CAI-8466: fix(calling): sec-vulnerabilities part 1 — validate makeCall dest, WSS frame guard, keepalive timeout

[mkesavan13]

COMPLETES https://jira-eng-gpk2.cisco.com/jira/browse/CAI-8466

This pull request addresses

Three security vulnerabilities in the @webex/calling package:

1. makeCall destination bypass — VALID_PHONE_REGEX lacked start/end anchors, so partial matches let malformed destination strings pass validation.
2. Malformed WebSocket frame processing — Socket.onmessage blindly cast JSON.parse output to SocketResponse without validating the shape, allowing primitives and arrays to be processed as call-control frames.
3. keepalive in-flight lock-up — The web worker had no timeout to release keepaliveInFlight if a keepalive response was never received, causing the keepalive mechanism to stall permanently.

by making the following changes

1. Anchored phone regex — Added MAKE_CALL_PHONE_REGEX (/^[\d\s()*#+.-]+$/) with ^/$ anchors so the entire destination address must match; simplified sanitizer in makeCall to strip anything not in [+*#\d].
2. WSS frame type guard — Added isSocketResponse function in socket/types.ts; onmessage now calls it before processing and drops (with a warning) any frame that is not a plain non-null object.
3. Keepalive in-flight timeout — Added keepaliveInFlightTimeout in webWorker.ts: set when a keepalive is dispatched, cleared on KEEPALIVE_RESULT or CLEAR_KEEPALIVE, and fires after interval × 2 seconds to reset keepaliveInFlight and unblock future keepalives.

Change Type

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Tooling change
• Internal code refactor

The following scenarios were tested

• Tests added: 22 new unit tests covering the three vulnerability fixes.
• Gate 1 (compile): PASSED — yarn workspace @webex/calling compile completed successfully (25+ packages built).
• Gate 2 (unit tests): PASSED — yarn workspace @webex/calling test:unit — 859 tests passed across 31 suites (including line.test.ts, socket.test.ts, webWorker.test.ts).
• Gate 3: not run.

Testing

• Tests added: 22
• Gate 1 verification: PASSED — yarn workspace @webex/calling compile — all 25 dependency packages and calling built successfully.
• Gate 2 verification: PASSED — yarn workspace @webex/calling test:unit — 859/859 tests passed, 31/31 suites.
• Gate 3 verification: not run.
• Coverage outcome: passed.

Acceptance Criteria

ID	Criterion	Source	JiraToPr status	Evidence
AC-1	makeCall rejects destination addresses that only partially match the phone regex.	CAI-8466 security vulnerability — makeCall destination bypass	Unit validated	Tests in line.test.ts for partial-match and full-match cases passed in Gate 2.
AC-2	Malformed (non-object) WebSocket frames are silently dropped with a warning log.	CAI-8466 security vulnerability — WSS frame guard	Unit validated	Tests in socket.test.ts for primitive and array frames passed in Gate 2.
AC-3	Keepalive in-flight flag is released after interval × 2 seconds if no response arrives.	CAI-8466 security vulnerability — keepalive timeout	Unit validated	Tests in webWorker.test.ts for timeout path passed in Gate 2.

Contract Discovery Warnings

• Manifest reference discovery capped at 100 strings

The GAI Coding Policy And Copyright Annotation Best Practices

• GAI was not used (or, no additional notation is required)
• Code was generated entirely by GAI
• GAI was used to create a draft that was subsequently customized or modified
• Coder created a draft manually that was non-substantively modified by GAI (e.g., refactoring was performed by GAI on manually written code)
• Tool used for AI assistance (GitHub Copilot / Other - specify)
  • Github Copilot
  • Other - Please Specify: Claude Sonnet 4.6 (JiraToPr)
• This PR is related to
  • Feature
  • Defect fix
  • Tech Debt
  • Automation

I certified that

• I have read and followed contributing guidelines
• I discussed changes with code owners prior to submitting this pull request
• I have not skipped any automated checks
• All existing and new tests passed
• I have updated the documentation accordingly

---

Jira: https://jira-eng-gpk2.cisco.com/jira/browse/CAI-8466