Export document reading with Remote lease safeguards

internal/app/read_all.go

@@ -19,11 +19,13 @@ func presentReadAllResult(logger *slog.Logger, speech speechEnqueuer, result rev
 		return
 	}
 	text := ""
+	origin := speechOriginUnknown
 	var parts []readAllPart
 	if result.Err != nil {
 		logger.Warn("read all failed", "error", result.Err)
 		text = "Could not read from current location."
 	} else {
+		origin = speechOriginLocal
 		// Keep semantic roles audible in continuous reading, without firing all
 		// the page's sound cues before the speech has reached those objects.
 		options.RoleSoundPresentation = "sound_and_speech"
@@ -38,6 +40,12 @@ func presentReadAllResult(logger *slog.Logger, speech speechEnqueuer, result rev
 		options.ReadFullRowInGUITable = false
 		for index, line := range result.ReadAllLines {
 			if spoken := presentation.DocumentLineSpeechWithOptions(line, options); spoken.Text != "" {
+				// One request owns the original observation ticket. Conservatively
+				// keep the entire reading private if any spoken line is sensitive
+				// or lacks source metadata, including sentence-mode continuations.
+				if source := document_line_speech_origin(line); source != speechOriginLocal {
+					origin = source
+				}
 				var began func()
 				if result.ReadAllProgress != nil {
 					began = func() { result.ReadAllProgress(index) }
@@ -61,7 +69,7 @@ func presentReadAllResult(logger *slog.Logger, speech speechEnqueuer, result rev
 		}
 	}
 	if text != "" || len(parts) != 0 {
-		speech.Enqueue(speechRequest{Text: text, ReadAll: parts, Role: "system", Cause: "read-all", context: result.ReadAllContext})
+		speech.Enqueue(speechRequest{origin: origin, Text: text, ReadAll: parts, Role: "system", Cause: "read-all", context: result.ReadAllContext})
 	}
 }