@ateam-ai-mobile/ui 0.1.7 → 0.1.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ateam-ai-mobile/ui",
-  "version": "0.1.7",
+  "version": "0.1.9",
   "description": "Prebuilt ADAS chat experience for React Native — full-screen chat, chips, widget views. Built on @ateam-ai-mobile/core + @ateam-ai-mobile/plugin-runtime.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -9,8 +9,8 @@
     "build": "tsup"
   },
   "dependencies": {
-    "@ateam-ai-mobile/core": "0.1.7",
-    "@ateam-ai-mobile/plugin-runtime": "0.1.7",
+    "@ateam-ai-mobile/core": "0.1.9",
+    "@ateam-ai-mobile/plugin-runtime": "0.1.9",
     "zustand": "^5.0.0"
   },
   "peerDependencies": {

package/src/plugin/Plugin.tsx

@@ -86,9 +86,10 @@ export default function Plugin({ id, manifest, commandBufferRef, props: enginePr
   const bridge = useNativeBridge(id, connectorId, commandBufferRef);
   // ONE runtime contract — the SAME resolver every surface uses, so this drawer/
   // fullscreen mount gates device/native + deviceState identically to the
-  // embedded mount and the tools path. Memoized so the plugin Component doesn't
-  // re-render on a fresh object every pass (useApi effects key off prop identity);
-  // `plugin` is in deps so state-domain fallback picks up the bundle once loaded.
+  // embedded mount. Memoized so the plugin Component doesn't re-render on a fresh
+  // object every pass (useApi effects key off prop identity). The manifest is the
+  // sole authority here (it is a required prop); `plugin` is read by the resolver
+  // only when there is no manifest, so the loaded bundle never widens its grants.
   const { device, native, deviceState, voice } = useMemo(
     () => resolvePluginRuntimeProps({ pluginId: id, manifest: manifest as any, plugin: plugin as any }),
     [id, manifest, plugin],

package/src/voice/voiceSession.ts

@@ -28,6 +28,7 @@ import {
   callDeviceTool,
   ensureDeviceToolsLoaded,
   listDeviceTools,
+  hasDeviceTool,
   PLATFORM_VOICE_CALLER,
   type VoiceSessionProvider,
   type VoiceCaller,
@@ -35,8 +36,11 @@ import {
   type VoiceState,
   type VoiceTranscriptEntry,
   type VoiceStartOptions,
+  type VoicePersona,
   type VoiceEvent,
   type VoiceSubscription,
+  type VoiceDeviceToolCall,
+  type VoiceDeviceToolReason,
 } from '@ateam-ai-mobile/plugin-runtime';
 
 // Re-export the transcript/state shapes under their historical names so existing
@@ -218,6 +222,33 @@ const buildObserveScript = (text: string) => `
 })(${JSON.stringify(text)}); true;
 `;
 
+/** How much of a device-tool error the snapshot keeps. The model still gets the
+ *  whole message; the snapshot is a diagnostic any reader of it can see, and a
+ *  tool's error can echo the call's arguments (what the user said). */
+const DEVICE_TOOL_ERROR_MAX = 200;
+
+function clipError(message: string): string {
+  const chars = Array.from(message); // by code point, so an emoji is never split
+  return chars.length > DEVICE_TOOL_ERROR_MAX
+    ? chars.slice(0, DEVICE_TOOL_ERROR_MAX - 1).join('') + '…'
+    : message;
+}
+
+/** A device-tool call's answer — what the mini-app gets back (plus its
+ *  correlationId) and what `lastDeviceTool` is built from. ONE object for both,
+ *  so the model's answer and the snapshot can never disagree. */
+type DeviceToolAnswer =
+  | { ok: true; result: any }
+  | { ok: false; reason: VoiceDeviceToolReason; error: string };
+
+/** A finished call, tagged with the session owner's pluginId when the tool is
+ *  that plugin's own; null when it is not (another solution's tool, the
+ *  platform's, an unregistered name, no name) — then only the platform sees it. */
+interface DeviceToolRecord {
+  owner: string | null;
+  call: VoiceDeviceToolCall;
+}
+
 /** Origin of a URL, or null if it can't be parsed. */
 function originOf(url?: string | null): string | null {
   if (!url) return null;
@@ -237,12 +268,20 @@ interface InternalState {
   userSpeaking: boolean;
   /** Epoch ms of the last speaking:false, or null before the first utterance. */
   lastUserSpeechEndedAt: number | null;
+  /** This session's finished device-tool calls: the LATEST per owner tag (see
+   *  DeviceToolRecord), in the order they finished. The platform reads the last
+   *  one; the owning plugin reads its own (lastDeviceToolFor) — one store, both
+   *  views derived from it. */
+  deviceToolCalls: DeviceToolRecord[];
   /** The WebView should be mounted (a session is wanted / live). */
   mounted: boolean;
   /** The WebView source, computed ONCE at start() so state changes (transcript,
    *  partials) never remount the WebView and drop the session. */
   webViewSource: { uri: string } | null;
   skillSlug?: string;
+  /** Per-call persona override ({ name, style }) — sent to the voice page on the
+   *  session URL and declared on POST /session; the server layers it. */
+  persona?: VoicePersona;
 }
 
 const IDLE: InternalState = {
@@ -255,12 +294,13 @@ const IDLE: InternalState = {
   muted: false,
   userSpeaking: false,
   lastUserSpeechEndedAt: null,
+  deviceToolCalls: [],
   mounted: false,
   webViewSource: null,
   skillSlug: undefined,
 };
 
-type Pending = { resolve: (s: VoiceSnapshot) => void; reject: (e: Error) => void; timer: any };
+type Pending = { caller: VoiceCaller; resolve: (s: VoiceSnapshot) => void; reject: (e: Error) => void; timer: any };
 
 class VoiceSessionManager implements VoiceSessionProvider {
   private state: InternalState = { ...IDLE };
@@ -279,6 +319,50 @@ class VoiceSessionManager implements VoiceSessionProvider {
    */
   private owner: VoiceCaller | null = null;
 
+  /** EVERY start() still in its pre-mount awaits (tool preload, token refresh).
+   *  The session is not 'connecting' yet, so a stop() arriving now would otherwise
+   *  be an idle no-op — and a start would then mount a call for a screen that has
+   *  already gone. A set, not one slot: two concurrent starts must BOTH be
+   *  cancellable. stop() cancels every pending start of its caller (the platform:
+   *  all of them); another plugin's stop cancels none. */
+  private pendingStarts = new Set<{ caller: VoiceCaller; cancelled: boolean }>();
+
+  /**
+   * The device-tool names Core ALLOWED for this voice session — Core's sanitized
+   * allowset, delivered to the phone in a `deviceToolAllowset` message.
+   * Authorization gates against THIS (necessary, alongside the registry's can-do).
+   *
+   * WHY (GPT gate 1, corrected): the phone only PROPOSES its available tools
+   * (sendDeviceToolList); CORE is the session authority and decides which are
+   * accepted (session.device_tools). Freezing the phone's own proposal would let
+   * a tool Core REJECTED still run locally. So the authz set is populated from
+   * Core's accepted set, never from listDeviceTools(). Until Core's set arrives
+   * this is null and every call FAILS CLOSED. Pinned once per session; the live
+   * registry (which drifts via lazy loads / host registration / tenant changes)
+   * never feeds it.
+   */
+  private frozenTools: Set<string> | null = null;
+
+  /** The voice `sessionId` the current allowset is BOUND to. Authorization
+   *  requires it to equal the active session's id (state.sessionId), so a stale
+   *  allowset from a previous/other session is refused. */
+  private frozenSessionId: string | null = null;
+
+  /** A CLEAN call (skills:'none') started by a plugin offers and runs ONLY that
+   *  plugin's own device tools — not other solutions' tools that happen to be
+   *  registered on the same phone. null = every registered tool (a normal call,
+   *  or the platform's). Set by every start(); like `owner`, kept after stop.
+   *  ONE identity: the caller is the TRUSTED manifest pluginId gateVoice stamps,
+   *  and the bundleManager registers a plugin's tools under that same id (never
+   *  the bundle's own short `id`), so exact equality is the whole check. */
+  private toolScope: string | null = null;
+
+  /** Bumped whenever a session begins or ends. A device-tool call remembers the
+   *  epoch it arrived in, and its outcome is recorded only if that session is
+   *  still the current one — a tool that finishes after hang-up (or after a new
+   *  call started) must not show up as the new session's last call. */
+  private sessionEpoch = 0;
+
   /** The platform (built-in sheet, mic indicator, session host) sees and
    *  controls any session — it is the user's own surface. A plugin caller may
    *  only touch a session it owns. */
@@ -319,12 +403,18 @@ class VoiceSessionManager implements VoiceSessionProvider {
     // different skillSlug does NOT restart it.
     if (this.state.callState === 'connected') {
       if (!this.canAccess(caller)) throw this.foreignError();
-      return this.realSnapshot();
+      return this.realSnapshot(caller);
     }
     if (this.state.callState === 'connecting') {
       if (!this.canAccess(caller)) throw this.foreignError();
-      return this.waitForConnect();
+      return this.waitForConnect(caller);
+    }
+
+    if (opts?.skills === 'none' && opts?.skillSlug) {
+      throw new Error("voice: skills:'none' (a clean call) cannot also hand the mic to a skill (skillSlug).");
     }
+    const ticket = { caller, cancelled: false };
+    this.pendingStarts.add(ticket);
 
     // Device tools only exist once their bundle is evaluated; a user who goes
     // straight to voice can otherwise ask for a tool the phone never loaded.
@@ -344,8 +434,28 @@ class VoiceSessionManager implements VoiceSessionProvider {
       // error rather than us blocking the call.
     }
 
-    // Idle → this caller becomes the owner of the new session.
+    this.pendingStarts.delete(ticket);
+    if (ticket.cancelled) throw new Error('voice: stopped before the session started');
+    // Another start() may have mounted a session while we awaited — attach to it
+    // (or be refused) exactly as the entry checks would have, never mount twice.
+    // (Re-read: the awaits above can change it; the entry checks' narrowing can't.)
+    const after = this.getInternal().callState;
+    if (after === 'connected') {
+      if (!this.canAccess(caller)) throw this.foreignError();
+      return this.realSnapshot(caller);
+    }
+    if (after === 'connecting') {
+      if (!this.canAccess(caller)) throw this.foreignError();
+      return this.waitForConnect(caller);
+    }
+
+    // Idle → this caller becomes the owner of the new session. A NEW session
+    // re-freezes its tool set on the next tool-list request.
     this.owner = caller;
+    this.toolScope = opts?.skills === 'none' && typeof caller === 'string' ? caller : null;
+    this.frozenTools = null;
+    this.frozenSessionId = null;
+    this.sessionEpoch++;
     const skillSlug = opts?.skillSlug;
     this.setState({
       callState: 'connecting',
@@ -354,19 +464,34 @@ class VoiceSessionManager implements VoiceSessionProvider {
       aiPartial: '',
       userPartial: '',
       muted: false,
+      // A session that ended from inside the voice page (not via stop()) left
+      // its calls here; the new session starts with none.
+      deviceToolCalls: [],
       mounted: true,
       skillSlug,
-      webViewSource: { uri: this.buildUri(skillSlug) },
+      persona: opts?.persona,
+      webViewSource: { uri: this.buildUri(skillSlug, opts?.persona, opts?.skills) },
     });
-    return this.waitForConnect();
+    return this.waitForConnect(caller);
   }
 
   stop(caller: VoiceCaller = PLATFORM_VOICE_CALLER): void {
     // A plugin may not hang up another solution's live call. (Idle stop is a
     // harmless no-op for anyone.)
     if (this.state.callState !== 'idle' && !this.canAccess(caller)) throw this.foreignError();
+    // Starts still before their mount: cancel ALL of this caller's (the platform:
+    // everyone's) — another plugin must not be able to abort someone's call.
+    for (const t of [...this.pendingStarts]) {
+      if (caller === PLATFORM_VOICE_CALLER || caller === t.caller) {
+        t.cancelled = true;
+        this.pendingStarts.delete(t);
+      }
+    }
     this.webView?.injectJavaScript?.('window.hangUp && window.hangUp(); true;');
     this.rejectPending(new Error('voice: session stopped before it connected'));
+    this.frozenTools = null; // the session's authorized set ends with the session
+    this.frozenSessionId = null;
+    this.sessionEpoch++; // a tool still running for this session records nothing
     this.setState({
       ...IDLE,
       // keep the transcript of the call that just ended for any reader still up
@@ -393,10 +518,9 @@ class VoiceSessionManager implements VoiceSessionProvider {
 
   /**
    * Stream a silent observation into the live session — tell the model without
-   * asking it to speak. The cheap, high-frequency channel (safe once or twice a
-   * second) behind a future props.voice.observe(); today the host uses it to run
-   * the real-device stream proof (VOICE_RT_STREAM_DEVICE_PROOF) before the gated
-   * plugin API is added. Owner-scoped like every other control.
+   * asking it to speak. The cheap channel behind the gated props.voice.observe();
+   * every item stays in the model's context for the call, so a caller sends only
+   * material changes. Owner-scoped like every other control.
    */
   observe(text: string, caller: VoiceCaller = PLATFORM_VOICE_CALLER): void {
     if (this.state.callState !== 'connected') {
@@ -411,10 +535,12 @@ class VoiceSessionManager implements VoiceSessionProvider {
     // nothing about the conversation another solution is holding. This is not a
     // fake idle (invariant 6 is about an UNDECLARED plugin): a declared plugin
     // that does not own the live session genuinely has none of its own.
-    return this.canAccess(caller) ? this.realSnapshot() : this.foreignSnapshot();
+    return this.canAccess(caller) ? this.realSnapshot(caller) : this.foreignSnapshot();
   }
 
-  private realSnapshot(): VoiceSnapshot {
+  /** The snapshot for a caller that may access the session. Everything is the
+   *  session's, except `lastDeviceTool`, which is scoped to the caller's tools. */
+  private realSnapshot(caller: VoiceCaller): VoiceSnapshot {
     const s = this.state;
     return {
       state: s.callState,
@@ -424,14 +550,30 @@ class VoiceSessionManager implements VoiceSessionProvider {
       listening: !!s.userPartial,
       userSpeaking: s.userSpeaking,
       lastUserSpeechEndedAt: s.lastUserSpeechEndedAt,
+      lastDeviceTool: this.lastDeviceToolFor(caller),
+      authorizedSessionId: this.frozenSessionId,
       lastError: s.error,
     };
   }
 
+  /**
+   * The last finished device-tool call THIS caller may see. The platform (the
+   * user's own surface) sees every call. A plugin sees only calls to tools it
+   * registered — even on a session it owns, the model can call another
+   * solution's tool (a normal call offers every registered tool), and that
+   * tool's name and error are not this plugin's to read.
+   */
+  private lastDeviceToolFor(caller: VoiceCaller): VoiceDeviceToolCall | null {
+    const calls = this.state.deviceToolCalls;
+    if (caller === PLATFORM_VOICE_CALLER) return calls.length ? calls[calls.length - 1].call : null;
+    return calls.find(r => r.owner === caller)?.call ?? null;
+  }
+
   private foreignSnapshot(): VoiceSnapshot {
     return {
       state: 'idle', sessionId: null, muted: false, speaking: false, listening: false,
-      userSpeaking: false, lastUserSpeechEndedAt: null, lastError: null,
+      userSpeaking: false, lastUserSpeechEndedAt: null, lastDeviceTool: null,
+      authorizedSessionId: null, lastError: null,
     };
   }
 
@@ -451,12 +593,21 @@ class VoiceSessionManager implements VoiceSessionProvider {
 
   // ── WebView plumbing ─────────────────────────────────────────
 
-  private buildUri(skillSlug?: string): string {
+  private buildUri(skillSlug?: string, persona?: VoicePersona, skills?: VoiceStartOptions['skills']): string {
     const token = getToken();
     const tenant = getTenant();
     const actorId = getUser()?.actorId || '';
     const skillParam = skillSlug ? `&skillSlug=${encodeURIComponent(skillSlug)}` : '';
-    return `${getVoiceApiUrl()}/app?mode=mini&embedded=rn&authToken=${encodeURIComponent(token || '')}&tenant=${encodeURIComponent(tenant)}&actorId=${encodeURIComponent(actorId)}${skillParam}`;
+    // Declared start option, carried on the same URL as tenant/authToken; the
+    // voice page forwards it as POST /session `persona`, where it's sanitized.
+    const p = persona && (persona.name || persona.style)
+      ? { ...(persona.name ? { name: persona.name } : {}), ...(persona.style ? { style: persona.style } : {}) }
+      : null;
+    const personaParam = p ? `&persona=${encodeURIComponent(JSON.stringify(p))}` : '';
+    // Clean call: only the one reduce-only value is ever sent; anything else is
+    // not a request at all (the server accepts only 'none' too).
+    const skillsParam = skills === 'none' ? '&skills=none' : '';
+    return `${getVoiceApiUrl()}/app?mode=mini&embedded=rn&authToken=${encodeURIComponent(token || '')}&tenant=${encodeURIComponent(tenant)}&actorId=${encodeURIComponent(actorId)}${skillParam}${personaParam}${skillsParam}`;
   }
 
   /** Handle a postMessage from the WebView. `event` is the RN WebView event. */
@@ -523,6 +674,31 @@ class VoiceSessionManager implements VoiceSessionProvider {
         this.sendDeviceToolList(data.correlationId);
         break;
       }
+      // CORE's ALLOWSET for this session — what the model may ASK for. Core sends
+      // it (even empty, on purpose) at session start. It is a NECESSARY gate, not
+      // the whole story: a call must be in the allowset AND the device must
+      // actually have the tool (the registry check inside callDeviceTool) — Core
+      // says what may be asked, the device decides what it will do.
+      //
+      // Origin-checked (only the voice app may set it) and pinned ONCE per session
+      // (a later message cannot widen it). An EMPTY allowset (arrived) refuses
+      // everything but is distinct from NEVER-arrived (frozenTools stays null);
+      // both fail closed here — we never fall back to the phone's own registry,
+      // which is the seam this closes.
+      case 'deviceToolAllowset': {
+        const sender = originOf(event?.nativeEvent?.url);
+        const expected = originOf(getVoiceApiUrl());
+        if (!sender || !expected || sender !== expected) break;
+        // Bind the allowset to its sessionId. Pin (or REPLACE for a different
+        // session) but never WIDEN within the same session — a second allowset
+        // for the same sessionId is ignored. Requires a string sessionId, so an
+        // allowset without one never authorizes anything (fail closed).
+        if (Array.isArray(data.tools) && typeof data.sessionId === 'string' && data.sessionId !== this.frozenSessionId) {
+          this.frozenTools = new Set(data.tools.filter((n: unknown) => typeof n === 'string'));
+          this.frozenSessionId = data.sessionId;
+        }
+        break;
+      }
       case 'device-tool-call': {
         const sender = originOf(event?.nativeEvent?.url);
         const expected = originOf(getVoiceApiUrl());
@@ -530,44 +706,128 @@ class VoiceSessionManager implements VoiceSessionProvider {
           console.warn(`[voiceSession] REFUSED device tool call from "${sender || 'unknown origin'}" (expected "${expected}")`);
           break;
         }
-        void this.runDeviceTool(data);
+        void this.handleDeviceToolCall(data);
         break;
       }
     }
   }
 
-  /** Answer "what device tools do you have?" — the client is the authority. */
+  /**
+   * One device-tool call, arrival to outcome: validate → authorize → run. The
+   * answer goes back to the mini-app (the model reads it) AND becomes
+   * `lastDeviceTool` — the same object, recorded only once it is known, so a
+   * refused call never looks like one that ran.
+   */
+  private async handleDeviceToolCall(data: any): Promise<void> {
+    const { correlationId, name, args, timeoutMs } = data || {};
+    const at = Date.now();
+    const epoch = this.sessionEpoch;
+    const toolName = typeof name === 'string' ? name : '';
+    // Which plugin may later read this call. The only plugin that can read this
+    // session's snapshot at all is its owner (any other gets the foreign one), so
+    // the call is tagged with the owner only if the tool is registered BY it, as
+    // of arrival — the same check a clean call's scope uses. Anything else
+    // (another solution's tool, the platform's, an unregistered name) is null:
+    // the platform's to see, no plugin's.
+    const sessionOwner = this.owner;
+    const owner = typeof sessionOwner === 'string' && toolName && hasDeviceTool(toolName, sessionOwner)
+      ? sessionOwner
+      : null;
+
+    let answer: DeviceToolAnswer;
+    if (!toolName) {
+      answer = { ok: false, reason: 'invalid', error: 'The device tool call named no tool.' };
+    } else if (!correlationId) {
+      answer = {
+        ok: false, reason: 'invalid',
+        error: `The call to "${toolName}" carried no correlationId, so it could not be answered.`,
+      };
+    } else if (!this.isToolAuthorized(toolName)) {
+      // AUTHORIZATION against the FROZEN session set, not the live registry
+      // (GPT gate 1). A tool that appeared after connect — the drift case — is
+      // refused here, before execution, even if it is registered right now.
+      // Both refusals fail closed, but they are DIFFERENT answers to the model:
+      // NOT-YET-TOLD (Core's allowset hasn't arrived) is transient — retry;
+      // TOLD-AND-DENIED (allowset present, tool not in it / wrong session /
+      // unregistered) is final. Same refusal, different sentence.
+      const notReady = this.frozenTools === null;
+      console.warn(`[voiceSession] REFUSED "${toolName}" — ${notReady ? 'allowset not received yet' : 'not authorized for this session'}`);
+      answer = notReady
+        ? {
+            ok: false, reason: 'not_ready',
+            error: 'The voice session is still starting up — its tool allowset has not arrived yet. Try again in a moment.',
+          }
+        : { ok: false, reason: 'not_authorized', error: `"${toolName}" is not available in this voice session.` };
+    } else {
+      answer = await this.runDeviceTool(toolName, args, timeoutMs);
+    }
+
+    // A call without a correlationId cannot be answered — nothing is waiting on it.
+    if (correlationId) this.postDeviceToolResult({ correlationId, ...answer });
+
+    if (epoch !== this.sessionEpoch) return; // its session ended while it ran
+    const ms = Math.max(0, Date.now() - at);
+    const call: VoiceDeviceToolCall = answer.ok
+      ? { name: toolName, at, ms, ok: true, reason: null, error: null }
+      : { name: toolName, at, ms, ok: false, reason: answer.reason, error: clipError(answer.error) };
+    this.setState({
+      deviceToolCalls: [...this.state.deviceToolCalls.filter(r => r.owner !== owner), { owner, call }],
+    });
+  }
+
+  /**
+   * Final authorization = Core's frozen allowset ∩ the current valid local
+   * registry, bound to the ACTIVE session. All must hold:
+   *  - a Core allowset arrived and is bound to THIS session (frozenSessionId ===
+   *    the active state.sessionId) — a missing or stale/wrong-session allowset
+   *    fails closed;
+   *  - the tool is IN that allowset (Core approved it); AND
+   *  - the tool is STILL registered locally right now (removed-after-approval is
+   *    refused; a lazily-added tool Core never approved is refused) — and, on a
+   *    clean call, registered by the call's owner.
+   * No fallback to the live registry alone, ever.
+   */
+  private isToolAuthorized(name: unknown): boolean {
+    if (typeof name !== 'string') return false;
+    if (this.frozenTools === null || this.frozenSessionId === null) return false;
+    if (this.frozenSessionId !== this.state.sessionId) return false;
+    if (!this.frozenTools.has(name)) return false;
+    return hasDeviceTool(name, this.toolScope ?? undefined); // still registered locally right now
+  }
+
+  /** Answer the mini-app's pending device-tool request (a call's outcome, or the
+   *  tool list) — it resolves the request with this payload by correlationId. */
+  private postDeviceToolResult(payload: { correlationId: string } & Record<string, unknown>): void {
+    this.webView?.injectJavaScript?.(
+      `window.__adasDeviceToolResult && window.__adasDeviceToolResult(${JSON.stringify(
+        JSON.stringify(payload),
+      )}); true;`,
+    );
+  }
+
+  /** PROPOSE the phone's available tools — this is an offer to Core, not the
+   *  authorization set. Core sanitizes it and returns the accepted set in a
+   *  `deviceToolAllowset` message, which is what actually gates execution. */
   private sendDeviceToolList(correlationId: string): void {
-    const tools = listDeviceTools().map(t => ({
+    const scope = this.toolScope;
+    const tools = listDeviceTools().filter(t => scope === null || t.pluginId === scope).map(t => ({
       name: t.name,
       description: t.description,
       input_schema: t.input_schema,
     }));
-    this.webView?.injectJavaScript?.(
-      `window.__adasDeviceToolResult && window.__adasDeviceToolResult(${JSON.stringify(
-        JSON.stringify({ correlationId, ok: true, tools }),
-      )}); true;`,
-    );
+    this.postDeviceToolResult({ correlationId, ok: true, tools });
   }
 
-  /** Run a device tool and post the outcome back into the WebView. */
-  private async runDeviceTool(data: any): Promise<void> {
-    const { correlationId, name, args, timeoutMs } = data || {};
-    if (!correlationId || typeof name !== 'string') return;
-    let payload: any;
+  /** Run an authorized device tool. Never throws: every failure is an answer. */
+  private async runDeviceTool(name: string, args: any, timeoutMs: number | undefined): Promise<DeviceToolAnswer> {
     try {
       const outcome = await callDeviceTool(name, args || {}, { timeoutMs });
-      payload = outcome.ok
-        ? { correlationId, ok: true, result: outcome.result }
-        : { correlationId, ok: false, error: outcome.error, reason: outcome.reason };
+      return outcome.ok
+        ? { ok: true, result: outcome.result }
+        : { ok: false, reason: outcome.reason, error: outcome.error };
     } catch (err: any) {
-      payload = { correlationId, ok: false, reason: 'failed', error: err?.message || String(err) };
+      return { ok: false, reason: 'failed', error: err?.message || String(err) };
     }
-    this.webView?.injectJavaScript?.(
-      `window.__adasDeviceToolResult && window.__adasDeviceToolResult(${JSON.stringify(
-        JSON.stringify(payload),
-      )}); true;`,
-    );
   }
 
   // ── internals ────────────────────────────────────────────────
@@ -588,23 +848,23 @@ class VoiceSessionManager implements VoiceSessionProvider {
     }
   }
 
-  private waitForConnect(): Promise<VoiceSnapshot> {
+  private waitForConnect(caller: VoiceCaller): Promise<VoiceSnapshot> {
     return new Promise<VoiceSnapshot>((resolve, reject) => {
       const timer = setTimeout(() => {
         this.pending = this.pending.filter(p => p.timer !== timer);
         reject(new Error('voice: timed out waiting to connect (is VoiceSessionHost mounted?)'));
       }, CONNECT_TIMEOUT_MS);
-      this.pending.push({ resolve, reject, timer });
+      this.pending.push({ caller, resolve, reject, timer });
     });
   }
 
   private resolvePending(): void {
     // Everyone still waiting on connect already passed the access check in
-    // start(), so they get the real snapshot.
-    const snap = this.realSnapshot();
+    // start(), so each gets the real snapshot — as ITS caller (lastDeviceTool
+    // is scoped per caller).
     const waiting = this.pending;
     this.pending = [];
-    for (const p of waiting) { clearTimeout(p.timer); p.resolve(snap); }
+    for (const p of waiting) { clearTimeout(p.timer); p.resolve(this.realSnapshot(p.caller)); }
   }
 
   private rejectPending(err: Error): void {
@@ -619,6 +879,11 @@ class VoiceSessionManager implements VoiceSessionProvider {
     this.rejectPending(new Error('voice: reset'));
     this.state = { ...IDLE };
     this.owner = null;
+    this.toolScope = null;
+    this.pendingStarts.clear();
+    this.frozenTools = null;
+    this.frozenSessionId = null;
+    this.sessionEpoch++;
     this.listeners.clear();
     this.webView = null;
   }