@vellumai/assistant 0.10.4 → 0.10.5-dev.202607022329.d89bf2f

package/src/runtime/guardian-reply-router.ts

@@ -43,7 +43,10 @@ import {
 } from "../notifications/guardian-question-mode.js";
 import { getLogger } from "../util/logger.js";
 import { runApprovalConversationTurn } from "./approval-conversation-turn.js";
-import type { ApprovalAction } from "./channel-approval-types.js";
+import {
+  type ApprovalAction,
+  isApprovalAction,
+} from "./channel-approval-types.js";
 import type {
   ApprovalConversationContext,
   ApprovalConversationGenerator,
@@ -143,8 +146,6 @@ export interface GuardianReplyResult {
 // Callback data parser — format: "apr:<requestId>:<action>"
 // ---------------------------------------------------------------------------
 
-const VALID_ACTIONS: ReadonlySet<string> = new Set(["approve_once", "reject"]);
-
 const LEGACY_CALLBACK_MAP: Record<string, string> = {
   approve_10m: "approve_once",
   approve_conversation: "approve_once",
@@ -158,12 +159,16 @@ interface ParsedCallback {
 
 function parseCallbackAction(data: string): ParsedCallback | null {
   const parts = data.split(":");
-  if (parts.length < 3 || parts[0] !== "apr") return null;
+  if (parts.length < 3 || parts[0] !== "apr") {
+    return null;
+  }
   const requestId = parts[1];
   const rawAction = parts.slice(2).join(":");
   const action = LEGACY_CALLBACK_MAP[rawAction] ?? rawAction;
-  if (!requestId || !VALID_ACTIONS.has(action)) return null;
-  return { requestId, action: action as ApprovalAction };
+  if (!requestId || !isApprovalAction(action)) {
+    return null;
+  }
+  return { requestId, action };
 }
 
 // ---------------------------------------------------------------------------
@@ -198,11 +203,15 @@ function parseRequestCode(
   // Request codes are 6 hex chars (A-F, 0-9), uppercase
   const upper = cleaned.toUpperCase();
   const match = upper.match(/^([A-F0-9]{6})(?:\s|$)/);
-  if (!match) return null;
+  if (!match) {
+    return null;
+  }
 
   const code = match[1];
   const request = getCanonicalGuardianRequestByCode(code);
-  if (!request) return null;
+  if (!request) {
+    return null;
+  }
 
   // Scope to the current conversation when requested, so a code belonging
   // to a different conversation is not consumed here. Requests with
@@ -501,9 +510,12 @@ export async function routeGuardianReply(
         };
       }
 
-      // Remaining text present — infer the decision action from it.
-      // If the text indicates rejection, use reject; otherwise approve_once.
-      const action = inferActionFromText(codeResult.remainingText);
+      // Remaining text present — infer the decision action from it, using
+      // the introduction-card verb set for access requests.
+      const action = inferActionFromText(
+        codeResult.remainingText,
+        request.kind,
+      );
 
       return applyDecision(
         request.id,
@@ -553,7 +565,12 @@ export async function routeGuardianReply(
   // approve/reject phrase ("approve", "yes", "reject", "no"), apply the
   // decision directly instead of falling through to legacy handlers.
   if (messageText.length > 0 && pendingRequests.length > 0) {
-    const inferredAction = inferDecisionActionFromFreeText(messageText);
+    // The action is only applied when exactly one request is pending, so the
+    // kind-aware verb set is used for that single known target.
+    const inferredAction = inferDecisionActionFromFreeText(
+      messageText,
+      pendingRequests.length === 1 ? pendingRequests[0].kind : undefined,
+    );
     if (inferredAction) {
       if (pendingRequests.length === 1) {
         return applyDecision(
@@ -640,8 +657,13 @@ export async function routeGuardianReply(
       };
     }
 
-    // Decision-bearing disposition from the engine
-    const decisionAction = engineResult.disposition as ApprovalAction;
+    // Decision-bearing disposition from the engine. The engine's allowed
+    // actions are a subset of ApprovalAction; an out-of-vocabulary
+    // disposition is not consumed as a decision.
+    if (!isApprovalAction(engineResult.disposition)) {
+      return notConsumed();
+    }
+    const decisionAction = engineResult.disposition;
 
     // Resolve the target request
     const targetId =
@@ -839,28 +861,107 @@ function normalizeDecisionPhrase(text: string): string {
     .replace(/\s+/g, " ");
 }
 
+/**
+ * Introduction-card phrases recognized without a request code. Checked before
+ * the generic reject vocabulary so a bare "block" on an access request maps
+ * to the block action (revoke) rather than the weaker leave-unverified
+ * outcome.
+ */
+const EXPLICIT_INTRODUCTION_PHRASES: ReadonlyMap<string, ApprovalAction> =
+  new Map([
+    ["trust", "trust"],
+    ["trust them", "trust"],
+    ["verify", "verify_code"],
+    ["verify them", "verify_code"],
+    ["block", "block"],
+    ["block them", "block"],
+    ["ban", "block"],
+    ["ban them", "block"],
+  ]);
+
 /**
  * Strict free-text decision parser used when no request code is present.
- * Returns null unless the message starts with an explicit approve/reject cue.
+ * Returns null unless the message starts with an explicit decision cue.
+ *
+ * For `access_request` targets the introduction-card verbs are recognized
+ * first, and the generic rejection vocabulary maps to `leave_unverified`
+ *.
+ *
+ * Exported for tests.
  */
-function inferDecisionActionFromFreeText(text: string): ApprovalAction | null {
+export function inferDecisionActionFromFreeText(
+  text: string,
+  requestKind?: string,
+): ApprovalAction | null {
   const normalized = normalizeDecisionPhrase(text);
-  if (!normalized) return null;
-  if (EXPLICIT_REJECT_PHRASES.has(normalized)) return "reject";
-  if (EXPLICIT_APPROVE_PHRASES.has(normalized)) return "approve_once";
+  if (!normalized) {
+    return null;
+  }
+  if (requestKind === "access_request") {
+    const introductionAction = EXPLICIT_INTRODUCTION_PHRASES.get(normalized);
+    if (introductionAction) {
+      return introductionAction;
+    }
+    if (EXPLICIT_REJECT_PHRASES.has(normalized)) {
+      return "leave_unverified";
+    }
+    if (EXPLICIT_APPROVE_PHRASES.has(normalized)) {
+      return "approve_once";
+    }
+    return null;
+  }
+  if (EXPLICIT_REJECT_PHRASES.has(normalized)) {
+    return "reject";
+  }
+  if (EXPLICIT_APPROVE_PHRASES.has(normalized)) {
+    return "approve_once";
+  }
   return null;
 }
 
+/**
+ * Introduction-card verbs for `access_request` requests. `trust` / `verify` /
+ * `block` map to their card actions; the generic reject vocabulary maps to
+ * leave-unverified (deny without revoking).
+ */
+const CODE_TRUST_PATTERNS = /^(trust|trusted)\b/i;
+const CODE_VERIFY_PATTERNS = /^(verify|verification|code|handshake)\b/i;
+const CODE_BLOCK_PATTERNS = /^(block|ban)\b/i;
+
 /**
  * Infer a guardian decision action from free-text after a request code.
  * Defaults to approve_once unless clear rejection language is detected.
+ *
+ * For `access_request` requests, the introduction-card verbs (trust / verify
+ * / block) are recognized first, and rejection vocabulary maps to
+ * `leave_unverified`.
  */
-function inferActionFromText(text: string): ApprovalAction {
+function inferActionFromText(
+  text: string,
+  requestKind?: string,
+): ApprovalAction {
   if (!text || text.trim().length === 0) {
     return "approve_once";
   }
+  const trimmed = text.trim();
+
+  if (requestKind === "access_request") {
+    if (CODE_BLOCK_PATTERNS.test(trimmed)) {
+      return "block";
+    }
+    if (CODE_TRUST_PATTERNS.test(trimmed)) {
+      return "trust";
+    }
+    if (CODE_VERIFY_PATTERNS.test(trimmed)) {
+      return "verify_code";
+    }
+    if (CODE_REJECT_PATTERNS.test(trimmed)) {
+      return "leave_unverified";
+    }
+    return "approve_once";
+  }
 
-  if (CODE_REJECT_PATTERNS.test(text.trim())) {
+  if (CODE_REJECT_PATTERNS.test(trimmed)) {
     return "reject";
   }
 

package/src/runtime/http-server.ts

@@ -11,13 +11,7 @@ import {
   activeMediaStreamSessions,
   MediaStreamCallSession,
 } from "../calls/media-stream-server.js";
-import type { RelayWebSocketData } from "../calls/relay-server.js";
 import {
-  activeRelayConnections,
-  RelayConnection,
-} from "../calls/relay-server.js";
-import {
-  handleConnectAction,
   handleStatusCallback,
   handleVoiceWebhook,
 } from "../calls/twilio-routes.js";
@@ -61,6 +55,7 @@ import { withErrorHandling } from "./middleware/error-handler.js";
 import {
   extractClientIp,
   ipRateLimiter,
+  isRateLimitExemptEndpoint,
   rateLimitHeaders,
   rateLimitResponse,
   selectAuthenticatedRateLimiter,
@@ -104,7 +99,7 @@ const MAX_REQUEST_BODY_BYTES = 512 * 1024 * 1024;
 /**
  * WebSocket data attached to `/v1/calls/media-stream` connections.
  * The `wsType` discriminator routes frames to the media-stream call
- * session instead of the ConversationRelay handlers.
+ * session instead of the other WebSocket handlers.
  */
 interface MediaStreamWebSocketData {
   wsType: "media-stream";
@@ -174,7 +169,6 @@ export class RuntimeHttpServer {
 
   async start(): Promise<void> {
     type AllWebSocketData =
-      | RelayWebSocketData
       | MediaStreamWebSocketData
       | SttStreamWebSocketData
       | LiveVoiceWebSocketData;
@@ -187,8 +181,8 @@ export class RuntimeHttpServer {
       websocket: {
         open: (ws) => {
           const data = ws.data as AllWebSocketData;
-          if ("wsType" in data && data.wsType === "media-stream") {
-            const msData = data as MediaStreamWebSocketData;
+          if (data.wsType === "media-stream") {
+            const msData = data;
             log.info(
               { callSessionId: msData.callSessionId },
               "Media-stream WebSocket opened",
@@ -204,8 +198,8 @@ export class RuntimeHttpServer {
             msData.session = session;
             return;
           }
-          if ("wsType" in data && data.wsType === "stt-stream") {
-            const sttData = data as SttStreamWebSocketData;
+          if (data.wsType === "stt-stream") {
+            const sttData = data;
 
             // The runtime is config-authoritative: always resolve the
             // provider from `services.stt.provider` regardless of what
@@ -275,34 +269,25 @@ export class RuntimeHttpServer {
             );
             return;
           }
-          if ("wsType" in data && data.wsType === "live-voice") {
+          if (data.wsType === "live-voice") {
             log.info("Live voice WebSocket opened");
             return;
           }
-          const callSessionId = (data as RelayWebSocketData).callSessionId;
-          log.info({ callSessionId }, "ConversationRelay WebSocket opened");
-          if (callSessionId) {
-            const connection = new RelayConnection(
-              ws as ServerWebSocket<RelayWebSocketData>,
-              callSessionId,
-            );
-            activeRelayConnections.set(callSessionId, connection);
-          }
+          log.warn("WebSocket opened with unknown data type — closing");
+          ws.close(1008, "Unknown WebSocket type");
         },
         message: (ws, message) => {
           const data = ws.data as AllWebSocketData;
-          const raw =
-            typeof message === "string"
-              ? message
-              : new TextDecoder().decode(message);
-          if ("wsType" in data && data.wsType === "media-stream") {
-            const msData = data as MediaStreamWebSocketData;
-            msData.session?.handleMessage(raw);
+          if (data.wsType === "media-stream") {
+            const raw =
+              typeof message === "string"
+                ? message
+                : new TextDecoder().decode(message);
+            data.session?.handleMessage(raw);
             return;
           }
-          if ("wsType" in data && data.wsType === "stt-stream") {
-            const sttData = data as SttStreamWebSocketData;
-            const session = sttData.session;
+          if (data.wsType === "stt-stream") {
+            const session = data.session;
             if (!session) return;
 
             if (typeof message === "string") {
@@ -317,7 +302,7 @@ export class RuntimeHttpServer {
             }
             return;
           }
-          if ("wsType" in data && data.wsType === "live-voice") {
+          if (data.wsType === "live-voice") {
             void this.handleLiveVoiceMessage(
               ws as ServerWebSocket<LiveVoiceWebSocketData>,
               message,
@@ -336,16 +321,13 @@ export class RuntimeHttpServer {
             });
             return;
           }
-          const callSessionId = (data as RelayWebSocketData).callSessionId;
-          if (callSessionId) {
-            const connection = activeRelayConnections.get(callSessionId);
-            connection?.handleMessage(raw);
-          }
+          log.warn("WebSocket message on unknown data type — closing");
+          ws.close(1008, "Unknown WebSocket type");
         },
         close: (ws, code, reason) => {
           const data = ws.data as AllWebSocketData;
-          if ("wsType" in data && data.wsType === "media-stream") {
-            const msData = data as MediaStreamWebSocketData;
+          if (data.wsType === "media-stream") {
+            const msData = data;
             log.info(
               {
                 callSessionId: msData.callSessionId,
@@ -372,8 +354,8 @@ export class RuntimeHttpServer {
             }
             return;
           }
-          if ("wsType" in data && data.wsType === "stt-stream") {
-            const sttData = data as SttStreamWebSocketData;
+          if (data.wsType === "stt-stream") {
+            const sttData = data;
             log.info(
               {
                 provider: sttData.provider,
@@ -394,7 +376,7 @@ export class RuntimeHttpServer {
             }
             return;
           }
-          if ("wsType" in data && data.wsType === "live-voice") {
+          if (data.wsType === "live-voice") {
             log.info(
               {
                 sessionId: data.sessionId,
@@ -406,17 +388,10 @@ export class RuntimeHttpServer {
             this.releaseLiveVoiceSession(data, "websocket_close");
             return;
           }
-          const callSessionId = (data as RelayWebSocketData).callSessionId;
-          log.info(
-            { callSessionId, code, reason: reason?.toString() },
-            "ConversationRelay WebSocket closed",
+          log.warn(
+            { code, reason: reason?.toString() },
+            "WebSocket with unknown data type closed",
           );
-          if (callSessionId) {
-            const connection = activeRelayConnections.get(callSessionId);
-            connection?.handleTransportClosed(code, reason?.toString());
-            connection?.destroy();
-            activeRelayConnections.delete(callSessionId);
-          }
         },
       },
     });
@@ -551,17 +526,9 @@ export class RuntimeHttpServer {
       return handleReadyz();
     }
 
-    // WebSocket upgrade for ConversationRelay — before auth check because
-    // Twilio WebSocket connections don't use bearer tokens.
-    if (
-      path.startsWith("/v1/calls/relay") &&
-      req.headers.get("upgrade")?.toLowerCase() === "websocket"
-    ) {
-      return this.handleRelayUpgrade(req, server);
-    }
-
-    // WebSocket upgrade for Twilio Media Streams — same private-network
-    // restrictions as relay upgrades.
+    // WebSocket upgrade for Twilio Media Streams — before auth check because
+    // Twilio WebSocket connections don't use bearer tokens; restricted to
+    // private-network peers with a gateway service token.
     if (
       path.startsWith("/v1/calls/media-stream") &&
       req.headers.get("upgrade")?.toLowerCase() === "websocket"
@@ -686,8 +653,13 @@ export class RuntimeHttpServer {
         ? selectAuthenticatedRateLimiter(clientIp)
         : ipRateLimiter;
       const limiterKind = token ? "authenticated" : "unauthenticated";
-      const result = limiter.check(clientIp, path);
-      if (!result.allowed) {
+      // Streaming (SSE) and liveness endpoints bypass the per-minute request
+      // limiter — see isRateLimitExemptEndpoint. `result` stays null for them,
+      // so no 429 is returned and no rate-limit headers are attached.
+      const result = isRateLimitExemptEndpoint(endpoint)
+        ? null
+        : limiter.check(clientIp, path);
+      if (result && !result.allowed) {
         return rateLimitResponse(result, {
           clientIp,
           deniedPath: path,
@@ -705,8 +677,10 @@ export class RuntimeHttpServer {
       const response =
         routerResponse ?? httpError("NOT_FOUND", "Not found", 404);
       const headers = new Headers(response.headers);
-      for (const [k, v] of Object.entries(rateLimitHeaders(result))) {
-        headers.set(k, v);
+      if (result) {
+        for (const [k, v] of Object.entries(rateLimitHeaders(result))) {
+          headers.set(k, v);
+        }
       }
       return new Response(response.body, {
         status: response.status,
@@ -747,35 +721,6 @@ export class RuntimeHttpServer {
     return null;
   }
 
-  private handleRelayUpgrade(
-    req: Request,
-    server: ReturnType<typeof Bun.serve>,
-  ): Response {
-    if (!isPrivateNetworkPeer(server, req) || !isPrivateNetworkOrigin(req)) {
-      return httpError(
-        "FORBIDDEN",
-        "Direct relay access disabled — only private network peers allowed",
-        403,
-      );
-    }
-
-    // Verify the gateway service token before accepting the upgrade.
-    const tokenError = this.verifyGatewayServiceToken(req);
-    if (tokenError) return tokenError;
-
-    const wsUrl = new URL(req.url);
-    const callSessionId = wsUrl.searchParams.get("callSessionId");
-    if (!callSessionId) {
-      return new Response("Missing callSessionId", { status: 400 });
-    }
-    const upgraded = server.upgrade(req, { data: { callSessionId } });
-    if (!upgraded) {
-      return new Response("WebSocket upgrade failed", { status: 500 });
-    }
-    // Bun's WebSocket upgrade consumes the request — no Response is sent.
-    return undefined!;
-  }
-
   private handleMediaStreamUpgrade(
     req: Request,
     server: ReturnType<typeof Bun.serve>,
@@ -798,7 +743,7 @@ export class RuntimeHttpServer {
       return new Response("Missing callSessionId", { status: 400 });
     }
     // Media-stream connections use a distinct wsType so the open/message/close
-    // handlers route them to MediaStreamCallSession instead of RelayConnection.
+    // handlers route them to MediaStreamCallSession.
     const upgraded = server.upgrade(req, {
       data: {
         wsType: "media-stream",
@@ -815,7 +760,7 @@ export class RuntimeHttpServer {
   /**
    * Handle WebSocket upgrade for `/v1/stt/stream`.
    *
-   * Private-network restrictions apply (same as relay/media-stream) so the
+   * Private-network restrictions apply (same as media-stream) so the
    * runtime remains unreachable from the public internet. The gateway
    * authenticates the downstream client and proxies the upgrade with a
    * short-lived gateway service token.
@@ -1071,8 +1016,6 @@ export class RuntimeHttpServer {
       return await handleVoiceWebhook(validatedReq);
     if (twilioSubpath === "status")
       return await handleStatusCallback(validatedReq);
-    if (twilioSubpath === "connect-action")
-      return await handleConnectAction(validatedReq);
 
     return null;
   }