@vellumai/assistant 0.12.0-dev.202609122019.43571ed → 0.12.0-dev.202609122213.71fcf45

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/assistant",
-  "version": "0.12.0-dev.202609122019.43571ed",
+  "version": "0.12.0-dev.202609122213.71fcf45",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/__tests__/always-loaded-tools-guard.test.ts

@@ -26,7 +26,7 @@ afterAll(() => {
 });
 
 describe("always-loaded tool count", () => {
-  test("should be exactly 14 with recall occupying the existing slot", async () => {
+  test("should be exactly 19 with recall occupying the existing slot", async () => {
     await initializeTools();
     const allDefs = getAllToolDefinitions();
 
@@ -44,20 +44,24 @@ describe("always-loaded tool count", () => {
     );
     const activeNames = activeTools.map((t) => t.name).sort();
 
-    // Host tools (host_bash, host_file_*) are excluded when no client is
-    // connected — without a human in the loop, the guardian auto-approve
-    // path would allow unchecked host command execution.
-    //
     // `watch_retro_report` survives this baseline for the same reason the
     // ui_* tools do: a watch retrospective runs clientless, so it can only
     // report through a tool that survives this baseline. The ui_* tools are
     // here because background UI surfaces persist and return instead of
     // awaiting action, so they no longer need a connected client.
+    // Host tool definitions stay on the wire for background turns: schemas
+    // are cache-stable, and the shared execution gate rejects host tools on
+    // explicitly non-interactive turns before any proxy dispatch.
     const expectedNames = [
       "bash",
       "file_edit",
       "file_read",
       "file_write",
+      "host_bash",
+      "host_file_edit",
+      "host_file_read",
+      "host_file_transfer",
+      "host_file_write",
       "recall",
       "remember",
       "skill_execute",
@@ -72,6 +76,6 @@ describe("always-loaded tool count", () => {
 
     expect(activeNames).toEqual(expectedNames);
     expect(activeNames.filter((name) => name === "recall")).toHaveLength(1);
-    expect(activeTools.length).toBe(14);
+    expect(activeTools.length).toBe(19);
   });
 });

package/src/__tests__/conversation-tool-setup-attribution.test.ts

@@ -354,6 +354,57 @@ describe("createToolExecutor isInteractive threading", () => {
   });
 });
 
+describe("createToolExecutor unattended host-tool gate", () => {
+  test("rejects a direct host tool in a background turn before dispatch", async () => {
+    const { executor, calls } = makeCapturingExecutor();
+    const toolFn = makeToolFn(
+      executor,
+      makeCtx({ currentTurnIsNonInteractive: true, transportInterface: "web" }),
+    );
+
+    const result = await toolFn("host_bash", { command: "pwd" });
+
+    expect(result).toMatchObject({ isError: true });
+    expect(result.content).toContain("requires an interactive user turn");
+    expect(calls).toHaveLength(0);
+  });
+
+  test("rejects a skill-dispatched host tool in a background turn before dispatch", async () => {
+    const { executor, calls } = makeCapturingExecutor();
+    const toolFn = makeToolFn(
+      executor,
+      makeCtx({ currentTurnIsNonInteractive: true, transportInterface: "web" }),
+    );
+
+    const result = await toolFn("skill_execute", {
+      tool: "host_file_read",
+      input: { path: "/tmp/a" },
+      activity: "testing",
+    });
+
+    expect(result).toMatchObject({ isError: true });
+    expect(result.content).toContain("requires an interactive user turn");
+    expect(calls).toHaveLength(0);
+  });
+
+  test("dispatches a host tool during an interactive turn", async () => {
+    const { executor, calls } = makeCapturingExecutor();
+    const toolFn = makeToolFn(
+      executor,
+      makeCtx({
+        currentTurnIsNonInteractive: false,
+        transportInterface: "web",
+      }),
+    );
+
+    const result = await toolFn("host_bash", { command: "pwd" });
+
+    expect(result).toMatchObject({ content: "ok", isError: false });
+    expect(calls).toHaveLength(1);
+    expect(calls[0].name).toBe("host_bash");
+  });
+});
+
 describe("createToolExecutor channel-permission coordinate threading", () => {
   beforeEach(() => {
     mockBindingExternalChatId = null;

package/src/__tests__/host-bash-proxy.test.ts

@@ -669,23 +669,31 @@ describe("HostBashProxy", () => {
       expect(sentMessages).toHaveLength(0);
     });
 
-    test("rejects ambiguously when multiple same-user capable clients are connected and no targetClientId", async () => {
-      // Regression: previously fell through to untargeted broadcast, fanning
-      // a single targeted-style request out across every same-user machine.
+    test("selects the most recently active same-user client when several are connected", async () => {
       setup();
       setupMultipleClients(["client-1", "client-2", "client-3"]);
 
-      const result = await proxy.request(
+      const resultPromise = proxy.request(
         { command: "echo hello" },
         "session-1",
         undefined,
         "user-A",
       );
 
-      expect(result.isError).toBe(true);
-      expect(result.content).toContain("target_client_id");
-      // No broadcast happened
-      expect(sentMessages).toHaveLength(0);
+      const sent = sentMessages[0] as Record<string, unknown>;
+      expect(sent.targetClientId).toBe("client-1");
+      const options = sentMessageOptions[0] as
+        | Record<string, unknown>
+        | undefined;
+      expect(options?.targetClientId).toBe("client-1");
+
+      proxy.resolveResult(sent.requestId as string, {
+        stdout: "hello\n",
+        stderr: "",
+        exitCode: 0,
+        timedOut: false,
+      });
+      expect((await resultPromise).isError).toBe(false);
     });
 
     test("falls through to broadcast when zero capable clients (existing timeout path)", async () => {
@@ -832,30 +840,19 @@ describe("HostBashProxy", () => {
       expect(sentMessages).toHaveLength(0);
     });
 
-    test("untargeted local flow unchanged when no auto-resolve match", async () => {
+    test("rejects when the actor has no capable client", async () => {
       setup();
-      // No capable clients connected — untargeted path runs.
 
-      const resultPromise = proxy.request(
+      const result = await proxy.request(
         { command: "echo hello" },
         "session-1",
         undefined,
         "user-A",
       );
 
-      expect(sentMessages).toHaveLength(1);
-      const sent = sentMessages[0] as Record<string, unknown>;
-      expect(sent.type).toBe("host_bash_request");
-      expect(sent.targetClientId).toBeUndefined();
-
-      const requestId = sent.requestId as string;
-      proxy.resolveResult(requestId, {
-        stdout: "hello\n",
-        stderr: "",
-        exitCode: 0,
-        timedOut: false,
-      });
-      await resultPromise;
+      expect(result).toMatchObject({ isError: true });
+      expect(result.content).toContain("belongs to this user");
+      expect(sentMessages).toHaveLength(0);
     });
 
     test("auto-resolve to same-user client succeeds", async () => {
@@ -883,36 +880,20 @@ describe("HostBashProxy", () => {
       await resultPromise;
     });
 
-    test("auto-resolve to different-user client falls through to untargeted", async () => {
+    test("rejects when only a different user has a capable client", async () => {
       setup();
-      // Single capable client owned by user-B; caller is user-A.
       setupSingleClient("client-abc", "user-B");
 
-      const resultPromise = proxy.request(
+      const result = await proxy.request(
         { command: "echo hello" },
         "session-1",
         undefined,
         "user-A",
       );
 
-      // Auto-resolve must NOT pick the cross-user client; the untargeted
-      // broadcast path runs instead.
-      expect(sentMessages).toHaveLength(1);
-      const sent = sentMessages[0] as Record<string, unknown>;
-      expect(sent.type).toBe("host_bash_request");
-      expect(sent.targetClientId).toBeUndefined();
-
-      const opts = sentMessageOptions[0] as Record<string, unknown> | undefined;
-      expect(opts?.targetClientId).toBeUndefined();
-
-      const requestId = sent.requestId as string;
-      proxy.resolveResult(requestId, {
-        stdout: "hello\n",
-        stderr: "",
-        exitCode: 0,
-        timedOut: false,
-      });
-      await resultPromise;
+      expect(result).toMatchObject({ isError: true });
+      expect(result.content).toContain("belongs to this user");
+      expect(sentMessages).toHaveLength(0);
     });
   });
 });

package/src/__tests__/host-browser-proxy.test.ts

@@ -608,22 +608,17 @@ describe("HostBrowserProxy", () => {
         },
       ];
 
-      const resultPromise = proxy.request(
+      const result = await proxy.request(
         { cdpMethod: "Page.navigate", cdpParams: { url: "https://a.test" } },
         "session-1",
         undefined,
         "user-1",
       );
 
-      // Auto-resolution filters out the cross-user candidate, so the
-      // proxy falls into the existing "no active extension connection"
-      // rejection — we never broadcast to a different actor's client.
-      await expect(resultPromise).rejects.toThrow(
-        "no active extension connection",
-      );
+      expect(result).toMatchObject({ isError: true });
+      expect(result.content).toContain("belongs to this user");
       expect(getPublishedMessages()).toHaveLength(0);
     });
-
     test("prefers the chrome-extension client over a more-recently-active macOS bridge", async () => {
       // Mock `listClientsByCapability` returns mockClients in array
       // order, which mirrors production's `lastActiveAt`-desc ordering.
@@ -720,11 +715,6 @@ describe("HostBrowserProxy", () => {
     });
 
     test("rejects when caller has actor but no host_browser-capable client is connected for that actor", async () => {
-      // Same-user filter returns empty even though listClientsByCapability
-      // would return a non-empty list (because that list is for a
-      // different actor). The unfiltered fallback path runs only when
-      // the caller has no actor — we don't silently broadcast to anyone
-      // when the caller IS authenticated to a specific actor.
       mockClients = [
         {
           clientId: "other-user-ext",
@@ -734,16 +724,15 @@ describe("HostBrowserProxy", () => {
         },
       ];
 
-      const resultPromise = proxy.request(
+      const result = await proxy.request(
         { cdpMethod: "Page.navigate", cdpParams: { url: "https://a.test" } },
         "session-1",
         undefined,
         "user-1",
       );
 
-      await expect(resultPromise).rejects.toThrow(
-        "no active extension connection",
-      );
+      expect(result).toMatchObject({ isError: true });
+      expect(result.content).toContain("belongs to this user");
       expect(getPublishedMessages()).toHaveLength(0);
     });
   });

package/src/__tests__/host-file-proxy-targeted.test.ts

@@ -274,6 +274,29 @@ describe("HostFileProxy — targetClientId (Phase 2)", () => {
     });
   });
 
+  test("selects the most recently active same-user client when several are connected", async () => {
+    setup();
+    setupMultipleClients(["client-1", "client-2"]);
+
+    const resultPromise = proxy.request(
+      { operation: "read", path: "/tmp/file.txt" },
+      "session-1",
+      undefined,
+      undefined,
+      TEST_PRINCIPAL,
+    );
+
+    const sent = sentMessages[0] as Record<string, unknown>;
+    expect(sent.targetClientId).toBe("client-1");
+    const options = sentMessageOptions[0] as
+      | Record<string, unknown>
+      | undefined;
+    expect(options?.targetClientId).toBe("client-1");
+
+    proxy.resolve(sent.requestId as string, { content: "ok", isError: false });
+    expect((await resultPromise).isError).toBe(false);
+  });
+
   // ── targetClientId in cancel (abort signal) ──────────────────────────
 
   describe("targetClientId in cancel — abort signal", () => {

package/src/__tests__/host-file-proxy.test.ts

@@ -746,9 +746,8 @@ describe("HostFileProxy", () => {
       expect(sentMessages).toHaveLength(0);
     });
 
-    test("untargeted request with no auto-resolve match still broadcasts (legacy path unchanged)", async () => {
+    test("rejects when the actor has no capable client", async () => {
       setup();
-      // No matching same-user clients available.
       mockClients = [
         {
           clientId: "client-A",
@@ -757,23 +756,18 @@ describe("HostFileProxy", () => {
         },
       ];
 
-      const resultPromise = proxy.request(
+      const result = await proxy.request(
         { operation: "read", path: "/tmp/test.txt" },
         "session-1",
         undefined,
         undefined,
-        "user-B", // No same-user match → no auto-resolve, broadcast untargeted.
+        "user-B",
       );
 
-      expect(sentMessages).toHaveLength(1);
-      const sent = sentMessages[0] as Record<string, unknown>;
-      expect(sent.targetClientId).toBeUndefined();
-      const requestId = sent.requestId as string;
-
-      proxy.resolve(requestId, { content: "ok", isError: false });
-      await resultPromise;
+      expect(result).toMatchObject({ isError: true });
+      expect(result.content).toContain("belongs to this user");
+      expect(sentMessages).toHaveLength(0);
     });
-
     test("auto-resolve picks the same-user client when there's exactly one", async () => {
       setup();
       mockClients = [
@@ -807,7 +801,7 @@ describe("HostFileProxy", () => {
       await resultPromise;
     });
 
-    test("auto-resolve falls through when no client matches the source user", async () => {
+    test("rejects when only a different user has a capable client", async () => {
       setup();
       mockClients = [
         {
@@ -817,7 +811,7 @@ describe("HostFileProxy", () => {
         },
       ];
 
-      const resultPromise = proxy.request(
+      const result = await proxy.request(
         { operation: "read", path: "/tmp/test.txt" },
         "session-1",
         undefined,
@@ -825,16 +819,10 @@ describe("HostFileProxy", () => {
         "user-C",
       );
 
-      // No same-user client → no auto-resolve, broadcast untargeted.
-      expect(sentMessages).toHaveLength(1);
-      const sent = sentMessages[0] as Record<string, unknown>;
-      expect(sent.targetClientId).toBeUndefined();
-      const requestId = sent.requestId as string;
-
-      proxy.resolve(requestId, { content: "ok", isError: false });
-      await resultPromise;
+      expect(result).toMatchObject({ isError: true });
+      expect(result.content).toContain("belongs to this user");
+      expect(sentMessages).toHaveLength(0);
     });
-
     test("legacy embedded targetClientId in input still goes through the same-user gate", async () => {
       setup();
       mockClients = [

package/src/__tests__/host-transfer-proxy-targeted.test.ts

@@ -812,7 +812,7 @@ describe("HostTransferProxy — targetClientId", () => {
       await resultPromise;
     });
 
-    test("requestToHost: auto-resolve falls through when no client matches the source user", async () => {
+    test("requestToHost: rejects when no client matches the source user", async () => {
       setup();
       mockClientRegistry.set("client-A", {
         clientId: "client-A",
@@ -824,7 +824,7 @@ describe("HostTransferProxy — targetClientId", () => {
       const srcPath = `/tmp/htp-auto-no-match-${Date.now()}.txt`;
       await globalThis.Bun.write(srcPath, "data");
 
-      const resultPromise = proxy.requestToHost(
+      const result = await proxy.requestToHost(
         {
           sourcePath: srcPath,
           destPath: "/host/dest.txt",
@@ -835,13 +835,9 @@ describe("HostTransferProxy — targetClientId", () => {
         "user-C",
       );
 
-      await waitForMessages(sentMessages, 1);
-      const sent = sentMessages[0] as Record<string, unknown>;
-      expect(sent.targetClientId).toBeUndefined();
-
-      const requestId = sent.requestId as string;
-      proxy.resolveTransferResult(requestId, { isError: false });
-      await resultPromise;
+      expect(result).toMatchObject({ isError: true });
+      expect(result.content).toContain("belongs to this user");
+      expect(sentMessages).toHaveLength(0);
     });
 
     test("requestToSandbox: targeted request from a different user is rejected", async () => {
@@ -897,6 +893,31 @@ describe("HostTransferProxy — targetClientId", () => {
       await resultPromise;
     });
 
+    test("requestToSandbox: rejects when no client matches the source user", async () => {
+      setup();
+      const a: MockClient = {
+        clientId: "client-A",
+        capabilities: ["host_file"],
+        actorPrincipalId: "user-A",
+      };
+      mockCapableClients = [a];
+      mockClientRegistry.set("client-A", a);
+
+      const result = await proxy.requestToSandbox(
+        {
+          sourcePath: "/host/source.txt",
+          destPath: "/sandbox/dest.txt",
+          conversationId: "conv-same-9-no-match",
+        },
+        undefined,
+        "user-C",
+      );
+
+      expect(result).toMatchObject({ isError: true });
+      expect(result.content).toContain("belongs to this user");
+      expect(sentMessages).toHaveLength(0);
+    });
+
     test("requestToSandbox: auto-resolve picks the same-user client when there's exactly one", async () => {
       setup();
       const a: MockClient = {

package/src/__tests__/subagent-tool-gate-mode.test.ts

@@ -249,17 +249,21 @@ describe("createResolveToolsCallback — toolContextPin", () => {
     });
   }
 
-  test("control: without a pin, a clientless fork drops every client-gated tool but ui_show", () => {
+  test("control: without a pin, a clientless fork drops client-gated tools but keeps host and UI tools", () => {
     projectedSkillToolNames = [];
     const resolve = createResolveToolsCallback(
       CLIENT_GATED_DEFS,
       clientlessExecutionCtx(),
     )!;
 
-    // ui_show stays on the wire: background UI surfaces persist and return
-    // instead of awaiting action, so they no longer need a connected client.
+    // Host tool definitions stay on the wire for background turns, and
+    // ui_show stays because background UI surfaces persist and return. The
+    // executor rejects host tools on explicitly non-interactive turns before
+    // dispatch; ask_question and request_system_permission remain
+    // client-gated at resolution.
     expect(resolve(EMPTY_HISTORY).map((t) => t.name)).toEqual([
       "remember",
+      "host_bash",
       "ui_show",
     ]);
   });
@@ -296,9 +300,12 @@ describe("createResolveToolsCallback — toolContextPin", () => {
       }),
     )!;
 
-    // ui_show survives the clientless pin: it persists and returns.
+    // Host tool definitions stay on the wire for background turns, and
+    // ui_show survives the clientless pin: it persists and returns. The
+    // executor rejects host tools on explicitly non-interactive turns.
     expect(resolve(EMPTY_HISTORY).map((t) => t.name)).toEqual([
       "remember",
+      "host_bash",
       "ui_show",
     ]);
   });

package/src/daemon/__tests__/conversation-tool-setup.test.ts

@@ -1,30 +1,7 @@
 /**
- * Tests for `isToolActiveForContext` host-tool capability gating.
- *
- * Scenarios verified:
- * - chrome-extension is its own executor and is exempt from the hasNoClient
- *   gate (the extension's own popup UI gates commands; there is no SSE
- *   interactive approval channel, and chrome-extension turns intentionally
- *   run with `hasNoClient: true` because chrome-extension is not in
- *   `INTERACTIVE_INTERFACES`).
- * - macos requires a connected SSE client for host tools that flow through
- *   the proxy (e.g. host_bash, host_file_*, host_browser), so
- *   `hasNoClient: true` denies those on macos.
- * - host_browser IS in the macos capability set — the proxy routes
- *   host_browser_request frames to the desktop client via SSE (or via the
- *   Chrome extension registry when an extension connection is present).
- *
- * The per-capability check (`supportsHostProxy(transport, capability)`) runs
- * first and is authoritative for structural support, so host_bash and
- * host_file_* are filtered out for chrome-extension regardless of the
- * hasNoClient flag.
- *
- * Cross-client exception: tools whose capabilities are in
- * CROSS_CLIENT_EXPOSED_CAPABILITIES (host_bash, host_file, host_browser)
- * are allowed for non-host-proxy interactive interfaces ("web", "ios")
- * when at least one capable client is connected via the event hub.
- * chrome-extension is excluded as a security boundary, regardless of
- * whether the capability is technically supported elsewhere.
+ * Tests for host-tool schema visibility. Host tool definitions stay stable
+ * across interactive and background turns. Chrome extension remains limited
+ * to host_browser because it is the only host capability it implements.
  */
 
 import { beforeEach, describe, expect, mock, test } from "bun:test";
@@ -311,7 +288,6 @@ describe("isToolActiveForContext - Slack task_progress UI exception", () => {
 });
 
 describe("isToolActiveForContext — host tool capability gating", () => {
-  // macOS transport: SSE-based interactive approval required.
   test("host_bash is active for macOS with a connected client", () => {
     expect(
       isToolActiveForContext(
@@ -321,27 +297,22 @@ describe("isToolActiveForContext — host tool capability gating", () => {
     ).toBe(true);
   });
 
-  test("host_bash is NOT active for macOS when hasNoClient is true (security invariant)", () => {
-    // macOS uses an SSE-based interactive approval channel. Without a
-    // connected client the guardian auto-approve path could execute host
-    // commands unattended, so host tools must be denied.
+  test("host_bash remains active for a background macOS turn", () => {
     expect(
       isToolActiveForContext(
         "host_bash",
         makeCtx({ hasNoClient: true, transportInterface: "macos" }),
       ),
-    ).toBe(false);
+    ).toBe(true);
   });
-
-  test("host_file_read is NOT active for macOS when hasNoClient is true", () => {
+  test("host_file_read remains active for a background macOS turn", () => {
     expect(
       isToolActiveForContext(
         "host_file_read",
         makeCtx({ hasNoClient: true, transportInterface: "macos" }),
       ),
-    ).toBe(false);
+    ).toBe(true);
   });
-
   test("host_browser is active for macOS with a connected client", () => {
     // macOS supports host_browser — the proxy routes host_browser_request
     // frames to the desktop client via SSE (or via the Chrome extension
@@ -354,19 +325,14 @@ describe("isToolActiveForContext — host tool capability gating", () => {
     ).toBe(true);
   });
 
-  test("host_browser is NOT active for macOS when hasNoClient is true", () => {
-    // macOS supports host_browser structurally, but without a connected
-    // client the host_browser_request frames have no consumer, so the tool
-    // is denied.
+  test("host_browser remains active for a background macOS turn", () => {
     expect(
       isToolActiveForContext(
         "host_browser",
         makeCtx({ hasNoClient: true, transportInterface: "macos" }),
       ),
-    ).toBe(false);
+    ).toBe(true);
   });
-
-  // chrome-extension transport: the extension is its own executor.
   test("host_browser is active for chrome-extension even when hasNoClient is true", () => {
     // chrome-extension turns run with `hasNoClient: true` by design because
     // chrome-extension is not in `INTERACTIVE_INTERFACES` — it is not an
@@ -422,10 +388,7 @@ describe("isToolActiveForContext — host tool capability gating", () => {
     ).toBe(false);
   });
 
-  // Backwards-compat fallback: no transport plumbed through.
-  test("host_bash falls back to hasNoClient gate when transport is undefined (client connected)", () => {
-    // Without a transport interface we cannot run the per-capability check,
-    // so we fall back to the coarse-grained `hasNoClient` behavior.
+  test("host_bash remains active without transport metadata for a connected turn", () => {
     expect(
       isToolActiveForContext(
         "host_bash",
@@ -434,20 +397,18 @@ describe("isToolActiveForContext — host tool capability gating", () => {
     ).toBe(true);
   });
 
-  test("host_bash falls back to hasNoClient gate when transport is undefined (no client)", () => {
+  test("host_bash remains active without transport metadata for a background turn", () => {
     expect(
       isToolActiveForContext(
         "host_bash",
         makeCtx({ hasNoClient: true, transportInterface: undefined }),
       ),
-    ).toBe(false);
+    ).toBe(true);
   });
 });
 
 describe("isToolActiveForContext — cross-client exception (Phase 1: host_bash)", () => {
   test("host_bash is active for web transport when a host_bash-capable client is connected", () => {
-    // Cross-client path: a web turn should see host_bash when a macOS client
-    // with host_bash capability is connected via the event hub.
     mockClientCountByCapability.set("host_bash", 1);
     expect(
       isToolActiveForContext(
@@ -457,30 +418,24 @@ describe("isToolActiveForContext — cross-client exception (Phase 1: host_bash)
     ).toBe(true);
   });
 
-  test("host_bash is NOT active for web transport when no capable client is connected", () => {
-    // No cross-client fallback: hub has no host_bash-capable subscribers.
+  test("host_bash remains active for web when no capable client is connected", () => {
     mockClientCountByCapability.set("host_bash", 0);
     expect(
       isToolActiveForContext(
         "host_bash",
         makeCtx({ hasNoClient: false, transportInterface: "web" }),
       ),
-    ).toBe(false);
+    ).toBe(true);
   });
-
-  test("host_file_read is NOT active for web transport when only a host_bash client is connected", () => {
-    // The cross-client exception is per-capability: a host_bash-capable
-    // client in the hub does not satisfy host_file's exposure check, since
-    // listClientsByCapability is queried with the tool's actual capability.
+  test("host_file_read remains active for web without host_file clients", () => {
     mockClientCountByCapability.set("host_bash", 1);
     expect(
       isToolActiveForContext(
         "host_file_read",
         makeCtx({ hasNoClient: false, transportInterface: "web" }),
       ),
-    ).toBe(false);
+    ).toBe(true);
   });
-
   test("host_bash for macos transport is unaffected by the cross-client exception", () => {
     // macos natively supports host_bash via host proxy — the supportsHostProxy
     // check passes, so the cross-client branch is never reached.
@@ -493,19 +448,15 @@ describe("isToolActiveForContext — cross-client exception (Phase 1: host_bash)
     ).toBe(true);
   });
 
-  test("host_bash for macos with no client is still denied (security invariant unaffected)", () => {
-    // Even with a capable client in the hub, the macos SSE path takes
-    // precedence — it passes the supportsHostProxy check, bypasses the
-    // cross-client branch, and reaches the hasNoClient gate.
+  test("host_bash remains active for a background macOS turn", () => {
     mockClientCountByCapability.set("host_bash", 1);
     expect(
       isToolActiveForContext(
         "host_bash",
         makeCtx({ hasNoClient: true, transportInterface: "macos" }),
       ),
-    ).toBe(false);
+    ).toBe(true);
   });
-
   test("host_bash is NOT active for chrome-extension even when a capable client is connected", () => {
     // Security boundary: chrome-extension only gets host_browser. The
     // cross-client exception explicitly excludes chrome-extension transport
@@ -519,16 +470,14 @@ describe("isToolActiveForContext — cross-client exception (Phase 1: host_bash)
     ).toBe(false);
   });
 
-  test("host_bash is NOT active for web transport when hasNoClient is true (no approval UI)", () => {
-    // hasNoClient gate: no interactive approval UI available for this turn.
-    // Cross-client exception must not bypass this gate.
+  test("host_bash remains active for a background web turn", () => {
     mockClientCountByCapability.set("host_bash", 1);
     expect(
       isToolActiveForContext(
         "host_bash",
         makeCtx({ hasNoClient: true, transportInterface: "web" }),
       ),
-    ).toBe(false);
+    ).toBe(true);
   });
 });
 
@@ -551,14 +500,14 @@ describe("isToolActiveForContext — cross-client exposure for host_file_*", ()
       ).toBe(true);
     });
 
-    test(`${tool} is NOT exposed for web when no host_file client is connected`, () => {
+    test(`${tool} remains active for web when no host_file client is connected`, () => {
       mockClientCountByCapability.set("host_file", 0);
       expect(
         isToolActiveForContext(
           tool,
           makeCtx({ hasNoClient: false, transportInterface: "web" }),
         ),
-      ).toBe(false);
+      ).toBe(true);
     });
 
     test(`${tool} is NOT exposed for chrome-extension (security boundary)`, () => {
@@ -574,20 +523,19 @@ describe("isToolActiveForContext — cross-client exposure for host_file_*", ()
       ).toBe(false);
     });
 
-    test(`${tool} is NOT exposed when hasNoClient is true (no approval UI)`, () => {
+    test(`${tool} remains active for a background web turn`, () => {
       mockClientCountByCapability.set("host_file", 1);
       expect(
         isToolActiveForContext(
           tool,
           makeCtx({ hasNoClient: true, transportInterface: "web" }),
         ),
-      ).toBe(false);
+      ).toBe(true);
     });
   }
 
-  test("listClientsByCapability is queried with the actual capability, not host_bash (regression guard for D5 latent bug)", () => {
-    mockClientCountByCapability.set("host_bash", 0);
-    mockClientCountByCapability.set("host_file", 1);
+  test("host_file_transfer does not depend on the live host_file roster", () => {
+    mockClientCountByCapability.set("host_file", 0);
     expect(
       isToolActiveForContext(
         "host_file_transfer",
@@ -626,37 +574,33 @@ describe("isToolActiveForContext — cross-client exposure for host_browser", ()
     ).toBe(true);
   });
 
-  test("host_browser is NOT exposed for web when no host_browser client is connected", () => {
+  test("host_browser remains active for web when no host_browser client is connected", () => {
     mockClientCountByCapability.set("host_browser", 0);
     expect(
       isToolActiveForContext(
         "host_browser",
         makeCtx({ hasNoClient: false, transportInterface: "web" }),
       ),
-    ).toBe(false);
+    ).toBe(true);
   });
-
-  test("host_browser is NOT exposed for ios when no host_browser client is connected", () => {
+  test("host_browser remains active for ios when no host_browser client is connected", () => {
     mockClientCountByCapability.set("host_browser", 0);
     expect(
       isToolActiveForContext(
         "host_browser",
         makeCtx({ hasNoClient: false, transportInterface: "ios" }),
       ),
-    ).toBe(false);
+    ).toBe(true);
   });
-
-  test("host_browser is NOT exposed when hasNoClient is true (no approval UI)", () => {
-    // hasNoClient gate: cross-client exception must not bypass this.
+  test("host_browser remains active for a background web turn", () => {
     mockClientCountByCapability.set("host_browser", 1);
     expect(
       isToolActiveForContext(
         "host_browser",
         makeCtx({ hasNoClient: true, transportInterface: "web" }),
       ),
-    ).toBe(false);
+    ).toBe(true);
   });
-
   test("host_browser for macos transport is unaffected by the cross-client exception", () => {
     // macos natively supports host_browser via host proxy — the
     // supportsHostProxy check passes, so the cross-client branch is never
@@ -685,10 +629,7 @@ describe("isToolActiveForContext — cross-client exposure for host_browser", ()
     ).toBe(true);
   });
 
-  test("listClientsByCapability is queried with host_browser, not host_bash or host_file (per-capability invariant)", () => {
-    // Defense against any future regression that hardcodes a different
-    // capability in the cross-client check. Only host_browser-capable
-    // clients should satisfy host_browser exposure.
+  test("host_browser does not depend on the live host_browser roster", () => {
     mockClientCountByCapability.set("host_bash", 1);
     mockClientCountByCapability.set("host_file", 1);
     mockClientCountByCapability.set("host_browser", 0);
@@ -697,7 +638,7 @@ describe("isToolActiveForContext — cross-client exposure for host_browser", ()
         "host_browser",
         makeCtx({ hasNoClient: false, transportInterface: "web" }),
       ),
-    ).toBe(false);
+    ).toBe(true);
   });
 });
 

package/src/daemon/conversation-tool-setup.ts

@@ -28,7 +28,6 @@ import { getAllDefaultPluginNames } from "../plugins/defaults/main.js";
 import { isActivationSession } from "../plugins/defaults/memory/activation-session-store.js";
 import { isPluginDisabled } from "../plugins/disabled-state.js";
 import type { Message, ToolDefinition } from "../providers/types.js";
-import { assistantEventHub } from "../runtime/assistant-event-hub.js";
 import { registerConversationSender } from "../tools/browser/browser-screencast.js";
 import { supportsClientOsForSkillTool } from "../tools/client-os.js";
 import type { ToolExecutor } from "../tools/executor.js";
@@ -260,6 +259,24 @@ export function createToolExecutor(
   // see {@link SubagentToolGateMode}): rejects non-allowlisted calls BEFORE
   // any executor dispatch, so a non-allowlisted tool's executor never runs.
   // The error tool_result lets the model continue or finish.
+  const rejectUnattendedHostTool = (
+    toolName: string,
+  ): ToolExecutionResult | null => {
+    const { transportInterface } = resolveTurnClientOs(ctx);
+    const isUnattended = ctx.currentTurnIsNonInteractive ?? ctx.hasNoClient;
+    if (
+      HOST_TOOL_NAMES.has(toolName) &&
+      isUnattended &&
+      transportInterface !== "chrome-extension"
+    ) {
+      return {
+        content: `The "${toolName}" tool requires an interactive user turn and cannot run in the background.`,
+        isError: true,
+      };
+    }
+    return null;
+  };
+
   const rejectNonAllowlistedTool = (
     toolName: string,
   ): ToolExecutionResult | null => {
@@ -387,6 +404,10 @@ export function createToolExecutor(
       if (rejection) {
         return rejection;
       }
+      const unattendedRejection = rejectUnattendedHostTool(executionName);
+      if (unattendedRejection) {
+        return unattendedRejection;
+      }
     }
 
     if (isDoordashCommand(executionName, executionInput)) {
@@ -550,6 +571,10 @@ export function createToolExecutor(
       if (innerRejection) {
         return innerRejection;
       }
+      const unattendedRejection = rejectUnattendedHostTool(toolName);
+      if (unattendedRejection) {
+        return unattendedRejection;
+      }
 
       // Per-chat plugin scope: reject the resolved inner tool when it belongs
       // to a plugin outside the conversation's effective set.
@@ -864,44 +889,17 @@ export function isToolActiveForContext(
     const capability = HOST_TOOL_TO_CAPABILITY.get(name);
     const transport = transportInterface;
 
-    // Per-capability check is authoritative for structural support: if the
-    // transport cannot service this capability, the tool is filtered out.
+    // A transport that does not implement a capability can invoke it through
+    // an eligible same-user client. Client selection happens when the call
+    // runs, so the wire schema stays stable across live and background turns.
     if (transport && capability && !supportsHostProxy(transport, capability)) {
-      // Cross-client exception: allow host tools whose capabilities have
-      // cross-client routing infrastructure (Phases 1–3 plus host_browser
-      // via PR #27489) to be exposed for non-host-proxy transports (e.g.
-      // "web", "ios") when at least one capable client is connected via
-      // the event hub. Members of CROSS_CLIENT_EXPOSED_CAPABILITIES
-      // (host_bash, host_file, host_browser) qualify.
-      // chrome-extension transport is excluded as a security boundary
-      // (extension only gets host_browser via its own executor path);
-      // hasNoClient turns are excluded (no interactive approval UI
-      // available).
-      if (
-        capability &&
+      return (
         CROSS_CLIENT_EXPOSED_CAPABILITIES.has(capability) &&
-        transport !== "chrome-extension" &&
-        !hasNoClient &&
-        assistantEventHub.listClientsByCapability(capability).length > 0
-      ) {
-        return true;
-      }
-      return false;
-    }
-
-    // chrome-extension is its own executor — the extension's popup gates
-    // commands via its own UI, and the transport does not use an SSE-level
-    // interactive approval channel. hasNoClient is intentionally `true` for
-    // chrome-extension turns (chrome-extension is not in INTERACTIVE_INTERFACES)
-    // and must not gate host_browser. Trust the per-capability check.
-    if (transport === "chrome-extension") {
-      return true;
+        transport !== "chrome-extension"
+      );
     }
 
-    // For transports that surface approvals over SSE (macos, backwards-compat
-    // fallback), deny when no client is present so the guardian auto-approve
-    // path cannot execute host commands unattended.
-    return !hasNoClient;
+    return true;
   }
   if (CLIENT_CAPABILITY_TOOL_NAMES.has(name)) {
     if (name === "ask_question" && channelCapabilities?.clientOS === "macos") {

package/src/daemon/host-bash-proxy.ts

@@ -1,9 +1,9 @@
 import { getConfig } from "../config/loader.js";
 import { assistantEventHub } from "../runtime/assistant-event-hub.js";
 import {
-  ambiguousSameUserError,
   enforceSameActorOrErrorResult,
-  pickSameUserAutoResolve,
+  pickMostRecentSameUserClient,
+  unavailableSameUserClientError,
 } from "../runtime/auth/same-actor.js";
 import * as pendingInteractions from "../runtime/pending-interactions.js";
 import { formatShellOutput } from "../tools/shared/shell-output.js";
@@ -93,21 +93,17 @@ export class HostBashProxy extends HostProxyBase<
       }
       resolvedTargetClientId = input.targetClientId;
     } else {
-      // Auto-resolve to the unique same-user client. Reject (rather than
-      // broadcast) when multiple same-user clients are connected so that
-      // a single targeted-style request cannot fan out across every one
-      // of the user's machines. Zero same-user matches falls through to
-      // the existing untargeted code path.
-      const resolved = pickSameUserAutoResolve({
+      resolvedTargetClientId = pickMostRecentSameUserClient({
         hub: assistantEventHub,
         capability: "host_bash",
         sourceActorPrincipalId,
       });
-      if (resolved.kind === "ambiguous") {
-        return ambiguousSameUserError("host_bash");
+      if (
+        resolvedTargetClientId === undefined &&
+        sourceActorPrincipalId !== undefined
+      ) {
+        return unavailableSameUserClientError("host_bash");
       }
-      resolvedTargetClientId =
-        resolved.kind === "match" ? resolved.clientId : undefined;
     }
 
     // Targeted requests must be bound to the same authenticated user as the

package/src/daemon/host-browser-proxy.ts

@@ -5,7 +5,10 @@ import {
   assistantEventHub,
   broadcastMessage,
 } from "../runtime/assistant-event-hub.js";
-import { enforceSameActorOrErrorResult } from "../runtime/auth/same-actor.js";
+import {
+  enforceSameActorOrErrorResult,
+  unavailableSameUserClientError,
+} from "../runtime/auth/same-actor.js";
 import * as pendingInteractions from "../runtime/pending-interactions.js";
 import type { ToolExecutionResult } from "../tools/types.js";
 import { AssistantError, ErrorCode } from "../util/errors.js";
@@ -284,6 +287,17 @@ export class HostBrowserProxy {
       targetClientId,
     );
 
+    if (
+      preferredClient === undefined &&
+      sourceActorPrincipalId !== undefined &&
+      targetClientId === undefined
+    ) {
+      if (isExtensionOnlyMethod(input.cdpMethod)) {
+        return Promise.resolve(extensionRequiredResult(input.cdpMethod));
+      }
+      return Promise.resolve(unavailableSameUserClientError("host_browser"));
+    }
+
     // Same-user enforcement: when the caller's actor is known, refuse to
     // dispatch to a client owned by a different actor. This covers the
     // cross-client exposure case where a web/iOS turn for actor A would

package/src/daemon/host-file-proxy.ts

@@ -6,10 +6,10 @@ import {
   broadcastMessage,
 } from "../runtime/assistant-event-hub.js";
 import {
-  ambiguousSameUserError,
   enforceSameActorOrErrorResult,
-  pickSameUserAutoResolve,
+  pickMostRecentSameUserClient,
   snapshotHostProxyActorPrincipalId,
+  unavailableSameUserClientError,
 } from "../runtime/auth/same-actor.js";
 import * as pendingInteractions from "../runtime/pending-interactions.js";
 import { readAudioBase64 } from "../tools/shared/filesystem/audio-read.js";
@@ -102,19 +102,17 @@ export class HostFileProxy {
         });
       }
     } else {
-      // Auto-resolve to the unique same-user client. Reject ambiguous
-      // (multi-machine) cases so a single targeted-style request cannot
-      // fan out across the user's machines.
-      const resolved = pickSameUserAutoResolve({
+      resolvedTargetClientId = pickMostRecentSameUserClient({
         hub: assistantEventHub,
         capability: "host_file",
         sourceActorPrincipalId,
       });
-      if (resolved.kind === "ambiguous") {
-        return Promise.resolve(ambiguousSameUserError("host_file"));
+      if (
+        resolvedTargetClientId === undefined &&
+        sourceActorPrincipalId !== undefined
+      ) {
+        return Promise.resolve(unavailableSameUserClientError("host_file"));
       }
-      resolvedTargetClientId =
-        resolved.kind === "match" ? resolved.clientId : undefined;
     }
 
     // Same-user check: targeted host_file requests must be bound to the same

package/src/daemon/host-transfer-proxy.ts

@@ -10,10 +10,10 @@ import {
   broadcastMessage,
 } from "../runtime/assistant-event-hub.js";
 import {
-  ambiguousSameUserError,
   enforceSameActorOrErrorResult,
-  pickSameUserAutoResolve,
+  pickMostRecentSameUserClient,
   snapshotHostProxyActorPrincipalId,
+  unavailableSameUserClientError,
 } from "../runtime/auth/same-actor.js";
 import * as pendingInteractions from "../runtime/pending-interactions.js";
 import type { ToolExecutionResult } from "../tools/types.js";
@@ -162,19 +162,17 @@ export class HostTransferProxy {
         });
       }
     } else {
-      // Auto-resolve to the unique same-user client; reject ambiguous
-      // (multi-machine) cases so a single targeted-style transfer cannot
-      // fan out across the user's machines.
-      const resolved = pickSameUserAutoResolve({
+      resolvedTargetClientId = pickMostRecentSameUserClient({
         hub: assistantEventHub,
         capability: "host_file",
         sourceActorPrincipalId,
       });
-      if (resolved.kind === "ambiguous") {
-        return Promise.resolve(ambiguousSameUserError("host_file"));
+      if (
+        resolvedTargetClientId === undefined &&
+        sourceActorPrincipalId !== undefined
+      ) {
+        return Promise.resolve(unavailableSameUserClientError("host_file"));
       }
-      resolvedTargetClientId =
-        resolved.kind === "match" ? resolved.clientId : undefined;
     }
 
     if (resolvedTargetClientId != null) {
@@ -364,19 +362,17 @@ export class HostTransferProxy {
         });
       }
     } else {
-      // Auto-resolve to the unique same-user client; reject ambiguous
-      // (multi-machine) cases so a single targeted-style transfer cannot
-      // fan out across the user's machines.
-      const resolved = pickSameUserAutoResolve({
+      resolvedTargetClientId = pickMostRecentSameUserClient({
         hub: assistantEventHub,
         capability: "host_file",
         sourceActorPrincipalId,
       });
-      if (resolved.kind === "ambiguous") {
-        return Promise.resolve(ambiguousSameUserError("host_file"));
+      if (
+        resolvedTargetClientId === undefined &&
+        sourceActorPrincipalId !== undefined
+      ) {
+        return Promise.resolve(unavailableSameUserClientError("host_file"));
       }
-      resolvedTargetClientId =
-        resolved.kind === "match" ? resolved.clientId : undefined;
     }
 
     if (resolvedTargetClientId != null) {

package/src/runtime/auth/same-actor.ts

@@ -142,9 +142,7 @@ function detectRejection(
     ? args.hub.getActorPrincipalIdForClient(args.targetClientId)
     : (args.targetActorPrincipalId ??
       (isHttpAuthDisabled() && targetClientId
-        ? args.hubForMissingTarget?.getActorPrincipalIdForClient(
-            targetClientId,
-          )
+        ? args.hubForMissingTarget?.getActorPrincipalIdForClient(targetClientId)
         : undefined));
 
   let reason: RejectionReason | undefined;
@@ -264,6 +262,43 @@ export function pickSameUserAutoResolve(args: {
   return { kind: "ambiguous" };
 }
 
+/**
+ * Pick the most recently active capable client owned by the turn actor.
+ * `listClientsByCapability` is ordered by recent activity, so the first
+ * same-user match provides deterministic routing without broadcasting a host
+ * request across multiple devices.
+ */
+export function pickMostRecentSameUserClient(args: {
+  hub: Pick<AssistantEventHub, "listClientsByCapability">;
+  capability: HostProxyCapability;
+  sourceActorPrincipalId: string | undefined;
+}): string | undefined {
+  const { hub, capability, sourceActorPrincipalId } = args;
+  if (sourceActorPrincipalId == null) {
+    return undefined;
+  }
+  return hub
+    .listClientsByCapability(capability)
+    .find((client) => client.actorPrincipalId === sourceActorPrincipalId)
+    ?.clientId;
+}
+
+/**
+ * Error result for an automatic host route with no capable client owned by the
+ * actor that initiated the turn.
+ */
+export function unavailableSameUserClientError(
+  capability: HostProxyCapability,
+): {
+  content: string;
+  isError: true;
+} {
+  return {
+    content: `No connected ${capability} client belongs to this user. Connect a capable client signed in as the same user, then retry.`,
+    isError: true,
+  };
+}
+
 /**
  * Actor principal persisted on a host-proxy pending interaction.
  *

package/src/tools/host-terminal/host-shell.ts

@@ -18,10 +18,7 @@ import { getConfig } from "../../config/loader.js";
 import { HostBashProxy } from "../../daemon/host-bash-proxy.js";
 import { RiskLevel } from "../../permissions/types.js";
 import { wakeAgentForOpportunity } from "../../runtime/agent-wake.js";
-import {
-  assistantEventHub,
-  broadcastMessage,
-} from "../../runtime/assistant-event-hub.js";
+import { broadcastMessage } from "../../runtime/assistant-event-hub.js";
 import { conversationRevealNonce } from "../../runtime/reveal-nonce.js";
 import { redactSecrets } from "../../security/secret-scanner.js";
 import {
@@ -142,7 +139,7 @@ export const hostShellInputSchema = z.looseObject({
   target_client_id: z
     .string()
     .describe(
-      "ID of the specific client to execute this command on. Required when multiple clients support host_bash; omit when only one client is connected. Obtain IDs from `assistant clients list --capability host_bash`.",
+      "Optional ID of the specific client to execute this command on. Without it, the most recently active eligible client is used. Obtain IDs from `assistant clients list --capability host_bash`.",
     )
     .optional()
     .catch(undefined),
@@ -203,20 +200,7 @@ export const hostShellTool = {
     const config = getConfig();
     const { shellDefaultTimeoutSec, shellMaxTimeoutSec } = config.timeouts;
 
-    // Guard: non-host-proxy interfaces need an explicit target when multiple
-    // capable clients are connected to avoid ambiguous untargeted broadcasts.
     const transportInterface = context.transportInterface;
-    if (
-      targetClientId == null &&
-      transportInterface != null &&
-      !supportsHostProxy(transportInterface) &&
-      assistantEventHub.listClientsByCapability("host_bash").length > 1
-    ) {
-      return {
-        content: `Error: multiple clients support host_bash. Specify which client to use with \`target_client_id\`. Run \`assistant clients list --capability host_bash\` to see client IDs and labels.`,
-        isError: true,
-      };
-    }
 
     // Guard: non-host-proxy interfaces with no capable clients connected.
     if (