@vellumai/assistant 0.4.29 → 0.4.31

package/src/calls/relay-server.ts

@@ -20,12 +20,13 @@ import {
 import {
   createGuardianBinding,
   revokeGuardianBinding,
+  touchContactInteraction,
   upsertMember,
 } from "../contacts/contacts-write.js";
 import { getAssistantName } from "../daemon/identity-helpers.js";
 import { getCanonicalGuardianRequest } from "../memory/canonical-guardian-store.js";
 import * as conversationStore from "../memory/conversation-store.js";
-import { findActiveVoiceInvites } from "../memory/ingress-invite-store.js";
+import { findActiveVoiceInvites } from "../memory/invite-store.js";
 import { revokeScopedApprovalGrantsForContext } from "../memory/scoped-approval-grants.js";
 import { emitNotificationSignal } from "../notifications/emit-signal.js";
 import { notifyGuardianOfAccessRequest } from "../runtime/access-request-helper.js";
@@ -43,7 +44,7 @@ import {
   composeVerificationVoice,
   GUARDIAN_VERIFY_TEMPLATE_KEYS,
 } from "../runtime/guardian-verification-templates.js";
-import { redeemVoiceInviteCode } from "../runtime/ingress-service.js";
+import { redeemVoiceInviteCode } from "../runtime/invite-service.js";
 import { parseJsonSafe } from "../util/json.js";
 import { getLogger } from "../util/logger.js";
 import {
@@ -874,6 +875,10 @@ export class RelayConnection {
       }
 
       // Guardian and trusted-contact callers proceed normally.
+      if (actorTrust.memberRecord) {
+        touchContactInteraction(actorTrust.memberRecord.contact.id);
+      }
+
       // Update the controller's guardian context with the trust-resolved
       // context so downstream policy gates have accurate actor metadata.
       if (this.controller && actorTrust.trustClass !== "unknown") {
@@ -1213,15 +1218,43 @@ export class RelayConnection {
 
       // Create the guardian binding now that verification succeeded.
       if (result.verificationType === "guardian") {
-        revokeGuardianBinding(this.guardianChallengeAssistantId, "voice");
-        createGuardianBinding({
-          assistantId: this.guardianChallengeAssistantId,
-          channel: "voice",
-          guardianExternalUserId: this.guardianVerificationFromNumber,
-          guardianDeliveryChatId: this.guardianVerificationFromNumber,
-          guardianPrincipalId: this.guardianVerificationFromNumber,
-          verifiedVia: "challenge",
-        });
+        const existingBinding = getGuardianBinding(
+          this.guardianChallengeAssistantId,
+          "voice",
+        );
+        if (
+          existingBinding &&
+          existingBinding.guardianExternalUserId !==
+            this.guardianVerificationFromNumber
+        ) {
+          log.warn(
+            {
+              callSessionId: this.callSessionId,
+              existingGuardian: existingBinding.guardianExternalUserId,
+            },
+            "Guardian binding conflict: another user already holds the voice binding",
+          );
+        } else {
+          revokeGuardianBinding(this.guardianChallengeAssistantId, "voice");
+
+          // Unify all channel bindings onto the canonical (vellum) principal
+          const vellumBinding = getGuardianBinding(
+            this.guardianChallengeAssistantId,
+            "vellum",
+          );
+          const canonicalPrincipal =
+            vellumBinding?.guardianPrincipalId ??
+            this.guardianVerificationFromNumber;
+
+          createGuardianBinding({
+            assistantId: this.guardianChallengeAssistantId,
+            channel: "voice",
+            guardianExternalUserId: this.guardianVerificationFromNumber,
+            guardianDeliveryChatId: this.guardianVerificationFromNumber,
+            guardianPrincipalId: canonicalPrincipal,
+            verifiedVia: "challenge",
+          });
+        }
       }
 
       if (isOutbound) {

package/src/channels/config.ts

@@ -47,7 +47,7 @@ const CHANNEL_POLICIES = {
   },
   slack: {
     notification: {
-      deliveryEnabled: false,
+      deliveryEnabled: true,
       conversationStrategy: "continue_existing_conversation",
     },
   },

package/src/cli/integrations.ts

@@ -58,14 +58,6 @@ function toQueryString(params: Record<string, string | undefined>): string {
   return encoded ? `?${encoded}` : "";
 }
 
-function resolveGatewayBaseUrl(): string {
-  const injectedGatewayBase = process.env.INTERNAL_GATEWAY_BASE_URL?.trim();
-  if (injectedGatewayBase && injectedGatewayBase.length > 0) {
-    return injectedGatewayBase.replace(/\/+$/, "");
-  }
-  return getGatewayInternalBaseUrl();
-}
-
 function readIngressConfig(): {
   success: true;
   enabled: boolean;
@@ -86,7 +78,7 @@ function readIngressConfig(): {
     success: true,
     enabled,
     publicBaseUrl: configuredUrl || undefined,
-    localGatewayTarget: resolveGatewayBaseUrl(),
+    localGatewayTarget: getGatewayInternalBaseUrl(),
   };
 }
 
@@ -112,8 +104,11 @@ function readVoiceConfig(): {
   };
 }
 
+// CLI-specific gateway helper — uses GATEWAY_AUTH_TOKEN env var for out-of-process
+// access. See runtime/gateway-internal-client.ts for daemon-internal usage which
+// mints fresh tokens.
 async function gatewayGet(path: string): Promise<unknown> {
-  const gatewayBase = resolveGatewayBaseUrl();
+  const gatewayBase = getGatewayInternalBaseUrl();
   const token = getGatewayToken();
 
   const response = await fetch(`${gatewayBase}${path}`, {
@@ -169,7 +164,7 @@ export function registerContactsCommand(program: Command): void {
   contacts
     .command("list")
     .description("List contacts (calls /v1/contacts)")
-    .option("--role <role>", "Filter by role")
+    .option("--role <role>", "Filter by role (default: contact)", "contact")
     .option("--limit <limit>", "Maximum number of contacts to return")
     .option("--query <query>", "Search query to filter contacts")
     .action(
@@ -192,7 +187,7 @@ export function registerContactsCommand(program: Command): void {
 
   contacts
     .command("invites")
-    .description("List ingress invites (calls /v1/ingress/invites)")
+    .description("List contact invites")
     .option("--source-channel <sourceChannel>", "Filter by source channel")
     .option("--status <status>", "Filter by invite status")
     .action(
@@ -205,7 +200,7 @@ export function registerContactsCommand(program: Command): void {
           status: opts.status,
         });
         await runRead(cmd, async () =>
-          gatewayGet(`/v1/ingress/invites${query}`),
+          gatewayGet(`/v1/contacts/invites${query}`),
         );
       },
     );
@@ -237,9 +232,9 @@ export function registerIntegrationsCommand(program: Command): void {
   guardian
     .command("status")
     .description("Get guardian status for a channel")
-    .option("--channel <channel>", "Channel: telegram|voice|sms", "voice")
+    .option("--channel <channel>", "Channel: telegram|voice|sms", "telegram")
     .action(async (opts: { channel?: GuardianChannel }, cmd: Command) => {
-      const channel = opts.channel ?? "voice";
+      const channel = opts.channel ?? "telegram";
       await runRead(cmd, async () =>
         gatewayGet(
           `/v1/integrations/guardian/status${toQueryString({ channel })}`,
@@ -300,57 +295,6 @@ export function registerIntegrationsCommand(program: Command): void {
       await runRead(cmd, async () => readIngressConfig());
     });
 
-  ingress
-    .command("members")
-    .description(
-      "[Deprecated: use 'vellum contacts list'] List trusted contacts",
-    )
-    .option("--limit <limit>", "Maximum number of contacts to return")
-    .option("--role <role>", "Filter by role (default: contact)")
-    .action(
-      async (
-        opts: {
-          limit?: string;
-          role?: string;
-        },
-        cmd: Command,
-      ) => {
-        process.stderr.write(
-          "⚠️  'vellum integrations ingress members' is deprecated. Use 'vellum contacts list' instead.\n",
-        );
-        const query = toQueryString({
-          role: opts.role ?? "contact",
-          limit: opts.limit,
-        });
-        await runRead(cmd, async () => gatewayGet(`/v1/contacts${query}`));
-      },
-    );
-
-  ingress
-    .command("invites")
-    .description(
-      "[Deprecated: use 'vellum contacts invites'] List trusted ingress invites",
-    )
-    .option("--source-channel <sourceChannel>", "Filter by source channel")
-    .option("--status <status>", "Filter by invite status")
-    .action(
-      async (
-        opts: { sourceChannel?: IngressChannel; status?: string },
-        cmd: Command,
-      ) => {
-        process.stderr.write(
-          "⚠️  'vellum integrations ingress invites' is deprecated. Use 'vellum contacts invites' instead.\n",
-        );
-        const query = toQueryString({
-          sourceChannel: opts.sourceChannel,
-          status: opts.status,
-        });
-        await runRead(cmd, async () =>
-          gatewayGet(`/v1/ingress/invites${query}`),
-        );
-      },
-    );
-
   const voice = integrations.command("voice").description("Voice setup status");
 
   voice