@vellumai/assistant 0.11.4 → 0.11.5-staging.1

package/src/api/constants/app-tools.ts

@@ -0,0 +1,34 @@
+/**
+ * The app tools that mutate the stored app set, and what each one leaves
+ * behind. Mirrors `document-tools.ts`: a single declaration both the daemon and
+ * the web client derive their tool sets from, so a new mutating app tool is
+ * added here once and every consumer picks it up.
+ *
+ * Tool names are the ones the runner sees. Calls arriving through the bundled
+ * `app-builder` skill reach the daemon already unwrapped to the inner tool
+ * name, and the web client unwraps the `skill_execute` envelope itself.
+ */
+
+export interface AppMutationTool {
+  /** The executed tool name. */
+  readonly name: string;
+  /**
+   * Whether the app is still openable once the tool has run. A deleted app has
+   * nothing to open, so it cannot anchor a card back to itself.
+   */
+  readonly reopenable: boolean;
+}
+
+export const APP_MUTATION_TOOLS: readonly AppMutationTool[] = [
+  { name: "app_create", reopenable: true },
+  { name: "app_update", reopenable: true },
+  { name: "app_delete", reopenable: false },
+];
+
+/**
+ * The mutating app tools that leave the app openable. The web transcript
+ * anchors its end-of-response app cards on these, so a delete never produces a
+ * card pointing at an app that is gone.
+ */
+export const APP_MUTATION_TOOL_NAMES: readonly string[] =
+  APP_MUTATION_TOOLS.filter((tool) => tool.reopenable).map((tool) => tool.name);

package/src/api/events/resource-pressure-status-changed.ts

@@ -0,0 +1,53 @@
+/**
+ * `resource_pressure_status_changed` SSE event.
+ *
+ * Global broadcast pushed when the daemon's resource-pressure snapshot
+ * changes. Mirrors the REST `GET /resource-pressure/status` shape so the
+ * client's monitor can apply stream updates and polled fetches through
+ * the same code path. Carries no `conversationId`: it is workspace-wide.
+ *
+ * Canonical wire-contract source. Daemon code imports the type
+ * directly from this file; external consumers import via
+ * `@vellumai/assistant-api`.
+ */
+
+import { z } from "zod";
+
+export const ResourcePressureStateSchema = z.enum([
+  "disabled",
+  "ok",
+  "elevated",
+  "unknown",
+]);
+
+export type ResourcePressureState = z.infer<typeof ResourcePressureStateSchema>;
+
+export const ResourcePressureStatusSchema = z.object({
+  enabled: z.boolean(),
+  state: ResourcePressureStateSchema,
+  /** Latest CPU sample as a percent of the CPU allocation. */
+  cpuPercent: z.number().nullable(),
+  /** Working set as a percent of the memory limit. */
+  memoryPercent: z.number().nullable(),
+  /** Whether the CPU signal is holding the `elevated` state. */
+  cpuElevated: z.boolean(),
+  /** Whether the memory signal is holding the `elevated` state. */
+  memoryElevated: z.boolean(),
+  cpuThresholdPercent: z.number(),
+  memoryThresholdPercent: z.number(),
+  lastCheckedAt: z.string().nullable(),
+  error: z.string().nullable(),
+});
+
+export type ResourcePressureStatus = z.infer<
+  typeof ResourcePressureStatusSchema
+>;
+
+export const ResourcePressureStatusChangedEventSchema = z.object({
+  type: z.literal("resource_pressure_status_changed"),
+  status: ResourcePressureStatusSchema,
+});
+
+export type ResourcePressureStatusChangedEvent = z.infer<
+  typeof ResourcePressureStatusChangedEventSchema
+>;

package/src/api/index.ts

@@ -102,6 +102,7 @@ import {
   RecordingStopEventSchema,
 } from "./events/recording.js";
 import { RelationshipStateUpdatedEventSchema } from "./events/relationship-state-updated.js";
+import { ResourcePressureStatusChangedEventSchema } from "./events/resource-pressure-status-changed.js";
 import { ScheduleConversationCreatedEventSchema } from "./events/schedule-conversation-created.js";
 import { SecretRequestEventSchema } from "./events/secret-request.js";
 import { ServiceGroupUpdateCompleteEventSchema } from "./events/service-group-update-complete.js";
@@ -134,6 +135,11 @@ import { WorkflowLeafStartedEventSchema } from "./events/workflow-leaf-started.j
 import { WorkflowProgressEventSchema } from "./events/workflow-progress.js";
 import { WorkflowStartedEventSchema } from "./events/workflow-started.js";
 
+export {
+  APP_MUTATION_TOOL_NAMES,
+  APP_MUTATION_TOOLS,
+  type AppMutationTool,
+} from "./constants/app-tools.js";
 export {
   CALL_SITE_COMPACTION_AGENT,
   CALL_SITE_SYNTHETIC_AGENT_ERROR_MESSAGE,
@@ -536,6 +542,14 @@ export {
   type RelationshipStateUpdatedEvent,
   RelationshipStateUpdatedEventSchema,
 } from "./events/relationship-state-updated.js";
+export {
+  type ResourcePressureState,
+  ResourcePressureStateSchema,
+  type ResourcePressureStatus,
+  type ResourcePressureStatusChangedEvent,
+  ResourcePressureStatusChangedEventSchema,
+  ResourcePressureStatusSchema,
+} from "./events/resource-pressure-status-changed.js";
 export {
   type ScheduleConversationCreatedEvent,
   ScheduleConversationCreatedEventSchema,
@@ -802,6 +816,10 @@ export {
   type MemoryV3SelectionRow,
   MemoryV3SelectionRowSchema,
 } from "./responses/memory-v3-selection-log.js";
+export {
+  type ResourcePressureStatusResponse,
+  ResourcePressureStatusResponseSchema,
+} from "./responses/resource-pressure-status.js";
 export {
   type SubagentDetailEvent,
   SubagentDetailEventSchema,
@@ -987,6 +1005,7 @@ export const AssistantEventSchema = z.discriminatedUnion("type", [
   RecordingStartEventSchema,
   RecordingStopEventSchema,
   RelationshipStateUpdatedEventSchema,
+  ResourcePressureStatusChangedEventSchema,
   ScheduleConversationCreatedEventSchema,
   SecretRequestEventSchema,
   ServiceGroupUpdateCompleteEventSchema,

package/src/api/responses/resource-pressure-status.ts

@@ -0,0 +1,25 @@
+/**
+ * Wire contract for the resource-pressure REST endpoint
+ * (`GET /resource-pressure/status`). Returns the current snapshot
+ * wrapped as `{ status }`.
+ *
+ * Reuses the canonical `ResourcePressureStatusSchema` defined alongside
+ * the `resource_pressure_status_changed` SSE event so the polled REST
+ * fetch and the streamed update share a single shape.
+ *
+ * Canonical wire-contract source. Assistant code imports the types
+ * directly from this file via relative paths; external consumers
+ * (web client, gateway, evals) import via `@vellumai/assistant-api`.
+ */
+
+import { z } from "zod";
+
+import { ResourcePressureStatusSchema } from "../events/resource-pressure-status-changed.js";
+
+export const ResourcePressureStatusResponseSchema = z.object({
+  status: ResourcePressureStatusSchema,
+});
+
+export type ResourcePressureStatusResponse = z.infer<
+  typeof ResourcePressureStatusResponseSchema
+>;

package/src/approvals/guardian-channel-delivery.ts

@@ -1,11 +1,12 @@
 /**
- * Shared addressing helpers for guardian requester-facing channel notices.
+ * Shared addressing helpers for guardian-flow channel notices.
  *
- * Requester notices (approval, denial, expiry) are delivered straight to the
- * requester's chat via `deliverChannelReply` — independent of the
- * guardian-facing notification pipeline. Centralizing the addressing rules here
- * keeps the decision resolvers and the timer-driven expiry sweep from drifting
- * apart on how a requester is reached.
+ * Requester notices (approval, denial, expiry) and the guardian's own approval
+ * prompt are delivered straight to a chat via `deliverChannelReply` -
+ * independent of the guardian-facing notification pipeline. Centralizing the
+ * addressing rules here keeps the decision resolvers, the timer-driven expiry
+ * sweep and the in-turn approval prompt from drifting apart on who a message
+ * is put in front of.
  */
 
 /**
@@ -111,3 +112,66 @@ export function resolveRequesterDeliveryTarget(params: {
   }
   return requesterChatId;
 }
+
+/**
+ * Reduce a reply callback to its channel route, dropping every query param.
+ *
+ * A callback addresses the turn it came from. The gateway hangs the turn's
+ * coordinates on it as params, and each transport reads a different one:
+ * Slack a `threadTs`, Telegram a forum topic `threadId`, Discord a `threadId`
+ * that replaces the destination outright rather than narrowing it. Carried
+ * onto a delivery aimed elsewhere they either fail the send or quietly win
+ * over the new address, and a redirect that leaves one behind is
+ * indistinguishable from no redirect at all.
+ *
+ * Everything is dropped rather than a named set, so a channel added later, or
+ * a param a transport starts reading later, cannot silently escape this. The
+ * channel itself survives because it is the path, which is also what
+ * `isDirectDelivery` resolves a transport from, and nothing the gateway hangs
+ * on a deliver callback is needed to authorize or route the send.
+ *
+ * Relative or malformed URLs are returned as-is; they carry no params.
+ */
+export function stripTurnDestination(replyCallbackUrl: string): string {
+  try {
+    const url = new URL(replyCallbackUrl);
+    url.search = "";
+    return url.toString();
+  } catch {
+    return replyCallbackUrl;
+  }
+}
+
+/**
+ * Resolve where a guardian's own approval prompt is delivered.
+ *
+ * The prompt is raised by a turn the guardian is having, and that turn can be
+ * running in a room: a shared Slack channel, a Telegram group. The card
+ * carries the tool name and a preview of the command, so delivering it where
+ * the turn is shows both to everyone there.
+ *
+ * It goes to the guardian's own bound chat instead, the address they
+ * nominated when they verified and the one the notification pipeline already
+ * sends guardian cards to. No channel is named in this rule and none can be
+ * forgotten by it: a bound chat is the guardian's by definition, on any
+ * channel, including ones not built yet.
+ *
+ * A bound chat equal to the turn's chat means the turn is already there, so
+ * nothing moves. That also covers a turn where no binding resolved, since the
+ * trust context falls back to the turn's own chat, leaving delivery exactly as
+ * it is rather than dropping it.
+ */
+export function resolveGuardianPromptDelivery(params: {
+  turnChatId: string;
+  turnCallbackUrl: string;
+  guardianChatId: string | undefined;
+}): { chatId: string; callbackUrl: string } {
+  const { turnChatId, turnCallbackUrl, guardianChatId } = params;
+  if (!guardianChatId || guardianChatId === turnChatId) {
+    return { chatId: turnChatId, callbackUrl: turnCallbackUrl };
+  }
+  return {
+    chatId: guardianChatId,
+    callbackUrl: stripTurnDestination(turnCallbackUrl),
+  };
+}

package/src/approvals/guardian-request-resolvers.ts

@@ -23,8 +23,10 @@ import type {
   GuardianRequestWire,
 } from "../channels/gateway-guardian-requests.js";
 import { getGuardianRequestOrNull } from "../channels/gateway-guardian-requests.js";
+import { audienceForReader } from "../channels/message-audience.js";
 import { findContactChannel } from "../contacts/contact-store.js";
 import { findConversation } from "../daemon/conversation-registry.js";
+import { isSlackDmConversation } from "../messaging/providers/slack/message-metadata.js";
 import { emitNotificationSignal } from "../notifications/emit-signal.js";
 import { parseQuestionAnswerActionId } from "../notifications/guardian-question-mode.js";
 import {
@@ -62,6 +64,7 @@ import {
   channelDeliversToUserId,
   resolveDeliverCallbackUrlForChannel,
   resolveRequesterDeliveryTarget,
+  stripTurnDestination,
 } from "./guardian-channel-delivery.js";
 
 const log = getLogger("guardian-request-resolvers");
@@ -70,38 +73,6 @@ const log = getLogger("guardian-request-resolvers");
 // Helpers
 // ---------------------------------------------------------------------------
 
-/**
- * Determines whether a Slack delivery should use ephemeral mode.
- *
- * Ephemeral messages (`chat.postEphemeral`) require a real channel ID
- * (starts with `C` for public/private channels, or `D` for DM conversations).
- * When the chat ID is a user ID (starts with `U`), `chat.postEphemeral` fails
- * with `channel_not_found`. In that case the message is already going to a DM
- * opened by `chat.postMessage`, so ephemeral isn't needed.
- *
- * Returns `true` only when the source channel is Slack AND the chatId is a
- * shared channel (starts with `C`), meaning other users could see the message.
- */
-function shouldUseEphemeral(sourceChannel: string, chatId: string): boolean {
-  return sourceChannel === "slack" && chatId.startsWith("C");
-}
-
-/**
- * Strip the `threadTs` query param from a reply callback URL. The param
- * addresses the guardian's channel thread; reusing it for a DM delivery
- * raises `thread_not_found`. Relative or malformed URLs are returned as-is —
- * they carry no threadTs to strip.
- */
-function stripThreadTsParam(replyCallbackUrl: string): string {
-  try {
-    const url = new URL(replyCallbackUrl);
-    url.searchParams.delete("threadTs");
-    return url.toString();
-  } catch {
-    return replyCallbackUrl;
-  }
-}
-
 /**
  * Deliver the verification code straight to the requester's DM so the
  * guardian is never an out-of-band courier for the secret.
@@ -125,7 +96,7 @@ async function deliverVerificationCodeToRequester(params: {
   verificationCode: string;
   assistantId: string;
 }): Promise<boolean> {
-  const callbackUrl = stripThreadTsParam(params.replyCallbackUrl);
+  const callbackUrl = stripTurnDestination(params.replyCallbackUrl);
 
   try {
     await deliverChannelReply(callbackUrl, {
@@ -194,13 +165,13 @@ function buildRequesterChannelNotice(params: {
     text: params.text,
     assistantId: params.assistantId,
   };
-  if (
-    shouldUseEphemeral(params.channel, params.requesterChatId) &&
-    params.requesterExternalUserId
-  ) {
-    payload.ephemeral = true;
-    payload.user = params.requesterExternalUserId;
-  }
+  payload.audience = audienceForReader(
+    params.channel,
+
+    params.requesterChatId,
+
+    params.requesterExternalUserId,
+  );
   return payload;
 }
 
@@ -1309,16 +1280,11 @@ const accessRequestResolver: GuardianRequestResolver = {
         };
         // On Slack shared channels, deliver the verification code as ephemeral
         // so only the guardian sees the secret — not all channel members.
-        if (
-          shouldUseEphemeral(
-            ctx.actor.channel,
-            guardianInBandContext.guardianChatId,
-          ) &&
-          ctx.actor.actorExternalUserId
-        ) {
-          codePayload.ephemeral = true;
-          codePayload.user = ctx.actor.actorExternalUserId;
-        }
+        codePayload.audience = audienceForReader(
+          ctx.actor.channel,
+          guardianInBandContext.guardianChatId,
+          ctx.actor.actorExternalUserId,
+        );
         await deliverChannelReply(
           guardianInBandContext.replyCallbackUrl,
           codePayload,
@@ -1339,9 +1305,9 @@ const accessRequestResolver: GuardianRequestResolver = {
         codeDelivered &&
         ctx.actor.channel === "slack" &&
         guardianUserId &&
-        !guardianInBandContext.guardianChatId.startsWith("D")
+        !isSlackDmConversation(guardianInBandContext.guardianChatId)
       ) {
-        const dmCallbackUrl = stripThreadTsParam(
+        const dmCallbackUrl = stripTurnDestination(
           guardianInBandContext.replyCallbackUrl,
         );
 
@@ -1543,13 +1509,13 @@ const toolGrantRequestResolver: GuardianRequestResolver = {
               text: `Your request to use "${request.toolName}" has been denied by the guardian.`,
               assistantId,
             };
-          if (
-            shouldUseEphemeral(request.sourceChannel ?? "", requesterChatId) &&
-            request.requesterExternalUserId
-          ) {
-            grantDenialPayload.ephemeral = true;
-            grantDenialPayload.user = request.requesterExternalUserId;
-          }
+          grantDenialPayload.audience = audienceForReader(
+            request.sourceChannel,
+
+            requesterChatId,
+
+            request.requesterExternalUserId,
+          );
           await deliverChannelReply(
             channelDeliveryContext.replyCallbackUrl,
             grantDenialPayload,
@@ -1642,13 +1608,13 @@ const toolGrantRequestResolver: GuardianRequestResolver = {
             text: `Your request to use "${request.toolName}" has been approved. Please retry your request.`,
             assistantId,
           };
-        if (
-          shouldUseEphemeral(request.sourceChannel ?? "", requesterChatId) &&
-          request.requesterExternalUserId
-        ) {
-          grantApprovalPayload.ephemeral = true;
-          grantApprovalPayload.user = request.requesterExternalUserId;
-        }
+        grantApprovalPayload.audience = audienceForReader(
+          request.sourceChannel,
+
+          requesterChatId,
+
+          request.requesterExternalUserId,
+        );
         await deliverChannelReply(
           channelDeliveryContext.replyCallbackUrl,
           grantApprovalPayload,

package/src/channels/__tests__/message-audience.test.ts

@@ -0,0 +1,49 @@
+import { describe, expect, test } from "bun:test";
+
+import { audienceForReader } from "../message-audience.js";
+
+describe("audienceForReader", () => {
+  test("restricts a reply in a Slack channel to the named reader", () => {
+    expect(audienceForReader("slack", "C0ROOM", "U0READER")).toEqual({
+      kind: "oneReader",
+      userId: "U0READER",
+    });
+  });
+
+  test("leaves a Slack DM unrestricted", () => {
+    // Nobody else can read a DM, so restricting buys no privacy and costs
+    // durability: an ephemeral message does not survive a reload.
+    expect(audienceForReader("slack", "D0DIRECT", "U0READER")).toBeUndefined();
+  });
+
+  test("restricts a private group, which several readers share", () => {
+    // A `G` id is a shared room like a `C` one. Testing for a DM rather than
+    // for a channel id is what keeps this from leaking into the group.
+    expect(audienceForReader("slack", "G0PRIVATE", "U0READER")).toEqual({
+      kind: "oneReader",
+      userId: "U0READER",
+    });
+  });
+
+  test("leaves every other channel unrestricted", () => {
+    for (const channel of ["telegram", "discord", "whatsapp", "email"]) {
+      expect(
+        audienceForReader(channel, "C0ROOM", "U0READER"),
+        `${channel} has no way to show one reader a message in a shared room`,
+      ).toBeUndefined();
+    }
+  });
+
+  test("stays unrestricted when there is no reader to name", () => {
+    expect(audienceForReader("slack", "C0ROOM", undefined)).toBeUndefined();
+    expect(audienceForReader("slack", "C0ROOM", null)).toBeUndefined();
+  });
+
+  test("tolerates an absent channel or room rather than throwing", () => {
+    // Several callers hold values that were never narrowed, so the answer for
+    // an unknown channel has to be the safe one rather than an exception.
+    expect(audienceForReader(undefined, "C0ROOM", "U0READER")).toBeUndefined();
+    expect(audienceForReader(null, "C0ROOM", "U0READER")).toBeUndefined();
+    expect(audienceForReader("slack", null, "U0READER")).toBeUndefined();
+  });
+});

package/src/channels/__tests__/types.test.ts

@@ -17,9 +17,10 @@ describe("INTERFACE_IDS", () => {
     ).toBe(true);
   });
 
-  test("still includes macos and other existing interfaces", () => {
+  test("includes desktop and existing interfaces", () => {
     for (const id of [
       "macos",
+      "windows",
       "ios",
       "cli",
       "telegram",
@@ -41,8 +42,9 @@ describe("INTERACTIVE_INTERFACES", () => {
     expect(INTERACTIVE_INTERFACES.has("chrome-extension" as never)).toBe(false);
   });
 
-  test("still includes macos", () => {
+  test("includes desktop clients", () => {
     expect(INTERACTIVE_INTERFACES.has("macos")).toBe(true);
+    expect(INTERACTIVE_INTERFACES.has("windows")).toBe(true);
   });
 });
 
@@ -51,8 +53,9 @@ describe("isInterfaceId", () => {
     expect(isInterfaceId("chrome-extension")).toBe(true);
   });
 
-  test("returns true for macos", () => {
+  test("returns true for desktop interfaces", () => {
     expect(isInterfaceId("macos")).toBe(true);
+    expect(isInterfaceId("windows")).toBe(true);
   });
 
   test("returns false for unknown interface", () => {
@@ -68,6 +71,7 @@ describe("parseInterfaceId", () => {
   test("returns canonical ID for valid interface", () => {
     expect(parseInterfaceId("web")).toBe("web");
     expect(parseInterfaceId("macos")).toBe("macos");
+    expect(parseInterfaceId("windows")).toBe("windows");
   });
 
   test("normalizes legacy 'vellum' alias to 'web'", () => {
@@ -103,6 +107,16 @@ describe("supportsHostProxy", () => {
     expect(supportsHostProxy("macos", "host_browser")).toBe(true);
   });
 
+  test("windows exposes its implemented host capabilities", () => {
+    expect(supportsHostProxy("windows")).toBe(true);
+    expect(supportsHostProxy("windows", "host_bash")).toBe(true);
+    expect(supportsHostProxy("windows", "host_file")).toBe(true);
+    expect(supportsHostProxy("windows", "host_cu")).toBe(true);
+    expect(supportsHostProxy("windows", "host_browser")).toBe(true);
+    expect(supportsHostProxy("windows", "host_ui_snapshot")).toBe(true);
+    expect(supportsHostProxy("windows", "host_app_control")).toBe(false);
+  });
+
   // ── chrome-extension: only host_browser. ──
   test("chrome-extension returns false (no capability)", () => {
     // Chrome extension does not support "any host proxy at all" — it only

package/src/channels/message-audience.ts

@@ -0,0 +1,40 @@
+/**
+ * Who a reply should be visible to, decided once for every producer.
+ */
+
+import type { MessageAudience } from "@vellumai/gateway-client";
+
+import { isSlackDmConversation } from "../messaging/providers/slack/message-metadata.js";
+
+/**
+ * The audience a reply addressed at `userId` should carry, or `undefined` when
+ * the whole room may see it.
+ *
+ * Restricting a message only means something where someone else could read it.
+ * A room with one reader gets no restriction: a Slack DM is already private,
+ * and marking it restricted there costs durability, because an ephemeral
+ * message does not survive a reload.
+ *
+ * Slack is the only channel that can show one reader a message in a room it
+ * shares with others. The test is for a DM rather than for a channel id, so
+ * every other room shape counts as shared: a private group holds several
+ * readers even though its id begins with `G` rather than `C`.
+ *
+ * `sourceChannel` and `chatId` are loosely typed because the only questions
+ * asked of them are whether the channel is Slack and whether the room is a
+ * DM, and several callers hold values that were never narrowed. An unknown
+ * channel answers with no restriction rather than throwing.
+ */
+export function audienceForReader(
+  sourceChannel: string | null | undefined,
+  chatId: string | null | undefined,
+  userId: string | null | undefined,
+): MessageAudience | undefined {
+  if (sourceChannel !== "slack" || !userId || !chatId) {
+    return undefined;
+  }
+  if (isSlackDmConversation(chatId)) {
+    return undefined;
+  }
+  return { kind: "oneReader", userId };
+}

package/src/channels/types.ts

@@ -166,6 +166,7 @@ export const CHANNEL_METADATA: Partial<Record<ChannelId, ChannelInfo>> = {
 
 export const INTERFACE_IDS = [
   "macos",
+  "windows",
   "ios",
   "cli",
   "telegram",
@@ -264,6 +265,7 @@ export function parseClientOs(value: unknown): ClientOs | null {
  */
 export const INTERACTIVE_INTERFACES: ReadonlySet<InterfaceId> = new Set([
   "macos",
+  "windows",
   "ios",
   "cli",
   "web",
@@ -274,9 +276,9 @@ export function isInteractiveInterface(id: InterfaceId): boolean {
 }
 
 /**
- * Host proxy capabilities that an interface can support. The macOS client
- * supports all of them; the chrome-extension interface only supports
- * host_browser (via the Chrome DevTools Protocol proxy).
+ * Host proxy capabilities that an interface can support. macOS supports all
+ * of them, Windows withholds app control, and chrome-extension supports only
+ * host_browser through the Chrome DevTools Protocol proxy.
  */
 export const HOST_PROXY_CAPABILITIES = [
   "host_bash",
@@ -290,29 +292,28 @@ export const HOST_PROXY_CAPABILITIES = [
 export type HostProxyCapability = (typeof HOST_PROXY_CAPABILITIES)[number];
 
 /**
- * Interfaces that support the full desktop host-proxy set (every
- * `HostProxyCapability` value). This is the capability-level identity used
- * by the discriminated transport metadata union and by the
+ * Interfaces that support desktop host-proxy tools. This identity is used by
+ * the discriminated transport metadata union and by the
  * `supportsHostProxy(id)` type predicate.
  *
  * Extend this literal type AND the `supportsHostProxy` implementation
- * below in lock-step when adding a new host-capable client (e.g. a native
- * Linux or Windows desktop).
+ * below in lock-step when adding a new host-capable client such as native
+ * Linux.
  */
-export type HostProxyInterfaceId = "macos";
+export type HostProxyInterfaceId = "macos" | "windows";
 
 /**
  * Whether the interface supports a host proxy capability.
  *
  * The no-arg form `supportsHostProxy(id)` asks "is this interface a desktop
- * host-proxy client?" — it returns `true` only for macOS and is the type
+ * host-proxy client?" It returns `true` for native desktop clients and is the
  * predicate that narrows `InterfaceId` to `HostProxyInterfaceId`. It returns
  * `false` for chrome-extension because chrome-extension only supports
  * `host_browser`, and the no-arg form is the gate that legacy desktop-only
  * call sites use (e.g. preactivating computer-use, restoring host proxies
- * in the drain queue). Callers that want to check a single capability —
+ * in the drain queue). Callers that want to check a single capability,
  * for example, to decide whether to keep `hostBrowserProxy` available for
- * chrome-extension — should pass the capability explicitly:
+ * chrome-extension, should pass the capability explicitly:
  * `supportsHostProxy(id, "host_browser")`.
  */
 export function supportsHostProxy(id: InterfaceId): id is HostProxyInterfaceId;
@@ -331,6 +332,9 @@ export function supportsHostProxy(
   if (id === "macos") {
     return true;
   }
+  if (id === "windows") {
+    return capability == null || capability !== "host_app_control";
+  }
   if (id === "chrome-extension" && capability === "host_browser") {
     return true;
   }