@vellumai/assistant 0.12.1-dev.202609141913.5e16607 → 0.12.1-dev.202609142215.1dfc46d

package/ARCHITECTURE.md

@@ -1406,15 +1406,15 @@ skills/<skill-id>/
 
 The following capabilities ship as bundled skills in `assistant/src/config/bundled-skills/`:
 
-| Skill ID        | Tools                                                                                                                                                                                                                                                             | Purpose                                                                                                                                                                                                                                                                                              |
-| --------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `browser`       | `browser_navigate`, `browser_snapshot`, `browser_screenshot`, `browser_close`, `browser_click`, `browser_type`, `browser_press_key`, `browser_wait_for`, `browser_extract`, `browser_fill_credential`                                                             | Headless browser automation — web scraping, form filling, interaction (previously core-registered as `headless-browser`; now skill-provided with default allow rules)                                                                                                                                |
-| `gmail`         | Gmail search, archive, send, etc.                                                                                                                                                                                                                                 | Email management via OAuth2 integration                                                                                                                                                                                                                                                              |
-| `computer-use`  | `computer_use_observe`, `computer_use_click`, `computer_use_type_text`, `computer_use_key`, `computer_use_scroll`, `computer_use_drag`, `computer_use_wait`, `computer_use_open_app`, `computer_use_run_applescript`, `computer_use_done`, `computer_use_respond` | Computer-use proxy tools preactivated via `preactivatedSkillIds` in desktop sessions. Each tool forwards actions to a compatible connected desktop host via `HostCuProxy`, which handles request/resolve proxying, step counting, loop detection, and observation formatting in the same agent loop. |
-| `weather`       | `get-weather`                                                                                                                                                                                                                                                     | Fetch current weather data                                                                                                                                                                                                                                                                           |
-| `app-builder`   | `app_create`, `app_delete`, `app_refresh`, `app_generate_icon`                                                                                                                                                                                                    | Dynamic app authoring — create and manage persistent apps; file editing uses generic file tools plus `app_refresh` (activated via `skill_load app-builder`; `app_open` remains a core proxy tool)                                                                                                    |
-| `self-upgrade`  | (instruction-only)                                                                                                                                                                                                                                                | Self-improvement workflow                                                                                                                                                                                                                                                                            |
-| `start-the-day` | (instruction-only)                                                                                                                                                                                                                                                | Morning briefing routine                                                                                                                                                                                                                                                                             |
+| Skill ID        | Tools                                                                                                                                                                                                                                                                                      | Purpose                                                                                                                                                                                                                                                                                              |
+| --------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `browser`       | `browser_navigate`, `browser_snapshot`, `browser_screenshot`, `browser_close`, `browser_click`, `browser_type`, `browser_press_key`, `browser_wait_for`, `browser_extract`, `browser_fill_credential`                                                                                      | Headless browser automation: web scraping, form filling, interaction (previously core-registered as `headless-browser`; now skill-provided with default allow rules)                                                                                                                                 |
+| `gmail`         | Gmail search, archive, send, etc.                                                                                                                                                                                                                                                          | Email management via OAuth2 integration                                                                                                                                                                                                                                                              |
+| `computer-use`  | `computer_use_observe`, `computer_use_click`, `computer_use_type_text`, `computer_use_key`, `computer_use_scroll`, `computer_use_drag`, `computer_use_wait`, `computer_use_open_app`, `computer_use_run_applescript`, `computer_use_sequence`, `computer_use_done`, `computer_use_respond` | Computer-use proxy tools preactivated via `preactivatedSkillIds` in desktop sessions. Each tool forwards actions to a compatible connected desktop host via `HostCuProxy`, which handles request/resolve proxying, step counting, loop detection, and observation formatting in the same agent loop. |
+| `weather`       | `get-weather`                                                                                                                                                                                                                                                                              | Fetch current weather data                                                                                                                                                                                                                                                                           |
+| `app-builder`   | `app_create`, `app_delete`, `app_refresh`, `app_generate_icon`                                                                                                                                                                                                                             | Dynamic app authoring: create and manage persistent apps; file editing uses generic file tools plus `app_refresh` (activated via `skill_load app-builder`; `app_open` remains a core proxy tool)                                                                                                     |
+| `self-upgrade`  | (instruction-only)                                                                                                                                                                                                                                                                         | Self-improvement workflow                                                                                                                                                                                                                                                                            |
+| `start-the-day` | (instruction-only)                                                                                                                                                                                                                                                                         | Morning briefing routine                                                                                                                                                                                                                                                                             |
 
 ### Activation and Projection Flow
 

package/openapi.yaml

@@ -15981,6 +15981,13 @@ paths:
                   type: string
                 userGuidance:
                   type: string
+                timings:
+                  type: object
+                  propertyNames:
+                    type: string
+                  additionalProperties:
+                    type: number
+                  description: Per-phase helper timings in milliseconds
               required:
                 - requestId
       responses:
@@ -22068,6 +22075,9 @@ paths:
                           type: boolean
                         noResponse:
                           type: boolean
+                        cameraFrame:
+                          type: boolean
+                          const: true
                         assistantTextVisibility:
                           type: string
                           enum:
@@ -37047,8 +37057,18 @@ paths:
           schema:
             type: string
           description:
-            "Compute recursive byte size for each directory entry (true/false). Budget-bounded — large subtrees may
-            return size: null."
+            "Compute recursive byte size for each directory entry (true/false). Budget-bounded: large subtrees may
+            return size: null. Not applied to a recursive listing, which carries every file for the client to sum."
+        - name: recursive
+          in: query
+          required: false
+          schema:
+            type: string
+          description:
+            "List the whole subtree in one response (true/false). Depth-first, each directory's entries in listing
+            order, so grouping by parent path recovers per-directory listings. Bounded: sets truncated when the entry
+            cap or deadline stops the walk, and does not enter directories the workspace gitignore rules exclude, which
+            are named in skipped."
       responses:
         "200":
           description: Successful response
@@ -37092,6 +37112,19 @@ paths:
                         - modifiedAt
                       additionalProperties: false
                     description: Directory entry objects
+                  truncated:
+                    description:
+                      A recursive walk stopped at its entry cap or deadline, so deeper entries are missing. Absent from
+                      assistants that predate recursive listings.
+                    type: boolean
+                  skipped:
+                    description:
+                      Directories a recursive walk listed but did not enter, whether because a workspace gitignore rule excludes
+                      them, they are symlinks, or they could not be read. Each can still be listed on its own. Absent
+                      from assistants that predate recursive listings.
+                    type: array
+                    items:
+                      type: string
                 required:
                   - path
                   - entries

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/assistant",
-  "version": "0.12.1-dev.202609141913.5e16607",
+  "version": "0.12.1-dev.202609142215.1dfc46d",
   "license": "MIT",
   "type": "module",
   "exports": {
@@ -62,6 +62,7 @@
     "dotenv": "17.3.1",
     "drizzle-orm": "0.45.2",
     "hast-util-to-html": "9.0.5",
+    "ignore": "7.0.9",
     "jszip": "3.10.1",
     "marked": "18.0.0",
     "mdast-util-to-hast": "13.2.1",

package/src/__tests__/anthropic-provider.test.ts

@@ -3029,69 +3029,6 @@ describe("AnthropicProvider - internal attachment id", () => {
   });
 });
 
-// ---------------------------------------------------------------------------
-// Tests — Orphaned UTF-16 surrogate sanitization
-// ---------------------------------------------------------------------------
-
-describe("AnthropicProvider — surrogate sanitization", () => {
-  let provider: AnthropicProvider;
-
-  beforeEach(() => {
-    lastStreamParams = null;
-    provider = new AnthropicProvider("sk-ant-test", "claude-sonnet-4-6");
-  });
-
-  test("strips orphaned high surrogate from a tool result before sending", async () => {
-    // An orphaned high surrogate — the exact shape that triggers Anthropic's
-    // "no low surrogate in string" 400. The mock's JSON.parse(JSON.stringify)
-    // on line ~44 would throw if sanitization didn't happen.
-    const LONE_HIGH = "\uD83C";
-    const messages: Message[] = [
-      toolUseMsg("tu1", "bash"),
-      toolResultMsg("tu1", `shell output ${LONE_HIGH} more output`),
-      userMsg("what happened?"),
-    ];
-
-    await provider.sendMessage(messages);
-
-    const sent = lastStreamParams!.messages as Array<{
-      role: string;
-      content: Array<{ type: string; content?: string; text?: string }>;
-    }>;
-    // Find the tool_result block in the captured payload and assert no orphans.
-    const toolResult = sent
-      .flatMap((m) => m.content)
-      .find((b) => b.type === "tool_result");
-    expect(toolResult).toBeDefined();
-    expect(toolResult!.content).toBeDefined();
-    const content = toolResult!.content as string;
-    for (let i = 0; i < content.length; i++) {
-      const code = content.charCodeAt(i);
-      if (code >= 0xd800 && code <= 0xdbff) {
-        const next = i + 1 < content.length ? content.charCodeAt(i + 1) : 0;
-        expect(next >= 0xdc00 && next <= 0xdfff).toBe(true);
-        i++;
-      } else {
-        expect(code < 0xdc00 || code > 0xdfff).toBe(true);
-      }
-    }
-  });
-
-  test("clean payloads are not copied unnecessarily", async () => {
-    // When there are no orphans, the sanitizer should be a no-op. We can't
-    // easily assert reference equality through the mock boundary (the mock
-    // JSON-round-trips params for capture), but we can at least confirm the
-    // call succeeds without error on ordinary payloads containing valid
-    // surrogate pairs (emoji).
-    const EMOJI = "\uD83C\uDF89";
-    await provider.sendMessage([userMsg(`hello ${EMOJI} world`)]);
-    const sent = lastStreamParams!.messages as Array<{
-      content: Array<{ text?: string }>;
-    }>;
-    expect(sent[0].content[0].text).toContain(EMOJI);
-  });
-});
-
 // ---------------------------------------------------------------------------
 // Haiku model gating
 // ---------------------------------------------------------------------------

package/src/__tests__/assistant-event-hub-machine-name.test.ts

@@ -125,7 +125,10 @@ describe("AssistantEventHub — machineName", () => {
   });
 });
 
-describe("window capture negotiation", () => {
+describe.each([
+  ["x-vellum-cu-window-capture", "host_cu_window_capture"],
+  ["x-vellum-cu-sequence", "host_cu_sequence"],
+] as const)("%s negotiation", (header, capability) => {
   test.each([
     ["macos", undefined, false],
     ["macos", "0", false],
@@ -145,18 +148,14 @@ describe("window capture negotiation", () => {
             headers: {
               "x-vellum-client-id": "client-1",
               "x-vellum-interface-id": interfaceId,
-              ...(advertised
-                ? { "x-vellum-cu-window-capture": advertised }
-                : {}),
+              ...(advertised ? { [header]: advertised } : {}),
             },
             abortSignal: ac.signal,
           },
           { hub },
         );
         expect(
-          hub
-            .getClientById("client-1")
-            ?.capabilities.includes("host_cu_window_capture"),
+          hub.getClientById("client-1")?.capabilities.includes(capability),
         ).toBe(supported);
       } finally {
         ac.abort();

package/src/__tests__/assistant-event-hub.test.ts

@@ -690,3 +690,47 @@ test("window requests never reach an older overlapping connection with the same
     supported.dispose();
   }
 });
+
+test("batched action requests never reach an older overlapping connection with the same device ID", async () => {
+  const receivedLegacy: unknown[] = [];
+  const receivedSupported: unknown[] = [];
+  const legacy = assistantEventHub.subscribe({
+    type: "client",
+    clientId: "sequence-client",
+    interfaceId: "macos",
+    capabilities: ["host_cu"],
+    callback: (event) => {
+      receivedLegacy.push(event);
+    },
+  });
+  const supported = assistantEventHub.subscribe({
+    type: "client",
+    clientId: "sequence-client",
+    interfaceId: "macos",
+    capabilities: ["host_cu", "host_cu_sequence"],
+    callback: (event) => {
+      receivedSupported.push(event);
+    },
+  });
+  try {
+    broadcastMessage(
+      {
+        type: "host_cu_request",
+        requestId: "sequence-request",
+        conversationId: "sequence-session",
+        toolName: "computer_use_sequence",
+        input: { actions: [{ action: "key", key: "cmd+n" }] },
+        stepNumber: 1,
+        targetClientId: "sequence-client",
+      },
+      "sequence-session",
+      { targetClientId: "sequence-client" },
+    );
+    await new Promise((resolve) => setTimeout(resolve, 0));
+    expect(receivedLegacy).toHaveLength(0);
+    expect(receivedSupported).toHaveLength(1);
+  } finally {
+    legacy.dispose();
+    supported.dispose();
+  }
+});

package/src/__tests__/computer-use-skill-manifest-regression.test.ts

@@ -29,7 +29,7 @@ const manifestPath = resolve(
 const manifest = JSON.parse(readFileSync(manifestPath, "utf-8"));
 
 describe("computer-use skill manifest regression", () => {
-  test("manifest has exactly 11 tools", () => {
+  test("manifest has exactly 12 tools", () => {
     expect(manifest.tools).toHaveLength(COMPUTER_USE_TOOL_COUNT);
   });
 

package/src/__tests__/computer-use-tools.test.ts

@@ -37,8 +37,8 @@ const ctx: ToolContext = {
 // ── Tool definitions ────────────────────────────────────────────────
 
 describe("computer-use tool definitions", () => {
-  test("allComputerUseTools contains 11 tools", () => {
-    expect(allComputerUseTools.length).toBe(11);
+  test("allComputerUseTools contains 12 tools", () => {
+    expect(allComputerUseTools.length).toBe(12);
   });
 
   test("all tools belong to computer-use category", () => {

package/src/__tests__/heartbeat-service.test.ts

@@ -557,52 +557,52 @@ describe("HeartbeatService", () => {
     expect(processMessageCalls).toHaveLength(1);
   });
 
-    test("active hours handles overnight window", async () => {
-      setHeartbeatConfig({ activeHoursStart: 22, activeHoursEnd: 6 });
+  test("active hours handles overnight window", async () => {
+    setHeartbeatConfig({ activeHoursStart: 22, activeHoursEnd: 6 });
 
-      // 23:00 should be within the window
-      const service = createService({ getCurrentHour: () => 23 });
-      await service.runOnce();
-      expect(processMessageCalls).toHaveLength(1);
+    // 23:00 should be within the window
+    const service = createService({ getCurrentHour: () => 23 });
+    await service.runOnce();
+    expect(processMessageCalls).toHaveLength(1);
 
-      // 10:00 should be outside the window
-      processMessageCalls.length = 0;
-      createdConversations.length = 0;
-      const service2 = createService({ getCurrentHour: () => 10 });
-      await service2.runOnce();
-      expect(processMessageCalls).toHaveLength(0);
-    });
+    // 10:00 should be outside the window
+    processMessageCalls.length = 0;
+    createdConversations.length = 0;
+    const service2 = createService({ getCurrentHour: () => 10 });
+    await service2.runOnce();
+    expect(processMessageCalls).toHaveLength(0);
+  });
 
-    test("active hours guard uses user timezone in interval mode", async () => {
-      setConfig("ui", { detectedTimezone: "America/Los_Angeles" });
-      setHeartbeatConfig({
-        cronExpression: null,
-        timezone: null,
-        activeHoursStart: 8,
-        activeHoursEnd: 22,
-      });
+  test("active hours guard uses user timezone in interval mode", async () => {
+    setConfig("ui", { detectedTimezone: "America/Los_Angeles" });
+    setHeartbeatConfig({
+      cronExpression: null,
+      timezone: null,
+      activeHoursStart: 8,
+      activeHoursEnd: 22,
+    });
 
-      // 23:00 UTC is 16:00 Pacific (inside 8-22) and 23:00 host-local
-      // (outside 8-22). If the guard still used the host clock this would skip.
-      const inside = createService({
-        now: () => new Date("2026-09-08T23:00:00Z"),
-        getCurrentHour: () => 23,
-      });
-      expect(await inside.runOnce()).toBe(true);
-      expect(processMessageCalls).toHaveLength(1);
+    // 23:00 UTC is 16:00 Pacific (inside 8-22) and 23:00 host-local
+    // (outside 8-22). If the guard still used the host clock this would skip.
+    const inside = createService({
+      now: () => new Date("2026-09-08T23:00:00Z"),
+      getCurrentHour: () => 23,
+    });
+    expect(await inside.runOnce()).toBe(true);
+    expect(processMessageCalls).toHaveLength(1);
 
-      processMessageCalls.length = 0;
-      createdConversations.length = 0;
+    processMessageCalls.length = 0;
+    createdConversations.length = 0;
 
-      // 06:00 UTC is 23:00 Pacific, outside 8-22, even though 6 is inside
-      // a naive UTC 8-22 window.
-      const outside = createService({
-        now: () => new Date("2026-09-09T06:00:00Z"),
-        getCurrentHour: () => 6,
-      });
-      expect(await outside.runOnce()).toBe(false);
-      expect(processMessageCalls).toHaveLength(0);
+    // 06:00 UTC is 23:00 Pacific, outside 8-22, even though 6 is inside
+    // a naive UTC 8-22 window.
+    const outside = createService({
+      now: () => new Date("2026-09-09T06:00:00Z"),
+      getCurrentHour: () => 6,
     });
+    expect(await outside.runOnce()).toBe(false);
+    expect(processMessageCalls).toHaveLength(0);
+  });
 
   test("overlap prevention works", async () => {
     let resolveFirst: () => void;
@@ -1004,7 +1004,23 @@ describe("HeartbeatService", () => {
         "slack",
       ]);
 
-      expect(prompt).toContain("google, slack");
+      expect(prompt).toContain(
+        "google (integration, acts as the connected person), slack (integration, acts as the connected person)",
+      );
+    });
+
+    test("prompt tells an integration apart from the channel bot of the same name", () => {
+      const service = createService();
+      const { prompt } = service.buildPrompt("- Check things", ["slack"]);
+
+      expect(prompt).toContain(
+        "slack (integration, acts as the connected person)",
+      );
+      expect(prompt).not.toContain("slack_channel");
+      expect(prompt).toContain("A channel bot is the assistant's own identity");
+
+      const bot = service.buildPrompt("- Check things", ["slack_channel"]);
+      expect(bot.prompt).toContain("slack_channel (the slack channel bot)");
     });
   });