@vellumai/assistant 0.3.0

package/src/bundler/signature-verifier.ts

@@ -0,0 +1,184 @@
+/**
+ * Signature verification for .vellumapp archives.
+ *
+ * Checks bundle integrity and Ed25519 signature validity.
+ */
+
+import { createHash, verify } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+import JSZip from 'jszip';
+import type { SignatureJson } from './bundle-signer.js';
+
+export type TrustTier = 'verified' | 'signed' | 'unsigned' | 'tampered';
+
+export interface SignatureVerificationResult {
+  trustTier: TrustTier;
+  signerKeyId?: string;
+  signerDisplayName?: string;
+  signerAccount?: string;
+  message: string;
+}
+
+/**
+ * Recursively sort object keys alphabetically for canonical JSON.
+ */
+function sortKeysDeep(obj: unknown): unknown {
+  if (obj === null || obj === undefined || typeof obj !== 'object') {
+    return obj;
+  }
+  if (Array.isArray(obj)) {
+    return obj.map(sortKeysDeep);
+  }
+  const sorted: Record<string, unknown> = {};
+  for (const key of Object.keys(obj as Record<string, unknown>).sort()) {
+    sorted[key] = sortKeysDeep((obj as Record<string, unknown>)[key]);
+  }
+  return sorted;
+}
+
+/**
+ * Verify the signature and integrity of a .vellumapp bundle.
+ *
+ * @param zipPath - Path to the .vellumapp zip archive.
+ * @param trustedPublicKeys - Optional map of keyId -> base64-encoded public key for verification.
+ *                            If not provided, signature is checked structurally but returns 'signed' at best.
+ * @returns The verification result with trust tier and signer info.
+ */
+export async function verifyBundleSignature(
+  zipPath: string,
+  trustedPublicKeys?: Map<string, string>,
+): Promise<SignatureVerificationResult> {
+  const zipBuffer = await readFile(zipPath);
+  const zip = await JSZip.loadAsync(zipBuffer);
+
+  // 1. Check for signature.json
+  const sigFile = zip.file('signature.json');
+  if (!sigFile) {
+    return {
+      trustTier: 'unsigned',
+      message: 'Bundle is not signed (no signature.json found)',
+    };
+  }
+
+  // 2. Parse signature.json
+  let signatureData: SignatureJson;
+  try {
+    const sigText = await sigFile.async('text');
+    signatureData = JSON.parse(sigText) as SignatureJson;
+  } catch {
+    return {
+      trustTier: 'tampered',
+      message: 'signature.json is malformed',
+    };
+  }
+
+  // 3. Recompute content hashes
+  const computedHashes: Record<string, string> = {};
+  const entries: string[] = [];
+
+  zip.forEach((relativePath, _file) => {
+    if (relativePath !== 'signature.json') {
+      entries.push(relativePath);
+    }
+  });
+  entries.sort();
+
+  for (const entryPath of entries) {
+    const file = zip.file(entryPath);
+    if (!file || file.dir) continue;
+    const content = await file.async('nodebuffer');
+    const hash = createHash('sha256').update(content).digest('hex');
+    computedHashes[entryPath] = hash;
+  }
+
+  // 4. Compare hashes
+  const expectedPaths = Object.keys(signatureData.content_hashes).sort();
+  const actualPaths = Object.keys(computedHashes).sort();
+
+  if (expectedPaths.length !== actualPaths.length ||
+      !expectedPaths.every((p, i) => p === actualPaths[i])) {
+    return {
+      trustTier: 'tampered',
+      signerKeyId: signatureData.signer.key_id,
+      signerDisplayName: signatureData.signer.display_name,
+      message: 'Bundle files do not match signed manifest (files added or removed)',
+    };
+  }
+
+  for (const path of expectedPaths) {
+    if (signatureData.content_hashes[path] !== computedHashes[path]) {
+      return {
+        trustTier: 'tampered',
+        signerKeyId: signatureData.signer.key_id,
+        signerDisplayName: signatureData.signer.display_name,
+        message: `Content hash mismatch for file: ${path}`,
+      };
+    }
+  }
+
+  // 5. Reconstruct canonical signing payload
+  const manifestFile = zip.file('manifest.json');
+  if (!manifestFile) {
+    return {
+      trustTier: 'tampered',
+      message: 'Bundle is missing manifest.json',
+    };
+  }
+  const manifestText = await manifestFile.async('text');
+  const manifest = JSON.parse(manifestText) as Record<string, unknown>;
+
+  const signingPayload = sortKeysDeep({
+    content_hashes: computedHashes,
+    manifest,
+  });
+  const canonicalPayload = JSON.stringify(signingPayload);
+
+  // 6. Verify Ed25519 signature if we have a public key
+  const keyId = signatureData.signer.key_id;
+  const publicKeyBase64 = trustedPublicKeys?.get(keyId);
+
+  if (publicKeyBase64) {
+    try {
+      const rawKey = Buffer.from(publicKeyBase64, 'base64');
+      const signatureBuffer = Buffer.from(signatureData.signature, 'base64');
+
+      // Ed25519 SPKI DER header (12 bytes) for wrapping raw 32-byte public key.
+      // The Swift client sends the key as rawRepresentation (32 bytes), but
+      // Node.js crypto.verify expects DER-encoded SPKI format (44 bytes).
+      const ed25519SpkiPrefix = Buffer.from('302a300506032b6570032100', 'hex');
+      const derKey = Buffer.concat([ed25519SpkiPrefix, rawKey]);
+
+      const isValid = verify(
+        null, // Ed25519 doesn't use a separate hash algorithm
+        Buffer.from(canonicalPayload),
+        { key: derKey, format: 'der', type: 'spki' },
+        signatureBuffer,
+      );
+
+      if (!isValid) {
+        return {
+          trustTier: 'tampered',
+          signerKeyId: keyId,
+          signerDisplayName: signatureData.signer.display_name,
+          message: 'Ed25519 signature verification failed',
+        };
+      }
+    } catch {
+      return {
+        trustTier: 'tampered',
+        signerKeyId: keyId,
+        signerDisplayName: signatureData.signer.display_name,
+        message: 'Ed25519 signature verification failed (crypto error)',
+      };
+    }
+  }
+
+  // For MVP, we don't have Vellum account lookup, so best we can do is 'signed'
+  return {
+    trustTier: 'signed',
+    signerKeyId: keyId,
+    signerDisplayName: signatureData.signer.display_name,
+    signerAccount: signatureData.signer.account,
+    message: `Bundle signed by ${signatureData.signer.display_name}`,
+  };
+}

package/src/calls/call-bridge.ts

@@ -0,0 +1,168 @@
+/**
+ * Call message bridge: intercepts user messages in-thread and routes them
+ * to the live call orchestrator — either as answers to pending questions
+ * or as mid-call steering instructions.
+ *
+ * Decision priority:
+ * 1. If a pending question exists → answer path (existing behavior).
+ * 2. If no pending question but an active call exists → instruction path.
+ *
+ * When the bridge consumes a message it returns `{ handled: true }` so
+ * the caller can skip agent processing.
+ */
+
+import { getLogger } from '../util/logger.js';
+import {
+  getActiveCallSessionForConversation,
+  getPendingQuestion,
+  answerPendingQuestion,
+  recordCallEvent,
+  getCallSession,
+} from './call-store.js';
+import { getCallOrchestrator } from './call-state.js';
+import { relayInstruction } from './call-domain.js';
+import * as conversationStore from '../memory/conversation-store.js';
+
+const log = getLogger('call-bridge');
+
+export interface CallBridgeResult {
+  handled: boolean;
+  reason?: string;
+  /** User-facing text persisted in-thread by the bridge (success ack or failure notice). */
+  userFacingText?: string;
+}
+
+/**
+ * Attempt to route a user message to an active call — as an answer to
+ * a pending question (priority) or as a mid-call steering instruction.
+ *
+ * @param conversationId - The conversation the message belongs to.
+ * @param userText - The user's message text.
+ * @param _userMessageId - The persisted message ID (reserved for future use).
+ * @returns `{ handled: true }` if the message was consumed by the call system,
+ *          `{ handled: false, reason }` otherwise.
+ */
+export async function tryRouteCallMessage(
+  conversationId: string,
+  userText: string,
+  _userMessageId?: string,
+): Promise<CallBridgeResult> {
+  // 1. Find an active call for this conversation
+  const callSession = getActiveCallSessionForConversation(conversationId);
+  if (!callSession) {
+    return { handled: false, reason: 'no_active_call' };
+  }
+
+  // 2. Check for a pending question — answer path takes priority
+  const pendingQuestion = getPendingQuestion(callSession.id);
+  if (pendingQuestion) {
+    return handleAnswer(conversationId, callSession.id, pendingQuestion, userText);
+  }
+
+  // 3. No pending question — instruction path
+  return handleInstruction(conversationId, callSession.id, userText);
+}
+
+/** @deprecated Use `tryRouteCallMessage` instead. */
+export const tryHandlePendingCallAnswer = tryRouteCallMessage;
+
+// ── Answer path ─────────────────────────────────────────────────────
+
+async function handleAnswer(
+  conversationId: string,
+  callSessionId: string,
+  pendingQuestion: { id: string; questionText: string },
+  userText: string,
+): Promise<CallBridgeResult> {
+  // Empty text (e.g. attachment-only messages) should not be consumed as
+  // an answer — fall through to normal processing so attachments are handled.
+  if (!userText.trim()) {
+    return { handled: false, reason: 'empty_answer_text' };
+  }
+
+  const orchestrator = getCallOrchestrator(callSessionId);
+  if (!orchestrator) {
+    // The call may have ended between the question being asked and the
+    // user replying. Persist a follow-up message so the user knows.
+    const freshSession = getCallSession(callSessionId);
+    const ended = freshSession && (freshSession.status === 'completed' || freshSession.status === 'failed');
+    if (ended) {
+      conversationStore.addMessage(
+        conversationId,
+        'assistant',
+        JSON.stringify([{
+          type: 'text',
+          text: 'The call ended before your answer could be relayed to the caller.',
+        }]),
+      );
+    }
+    return { handled: false, reason: 'orchestrator_not_found' };
+  }
+
+  if (orchestrator.getState() !== 'waiting_on_user') {
+    return { handled: false, reason: 'orchestrator_not_waiting' };
+  }
+
+  const accepted = await orchestrator.handleUserAnswer(userText);
+  if (!accepted) {
+    return { handled: false, reason: 'orchestrator_rejected' };
+  }
+
+  answerPendingQuestion(pendingQuestion.id, userText);
+  recordCallEvent(callSessionId, 'user_answered', { answer: userText });
+
+  log.info(
+    { conversationId, callSessionId, questionId: pendingQuestion.id },
+    'User reply routed as call answer via bridge',
+  );
+
+  return { handled: true };
+}
+
+// ── Instruction path ────────────────────────────────────────────────
+
+async function handleInstruction(
+  conversationId: string,
+  callSessionId: string,
+  userText: string,
+): Promise<CallBridgeResult> {
+  // Empty text (e.g. attachment-only messages) should not be relayed —
+  // fall through to normal processing so attachments are handled.
+  if (!userText.trim()) {
+    return { handled: false, reason: 'empty_instruction_text' };
+  }
+
+  const result = await relayInstruction({ callSessionId, instructionText: userText });
+
+  if (!result.ok) {
+    log.warn(
+      { conversationId, callSessionId, error: result.error },
+      'Instruction relay failed via bridge',
+    );
+
+    const failureText = 'Failed to relay instruction to the active call.';
+    conversationStore.addMessage(
+      conversationId,
+      'assistant',
+      JSON.stringify([{ type: 'text', text: failureText }]),
+    );
+
+    // Consumed: caller should NOT fall through to the agent loop
+    return { handled: true, reason: 'instruction_relay_failed', userFacingText: failureText };
+  }
+
+  // Persist a concise acknowledgement so the user sees confirmation
+  const ackText = 'Instruction relayed to active call.';
+  conversationStore.addMessage(
+    conversationId,
+    'assistant',
+    JSON.stringify([{ type: 'text', text: ackText }]),
+  );
+
+  log.info(
+    { conversationId, callSessionId },
+    'User message routed as call instruction via bridge',
+  );
+
+  return { handled: true, userFacingText: ackText };
+}

package/src/calls/call-constants.ts

@@ -0,0 +1,48 @@
+import { getConfig } from '../config/loader.js';
+
+// Emergency/high-risk numbers that should never be called
+export const DENIED_NUMBERS = new Set([
+  '911', '112', '999', '000', '110', '119',
+]);
+
+/**
+ * Check whether a phone number is a denied emergency number.
+ *
+ * Normalizes E.164 variants by stripping the leading '+' and then checking
+ * whether the resulting digit string exactly matches a denied number or could
+ * be a country-code-prefixed emergency number (e.g. +1911, +44999, +61000).
+ * Country codes are 1–3 digits, so we try every valid split.
+ */
+export function isDeniedNumber(phoneNumber: string): boolean {
+  // Strip leading '+' to get a digits-only string
+  const digits = phoneNumber.startsWith('+') ? phoneNumber.slice(1) : phoneNumber;
+
+  // Exact match (covers bare short codes like "911", "112")
+  if (DENIED_NUMBERS.has(digits)) return true;
+
+  // Try splitting off 1-, 2-, or 3-digit country codes and check if the
+  // remainder is a denied number. This catches patterns like +1911, +44999.
+  for (let ccLen = 1; ccLen <= 3; ccLen++) {
+    if (digits.length > ccLen) {
+      const remainder = digits.slice(ccLen);
+      if (DENIED_NUMBERS.has(remainder)) return true;
+    }
+  }
+
+  return false;
+}
+
+// Call limits — backed by config with hardcoded fallbacks
+export function getMaxCallDurationMs(): number {
+  return getConfig().calls.maxDurationSeconds * 1000;
+}
+
+export function getUserConsultationTimeoutMs(): number {
+  return getConfig().calls.userConsultTimeoutSeconds * 1000;
+}
+
+export const SILENCE_TIMEOUT_MS = 30 * 1000; // 30 seconds
+
+// Legacy named exports for backward compatibility (use functions above for config-backed values)
+export const MAX_CALL_DURATION_MS = 3600 * 1000; // fallback default; prefer getMaxCallDurationMs()
+export const USER_CONSULTATION_TIMEOUT_MS = 120 * 1000; // fallback default; prefer getUserConsultationTimeoutMs()