@vellumai/assistant 0.10.1 → 0.10.2-dev.202606241651.2d2b40d

package/src/runtime/trust-verdict-consumer.ts

@@ -33,16 +33,17 @@ export interface TrustVerdictTransport {
 }
 
 /**
- * Build a {@link TrustContext} from a gateway verdict + transport identity.
+ * Reassemble an {@link ActorTrustContext} from a gateway verdict + transport
+ * identity (mirroring `resolveActorTrust`), without any local DB/IPC reads.
  *
- * Reassembles an {@link ActorTrustContext} (mirroring `resolveActorTrust`) and
- * routes it through {@link toTrustContext}, so the output is byte-identical to
- * the local resolution path.
+ * Pure: the voice path consumes this directly for routing on
+ * `actorTrust.trustClass`; {@link trustContextFromVerdict} routes it through
+ * {@link toTrustContext}.
  */
-export function trustContextFromVerdict(
+export function actorTrustContextFromVerdict(
   verdict: TrustVerdict,
   input: TrustVerdictTransport,
-): TrustContext {
+): ActorTrustContext {
   const canonicalSenderId = verdict.canonicalSenderId;
   const memberDisplayName = verdict.memberDisplayName;
   const senderDisplayName = input.actorDisplayName;
@@ -51,7 +52,7 @@ export function trustContextFromVerdict(
     ? `@${username}`
     : (canonicalSenderId ?? undefined);
 
-  const actorTrustContext: ActorTrustContext = {
+  return {
     canonicalSenderId,
     guardianBindingMatch: verdict.guardianExternalUserId
       ? {
@@ -60,7 +61,12 @@ export function trustContextFromVerdict(
         }
       : null,
     guardianPrincipalId: verdict.guardianPrincipalId,
-    memberRecord: null,
+    // Populate from the verdict so the voice path's ACL gates (which read
+    // actorTrust.memberRecord.channel status/policy) enforce blocked/revoked/
+    // deny/escalate. Null for memberless verdicts. Text path is unaffected:
+    // toTrustContext derives the same member fields trustContextFromVerdict
+    // already stamps.
+    memberRecord: resolvedMemberFromVerdict(verdict),
     trustClass: verdict.trustClass,
     actorMetadata: {
       identifier,
@@ -72,9 +78,21 @@ export function trustContextFromVerdict(
       trustStatus: verdict.trustClass,
     },
   };
+}
 
+/**
+ * Build a {@link TrustContext} from a gateway verdict + transport identity.
+ *
+ * Reassembles an {@link ActorTrustContext} (mirroring `resolveActorTrust`) and
+ * routes it through {@link toTrustContext}, so the output is byte-identical to
+ * the local resolution path.
+ */
+export function trustContextFromVerdict(
+  verdict: TrustVerdict,
+  input: TrustVerdictTransport,
+): TrustContext {
   const context = toTrustContext(
-    actorTrustContext,
+    actorTrustContextFromVerdict(verdict, input),
     input.conversationExternalId,
   );
 
@@ -91,6 +109,26 @@ export function trustContextFromVerdict(
   return context;
 }
 
+/**
+ * True when the verdict carries a member identity (contactId or channelId),
+ * regardless of whether that member resolves to a usable {@link ResolvedMember}.
+ */
+export function verdictHasMemberIdentity(verdict: TrustVerdict): boolean {
+  return !!(verdict.contactId || verdict.channelId);
+}
+
+/**
+ * True when the verdict claims a member identity but that member can't be
+ * synthesized (partial/mixed-version verdict). Such a verdict is unusable —
+ * callers fall back to local resolution.
+ */
+export function verdictMemberUnresolvable(verdict: TrustVerdict): boolean {
+  return (
+    verdictHasMemberIdentity(verdict) &&
+    resolvedMemberFromVerdict(verdict) === null
+  );
+}
+
 // Allowed ACL enum values, kept in sync with the ContactChannel union types.
 const CHANNEL_STATUS_VALUES: readonly ChannelStatus[] = [
   "active",
@@ -113,6 +151,44 @@ function isChannelPolicy(value: string): value is ChannelPolicy {
   return (CHANNEL_POLICY_VALUES as readonly string[]).includes(value);
 }
 
+/**
+ * The ACL fields a gateway verdict carries for a resolved member, decoupled
+ * from the schema-derived {@link ContactChannel}.
+ */
+export interface VerdictMember {
+  contactId: string;
+  channelId: string;
+  status: ChannelStatus;
+  policy: ChannelPolicy;
+  verifiedAt: number | null;
+  displayName: string | null;
+}
+
+/**
+ * Extract the narrow {@link VerdictMember} ACL view from a gateway verdict.
+ *
+ * Mirrors {@link resolvedMemberFromVerdict}'s guards (contactId/channelId
+ * present + known status/policy enums), failing closed to null otherwise.
+ */
+export function verdictMemberFromVerdict(
+  verdict: TrustVerdict,
+): VerdictMember | null {
+  if (!verdict.contactId || !verdict.channelId) return null;
+  if (!verdict.status || !verdict.policy) return null;
+  if (!isChannelStatus(verdict.status) || !isChannelPolicy(verdict.policy)) {
+    return null;
+  }
+
+  return {
+    contactId: verdict.contactId,
+    channelId: verdict.channelId,
+    status: verdict.status,
+    policy: verdict.policy,
+    verifiedAt: verdict.verifiedAt ?? null,
+    displayName: verdict.memberDisplayName ?? null,
+  };
+}
+
 /**
  * Build a synthetic {@link ResolvedMember} from a gateway verdict.
  *

package/src/runtime/verification-outbound-actions.ts

@@ -21,7 +21,7 @@ import {
   countRecentSendsToDestination,
   createOutboundSession,
   findActiveSession,
-  getGuardianBinding,
+  isGuardianBoundForChannel,
   updateSessionDelivery,
   updateSessionStatus,
 } from "./channel-verification-service.js";
@@ -224,7 +224,7 @@ export async function startOutbound(
       originConversationId,
     );
   } else if (channel === "phone") {
-    return startOutboundVoice(
+    return await startOutboundVoice(
       params.destination,
       assistantId,
       channel,
@@ -232,7 +232,7 @@ export async function startOutbound(
       originConversationId,
     );
   } else if (channel === "slack") {
-    return startOutboundSlack(
+    return await startOutboundSlack(
       params.destination,
       assistantId,
       channel,
@@ -240,7 +240,7 @@ export async function startOutbound(
       originConversationId,
     );
   } else if (channel === "email") {
-    return startOutboundEmail(
+    return await startOutboundEmail(
       params.destination,
       assistantId,
       channel,
@@ -274,8 +274,8 @@ async function startOutboundTelegram(
     };
   }
 
-  const existingBinding = getGuardianBinding(assistantId, channel);
-  if (existingBinding && !rebind) {
+  const alreadyBound = await isGuardianBoundForChannel(channel);
+  if (alreadyBound && !rebind) {
     return {
       success: false,
       error: "already_bound",
@@ -394,13 +394,13 @@ async function startOutboundTelegram(
   };
 }
 
-function startOutboundVoice(
+async function startOutboundVoice(
   rawDestination: string | undefined,
   assistantId: string,
   channel: ChannelId,
   rebind?: boolean,
   originConversationId?: string,
-): OutboundActionResult {
+): Promise<OutboundActionResult> {
   if (!rawDestination) {
     return {
       success: false,
@@ -422,8 +422,8 @@ function startOutboundVoice(
     };
   }
 
-  const existingBinding = getGuardianBinding(assistantId, channel);
-  if (existingBinding && !rebind) {
+  const alreadyBound = await isGuardianBoundForChannel(channel);
+  if (alreadyBound && !rebind) {
     return {
       success: false,
       error: "already_bound",
@@ -591,13 +591,13 @@ export function deliverVerificationEmail(
   })();
 }
 
-function startOutboundSlack(
+async function startOutboundSlack(
   destination: string | undefined,
   assistantId: string,
   channel: ChannelId,
   rebind?: boolean,
   originConversationId?: string,
-): OutboundActionResult {
+): Promise<OutboundActionResult> {
   if (!destination) {
     return {
       success: false,
@@ -607,8 +607,8 @@ function startOutboundSlack(
     };
   }
 
-  const existingBinding = getGuardianBinding(assistantId, channel);
-  if (existingBinding && !rebind) {
+  const alreadyBound = await isGuardianBoundForChannel(channel);
+  if (alreadyBound && !rebind) {
     return {
       success: false,
       error: "already_bound",
@@ -669,13 +669,13 @@ function startOutboundSlack(
   };
 }
 
-function startOutboundEmail(
+async function startOutboundEmail(
   destination: string | undefined,
   assistantId: string,
   channel: ChannelId,
   rebind?: boolean,
   originConversationId?: string,
-): OutboundActionResult {
+): Promise<OutboundActionResult> {
   if (!destination) {
     return {
       success: false,
@@ -688,8 +688,8 @@ function startOutboundEmail(
 
   const normalizedEmail = destination.trim().toLowerCase();
 
-  const existingBinding = getGuardianBinding(assistantId, channel);
-  if (existingBinding && !rebind) {
+  const alreadyBound = await isGuardianBoundForChannel(channel);
+  if (alreadyBound && !rebind) {
     return {
       success: false,
       error: "already_bound",

package/src/signals/user-message.ts

@@ -15,6 +15,7 @@ import { readFileSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 
 import { getOrCreateConversation } from "../daemon/conversation-store.js";
+import { supersedePendingInteractionsOnEnqueue } from "../daemon/handlers/conversations.js";
 import type { UserMessageAttachment } from "../daemon/message-types/shared.js";
 import {
   processMessageInBackground,
@@ -131,6 +132,21 @@ async function dispatchUserMessage(params: {
         assistantMessageInterface: resolvedInterface,
       },
     });
+    if (!result.rejected) {
+      // Mirror the HTTP send path: a follow-up enqueued while the turn is busy
+      // auto-denies pending confirmations and supersedes a parked ask_question
+      // so it isn't stranded behind the prompt until the response backstop.
+      // Best-effort — the message is already queued, so a cleanup failure must
+      // not surface as an error that makes the CLI retry and enqueue a duplicate.
+      try {
+        supersedePendingInteractionsOnEnqueue(conversationId, requestId);
+      } catch (err) {
+        log.warn(
+          { err, conversationId },
+          "Post-enqueue supersession failed — queued message unaffected",
+        );
+      }
+    }
     return { accepted: !result.rejected };
   }
 

package/src/subagent/manager.ts

@@ -553,6 +553,15 @@ export class SubagentManager {
       ),
     );
     managed.state.completedAt = Date.now();
+    // Capture the conversation's latest usage before emitting the terminal
+    // status. `subagent_status_changed` ships `state.usage`, and the abort path
+    // (unlike the completion/failure paths, which sync at agent-loop exit) would
+    // otherwise send the {0,0,0} init usage — zeroing the client's token counts
+    // even though those tokens were already spent. `usageStats` accrues per LLM
+    // turn (see conversation-usage.ts), so this is the most recent total.
+    if (managed.conversation) {
+      managed.state.usage = { ...managed.conversation.usageStats };
+    }
     if (parentSendToClient) {
       // Route the status update through the stored parent sender so the
       // owning conversation's UI chip updates, even when the abort comes from a

package/src/telemetry/types.ts

@@ -391,6 +391,38 @@ export interface SkillLoadedTelemetryEvent extends ModelTelemetryEventBase {
   conversation_id: string | null;
 }
 
+/**
+ * Watchdog health event — one per watchdog check firing. The daemon's
+ * watchdog observes liveness/health signals (event-loop block, stream-idle
+ * stalls, restarts, ...) and emits one event per check firing.
+ *
+ * Deliberately minimal and forward-compatible, mirroring the platform
+ * `WatchdogTelemetryEventSerializer`:
+ *
+ *   - `check_name` — which watchdog check fired. Open string set (not a
+ *     closed enum) so the daemon can introduce a new check without a
+ *     coordinated serializer release; it is the primary group-by dimension
+ *     downstream. The infrastructure admin chart filters this to
+ *     `event_loop_blocked`.
+ *   - `value` — the single measured magnitude for the check (block ms, idle
+ *     ms, ...). Nullable: not every check carries a scalar. The platform
+ *     coerces ints to float, so the daemon need not distinguish.
+ *   - `detail` — open JSON bag for any extra fields the daemon attaches
+ *     (reason codes, secondary numbers, a human message) without a
+ *     platform-coordinated schema change. Null when the daemon attaches
+ *     nothing. Bounded server-side (4096 bytes serialized); an oversize bag
+ *     rejects only the single event, never the batch.
+ *
+ * Metadata only — no conversation content. Dedupe downstream on
+ * `daemon_event_id` (the daemon retries a batch on transient POST failure).
+ */
+export interface WatchdogTelemetryEvent extends TelemetryEventBase {
+  type: "watchdog";
+  check_name: string;
+  value: number | null;
+  detail: Record<string, unknown> | null;
+}
+
 /** Discriminated union of all telemetry event types. */
 export type TelemetryEvent =
   | LlmUsageTelemetryEvent
@@ -399,4 +431,5 @@ export type TelemetryEvent =
   | OnboardingTelemetryEvent
   | AuthFallbackTelemetryEvent
   | ToolExecutedTelemetryEvent
-  | SkillLoadedTelemetryEvent;
+  | SkillLoadedTelemetryEvent
+  | WatchdogTelemetryEvent;

package/src/telemetry/usage-telemetry-reporter.test.ts

@@ -1547,11 +1547,11 @@ describe("UsageTelemetryReporter", () => {
     // No HTTP call should have been made
     expect(mockFetch).not.toHaveBeenCalled();
 
-    // All 7 timestamp watermarks should have been advanced, and all 7 ID
+    // All 8 timestamp watermarks should have been advanced, and all 8 ID
     // watermarks pinned to the high-sorting sentinel (a truthy value keeps
     // the compound-cursor branch active while closing its same-millisecond
     // arm against opt-out rows).
-    expect(mockSetMemoryCheckpoint).toHaveBeenCalledTimes(14);
+    expect(mockSetMemoryCheckpoint).toHaveBeenCalledTimes(16);
 
     const calls = mockSetMemoryCheckpoint.mock.calls;
     const keys = calls.map((c) => c[0]);
@@ -1563,6 +1563,7 @@ describe("UsageTelemetryReporter", () => {
       "auth_fallback",
       "tool_executed",
       "skill_loaded",
+      "watchdog",
     ];
     for (const eventType of eventTypes) {
       expect(keys).toContain(`telemetry:${eventType}:last_reported_at`);

package/src/telemetry/usage-telemetry-reporter.ts

@@ -28,6 +28,7 @@ import {
   assembleBoundedTurnTrace,
   isTurnSettled,
 } from "../memory/turn-trace-store.js";
+import { queryUnreportedWatchdogEvents } from "../memory/watchdog-events-store.js";
 import { VellumPlatformClient } from "../platform/client.js";
 import {
   getCachedShareAnalytics,
@@ -76,6 +77,9 @@ const CHECKPOINT_KEY_SKILL_LOADED_WATERMARK =
   "telemetry:skill_loaded:last_reported_at";
 const CHECKPOINT_KEY_SKILL_LOADED_WATERMARK_ID =
   "telemetry:skill_loaded:last_reported_id";
+const CHECKPOINT_KEY_WATCHDOG_WATERMARK = "telemetry:watchdog:last_reported_at";
+const CHECKPOINT_KEY_WATCHDOG_WATERMARK_ID =
+  "telemetry:watchdog:last_reported_id";
 // Written into the `*_id` watermark checkpoints by the opt-out flush branch.
 // Sorts lexicographically above every real row ID (all event stores generate
 // lowercase v4 UUIDs), so the compound cursor's same-millisecond arm
@@ -100,6 +104,7 @@ const WATERMARK_KEY_PAIRS: ReadonlyArray<readonly [string, string]> = [
     CHECKPOINT_KEY_SKILL_LOADED_WATERMARK,
     CHECKPOINT_KEY_SKILL_LOADED_WATERMARK_ID,
   ],
+  [CHECKPOINT_KEY_WATCHDOG_WATERMARK, CHECKPOINT_KEY_WATCHDOG_WATERMARK_ID],
 ];
 const REPORT_INTERVAL_MS = 5 * 60 * 1000;
 const INITIAL_FLUSH_DELAY_MS = 30_000; // Delay first flush to let CES handshake complete
@@ -123,6 +128,37 @@ export function setUsageTelemetryReporter(
   _instance = reporter;
 }
 
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+/**
+ * Parse a stored `watchdog_events.detail` JSON text column into the object the
+ * platform expects. Returns null for a null column or an unparseable/corrupted
+ * blob (mirroring the turn `client` metadata parse: a bad blob emits null
+ * rather than failing the batch). A non-object (e.g. a bare number or string)
+ * also resolves to null, since the platform serializer treats `detail` as a
+ * JSON object bag.
+ */
+function parseWatchdogDetail(
+  raw: string | null,
+): Record<string, unknown> | null {
+  if (!raw) return null;
+  try {
+    const parsed = JSON.parse(raw) as unknown;
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+      return parsed as Record<string, unknown>;
+    }
+    return null;
+  } catch {
+    log.warn(
+      { rawDetail: raw.slice(0, 200) },
+      "Telemetry watchdog: failed to parse detail; emitting null",
+    );
+    return null;
+  }
+}
+
 // ---------------------------------------------------------------------------
 // Reporter
 // ---------------------------------------------------------------------------
@@ -307,7 +343,8 @@ export class UsageTelemetryReporter {
         undefined;
 
       // Read skill-loaded watermark (compound cursor: createdAt + id).
-      // Brand-new table, so the standard 0 default is safe.
+      // Writes are gated on share_analytics consent, so opted-out rows
+      // cannot exist and the standard 0 default is safe.
       const skillLoadedWatermark = Number(
         getMemoryCheckpoint(CHECKPOINT_KEY_SKILL_LOADED_WATERMARK) ?? "0",
       );
@@ -315,6 +352,15 @@ export class UsageTelemetryReporter {
         getMemoryCheckpoint(CHECKPOINT_KEY_SKILL_LOADED_WATERMARK_ID) ??
         undefined;
 
+      // Read watchdog watermark (compound cursor: createdAt + id).
+      // Writes are gated on share_analytics consent, so opted-out rows
+      // cannot exist and the standard 0 default is safe.
+      const watchdogWatermark = Number(
+        getMemoryCheckpoint(CHECKPOINT_KEY_WATCHDOG_WATERMARK) ?? "0",
+      );
+      const watchdogWatermarkId =
+        getMemoryCheckpoint(CHECKPOINT_KEY_WATCHDOG_WATERMARK_ID) ?? undefined;
+
       // Query unreported events
       const events = queryUnreportedUsageEvents(
         watermark,
@@ -351,6 +397,11 @@ export class UsageTelemetryReporter {
         skillLoadedWatermarkId,
         BATCH_SIZE,
       );
+      const watchdogEvents = queryUnreportedWatchdogEvents(
+        watchdogWatermark,
+        watchdogWatermarkId,
+        BATCH_SIZE,
+      );
 
       // Trace completeness barrier (trace-eligible owners only).
       //
@@ -418,7 +469,8 @@ export class UsageTelemetryReporter {
         onboardingEvents.length === 0 &&
         authFallbackEvents.length === 0 &&
         toolExecutedEvents.length === 0 &&
-        skillLoadedEvents.length === 0
+        skillLoadedEvents.length === 0 &&
+        watchdogEvents.length === 0
       )
         return;
 
@@ -442,6 +494,7 @@ export class UsageTelemetryReporter {
           authFallbackCount: authFallbackEvents.length,
           toolExecutedCount: toolExecutedEvents.length,
           skillLoadedCount: skillLoadedEvents.length,
+          watchdogCount: watchdogEvents.length,
         },
         "Telemetry flush: resolved auth context",
       );
@@ -674,6 +727,23 @@ export class UsageTelemetryReporter {
             assistant_version: APP_VERSION,
           }),
         ),
+        ...watchdogEvents.map(
+          (e): TelemetryEvent => ({
+            type: "watchdog",
+            daemon_event_id: e.id,
+            recorded_at: e.createdAt,
+            check_name: e.checkName,
+            value: e.value,
+            // `detail` is stored as JSON text; parse defensively so a
+            // corrupted blob never fails the batch flush. A parse failure
+            // emits null rather than dropping the event.
+            detail: parseWatchdogDetail(e.detail),
+            // `watchdog_events` has no record-time version column — same
+            // upload-time APP_VERSION stamping as the other non-llm_usage
+            // event types.
+            assistant_version: APP_VERSION,
+          }),
+        ),
       ];
 
       const organizationId = getPlatformOrganizationId() || undefined;
@@ -796,6 +866,19 @@ export class UsageTelemetryReporter {
         );
       }
 
+      // Advance watchdog watermark (compound cursor)
+      if (watchdogEvents.length > 0) {
+        const lastWatchdog = watchdogEvents[watchdogEvents.length - 1];
+        setMemoryCheckpoint(
+          CHECKPOINT_KEY_WATCHDOG_WATERMARK,
+          String(lastWatchdog.createdAt),
+        );
+        setMemoryCheckpoint(
+          CHECKPOINT_KEY_WATCHDOG_WATERMARK_ID,
+          lastWatchdog.id,
+        );
+      }
+
       // If we got a full batch of any type, there may be more — recurse.
       // Turns use the REPORTED count: when the completeness barrier truncates
       // the batch, the deferred turns must wait for a later flush (by which
@@ -808,7 +891,8 @@ export class UsageTelemetryReporter {
         onboardingEvents.length === BATCH_SIZE ||
         authFallbackEvents.length === BATCH_SIZE ||
         toolExecutedEvents.length === BATCH_SIZE ||
-        skillLoadedEvents.length === BATCH_SIZE
+        skillLoadedEvents.length === BATCH_SIZE ||
+        watchdogEvents.length === BATCH_SIZE
       ) {
         await this._doFlush(batchCount + 1);
       }

package/src/tools/ask-question/ask-question-tool.test.ts

@@ -206,6 +206,35 @@ describe("AskQuestionTool.execute", () => {
     expect(result.content).toBe("Question aborted");
   });
 
+  test("short-circuits without prompting when no interactive user is present", async () => {
+    setNextResult(singleCompleted({ decision: "option", optionId: "a" }));
+
+    const result = await askQuestionTool.execute(
+      validInput,
+      makeContext({ isInteractive: false }),
+    );
+
+    // The prompter must never be invoked — there is no one to answer, so the
+    // turn proceeds with defaults instead of parking on the response backstop.
+    expect(calls).toHaveLength(0);
+    expect(result.isError).toBe(false);
+    expect(result.content.toLowerCase()).toContain("no interactive user");
+  });
+
+  test("still prompts when isInteractive is true or unset", async () => {
+    setNextResult(singleCompleted({ decision: "option", optionId: "a" }));
+
+    // The short-circuit keys off an explicit `false`, not a missing flag, so an
+    // interactive turn (or one that never set the flag) still prompts.
+    await askQuestionTool.execute(
+      validInput,
+      makeContext({ isInteractive: true }),
+    );
+    await askQuestionTool.execute(validInput, makeContext());
+
+    expect(calls).toHaveLength(2);
+  });
+
   test("rejects a question with fewer than 2 options", async () => {
     setNextResult(singleCompleted({ decision: "option", optionId: "a" }));
     const result = await askQuestionTool.execute(

package/src/tools/ask-question/ask-question-tool.ts

@@ -182,6 +182,19 @@ export const askQuestionTool = {
 
     const questions: SingleQuestion[] = parsed.data.questions;
 
+    // No interactive user is present to answer (scheduled/headless/background
+    // turn). Don't park the turn on a prompt no one can resolve — proceed with
+    // defaults immediately. Non-interactive turns are already instructed not to
+    // ask (NON_INTERACTIVE_CONTEXT_BLOCK); this is the backstop for when the
+    // model asks anyway, so it doesn't wait out the full response timeout.
+    if (context.isInteractive === false) {
+      return {
+        content:
+          "No interactive user is present to answer; proceeding with reasonable defaults.",
+        isError: false,
+      };
+    }
+
     const prompter = new QuestionPrompter();
     const result = await prompter.prompt({
       conversationId: context.conversationId,

package/src/tools/computer-use/definitions.ts

@@ -437,7 +437,7 @@ export const computerUseRespondTool = {
 // observe
 // ---------------------------------------------------------------------------
 
-const computerUseObserveTool = {
+export const computerUseObserveTool = {
   name: "computer_use_observe",
   description:
     "Capture the current screen state. Returns the accessibility tree with [ID] element references and optionally a screenshot.\n\nThe accessibility tree shows interactive elements like [3] AXButton 'Save' or [17] AXTextField 'Search'. Use element_id to target these elements in subsequent actions - this is much more reliable than pixel coordinates.\n\nCall this before your first computer use action, or to check screen state without acting.",
@@ -447,7 +447,13 @@ const computerUseObserveTool = {
 
   input_schema: {
     type: "object",
-    properties: {},
+    properties: {
+      target_client_id: {
+        type: "string",
+        description:
+          "ID of the specific client to target. Required when multiple clients support host_cu; omit when only one is connected. Obtain IDs from `assistant clients list --capability host_cu`.",
+      },
+    },
     required: [],
   },
 

package/src/tools/executor.ts

@@ -528,8 +528,8 @@ export { isSideEffectTool } from "./side-effects.js";
  * handles cleanup before the executor wrapper trips.
  *
  * `ask_question` blocks on user input inside `execute()` via `QuestionPrompter`,
- * which waits up to `permissionTimeoutSec`. We give the wrapper the same 5s
- * buffer over that deadline so the prompter's own timeout fires first and
+ * which waits up to `questionResponseTimeoutSec`. We give the wrapper the same
+ * 5s buffer over that deadline so the prompter's own timeout fires first and
  * returns its clean "User did not respond within timeout" result — otherwise
  * the shorter generic budget trips first, orphaning the still-pending prompt
  * behind the confusing "may still be running in the background" error.
@@ -556,8 +556,8 @@ export function computePerToolTimeoutMs(
     return (shellTimeoutSec + 5) * 1000;
   }
   if (name === "ask_question") {
-    const { permissionTimeoutSec } = getConfig().timeouts;
-    return (permissionTimeoutSec + 5) * 1000;
+    const { questionResponseTimeoutSec } = getConfig().timeouts;
+    return (questionResponseTimeoutSec + 5) * 1000;
   }
   const rawTimeoutSec = getConfig().timeouts.toolExecutionTimeoutSec;
   return safeTimeoutMs(rawTimeoutSec);