = outcome.ok ? { correlationId, ok: true, result: outcome.result } : { correlationId, ok: false, error: outcome.error, reason: outcome.reason };
+      return outcome.ok ? { ok: true, result: outcome.result } : { ok: false, reason: outcome.reason, error: outcome.error };
     } catch (err) {
-      payload = { correlationId, ok: false, reason: "failed", error: err?.message || String(err) };
+      return { ok: false, reason: "failed", error: err?.message || String(err) };
     }
-    this.webView?.injectJavaScript?.(
-      `window.__adasDeviceToolResult && window.__adasDeviceToolResult(${JSON.stringify(
-        JSON.stringify(payload)
-      )}); true;`
-    );
   }
   // ── internals ────────────────────────────────────────────────
   setState(partial) {
@@ -3100,22 +3280,21 @@ var VoiceSessionManager = class {
       }
     }
   }
-  waitForConnect() {
+  waitForConnect(caller) {
     return new Promise((resolve, reject) => {
       const timer = setTimeout(() => {
         this.pending = this.pending.filter((p) => p.timer !== timer);
         reject(new Error("voice: timed out waiting to connect (is VoiceSessionHost mounted?)"));
       }, CONNECT_TIMEOUT_MS);
-      this.pending.push({ resolve, reject, timer });
+      this.pending.push({ caller, resolve, reject, timer });
     });
   }
   resolvePending() {
-    const snap = this.realSnapshot();
     const waiting = this.pending;
     this.pending = [];
     for (const p of waiting) {
       clearTimeout(p.timer);
-      p.resolve(snap);
+      p.resolve(this.realSnapshot(p.caller));
     }
   }
   rejectPending(err) {
@@ -3132,6 +3311,11 @@ var VoiceSessionManager = class {
     this.rejectPending(new Error("voice: reset"));
     this.state = { ...IDLE };
     this.owner = null;
+    this.toolScope = null;
+    this.pendingStarts.clear();
+    this.frozenTools = null;
+    this.frozenSessionId = null;
+    this.sessionEpoch++;
     this.listeners.clear();
     this.webView = null;
   }