@vellumai/credential-executor 0.10.4 → 0.10.5-dev.202607022248.91fa053

package/node_modules/@vellumai/service-contracts/src/__tests__/ingress.test.ts

@@ -5,10 +5,8 @@ import {
   normalizePublicBaseUrl,
 } from "../ingress.js";
 import {
-  buildTwilioConnectActionUrl,
   buildTwilioMediaStreamUrl,
   buildTwilioPhoneNumberWebhookUrls,
-  buildTwilioRelayUrl,
   buildTwilioVoiceWebhookUrl,
   resolveTwilioPublicBaseUrl,
 } from "../twilio-ingress.js";
@@ -90,12 +88,6 @@ describe("Twilio ingress helpers", () => {
     expect(buildTwilioVoiceWebhookUrl("https://example.test", "call-123")).toBe(
       "https://example.test/webhooks/twilio/voice?callSessionId=call-123",
     );
-    expect(buildTwilioConnectActionUrl("https://example.test")).toBe(
-      "https://example.test/webhooks/twilio/connect-action",
-    );
-    expect(buildTwilioRelayUrl("https://example.test")).toBe(
-      "wss://example.test/webhooks/twilio/relay",
-    );
     expect(buildTwilioMediaStreamUrl("http://example.test")).toBe(
       "ws://example.test/webhooks/twilio/media-stream",
     );

package/node_modules/@vellumai/service-contracts/src/__tests__/package-boundary.test.ts

@@ -5,8 +5,7 @@
  * 1. Does NOT import from assistant, gateway, credential-executor, or other
  *    service runtime modules.
  * 2. Does NOT import from runtime shared packages that sit above it in the
- *    dependency hierarchy (@vellumai/credential-storage, @vellumai/egress-proxy,
- *    @vellumai/skill-host-contracts).
+ *    dependency hierarchy (@vellumai/credential-storage, @vellumai/egress-proxy).
  * 3. Does NOT import from x-client packages (@vellumai/assistant-client,
  *    @vellumai/ces-client, @vellumai/gateway-client).
  * 4. Remains a pure schema/type package — no runtime dependencies beyond zod.
@@ -73,8 +72,6 @@ const FORBIDDEN_IMPORT_PATTERNS = [
   /require\s*\(\s*["']@vellumai\/credential-storage(?:\/|["'])/,
   /from\s+["']@vellumai\/egress-proxy(?:\/|["'])/,
   /require\s*\(\s*["']@vellumai\/egress-proxy(?:\/|["'])/,
-  /from\s+["']@vellumai\/skill-host-contracts(?:\/|["'])/,
-  /require\s*\(\s*["']@vellumai\/skill-host-contracts(?:\/|["'])/,
 
   // x-client packages (higher layer)
   /from\s+["']@vellumai\/assistant-client(?:\/|["'])/,
@@ -143,7 +140,6 @@ describe("package boundary", () => {
         "@vellumai/assistant",
         "@vellumai/credential-storage",
         "@vellumai/egress-proxy",
-        "@vellumai/skill-host-contracts",
         "@vellumai/assistant-client",
         "@vellumai/ces-client",
         "@vellumai/gateway-client",

package/node_modules/@vellumai/service-contracts/src/twilio-ingress.ts

@@ -2,9 +2,6 @@ import { normalizePublicBaseUrl } from "./ingress.js";
 
 export const TWILIO_VOICE_WEBHOOK_PATH = "/webhooks/twilio/voice";
 export const TWILIO_STATUS_WEBHOOK_PATH = "/webhooks/twilio/status";
-export const TWILIO_CONNECT_ACTION_WEBHOOK_PATH =
-  "/webhooks/twilio/connect-action";
-export const TWILIO_RELAY_WEBHOOK_PATH = "/webhooks/twilio/relay";
 export const TWILIO_MEDIA_STREAM_WEBHOOK_PATH = "/webhooks/twilio/media-stream";
 
 /**
@@ -13,9 +10,9 @@ export const TWILIO_MEDIA_STREAM_WEBHOOK_PATH = "/webhooks/twilio/media-stream";
  * with the actual public URL (from Velay registration, config, or the
  * `X-Vellum-Ingress-URL` header) before returning TwiML to Twilio.
  *
- * The placeholder uses `https://` so that `buildTwilioRelayUrl` /
- * `buildTwilioMediaStreamUrl` can apply the standard `http→ws` scheme
- * conversion, producing `wss://__VELLUM_PUBLIC_BASE_URL__/…` in the output.
+ * The placeholder uses `https://` so that `buildTwilioMediaStreamUrl` can
+ * apply the standard `http→ws` scheme conversion, producing
+ * `wss://__VELLUM_PUBLIC_BASE_URL__/…` in the output.
  */
 export const TWILIO_PUBLIC_BASE_URL_PLACEHOLDER =
   "https://__VELLUM_PUBLIC_BASE_URL__";
@@ -58,14 +55,6 @@ export function buildTwilioStatusWebhookUrl(baseUrl: string): string {
   return `${baseUrl}${TWILIO_STATUS_WEBHOOK_PATH}`;
 }
 
-export function buildTwilioConnectActionUrl(baseUrl: string): string {
-  return `${baseUrl}${TWILIO_CONNECT_ACTION_WEBHOOK_PATH}`;
-}
-
-export function buildTwilioRelayUrl(baseUrl: string): string {
-  return `${toTwilioWebSocketBaseUrl(baseUrl)}${TWILIO_RELAY_WEBHOOK_PATH}`;
-}
-
 export function buildTwilioMediaStreamUrl(baseUrl: string): string {
   return `${toTwilioWebSocketBaseUrl(baseUrl)}${TWILIO_MEDIA_STREAM_WEBHOOK_PATH}`;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/credential-executor",
-  "version": "0.10.4",
+  "version": "0.10.5-dev.202607022248.91fa053",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/__tests__/grant-store.test.ts

@@ -419,6 +419,110 @@ describe("TemporaryGrantStore", () => {
       expect(store.check("allow_once", "hash-1")).toBe(false);
       expect(store.check("allow_once", "hash-2")).toBe(false);
     });
+
+    test("remains usable immediately (default TTL is not instantaneous)", () => {
+      // The default `allow_once` TTL must still allow a prompt retry of the
+      // just-approved operation.
+      store.add("allow_once", "hash-default-ttl");
+      expect(store.check("allow_once", "hash-default-ttl")).toBe(true);
+    });
+
+    test("expires after its TTL even if never consumed (ATL-935)", () => {
+      // An unconsumed single-use approval must not live forever.
+      store.add("allow_once", "hash-once-expire", { durationMs: 1 });
+
+      const start = Date.now();
+      while (Date.now() - start < 5) {
+        // spin
+      }
+
+      expect(store.check("allow_once", "hash-once-expire")).toBe(false);
+    });
+  });
+
+  // -------------------------------------------------------------------------
+  // ATL-935: ephemeral approvals are bounded by TTLs, not by connection
+  // teardown.
+  //
+  // In managed mode the store instance — contents included — is deliberately
+  // shared across assistant reconnects and, in the multi-process daemon model,
+  // across the connections that each talk to CES, so one guardian approval can
+  // be used by any connection entitled to it. The security boundary is the
+  // per-grant TTL: an approval that is recorded but never consumed must expire
+  // on its own rather than survive indefinitely and be replayed by a much later
+  // connection. These tests encode both halves of that contract — an approval
+  // stays usable across a reconnect (sharing preserved) but does not outlive
+  // its TTL (replay window bounded).
+  // -------------------------------------------------------------------------
+  describe("ATL-935: ephemeral approvals are bounded by TTLs, not teardown", () => {
+    test("every grant kind is bounded by a TTL (no unbounded approvals)", () => {
+      // The finding was that allow_once and allow_conversation had no time
+      // bound at all. Every kind must now expire on its own.
+      store.add("allow_once", "exp-once", { durationMs: 1 });
+      store.add("allow_10m", "exp-10m", { durationMs: 1 });
+      store.add("allow_conversation", "exp-conv", {
+        conversationId: "c",
+        durationMs: 1,
+      });
+
+      const start = Date.now();
+      while (Date.now() - start < 5) {
+        // spin until all three TTLs lapse
+      }
+
+      expect(store.check("allow_once", "exp-once")).toBe(false);
+      expect(store.check("allow_10m", "exp-10m")).toBe(false);
+      expect(store.check("allow_conversation", "exp-conv", "c")).toBe(false);
+    });
+
+    test("allow_once that is never consumed expires instead of lingering", () => {
+      // The headline scenario: an approval recorded but not consumed before a
+      // connection drops must not be replayable by a later connection.
+      store.add("allow_once", "hash-stale", { durationMs: 1 });
+
+      const start = Date.now();
+      while (Date.now() - start < 5) {
+        // spin
+      }
+
+      expect(store.checkAny("hash-stale")).toBeUndefined();
+    });
+
+    test("allow_conversation is bounded by an absolute TTL backstop", () => {
+      store.add("allow_conversation", "hash-conv-ttl", {
+        conversationId: "conv-1",
+        durationMs: 1,
+      });
+
+      const start = Date.now();
+      while (Date.now() - start < 5) {
+        // spin
+      }
+
+      expect(store.checkAny("hash-conv-ttl", "conv-1")).toBeUndefined();
+    });
+
+    test("an unexpired approval is still shared across a reconnect (no teardown)", () => {
+      // The multi-process daemon model depends on this: the store is NOT
+      // cleared on disconnect, so an approval granted while one connection was
+      // live remains usable by a later or sibling connection within its TTL.
+      store.add("allow_conversation", "hash-shared", {
+        conversationId: "conv-1",
+      });
+
+      // Simulate a reconnect — no clear() happens between connections.
+      expect(store.checkAny("hash-shared", "conv-1")).toBe(
+        "allow_conversation",
+      );
+      // Still usable again (conversation grants are not consumed on use).
+      expect(store.checkAny("hash-shared", "conv-1")).toBe(
+        "allow_conversation",
+      );
+
+      // An allow_10m approval likewise survives a reconnect within its window.
+      store.add("allow_10m", "hash-shared-10m");
+      expect(store.checkAny("hash-shared-10m")).toBe("allow_10m");
+    });
   });
 
   describe("allow_10m", () => {

package/src/grants/temporary-store.ts

@@ -6,11 +6,29 @@
  * which is the desired behaviour for ephemeral approvals.
  *
  * Keying:
- * - `allow_once`: Keyed by proposal hash. Consumed (deleted) on first use.
+ * - `allow_once`: Keyed by proposal hash. Consumed (deleted) on first use, and
+ *   bounded by a short default TTL so an approval that is never consumed cannot
+ *   linger and be replayed long after the guardian approved the imminent
+ *   operation (see ATL-935).
  * - `allow_10m`: Keyed by proposal hash. Checked for expiry on every read;
  *   expired entries are lazily purged.
  * - `allow_conversation`: Keyed by proposal hash + conversation ID. Scoped to a
- *   single conversation.
+ *   single conversation and bounded by a generous absolute TTL backstop so an
+ *   approval cannot live for the store's entire (process-long) lifetime and be
+ *   replayed by a later connection that presents the same conversation ID
+ *   (see ATL-935).
+ *
+ * Lifetime note: in managed mode this store instance is process-scoped and
+ * deliberately shared across assistant reconnects — and, in the forthcoming
+ * multi-process daemon model, across the multiple connections that each talk to
+ * CES — so a single guardian approval can be used by any connection entitled to
+ * it. Grant lifetime is therefore bounded by per-grant TTLs rather than by
+ * connection teardown: every grant kind carries an expiry, so an unconsumed
+ * approval expires on its own instead of surviving indefinitely. (A future
+ * multi-connection daemon may additionally evict on quiescence — when the count
+ * of live CES connections reaches zero — to scope grants to assistant presence;
+ * that is connection-lifecycle machinery the multi-connection work should own,
+ * and is intentionally not built here.)
  */
 
 // ---------------------------------------------------------------------------
@@ -28,13 +46,41 @@ export interface TemporaryGrant {
   conversationId?: string;
   /** When the grant was created (epoch ms). */
   createdAt: number;
-  /** When the grant expires (epoch ms). Set for `allow_10m`; optionally set for `allow_once`. */
+  /** When the grant expires (epoch ms). Set for every grant kind: a short
+   *  default for `allow_once`, the timed window for `allow_10m`, and a generous
+   *  absolute backstop for `allow_conversation`. */
   expiresAt?: number;
 }
 
 /** Default TTL for timed grants (10 minutes). */
 const DEFAULT_TIMED_DURATION_MS = 10 * 60 * 1000;
 
+/**
+ * Default TTL for single-use (`allow_once`) grants (2 minutes).
+ *
+ * `allow_once` exists to bridge the gap between a guardian approval and the
+ * caller immediately retrying the just-approved operation. Without a TTL, an
+ * approval that is never consumed (e.g. the assistant connection drops before
+ * the retry) would live for the store's entire lifetime and could later be
+ * replayed without a fresh prompt (ATL-935). A short bound keeps the grant
+ * usable for a prompt retry while ensuring a stale, unconsumed approval
+ * expires on its own.
+ */
+const DEFAULT_ONCE_DURATION_MS = 2 * 60 * 1000;
+
+/**
+ * Absolute TTL backstop for `allow_conversation` grants (12 hours).
+ *
+ * `allow_conversation` is scoped to a conversation ID and is meant to persist
+ * for the life of that conversation, so it is not consumed on use and has no
+ * short timeout. But without any bound it would live for the store's entire
+ * process-long lifetime and could be replayed by a later connection that
+ * presents the same conversation ID long after the original approval (ATL-935).
+ * A generous backstop keeps the grant usable across a normal working session
+ * while ensuring a long-stale approval eventually requires a fresh prompt.
+ */
+const DEFAULT_CONVERSATION_DURATION_MS = 12 * 60 * 60 * 1000;
+
 // ---------------------------------------------------------------------------
 // Store implementation
 // ---------------------------------------------------------------------------
@@ -102,8 +148,19 @@ export class TemporaryGrantStore {
     if (kind === "allow_10m") {
       grant.expiresAt =
         Date.now() + (options?.durationMs ?? DEFAULT_TIMED_DURATION_MS);
-    } else if (kind === "allow_once" && options?.durationMs !== undefined) {
-      grant.expiresAt = Date.now() + options.durationMs;
+    } else if (kind === "allow_once") {
+      // `allow_once` is always bounded by a TTL — a caller-supplied duration
+      // when present, otherwise a short default — so an unconsumed single-use
+      // approval cannot be replayed indefinitely (ATL-935).
+      grant.expiresAt =
+        Date.now() + (options?.durationMs ?? DEFAULT_ONCE_DURATION_MS);
+    } else if (kind === "allow_conversation") {
+      // `allow_conversation` persists for the conversation and is not consumed
+      // on use, but it still carries a generous absolute TTL backstop so a
+      // conversation-scoped approval cannot linger for the store's entire
+      // process lifetime and be replayed by a later connection (ATL-935).
+      grant.expiresAt =
+        Date.now() + (options?.durationMs ?? DEFAULT_CONVERSATION_DURATION_MS);
     }
 
     this.store.set(key, grant);
@@ -115,8 +172,9 @@ export class TemporaryGrantStore {
    * - `allow_once`: Returns `true` and **consumes** the grant (deletes it).
    * - `allow_10m`: Returns `true` only if the grant has not expired.
    *   Expired grants are lazily purged.
-   * - `allow_conversation`: Returns `true` only if a grant exists for the given
-   *   proposal hash scoped to the specified conversation ID.
+   * - `allow_conversation`: Returns `true` only if a non-expired grant exists
+   *   for the given proposal hash scoped to the specified conversation ID.
+   *   Expired grants (past the absolute TTL backstop) are lazily purged.
    *
    * Returns `false` if no matching grant exists.
    */
@@ -149,7 +207,12 @@ export class TemporaryGrantStore {
       return true;
     }
 
-    // allow_conversation — no expiry, just existence check
+    // allow_conversation — bounded by an absolute TTL backstop; lazily purge an
+    // expired grant and deny, mirroring allow_10m.
+    if (grant.expiresAt !== undefined && Date.now() >= grant.expiresAt) {
+      this.store.delete(key);
+      return false;
+    }
     return true;
   }
 

package/src/managed-main.ts

@@ -668,12 +668,23 @@ async function main(): Promise<void> {
   // `unregister` miss a tool registered in an earlier session and orphan its
   // bundle.
   //
-  // The in-memory temporary-grant store is also process-scoped, and (unlike
-  // before) is NOT cleared between sessions: ephemeral approvals are shared
-  // across all of a daemon's connections for the process lifetime. Its own
-  // semantics keep this safe — `allow_once` is consumed on first use,
-  // `allow_10m` expires by wall-clock TTL, `allow_conversation` is cleared when
-  // its conversation ends (see the serve loop below).
+  // The in-memory temporary-grant store instance is also process-scoped and is
+  // deliberately reused — contents included — across reconnects. Ephemeral
+  // approvals (`allow_once` / `allow_10m` / `allow_conversation`) are keyed by
+  // proposal hash (plus a caller-supplied conversation ID), not by the
+  // connection that produced them, precisely so a single guardian approval can
+  // be shared by any connection entitled to use it. That sharing is what the
+  // multi-process daemon model needs: several assistant processes will each
+  // talk to CES, and an approval granted while one is connected must remain
+  // usable by the others. Grant lifetime is therefore bounded by per-grant TTLs
+  // (every kind now carries an expiry), not by tearing the store down on
+  // disconnect — so an approval that is never consumed expires on its own
+  // instead of surviving indefinitely and being replayed by a much later
+  // connection without a fresh guardian prompt (ATL-935). A future
+  // multi-connection daemon may additionally evict on quiescence (when the
+  // count of live CES connections reaches zero) to scope grants to assistant
+  // presence; that is connection-lifecycle machinery the multi-connection work
+  // should own, and is intentionally not added here.
   //
   // The mutable refs carry the handshake-provided API key and assistant ID;
   // handlers read them at call time. These don't vary across a daemon's
@@ -682,11 +693,7 @@ async function main(): Promise<void> {
   // at call time for audit attribution).
   const apiKeyRef: ApiKeyRef = { current: "" };
   const assistantIdRef: AssistantIdRef = { current: "" };
-  const handlers = buildHandlers(
-    apiKeyRef,
-    assistantIdRef,
-    secureKeyBackend,
-  );
+  const handlers = buildHandlers(apiKeyRef, assistantIdRef, secureKeyBackend);
 
   // Serve loop. CES is a long-lived sidecar that must outlive any single
   // assistant session: the assistant container can crash and be restarted
@@ -782,16 +789,6 @@ async function main(): Promise<void> {
 
     rpcConnected = false;
 
-    // Temporary grants are process-shared: they are NOT cleared when a session
-    // ends. CES is moving to a model where the assistant daemon's multiple
-    // processes each hold their own connection, so an ephemeral approval
-    // (`allow_once` / `allow_10m` / `allow_conversation`) granted on one
-    // connection must remain usable by the others rather than being scoped to a
-    // single session. The store's own semantics keep this safe across a
-    // reconnect: `allow_once` is consumed on first use, `allow_10m` is bounded
-    // by its wall-clock TTL, and `allow_conversation` is cleared when its
-    // conversation ends.
-    //
     // A signal-driven end means the process is shutting down; exit the loop.
     // Any other end reason (the assistant disconnected, its stream closed,
     // or the transport errored) means we keep the sidecar up and await a