@vellumai/assistant 0.10.0 → 0.10.1-dev.202606240317.ea25efe

package/src/calls/relay-verification.ts

@@ -224,7 +224,8 @@ interface InviteRedemptionParams {
   inviteRedemptionAssistantId: string;
   inviteRedemptionFromNumber: string;
   enteredCode: string;
-  inviteRedemptionGuardianName: string | null;
+  /** Resolved guardian label used in the failure TTS message. */
+  guardianLabel: string;
 }
 
 type InviteRedemptionResult =
@@ -244,17 +245,17 @@ type InviteRedemptionResult =
  * caller. Returns a structured result so the caller can handle state
  * mutations and session updates.
  */
-export function attemptInviteCodeRedemption(
+export async function attemptInviteCodeRedemption(
   params: InviteRedemptionParams,
-): InviteRedemptionResult {
+): Promise<InviteRedemptionResult> {
   const {
     inviteRedemptionAssistantId,
     inviteRedemptionFromNumber,
     enteredCode,
-    inviteRedemptionGuardianName,
+    guardianLabel,
   } = params;
 
-  const result = redeemVoiceInviteCode({
+  const result = await redeemVoiceInviteCode({
     assistantId: inviteRedemptionAssistantId,
     callerExternalUserId: inviteRedemptionFromNumber,
     sourceChannel: "phone",
@@ -270,9 +271,8 @@ export function attemptInviteCodeRedemption(
     };
   }
 
-  const displayGuardian = inviteRedemptionGuardianName ?? "your contact";
   return {
     outcome: "failure",
-    ttsMessage: `Sorry, the code you provided is incorrect or has since expired. Please ask ${displayGuardian} for a new code. Goodbye.`,
+    ttsMessage: `Sorry, the code you provided is incorrect or has since expired. Please ask ${guardianLabel} for a new code. Goodbye.`,
   };
 }

package/src/calls/stt-hints.ts

@@ -1,9 +1,8 @@
+import { findContactByAddress, listContacts } from "../contacts/contact-store.js";
 import {
-  findContactByAddress,
-  findGuardianForChannel,
-  listContacts,
-  listGuardianChannels,
-} from "../contacts/contact-store.js";
+  getGuardianDelivery,
+  voiceGuardianDisplayName,
+} from "../contacts/guardian-delivery-reader.js";
 import { getAssistantName } from "../daemon/identity-helpers.js";
 import { DEFAULT_USER_REFERENCE, resolveGuardianName } from "../prompts/user-reference.js";
 import { getLogger } from "../util/logger.js";
@@ -119,7 +118,7 @@ export function buildSttHints(input: SttHintsInput): string {
  * {@link buildSttHints}. All DB lookups are best-effort — errors are
  * logged but never propagate so hints can never fail a call.
  */
-export function resolveCallHints(
+export async function resolveCallHints(
   session: {
     task: string | null;
     toNumber: string;
@@ -129,16 +128,14 @@ export function resolveCallHints(
     inviteGuardianName: string | null;
   } | null,
   staticHints: string[],
-): string {
+): Promise<string> {
   const assistantName = getAssistantName();
 
-  // Look up the guardian contact for a displayName fallback (mirrors relay-server pattern)
+  // Resolve the guardian displayName from the gateway binding for STT vocabulary.
   let guardianDisplayName: string | undefined;
   try {
-    const voiceGuardian = findGuardianForChannel("phone");
-    const guardianChannels = voiceGuardian ? null : listGuardianChannels();
-    const guardianContact = voiceGuardian?.contact ?? guardianChannels?.contact;
-    guardianDisplayName = guardianContact?.displayName;
+    const list = await getGuardianDelivery();
+    guardianDisplayName = voiceGuardianDisplayName(list);
   } catch (err) {
     logger.warn({ err }, "Failed to look up guardian contact for STT hints");
   }

package/src/calls/twilio-routes.ts

@@ -55,6 +55,7 @@ import {
   updateCallSession,
 } from "./call-store.js";
 import { getChannelAdmissionPolicy } from "./channel-admission-reader.js";
+import { getPhoneCallerVerdict } from "./inbound-trust-reader.js";
 import { routeSetup } from "./relay-setup-router.js";
 import { resolveCallHints } from "./stt-hints.js";
 import { resolveTelephonySttRouting } from "./telephony-stt-routing.js";
@@ -484,12 +485,21 @@ async function buildVoiceWebhookTwiml(
   // admits the caller.
   const admissionPolicy = await getChannelAdmissionPolicy("phone");
 
+  // Verdict-first caller trust so this preflight matches handleSetup's ACL.
+  // routeSetup uses it when present and not resolutionFailed, else falls back
+  // to local resolution. The reader returns null on failure, keeping the
+  // local path on a gateway blip.
+  const isInbound = sessionContext?.direction !== "outbound";
+  const otherPartyNumber = isInbound ? from : to;
+  const verdict = await getPhoneCallerVerdict(otherPartyNumber);
+
   const { outcome } = routeSetup({
     callSessionId,
     session: session ?? null,
     from,
     to,
     admissionPolicy,
+    verdict,
   });
 
   // The media-stream transport supports normal_call and deny (which speaks
@@ -522,7 +532,7 @@ async function buildVoiceWebhookTwiml(
 /**
  * Build ConversationRelay TwiML for Twilio-native STT providers.
  */
-function buildConversationRelayTwiml(
+async function buildConversationRelayTwiml(
   callSessionId: string,
   profile: ReturnType<typeof resolveVoiceQualityProfile>,
   sessionContext: {
@@ -535,8 +545,8 @@ function buildConversationRelayTwiml(
   } | null,
   verificationSessionId: string | null | undefined,
   sttAttrs: { transcriptionProvider: string; speechModel: string | undefined },
-): string {
-  const rawHints = resolveCallHints(sessionContext, profile.hints);
+): Promise<string> {
+  const rawHints = await resolveCallHints(sessionContext, profile.hints);
 
   const speechConfig: TwilioRelaySpeechConfig = {
     transcriptionProvider: sttAttrs.transcriptionProvider,

package/src/cli/commands/__tests__/cache.test.ts

@@ -88,8 +88,15 @@ mock.module("../../../util/logger.js", () => ({
 }));
 
 mock.module("../../lib/cache-fs.js", () => ({
-  readFileSync: (path: string, encoding?: BufferEncoding) => {
+  readFileSync: (path: string | number, encoding?: BufferEncoding) => {
+    // Stdin must be read via fd 0, not by reopening "/dev/stdin": a spawned
+    // subprocess whose stdin is a pipe (Bun.spawn stdin:"pipe") cannot reopen
+    // its read-end by path — open("/dev/stdin") fails ENXIO. Throwing here on
+    // the path makes any regression to path-based reading fail loudly.
     if (path === "/dev/stdin") {
+      throw new Error("ENXIO: no such device or address, open '/dev/stdin'");
+    }
+    if (path === 0) {
       if (mockStdinContent === null) {
         throw new Error("EAGAIN: resource temporarily unavailable");
       }

package/src/cli/commands/cache.ts

@@ -17,6 +17,9 @@ import { log } from "../logger.js";
 /** Warn (stderr) when a raw payload exceeds this byte count. */
 const MAX_PAYLOAD_BYTES = 1_000_000; // 1 MB
 
+/** Standard input file descriptor. */
+const STDIN_FD = 0;
+
 // ── TTL parsing ───────────────────────────────────────────────────────
 
 const TTL_PATTERN = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h)$/;
@@ -99,6 +102,11 @@ function parseJsonPayload(raw: string, source: string): unknown {
  * Read JSON payload from stdin when piped. Throws when stdin is a TTY
  * (no piped input) or when the input is empty/invalid JSON, so the CLI
  * can surface actionable parse errors.
+ *
+ * Reads file descriptor 0 directly rather than reopening the `/dev/stdin`
+ * path. When the caller is a spawned subprocess whose stdin is a pipe (e.g.
+ * `Bun.spawn(..., { stdin: "pipe" })`), `open("/dev/stdin")` fails with ENXIO
+ * because a pipe read-end cannot be reopened by path; the fd is readable.
  */
 function readPayloadFromStdin(): unknown {
   if (process.stdin.isTTY) {
@@ -111,7 +119,7 @@ function readPayloadFromStdin(): unknown {
 
   let raw: string;
   try {
-    raw = readFileSync("/dev/stdin", "utf-8");
+    raw = readFileSync(STDIN_FD, "utf-8");
   } catch (err) {
     throw new Error(
       `Failed to read stdin: ${err instanceof Error ? err.message : String(err)}.\n` +
@@ -173,10 +181,9 @@ export function registerCacheCommand(program: Command): void {
     transport: "ipc",
     description: "Interact with the assistant's in-memory key/value cache",
     build: (cache) => {
-
-  cache.addHelpText(
-    "after",
-    `
+      cache.addHelpText(
+        "after",
+        `
 The cache is a TTL-aware, LRU-evicting in-memory store managed by the
 running assistant. Data is scoped to the assistant process lifetime and
 is not persisted across restarts.
@@ -190,33 +197,33 @@ Examples:
   $ echo '{"result": [1,2,3]}' | assistant cache set --ttl 5m
   $ assistant cache get my-key
   $ assistant cache delete my-key`,
-  );
-
-  // ── set ───────────────────────────────────────────────────────────
-
-  cache
-    .command("set")
-    .description("Store a JSON value in the cache")
-    .option(
-      "--key <key>",
-      "Cache key for idempotent upsert. Omit to auto-generate.",
-    )
-    .option(
-      "--ttl <duration>",
-      "Time-to-live (minimum 1s). Units: ms, s, m, h (e.g. 1000ms, 30s, 5m, 2h). Defaults to 30m if omitted.",
-    )
-    .option(
-      "--value <json>",
-      "JSON payload to store. Alternative to piping via stdin.",
-    )
-    .option(
-      "--file <path>",
-      "Path to a file containing the JSON payload. Alternative to piping via stdin.",
-    )
-    .option("--json", "Output result as machine-readable JSON.")
-    .addHelpText(
-      "after",
-      `
+      );
+
+      // ── set ───────────────────────────────────────────────────────────
+
+      cache
+        .command("set")
+        .description("Store a JSON value in the cache")
+        .option(
+          "--key <key>",
+          "Cache key for idempotent upsert. Omit to auto-generate.",
+        )
+        .option(
+          "--ttl <duration>",
+          "Time-to-live (minimum 1s). Units: ms, s, m, h (e.g. 1000ms, 30s, 5m, 2h). Defaults to 30m if omitted.",
+        )
+        .option(
+          "--value <json>",
+          "JSON payload to store. Alternative to piping via stdin.",
+        )
+        .option(
+          "--file <path>",
+          "Path to a file containing the JSON payload. Alternative to piping via stdin.",
+        )
+        .option("--json", "Output result as machine-readable JSON.")
+        .addHelpText(
+          "after",
+          `
 Stores a JSON payload in the cache and prints the assigned key. The payload
 can be provided via --value, --file, or piped through stdin. If --key is
 provided, the entry is upserted (created or replaced). If omitted, a new
@@ -240,86 +247,86 @@ Examples:
   $ assistant cache set --file /tmp/payload.json --key scores --ttl 10m
   $ echo '{"scores":[98,85,72]}' | assistant cache set
   $ echo '"simple string"' | assistant cache set --ttl 1h --json`,
-    )
-    .action(
-      async (opts: {
-        key?: string;
-        ttl?: string;
-        value?: string;
-        file?: string;
-        json?: boolean;
-      }) => {
-        let data: unknown;
-        try {
-          data = resolvePayload(opts);
-        } catch (err) {
-          const msg = err instanceof Error ? err.message : String(err);
-          if (opts.json) {
-            process.stdout.write(
-              JSON.stringify({ ok: false, error: msg }) + "\n",
-            );
-          } else {
-            log.error(msg);
-          }
-          process.exitCode = 1;
-          return;
-        }
-
-        let ttl_ms: number | undefined;
-        try {
-          ttl_ms = parseTtl(opts.ttl);
-        } catch (err) {
-          const msg = err instanceof Error ? err.message : String(err);
-          if (opts.json) {
-            process.stdout.write(
-              JSON.stringify({ ok: false, error: msg }) + "\n",
-            );
-          } else {
-            log.error(msg);
-          }
-          process.exitCode = 1;
-          return;
-        }
-
-        const params: Record<string, unknown> = { data };
-        if (ttl_ms !== undefined) params.ttl_ms = ttl_ms;
-        if (opts.key) params.key = opts.key;
-
-        const result = await cliIpcCall<{ key: string }>("cache_set", {
-          body: params,
-        });
-
-        if (!result.ok) {
-          if (opts.json) {
-            process.stdout.write(
-              JSON.stringify({ ok: false, error: result.error }) + "\n",
-            );
-          } else {
-            log.error(`Error: ${result.error}`);
-          }
-          process.exitCode = 1;
-          return;
-        }
-
-        if (opts.json) {
-          process.stdout.write(
-            JSON.stringify({ ok: true, key: result.result!.key }) + "\n",
-          );
-        } else {
-          log.info(`Cached with key: ${result.result!.key}`);
-        }
-      },
-    );
+        )
+        .action(
+          async (opts: {
+            key?: string;
+            ttl?: string;
+            value?: string;
+            file?: string;
+            json?: boolean;
+          }) => {
+            let data: unknown;
+            try {
+              data = resolvePayload(opts);
+            } catch (err) {
+              const msg = err instanceof Error ? err.message : String(err);
+              if (opts.json) {
+                process.stdout.write(
+                  JSON.stringify({ ok: false, error: msg }) + "\n",
+                );
+              } else {
+                log.error(msg);
+              }
+              process.exitCode = 1;
+              return;
+            }
+
+            let ttl_ms: number | undefined;
+            try {
+              ttl_ms = parseTtl(opts.ttl);
+            } catch (err) {
+              const msg = err instanceof Error ? err.message : String(err);
+              if (opts.json) {
+                process.stdout.write(
+                  JSON.stringify({ ok: false, error: msg }) + "\n",
+                );
+              } else {
+                log.error(msg);
+              }
+              process.exitCode = 1;
+              return;
+            }
+
+            const params: Record<string, unknown> = { data };
+            if (ttl_ms !== undefined) params.ttl_ms = ttl_ms;
+            if (opts.key) params.key = opts.key;
+
+            const result = await cliIpcCall<{ key: string }>("cache_set", {
+              body: params,
+            });
+
+            if (!result.ok) {
+              if (opts.json) {
+                process.stdout.write(
+                  JSON.stringify({ ok: false, error: result.error }) + "\n",
+                );
+              } else {
+                log.error(`Error: ${result.error}`);
+              }
+              process.exitCode = 1;
+              return;
+            }
+
+            if (opts.json) {
+              process.stdout.write(
+                JSON.stringify({ ok: true, key: result.result!.key }) + "\n",
+              );
+            } else {
+              log.info(`Cached with key: ${result.result!.key}`);
+            }
+          },
+        );
 
-  // ── get ───────────────────────────────────────────────────────────
+      // ── get ───────────────────────────────────────────────────────────
 
-  cache
-    .command("get <key>")
-    .description("Retrieve a cached value by key")
-    .option("--json", "Output result as machine-readable JSON.")
-    .addHelpText(
-      "after",
-      `
+      cache
+        .command("get <key>")
+        .description("Retrieve a cached value by key")
+        .option("--json", "Output result as machine-readable JSON.")
+        .addHelpText(
+          "after",
+          `
 Arguments:
   key   The cache key to look up. Run 'assistant cache set' to store a
         value and receive its key.
@@ -331,49 +338,52 @@ exist or has expired, reports not-found. In --json mode, a miss returns
 Examples:
   $ assistant cache get my-key
   $ assistant cache get my-key --json`,
-    )
-    .action(async (key: string, opts: { json?: boolean }) => {
-      const result = await cliIpcCall<{ data: unknown } | null>("cache_get", {
-        body: { key },
-      });
-
-      if (!result.ok) {
-        if (opts.json) {
-          process.stdout.write(
-            JSON.stringify({ ok: false, error: result.error }) + "\n",
+        )
+        .action(async (key: string, opts: { json?: boolean }) => {
+          const result = await cliIpcCall<{ data: unknown } | null>(
+            "cache_get",
+            {
+              body: { key },
+            },
           );
-        } else {
-          log.error(`Error: ${result.error}`);
-        }
-        process.exitCode = 1;
-        return;
-      }
-
-      if (opts.json) {
-        process.stdout.write(
-          JSON.stringify({
-            ok: true,
-            data: result.result ? result.result.data : null,
-          }) + "\n",
-        );
-      } else {
-        if (result.result == null) {
-          log.info(`No cache entry found for key "${key}".`);
-        } else {
-          log.info(JSON.stringify(result.result.data, null, 2));
-        }
-      }
-    });
-
-  // ── delete ────────────────────────────────────────────────────────
-
-  cache
-    .command("delete <key>")
-    .description("Remove a cached entry by key")
-    .option("--json", "Output result as machine-readable JSON.")
-    .addHelpText(
-      "after",
-      `
+
+          if (!result.ok) {
+            if (opts.json) {
+              process.stdout.write(
+                JSON.stringify({ ok: false, error: result.error }) + "\n",
+              );
+            } else {
+              log.error(`Error: ${result.error}`);
+            }
+            process.exitCode = 1;
+            return;
+          }
+
+          if (opts.json) {
+            process.stdout.write(
+              JSON.stringify({
+                ok: true,
+                data: result.result ? result.result.data : null,
+              }) + "\n",
+            );
+          } else {
+            if (result.result == null) {
+              log.info(`No cache entry found for key "${key}".`);
+            } else {
+              log.info(JSON.stringify(result.result.data, null, 2));
+            }
+          }
+        });
+
+      // ── delete ────────────────────────────────────────────────────────
+
+      cache
+        .command("delete <key>")
+        .description("Remove a cached entry by key")
+        .option("--json", "Output result as machine-readable JSON.")
+        .addHelpText(
+          "after",
+          `
 Arguments:
   key   The cache key to remove. Run 'assistant cache get <key>' to
         verify a key exists before deleting.
@@ -384,36 +394,39 @@ existed or not, but reports whether an entry was actually removed.
 Examples:
   $ assistant cache delete my-key
   $ assistant cache delete my-key --json`,
-    )
-    .action(async (key: string, opts: { json?: boolean }) => {
-      const result = await cliIpcCall<{ deleted: boolean }>("cache_delete", {
-        body: { key },
-      });
-
-      if (!result.ok) {
-        if (opts.json) {
-          process.stdout.write(
-            JSON.stringify({ ok: false, error: result.error }) + "\n",
+        )
+        .action(async (key: string, opts: { json?: boolean }) => {
+          const result = await cliIpcCall<{ deleted: boolean }>(
+            "cache_delete",
+            {
+              body: { key },
+            },
           );
-        } else {
-          log.error(`Error: ${result.error}`);
-        }
-        process.exitCode = 1;
-        return;
-      }
-
-      const deleted = result.result!.deleted;
-
-      if (opts.json) {
-        process.stdout.write(JSON.stringify({ ok: true, deleted }) + "\n");
-      } else {
-        if (deleted) {
-          log.info(`Deleted cache entry "${key}".`);
-        } else {
-          log.info(`No cache entry "${key}" (nothing to delete).`);
-        }
-      }
-    });
+
+          if (!result.ok) {
+            if (opts.json) {
+              process.stdout.write(
+                JSON.stringify({ ok: false, error: result.error }) + "\n",
+              );
+            } else {
+              log.error(`Error: ${result.error}`);
+            }
+            process.exitCode = 1;
+            return;
+          }
+
+          const deleted = result.result!.deleted;
+
+          if (opts.json) {
+            process.stdout.write(JSON.stringify({ ok: true, deleted }) + "\n");
+          } else {
+            if (deleted) {
+              log.info(`Deleted cache entry "${key}".`);
+            } else {
+              log.info(`No cache entry "${key}" (nothing to delete).`);
+            }
+          }
+        });
     },
   });
 }

package/src/cli/commands/contacts.ts

@@ -614,22 +614,10 @@ Examples:
         .option("--note <note>", "Optional note")
         .option("--max-uses <n>", "Max redemptions")
         .option("--expires-in-ms <ms>", "Expiry duration in milliseconds")
-        .option(
-          "--contact-name <name>",
-          "Contact name for personalizing instructions",
-        )
         .option(
           "--expected-external-user-id <id>",
           "E.164 phone number (required for voice invites)",
         )
-        .option(
-          "--friend-name <name>",
-          "Friend name (required for voice invites)",
-        )
-        .option(
-          "--guardian-name <name>",
-          "Guardian name (required for voice invites)",
-        )
         .requiredOption(
           "--contact-id <id>",
           "Contact ID to bind the invite to",
@@ -640,20 +628,20 @@ Examples:
 Creates a new invite token for the specified source channel. The --source-channel
 flag is required and must be one of: telegram, phone, email, whatsapp.
 
+The invitee's display name is read from the bound contact (--contact-id);
+the guardian label is resolved at runtime. There are no free-text name flags.
+
 Optional fields:
   --note                        Free-text note attached to the invite
   --max-uses                    Maximum number of times the invite can be redeemed
   --expires-in-ms               Expiry duration in milliseconds from creation
-  --contact-name                Name used to personalize invite instructions
 
-Voice invites require three additional fields:
+Voice invites also require:
   --expected-external-user-id   E.164 phone number of the expected caller (e.g. +15551234567)
-  --friend-name                 Name the contact uses for the assistant's owner
-  --guardian-name                Name of the guardian associated with this invite
 
 Examples:
-  $ assistant contacts invites create --source-channel telegram --note "For Alice" --max-uses 1
-  $ assistant contacts invites create --source-channel phone --expected-external-user-id "+15551234567" --friend-name "Alice" --guardian-name "Bob" --contact-name "Alice Smith"`,
+  $ assistant contacts invites create --source-channel telegram --contact-id <id> --note "For Alice" --max-uses 1
+  $ assistant contacts invites create --source-channel phone --contact-id <id> --expected-external-user-id "+15551234567"`,
         )
         .action(
           async (
@@ -662,10 +650,7 @@ Examples:
               note?: string;
               maxUses?: string;
               expiresInMs?: string;
-              contactName?: string;
               expectedExternalUserId?: string;
-              friendName?: string;
-              guardianName?: string;
               contactId: string;
             },
             cmd: Command,
@@ -704,10 +689,7 @@ Examples:
                 note: opts.note,
                 maxUses,
                 expiresInMs,
-                contactName: opts.contactName,
                 expectedExternalUserId: opts.expectedExternalUserId,
-                friendName: opts.friendName,
-                guardianName: opts.guardianName,
                 contactId: opts.contactId,
               },
             });