@vellumai/assistant 0.11.2-dev.202608051734.355dff7 → 0.11.2-dev.202608051933.deffc0f

package/ARCHITECTURE.md

@@ -67,8 +67,10 @@ All HTTP API requests use a single `Authorization: Bearer <jwt>` header for auth
 | -------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------- |
 | `actor_client_v1`    | `chat.{read,write}`, `approval.{read,write}`, `settings.{read,write}`, `attachments.{read,write}`, `calls.{read,write}`, `feature_flags.{read,write}` | Desktop, CLI clients                         |
 | `gateway_ingress_v1` | `ingress.write`, `internal.write`                                                                                                                     | Gateway channel inbound + webhook forwarding |
-| `gateway_service_v1` | `settings.read`, `settings.write`, `internal.write`                                                                                                   | Gateway service-to-daemon calls              |
-| `internal_v1`        | `internal.all`                                                                                                                                        | Internal service connections                 |
+| `gateway_service_v1` | `chat.{read,write}`, `settings.{read,write}`, `attachments.{read,write}`, `internal.write`                                                            | Gateway service-to-daemon calls              |
+| `local_v1`           | `local.all`                                                                                                                                           | Local (loopback) conversation sessions       |
+| `speech_relay_v1`    | `speech.relay`                                                                                                                                        | Daemon dial of the gateway speech relay only |
+| `ui_page_v1`         | `settings.read`                                                                                                                                       | Served UI pages                              |
 
 **Identity lifecycle:**
 

package/node_modules/@vellumai/ces-client/node_modules/@vellumai/service-contracts/src/ingress.ts

@@ -20,6 +20,16 @@ export function normalizePublicBaseUrl(value: unknown): string | undefined {
   return normalized.length > 0 ? normalized : undefined;
 }
 
+/**
+ * Application close code the gateway's velay bridge sends to proxied
+ * WebSockets when the tunnel itself is lost (velay disconnect, gateway
+ * shutdown). A dedicated code because the natural 1001 (going away) cannot
+ * be sent through the JS `close()` API (the bridge would remap it to a
+ * misleading 4001), and Bun's WebSocket client drops close reasons, so the
+ * code is the only signal that survives the relay to the daemon.
+ */
+export const GATEWAY_TUNNEL_LOST_WS_CLOSE_CODE = 4801;
+
 export function normalizeHttpPublicBaseUrl(value: unknown): string | undefined {
   if (typeof value !== "string") return undefined;
   const trimmed = value.trim();

package/node_modules/@vellumai/gateway-client/node_modules/@vellumai/service-contracts/src/ingress.ts

@@ -20,6 +20,16 @@ export function normalizePublicBaseUrl(value: unknown): string | undefined {
   return normalized.length > 0 ? normalized : undefined;
 }
 
+/**
+ * Application close code the gateway's velay bridge sends to proxied
+ * WebSockets when the tunnel itself is lost (velay disconnect, gateway
+ * shutdown). A dedicated code because the natural 1001 (going away) cannot
+ * be sent through the JS `close()` API (the bridge would remap it to a
+ * misleading 4001), and Bun's WebSocket client drops close reasons, so the
+ * code is the only signal that survives the relay to the daemon.
+ */
+export const GATEWAY_TUNNEL_LOST_WS_CLOSE_CODE = 4801;
+
 export function normalizeHttpPublicBaseUrl(value: unknown): string | undefined {
   if (typeof value !== "string") return undefined;
   const trimmed = value.trim();

package/node_modules/@vellumai/service-contracts/src/ingress.ts

@@ -20,6 +20,16 @@ export function normalizePublicBaseUrl(value: unknown): string | undefined {
   return normalized.length > 0 ? normalized : undefined;
 }
 
+/**
+ * Application close code the gateway's velay bridge sends to proxied
+ * WebSockets when the tunnel itself is lost (velay disconnect, gateway
+ * shutdown). A dedicated code because the natural 1001 (going away) cannot
+ * be sent through the JS `close()` API (the bridge would remap it to a
+ * misleading 4001), and Bun's WebSocket client drops close reasons, so the
+ * code is the only signal that survives the relay to the daemon.
+ */
+export const GATEWAY_TUNNEL_LOST_WS_CLOSE_CODE = 4801;
+
 export function normalizeHttpPublicBaseUrl(value: unknown): string | undefined {
   if (typeof value !== "string") return undefined;
   const trimmed = value.trim();

package/openapi.yaml

@@ -9565,6 +9565,28 @@ paths:
                 required:
                   - ok
                 additionalProperties: false
+  /v1/conversations/unread-count:
+    get:
+      operationId: conversations_unreadcount_get
+      summary: Unread conversation count
+      description:
+        "Count of foreground conversations whose latest assistant message is unseen. Matches the sidebar's unread
+        indicators: archived rows and non-surfaced background/scheduled rows are excluded."
+      tags:
+        - conversations
+      responses:
+        "200":
+          description: Successful response
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  count:
+                    type: number
+                required:
+                  - count
+                additionalProperties: false
   /v1/conversations/wake:
     post:
       operationId: conversations_wake_post

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/assistant",
-  "version": "0.11.2-dev.202608051734.355dff7",
+  "version": "0.11.2-dev.202608051933.deffc0f",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/__tests__/agent-loop-override-profile.test.ts

@@ -1,16 +1,17 @@
 /**
  * Verifies that the per-turn `overrideProfile` plumbed into `AgentLoop.run()`
  * surfaces on every `SendMessageOptions.config` the loop emits, and that
- * `SubagentManager.spawn()` propagates an inherited `overrideProfile` from
- * its `SubagentConfig` into the subagent's `runAgentLoop()` call.
+ * `SubagentManager.spawn()` propagates an `overrideProfile` set on its
+ * `SubagentConfig` into the subagent's `runAgentLoop()` call.
  *
- * Together these two assertions establish the PR 6 contract: a parent
- * conversation that pins an inference profile sees that profile applied to
- * every LLM call within its agent-loop turn, and any subagent spawned during
- * that turn inherits the same profile automatically.
+ * Together these establish where a pinned profile does and does not travel: it
+ * applies to every LLM call within the pinning conversation's own turn, and it
+ * stops at the spawn boundary. `executeSubagentSpawn` sets `overrideProfile`
+ * on the `SubagentConfig` only for a profile named explicitly on the spawn, so
+ * the propagation above carries a caller's choice rather than a parent's pin.
  *
- * Default behavior (no `overrideProfile` set) must remain unchanged — the
- * field is omitted from `providerConfig` rather than carrying `undefined`.
+ * With no `overrideProfile` set, the field is omitted from `providerConfig`
+ * rather than carrying `undefined`.
  */
 
 import { describe, expect, mock, test } from "bun:test";
@@ -183,7 +184,7 @@ describe("AgentLoop.run — overrideProfile plumbing", () => {
   });
 });
 
-// ── Subagent inheritance ─────────────────────────────────────────────────
+// ── Subagent profile forwarding ──────────────────────────────────────────
 
 // Capture the SubagentManager → Conversation handshake so we can verify the
 // `overrideProfile` from `SubagentConfig` is forwarded into the spawned
@@ -329,7 +330,7 @@ seedLlmConfig();
 
 import { SubagentManager } from "../subagent/manager.js";
 
-describe("SubagentManager.spawn — overrideProfile inheritance", () => {
+describe("SubagentManager.spawn: forwards a configured overrideProfile", () => {
   test("forwards overrideProfile from SubagentConfig into runAgentLoop", async () => {
     capturedRunAgentLoopOptions.length = 0;
 
@@ -344,9 +345,9 @@ describe("SubagentManager.spawn — overrideProfile inheritance", () => {
       () => {},
     );
 
-    // The spawned subagent's runAgentLoop must receive both the
-    // `subagentSpawn` callSite (existing behavior) and the inherited
-    // `overrideProfile` (new behavior).
+    // The spawned subagent's runAgentLoop receives the `subagentSpawn`
+    // callSite and whatever `overrideProfile` the config carries, which
+    // `executeSubagentSpawn` sets only for an explicitly named profile.
     expect(capturedRunAgentLoopOptions).toHaveLength(1);
     const captured = capturedRunAgentLoopOptions[0];
     expect(captured.callSite).toBe("subagentSpawn");
@@ -399,21 +400,18 @@ describe("SubagentManager.spawn — overrideProfile inheritance", () => {
   });
 });
 
-// ── Nested subagent spawn — context.overrideProfile preferred ────────────
+// ── Nested subagent spawn: no profile crosses the boundary ───────────────
 
-// Verify the third-level inheritance contract: when a subagent's agent loop
-// is running with `currentTurnOverrideProfile`, the executor closure plumbs
-// that value into `ToolContext.overrideProfile`. `executeSubagentSpawn` must
-// then prefer `context.overrideProfile` over a row read against the in-flight
-// subagent's own conversationId — that row never has `inferenceProfile` set,
-// and `getConversationOverrideProfile` short-circuits for background
-// conversations regardless. Without preferring the in-memory context, the
-// inheritance chain breaks at the second nesting level.
+// When a subagent's agent loop is running under a turn profile, the executor
+// closure plumbs that value into `ToolContext.overrideProfile`. That value
+// describes the spawning turn, so `executeSubagentSpawn` leaves it behind: a
+// child resolves the `subagentSpawn` call site on its own, and a forwarded
+// override would both re-price the child and file its spend as a pin nobody
+// set. These tests cover the nesting levels where a profile could otherwise
+// compound down a chain of children.
 
 mock.module("../persistence/conversation-crud.js", () => ({
   setConversationProcessingStartedAt: () => {},
-  // Always return undefined for the row read so the test fails fast unless
-  // executeSubagentSpawn reads from context.overrideProfile first.
   getConversationOverrideProfile: () => undefined,
   reserveMessage: mock(async () => ({ id: "msg-reserve" })),
 }));
@@ -421,8 +419,8 @@ mock.module("../persistence/conversation-crud.js", () => ({
 import { getSubagentManager } from "../subagent/index.js";
 import { executeSubagentSpawn } from "../tools/subagent/spawn.js";
 
-describe("executeSubagentSpawn — nested inheritance via context.overrideProfile", () => {
-  test("forwards context.overrideProfile to SubagentConfig (third-level inheritance)", async () => {
+describe("executeSubagentSpawn: the spawn boundary carries no profile", () => {
+  test("a subagent spawning a subagent does not pass its own turn profile down", async () => {
     const manager = getSubagentManager();
     const originalSpawn = manager.spawn.bind(manager);
     let capturedConfig: Record<string, unknown> | undefined;
@@ -432,11 +430,11 @@ describe("executeSubagentSpawn — nested inheritance via context.overrideProfil
     };
 
     try {
-      // Simulate the second-level spawn: tool invocation occurs inside the
-      // first subagent's tool context, where `overrideProfile` was populated
-      // by `runAgentLoopImpl` from its `currentTurnOverrideProfile` snapshot.
-      // The first subagent's own conversation row has no `inferenceProfile`,
-      // so the row-read fallback would otherwise return undefined.
+      // The second-level spawn: this tool call happens inside the first
+      // subagent's tool context, where `overrideProfile` was populated by
+      // `runAgentLoopImpl` from its own turn snapshot. That snapshot describes
+      // the parent's turn, so it stops here rather than compounding down a
+      // chain of nested children.
       const result = await executeSubagentSpawn(
         { label: "nested", objective: "do nested work" },
         {
@@ -450,16 +448,13 @@ describe("executeSubagentSpawn — nested inheritance via context.overrideProfil
 
       expect(result.isError).toBe(false);
       expect(capturedConfig).toBeDefined();
-      // The forwarded SubagentConfig must carry the in-memory override so
-      // SubagentManager.spawn forwards it into the nested subagent's
-      // runAgentLoop options — preserving inheritance across the chain.
-      expect(capturedConfig!.overrideProfile).toBe("fast");
+      expect("overrideProfile" in capturedConfig!).toBe(false);
     } finally {
       manager.spawn = originalSpawn;
     }
   });
 
-  test("forwards the invoker's resolved default profile when neither context nor row carries an override", async () => {
+  test("no override anywhere leaves the child on the subagentSpawn default", async () => {
     const manager = getSubagentManager();
     const originalSpawn = manager.spawn.bind(manager);
     let capturedConfig: Record<string, unknown> | undefined;
@@ -481,22 +476,17 @@ describe("executeSubagentSpawn — nested inheritance via context.overrideProfil
       );
 
       expect(capturedConfig).toBeDefined();
-      // With no explicit override anywhere, the invoker-default tier forwards
-      // the invoking call site's resolved default profile — here `mainAgent`
-      // with no active profile or pin, which resolves the catalog `balanced`
-      // default — so the subagent matches its invoker's model selection.
-      expect(capturedConfig!.overrideProfile).toBe("balanced");
+      expect("overrideProfile" in capturedConfig!).toBe(false);
     } finally {
       manager.spawn = originalSpawn;
     }
   });
 
-  test("an explicit subagentSpawn call-site pin suppresses the invoker-default inheritance", async () => {
-    // With an active profile the invoker-default tier resolves ("fast"), so
-    // absent a pin it is forwarded as the inherited override; with an
-    // explicit llm.callSites.subagentSpawn profile the heuristic must yield —
-    // a forwarded override would outrank the pin under single-winner
-    // resolution, overriding the user's explicit call-site choice.
+  test("a workspace active profile does not reach the child, pinned or not", async () => {
+    // The child resolves `llm.callSites.subagentSpawn` on its own, so the
+    // spawn must forward nothing either way: a forwarded override would
+    // outrank an explicit call-site pin under single-winner resolution and
+    // overturn the operator's choice.
     const manager = getSubagentManager();
     const originalSpawn = manager.spawn.bind(manager);
     let capturedConfig: Record<string, unknown> | undefined;
@@ -517,7 +507,7 @@ describe("executeSubagentSpawn — nested inheritance via context.overrideProfil
         { label: "nested", objective: "do nested work" },
         baseContext,
       );
-      expect(capturedConfig!.overrideProfile).toBe("fast");
+      expect("overrideProfile" in capturedConfig!).toBe(false);
 
       seedLlmConfig({
         activeProfile: "fast",

package/src/__tests__/assistant-feature-flags-integration.test.ts

@@ -80,16 +80,6 @@ describe("isAssistantFeatureFlagEnabled", () => {
   });
 });
 
-describe("subagent flags default to disabled", () => {
-  for (const flagKey of ["subagent-profile-isolation", "subagent-loop-guard"]) {
-    test(`${flagKey} resolves to false with no override`, () => {
-      const config = {} as any;
-
-      expect(isAssistantFeatureFlagEnabled(flagKey, config)).toBe(false);
-    });
-  }
-});
-
 describe("isAssistantFeatureFlagEnabled with skillFlagKey", () => {
   test("resolves skill flag via canonical path", () => {
     setOverridesForTesting({ [DECLARED_FLAG_KEY]: false });

package/src/__tests__/conversation-tool-setup-app-refresh.test.ts

@@ -92,6 +92,7 @@ function makeCtx(overrides: Partial<Conversation> = {}): Conversation {
     conversationId: "conv-test",
     currentRequestId: "req-1",
     workingDir: "/tmp/test",
+    getTurnActorPrincipalId: () => undefined,
     abortController: null,
     sendToClient: mock(() => {}),
     pendingSurfaceActions: new Map(),

package/src/__tests__/conversation-tool-setup-attribution.test.ts

@@ -99,6 +99,7 @@ function makeCtx(overrides: Partial<Conversation> = {}): Conversation {
     conversationId: "conv-test",
     currentRequestId: "req-1",
     workingDir: "/tmp/test",
+    getTurnActorPrincipalId: () => undefined,
     abortController: null,
     sendToClient: mock(() => {}),
     pendingSurfaceActions: new Map(),
@@ -402,3 +403,63 @@ describe("createToolExecutor channel-permission coordinate threading", () => {
     expect(bindingLookups).toEqual([]);
   });
 });
+
+describe("createToolExecutor source-actor threading", () => {
+  test("submits the turn's actor principal, not the trust context's guardian", async () => {
+    // `ToolContext.sourceActorPrincipalId` is compared against the principal a
+    // client registered with on its SSE stream, so it has to be the turn's
+    // actor. Reading `trustContext.guardianPrincipalId` instead meant any turn
+    // whose trust resolution degraded submitted nothing, and the same-actor
+    // gate rejected it as a user mismatch.
+    const { executor, calls } = makeCapturingExecutor();
+    await makeToolFn(
+      executor,
+      makeCtx({
+        getTurnActorPrincipalId: () => "actor-1",
+        currentTurnTrustContext: {
+          sourceChannel: "vellum",
+          trustClass: "guardian",
+          guardianPrincipalId: "guardian-1",
+        },
+      }),
+    )("file_read", { path: "/tmp/a" });
+
+    expect(calls[0].context.sourceActorPrincipalId).toBe("actor-1");
+  });
+
+  test("carries the actor through even when trust resolved without a guardian principal", async () => {
+    // The regression: degraded trust resolution (unreachable gateway, binding
+    // drift) or a service-principal turn leaves `guardianPrincipalId` unset
+    // while the turn's actor is perfectly well known.
+    const { executor, calls } = makeCapturingExecutor();
+    await makeToolFn(
+      executor,
+      makeCtx({
+        getTurnActorPrincipalId: () => "actor-1",
+        currentTurnTrustContext: {
+          sourceChannel: "vellum",
+          trustClass: "unknown",
+        },
+      }),
+    )("file_read", { path: "/tmp/a" });
+
+    expect(calls[0].context.sourceActorPrincipalId).toBe("actor-1");
+  });
+
+  test("submits nothing when the turn has no actor identity at all", async () => {
+    const { executor, calls } = makeCapturingExecutor();
+    await makeToolFn(
+      executor,
+      makeCtx({
+        getTurnActorPrincipalId: () => undefined,
+        currentTurnTrustContext: {
+          sourceChannel: "vellum",
+          trustClass: "guardian",
+          guardianPrincipalId: "guardian-1",
+        },
+      }),
+    )("file_read", { path: "/tmp/a" });
+
+    expect(calls[0].context.sourceActorPrincipalId).toBeUndefined();
+  });
+});

package/src/__tests__/cu-unified-flow.test.ts

@@ -705,9 +705,7 @@ describe("surfaceProxyResolver — CU tool routing", () => {
       });
 
       expect(result.isError).toBe(true);
-      expect(result.content).toContain(
-        "Submitting actor does not match the target client's actor",
-      );
+      expect(result.content).toContain("signed in as a different user");
       // No state mutation, no dispatch.
       expect(proxy.stepCount).toBe(0);
       expect(proxy.actionHistory).toHaveLength(0);
@@ -734,9 +732,7 @@ describe("surfaceProxyResolver — CU tool routing", () => {
       });
 
       expect(result.isError).toBe(true);
-      expect(result.content).toContain(
-        "Submitting actor does not match the target client's actor",
-      );
+      expect(result.content).toContain("no authenticated actor");
       expect(sentMessages).toHaveLength(0);
     });
 

package/src/__tests__/file-ops-service.test.ts

@@ -11,6 +11,7 @@ import { join } from "node:path";
 import { afterEach, describe, expect, test } from "bun:test";
 
 import {
+  DEFAULT_READ_LINE_LIMIT,
   FileSystemOps,
   type PathPolicy,
 } from "../tools/shared/filesystem/file-ops-service.js";
@@ -124,10 +125,80 @@ describe("FileSystemOps.readFileSafe", () => {
     if (!result.ok) {
       return;
     }
-    expect(result.value.content).toContain("b");
-    expect(result.value.content).toContain("c");
-    expect(result.value.content).not.toContain("     1");
-    expect(result.value.content).not.toContain("d");
+    // Assert on the numbered lines rather than bare letters: the truncation
+    // notice is prose, so a bare `toContain("d")` matches its wording.
+    const [body] = result.value.content.split("\n\n[Truncated:");
+    expect(body).toContain("     2  b");
+    expect(body).toContain("     3  c");
+    expect(body).not.toContain("     1  a");
+    expect(body).not.toContain("     4  d");
+  });
+
+  test("caps an unbounded read at the default line limit and says so", async () => {
+    const dir = makeTempDir();
+    const total = DEFAULT_READ_LINE_LIMIT + 500;
+    const lines = Array.from({ length: total }, (_, i) => `line${i + 1}`);
+    writeFileSync(join(dir, "big.txt"), lines.join("\n"));
+    const ops = new FileSystemOps(sandboxPolicyFor(dir));
+
+    const result = await ops.readFileSafe({ path: "big.txt" });
+    expect(result.ok).toBe(true);
+    if (!result.ok) {
+      return;
+    }
+    const content = result.value.content;
+    expect(content).toContain(`  ${DEFAULT_READ_LINE_LIMIT}  line2000`);
+    expect(content).not.toContain("line2001");
+    expect(content).toContain(
+      `[Truncated: showing through line ${DEFAULT_READ_LINE_LIMIT} of ${total}. Read on with offset=${DEFAULT_READ_LINE_LIMIT + 1}`,
+    );
+  });
+
+  test("an explicit limit is honored rather than replaced by the default", async () => {
+    const dir = makeTempDir();
+    const lines = Array.from(
+      { length: DEFAULT_READ_LINE_LIMIT + 500 },
+      (_, i) => `line${i + 1}`,
+    );
+    writeFileSync(join(dir, "big.txt"), lines.join("\n"));
+    const ops = new FileSystemOps(sandboxPolicyFor(dir));
+
+    const result = await ops.readFileSafe({
+      path: "big.txt",
+      limit: DEFAULT_READ_LINE_LIMIT + 500,
+    });
+    expect(result.ok).toBe(true);
+    if (!result.ok) {
+      return;
+    }
+    expect(result.value.content).toContain("line2500");
+    expect(result.value.content).not.toContain("[Truncated:");
+  });
+
+  test("a read that reaches the last line carries no truncation notice", async () => {
+    const dir = makeTempDir();
+    writeFileSync(join(dir, "small.txt"), "a\nb\nc");
+    const ops = new FileSystemOps(sandboxPolicyFor(dir));
+
+    const result = await ops.readFileSafe({ path: "small.txt" });
+    expect(result.ok).toBe(true);
+    if (!result.ok) {
+      return;
+    }
+    expect(result.value.content).not.toContain("[Truncated:");
+  });
+
+  test("paging past the end is not reported as truncation", async () => {
+    const dir = makeTempDir();
+    writeFileSync(join(dir, "small.txt"), "a\nb\nc");
+    const ops = new FileSystemOps(sandboxPolicyFor(dir));
+
+    const result = await ops.readFileSafe({ path: "small.txt", offset: 100 });
+    expect(result.ok).toBe(true);
+    if (!result.ok) {
+      return;
+    }
+    expect(result.value.content).not.toContain("[Truncated:");
   });
 });
 

package/src/__tests__/host-bash-proxy.test.ts

@@ -742,8 +742,11 @@ describe("HostBashProxy", () => {
   });
 
   describe("same-user binding (sourceActorPrincipalId)", () => {
-    const SAME_USER_REJECTION =
-      "Submitting actor does not match the target client's actor for this request. The targeted client's authenticated user must submit the result.";
+    // The proxy path names which comparison failed, so each rejection asserts
+    // its own reason — a turn with no actor, a client registered without one,
+    // and two genuinely different users are three different problems.
+    const CROSS_USER_REJECTION =
+      "Submitting actor does not match the target client's actor for this request. The target client is signed in as a different user — run `assistant clients list` to see which connected clients you own.";
 
     test("same-user targeted request succeeds", async () => {
       setup();
@@ -784,7 +787,7 @@ describe("HostBashProxy", () => {
       );
 
       expect(result.isError).toBe(true);
-      expect(result.content).toBe(SAME_USER_REJECTION);
+      expect(result.content).toBe(CROSS_USER_REJECTION);
       // No broadcast and no pending registration
       expect(sentMessages).toHaveLength(0);
     });
@@ -807,7 +810,9 @@ describe("HostBashProxy", () => {
       );
 
       expect(result.isError).toBe(true);
-      expect(result.content).toBe(SAME_USER_REJECTION);
+      expect(result.content).toContain(
+        "registered without an authenticated user",
+      );
       expect(sentMessages).toHaveLength(0);
     });
 
@@ -823,7 +828,7 @@ describe("HostBashProxy", () => {
       );
 
       expect(result.isError).toBe(true);
-      expect(result.content).toBe(SAME_USER_REJECTION);
+      expect(result.content).toContain("no authenticated actor");
       expect(sentMessages).toHaveLength(0);
     });
 

package/src/__tests__/host-browser-proxy.test.ts

@@ -867,7 +867,7 @@ describe("HostBrowserProxy", () => {
       );
 
       expect(result.isError).toBe(true);
-      expect(result.content).toContain("Submitting actor does not match");
+      expect(result.content).toContain("signed in as a different user");
       expect(getPublishedMessages()).toHaveLength(0);
     });
 
@@ -1054,7 +1054,7 @@ describe("HostBrowserProxy", () => {
       );
 
       expect(result.isError).toBe(true);
-      expect(result.content).toContain("Submitting actor does not match");
+      expect(result.content).toContain("signed in as a different user");
       expect(result.content).not.toContain("extension_required");
       expect(getPublishedMessages()).toHaveLength(0);
     });

package/src/__tests__/host-cu-proxy.test.ts

@@ -1416,9 +1416,7 @@ describe("HostCuProxy", () => {
       );
 
       expect(result.isError).toBe(true);
-      expect(result.content).toContain(
-        "Submitting actor does not match the target client's actor",
-      );
+      expect(result.content).toContain("signed in as a different user");
       expect(sentMessages).toHaveLength(0);
     });
 
@@ -1444,9 +1442,7 @@ describe("HostCuProxy", () => {
       );
 
       expect(result.isError).toBe(true);
-      expect(result.content).toContain(
-        "Submitting actor does not match the target client's actor",
-      );
+      expect(result.content).toContain("no authenticated actor");
       expect(sentMessages).toHaveLength(0);
     });
 
@@ -1473,7 +1469,7 @@ describe("HostCuProxy", () => {
 
       expect(result.isError).toBe(true);
       expect(result.content).toContain(
-        "Submitting actor does not match the target client's actor",
+        "registered without an authenticated user",
       );
       expect(sentMessages).toHaveLength(0);
     });

package/src/__tests__/host-file-proxy.test.ts

@@ -693,9 +693,7 @@ describe("HostFileProxy", () => {
       );
 
       expect(result.isError).toBe(true);
-      expect(result.content).toContain(
-        "Submitting actor does not match the target client's actor",
-      );
+      expect(result.content).toContain("signed in as a different user");
       // No host_file_request was broadcast.
       expect(sentMessages).toHaveLength(0);
     });
@@ -720,7 +718,7 @@ describe("HostFileProxy", () => {
 
       expect(result.isError).toBe(true);
       expect(result.content).toContain(
-        "Submitting actor does not match the target client's actor",
+        "registered without an authenticated user",
       );
       expect(sentMessages).toHaveLength(0);
     });
@@ -744,9 +742,7 @@ describe("HostFileProxy", () => {
       );
 
       expect(result.isError).toBe(true);
-      expect(result.content).toContain(
-        "Submitting actor does not match the target client's actor",
-      );
+      expect(result.content).toContain("no authenticated actor");
       expect(sentMessages).toHaveLength(0);
     });
 

package/src/__tests__/host-file-read-tool.test.ts

@@ -27,6 +27,7 @@ mock.module("../daemon/host-file-proxy.js", () => ({
 }));
 
 import { hostFileReadTool } from "../tools/host-filesystem/read.js";
+import { DEFAULT_READ_LINE_LIMIT } from "../tools/shared/filesystem/file-ops-service.js";
 import type { ToolContext } from "../tools/types.js";
 
 const testDirs: string[] = [];
@@ -226,13 +227,16 @@ describe("host_file_read image support", () => {
 
     expect(result.isError).toBe(false);
     expect(result.contentBlocks).toHaveLength(1);
+    // The proxied request carries the resolved default window, so a host read
+    // is bounded by the same limit as a local one rather than streaming a
+    // whole file across the bridge.
     expect(requests).toEqual([
       {
         input: {
           operation: "read",
           path: "/host/screenshot.png",
           offset: undefined,
-          limit: undefined,
+          limit: DEFAULT_READ_LINE_LIMIT,
         },
         conversationId: "test-conversation",
         signal: undefined,