@vellumai/assistant 0.11.1 → 0.11.2-staging.2

package/src/calls/__tests__/call-setup-router.test.ts

@@ -29,6 +29,7 @@ import {
 import type { AdmissionPolicy, TrustVerdict } from "@vellumai/gateway-client";
 
 import type { TrustClass } from "../../runtime/actor-trust-resolver.js";
+import type { SetupOutcome } from "../call-setup-router.js";
 import type { CallSession } from "../types.js";
 
 // `resolveActorTrust` must never be consulted by the router — the gateway
@@ -376,47 +377,75 @@ describe("routeSetup — verdict session stamp gates getPendingSession", () => {
 });
 
 // ---------------------------------------------------------------------------
-// Floor table: trustClass × policy → admit/deny
+// Floor table: trustClass × policy → setup action
+//
+// A caller at or above the floor connects directly (`normal_call`). A caller
+// BELOW a floor that a guardian approval could clear is routed into the
+// guardian access-request flow instead of hung up on: `name_capture` for an
+// unrecognized number, `unverified_caller` for a known contact who still owes
+// verification. `guardian_only` / `no_one` sit above the trusted
+// contact rank an approval grants, so they stay a hard `deny`.
 // ---------------------------------------------------------------------------
 
 describe("routeSetup — admission floor table", () => {
   const cases: Array<{
     policy: AdmissionPolicy;
-    admits: TrustClass[];
-    denies: TrustClass[];
+    expected: Record<TrustClass, SetupOutcome["action"]>;
   }> = [
     {
       policy: "strangers",
-      admits: ["unknown", "unverified_contact", "trusted_contact", "guardian"],
-      denies: [],
+      expected: {
+        unknown: "normal_call",
+        unverified_contact: "normal_call",
+        trusted_contact: "normal_call",
+        guardian: "normal_call",
+      },
     },
     {
       policy: "any_contact",
-      admits: ["unverified_contact", "trusted_contact", "guardian"],
-      denies: ["unknown"],
+      expected: {
+        unknown: "name_capture",
+        unverified_contact: "normal_call",
+        trusted_contact: "normal_call",
+        guardian: "normal_call",
+      },
     },
     {
       policy: "trusted_contacts",
-      admits: ["trusted_contact", "guardian"],
-      denies: ["unknown", "unverified_contact"],
+      expected: {
+        unknown: "name_capture",
+        unverified_contact: "unverified_caller",
+        trusted_contact: "normal_call",
+        guardian: "normal_call",
+      },
     },
     {
       policy: "guardian_only",
-      admits: ["guardian"],
-      denies: ["unknown", "unverified_contact", "trusted_contact"],
+      expected: {
+        unknown: "deny",
+        unverified_contact: "deny",
+        trusted_contact: "deny",
+        guardian: "normal_call",
+      },
     },
     {
       policy: "no_one",
-      admits: [],
-      denies: ["unknown", "unverified_contact", "trusted_contact", "guardian"],
+      expected: {
+        unknown: "deny",
+        unverified_contact: "deny",
+        trusted_contact: "deny",
+        guardian: "deny",
+      },
     },
   ];
 
-  for (const { policy, admits, denies } of cases) {
-    for (const trustClass of denies) {
-      test(`${policy} denies ${trustClass}`, async () => {
+  for (const { policy, expected } of cases) {
+    for (const [trustClass, action] of Object.entries(expected) as Array<
+      [TrustClass, SetupOutcome["action"]]
+    >) {
+      test(`${policy} routes ${trustClass} to ${action}`, async () => {
         const { outcome } = await route(policy, verdictFor(trustClass));
-        expect(outcome.action).toBe("deny");
+        expect(outcome.action).toBe(action);
         if (outcome.action === "deny") {
           expect(outcome.logReason).toBe(
             `Inbound voice admission floor: ${policy}`,
@@ -424,15 +453,116 @@ describe("routeSetup — admission floor table", () => {
         }
       });
     }
-    for (const trustClass of admits) {
-      test(`${policy} admits ${trustClass}`, async () => {
-        const { outcome } = await route(policy, verdictFor(trustClass));
-        expect(outcome.action).not.toBe("deny");
-      });
-    }
   }
 });
 
+// ---------------------------------------------------------------------------
+// An unrecognized caller below a clearable floor reaches the guardian
+// access-request flow instead of being hung up on. The default channel policy
+// is `trusted_contacts`, so this is the out-of-the-box path for every inbound
+// call from an unknown number.
+// ---------------------------------------------------------------------------
+
+describe("routeSetup: below-floor unknown caller reaches guardian approval", () => {
+  test("default trusted_contacts floor routes an unknown caller to name_capture", async () => {
+    const { outcome, resolved } = await route(
+      "trusted_contacts",
+      verdictFor("unknown"),
+    );
+    expect(outcome.action).toBe("name_capture");
+    if (outcome.action === "name_capture") {
+      expect(outcome.fromNumber).toBe("+12025550142");
+    }
+    expect(resolved.actorTrust.trustClass).toBe("unknown");
+  });
+
+  test("an active voice invite still takes precedence over the approval flow", async () => {
+    activeVoiceInvite = {
+      inviteId: "inv_1",
+      inviteeName: "Alice Example",
+      guardianName: "Sam",
+      codeDigits: 6,
+    };
+    const { outcome } = await route("trusted_contacts", verdictFor("unknown"));
+    expect(outcome.action).toBe("invite_redemption");
+  });
+
+  test("guardian_only keeps the hard deny (approval could not admit them)", async () => {
+    const { outcome } = await route("guardian_only", verdictFor("unknown"));
+    expect(outcome.action).toBe("deny");
+  });
+
+  test("a blocked caller below a clearable floor is still denied", async () => {
+    const { outcome } = await route(
+      "trusted_contacts",
+      makeMemberVerdict("unknown", { status: "blocked" }),
+    );
+    expect(outcome.action).toBe("deny");
+  });
+
+  test("a revoked caller below a clearable floor is still denied", async () => {
+    const { outcome } = await route(
+      "trusted_contacts",
+      makeMemberVerdict("unknown", { status: "revoked" }),
+    );
+    expect(outcome.action).toBe("deny");
+  });
+
+  // Status and policy are independent governance signals: the gateway derives
+  // trust class from status alone, so a channel the guardian set to
+  // `policy: "deny"` still resolves to `unverified_contact` while status is
+  // `unverified`/`pending`. The deny gate is trust-class independent and runs
+  // ahead of the floor, so it holds whether the floor admits or denies, and it
+  // outranks an active voice invite.
+  describe("member policy deny outranks every inbound flow", () => {
+    const denyVerdict = () =>
+      makeMemberVerdict("unverified_contact", {
+        status: "unverified",
+        policy: "deny",
+      });
+
+    test("denied below a clearable floor (not sent to verification guidance)", async () => {
+      const { outcome } = await route("trusted_contacts", denyVerdict());
+      expect(outcome.action).toBe("deny");
+      if (outcome.action === "deny") {
+        expect(outcome.logReason).toBe("Inbound voice ACL: member policy deny");
+      }
+    });
+
+    test("denied even when the floor would admit them", async () => {
+      const { outcome } = await route("strangers", denyVerdict());
+      expect(outcome.action).toBe("deny");
+    });
+
+    test("denied with no floor configured", async () => {
+      const { outcome } = await route(null, denyVerdict());
+      expect(outcome.action).toBe("deny");
+    });
+
+    test("denied even with an active voice invite", async () => {
+      activeVoiceInvite = {
+        inviteId: "inv_1",
+        inviteeName: "Alice Example",
+        guardianName: "Sam",
+        codeDigits: 6,
+      };
+      const { outcome } = await route("trusted_contacts", denyVerdict());
+      expect(outcome.action).toBe("deny");
+    });
+
+    test("an active-status member with policy deny is denied", async () => {
+      const { outcome } = await route(
+        "trusted_contacts",
+        makeMemberVerdict("trusted_contact", {
+          status: "active",
+          policy: "deny",
+        }),
+      );
+      expect(outcome.action).toBe("deny");
+    });
+  });
+});
+
 // ---------------------------------------------------------------------------
 // Blocked / revoked always deny
 // ---------------------------------------------------------------------------
@@ -542,14 +672,14 @@ describe("routeSetup — permissive floor admits to normal_call", () => {
     ).toBe("unverified_caller");
   });
 
-  test("trusted_contacts (default) still denies unknown and unverified", async () => {
+  test("trusted_contacts (default) keeps below-floor callers out of normal_call", async () => {
     expect(
       (await route("trusted_contacts", verdictFor("unknown"))).outcome.action,
-    ).toBe("deny");
+    ).toBe("name_capture");
     expect(
       (await route("trusted_contacts", verdictFor("unverified_contact")))
         .outcome.action,
-    ).toBe("deny");
+    ).toBe("unverified_caller");
   });
 });
 

package/src/calls/__tests__/voice-session-bridge.test.ts

@@ -78,6 +78,7 @@ import {
   cutFrontDoorContentAtVerdict,
   startVoiceTurn,
   TOOL_RESULT_PREVIEW_MAX_CHARS,
+  type VoiceTurnOptions,
 } from "../voice-session-bridge.js";
 import {
   escalatedContinuationRule,
@@ -118,7 +119,13 @@ interface FakeConversation {
     requestId: string;
     metadata?: Record<string, unknown>;
   }) => Promise<{ id: string }>;
+  workingDir: string;
   updateClient: (cb: unknown, reset?: boolean) => void;
+  handleConfirmationResponse: (
+    requestId: string,
+    decision: string,
+    opts?: { decisionContext?: string },
+  ) => void;
   runAgentLoop: (...args: unknown[]) => Promise<void>;
   abort: (reason?: unknown) => void;
   loadFromDb: () => Promise<void>;
@@ -134,14 +141,22 @@ function makeFakeConversation(opts: {
   hasQueuedMessages?: () => boolean;
   /** Runs before each persist resolves; throw to script a persist failure. */
   onPersist?: (attempt: number) => void;
+  /** Workspace root; pass empty to model a missing boundary. */
+  workingDir?: string;
 }) {
   const waitForIdleCalls: WaitForIdleCall[] = [];
+  const confirmationDecisions: Array<{ requestId: string; decision: string }> =
+    [];
+  let clientCallback: ((msg: unknown) => Promise<void>) | undefined;
   let persistCount = 0;
   let lastPersistOpts:
     | { content: string; requestId: string; metadata?: Record<string, unknown> }
     | undefined;
   const conversation: FakeConversation = {
     conversationId: "conv-voice-bridge-test",
+    // The workspace boundary the reach check compares paths against. A real
+    // conversation always has one; without it the approval gate fails closed.
+    workingDir: opts.workingDir ?? "/tmp/workspace-voice-bridge-test",
     callSessionId: undefined,
     forcePromptSideEffects: false,
     currentRequestId: undefined,
@@ -173,8 +188,14 @@ function makeFakeConversation(opts: {
     },
     // The install (reset falsy) / reset (reset true) pair marks a turn
     // taking ownership of the conversation vs a turn's cleanup releasing it.
-    updateClient: (_cb, reset) => {
+    updateClient: (cb, reset) => {
       opts.events?.push(reset ? "client:reset" : "client:install");
+      if (reset !== true) {
+        clientCallback = cb as (msg: unknown) => Promise<void>;
+      }
+    },
+    handleConfirmationResponse: (requestId, decision) => {
+      confirmationDecisions.push({ requestId, decision });
     },
     runAgentLoop: () => (opts.runAgentLoop ?? (async () => {}))(),
     abort: () => {},
@@ -186,6 +207,11 @@ function makeFakeConversation(opts: {
   return {
     conversation,
     waitForIdleCalls,
+    confirmationDecisions,
+    /** Deliver an event the way the conversation would, to the installed handler. */
+    emitToClient: async (msg: unknown) => {
+      await clientCallback?.(msg);
+    },
     persistCount: () => persistCount,
     lastPersistOpts: () => lastPersistOpts,
     setProcessingFlag: (value: boolean) => {
@@ -338,7 +364,10 @@ describe("startVoiceTurn escalation-continuation persistence", () => {
     expect(fake.lastPersistOpts()?.content).toBe(
       ESCALATION_CONTINUATION_CONTENT,
     );
-    expect(fake.lastPersistOpts()?.metadata).toEqual({ hidden: true });
+    expect(fake.lastPersistOpts()?.metadata).toEqual({
+      voiceSessionTurn: true,
+      hidden: true,
+    });
   });
 
   test("the opener prompt is persisted un-hidden (unchanged)", async () => {
@@ -347,7 +376,9 @@ describe("startVoiceTurn escalation-continuation persistence", () => {
 
     await startVoiceTurn(makeTurnOptions()); // content: CALL_OPENING_MARKER
 
-    expect(fake.lastPersistOpts()?.metadata).toBeUndefined();
+    expect(fake.lastPersistOpts()?.metadata).toEqual({
+      voiceSessionTurn: true,
+    });
   });
 });
 
@@ -390,7 +421,10 @@ describe("startVoiceTurn hiddenSyntheticPrompt", () => {
     );
 
     expect(fake.lastPersistOpts()?.content).toBe(SYNTHETIC_CONTENT);
-    expect(fake.lastPersistOpts()?.metadata).toEqual({ hidden: true });
+    expect(fake.lastPersistOpts()?.metadata).toEqual({
+      voiceSessionTurn: true,
+      hidden: true,
+    });
     expect(echoes).toHaveLength(0);
   });
 
@@ -405,7 +439,9 @@ describe("startVoiceTurn hiddenSyntheticPrompt", () => {
       }),
     );
 
-    expect(fake.lastPersistOpts()?.metadata).toBeUndefined();
+    expect(fake.lastPersistOpts()?.metadata).toEqual({
+      voiceSessionTurn: true,
+    });
     expect(echoes).toEqual([
       expect.objectContaining({ text: SYNTHETIC_CONTENT }),
     ]);
@@ -475,9 +511,10 @@ describe("startVoiceTurn triage-and-escalate control prompt", () => {
 });
 
 describe("startVoiceTurn channel capabilities", () => {
-  // Voice calls are non-interactive: the bridge forces supportsDynamicUi off
-  // for every voice turn so ui-surface tools never reach the model mid-call,
-  // while leaving the rest of the channel's resolved capabilities intact.
+  // Whether a call can show a surface is a property of its channel, not of
+  // calls in general, so the bridge applies no voice-specific override: a
+  // phone call has no screen and resolves false on its own, while a live-voice
+  // call is a screen the user is holding and resolves true.
 
   // The turn installs its capabilities, then cleanup resets them to null — so
   // capture every applied value and read the installed (non-null) one.
@@ -497,7 +534,7 @@ describe("startVoiceTurn channel capabilities", () => {
       );
   }
 
-  test("a vellum/macos (live-voice) turn forces supportsDynamicUi off, other fields untouched", async () => {
+  test("a vellum/macos (live-voice) turn keeps its channel's dynamic UI", async () => {
     const installed = captureInstalledCapabilities();
     await startVoiceTurn({
       ...makeTurnOptions(),
@@ -505,14 +542,16 @@ describe("startVoiceTurn channel capabilities", () => {
       userMessageInterface: "macos",
     });
     const caps = installed();
-    expect(caps?.supportsDynamicUi).toBe(false);
-    // The override is surgical: live-voice keeps identifying as vellum/macos.
+    expect(caps?.supportsDynamicUi).toBe(true);
+    // Nothing else about the channel is rewritten either.
     expect(caps?.dashboardCapable).toBe(true);
     expect(caps?.supportsVoiceInput).toBe(true);
     expect(caps?.clientOS).toBe("macos");
   });
 
-  test("phone defaults (no channel overrides) also yield supportsDynamicUi false", async () => {
+  // The case the removed override existed for, still covered: a phone call has
+  // no screen to show a surface on, and says so through its channel.
+  test("phone defaults yield supportsDynamicUi false", async () => {
     const installed = captureInstalledCapabilities();
     await startVoiceTurn(makeTurnOptions());
     const caps = installed();
@@ -521,6 +560,156 @@ describe("startVoiceTurn channel capabilities", () => {
   });
 });
 
+describe("startVoiceTurn guardian approvals", () => {
+  function confirmationRequest(
+    toolName: string,
+    executionTarget?: "sandbox" | "host",
+    input: Record<string, unknown> = {},
+  ) {
+    return {
+      type: "confirmation_request",
+      requestId: "req-1",
+      toolName,
+      input,
+      riskLevel: "medium",
+      allowlistOptions: [],
+      scopeOptions: [],
+      ...(executionTarget !== undefined ? { executionTarget } : {}),
+    };
+  }
+
+  async function runVoiceTurn(
+    overrides: Partial<VoiceTurnOptions>,
+    conversationOpts: { workingDir?: string } = {},
+  ) {
+    const fake = makeFakeConversation({
+      processing: false,
+      ...conversationOpts,
+    });
+    fakeConversation = fake.conversation;
+    const pendingAnnounced: string[] = [];
+    await startVoiceTurn({
+      ...makeTurnOptions(),
+      trustContext: { trustClass: "guardian" },
+      onApprovalPending: (requestId: string) => {
+        pendingAnnounced.push(requestId);
+      },
+      ...overrides,
+    } as VoiceTurnOptions);
+    return { ...fake, pendingAnnounced };
+  }
+
+  // A live-voice call has a screen, so a tool that reaches the workspace or
+  // the host is put to the user rather than decided for them. This is the hole
+  // it closes: a guardian call used to allow every confirmation outright.
+  test("leaves a sensitive tool pending for the user to answer", async () => {
+    const fake = await runVoiceTurn({
+      userMessageChannel: "vellum",
+      userMessageInterface: "macos",
+    });
+
+    await fake.emitToClient(confirmationRequest("bash", "host"));
+
+    expect(fake.confirmationDecisions).toEqual([]);
+    // The card renders in the app, and the call covers the app, so a pending
+    // decision has to be announced or the turn just goes quiet.
+    expect(fake.pendingAnnounced).toEqual(["req-1"]);
+  });
+
+  // The tools that read or render were never the reason approval exists, and
+  // gating them would interrupt the conversation constantly.
+  test("still allows a tool with no sensitive reach", async () => {
+    const fake = await runVoiceTurn({
+      userMessageChannel: "vellum",
+      userMessageInterface: "macos",
+    });
+
+    await fake.emitToClient(confirmationRequest("ui_show", "sandbox"));
+
+    expect(fake.confirmationDecisions).toEqual([
+      { requestId: "req-1", decision: "allow" },
+    ]);
+    // Nothing is waiting, so nothing interrupts the call.
+    expect(fake.pendingAnnounced).toEqual([]);
+  });
+
+  // There is no screen on a phone call, so a prompt there is a question nobody
+  // can answer.
+  test("a phone call keeps allowing sensitive tools outright", async () => {
+    const fake = await runVoiceTurn({ userMessageChannel: "phone" });
+
+    await fake.emitToClient(confirmationRequest("bash", "host"));
+
+    expect(fake.confirmationDecisions).toEqual([
+      { requestId: "req-1", decision: "allow" },
+    ]);
+  });
+
+  // The escape this gate exists to catch: a *sandbox* file tool pointed
+  // outside the workspace reaches the host filesystem on a non-containerized
+  // install. The reach check can only see that when it is given the workspace
+  // boundary; without it this read of a host file classifies as `none` and
+  // lands on the auto-allow.
+  test("an out-of-workspace path prompts even on a sandbox target", async () => {
+    const fake = await runVoiceTurn(
+      { userMessageChannel: "vellum", userMessageInterface: "macos" },
+      { workingDir: "/tmp/workspace-voice-bridge-test" },
+    );
+
+    await fake.emitToClient(
+      confirmationRequest("file_read", "sandbox", { path: "/etc/hosts" }),
+    );
+
+    expect(fake.confirmationDecisions).toEqual([]);
+  });
+
+  // A path inside the workspace is the ordinary case, and gating it would
+  // interrupt the conversation for every file the assistant touches.
+  test("an in-workspace read is still allowed outright", async () => {
+    const fake = await runVoiceTurn(
+      { userMessageChannel: "vellum", userMessageInterface: "macos" },
+      { workingDir: "/tmp/workspace-voice-bridge-test" },
+    );
+
+    await fake.emitToClient(
+      confirmationRequest("file_read", "sandbox", {
+        path: "/tmp/workspace-voice-bridge-test/notes.md",
+      }),
+    );
+
+    expect(fake.confirmationDecisions).toEqual([
+      { requestId: "req-1", decision: "allow" },
+    ]);
+  });
+
+  // With no boundary there is no way to tell an ordinary write from an escape,
+  // and the safe reading of "cannot tell" is "ask".
+  test("a missing workspace boundary fails closed", async () => {
+    const fake = await runVoiceTurn(
+      { userMessageChannel: "vellum", userMessageInterface: "macos" },
+      { workingDir: "" },
+    );
+
+    await fake.emitToClient(confirmationRequest("ui_show", "sandbox"));
+
+    expect(fake.confirmationDecisions).toEqual([]);
+  });
+
+  // Requests from the proxy and network prompters carry no target. Unknown
+  // reads as the more consequential of the two: a prompt the user did not need
+  // costs less than an unreviewed action on their machine.
+  test("prompts when the execution target is unknown", async () => {
+    const fake = await runVoiceTurn({
+      userMessageChannel: "vellum",
+      userMessageInterface: "macos",
+    });
+
+    await fake.emitToClient(confirmationRequest("bash"));
+
+    expect(fake.confirmationDecisions).toEqual([]);
+  });
+});
+
 describe("startVoiceTurn conversation-lock wait", () => {
   test("an idle conversation starts the turn without consulting waitForIdle", async () => {
     const fake = makeFakeConversation({ processing: false });