@moxxy/sdk 0.7.0 → 0.8.1

package/src/channel-auth.ts

@@ -1,12 +1,18 @@
 /**
  * Standard auth toolkit for channels — so a new channel gets consistent
- * connection auth without re-rolling token handling. Two pieces:
+ * connection auth without re-rolling token handling. The pieces:
  *
  *   - {@link resolveChannelToken} — the standard `channels.<name>` token
  *     resolution (env → config → a generated, persisted secret). Never empty.
+ *   - {@link rotateChannelToken} — replace the persisted secret with a fresh
+ *     one (pairing-token rotation; old tokens stop authenticating).
  *   - {@link bearerGuard} — a pre-connection handler: a constant-time bearer
  *     check a channel runs at its accept point (a WebSocket handshake, an HTTP
  *     request) before admitting a client.
+ *   - {@link encodeWsBearerProtocol} / {@link tokenFromWsProtocolHeader} — the
+ *     `Sec-WebSocket-Protocol` token convention for WebSocket clients that
+ *     cannot set an `Authorization` header (browser / React Native), so the
+ *     secret stays out of the URL (query strings leak via logs and QR/stdout).
  *
  * Channels that expose a network surface (mobile WS bridge, HTTP, web) should
  * resolve their token with the former and gate connections with the latter,
@@ -16,9 +22,9 @@
 
 import { randomBytes } from 'node:crypto';
 import fs from 'node:fs';
-import os from 'node:os';
 import path from 'node:path';
 
+import { moxxyHome } from './fs-utils.js';
 import { bearerTokenMatches } from './http-utils.js';
 
 export interface ChannelTokenOptions {
@@ -26,35 +32,107 @@ export interface ChannelTokenOptions {
   readonly configured?: string;
   /** Env var checked first, e.g. `MOXXY_MOBILE_TOKEN`. */
   readonly envVar?: string;
-  /** File (under the moxxy home dir) to persist a generated token, e.g. `mobile-token`. */
+  /** File to persist a generated token, e.g. `mobile-token`. */
   readonly fileName: string;
+  /** Directory the token file lives under. Defaults to the moxxy home dir;
+   *  the desktop bridge passes its Electron `userData` dir here instead. */
+  readonly dir?: string;
+  /** Receives the stale-token warning (default: `console.warn`). */
+  readonly warn?: (msg: string) => void;
 }
 
-function moxxyHome(): string {
-  return process.env.MOXXY_HOME?.trim() || path.join(os.homedir(), '.moxxy');
+/** Persisted tokens older than this trigger a rotation warning (soft only —
+ *  silently breaking an existing pairing is worse than an old secret). */
+const STALE_TOKEN_MS = 90 * 24 * 60 * 60 * 1000;
+
+interface PersistedToken {
+  readonly token: string;
+  /** Epoch ms the token was created, when known (null for ageless reads). */
+  readonly createdAtMs: number | null;
+}
+
+function tokenFilePath(opts: Pick<ChannelTokenOptions, 'dir' | 'fileName'>): string {
+  return path.join(opts.dir ?? moxxyHome(), opts.fileName);
+}
+
+/** Read a persisted token. New files are JSON `{ token, createdAt }`; legacy
+ *  files are the bare token (age falls back to the file mtime, best-effort). */
+function readTokenFile(file: string): PersistedToken | null {
+  let raw: string;
+  try {
+    raw = fs.readFileSync(file, 'utf8').trim();
+  } catch {
+    return null; // not yet created
+  }
+  if (!raw) return null;
+  if (raw.startsWith('{')) {
+    try {
+      const parsed = JSON.parse(raw) as { token?: unknown; createdAt?: unknown };
+      if (typeof parsed.token !== 'string' || !parsed.token) return null;
+      const created = typeof parsed.createdAt === 'string' ? Date.parse(parsed.createdAt) : NaN;
+      return { token: parsed.token, createdAtMs: Number.isFinite(created) ? created : null };
+    } catch {
+      return null; // corrupt — regenerate
+    }
+  }
+  let createdAtMs: number | null = null;
+  try {
+    createdAtMs = fs.statSync(file).mtimeMs;
+  } catch {
+    // age unknown
+  }
+  return { token: raw, createdAtMs };
+}
+
+function writeTokenFile(file: string, token: string): void {
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  fs.writeFileSync(file, `${JSON.stringify({ token, createdAt: new Date().toISOString() })}\n`, {
+    mode: 0o600,
+  });
 }
 
 /**
  * Resolve a channel's auth token. Precedence: `envVar` → `configured` → a
- * 256-bit secret generated once and persisted (0600) under the moxxy home, so
- * the same pairing secret survives restarts. Never returns an empty string —
- * a network-reachable channel must always be authenticated.
+ * 256-bit secret generated once and persisted (0600, JSON with a `createdAt`)
+ * under `dir` (default: the moxxy home). Never returns an empty string — a
+ * network-reachable channel must always be authenticated.
+ *
+ * A persisted token older than ~90 days logs a rotation hint (via `warn`);
+ * there is no hard expiry, because silently breaking a pairing is worse.
  */
 export function resolveChannelToken(opts: ChannelTokenOptions): string {
   const fromEnv = (opts.envVar ? process.env[opts.envVar] : undefined)?.trim();
   if (fromEnv) return fromEnv;
   if (opts.configured && opts.configured.trim()) return opts.configured.trim();
 
-  const file = path.join(moxxyHome(), opts.fileName);
-  try {
-    const existing = fs.readFileSync(file, 'utf8').trim();
-    if (existing) return existing;
-  } catch {
-    // not yet created
+  const file = tokenFilePath(opts);
+  const existing = readTokenFile(file);
+  if (existing) {
+    if (existing.createdAtMs !== null && Date.now() - existing.createdAtMs > STALE_TOKEN_MS) {
+      const days = Math.floor((Date.now() - existing.createdAtMs) / (24 * 60 * 60 * 1000));
+      (opts.warn ?? console.warn)(
+        `[moxxy] channel token at ${file} is ${days} days old — consider rotating it ` +
+          `(rotateChannelToken / delete the file to regenerate; clients must re-pair).`,
+      );
+    }
+    return existing.token;
   }
+  return rotateChannelToken(opts);
+}
+
+/**
+ * Rotate the PERSISTED channel token: generate a fresh 256-bit secret, rewrite
+ * the token file (old token stops authenticating new connections), and return
+ * it. Callers that hold a live server must also re-key it and drop existing
+ * connections (the WS bridge exposes `rotateAuthToken` for exactly this).
+ *
+ * Note: only the file-persisted token rotates — a token supplied via `envVar`
+ * or channel config takes precedence at resolve time and must be rotated at
+ * its source.
+ */
+export function rotateChannelToken(opts: Pick<ChannelTokenOptions, 'dir' | 'fileName'>): string {
   const token = randomBytes(32).toString('hex');
-  fs.mkdirSync(path.dirname(file), { recursive: true });
-  fs.writeFileSync(file, token, { mode: 0o600 });
+  writeTokenFile(tokenFilePath(opts), token);
   return token;
 }
 
@@ -66,3 +144,38 @@ export function resolveChannelToken(opts: ChannelTokenOptions): string {
 export function bearerGuard(expected: string): (presented: string | undefined | null) => boolean {
   return (presented) => (expected ? bearerTokenMatches(presented, expected) : false);
 }
+
+/** The moxxy WS application subprotocol a client requests (and the server
+ *  selects) when it also smuggles its bearer token as a protocol entry. */
+export const MOXXY_WS_SUBPROTOCOL = 'moxxy.v1';
+
+/** Prefix of the `Sec-WebSocket-Protocol` entry that carries the bearer token:
+ *  `moxxy.bearer.<rfc3986-strict-percent-encoded token>`. Percent-encoding
+ *  keeps every output character a valid HTTP token char. */
+export const MOXXY_WS_BEARER_PROTOCOL_PREFIX = 'moxxy.bearer.';
+
+/** Encode a bearer token as the WS subprotocol entry a header-less WebSocket
+ *  client (browser / React Native) sends alongside {@link MOXXY_WS_SUBPROTOCOL}. */
+export function encodeWsBearerProtocol(token: string): string {
+  const strict = encodeURIComponent(token).replace(
+    /[!'()*]/g,
+    (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`,
+  );
+  return `${MOXXY_WS_BEARER_PROTOCOL_PREFIX}${strict}`;
+}
+
+/** Extract the bearer token from a `Sec-WebSocket-Protocol` request header
+ *  (comma-separated offer list), or null when no bearer entry is present. */
+export function tokenFromWsProtocolHeader(header: string | undefined): string | null {
+  if (!header) return null;
+  for (const entry of header.split(',')) {
+    const candidate = entry.trim();
+    if (!candidate.startsWith(MOXXY_WS_BEARER_PROTOCOL_PREFIX)) continue;
+    try {
+      return decodeURIComponent(candidate.slice(MOXXY_WS_BEARER_PROTOCOL_PREFIX.length));
+    } catch {
+      return null; // malformed escape — treat as unauthenticated
+    }
+  }
+  return null;
+}

package/src/compactor-helpers.ts

@@ -182,6 +182,11 @@ export async function runCompactionIfNeeded(
       log: ctx.log,
       budget,
       signal: ctx.signal,
+      // Hand the compactor the session's provider/model so the default
+      // summarize compactor can write a real summary (it truncates honestly
+      // when no provider is reachable).
+      provider: ctx.provider,
+      model: ctx.model,
     });
     if (result.tokensSaved <= 0 || result.summary.trim().length === 0) return false;
     // `compactor.compact` declares `Omit<CompactionEvent, keyof EventBase>`,

package/src/compactor.ts

@@ -1,5 +1,6 @@
 import type { CompactionEvent, MoxxyEvent } from './events.js';
 import type { EventLogReader } from './log.js';
+import type { LLMProvider } from './provider.js';
 
 export interface TokenBudget {
   readonly contextWindow: number;
@@ -11,6 +12,15 @@ export interface CompactContext {
   readonly log: EventLogReader;
   readonly budget: TokenBudget;
   readonly signal: AbortSignal;
+  /**
+   * The session's active provider + model, when the dispatcher has them
+   * (`runCompactionIfNeeded` always passes both). Lets a compactor produce a
+   * REAL model-written summary instead of a lossy truncation. Optional so
+   * hand-rolled callers and tests can still invoke `compact` without one —
+   * compactors must degrade gracefully when absent.
+   */
+  readonly provider?: LLMProvider;
+  readonly model?: string;
 }
 
 export interface CompactorDef {

package/src/index.ts

@@ -143,7 +143,7 @@ export type {
   ViewTagSpec,
   ViewRendererDef,
 } from './view-renderer.js';
-export { VIEW_PRIMITIVES, VIEW_COMPONENTS, DEFAULT_VIEW_TAGS } from './view-renderer.js';
+export { VIEW_PRIMITIVES, VIEW_COMPONENTS, DEFAULT_VIEW_TAGS, isSafeViewUrl } from './view-renderer.js';
 export type { TunnelProviderDef, TunnelHandle, TunnelOpenOptions } from './tunnel.js';
 export { isRetryableError, toFriendlyError, zodToJsonSchema, estimateTextTokens, type StopReason } from './provider-utils.js';
 export { writeFileAtomic, moxxyHome, moxxyPath, type WriteFileAtomicOptions } from './fs-utils.js';
@@ -151,7 +151,12 @@ export { createMutex, type Mutex } from './mutex.js';
 export { readRequestBody, bearerTokenMatches } from './http-utils.js';
 export {
   resolveChannelToken,
+  rotateChannelToken,
   bearerGuard,
+  encodeWsBearerProtocol,
+  tokenFromWsProtocolHeader,
+  MOXXY_WS_SUBPROTOCOL,
+  MOXXY_WS_BEARER_PROTOCOL_PREFIX,
   type ChannelTokenOptions,
 } from './channel-auth.js';
 export {
@@ -376,10 +381,4 @@ export {
   type InstallTarget,
 } from './install-hints.js';
 
-export {
-  checkTranscriberReady,
-  pickFirstAvailableTranscriber,
-  resolveTranscriber,
-} from './voice.js';
-
 export { z } from 'zod';

package/src/loop-helpers.test.ts

@@ -50,6 +50,107 @@ describe('projectMessagesFromLog', () => {
       content: [{ type: 'text', text: 'current prompt' }],
     });
   });
+
+  it('omits the empty text block from a tool-only assistant turn (keeps tool_use + results)', () => {
+    // Historical wedged-log shape: end_turn with tool calls and no prose
+    // produced an assistant_message with empty content. Providers (Anthropic)
+    // reject empty text blocks on the NEXT request — the projection must drop
+    // the block so even existing logs become valid again.
+    const log = reader([
+      event(0, { type: 'user_prompt', turnId: t1, source: 'user', text: 'run the tool' }),
+      event(1, {
+        type: 'tool_call_requested',
+        turnId: t1,
+        source: 'model',
+        callId: 'call-1',
+        name: 'do_thing',
+        input: { a: 1 },
+      }),
+      event(2, {
+        type: 'assistant_message',
+        turnId: t1,
+        source: 'model',
+        content: '',
+        stopReason: 'end_turn',
+      }),
+      event(3, {
+        type: 'tool_result',
+        turnId: t1,
+        source: 'tool',
+        callId: 'call-1',
+        ok: true,
+        output: 'done',
+      }),
+    ]);
+
+    const messages = projectMessagesFromLog({ log });
+
+    expect(messages.map((m) => m.role)).toEqual(['user', 'assistant', 'tool_result']);
+    expect(messages[1]!.content).toEqual([
+      { type: 'tool_use', id: 'call-1', name: 'do_thing', input: { a: 1 } },
+    ]);
+    // No empty text block anywhere in the projected conversation.
+    for (const m of messages) {
+      for (const block of m.content) {
+        if (block.type === 'text') expect(block.text.trim().length).toBeGreaterThan(0);
+      }
+    }
+  });
+
+  it('skips a whitespace-only assistant message even without tool calls', () => {
+    const log = reader([
+      event(0, { type: 'user_prompt', turnId: t1, source: 'user', text: 'hi' }),
+      event(1, {
+        type: 'assistant_message',
+        turnId: t1,
+        source: 'model',
+        content: '  \n',
+        stopReason: 'end_turn',
+      }),
+      event(2, { type: 'user_prompt', turnId: t2, source: 'user', text: 'still there?' }),
+    ]);
+
+    const messages = projectMessagesFromLog({ log });
+
+    expect(messages.map((m) => m.role)).toEqual(['user', 'user']);
+  });
+
+  it('still projects non-empty assistant messages alongside tool calls', () => {
+    const log = reader([
+      event(0, { type: 'user_prompt', turnId: t1, source: 'user', text: 'run it' }),
+      event(1, {
+        type: 'tool_call_requested',
+        turnId: t1,
+        source: 'model',
+        callId: 'call-2',
+        name: 'do_thing',
+        input: {},
+      }),
+      event(2, {
+        type: 'assistant_message',
+        turnId: t1,
+        source: 'model',
+        content: 'running it now',
+        stopReason: 'end_turn',
+      }),
+      event(3, {
+        type: 'tool_result',
+        turnId: t1,
+        source: 'tool',
+        callId: 'call-2',
+        ok: true,
+        output: 'ok',
+      }),
+    ]);
+
+    const messages = projectMessagesFromLog({ log });
+
+    expect(messages.map((m) => m.role)).toEqual(['user', 'assistant', 'assistant', 'tool_result']);
+    expect(messages[2]).toMatchObject({
+      role: 'assistant',
+      content: [{ type: 'text', text: 'running it now' }],
+    });
+  });
 });
 
 function reader(events: ReadonlyArray<MoxxyEvent>): EventLogReader {

package/src/mode-helpers.ts

@@ -296,6 +296,16 @@ export function projectMessages(
           recordStable(e.seq);
           break;
         }
+        // A tool-only turn can log an assistant_message with empty content
+        // (end_turn + tool calls, no prose). Projecting it as an empty text
+        // block makes some providers (Anthropic) reject the NEXT request and
+        // permanently wedges the session. Skip the block — the turn's
+        // tool_use blocks are projected from tool_call_requested events —
+        // which also un-wedges historical logs that already contain one.
+        if (e.content.trim().length === 0) {
+          recordStable(e.seq);
+          break;
+        }
         messages.push({ role: 'assistant', content: [{ type: 'text', text: e.content }] });
         recordStable(e.seq);
         break;
@@ -373,6 +383,15 @@ export async function collectProviderStream(
      * strategy then falls back to its tools/system/tail breakpoints only.
      */
     stablePrefixIndex?: number;
+    /**
+     * Number of trailing messages in `messages` that are volatile — injected
+     * for this call only (e.g. goal mode's `trailingUserText` nudge) and
+     * absent from the append-only log, so they won't recur at the same
+     * position next call. Forwarded to the cache strategy as
+     * `volatileTailMessageCount` so it keeps its rolling tail breakpoint
+     * before them instead of paying a guaranteed-wasted cache write.
+     */
+    volatileTailCount?: number;
   } = {},
 ): Promise<StreamResult> {
   // Lazy tool gating (opt-in): send only always-on + loaded tool schemas, and
@@ -400,12 +419,20 @@ export async function collectProviderStream(
         ...(opts.stablePrefixIndex != null && opts.stablePrefixIndex >= 0
           ? { stablePrefixMessageIndex: opts.stablePrefixIndex }
           : {}),
+        ...(opts.volatileTailCount != null && opts.volatileTailCount > 0
+          ? { volatileTailMessageCount: opts.volatileTailCount }
+          : {}),
       })
     : undefined;
 
+  // NOTE: `system` is deliberately NOT prefilled with ctx.systemPrompt — the
+  // composed system prompt already rides as the leading system-role message
+  // (see projectMessages), and providers deliver `req.system` IN ADDITION to
+  // message-derived system text. Prefilling it would duplicate the prompt.
+  // It stays as the side channel `onBeforeProviderCall` hooks use to inject
+  // per-request system text (e.g. the memory consolidation nudge).
   const req = {
     model: ctx.model,
-    system: ctx.systemPrompt,
     messages: effectiveMessages,
     ...(toolList ? { tools: toolList } : {}),
     ...(cacheHints && cacheHints.length > 0 ? { cacheHints } : {}),

package/src/permission.ts

@@ -34,4 +34,17 @@ export interface PermissionContext {
 export interface PermissionResolver {
   readonly name: string;
   check(call: PendingToolCall, ctx: PermissionContext): Promise<PermissionDecision>;
+  /**
+   * Optional prompt-free policy probe. Returns the decision the persistent
+   * policy layer would make for this call (user deny/allow rules from
+   * `~/.moxxy/permissions.json`, then the tool's own declared rule), or
+   * `null` when no rule matches — WITHOUT falling through to the
+   * interactive prompt path that `check` takes.
+   *
+   * Core's session resolver (the policy wrapper) implements this; bare
+   * resolvers may omit it. Auto-approving modes (e.g. goal mode) consult it
+   * before allowing, so a configured deny rule still denies in unattended
+   * runs while nothing can ever block on a prompt.
+   */
+  policyCheck?(call: PendingToolCall, ctx: PermissionContext): Promise<PermissionDecision | null>;
 }

package/src/provider.ts

@@ -38,6 +38,16 @@ export interface CacheHint {
 
 export interface ProviderRequest {
   readonly model: string;
+  /**
+   * Extra system text delivered IN ADDITION to any `role: 'system'`
+   * messages in `messages`. The loop helpers project the composed system
+   * prompt as the leading system message (so cache hints can target it)
+   * and leave this unset; `onBeforeProviderCall` hooks use it as the
+   * side channel for per-request system injections (e.g. plugin-memory's
+   * consolidation nudge), and direct callers (e.g. skill synthesis) may
+   * set it instead of crafting a system message. Providers MUST deliver
+   * it — appended after the message-derived system text — never drop it.
+   */
   readonly system?: string;
   readonly messages: ReadonlyArray<ProviderMessage>;
   readonly tools?: ReadonlyArray<ToolDef>;

package/src/session-like.ts

@@ -235,6 +235,20 @@ export interface SessionLike {
   getInfo(): SessionInfo;
   close(reason?: string): Promise<void>;
 
+  /**
+   * Authoritative session reset (`/new`): wipe the conversation history at
+   * its source so it cannot resurrect. On an in-process `Session` this clears
+   * the real `EventLog` (and, via the log's clear listeners, truncates the
+   * persistence sidecar so `--resume` sees an empty session). On a
+   * `RemoteSession` it invokes the runner's `session.reset` RPC — the runner
+   * aborts in-flight turns, clears ITS log, and broadcasts a reset
+   * notification so every attached mirror clears in lockstep. Optional
+   * capability per the seam convention: callers MUST guard and fall back to
+   * `log.clear()` when absent, and MUST surface a rejection instead of
+   * claiming the history was cleared.
+   */
+  reset?(): Promise<void>;
+
   /**
    * Live runtime capabilities present only on an in-process Session; a
    * `RemoteSession` thin client leaves them undefined, so callers MUST guard.

package/src/view-renderer.ts

@@ -93,6 +93,28 @@ export interface ViewRendererDef {
   validate(doc: ViewDoc): ReadonlyArray<ViewParseError>;
 }
 
+/**
+ * URL-scheme allow-list for agent-authored `href`/`src` values — the single
+ * canonical check, enforced at BOTH walls: parse/validate time
+ * (core's `parseView`/`validateDoc`) and render time (the web frontend
+ * re-checks before emitting an anchor/img; it keeps a verbatim copy in
+ * `plugin-channel-web/src/frontend/url-safety.ts` because the browser bundle
+ * cannot import the sdk root — keep the two in lockstep).
+ *
+ * Decision (audit A44): allowed schemes are `https:`, `http:`, `mailto:`,
+ * `tel:`, plus relative/fragment URLs; `data:` only as an `img src` and only
+ * `data:image/*`. Everything else — notably `javascript:`, `vbscript:`,
+ * `data:text/*` — is rejected. Views are designed to be shared with third
+ * parties, so a `javascript:` link is click-XSS on a shared surface.
+ */
+export function isSafeViewUrl(url: string, attr: string): boolean {
+  const u = url.trim().toLowerCase();
+  if (u.startsWith('javascript:') || u.startsWith('vbscript:')) return false;
+  if (u.startsWith('data:')) return attr === 'src' && u.startsWith('data:image/');
+  if (/^[a-z][a-z0-9+.-]*:/.test(u)) return /^(https?:|mailto:|tel:)/.test(u);
+  return true; // relative / fragment
+}
+
 const TONE = ['default', 'muted', 'success', 'warn', 'danger'] as const;
 const GAP = ['none', 'sm', 'md', 'lg'] as const;
 

package/dist/voice.d.ts

@@ -1,36 +0,0 @@
-/**
- * Voice / transcription helpers shared across surfaces.
- *
- * The TUI's voice-input infrastructure used to inline the same logic
- * with a `Codex`-specific name baked in. Pulled out here as
- * *agnostic* helpers that take a transcriber name as input, so the
- * desktop, TUI, and any future channel can mirror the same flow:
- *
- *   - Is the session ready to transcribe? Check via the requirements
- *     API for a named transcriber. (`checkTranscriberReady`)
- *   - Activate any registered transcriber lazily. Returns the active
- *     transcriber instance. (`resolveTranscriber`)
- *   - "Just give me whatever works" — try a list of candidates in
- *     order, or fall back to the first registered one. (`pickFirstAvailableTranscriber`)
- */
-import type { ClientSession } from './client-session.js';
-import type { MoxxyRequirement, RequirementCheck } from './requirements.js';
-import type { Transcriber } from './transcriber.js';
-/** Probe whether a *named* transcriber is ready: registered, with any
- *  declared upstream requirements satisfied. The optional `requires`
- *  list lets channels gate on additional provider / auth runtimes
- *  (the Codex transcriber e.g. depends on the `openai-codex` provider
- *  + its OAuth runtime). */
-export declare function checkTranscriberReady(session: ClientSession, transcriberName: string, requires?: ReadonlyArray<MoxxyRequirement>): RequirementCheck;
-/** Activate a transcriber by name, lazily. Returns the active instance
- *  ready to `.transcribe(...)`. Throws if no such transcriber is
- *  registered, or a *different* one is already active. */
-export declare function resolveTranscriber(session: ClientSession, transcriberName: string): Transcriber;
-/** "Just pick a transcriber that works."
- *
- *  Tries each name in `candidates` in order — first one that can be
- *  activated wins. Returns null if none can be activated, so callers
- *  can degrade gracefully (hide their mic button, show a "no voice
- *  configured" tip, …) instead of throwing. */
-export declare function pickFirstAvailableTranscriber(session: ClientSession, candidates: ReadonlyArray<string>): Transcriber | null;
-//# sourceMappingURL=voice.d.ts.map

package/dist/voice.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"voice.d.ts","sourceRoot":"","sources":["../src/voice.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EACV,gBAAgB,EAChB,gBAAgB,EAEjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD;;;;4BAI4B;AAC5B,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,aAAa,EACtB,eAAe,EAAE,MAAM,EACvB,QAAQ,GAAE,aAAa,CAAC,gBAAgB,CAAM,GAC7C,gBAAgB,CAqBlB;AAED;;0DAE0D;AAC1D,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,aAAa,EACtB,eAAe,EAAE,MAAM,GACtB,WAAW,CAcb;AAED;;;;;+CAK+C;AAC/C,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,aAAa,EACtB,UAAU,EAAE,aAAa,CAAC,MAAM,CAAC,GAChC,WAAW,GAAG,IAAI,CAepB"}

package/dist/voice.js

@@ -1,82 +0,0 @@
-/**
- * Voice / transcription helpers shared across surfaces.
- *
- * The TUI's voice-input infrastructure used to inline the same logic
- * with a `Codex`-specific name baked in. Pulled out here as
- * *agnostic* helpers that take a transcriber name as input, so the
- * desktop, TUI, and any future channel can mirror the same flow:
- *
- *   - Is the session ready to transcribe? Check via the requirements
- *     API for a named transcriber. (`checkTranscriberReady`)
- *   - Activate any registered transcriber lazily. Returns the active
- *     transcriber instance. (`resolveTranscriber`)
- *   - "Just give me whatever works" — try a list of candidates in
- *     order, or fall back to the first registered one. (`pickFirstAvailableTranscriber`)
- */
-/** Probe whether a *named* transcriber is ready: registered, with any
- *  declared upstream requirements satisfied. The optional `requires`
- *  list lets channels gate on additional provider / auth runtimes
- *  (the Codex transcriber e.g. depends on the `openai-codex` provider
- *  + its OAuth runtime). */
-export function checkTranscriberReady(session, transcriberName, requires = []) {
-    const baseline = [
-        { kind: 'transcriber', name: transcriberName },
-        ...requires,
-    ];
-    const check = session.requirements.check(baseline);
-    const activeName = session.transcribers.getActiveName();
-    if (!activeName || activeName === transcriberName)
-        return check;
-    const conflict = {
-        requirement: {
-            kind: 'transcriber',
-            name: transcriberName,
-            state: 'active',
-            hint: `Switch active transcriber to ${transcriberName}.`,
-        },
-        code: 'inactive',
-        message: `Required active transcriber ${transcriberName}; active is ${activeName}`,
-        hint: `Switch active transcriber to ${transcriberName}.`,
-    };
-    return { ready: false, issues: [conflict, ...check.issues] };
-}
-/** Activate a transcriber by name, lazily. Returns the active instance
- *  ready to `.transcribe(...)`. Throws if no such transcriber is
- *  registered, or a *different* one is already active. */
-export function resolveTranscriber(session, transcriberName) {
-    const activeName = session.transcribers.getActiveName();
-    if (activeName && activeName !== transcriberName) {
-        throw new Error(`Another transcriber is already active: ${activeName}.`);
-    }
-    if (activeName === transcriberName)
-        return session.transcribers.getActive();
-    if (session.transcribers.has(transcriberName)) {
-        return session.transcribers.setActive(transcriberName);
-    }
-    throw new Error(`No transcriber registered as ${transcriberName}. Configure one via your moxxy plugins.`);
-}
-/** "Just pick a transcriber that works."
- *
- *  Tries each name in `candidates` in order — first one that can be
- *  activated wins. Returns null if none can be activated, so callers
- *  can degrade gracefully (hide their mic button, show a "no voice
- *  configured" tip, …) instead of throwing. */
-export function pickFirstAvailableTranscriber(session, candidates) {
-    // If something's already active, just hand that back — never fight
-    // a user-chosen activation.
-    const existing = session.transcribers.tryGetActive();
-    if (existing)
-        return existing;
-    for (const name of candidates) {
-        try {
-            return resolveTranscriber(session, name);
-        }
-        catch {
-            // Wrong-active errors don't apply here (we just returned early),
-            // so any throw is "this candidate isn't registered" — keep
-            // trying.
-        }
-    }
-    return null;
-}
-//# sourceMappingURL=voice.js.map

package/dist/voice.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"voice.js","sourceRoot":"","sources":["../src/voice.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAUH;;;;4BAI4B;AAC5B,MAAM,UAAU,qBAAqB,CACnC,OAAsB,EACtB,eAAuB,EACvB,WAA4C,EAAE;IAE9C,MAAM,QAAQ,GAAoC;QAChD,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,eAAe,EAAE;QAC9C,GAAG,QAAQ;KACZ,CAAC;IACF,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACnD,MAAM,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,aAAa,EAAE,CAAC;IACxD,IAAI,CAAC,UAAU,IAAI,UAAU,KAAK,eAAe;QAAE,OAAO,KAAK,CAAC;IAEhE,MAAM,QAAQ,GAAqB;QACjC,WAAW,EAAE;YACX,IAAI,EAAE,aAAa;YACnB,IAAI,EAAE,eAAe;YACrB,KAAK,EAAE,QAAQ;YACf,IAAI,EAAE,gCAAgC,eAAe,GAAG;SACzD;QACD,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,+BAA+B,eAAe,eAAe,UAAU,EAAE;QAClF,IAAI,EAAE,gCAAgC,eAAe,GAAG;KACzD,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,QAAQ,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED;;0DAE0D;AAC1D,MAAM,UAAU,kBAAkB,CAChC,OAAsB,EACtB,eAAuB;IAEvB,MAAM,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,aAAa,EAAE,CAAC;IACxD,IAAI,UAAU,IAAI,UAAU,KAAK,eAAe,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CACb,0CAA0C,UAAU,GAAG,CACxD,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,KAAK,eAAe;QAAE,OAAO,OAAO,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC;IAC5E,IAAI,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;QAC9C,OAAO,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,IAAI,KAAK,CACb,gCAAgC,eAAe,yCAAyC,CACzF,CAAC;AACJ,CAAC;AAED;;;;;+CAK+C;AAC/C,MAAM,UAAU,6BAA6B,CAC3C,OAAsB,EACtB,UAAiC;IAEjC,mEAAmE;IACnE,4BAA4B;IAC5B,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC,YAAY,EAAE,CAAC;IACrD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,OAAO,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;YACjE,2DAA2D;YAC3D,UAAU;QACZ,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}