@pimote/pimote 0.6.0 → 0.7.0

package/server/dist/static-host/http-handler.js

@@ -1,5 +1,5 @@
 import { createReadStream } from 'node:fs';
-import { stat } from 'node:fs/promises';
+import { stat, realpath } from 'node:fs/promises';
 import path from 'node:path';
 const MIME_TYPES = {
     '.html': 'text/html; charset=utf-8',
@@ -126,11 +126,37 @@ export async function serveStaticHostRoute(req, res, registry) {
         send404(res);
         return true;
     }
+    // Symlink containment: stat()/createReadStream() follow symlinks, so a symlink
+    // INSIDE the bundle could point outside it (the `..` and path.resolve checks
+    // above are lexical and cannot see this). Resolve symlinks on both the target
+    // and the registered folder and require the real target to stay within.
+    try {
+        const [realTarget, realFolder] = await Promise.all([realpath(resolved), realpath(folderPath)]);
+        if (realTarget !== realFolder && !realTarget.startsWith(realFolder + path.sep)) {
+            send404(res);
+            return true;
+        }
+    }
+    catch {
+        send404(res);
+        return true;
+    }
     const ext = path.extname(resolved).toLowerCase();
     const mime = MIME_TYPES[ext] || 'application/octet-stream';
     res.writeHead(200, {
         'Content-Type': mime,
         'Cache-Control': 'no-cache, no-store, must-revalidate',
+        // Agent-authored content served same-origin with the control PWA. Two
+        // hardening headers (review finding M4):
+        //  - nosniff: never let the browser MIME-sniff a bundle file into a script.
+        //  - CSP connect-src http:/https: blocks ws:/wss:, so a (prompt-injected)
+        //    bundle cannot open pimote's authenticated WebSocket and drive sessions.
+        //    We stay same-origin (not sandboxed) so bundles keep localStorage and
+        //    same-origin asset fetches; same-origin HTTP fetch + storage reads remain
+        //    possible but are contained by the single-user model + edge auth. Full
+        //    isolation would require serving bundles from a separate origin.
+        'X-Content-Type-Options': 'nosniff',
+        'Content-Security-Policy': 'connect-src http: https:',
     });
     if (req.method === 'HEAD') {
         res.end();

package/server/dist/static-host/index.js

@@ -1,5 +1,5 @@
 import { Type } from 'typebox';
-import { executeRegisterTool, executeRemoveTool } from './tools.js';
+import { executeRegisterTool, executeRemoveTool, resolveSlugCollision } from './tools.js';
 import { STATIC_HOST_TOOL_DESCRIPTION } from './prompt.js';
 export { InMemoryStaticHostRegistry } from './registry.js';
 export { FileStaticHostStore } from './store.js';
@@ -94,23 +94,35 @@ export function createStaticHostExtension(opts) {
             const file = await store.read(sessionId);
             if (!file)
                 return;
+            // Replay persisted entries, re-suffixing any slug already taken (another
+            // session persisted the same slug, or this session reloaded earlier this
+            // boot). Re-suffixing keeps the bundle reachable; the old behaviour left a
+            // phantom entry in the file that the remove tool could never match (its
+            // registry lookup failed) and that got re-appended on every future write.
+            const replayed = [];
+            let mutated = false;
             for (const entry of file.entries) {
+                let slug = entry.slug;
+                if (registry.has(slug)) {
+                    slug = resolveSlugCollision(slug, registry);
+                    mutated = true;
+                }
                 try {
-                    registry.register({
-                        slug: entry.slug,
-                        folderPath: entry.folderPath,
-                        sessionId,
-                        cardMetadata: entry.cardMetadata,
-                    });
+                    registry.register({ slug, folderPath: entry.folderPath, sessionId, cardMetadata: entry.cardMetadata });
+                    replayed.push(slug === entry.slug ? entry : { ...entry, slug });
                 }
                 catch (err) {
-                    // Defensive: a slug conflict (e.g. two sessions persisted the same
-                    // slug, or another session reloaded earlier this boot) must not
-                    // abort the whole replay loop and leave the session partially
-                    // loaded. Skip the conflicting entry and continue.
-                    console.warn(`[static-host] session_start: skipping persisted entry ${entry.slug} for session ${sessionId}`, err);
+                    // Couldn't register even after re-suffixing — drop it from the file so
+                    // it doesn't linger as a phantom on the next write.
+                    mutated = true;
+                    console.warn(`[static-host] session_start: dropping unregisterable entry ${entry.slug} for session ${sessionId}`, err);
                 }
             }
+            // Persist the reconciled list only if something changed, so the common
+            // conflict-free replay performs no write.
+            if (mutated) {
+                await store.write(sessionId, { version: 1, entries: replayed });
+            }
             emitPanelCards(pi, sessionId);
         });
         pi.on('session_shutdown', async (_ev, ctx) => {

package/server/dist/static-host/store.js

@@ -22,7 +22,16 @@ export class FileStaticHostStore {
                 return undefined;
             throw err;
         }
-        return JSON.parse(raw);
+        try {
+            return JSON.parse(raw);
+        }
+        catch (err) {
+            // A truncated/corrupt file must not reject out of the async session_start
+            // handler (which could break session load). Treat it as "no state" — the
+            // next write overwrites it atomically.
+            console.warn(`[static-host] ignoring corrupt store file ${path}:`, err.message ?? err);
+            return undefined;
+        }
     }
     async write(sessionId, file) {
         await mkdir(this.storeDir, { recursive: true });

package/server/dist/static-host/tools.js

@@ -1,5 +1,5 @@
 import { stat } from 'node:fs/promises';
-import { isAbsolute, join } from 'node:path';
+import { isAbsolute, join, resolve } from 'node:path';
 /**
  * Validates and normalises a slug.
  *
@@ -56,6 +56,10 @@ export async function executeRegisterTool(input, deps) {
     if (typeof input.folder !== 'string' || !isAbsolute(input.folder)) {
         throw new Error(`folder must be an absolute path: ${JSON.stringify(input.folder)}`);
     }
+    // Normalize before stat/persist/register: a trailing slash or internal `..`
+    // segment would otherwise break the http-handler's containment check (which
+    // compares a resolved request path against `folderPath + path.sep`).
+    input.folder = resolve(input.folder);
     let folderStat;
     try {
         folderStat = await stat(input.folder);

package/server/dist/voice/fsm/reducer.js

@@ -19,7 +19,7 @@
 //    place to handle them because it lives at the boundary between
 //    "do we even have a connection" and "what should the agent do".)
 import { reduceLifecycle, applyLifecycleResult, bufferOrPassFrame } from './reducers/lifecycle.js';
-import { reduceStreaming } from './reducers/streaming.js';
+import { reduceStreaming, currentStreamingSpeakId } from './reducers/streaming.js';
 import { reduceWalkback, applyWalkbackResult } from './reducers/walkback.js';
 export function reduce(prev, event, reducers) {
     let state = prev;
@@ -53,7 +53,19 @@ export function reduce(prev, event, reducers) {
         }
     }
     // ---- Walkback ----------------------------------------------------------
-    const wb = reduceWalkback(state.walkback, state.lastEmittedSpeakId, event);
+    // Pass:
+    //  - lifecycle kind, so abort/rollback frames arriving when no call is active
+    //    are dropped (e.g. in flight during teardown) — a stray abort would
+    //    otherwise abort a text-mode turn. (H3)
+    //  - the in-flight speak id, so an interrupt targeting a still-streaming
+    //    speak resolves correctly when the frame omits a speak_id. (gap 2)
+    // `state.message` is post-streaming here, so its blocks still hold the
+    // in-flight speak (ws:incoming doesn't clear them).
+    const wb = reduceWalkback(state.walkback, event, {
+        lastEmittedSpeakId: state.lastEmittedSpeakId,
+        currentStreamingSpeakId: currentStreamingSpeakId(state.message),
+        lifecycleKind: state.lifecycle.kind,
+    });
     state = applyWalkbackResult(state, wb);
     actions.push(...wb.actions);
     // Clear lastEmittedSpeakId on full deactivation so a subsequent call

package/server/dist/voice/fsm/reducers/lifecycle.js

@@ -38,7 +38,11 @@ export function reduceLifecycle(prev, event, ctx) {
                     modelId: ctx.config.defaultInterpreterModel.modelId,
                 });
             }
-            actions.push({ kind: 'send_user_message', text: VOICE_CALL_STARTED_SENTINEL });
+            // Steer the start sentinel rather than aborting: if the agent is mid-task
+            // when the call binds, preserve that work. The executor injects into the
+            // running turn when busy, and sends normally (triggering the greeting)
+            // when idle. (M7)
+            actions.push({ kind: 'send_user_message', text: VOICE_CALL_STARTED_SENTINEL, deliverAs: 'steer' });
             actions.push({ kind: 'open_ws', url: event.msg.speechmuxWsUrl });
             return {
                 next: {
@@ -98,21 +102,23 @@ export function reduceLifecycle(prev, event, ctx) {
                 return { next: prev, interpreterAppliedNow: false, actions: [] };
             }
             // Drop any buffered frames; the shell will rebuild from scratch
-            // on the next activate.
+            // on the next activate. Carry the sessionId on the action from the
+            // pre-transition state — after this we're dormant. (M1)
             return {
                 next: { kind: 'dormant' },
                 interpreterAppliedNow: false,
-                actions: [{ kind: 'emit_deactivate_request' }],
+                actions: [{ kind: 'emit_deactivate_request', sessionId: prev.sessionId }],
             };
         }
         case 'ws:disconnected': {
             if (prev.kind === 'dormant') {
                 return { next: prev, interpreterAppliedNow: false, actions: [] };
             }
+            // prev is activating|active here — both carry sessionId. (M1)
             return {
                 next: { kind: 'dormant' },
                 interpreterAppliedNow: false,
-                actions: [{ kind: 'emit_deactivate_request' }],
+                actions: [{ kind: 'emit_deactivate_request', sessionId: prev.sessionId }],
             };
         }
         default:

package/server/dist/voice/fsm/reducers/streaming.js

@@ -44,15 +44,41 @@ const noFrames = (next) => ({
 export function reduceStreaming(prev, event) {
     switch (event.type) {
         case 'sdk:message_start':
-            // Assistant message starts → wipe per-block state. (Filtering on
+            // Assistant message starts → wipe per-block state and clear the
+            // interrupt latch (a new turn can emit again). (Filtering on
             // role==='assistant' happens at the dispatcher.)
-            return noFrames({ blocks: new Map() });
+            return noFrames({ blocks: new Map(), interrupted: false });
+        case 'ws:incoming':
+            // A barge-in latches `interrupted` so we stop feeding speechmux tokens
+            // for an utterance it already aborted. Reset on the next message_start.
+            if (event.frame.type === 'abort' || event.frame.type === 'rollback') {
+                return noFrames({ ...prev, interrupted: true });
+            }
+            return noFrames(prev);
         case 'sdk:toolcall_start':
+            if (prev.interrupted)
+                return noFrames(prev);
             return noFrames(setBlock(prev, event.contentIndex, blockFromPartial(event.contentIndex, event.partial)));
         case 'sdk:toolcall_delta':
+            if (prev.interrupted)
+                return noFrames(prev);
             return reduceDelta(prev, event.contentIndex, event.delta, event.partial);
         case 'sdk:toolcall_end':
+            if (prev.interrupted)
+                return noFrames(prev);
             return reduceEnd(prev, event.contentIndex, event.toolCall);
+        case 'sdk:turn_end':
+            // Release the floor for the turn's last spoken utterance. Routed as a
+            // frame so the lifecycle layer buffers it during `activating` and passes
+            // it during `active` — the same discipline as token/end frames. (M2)
+            return {
+                next: prev,
+                frames: [event.lastSpeakToolCallId ? { type: 'floor_released', speak_id: event.lastSpeakToolCallId } : { type: 'floor_released' }],
+                endedSpeakIds: [],
+            };
+        case 'sdk:agent_end':
+            // Surface a harness-side error to speechmux. (M2)
+            return event.error ? { next: prev, frames: [{ type: 'error', message: event.error }], endedSpeakIds: [] } : noFrames(prev);
         default:
             return noFrames(prev);
     }
@@ -165,7 +191,17 @@ function setBlock(state, idx, block) {
         return state;
     const blocks = new Map(state.blocks);
     blocks.set(idx, block);
-    return { blocks };
+    return { ...state, blocks };
+}
+/** Toolcall id of the speak() block currently mid-stream (if any). The most
+ *  likely walkback target when speechmux's frame omits a speak_id: an in-flight
+ *  speak hasn't emitted its `end`, so it isn't in `lastEmittedSpeakId` yet. */
+export function currentStreamingSpeakId(message) {
+    for (const block of message.blocks.values()) {
+        if (block.kind === 'speak_streaming' && block.toolCallId)
+            return block.toolCallId;
+    }
+    return null;
 }
 function partialBlock(partial, idx) {
     const c = partial?.content;

package/server/dist/voice/fsm/reducers/walkback.js

@@ -18,27 +18,30 @@
 // such ambiguity.
 import { VOICE_INTERRUPT_CUSTOM_TYPE } from '../../../../../shared/dist/index.js';
 import { walkBack } from '../../walk-back.js';
-/** Resolve which speak() id to walk back to. Prefers what speechmux
- *  echoes; falls back to runtime-tracked latest. Returns null if neither
- *  is available (we'll degrade gracefully — abort the agent but skip
- *  the rewrite). */
-function resolveTarget(frameSpeakId, lastEmittedSpeakId) {
-    if (frameSpeakId)
-        return frameSpeakId;
-    return lastEmittedSpeakId;
+/** Resolve which speak() id to walk back to. Prefers what speechmux echoes;
+ *  then the in-flight speak; then the last fully-emitted one. Returns null if
+ *  none is available (degrade gracefully — abort the agent, skip the rewrite). */
+function resolveTarget(frameSpeakId, ctx) {
+    return frameSpeakId ?? ctx.currentStreamingSpeakId ?? ctx.lastEmittedSpeakId;
 }
-export function reduceWalkback(prev, lastEmittedSpeakId, event) {
+export function reduceWalkback(prev, event, ctx) {
     switch (event.type) {
         case 'ws:incoming': {
             const f = event.frame;
             if (f.type === 'user')
                 return { next: prev, actions: [] };
+            // Only honour barge-in (abort/rollback) while a call is live. A frame
+            // arriving when dormant (e.g. in flight during teardown, or from a
+            // just-discarded client) must not abort an unrelated text-mode turn. (H3)
+            if (ctx.lifecycleKind !== 'active' && ctx.lifecycleKind !== 'activating') {
+                return { next: prev, actions: [] };
+            }
             const heardText = f.type === 'rollback' ? f.heard_text : '';
             const data = {
                 heard_text: heardText,
                 kind: f.type === 'rollback' ? 'rollback' : 'abort',
             };
-            const target = resolveTarget(f.speak_id, lastEmittedSpeakId);
+            const target = resolveTarget(f.speak_id, ctx);
             const actions = [{ kind: 'abort_agent' }, { kind: 'append_custom_entry', customType: VOICE_INTERRUPT_CUSTOM_TYPE, data }];
             if (target === null) {
                 // No target available → can't rewrite. Just abort + record the

package/server/dist/voice/fsm/state.js

@@ -13,7 +13,7 @@
 export function initialState() {
     return {
         lifecycle: { kind: 'dormant' },
-        message: { blocks: new Map() },
+        message: { blocks: new Map(), interrupted: false },
         walkback: { kind: 'idle' },
         interpreterApplied: false,
         lastEmittedSpeakId: null,

package/server/dist/voice/index.js

@@ -83,10 +83,20 @@ export function createVoiceExtension(opts) {
         let state = initialState();
         let lastCtx = null;
         let speechmuxClient = null;
-        /** Slot read by the `context` hook to return rewritten messages. */
-        let pendingContextRewrite = null;
+        // Monotonic generation tag for the speechmux client. Bumped on every
+        // open_ws and close_ws so a discarded client's late callbacks (frame /
+        // disconnect) and an in-flight connect that the call already abandoned
+        // can detect they are stale and no-op. See voice lifecycle review (H1/H2).
+        let clientGeneration = 0;
+        // Detaches the current client's onFrame/onDisconnect listeners. Captured
+        // on open so we can unsubscribe when discarding the client.
+        let detachClientListeners = null;
         // ---- Reducer driver --------------------------------------------------
-        const dispatch = async (event) => {
+        // Synchronous core: reduce + write back state + trace. Returns the actions
+        // to execute. Split out from `dispatch` so the `context` hook can run a
+        // reduction and read the resulting rewrite synchronously — pi's context
+        // hook must return the rewritten messages inline, and `dispatch` is async. (M5)
+        const reduceAndApply = (event) => {
             const evtTrace = traceEvent(event);
             const lifecycleBefore = state.lifecycle.kind;
             const { next, actions } = reduce(state, event, {
@@ -101,6 +111,10 @@ export function createVoiceExtension(opts) {
                     blocks: blockSummary(state.message.blocks),
                 }));
             }
+            return actions;
+        };
+        const dispatch = async (event) => {
+            const actions = reduceAndApply(event);
             for (const action of actions) {
                 try {
                     await execute(action);
@@ -126,6 +140,19 @@ export function createVoiceExtension(opts) {
                     return;
                 }
                 case 'send_user_message': {
+                    // Steer-on-activate (deliverAs:'steer'): preserve in-flight work
+                    // rather than aborting it. When the agent is busy, inject the
+                    // message into the running turn (no abort); when idle there's no
+                    // turn to steer into, so send normally to trigger the turn. (M7)
+                    if (action.deliverAs === 'steer') {
+                        if (lastCtx && !lastCtx.isIdle()) {
+                            pi.sendUserMessage(action.text, { deliverAs: 'steer' });
+                        }
+                        else {
+                            pi.sendUserMessage(action.text);
+                        }
+                        return;
+                    }
                     // Ensure the agent is idle before sending. If it isn't, fire
                     // a synthesized barge-in (ctx.abort()) and wait for teardown
                     // — covers the case where the user spoke while the worker
@@ -154,7 +181,11 @@ export function createVoiceExtension(opts) {
                     return;
                 }
                 case 'open_ws': {
-                    // Reentrancy guard: close any prior client first.
+                    // Invalidate any prior client: bump the generation so its in-flight
+                    // callbacks no-op, detach its listeners, and close it.
+                    clientGeneration++;
+                    detachClientListeners?.();
+                    detachClientListeners = null;
                     try {
                         speechmuxClient?.close();
                     }
@@ -162,24 +193,53 @@ export function createVoiceExtension(opts) {
                         /* ignore */
                     }
                     speechmuxClient = null;
+                    const gen = clientGeneration;
                     try {
                         const client = await clientFactory({ wsUrl: action.url });
+                        // If the call ended (or another open started) while we were
+                        // connecting, this client is stale — close it and bail. (H2)
+                        if (gen !== clientGeneration) {
+                            try {
+                                client.close();
+                            }
+                            catch {
+                                /* ignore */
+                            }
+                            return;
+                        }
                         speechmuxClient = client;
-                        client.onFrame((frame) => {
+                        const offFrame = client.onFrame((frame) => {
+                            if (gen !== clientGeneration)
+                                return;
                             void dispatch({ type: 'ws:incoming', frame });
                         });
-                        client.onDisconnect(() => {
+                        const offDisconnect = client.onDisconnect(() => {
+                            if (gen !== clientGeneration)
+                                return;
                             void dispatch({ type: 'ws:disconnected' });
                         });
+                        detachClientListeners = () => {
+                            offFrame();
+                            offDisconnect();
+                        };
                         await dispatch({ type: 'ws:opened' });
                     }
                     catch (err) {
+                        // A stale open's failure is irrelevant — the FSM has moved on.
+                        if (gen !== clientGeneration)
+                            return;
                         console.warn('[voice] speechmux open failed', err);
                         await dispatch({ type: 'ws:open_failed', error: err });
                     }
                     return;
                 }
                 case 'close_ws': {
+                    // Bump the generation so a client still mid-connect (and any late
+                    // close/frame callbacks from the current one) is invalidated and
+                    // auto-cleaned. (H1/H2)
+                    clientGeneration++;
+                    detachClientListeners?.();
+                    detachClientListeners = null;
                     try {
                         speechmuxClient?.close();
                     }
@@ -213,19 +273,16 @@ export function createVoiceExtension(opts) {
                     return;
                 }
                 case 'emit_deactivate_request': {
-                    const sessionId = state.lifecycle.kind === 'active' || state.lifecycle.kind === 'activating' ? state.lifecycle.sessionId : '';
+                    // sessionId is carried on the action (populated by the reducer from
+                    // the pre-transition state) — reading it from `state` here would be
+                    // too late, since the lifecycle has already gone dormant. (M1)
                     const msg = {
                         type: 'pimote:voice:deactivate',
-                        sessionId,
+                        sessionId: action.sessionId,
                     };
                     pi.events.emit('pimote:voice:deactivate', msg);
                     return;
                 }
-                case 'rewrite_context': {
-                    // Stash; the `context` hook below reads this on its return.
-                    pendingContextRewrite = action.messages;
-                    return;
-                }
             }
         };
         // ---- EventBus listeners ---------------------------------------------
@@ -319,43 +376,42 @@ export function createVoiceExtension(opts) {
             }
         });
         pi.on('turn_end', (event) => {
-            if (state.lifecycle.kind !== 'active' || !speechmuxClient)
-                return;
+            // Route through the FSM so the floor_released frame is buffered when the
+            // greeting turn ends before the WS handshake completes, instead of being
+            // dropped. Only dispatch when the turn actually spoke. (M2)
             const lastSpeakResult = [...event.toolResults].reverse().find((result) => result.toolName === 'speak');
             if (!lastSpeakResult)
                 return;
-            try {
-                speechmuxClient.send(typeof lastSpeakResult.toolCallId === 'string' ? { type: 'floor_released', speak_id: lastSpeakResult.toolCallId } : { type: 'floor_released' });
-            }
-            catch (err) {
-                console.warn('[voice] speechmux send failed', 'floor_released', err);
-            }
+            void dispatch({
+                type: 'sdk:turn_end',
+                lastSpeakToolCallId: typeof lastSpeakResult.toolCallId === 'string' ? lastSpeakResult.toolCallId : null,
+            });
         });
         pi.on('agent_end', (event) => {
-            if (state.lifecycle.kind !== 'active' || !speechmuxClient)
-                return;
+            // Route through the FSM (same buffering rationale as turn_end). (M2)
             const error = event.error;
-            if (typeof error !== 'string' || error.length === 0)
-                return;
-            try {
-                speechmuxClient.send({ type: 'error', message: error });
-            }
-            catch (err) {
-                console.warn('[voice] speechmux send failed', 'error', err);
-            }
+            void dispatch({ type: 'sdk:agent_end', error: typeof error === 'string' && error.length > 0 ? error : null });
         });
         pi.on('context', (event, ctx) => {
             lastCtx = ctx;
-            // The walkback reducer always runs walkBack (even when no rewrite
-            // is pending — to strip aborted-empty-assistants). It writes the
-            // result into `pendingContextRewrite` via the `rewrite_context`
-            // action, which we read below.
-            void dispatch({ type: 'sdk:context', messages: event.messages });
-            const result = pendingContextRewrite;
-            pendingContextRewrite = null;
-            if (result)
-                return { messages: result };
-            return undefined;
+            // The walkback reducer always runs walkBack (even when no rewrite is
+            // pending — to strip aborted-empty assistants) and emits the result as a
+            // `rewrite_context` action. Drive the reduction synchronously and read
+            // the rewrite straight off the returned actions: no module-level slot,
+            // no dependence on action ordering or on `execute` staying side-effect
+            // free before the rewrite. (M5)
+            const actions = reduceAndApply({ type: 'sdk:context', messages: event.messages });
+            let rewritten;
+            for (const action of actions) {
+                if (action.kind === 'rewrite_context') {
+                    rewritten = action.messages;
+                }
+                else {
+                    // Any other side effects still run on the normal async path.
+                    void execute(action);
+                }
+            }
+            return rewritten ? { messages: rewritten } : undefined;
         });
     };
 }