@vellumai/assistant 0.9.0-dev.202606181324.0804a69 → 0.9.0-dev.202606181513.fd39213

package/src/calls/relay-server.ts

@@ -8,6 +8,7 @@
 
 import { randomInt } from "node:crypto";
 
+import type { AdmissionPolicy } from "@vellumai/gateway-client";
 import type { ServerWebSocket } from "bun";
 
 import {
@@ -47,6 +48,7 @@ import {
   updateCallSession,
 } from "./call-store.js";
 import { ConversationRelayTransport } from "./call-transport.js";
+import { getChannelAdmissionPolicy } from "./channel-admission-reader.js";
 import { finalizeCall } from "./finalize-call.js";
 import {
   classifyWaitUtterance,
@@ -170,6 +172,11 @@ export function setRelayBroadcast(fn: (msg: ServerMessage) => void): void {
  */
 type RelayConnectionState =
   | "connected"
+  // Transient state held synchronously from the start of handleSetup until
+  // routing/ACL completes. Prompts arriving in this window are dropped so a
+  // not-yet-authorized caller's speech is never persisted/emitted before the
+  // admission floor and trust ACL are applied.
+  | "setting_up"
   | "verification_pending"
   | "awaiting_name"
   | "awaiting_guardian_decision"
@@ -550,15 +557,58 @@ export class RelayConnection {
       "ConversationRelay setup received",
     );
 
+    // Enter the setup-pending state synchronously, before any await. The
+    // admission-policy read below yields the event loop, and inbound frames are
+    // dispatched fire-and-forget, so a `prompt` frame can arrive before routing
+    // completes. handlePrompt drops prompts while in "setting_up" so a blocked
+    // or admission-denied caller's speech is never stored before the ACL runs.
+    this.connectionState = "setting_up";
+
     const session = getCallSession(this.callSessionId);
     this.recordSetupBookkeeping(session, msg);
 
+    // Resolve the phone channel's inbound admission floor. The reader fails
+    // open to `null` by contract, so a transport hiccup admits the caller.
+    const admissionPolicy = await getChannelAdmissionPolicy("phone");
+
+    try {
+      await this.routeSetupOutcome(msg, session, admissionPolicy);
+    } catch (err) {
+      // Never leave the connection stranded in "setting_up": a setup that
+      // throws before reaching a terminal outcome would otherwise drop every
+      // prompt forever. Tear the call down instead.
+      log.error(
+        { err, callSessionId: this.callSessionId },
+        "Setup routing failed — disconnecting",
+      );
+      this.connectionState = "disconnecting";
+      updateCallSession(this.callSessionId, {
+        status: "failed",
+        endedAt: Date.now(),
+        lastError: "Setup routing failed",
+      });
+      this.endSession("Setup routing failed");
+    }
+  }
+
+  /**
+   * Apply the routing/ACL outcome for a setup frame. Synchronous helpers that
+   * fire-and-forget (greeting, verification, name capture) are awaited here only
+   * when they themselves are async. Each reachable outcome transitions the
+   * connection out of "setting_up" into its terminal state.
+   */
+  private async routeSetupOutcome(
+    msg: RelaySetupMessage,
+    session: ReturnType<typeof getCallSession>,
+    admissionPolicy: AdmissionPolicy | null,
+  ): Promise<void> {
     const { outcome, resolved } = routeSetup({
       callSessionId: this.callSessionId,
       session,
       from: msg.from,
       to: msg.to,
       customParameters: msg.customParameters,
+      admissionPolicy,
     });
 
     const initialTrustContext = toTrustContext(
@@ -634,6 +684,9 @@ export class RelayConnection {
             );
           }
         }
+        // Routing/ACL cleared — leave the setup-pending state so subsequent
+        // prompts are handled normally.
+        this.connectionState = "connected";
         this.startNormalCallFlow(controller, outcome.isInbound);
         return;
     }
@@ -1822,6 +1875,13 @@ export class RelayConnection {
       return;
     }
 
+    // Prompts arriving before setup routing/ACL completes are dropped — never
+    // persisted or emitted — so a not-yet-authorized caller's speech can't be
+    // stored ahead of the admission floor / trust ACL decision.
+    if (this.connectionState === "setting_up") {
+      return;
+    }
+
     if (!msg.last) {
       // Partial transcript, wait for final
       return;
@@ -2024,6 +2084,12 @@ export class RelayConnection {
       return;
     }
 
+    // Drop DTMF arriving before setup routing/ACL completes (same reasoning as
+    // handlePrompt): don't record input from a not-yet-authorized caller.
+    if (this.connectionState === "setting_up") {
+      return;
+    }
+
     // Ignore DTMF during name capture and guardian decision wait
     if (
       this.connectionState === "awaiting_name" ||

package/src/calls/relay-setup-router.ts

@@ -6,6 +6,8 @@
  * next — without performing any side effects itself.
  */
 
+import type { AdmissionPolicy } from "@vellumai/gateway-client";
+
 import { getConfig } from "../config/loader.js";
 import { findActiveVoiceInvites } from "../memory/invite-store.js";
 import {
@@ -14,6 +16,10 @@ import {
 } from "../runtime/actor-trust-resolver.js";
 import { DAEMON_INTERNAL_ASSISTANT_ID } from "../runtime/assistant-scope.js";
 import { getPendingSession } from "../runtime/channel-verification-service.js";
+import {
+  type AdmissionPolicyResult,
+  enforceAdmissionPolicy,
+} from "../runtime/routes/inbound-stages/admission-policy.js";
 import { getLogger } from "../util/logger.js";
 import type { CallSession } from "./types.js";
 
@@ -27,6 +33,12 @@ interface SetupContext {
   from: string;
   to: string;
   customParameters?: Record<string, string>;
+  /**
+   * Per-channel inbound admission floor for the `phone` channel, supplied by
+   * the caller. When absent/`null`, the floor check is skipped entirely —
+   * preserving all pre-admission behavior.
+   */
+  admissionPolicy?: AdmissionPolicy | null;
 }
 
 // ── Setup outcomes ───────────────────────────────────────────────────
@@ -184,6 +196,50 @@ export function routeSetup(ctx: SetupContext): {
   // ── Inbound call ACL evaluation ─────────────────────────────────
   const pendingChallenge = getPendingSession("phone");
 
+  // An admission floor is "active" only when a policy applies and no pending
+  // verification challenge is in flight. While active, the floor IS the access
+  // decision: an admitted caller bypasses the legacy identity flows
+  // (unverified_caller / name_capture) and connects directly. When inactive
+  // (null policy, flag off, exempt channel, reader failed open, or a pending
+  // challenge), those legacy flows are preserved unchanged.
+  const floorActive = ctx.admissionPolicy != null && !pendingChallenge;
+
+  // Inbound admission floor verdict; defaults to admitted when inactive.
+  const floorVerdict = floorActive
+    ? enforceAdmissionPolicy({
+        sourceChannel: "phone",
+        trustClass: actorTrust.trustClass,
+        memberStatus: actorTrust.memberRecord?.channel.status,
+        policy: ctx.admissionPolicy!,
+      })
+    : ({ admitted: true } as const);
+
+  // Floor-deny outcome shared by the unknown-caller and member-caller branches.
+  // Live calls cannot await async re-verification, so the floor's
+  // `shouldChallenge` upgrade UX is not surfaced — same rationale as `escalate`.
+  const floorDeny = (
+    denyVerdict: Extract<AdmissionPolicyResult, { admitted: false }>,
+  ) => {
+    log.info(
+      {
+        callSessionId: ctx.callSessionId,
+        from: ctx.from,
+        trustClass: actorTrust.trustClass,
+        effectivePolicy: denyVerdict.effectivePolicy,
+      },
+      "Inbound voice ACL: admission floor denied caller",
+    );
+    return {
+      outcome: {
+        action: "deny" as const,
+        message:
+          "This number is not authorized to reach the assistant right now.",
+        logReason: `Inbound voice admission floor: ${denyVerdict.effectivePolicy}`,
+      },
+      resolved,
+    };
+  };
+
   if (
     (actorTrust.trustClass === "unknown" ||
       actorTrust.trustClass === "unverified_contact") &&
@@ -245,6 +301,21 @@ export function routeSetup(ctx: SetupContext): {
       };
     }
 
+    // When a floor is active it is the access decision: an admitted caller
+    // connects directly (skipping unverified_caller / name_capture), and a
+    // below-floor caller is denied. Invites (handled above) bypass the floor
+    // as an explicit grant. When the floor is inactive (null policy), fall
+    // through to the legacy identity flows below.
+    if (floorActive) {
+      if (!floorVerdict.admitted) {
+        return floorDeny(floorVerdict);
+      }
+      return {
+        outcome: { action: "normal_call" as const, isInbound: true },
+        resolved,
+      };
+    }
+
     // Known caller whose channel hasn't passed verification yet —
     // mirrors the gateway's pre-intercept (twilio-voice-webhook.ts) so
     // calls slipping past it (e.g. canonicalization mismatch between
@@ -349,6 +420,12 @@ export function routeSetup(ctx: SetupContext): {
     };
   }
 
+  // Admission floor: deny member/guardian callers below the floor (e.g.
+  // `guardian_only` denies a trusted_contact).
+  if (!floorVerdict.admitted) {
+    return floorDeny(floorVerdict);
+  }
+
   // Guardian and trusted-contact callers proceed normally
   return {
     outcome: { action: "normal_call", isInbound: true },

package/src/calls/twilio-routes.ts

@@ -54,6 +54,7 @@ import {
   releaseCallbackClaim,
   updateCallSession,
 } from "./call-store.js";
+import { getChannelAdmissionPolicy } from "./channel-admission-reader.js";
 import { routeSetup } from "./relay-setup-router.js";
 import { resolveCallHints } from "./stt-hints.js";
 import { resolveTelephonySttRouting } from "./telephony-stt-routing.js";
@@ -277,10 +278,10 @@ const TWIML_HEADERS = { "Content-Type": "text/xml" } as const;
  * query for outbound calls). Returns a TwiML string. Throws RouteError
  * subclasses on failure.
  */
-function processVoiceWebhook(
+async function processVoiceWebhook(
   params: Record<string, string>,
   callSessionId: string | null,
-): string {
+): Promise<string> {
   const callSid = params.CallSid ?? null;
   const callerFrom = params.From ?? "";
   const callerTo = params.To ?? "";
@@ -371,7 +372,7 @@ export async function handleVoiceWebhook(req: Request): Promise<Response> {
   const params = Object.fromEntries(formBody.entries());
 
   try {
-    return twimlResponse(processVoiceWebhook(params, callSessionId));
+    return twimlResponse(await processVoiceWebhook(params, callSessionId));
   } catch (err) {
     if (err instanceof RouteError) {
       return new Response(err.message, { status: err.statusCode });
@@ -399,7 +400,7 @@ export async function handleVoiceWebhook(req: Request): Promise<Response> {
  * the Twilio setup payload. The persisted call session mode is the
  * primary signal for deterministic flow selection in the relay server.
  */
-function buildVoiceWebhookTwiml(
+async function buildVoiceWebhookTwiml(
   callSessionId: string,
   sessionContext: {
     task: string | null;
@@ -410,7 +411,7 @@ function buildVoiceWebhookTwiml(
     inviteGuardianName: string | null;
   } | null,
   verificationSessionId?: string | null,
-): string {
+): Promise<string> {
   const cfg = loadConfig();
   const profile = resolveVoiceQualityProfile(cfg);
 
@@ -476,11 +477,19 @@ function buildVoiceWebhookTwiml(
   const from = sessionContext?.fromNumber ?? "";
   const to = sessionContext?.toNumber ?? "";
 
+  // Resolve the phone channel's inbound admission floor so this preflight
+  // classification matches the real enforcement at stream start — a
+  // floor-denied caller is recognized as `deny` here, not `normal_call`.
+  // The reader fails open to `null` by contract, so a transport hiccup
+  // admits the caller.
+  const admissionPolicy = await getChannelAdmissionPolicy("phone");
+
   const { outcome } = routeSetup({
     callSessionId,
     session: session ?? null,
     from,
     to,
+    admissionPolicy,
   });
 
   // The media-stream transport supports normal_call and deny (which speaks
@@ -780,9 +789,9 @@ const EMPTY_TWIML = '<?xml version="1.0" encoding="UTF-8"?><Response/>';
  * Internal voice-webhook handler for gateway→runtime forwarding.
  * Accepts JSON body `{ params, originalUrl? }` from the gateway.
  */
-export function handleInternalVoiceWebhook({
+export async function handleInternalVoiceWebhook({
   body = {},
-}: RouteHandlerArgs): RouteResponse {
+}: RouteHandlerArgs): Promise<RouteResponse> {
   const { params = {}, originalUrl } = body as {
     params?: Record<string, string>;
     originalUrl?: string;
@@ -798,7 +807,7 @@ export function handleInternalVoiceWebhook({
     }
   }
 
-  const twiml = processVoiceWebhook(params, callSessionId);
+  const twiml = await processVoiceWebhook(params, callSessionId);
   return new RouteResponse(twiml, TWIML_HEADERS);
 }
 

package/src/daemon/conversation-agent-loop.ts

@@ -187,6 +187,67 @@ export interface AssistantSurface {
   activationMoment?: ActivationMomentParam;
 }
 
+// ── abort watchdog ───────────────────────────────────────────────────
+
+/**
+ * Generous backstop that drives an aborted turn to its `finally` even if some
+ * awaited operation fails to observe the abort signal.
+ *
+ * Abort is otherwise cooperative and already wired into the slow paths: the
+ * provider call forwards the signal to its HTTP/streaming fetch, and tool
+ * execution races the signal so a stuck tool can't block cancellation. This
+ * watchdog only fires when a future code path silently ignores abort — without
+ * it, such a path would hang the loop forever and latch the conversation's
+ * `processing` flag true (the wedged "Thinking…" indicator). It is
+ * defense-in-depth, not the primary mechanism, so the timeout is deliberately
+ * generous; in the common case abort settles in-flight work well before it.
+ */
+const ABORT_WATCHDOG_MS = 45_000;
+
+/**
+ * Race `work` against an abort watchdog. The watchdog stays disarmed until the
+ * signal fires; once it does, the turn has `timeoutMs` to settle before the
+ * watchdog rejects with the signal's own abort reason so the caller unwinds to
+ * its `finally` and the reason classifies as a user cancellation downstream.
+ * The abandoned `work` promise keeps running detached — its eventual rejection
+ * is swallowed so it can't surface as an unhandled rejection.
+ */
+async function withAbortWatchdog<T>(
+  work: Promise<T>,
+  signal: AbortSignal,
+  timeoutMs: number,
+  onFire: () => void,
+): Promise<T> {
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  let onAbort: (() => void) | undefined;
+  const watchdog = new Promise<never>((_, reject) => {
+    const arm = () => {
+      timer = setTimeout(() => {
+        onFire();
+        // Propagate the signal's own reason (an `AbortReason` for daemon-owned
+        // cancels) so the loop's catch classifies this as a user cancellation;
+        // fall back to a tagged AbortError when the signal carries no reason.
+        reject(
+          signal.reason ??
+            new DOMException("The operation was aborted", "AbortError"),
+        );
+      }, timeoutMs);
+    };
+    if (signal.aborted) arm();
+    else {
+      onAbort = arm;
+      signal.addEventListener("abort", onAbort, { once: true });
+    }
+  });
+  try {
+    return await Promise.race([work, watchdog]);
+  } finally {
+    if (timer) clearTimeout(timer);
+    if (onAbort) signal.removeEventListener("abort", onAbort);
+    void work.catch(() => {});
+  }
+}
+
 // ── runAgentLoop ─────────────────────────────────────────────────────
 
 export async function runAgentLoopImpl(
@@ -902,22 +963,36 @@ export async function runAgentLoopImpl(
       msgs: Message[],
       compactInPlace = false,
     ): Promise<Message[]> => {
-      const { history, exitReason, newMessages } = await ctx.agentLoop.run({
-        messages: msgs,
-        onEvent: eventHandler,
-        signal: abortController.signal,
-        requestId: reqId,
-        onCheckpoint,
-        callSite: turnCallSite,
-        trust: loopTrust,
-        overrideProfile: turnOverrideProfile,
-        ...(forceOverrideProfile ? { forceOverrideProfile: true } : {}),
-        resolveOverrideProfile: resolveCurrentOverrideProfile,
-        resolveContextWindow,
-        compactInPlace,
-        isNonInteractive,
-        modelProfileKey,
-      });
+      const watchdogMs = ctx.abortWatchdogMs ?? ABORT_WATCHDOG_MS;
+      const { history, exitReason, newMessages } = await withAbortWatchdog(
+        ctx.agentLoop.run({
+          messages: msgs,
+          onEvent: eventHandler,
+          signal: abortController.signal,
+          requestId: reqId,
+          onCheckpoint,
+          callSite: turnCallSite,
+          trust: loopTrust,
+          overrideProfile: turnOverrideProfile,
+          ...(forceOverrideProfile ? { forceOverrideProfile: true } : {}),
+          resolveOverrideProfile: resolveCurrentOverrideProfile,
+          resolveContextWindow,
+          compactInPlace,
+          isNonInteractive,
+          modelProfileKey,
+        }),
+        abortController.signal,
+        watchdogMs,
+        () =>
+          rlog.error(
+            {
+              conversationId: ctx.conversationId,
+              requestId: reqId,
+              timeoutMs: watchdogMs,
+            },
+            "Abort watchdog fired — agent loop did not settle after cancel; forcing turn to finally",
+          ),
+      );
       lastRunNewMessages = newMessages;
       if (exitReason === "handoff") {
         yieldedForHandoff = true;
@@ -1450,46 +1525,37 @@ export async function runAgentLoopImpl(
 
     ctx.profiler.emitSummary(ctx.traceEmitter, reqId);
 
-    // A user cancel clears `processing` immediately so the UI unblocks even
-    // when this turn is slow to unwind, which lets a new turn start and install
-    // its own AbortController, processing flag, request id, and queued work
-    // before this turn reaches here. The shared per-turn state below belongs to
-    // whichever turn currently owns the conversation, so tear it down only while
-    // this turn is still the owner. Each turn captures its AbortController at
-    // start, so a newer turn having replaced `ctx.abortController` means it has
-    // taken ownership; in that case leave the state intact so the new turn stays
-    // cancellable and visible.
-    const supersededByNewerTurn =
-      ctx.abortController !== null && ctx.abortController !== abortController;
-    if (!supersededByNewerTurn) {
-      ctx.abortController = null;
-      ctx.setProcessing(false);
-      ctx.onConfirmationOutcome = undefined;
-      ctx.surfaceActionRequestIds.delete(ctx.currentRequestId ?? "");
-      ctx.approvedViaPromptThisTurn = false;
-      ctx.currentRequestId = undefined;
-      ctx.currentActiveSurfaceId = undefined;
-      ctx.allowedToolNames = undefined;
-      ctx.diskPressureCleanupModeActive = false;
-      ctx.preactivatedSkillIds = undefined;
-      ctx.currentTurnOverrideProfile = undefined;
-      // Channel command intents (e.g. Telegram /start) are single-turn metadata.
-      // Clear at turn end so they never leak into subsequent unrelated messages.
-      ctx.commandIntent = undefined;
-      // taskRunId scopes ephemeral task-run permissions to a single turn. Clear
-      // before drainQueue so queued/drained turns on a reused conversation can't
-      // inherit stale in-task-run scope from the turn that just finished.
-      ctx.taskRunId = undefined;
-
-      // Consolidation deferred to compaction: keeping assistant + tool_result
-      // messages unconsolidated preserves the exact message structure sent to
-      // the API, enabling stable prefix caching across turns.  Compaction
-      // consolidates when it summarizes old messages (cache miss is expected).
-
-      ctx.drainQueue(
-        yieldedForHandoff ? "checkpoint_handoff" : "loop_complete",
-      );
-    }
+    // Tear down this turn's per-turn state. Abort reliably drives the loop to
+    // this `finally` within a bounded time — cooperative signal propagation
+    // (provider fetch + tool race) backed by the abort watchdog — so a
+    // cancelled turn always unwinds before any resend can start a new one.
+    // There is therefore only ever one turn alive, and clearing the shared
+    // state below cannot clobber a concurrent turn.
+    ctx.abortController = null;
+    ctx.setProcessing(false);
+    ctx.onConfirmationOutcome = undefined;
+    ctx.surfaceActionRequestIds.delete(ctx.currentRequestId ?? "");
+    ctx.approvedViaPromptThisTurn = false;
+    ctx.currentRequestId = undefined;
+    ctx.currentActiveSurfaceId = undefined;
+    ctx.allowedToolNames = undefined;
+    ctx.diskPressureCleanupModeActive = false;
+    ctx.preactivatedSkillIds = undefined;
+    ctx.currentTurnOverrideProfile = undefined;
+    // Channel command intents (e.g. Telegram /start) are single-turn metadata.
+    // Clear at turn end so they never leak into subsequent unrelated messages.
+    ctx.commandIntent = undefined;
+    // taskRunId scopes ephemeral task-run permissions to a single turn. Clear
+    // before drainQueue so queued/drained turns on a reused conversation can't
+    // inherit stale in-task-run scope from the turn that just finished.
+    ctx.taskRunId = undefined;
+
+    // Consolidation deferred to compaction: keeping assistant + tool_result
+    // messages unconsolidated preserves the exact message structure sent to
+    // the API, enabling stable prefix caching across turns.  Compaction
+    // consolidates when it summarizes old messages (cache miss is expected).
+
+    ctx.drainQueue(yieldedForHandoff ? "checkpoint_handoff" : "loop_complete");
 
     // Clear conversation tags so they don't leak into unrelated error captures
     // (e.g. unhandledRejection from a different async chain).

package/src/daemon/conversation.ts

@@ -394,6 +394,13 @@ export class Conversation {
     workspaceDir: string,
   ) => Pick<WorkspaceGitService, "ensureInitialized">;
   /** @internal */ commitTurnChanges?: typeof commitTurnChanges;
+  /**
+   * Abort-watchdog timeout (ms) for the agent loop's bounded-unwind backstop.
+   * Overridable in tests to fire the watchdog quickly; defaults to the
+   * production constant in the agent loop when unset.
+   * @internal
+   */
+  abortWatchdogMs?: number;
   /**
    * The conversation's immutable creation type (`interactive`, `background`,
    * `scheduled`, …) as stored on the DB row. Cached on load (and set directly

package/src/daemon/handlers/conversations.ts

@@ -106,14 +106,12 @@ export function cancelGeneration(conversationId: string): boolean {
   // being cancelled, so enqueuing synthetic messages would trigger
   // unwanted model activity after the user pressed stop.
   getSubagentManager().abortAllForParent(conversationId);
-  // Clear the processing flag so every client stops rendering the thinking
-  // indicator. abort() only signals the AbortController, so a turn that never
-  // observes the signal leaves `processing` latched true; clearing it here
-  // publishes the metadata sync invalidation that drives clients to the
-  // authoritative state. A turn that does eventually unwind tears down only the
-  // shared turn state it still owns, so this early clear neither double-fires
-  // the invalidation nor clobbers a turn started after the cancel.
-  conversation.setProcessing(false);
+  // The processing flag is cleared by the in-flight turn's `finally`, not here.
+  // Abort propagates into the provider call and tool execution (and is backed
+  // by the agent loop's abort watchdog), so the turn reaches its `finally`
+  // within a bounded time and tears down its own state there — which publishes
+  // the metadata sync invalidation that drives clients to the authoritative
+  // idle state.
   return true;
 }
 

package/src/runtime/routes/inbound-stages/admission-policy.test.ts

@@ -33,11 +33,13 @@ describe("enforceAdmissionPolicy — exempt channels", () => {
     expect(result.admitted).toBe(true);
   });
 
-  test("phone short-circuits to admitted (§8.4: voice ingress not wired)", () => {
+  test("phone is enforced (not exempt): the floor applies", () => {
+    // Voice ingress is wired, so `phone` is no longer exempt — an `unknown`
+    // caller is denied under `no_one`.
     const result = enforceAdmissionPolicy(
       makeInput({ sourceChannel: "phone", trustClass: "unknown", policy: "no_one" }),
     );
-    expect(result.admitted).toBe(true);
+    expect(result.admitted).toBe(false);
   });
 });