@vellumai/assistant 0.12.0 → 0.12.1-staging.1

package/src/daemon/config-watcher.ts

@@ -1,19 +1,19 @@
 /**
  * File watchers and config reload logic extracted from DaemonServer.
- * Watches workspace files (config, prompts) and skills directories
- * for changes.
+ * Watches workspace files (config, prompts, signals, avatar, sounds).
+ * Skill capability cards reseed from SKILL.md mtimes in the memory worker
+ * and the assistant process, not from this watcher.
  */
 import {
   existsSync,
   type FSWatcher,
   mkdirSync,
-  readdirSync,
   readFileSync,
   unwatchFile,
   watch,
   watchFile,
 } from "node:fs";
-import { basename, join } from "node:path";
+import { join } from "node:path";
 
 import { AVATAR_IMAGE_FILENAME } from "@vellumai/avatar-manifest";
 
@@ -44,50 +44,14 @@ import {
   getSoundsDir,
   getWorkspaceDir,
   getWorkspacePromptPath,
-  getWorkspaceSkillsDir,
+  WORKSPACE_MCP_FILENAME,
 } from "../util/platform.js";
 import { evictConversationsForReload } from "./conversation-store.js";
 import { parseIdentityFields } from "./handlers/identity.js";
 import { reloadMcpServers } from "./mcp-reload-service.js";
-import { refreshSkillCapabilityMemories } from "./skill-memory-refresh.js";
 
 const log = getLogger("config-watcher");
 
-const SKILL_WATCH_SKIPPED_DIRS = new Set([
-  "node_modules",
-  ".git",
-  "__pycache__",
-  ".install-staging",
-  ".cache",
-  ".next",
-  ".turbo",
-  ".venv",
-  "coverage",
-]);
-
-function isSkippedSkillWatchPath(relativePath: string): boolean {
-  if (relativePath === "(unknown)") {
-    return false;
-  }
-
-  const segments = relativePath.split(/[\\/]+/).filter(Boolean);
-  return segments.some((segment) => SKILL_WATCH_SKIPPED_DIRS.has(segment));
-}
-
-/**
- * Files whose contents feed the skill catalog: `SKILL.md` carries a skill's
- * metadata and body, `TOOLS.json` its tool manifest. Both live at the top
- * level of a skill directory. Every other file (scripts, reference docs, build
- * output) is read fresh on demand or irrelevant to the catalog, so changes to
- * them do not require a catalog reload.
- */
-const SKILL_CATALOG_FILENAMES = new Set(["SKILL.md", "TOOLS.json"]);
-
-/** True when a changed path's basename is a skill-catalog file. */
-function isSkillCatalogFile(filename: string): boolean {
-  return SKILL_CATALOG_FILENAMES.has(basename(filename));
-}
-
 /**
  * Attach a resilient error handler to an FSWatcher so that async errors
  * (e.g. ENXIO when a Unix socket file like `gateway.sock` appears in a
@@ -227,19 +191,11 @@ export class ConfigWatcher {
           return;
         }
         try {
-          const prevMcpFingerprint = JSON.stringify(this.lastConfig?.mcp ?? {});
           const changed = await this.refreshConfigFromSources();
           if (changed) {
             evictConversationsForReload();
             refreshAuthenticatedApiRateLimit();
             publishConfigChanged();
-            const newConfig = this.lastConfig ?? getConfig();
-            const newMcpFingerprint = JSON.stringify(newConfig.mcp ?? {});
-            if (newMcpFingerprint !== prevMcpFingerprint) {
-              reloadMcpServers().catch((err: unknown) => {
-                log.error({ err }, "MCP reload after config change failed");
-              });
-            }
           }
         } catch (err) {
           log.error(
@@ -248,6 +204,14 @@ export class ConfigWatcher {
           );
         }
       },
+      [WORKSPACE_MCP_FILENAME]: () => {
+        if (this.suppressReload) {
+          return;
+        }
+        reloadMcpServers().catch((err: unknown) => {
+          log.error({ err }, "MCP reload after mcp.json change failed");
+        });
+      },
       "SOUL.md": () => {
         evictConversationsForReload();
       },
@@ -270,7 +234,6 @@ export class ConfigWatcher {
     this.startAvatarWatcher();
     this.startSignalsWatcher();
     this.startUsersWatcher();
-    this.startSkillsWatchers();
   }
 
   stop(): void {
@@ -485,150 +448,6 @@ export class ConfigWatcher {
       );
     }
   }
-
-  private startSkillsWatchers(): void {
-    const skillsDir = getWorkspaceSkillsDir();
-    if (!existsSync(skillsDir)) {
-      return;
-    }
-
-    const scheduleSkillsReload = (file: string): void => {
-      if (isSkippedSkillWatchPath(file)) {
-        return;
-      }
-
-      this.debounceTimers.schedule("skills:catalog", () => {
-        log.info({ file }, "Skill catalog changed, reloading");
-        evictConversationsForReload();
-        refreshSkillCapabilityMemories(getConfig());
-      });
-    };
-
-    // Only SKILL.md and TOOLS.json feed the skill catalog, and both live at the
-    // top level of a skill directory. Changes to any other file (scripts,
-    // reference docs, build output) never alter the catalog, so the watchers
-    // react only to those two files — plus skill directories appearing or
-    // disappearing, which is an install or removal.
-    try {
-      const recursiveWatcher = watch(
-        skillsDir,
-        { recursive: true },
-        (_eventType, filename) => {
-          if (!filename || isSkillCatalogFile(String(filename))) {
-            scheduleSkillsReload(filename ? String(filename) : "(unknown)");
-          }
-        },
-      );
-      attachWatcherErrorHandler(recursiveWatcher, skillsDir);
-      this.watchers.push(recursiveWatcher);
-      log.info({ dir: skillsDir }, "Watching skills catalog recursively");
-      return;
-    } catch (err) {
-      log.info(
-        { err, dir: skillsDir },
-        "Recursive skills watch unavailable; using per-skill-directory watchers",
-      );
-    }
-
-    // Fallback when recursive watches are unavailable: watch the skills root
-    // (to detect a skill being installed or removed) plus each immediate skill
-    // directory (to detect SKILL.md / TOOLS.json edits). Nested subdirectories
-    // are deliberately not watched, bounding the descriptor count to one per
-    // skill rather than one per subdirectory.
-    const skillDirWatchers = new Map<string, FSWatcher>();
-
-    const watchDir = (
-      dirPath: string,
-      onChange: (filename: string | null) => void,
-    ): FSWatcher | null => {
-      try {
-        const watcher = watch(dirPath, (_eventType, filename) => {
-          onChange(filename ? String(filename) : null);
-        });
-        attachWatcherErrorHandler(watcher, dirPath);
-        this.watchers.push(watcher);
-        return watcher;
-      } catch (err) {
-        log.warn({ err, dirPath }, "Failed to watch skill directory");
-        return null;
-      }
-    };
-
-    const removeWatcher = (watcher: FSWatcher): void => {
-      const idx = this.watchers.indexOf(watcher);
-      if (idx !== -1) {
-        this.watchers.splice(idx, 1);
-      }
-    };
-
-    const listSkillDirs = (): string[] => {
-      try {
-        return readdirSync(skillsDir, { withFileTypes: true })
-          .filter(
-            (entry) =>
-              entry.isDirectory() && !SKILL_WATCH_SKIPPED_DIRS.has(entry.name),
-          )
-          .map((entry) => join(skillsDir, entry.name));
-      } catch (err) {
-        log.warn({ err, skillsDir }, "Failed to enumerate skill directories");
-        return [];
-      }
-    };
-
-    // Reconcile the per-skill-directory watchers against what is on disk.
-    // Returns true when the set of watched directories changed — i.e. a skill
-    // was installed or removed — so the caller can reload the catalog.
-    const refreshSkillDirWatchers = (): boolean => {
-      const nextDirs = new Set(listSkillDirs());
-      let changed = false;
-
-      for (const [dirPath, watcher] of skillDirWatchers.entries()) {
-        if (nextDirs.has(dirPath)) {
-          continue;
-        }
-        watcher.close();
-        skillDirWatchers.delete(dirPath);
-        removeWatcher(watcher);
-        changed = true;
-      }
-
-      for (const dirPath of nextDirs) {
-        if (skillDirWatchers.has(dirPath)) {
-          continue;
-        }
-        const watcher = watchDir(dirPath, (filename) => {
-          if (!filename || isSkillCatalogFile(filename)) {
-            scheduleSkillsReload(filename ?? "(unknown)");
-          }
-        });
-        if (watcher) {
-          skillDirWatchers.set(dirPath, watcher);
-          changed = true;
-        }
-      }
-
-      return changed;
-    };
-
-    const rootWatcher = watchDir(skillsDir, () => {
-      // A change directly under the skills root means a skill directory was
-      // added, removed, or renamed. Re-sync the per-skill watchers and reload
-      // the catalog when the set actually changed.
-      if (refreshSkillDirWatchers()) {
-        scheduleSkillsReload("(skill installed or removed)");
-      }
-    });
-
-    if (!rootWatcher) {
-      return;
-    }
-
-    refreshSkillDirWatchers();
-    log.info(
-      { dir: skillsDir },
-      "Watching skills catalog with per-skill-directory fallback",
-    );
-  }
 }
 
 /**

package/src/daemon/conversation-process.ts

@@ -646,52 +646,6 @@ export async function kickQueueDrain(
   }
 }
 
-/**
- * Commit `actor` as the actor the turn about to start runs for: the resting
- * slot names them, so the history is scoped to them and every reader of the
- * slot (the `<turn_context>` actor section, memory retrieval, the Slack
- * transcript filters) describes them rather than whoever sent last, and the
- * per-turn snapshot then reads back that same actor, which is also returned
- * for callers that must hold it in a local. A caller with no actor of its own
- * (internal dispatch, or a queued message whose enqueue found the slot empty)
- * passes `undefined`, and the resting actor stands.
- *
- * `reloadHistory` is off only for a steered drain, which keeps its resident
- * history: a steer comes from the actor whose turn it cut off, and that
- * history may hold the in-memory repair of the abandoned `tool_use`, which a
- * reload would discard.
- *
- * The committed actor is captured and snapshotted before the reload awaits:
- * the slot is writable out-of-band across that await (a wake's stamp, a
- * pointer elevation), and a read after it would hand the turn that writer's
- * actor. A reload that fails starts no turn, so the slot is put back to what
- * it held before, guarded so a writer that legitimately moved it in between
- * is left alone.
- */
-async function commitTurnActor(
-  conversation: Conversation,
-  actor: TrustContext | undefined,
-  options: { reloadHistory: boolean },
-): Promise<TrustContext | undefined> {
-  const prior = restingTrust(conversation);
-  if (actor) {
-    conversation.setTrustContext(actor);
-  }
-  const turnTrustContext = restingTrust(conversation);
-  conversation.currentTurnTrustContext = turnTrustContext;
-  if (options.reloadHistory) {
-    try {
-      await conversation.ensureActorScopedHistory();
-    } catch (err) {
-      if (actor && restingTrust(conversation) === actor) {
-        conversation.setTrustContext(prior ?? null);
-      }
-      throw err;
-    }
-  }
-  return turnTrustContext;
-}
-
 async function drainSingleMessage(
   conversation: Conversation,
   next: QueuedMessage,
@@ -794,12 +748,11 @@ async function drainSingleMessage(
   // a different actor's context if a concurrent request mutates the live fields.
   // Trust comes from the queued message, not the live slot: the slot holds
   // whichever actor sent most recently, which is this sender only when nobody
-  // else sent while this message waited.
-  const turnTrustContext = await commitTurnActor(
-    conversation,
-    next.trustContext,
-    { reloadHistory: !steered },
-  );
+  // else sent while this message waited. Held in a local as well, because the
+  // field is writable out-of-band across the awaits between here and the loop
+  // call below.
+  const turnTrustContext = next.trustContext ?? restingTrust(conversation);
+  conversation.currentTurnTrustContext = turnTrustContext;
   conversation.currentTurnChannelCapabilities =
     conversation.channelCapabilities;
 
@@ -1407,12 +1360,9 @@ async function drainBatch(
   // The head's trust governs the batch, which is sound only because
   // `buildPassthroughBatch` refuses to coalesce messages from different
   // actors; without that boundary this would run a tail under the head's
-  // trust.
-  const turnTrustContext = await commitTurnActor(
-    conversation,
-    head.trustContext,
-    { reloadHistory: true },
-  );
+  // trust. Held in a local for the same reason as the single-message drain.
+  const turnTrustContext = head.trustContext ?? restingTrust(conversation);
+  conversation.currentTurnTrustContext = turnTrustContext;
   conversation.currentTurnChannelCapabilities =
     conversation.channelCapabilities;
 
@@ -1890,16 +1840,37 @@ export async function processMessage(
     metadata: callerMetadata,
     trustContext: committingTrustContext,
   } = options;
+  const priorRestingTrust = restingTrust(conversation);
+  if (committingTrustContext) {
+    conversation.setTrustContext(committingTrustContext);
+  }
   // Held in a local as well as on the conversation: the field is writable
   // out-of-band while this turn is in flight (`agent-wake` stamps it and
   // restores the prior value in a `finally`), so reading it back at the agent
   // loop call below would reintroduce the late read this capture exists to
-  // avoid. The local is what the loop runs under.
-  const turnTrustContext = await commitTurnActor(
-    conversation,
-    committingTrustContext,
-    { reloadHistory: true },
-  );
+  // avoid. The local is what the loop runs under. Captured before the history
+  // reload for the same reason: that await is one of the windows a writer can
+  // land in.
+  const turnTrustContext = restingTrust(conversation);
+  conversation.currentTurnTrustContext = turnTrustContext;
+  try {
+    await conversation.ensureActorScopedHistory();
+  } catch (err) {
+    // This is the commitment point for the turn, so the stamp above is
+    // correct, but a reload that fails starts no turn: the conversation must
+    // not be left attributed to a sender that never ran. Guarded on identity
+    // so a writer that legitimately moved the slot across the await keeps it.
+    // Only the resting slot needs putting back; `runAgentLoopImpl` re-seeds
+    // the per-turn field at the head of every turn, so no later dispatch can
+    // inherit it.
+    if (
+      committingTrustContext &&
+      restingTrust(conversation) === committingTrustContext
+    ) {
+      conversation.setTrustContext(priorRestingTrust ?? null);
+    }
+    throw err;
+  }
   conversation.currentTurnAuthContext = conversation.authContext;
   conversation.currentTurnSourceActorPrincipalId =
     sourceActorPrincipalId ?? conversation.authContext?.actorPrincipalId;

package/src/daemon/conversation-skill-tools.ts

@@ -75,11 +75,13 @@ export interface SkillToolProjection {
 }
 
 /**
- * Conversation-scoped cache for skill projection. Avoids re-scanning the entire
- * conversation history and re-reading the filesystem on every agent turn.
+ * Conversation-scoped cache for skill projection. Avoids re-scanning the
+ * conversation history on every agent turn. Catalog membership is not stored
+ * here: each projection reads a fresh `loadSkillCatalog()` so newly
+ * installed or removed skills are visible on the next turn.
  *
- * Each conversation should own its own cache instance to prevent cross-conversation
- * state bleed.
+ * Each conversation should own its own cache instance to prevent
+ * cross-conversation state bleed.
  */
 export interface SkillProjectionCache {
   /** Cached deriveActiveSkills result. */
@@ -95,9 +97,6 @@ export interface SkillProjectionCache {
     /** The accumulated active skill entries. */
     entries: ActiveSkillEntry[];
   };
-  /** Cached skill catalog. Invalidated when the conversation is marked stale
-   *  (e.g. skill directories changed on disk while a run is in progress). */
-  catalog?: SkillSummary[];
 }
 
 export interface ProjectSkillToolsOptions {
@@ -113,9 +112,9 @@ export interface ProjectSkillToolsOptions {
    */
   previouslyActiveSkillIds?: Map<string, string>;
   /**
-   * Conversation-scoped projection cache. When provided, projectSkillTools will
-   * avoid redundant deriveActiveSkills scans and loadSkillCatalog filesystem
-   * reads across agent turns.
+   * Conversation-scoped projection cache. When provided, projectSkillTools
+   * avoids redundant deriveActiveSkills scans across agent turns. Catalog
+   * membership is always a fresh `loadSkillCatalog()` read.
    */
   cache?: SkillProjectionCache;
   /**
@@ -310,23 +309,6 @@ function getCachedActiveSkills(
   return entries;
 }
 
-/**
- * Return the skill catalog, caching it across agent turns.
- *
- * The cache is invalidated when the conversation is marked stale (e.g. skill
- * directories changed on disk while the conversation is still processing).
- */
-function getCachedCatalog(cache?: SkillProjectionCache): SkillSummary[] {
-  if (!cache) {
-    return loadSkillCatalog();
-  }
-
-  if (!cache.catalog) {
-    cache.catalog = loadSkillCatalog();
-  }
-  return cache.catalog;
-}
-
 // ---------------------------------------------------------------------------
 // Main export
 // ---------------------------------------------------------------------------
@@ -363,11 +345,11 @@ export function projectSkillTools(
   const contextIds = contextEntries.map((e) => e.id);
   const allCandidateIds = new Set<string>([...contextIds, ...preactivated]);
 
-  // Load the catalog (cached for conversation lifetime), then scope it to the
-  // conversation's per-chat plugin selection so plugin-contributed skills from
-  // unselected plugins are not resolvable for this run (null = no restriction).
+  // Load the catalog, then scope it to the conversation's per-chat plugin
+  // selection so plugin-contributed skills from unselected plugins are not
+  // resolvable for this run (null = no restriction).
   const catalog = filterSkillsByEnabledPlugins(
-    getCachedCatalog(options?.cache),
+    loadSkillCatalog(),
     options?.effectiveEnabledPluginSet ?? null,
   );
   const catalogById = new Map<string, SkillSummary>();

package/src/daemon/conversation-store.ts

@@ -548,7 +548,7 @@ export function clearAllActiveConversations(): number {
 }
 
 /**
- * Evict in-memory conversations after a config/prompt/skills reload so the next
+ * Evict in-memory conversations after a config/prompt reload so the next
  * turn rebuilds them against the new config. Conversations with in-flight work
  * (a live turn, a queued successor, or an active subagent) are marked stale
  * and rebuilt by `getOrCreateConversation` once that work finishes. Idle

package/src/daemon/conversation-surfaces.ts

@@ -55,6 +55,7 @@ import {
   isActivationMomentParam,
 } from "../telemetry/activation-funnel.js";
 import { resolveAppId } from "../tools/apps/resolve-app-id.js";
+import { formatDesktopAppRequired } from "../tools/capability-offer.js";
 import { POINT_AT_PROXY_TOOL } from "../tools/computer-use/skill-proxy-bridge.js";
 import type { ToolExecutionResult } from "../tools/types.js";
 import { getLogger } from "../util/logger.js";
@@ -2936,7 +2937,7 @@ export function buildAppOpenPreview(
 function describeComputerUseUnavailable(ctx: Conversation): string {
   const capable = assistantEventHub.listClientsByCapability("host_cu");
   if (capable.length === 0) {
-    return "Computer use is not available — no desktop client connected. Open the Vellum desktop app on the machine you want to control, then retry.";
+    return formatDesktopAppRequired("screen");
   }
   return `Computer use is not available for this conversation — ${capable.length} desktop client(s) advertise host_cu, but none of them can be driven from this conversation's interface (${ctx.transportInterface ?? "unknown"}) as its current user.`;
 }
@@ -3251,8 +3252,7 @@ export async function surfaceProxyResolver(
 
     if (!ctx.hostAppControlProxy || !ctx.hostAppControlProxy.isAvailable()) {
       return {
-        content:
-          "App control is not available — enable the `app-control` feature flag and connect a macOS client.",
+        content: formatDesktopAppRequired("apps"),
         isError: true,
       };
     }
@@ -3344,6 +3344,7 @@ export async function surfaceProxyResolver(
     const caps = ctx.channelCapabilities;
     if (
       caps &&
+      !ctx.hasNoClient &&
       !caps.supportsDynamicUi &&
       !isSlackTaskProgressUiException(ctx, toolName, input)
     ) {
@@ -3552,11 +3553,12 @@ export async function surfaceProxyResolver(
           : surfaceType === "table"
             ? hasActions
             : INTERACTIVE_SURFACE_TYPES.includes(surfaceType);
-    // An explicit `await_action: true` is honored for every other type; an
-    // actionless surface has nothing to await, so it is forced false.
-    const awaitAction = isActionless
-      ? false
-      : ((input.await_action as boolean) ?? isInteractive);
+    // Background turns persist surfaces for a later conversation open and
+    // return immediately. An actionless surface also has nothing to await.
+    const awaitAction =
+      !ctx.hasNoClient &&
+      !isActionless &&
+      ((input.await_action as boolean) ?? isInteractive);
 
     // Only one non-persistent interactive surface at a time. If another
     // surface is already awaiting user input, reject this one so the LLM

package/src/daemon/conversation-tool-setup.ts

@@ -28,7 +28,6 @@ import { getAllDefaultPluginNames } from "../plugins/defaults/main.js";
 import { isActivationSession } from "../plugins/defaults/memory/activation-session-store.js";
 import { isPluginDisabled } from "../plugins/disabled-state.js";
 import type { Message, ToolDefinition } from "../providers/types.js";
-import { assistantEventHub } from "../runtime/assistant-event-hub.js";
 import { registerConversationSender } from "../tools/browser/browser-screencast.js";
 import { supportsClientOsForSkillTool } from "../tools/client-os.js";
 import type { ToolExecutor } from "../tools/executor.js";
@@ -260,6 +259,24 @@ export function createToolExecutor(
   // see {@link SubagentToolGateMode}): rejects non-allowlisted calls BEFORE
   // any executor dispatch, so a non-allowlisted tool's executor never runs.
   // The error tool_result lets the model continue or finish.
+  const rejectUnattendedHostTool = (
+    toolName: string,
+  ): ToolExecutionResult | null => {
+    const { transportInterface } = resolveTurnClientOs(ctx);
+    const isUnattended = ctx.currentTurnIsNonInteractive ?? ctx.hasNoClient;
+    if (
+      HOST_TOOL_NAMES.has(toolName) &&
+      isUnattended &&
+      transportInterface !== "chrome-extension"
+    ) {
+      return {
+        content: `The "${toolName}" tool requires an interactive user turn and cannot run in the background.`,
+        isError: true,
+      };
+    }
+    return null;
+  };
+
   const rejectNonAllowlistedTool = (
     toolName: string,
   ): ToolExecutionResult | null => {
@@ -387,6 +404,10 @@ export function createToolExecutor(
       if (rejection) {
         return rejection;
       }
+      const unattendedRejection = rejectUnattendedHostTool(executionName);
+      if (unattendedRejection) {
+        return unattendedRejection;
+      }
     }
 
     if (isDoordashCommand(executionName, executionInput)) {
@@ -550,6 +571,10 @@ export function createToolExecutor(
       if (innerRejection) {
         return innerRejection;
       }
+      const unattendedRejection = rejectUnattendedHostTool(toolName);
+      if (unattendedRejection) {
+        return unattendedRejection;
+      }
 
       // Per-chat plugin scope: reject the resolved inner tool when it belongs
       // to a plugin outside the conversation's effective set.
@@ -628,7 +653,6 @@ export const DEFAULT_PREACTIVATED_SKILL_IDS = ["notifications", "subagent"];
 // ── Conditional tool sets ────────────────────────────────────────────
 
 const UI_SURFACE_TOOL_NAMES = new Set(["ui_show", "ui_update", "ui_dismiss"]);
-const SLACK_TASK_PROGRESS_UI_TOOL_NAMES = new Set(["ui_show", "ui_update"]);
 /**
  * Single source of truth for which tools are host tools and the capability
  * each one requires from the connected client interface. Adding a tool here
@@ -856,56 +880,26 @@ export function isToolActiveForContext(
     return supportsChannelReaction(turnChannel);
   }
   if (UI_SURFACE_TOOL_NAMES.has(name)) {
-    if (
-      channelCapabilities?.channel === "slack" &&
-      SLACK_TASK_PROGRESS_UI_TOOL_NAMES.has(name)
-    ) {
-      return !hasNoClient;
-    }
-    return channelCapabilities?.supportsDynamicUi ?? !hasNoClient;
+    // Surface calls write conversation content. Background turns persist that
+    // content for the next client that opens the conversation, so presence
+    // cannot change whether the model receives these definitions.
+    return true;
   }
   if (HOST_TOOL_NAMES.has(name)) {
     const capability = HOST_TOOL_TO_CAPABILITY.get(name);
     const transport = transportInterface;
 
-    // Per-capability check is authoritative for structural support: if the
-    // transport cannot service this capability, the tool is filtered out.
+    // A transport that does not implement a capability can invoke it through
+    // an eligible same-user client. Client selection happens when the call
+    // runs, so the wire schema stays stable across live and background turns.
     if (transport && capability && !supportsHostProxy(transport, capability)) {
-      // Cross-client exception: allow host tools whose capabilities have
-      // cross-client routing infrastructure (Phases 1–3 plus host_browser
-      // via PR #27489) to be exposed for non-host-proxy transports (e.g.
-      // "web", "ios") when at least one capable client is connected via
-      // the event hub. Members of CROSS_CLIENT_EXPOSED_CAPABILITIES
-      // (host_bash, host_file, host_browser) qualify.
-      // chrome-extension transport is excluded as a security boundary
-      // (extension only gets host_browser via its own executor path);
-      // hasNoClient turns are excluded (no interactive approval UI
-      // available).
-      if (
-        capability &&
+      return (
         CROSS_CLIENT_EXPOSED_CAPABILITIES.has(capability) &&
-        transport !== "chrome-extension" &&
-        !hasNoClient &&
-        assistantEventHub.listClientsByCapability(capability).length > 0
-      ) {
-        return true;
-      }
-      return false;
-    }
-
-    // chrome-extension is its own executor — the extension's popup gates
-    // commands via its own UI, and the transport does not use an SSE-level
-    // interactive approval channel. hasNoClient is intentionally `true` for
-    // chrome-extension turns (chrome-extension is not in INTERACTIVE_INTERFACES)
-    // and must not gate host_browser. Trust the per-capability check.
-    if (transport === "chrome-extension") {
-      return true;
+        transport !== "chrome-extension"
+      );
     }
 
-    // For transports that surface approvals over SSE (macos, backwards-compat
-    // fallback), deny when no client is present so the guardian auto-approve
-    // path cannot execute host commands unattended.
-    return !hasNoClient;
+    return true;
   }
   if (CLIENT_CAPABILITY_TOOL_NAMES.has(name)) {
     if (name === "ask_question" && channelCapabilities?.clientOS === "macos") {

package/src/daemon/conversation.ts

@@ -2366,9 +2366,6 @@ export class Conversation {
 
   markStale(): void {
     this.stale = true;
-    // Invalidate the cached skill catalog so the next projection picks up
-    // filesystem changes (e.g. a skill created during this run).
-    this.skillProjectionCache.catalog = undefined;
   }
 
   isStale(): boolean {