@vellumai/assistant 0.7.0 → 0.7.2

package/src/runtime/routes/inbound-stages/verification-intercept.ts

@@ -1,329 +0,0 @@
-/**
- * Verification code intercept stage: validates and consumes verification
- * codes, applies role-specific side effects (guardian binding creation,
- * trusted-contact activation signals), upserts member records, and delivers
- * deterministic template-driven replies.
- *
- * This is the dispatch point for channel-based post-verification side
- * effects. Voice verification has its own dispatch in relay-server.ts.
- * Both guardian and trusted-contact flows converge here after
- * validateAndConsumeVerification() returns success.
- *
- * Verification code messages are short-circuited here and NEVER enter the
- * agent pipeline. This prevents verification codes from producing
- * agent-generated copy.
- */
-import type { ChannelId } from "../../../channels/types.js";
-import { findContactChannel } from "../../../contacts/contact-store.js";
-import {
-  createGuardianBinding,
-  revokeGuardianBinding,
-  upsertContactChannel,
-} from "../../../contacts/contacts-write.js";
-import {
-  clearPendingVerificationReply,
-  storePendingVerificationReply,
-} from "../../../memory/delivery-channels.js";
-import { emitNotificationSignal } from "../../../notifications/emit-signal.js";
-import type { NotificationSourceChannel } from "../../../notifications/signal.js";
-import { canonicalizeInboundIdentity } from "../../../util/canonicalize-identity.js";
-import { getLogger } from "../../../util/logger.js";
-import {
-  findActiveSession,
-  getGuardianBinding,
-  getPendingSession,
-  validateAndConsumeVerification,
-} from "../../channel-verification-service.js";
-import { deliverChannelReply } from "../../gateway-client.js";
-import {
-  composeChannelVerifyReply,
-  GUARDIAN_VERIFY_TEMPLATE_KEYS,
-} from "../../verification-templates.js";
-import { stripVerificationFailurePrefix } from "../channel-route-shared.js";
-
-const log = getLogger("runtime-http");
-
-// ---------------------------------------------------------------------------
-// Public API
-// ---------------------------------------------------------------------------
-
-export interface VerificationInterceptParams {
-  isDuplicate: boolean;
-  guardianVerifyCode: string | undefined;
-  rawSenderId: string | undefined;
-  canonicalSenderId: string | null;
-  canonicalAssistantId: string;
-  sourceChannel: ChannelId;
-  conversationExternalId: string;
-  conversationId: string;
-  eventId: string;
-  replyCallbackUrl: string | undefined;
-  assistantId: string;
-  actorDisplayName: string | undefined;
-  actorUsername: string | undefined;
-}
-
-/**
- * Intercept guardian verification codes and handle them deterministically.
- *
- * Bare 6-digit codes are only intercepted when there is actually a
- * pending challenge or active outbound session for this channel.
- * Without this guard, normal 6-digit messages (zip codes, PINs, etc.)
- * would be swallowed by the verification handler and never reach the
- * agent pipeline.
- *
- * Returns a Response if the verification was handled, or null to continue
- * the pipeline.
- */
-export async function handleVerificationIntercept(
-  params: VerificationInterceptParams,
-): Promise<Record<string, unknown> | null> {
-  const {
-    isDuplicate,
-    guardianVerifyCode,
-    rawSenderId,
-    canonicalSenderId,
-    canonicalAssistantId,
-    sourceChannel,
-    conversationExternalId,
-    conversationId,
-    eventId,
-    replyCallbackUrl,
-    assistantId,
-    actorDisplayName,
-    actorUsername,
-  } = params;
-
-  // Only intercept when there is a pending challenge or active outbound session
-  const shouldIntercept =
-    guardianVerifyCode !== undefined &&
-    (!!getPendingSession(sourceChannel) || !!findActiveSession(sourceChannel));
-
-  if (
-    isDuplicate ||
-    !shouldIntercept ||
-    guardianVerifyCode === undefined ||
-    !rawSenderId
-  ) {
-    return null;
-  }
-
-  const verifyResult = validateAndConsumeVerification(
-    sourceChannel,
-    guardianVerifyCode,
-    canonicalSenderId ?? rawSenderId,
-    conversationExternalId,
-    actorUsername,
-    actorDisplayName,
-  );
-
-  const guardianVerifyOutcome: "verified" | "failed" = verifyResult.success
-    ? "verified"
-    : "failed";
-
-  if (verifyResult.success) {
-    const existingContactResult =
-      (canonicalSenderId ?? rawSenderId)
-        ? findContactChannel({
-            channelType: sourceChannel,
-            externalUserId: canonicalSenderId ?? rawSenderId,
-            externalChatId: conversationExternalId,
-          })
-        : null;
-    const existingChannel = existingContactResult?.channel ?? null;
-    const existingContact = existingContactResult?.contact ?? null;
-    const memberMatchesSender = existingChannel?.externalUserId
-      ? canonicalizeInboundIdentity(
-          sourceChannel,
-          existingChannel.externalUserId,
-        ) === (canonicalSenderId ?? rawSenderId)
-      : false;
-    const preservedDisplayName =
-      memberMatchesSender && existingContact?.displayName?.trim().length
-        ? existingContact.displayName
-        : actorDisplayName;
-
-    upsertContactChannel({
-      sourceChannel,
-      externalUserId: canonicalSenderId ?? rawSenderId,
-      externalChatId: conversationExternalId,
-      status: "active",
-      policy: "allow",
-      // Keep guardian-curated member name stable across re-verification.
-      displayName: preservedDisplayName,
-      username: actorUsername,
-    });
-
-    // Guardian-specific side effect: create/update the guardian binding.
-    // This was previously inside validateAndConsumeVerification but is now
-    // handled here so both verification types have symmetric dispatch.
-    if (verifyResult.verificationType === "guardian") {
-      // Reject if a different user already holds the guardian binding
-      const existingBinding = getGuardianBinding(
-        canonicalAssistantId,
-        sourceChannel,
-      );
-      if (
-        existingBinding &&
-        existingBinding.guardianExternalUserId !==
-          (canonicalSenderId ?? rawSenderId)
-      ) {
-        // Edge case: another user already bound. Log and skip binding creation.
-        // The upsertContactChannel above already succeeded, so the sender is a known contact,
-        // but they won't get guardian role.
-        log.warn(
-          {
-            sourceChannel,
-            existingGuardian: existingBinding.guardianExternalUserId,
-          },
-          "Guardian binding conflict: another user already holds this channel binding",
-        );
-      } else {
-        // Revoke any existing active binding before creating a new one (same-user re-verification)
-        revokeGuardianBinding(sourceChannel);
-
-        const metadata: Record<string, string> = {};
-        if (actorUsername && actorUsername.trim().length > 0) {
-          metadata.username = actorUsername.trim();
-        }
-        if (actorDisplayName && actorDisplayName.trim().length > 0) {
-          metadata.displayName = actorDisplayName.trim();
-        }
-
-        // Unify all channel bindings onto the canonical (vellum) principal
-        const vellumBinding = getGuardianBinding(
-          canonicalAssistantId,
-          "vellum",
-        );
-        const canonicalPrincipal =
-          vellumBinding?.guardianPrincipalId ??
-          canonicalSenderId ??
-          rawSenderId;
-
-        createGuardianBinding({
-          channel: sourceChannel,
-          guardianExternalUserId: canonicalSenderId ?? rawSenderId,
-          guardianDeliveryChatId: conversationExternalId,
-          guardianPrincipalId: canonicalPrincipal,
-          verifiedVia: "challenge",
-          metadataJson:
-            Object.keys(metadata).length > 0 ? JSON.stringify(metadata) : null,
-        });
-      }
-    }
-
-    const verifyLogLabel =
-      verifyResult.verificationType === "trusted_contact"
-        ? "Trusted contact verified"
-        : "Guardian verified";
-    log.info(
-      {
-        sourceChannel,
-        externalUserId: canonicalSenderId,
-        verificationType: verifyResult.verificationType,
-      },
-      `${verifyLogLabel}: auto-upserted ingress member`,
-    );
-
-    // Emit activated signal when a trusted contact completes verification.
-    // Member record is persisted above before this event fires, satisfying
-    // the persistence-before-event ordering invariant.
-    if (verifyResult.verificationType === "trusted_contact") {
-      void emitNotificationSignal({
-        sourceEventName: "ingress.trusted_contact.activated",
-        sourceChannel: sourceChannel as NotificationSourceChannel,
-        sourceContextId: conversationId,
-        attentionHints: {
-          requiresAction: false,
-          urgency: "low",
-          isAsyncBackground: false,
-          visibleInSourceNow: false,
-        },
-        contextPayload: {
-          sourceChannel,
-          actorExternalId: canonicalSenderId ?? rawSenderId,
-          conversationExternalId,
-          actorDisplayName: actorDisplayName ?? null,
-          actorUsername: actorUsername ?? null,
-        },
-        dedupeKey: `trusted-contact:activated:${canonicalAssistantId}:${sourceChannel}:${
-          canonicalSenderId ?? rawSenderId
-        }`,
-      });
-    }
-  }
-
-  // Deliver a deterministic template-driven reply and short-circuit.
-  // Verification code messages must never produce agent-generated copy.
-  if (replyCallbackUrl) {
-    let replyText: string;
-    if (!verifyResult.success) {
-      replyText = composeChannelVerifyReply(
-        GUARDIAN_VERIFY_TEMPLATE_KEYS.CHANNEL_VERIFY_FAILED,
-        { failureReason: stripVerificationFailurePrefix(verifyResult.reason) },
-      );
-    } else {
-      replyText = composeChannelVerifyReply(
-        GUARDIAN_VERIFY_TEMPLATE_KEYS.CHANNEL_VERIFY_SUCCESS,
-        { verificationType: verifyResult.verificationType },
-      );
-    }
-    try {
-      await deliverChannelReply(replyCallbackUrl, {
-        chatId: conversationExternalId,
-        text: replyText,
-        assistantId,
-      });
-    } catch (err) {
-      // The challenge is already consumed and side effects applied, so
-      // we cannot simply re-throw and let the gateway retry the full
-      // flow. Instead, persist the reply so that gateway retries
-      // (which arrive as duplicates) can re-attempt delivery.
-      log.error(
-        { err, conversationExternalId },
-        "Failed to deliver deterministic verification reply; persisting for retry",
-      );
-      storePendingVerificationReply(eventId, {
-        chatId: conversationExternalId,
-        text: replyText,
-        assistantId,
-      });
-
-      // Self-retry after a short delay. The gateway deduplicates
-      // inbound webhooks after a successful forward, so duplicate
-      // retries may never arrive. This fire-and-forget retry ensures
-      // delivery is re-attempted even without a gateway duplicate.
-      setTimeout(async () => {
-        try {
-          await deliverChannelReply(replyCallbackUrl, {
-            chatId: conversationExternalId,
-            text: replyText,
-            assistantId,
-          });
-          log.info({ eventId }, "Verification reply delivered on self-retry");
-          clearPendingVerificationReply(eventId);
-        } catch (retryErr) {
-          log.error(
-            { err: retryErr, eventId },
-            "Verification reply self-retry also failed; pending reply remains as fallback",
-          );
-        }
-      }, 3000);
-
-      return ({
-        accepted: true,
-        duplicate: false,
-        eventId,
-        verificationOutcome: guardianVerifyOutcome,
-        deliveryPending: true,
-      });
-    }
-  }
-
-  return ({
-    accepted: true,
-    duplicate: false,
-    eventId,
-    verificationOutcome: guardianVerifyOutcome,
-  });
-}

package/src/signals/mcp-reload.ts

@@ -1,18 +0,0 @@
-/**
- * Handle MCP reload signals from the CLI.
- *
- * When the CLI writes to `signals/mcp-reload`, the daemon's ConfigWatcher
- * detects the file change and invokes {@link handleMcpReloadSignal} to
- * restart MCP servers with the latest configuration.
- */
-
-import { reloadMcpServers } from "../daemon/mcp-reload-service.js";
-import { getLogger } from "../util/logger.js";
-
-const log = getLogger("signal:mcp-reload");
-
-export function handleMcpReloadSignal(): void {
-  reloadMcpServers().catch((err: unknown) => {
-    log.error({ err }, "MCP reload triggered by signal file failed");
-  });
-}

package/src/tools/secret-detection-handler.ts

@@ -1,269 +0,0 @@
-import { getConfig } from "../config/loader.js";
-import { PermissionPrompter } from "../permissions/prompter.js";
-import { RiskLevel } from "../permissions/types.js";
-import type { SecretPattern } from "../security/secret-scanner.js";
-import {
-  compileCustomPatterns,
-  redactSecrets,
-  scanText,
-} from "../security/secret-scanner.js";
-import type {
-  ExecutionTarget,
-  ToolContext,
-  ToolExecutionResult,
-  ToolLifecycleEvent,
-} from "./types.js";
-
-/**
- * Encapsulates post-execution secret detection, redaction, and action handling.
- * Extracted from ToolExecutor to isolate the secret-scanning concern.
- */
-export class SecretDetectionHandler {
-  private prompter: PermissionPrompter;
-
-  constructor(prompter: PermissionPrompter) {
-    this.prompter = prompter;
-  }
-
-  /**
-   * Scan a tool execution result for secrets and apply the configured action
-   * (redact, block, or prompt). Returns the (possibly modified) result, or
-   * a blocked result if secrets were blocked. Returns `null` when no secret
-   * handling was needed and the caller should continue normally.
-   */
-  async handle(
-    execResult: ToolExecutionResult,
-    name: string,
-    input: Record<string, unknown>,
-    context: ToolContext,
-    executionTarget: ExecutionTarget,
-    riskLevel: string,
-    decision: string,
-    startTime: number,
-    emitLifecycleEvent: (
-      context: ToolContext,
-      event: ToolLifecycleEvent,
-    ) => void,
-  ): Promise<{ result: ToolExecutionResult; earlyReturn: boolean }> {
-    const sdConfig = getConfig().secretDetection;
-    if (!sdConfig.enabled || execResult.isError) {
-      return { result: execResult, earlyReturn: false };
-    }
-
-    const entropyConfig = {
-      enabled: true,
-      base64Threshold: sdConfig.entropyThreshold,
-    };
-    const compiledCustom = sdConfig.customPatterns?.length
-      ? compileCustomPatterns(sdConfig.customPatterns)
-      : undefined;
-
-    const allMatches = this.collectMatches(
-      execResult,
-      entropyConfig,
-      compiledCustom,
-    );
-
-    if (allMatches.length === 0) {
-      return { result: execResult, earlyReturn: false };
-    }
-
-    const matchSummary = allMatches.map((m) => ({
-      type: m.type,
-      redactedValue: m.redactedValue,
-    }));
-
-    emitLifecycleEvent(context, {
-      type: "secret_detected",
-      toolName: name,
-      executionTarget,
-      input,
-      workingDir: context.workingDir,
-      conversationId: context.conversationId,
-      requestId: context.requestId,
-      matches: matchSummary,
-      action: sdConfig.action,
-      detectedAtMs: Date.now(),
-    });
-
-    if (sdConfig.action === "redact") {
-      this.redactResult(execResult, entropyConfig, compiledCustom);
-      return { result: execResult, earlyReturn: false };
-    }
-
-    if (sdConfig.action === "block") {
-      return this.handleBlock(
-        allMatches,
-        name,
-        input,
-        context,
-        executionTarget,
-        riskLevel,
-        decision,
-        startTime,
-        emitLifecycleEvent,
-      );
-    }
-
-    if (sdConfig.action === "prompt") {
-      return this.handlePrompt(
-        allMatches,
-        execResult,
-        name,
-        input,
-        context,
-        executionTarget,
-        riskLevel,
-        decision,
-        startTime,
-        emitLifecycleEvent,
-      );
-    }
-
-    return { result: execResult, earlyReturn: false };
-  }
-
-  private collectMatches(
-    execResult: ToolExecutionResult,
-    entropyConfig: { enabled: boolean; base64Threshold: number },
-    compiledCustom: SecretPattern[] | undefined,
-  ) {
-    const contentMatches = scanText(
-      execResult.content,
-      entropyConfig,
-      compiledCustom,
-    );
-    const diffMatches = execResult.diff
-      ? scanText(execResult.diff.newContent, entropyConfig, compiledCustom)
-      : [];
-    const blockMatches = (execResult.contentBlocks ?? []).flatMap((block) => {
-      if (block.type === "text")
-        return scanText(block.text, entropyConfig, compiledCustom);
-      if (block.type === "file" && block.extracted_text)
-        return scanText(block.extracted_text, entropyConfig, compiledCustom);
-      return [];
-    });
-    return [...contentMatches, ...diffMatches, ...blockMatches];
-  }
-
-  private redactResult(
-    execResult: ToolExecutionResult,
-    entropyConfig: { enabled: boolean; base64Threshold: number },
-    compiledCustom: SecretPattern[] | undefined,
-  ): void {
-    execResult.content = redactSecrets(
-      execResult.content,
-      entropyConfig,
-      compiledCustom,
-    );
-    if (execResult.diff) {
-      execResult.diff = {
-        ...execResult.diff,
-        newContent: redactSecrets(
-          execResult.diff.newContent,
-          entropyConfig,
-          compiledCustom,
-        ),
-      };
-    }
-    if (execResult.contentBlocks) {
-      execResult.contentBlocks = execResult.contentBlocks.map((block) => {
-        if (block.type === "text") {
-          return {
-            ...block,
-            text: redactSecrets(block.text, entropyConfig, compiledCustom),
-          };
-        }
-        if (block.type === "file" && block.extracted_text) {
-          return {
-            ...block,
-            extracted_text: redactSecrets(
-              block.extracted_text,
-              entropyConfig,
-              compiledCustom,
-            ),
-          };
-        }
-        return block;
-      });
-    }
-  }
-
-  private handleBlock(
-    allMatches: Array<{ type: string; redactedValue: string }>,
-    name: string,
-    input: Record<string, unknown>,
-    context: ToolContext,
-    executionTarget: ExecutionTarget,
-    riskLevel: string,
-    decision: string,
-    startTime: number,
-    emitLifecycleEvent: (
-      context: ToolContext,
-      event: ToolLifecycleEvent,
-    ) => void,
-  ): { result: ToolExecutionResult; earlyReturn: boolean } {
-    const types = [...new Set(allMatches.map((m) => m.type))].join(", ");
-    const blockedContent = `Tool output blocked: detected ${allMatches.length} potential secret(s) (${types}). Configure secretDetection.action to "redact" or "prompt" to allow output.`;
-    const durationMs = Date.now() - startTime;
-    const blockedResult: ToolExecutionResult = {
-      content: blockedContent,
-      isError: true,
-    };
-
-    emitLifecycleEvent(context, {
-      type: "executed",
-      toolName: name,
-      executionTarget,
-      input,
-      workingDir: context.workingDir,
-      conversationId: context.conversationId,
-      requestId: context.requestId,
-      riskLevel,
-      decision,
-      durationMs,
-      result: blockedResult,
-    });
-
-    return { result: blockedResult, earlyReturn: true };
-  }
-
-  private async handlePrompt(
-    allMatches: Array<{ type: string; redactedValue: string }>,
-    _execResult: ToolExecutionResult,
-    name: string,
-    input: Record<string, unknown>,
-    context: ToolContext,
-    executionTarget: ExecutionTarget,
-    _riskLevel: string,
-    _decision: string,
-    startTime: number,
-    emitLifecycleEvent: (
-      context: ToolContext,
-      event: ToolLifecycleEvent,
-    ) => void,
-  ): Promise<{ result: ToolExecutionResult; earlyReturn: boolean }> {
-    const types = [...new Set(allMatches.map((m) => m.type))].join(", ");
-    const blockedContent = `Tool output blocked: detected ${allMatches.length} potential secret(s) (${types}). Ask the user for confirmation conversationally before retrying.`;
-    const durationMs = Date.now() - startTime;
-
-    emitLifecycleEvent(context, {
-      type: "permission_denied",
-      toolName: name,
-      executionTarget,
-      input,
-      workingDir: context.workingDir,
-      conversationId: context.conversationId,
-      requestId: context.requestId,
-      riskLevel: RiskLevel.High,
-      decision: "deny",
-      reason: "Secret output blocked without deterministic prompt",
-      durationMs,
-    });
-
-    return {
-      result: { content: blockedContent, isError: true },
-      earlyReturn: true,
-    };
-  }
-}