@vellumai/assistant 0.10.4 → 0.10.5-dev.202607022329.d89bf2f

package/src/runtime/middleware/twilio-validation.ts

@@ -2,7 +2,7 @@
  * Twilio webhook signature validation and related constants.
  */
 
-import { TwilioConversationRelayProvider } from "../../calls/twilio-provider.js";
+import { TwilioVoiceProvider } from "../../calls/twilio-provider.js";
 import { loadConfig } from "../../config/loader.js";
 import { getPublicBaseUrl } from "../../inbound/public-ingress-urls.js";
 import { getLogger } from "../../util/logger.js";
@@ -27,19 +27,17 @@ export const TWILIO_GATEWAY_WEBHOOK_RE = /^\/webhooks\/twilio\/(.+)$/;
 export const GATEWAY_SUBPATH_MAP: Record<string, string> = {
   voice: "voice-webhook",
   status: "status",
-  "connect-action": "connect-action",
 };
 
 /**
  * Direct Twilio webhook subpaths that are blocked in gateway_only mode.
- * Includes all public-facing webhook paths (voice, status, connect-action)
- * because the runtime must never serve as a direct ingress for external webhooks.
+ * Includes all public-facing webhook paths (voice, status) because the
+ * runtime must never serve as a direct ingress for external webhooks.
  * Internal forwarding endpoints (gateway->runtime) are unaffected.
  */
 export const GATEWAY_ONLY_BLOCKED_SUBPATHS = new Set([
   "voice-webhook",
   "status",
-  "connect-action",
 ]);
 
 /**
@@ -57,7 +55,7 @@ export async function validateTwilioWebhook(
 ): Promise<{ body: string } | Response> {
   const rawBody = await req.text();
 
-  const authToken = await TwilioConversationRelayProvider.getAuthToken();
+  const authToken = await TwilioVoiceProvider.getAuthToken();
 
   if (!authToken) {
     log.error(
@@ -95,7 +93,7 @@ export async function validateTwilioWebhook(
     ? publicBaseUrl + parsedUrl.pathname + parsedUrl.search
     : req.url;
 
-  const isValid = TwilioConversationRelayProvider.verifyWebhookSignature(
+  const isValid = TwilioVoiceProvider.verifyWebhookSignature(
     publicUrl,
     params,
     signature,

package/src/runtime/migrations/__tests__/gcs-signed-url.test.ts

@@ -68,6 +68,34 @@ describe("validateGcsSignedUrl", () => {
     expect(result).toEqual({ ok: false, reason: "scheme" });
   });
 
+  test("accepts http:// for a host on a non-default allowlist", () => {
+    // A non-default allowlist (e.g. local/minikube where the bundle is
+    // served over http from host.docker.internal) relaxes the scheme check
+    // to also accept http and skips the explicit-port check.
+    const url =
+      "http://host.docker.internal:8000/bucket/object.tgz" +
+      "?X-Goog-Signature=deadbeef";
+
+    const result = validateGcsSignedUrl(url, {
+      allowedHosts: ["host.docker.internal"],
+    });
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.host).toBe("host.docker.internal");
+      expect(result.path).toBe("/bucket/object.tgz");
+    }
+  });
+
+  test("still rejects a host absent from a non-default allowlist", () => {
+    const url =
+      "http://evil.internal/bucket/object.tgz" + "?X-Goog-Signature=deadbeef";
+
+    const result = validateGcsSignedUrl(url, {
+      allowedHosts: ["host.docker.internal"],
+    });
+    expect(result).toEqual({ ok: false, reason: "host" });
+  });
+
   test("rejects a non-GCS host", () => {
     const url =
       "https://evil.com/my-bucket/object.tgz" + "?X-Goog-Signature=deadbeef";

package/src/runtime/migrations/origin-mode.ts

@@ -7,15 +7,15 @@
  *   - `hasManagedProxyPrereqs()` — true when the daemon has the credentials
  *     it needs to act as a managed-proxy client, i.e. this is a managed
  *     deployment.
- *   - `getDaemonRuntimeMode()` — `"docker"` vs `"bare-metal"`, identifying
- *     where the daemon process is running.
+ *   - `getIsContainerized()` — true when the daemon runs inside a container
+ *     (`IS_CONTAINERIZED`), identifying where the daemon process is running.
  *
  * Folding both into a single helper keeps callers from repeating the
  * combination logic.
  */
 
+import { getIsContainerized } from "../../config/env-registry.js";
 import { hasManagedProxyPrereqs } from "../../providers/platform-proxy/context.js";
-import { getDaemonRuntimeMode } from "../runtime-mode.js";
 
 export type VBundleOriginMode =
   | "managed"
@@ -26,14 +26,14 @@ export type VBundleOriginMode =
  * Returns the origin mode for the current daemon.
  *
  * Managed-proxy prereqs win first (a managed deployment is always
- * "managed" regardless of where the daemon process runs); otherwise docker
- * → "self-hosted-remote", bare-metal → "self-hosted-local".
+ * "managed" regardless of where the daemon process runs); otherwise
+ * containerized → "self-hosted-remote", bare-metal → "self-hosted-local".
  */
 export async function getOriginMode(): Promise<VBundleOriginMode> {
   if (await hasManagedProxyPrereqs()) {
     return "managed";
   }
-  if (getDaemonRuntimeMode() === "docker") {
+  if (getIsContainerized()) {
     return "self-hosted-remote";
   }
   return "self-hosted-local";

package/src/runtime/pre-first-message-gate.ts

@@ -52,6 +52,7 @@ export function hasReceivedUserMessage(): boolean {
 
   try {
     const row = rawGet<{ one: number }>(
+      "preFirstMsg:hasReceivedUserMessage",
       `SELECT 1 AS one FROM messages m
        JOIN conversations c ON m.conversation_id = c.id
        WHERE m.role = 'user'

package/src/runtime/routes/__tests__/channel-verification-revoke.test.ts

@@ -53,10 +53,6 @@ mock.module("../../verification-outbound-actions.js", () => ({
 }));
 
 const revokePendingSessionsMock = mock((_channel: string) => {});
-const revokeBindingMock = mock((_assistantId: string, _channel: string) => {
-  revokeGuardianBindingMock();
-  return true;
-});
 let guardianBinding: {
   guardianExternalUserId: string;
   guardianDeliveryChatId?: string;
@@ -66,7 +62,6 @@ const actualVerificationService =
 mock.module("../../channel-verification-service.js", () => ({
   ...actualVerificationService,
   revokePendingSessions: revokePendingSessionsMock,
-  revokeBinding: revokeBindingMock,
   getGuardianBinding: mock(() => guardianBinding),
 }));
 
@@ -103,23 +98,19 @@ mock.module("../../../contacts/guardian-delivery-reader.js", () => ({
 }));
 
 // Guard: the contact-channel ACL write moves to the gateway relay and must
-// never run locally. The assistant-owned guardian-binding teardown
-// (revokeGuardianBinding) still runs locally — assert it is invoked.
+// never run locally.
 const localAclWrite = mock(() => {
   throw new Error("local ACL write must not happen on relayed revoke");
 });
-const revokeGuardianBindingMock = mock(() => true);
 const actualContactsWrite = await import("../../../contacts/contacts-write.js");
 mock.module("../../../contacts/contacts-write.js", () => ({
   ...actualContactsWrite,
   revokeMember: localAclWrite,
-  revokeGuardianBinding: revokeGuardianBindingMock,
 }));
 
 // Contact-change notification — fired explicitly on relay success so open
-// client views stop showing the channel as active (the gateway dual-write to
-// "revoked" precedes binding teardown, so revokeGuardianBinding no longer
-// fires it).
+// client views stop showing the channel as active after the gateway
+// dual-writes it to "revoked".
 const notifyContactsChangedMock = mock(() => {});
 mock.module("../../../contacts/notify-contacts-changed.js", () => ({
   notifyContactsChanged: notifyContactsChangedMock,
@@ -160,8 +151,6 @@ describe("verification revoke relay", () => {
     ipcCallPersistentMock.mockClear();
     cancelOutboundMock.mockClear();
     revokePendingSessionsMock.mockClear();
-    revokeBindingMock.mockClear();
-    revokeGuardianBindingMock.mockClear();
     localAclWrite.mockClear();
     notifyContactsChangedMock.mockClear();
   });
@@ -186,28 +175,17 @@ describe("verification revoke relay", () => {
     expect(cancelOutboundMock).toHaveBeenCalledTimes(1);
     expect(revokePendingSessionsMock).toHaveBeenCalledTimes(1);
 
-    // Assistant-owned guardian binding torn down locally.
-    expect(revokeBindingMock).toHaveBeenCalledTimes(1);
-    expect(revokeGuardianBindingMock).toHaveBeenCalledTimes(1);
-
     // The contact-channel ACL write does not fall back to the assistant.
     expect(localAclWrite).not.toHaveBeenCalled();
 
-    // Invalidation emitted explicitly on relay success: the gateway dual-write
-    // to "revoked" precedes binding teardown, so revokeGuardianBinding's own
-    // emit no longer fires.
+    // Invalidation emitted explicitly on relay success.
     expect(notifyContactsChangedMock).toHaveBeenCalledTimes(1);
 
     expect(result.success).toBe(true);
     expect(result.bound).toBe(false);
   });
 
-  test("emits the invalidation even when the gateway dual-write already revoked the channel", async () => {
-    // Simulate the gateway having dual-written the assistant row to "revoked"
-    // before binding teardown: findGuardianForChannel (active-only) now finds
-    // nothing, so revokeGuardianBinding is a no-op and never emits.
-    revokeGuardianBindingMock.mockImplementationOnce(() => false);
-
+  test("emits the invalidation on a successful relay", async () => {
     await revokeHandler({ body: { channel: "telegram" } });
 
     expect(ipcCalls).toHaveLength(1);
@@ -230,7 +208,6 @@ describe("verification revoke relay", () => {
     expect(thrown).toBeDefined();
     // Invalidation must not fire when the relay response is invalid.
     expect(notifyContactsChangedMock).not.toHaveBeenCalled();
-    expect(revokeBindingMock).not.toHaveBeenCalled();
   });
 
   test("ok: false gateway response surfaces as an error", async () => {
@@ -256,7 +233,6 @@ describe("verification revoke relay", () => {
 
     expect(thrown).toBeDefined();
     expect(notifyContactsChangedMock).not.toHaveBeenCalled();
-    expect(revokeBindingMock).not.toHaveBeenCalled();
   });
 
   test("guardian guard rejection from the gateway surfaces as an error", async () => {
@@ -274,11 +250,9 @@ describe("verification revoke relay", () => {
 
     expect(thrown).toBeDefined();
     expect(thrown!.statusCode).toBe(409);
-    // Session teardown ran before the relay rejected; the binding teardown
-    // does not run when the gateway refuses the downgrade.
+    // Session teardown ran before the relay rejected.
     expect(cancelOutboundMock).toHaveBeenCalledTimes(1);
     expect(revokePendingSessionsMock).toHaveBeenCalledTimes(1);
-    expect(revokeBindingMock).not.toHaveBeenCalled();
     expect(localAclWrite).not.toHaveBeenCalled();
   });
 
@@ -292,7 +266,6 @@ describe("verification revoke relay", () => {
     expect(ipcCalls).toEqual([]);
     expect(cancelOutboundMock).toHaveBeenCalledTimes(1);
     expect(revokePendingSessionsMock).toHaveBeenCalledTimes(1);
-    expect(revokeBindingMock).not.toHaveBeenCalled();
     expect(result.success).toBe(true);
     expect(result.bound).toBe(false);
   });
@@ -316,7 +289,5 @@ describe("verification revoke relay", () => {
     expect(ipcCalls).toEqual([]);
     expect(cancelOutboundMock).toHaveBeenCalledTimes(1);
     expect(revokePendingSessionsMock).toHaveBeenCalledTimes(1);
-    // Binding teardown still runs even when the channel is already revoked.
-    expect(revokeBindingMock).toHaveBeenCalledTimes(1);
   });
 });

package/src/runtime/routes/__tests__/consolidation-routes.test.ts

@@ -71,6 +71,7 @@ function insertMessage(
   createdAt: number,
 ): void {
   rawRun(
+    "test:insertMessage",
     "INSERT INTO messages (id, conversation_id, role, content, created_at) VALUES (?, ?, ?, ?, ?)",
     `msg-${conversationId}-${role}-${createdAt}`,
     conversationId,
@@ -105,6 +106,7 @@ function recordUsageCostAt(
     { estimatedCostUsd, pricingStatus: "priced" },
   );
   rawRun(
+    "test:setUsageCreatedAt",
     "UPDATE llm_usage_events SET created_at = ? WHERE id = ?",
     createdAt,
     event.id,
@@ -188,6 +190,7 @@ describe("listConsolidationRuns handler", () => {
       source: "memory_v2_consolidation",
     });
     rawRun(
+      "test:setCreatedAt",
       "UPDATE conversations SET created_at = ? WHERE id = ?",
       1000,
       conv.id,
@@ -224,6 +227,7 @@ describe("listConsolidationRuns handler", () => {
       source: "memory_v2_consolidation",
     });
     rawRun(
+      "test:setCreatedAtAndCost",
       "UPDATE conversations SET created_at = ?, total_estimated_cost = ? WHERE id = ?",
       1000,
       0.42,
@@ -244,6 +248,7 @@ describe("listConsolidationRuns handler", () => {
       source: "memory_v2_consolidation",
     });
     rawRun(
+      "test:setCreatedAt",
       "UPDATE conversations SET created_at = ? WHERE id = ?",
       1000,
       conv.id,
@@ -284,6 +289,7 @@ describe("listConsolidationRuns handler", () => {
       source: "memory_v2_consolidation",
     });
     rawRun(
+      "test:setCreatedAtAndLastMsg",
       "UPDATE conversations SET created_at = ?, last_message_at = ? WHERE id = ?",
       1000,
       1100,
@@ -328,9 +334,24 @@ describe("listConsolidationRuns handler", () => {
       title: "c",
       source: "memory_v2_consolidation",
     });
-    rawRun("UPDATE conversations SET created_at = ? WHERE id = ?", 1000, a.id);
-    rawRun("UPDATE conversations SET created_at = ? WHERE id = ?", 3000, b.id);
-    rawRun("UPDATE conversations SET created_at = ? WHERE id = ?", 2000, c.id);
+    rawRun(
+      "test:setCreatedAt",
+      "UPDATE conversations SET created_at = ? WHERE id = ?",
+      1000,
+      a.id,
+    );
+    rawRun(
+      "test:setCreatedAt",
+      "UPDATE conversations SET created_at = ? WHERE id = ?",
+      3000,
+      b.id,
+    );
+    rawRun(
+      "test:setCreatedAt",
+      "UPDATE conversations SET created_at = ? WHERE id = ?",
+      2000,
+      c.id,
+    );
 
     const handler = findHandler("listConsolidationRuns");
     const result = (await handler({})) as ListRunsResponse;

package/src/runtime/routes/__tests__/contact-routes.test.ts

@@ -102,7 +102,6 @@ const nativeContact = {
       address: "+15550200",
       isPrimary: true,
       externalChatId: null,
-      inviteId: null,
       lastSeenAt: 4100,
       interactionCount: 4,
       lastInteraction: 4200,
@@ -305,7 +304,41 @@ describe("contacts read API relays from the gateway", () => {
   });
 });
 
-describe("filtered/native contact reads stay daemon-native", () => {
+// Gateway rich-read for the native contact (ct_2), with telemetry values
+// DISTINCT from the local nativeContact fixture so tests can prove the served
+// telemetry is gateway-sourced (hydrated), not the local aggregation.
+const nativeGatewayRead = {
+  id: "ct_2",
+  displayName: "Bob",
+  role: "contact",
+  notes: null,
+  contactType: "human",
+  lastInteraction: 9200,
+  interactionCount: 11,
+  createdAt: 1000,
+  updatedAt: 1500,
+  channels: [
+    {
+      id: "ch_2",
+      contactId: "ct_2",
+      type: "phone",
+      address: "+15550200",
+      isPrimary: true,
+      externalUserId: null,
+      status: "active",
+      policy: "allow",
+      verifiedAt: null,
+      verifiedVia: null,
+      lastSeenAt: 9100,
+      interactionCount: 11,
+      lastInteraction: 9200,
+      revokedReason: null,
+      blockedReason: null,
+    },
+  ],
+};
+
+describe("filtered/native contact reads: daemon filters, gateway hydrates telemetry", () => {
   const listRoute = ROUTES.find((r) => r.operationId === "listContacts")!;
   const listResponseSchema = listRoute.responseBody as z.ZodTypeAny;
   const searchRoute = ROUTES.find((r) => r.operationId === "search_contacts")!;
@@ -313,7 +346,9 @@ describe("filtered/native contact reads stay daemon-native", () => {
 
   beforeEach(() => {
     ipcCalls = [];
-    ipcResult = {};
+    // Telemetry hydration relays `contacts_list_rich` with an ids filter; return
+    // the gateway rich-read for ct_2 by default so hydration succeeds.
+    ipcResult = { ok: true, contacts: [nativeGatewayRead] };
     ipcError = undefined;
     ipcCallPersistentMock.mockClear();
     contactStoreReadGuard.mockClear();
@@ -323,31 +358,58 @@ describe("filtered/native contact reads stay daemon-native", () => {
     getGuardianContactIdsMock.mockClear();
   });
 
-  test("query-filtered list serves daemon-native INFO and validates against the response schema", async () => {
+  test("query-filtered list hydrates telemetry from the gateway (not local aggregation)", async () => {
     searchContactsResult = [nativeContact];
 
     const result = await handleListContacts({ query: "Bob", limit: "10" });
 
-    // No gateway relay for a true search.
-    expect(ipcCalls).toEqual([]);
+    // Filtering stays daemon-native; telemetry is hydrated via an ids-scoped
+    // gateway rich read.
     expect(searchContactsMock).toHaveBeenCalled();
+    expect(ipcCalls).toEqual([
+      { method: "contacts_list_rich", params: { ids: ["ct_2"] } },
+    ]);
 
     const [contact] = result.contacts;
-    // INFO telemetry is present (re-hydrated locally, not dropped).
-    expect(contact.interactionCount).toBe(4);
-    expect(contact.lastInteraction).toBe(4200);
+    // Telemetry comes from the gateway (11/9200/9100), NOT the local fixture
+    // (4/4200/4100).
+    expect(contact.interactionCount).toBe(11);
+    expect(contact.lastInteraction).toBe(9200);
     const channel = contact.channels[0] as Record<string, unknown>;
-    expect(channel.interactionCount).toBe(4);
-    expect(channel.lastSeenAt).toBe(4100);
+    expect(channel.interactionCount).toBe(11);
+    expect(channel.lastSeenAt).toBe(9100);
+    expect(channel.lastInteraction).toBe(9200);
     expect(channel.externalUserId).toBe("+15550200");
     // Non-guardian id derives role "contact" (no name override).
     expect((contact as { role: string }).role).toBe("contact");
     expect(contact.displayName).toBe("Bob");
-    // Channel-level ACL fields (status/policy) are gateway-owned and absent.
+    // Channel-level ACL fields (status/policy) are gateway-owned and absent on
+    // the daemon-native shape.
     expect("status" in channel).toBe(false);
     expect(() => listResponseSchema.parse(result)).not.toThrow();
   });
 
+  test("telemetry degrades to default (0 counts, null timestamps) when the gateway hydration fails", async () => {
+    searchContactsResult = [nativeContact];
+    ipcError = new IpcCallError("gateway down", {
+      statusCode: 503,
+      errorCode: "UNAVAILABLE",
+    });
+
+    const result = await handleListContacts({ query: "Bob", limit: "10" });
+
+    // Search results are still returned; the interaction counts default to 0
+    // (never null, so callers render a real number) and the timestamps null.
+    const [contact] = result.contacts;
+    expect(contact.interactionCount).toBe(0);
+    expect(contact.lastInteraction).toBeNull();
+    const channel = contact.channels[0] as Record<string, unknown>;
+    expect(channel.interactionCount).toBe(0);
+    expect(channel.lastSeenAt).toBeNull();
+    expect(contact.displayName).toBe("Bob");
+    expect(() => listResponseSchema.parse(result)).not.toThrow();
+  });
+
   test("daemon-native search stamps role guardian + the name override from the gateway id set", async () => {
     searchContactsResult = [nativeContact];
     guardianIds = new Set(["ct_2"]);
@@ -372,15 +434,18 @@ describe("filtered/native contact reads stay daemon-native", () => {
     expect(contact.displayName).toBe("Bob");
   });
 
-  test("POST search with a filter validates against the response schema", async () => {
+  test("POST search with a filter hydrates telemetry and validates against the response schema", async () => {
     searchContactsResult = [nativeContact];
 
     const contacts = (await searchRoute.handler({
       body: { query: "Bob" },
-    })) as unknown[];
+    })) as Array<{ interactionCount: number | null }>;
 
-    expect(ipcCalls).toEqual([]);
     expect(searchContactsMock).toHaveBeenCalled();
+    expect(ipcCalls).toEqual([
+      { method: "contacts_list_rich", params: { ids: ["ct_2"] } },
+    ]);
+    expect(contacts[0].interactionCount).toBe(11);
     expect(() => searchResponseSchema.parse(contacts)).not.toThrow();
   });
 });

package/src/runtime/routes/__tests__/conversation-list-routes.test.ts

@@ -46,6 +46,7 @@ function clearConversations(): void {
 function seedArchived(title: string): string {
   const conv = createConversation({ title });
   rawRun(
+    "test:archiveConversation",
     "UPDATE conversations SET archived_at = ? WHERE id = ?",
     Date.now(),
     conv.id,
@@ -154,8 +155,13 @@ describe("GET /v1/conversations — archiveStatus", () => {
     // GIVEN a pinned-but-archived row that would otherwise be force-included
     // on offset=0 of the active view.
     const pinned = createConversation("pinned-archived");
-    rawRun("UPDATE conversations SET is_pinned = 1 WHERE id = ?", pinned.id);
     rawRun(
+      "test:setPinned",
+      "UPDATE conversations SET is_pinned = 1 WHERE id = ?",
+      pinned.id,
+    );
+    rawRun(
+      "test:archiveConversation",
       "UPDATE conversations SET archived_at = ? WHERE id = ?",
       Date.now(),
       pinned.id,

package/src/runtime/routes/__tests__/global-search-routes.test.ts

@@ -34,8 +34,6 @@ function makeContact(
     displayName: "Alice",
     notes: null,
     role: "contact",
-    lastInteraction: null,
-    interactionCount: 0,
     createdAt: 1,
     updatedAt: 1,
     contactType: "human",
@@ -57,7 +55,6 @@ describe("global-search contacts recency source", () => {
         id: "ct_1",
         displayName: "Alice",
         updatedAt: 5000,
-        lastInteraction: 9999,
       }),
     ];