@vellumai/assistant 0.12.1-staging.1 → 0.12.1

package/src/daemon/config-watcher.ts

@@ -1,19 +1,19 @@
 /**
  * File watchers and config reload logic extracted from DaemonServer.
- * Watches workspace files (config, prompts, signals, avatar, sounds).
- * Skill capability cards reseed from SKILL.md mtimes in the memory worker
- * and the assistant process, not from this watcher.
+ * Watches workspace files (config, prompts) and skills directories
+ * for changes.
  */
 import {
   existsSync,
   type FSWatcher,
   mkdirSync,
+  readdirSync,
   readFileSync,
   unwatchFile,
   watch,
   watchFile,
 } from "node:fs";
-import { join } from "node:path";
+import { basename, join } from "node:path";
 
 import { AVATAR_IMAGE_FILENAME } from "@vellumai/avatar-manifest";
 
@@ -44,14 +44,50 @@ import {
   getSoundsDir,
   getWorkspaceDir,
   getWorkspacePromptPath,
-  WORKSPACE_MCP_FILENAME,
+  getWorkspaceSkillsDir,
 } from "../util/platform.js";
 import { evictConversationsForReload } from "./conversation-store.js";
 import { parseIdentityFields } from "./handlers/identity.js";
 import { reloadMcpServers } from "./mcp-reload-service.js";
+import { refreshSkillCapabilityMemories } from "./skill-memory-refresh.js";
 
 const log = getLogger("config-watcher");
 
+const SKILL_WATCH_SKIPPED_DIRS = new Set([
+  "node_modules",
+  ".git",
+  "__pycache__",
+  ".install-staging",
+  ".cache",
+  ".next",
+  ".turbo",
+  ".venv",
+  "coverage",
+]);
+
+function isSkippedSkillWatchPath(relativePath: string): boolean {
+  if (relativePath === "(unknown)") {
+    return false;
+  }
+
+  const segments = relativePath.split(/[\\/]+/).filter(Boolean);
+  return segments.some((segment) => SKILL_WATCH_SKIPPED_DIRS.has(segment));
+}
+
+/**
+ * Files whose contents feed the skill catalog: `SKILL.md` carries a skill's
+ * metadata and body, `TOOLS.json` its tool manifest. Both live at the top
+ * level of a skill directory. Every other file (scripts, reference docs, build
+ * output) is read fresh on demand or irrelevant to the catalog, so changes to
+ * them do not require a catalog reload.
+ */
+const SKILL_CATALOG_FILENAMES = new Set(["SKILL.md", "TOOLS.json"]);
+
+/** True when a changed path's basename is a skill-catalog file. */
+function isSkillCatalogFile(filename: string): boolean {
+  return SKILL_CATALOG_FILENAMES.has(basename(filename));
+}
+
 /**
  * Attach a resilient error handler to an FSWatcher so that async errors
  * (e.g. ENXIO when a Unix socket file like `gateway.sock` appears in a
@@ -191,11 +227,19 @@ export class ConfigWatcher {
           return;
         }
         try {
+          const prevMcpFingerprint = JSON.stringify(this.lastConfig?.mcp ?? {});
           const changed = await this.refreshConfigFromSources();
           if (changed) {
             evictConversationsForReload();
             refreshAuthenticatedApiRateLimit();
             publishConfigChanged();
+            const newConfig = this.lastConfig ?? getConfig();
+            const newMcpFingerprint = JSON.stringify(newConfig.mcp ?? {});
+            if (newMcpFingerprint !== prevMcpFingerprint) {
+              reloadMcpServers().catch((err: unknown) => {
+                log.error({ err }, "MCP reload after config change failed");
+              });
+            }
           }
         } catch (err) {
           log.error(
@@ -204,14 +248,6 @@ export class ConfigWatcher {
           );
         }
       },
-      [WORKSPACE_MCP_FILENAME]: () => {
-        if (this.suppressReload) {
-          return;
-        }
-        reloadMcpServers().catch((err: unknown) => {
-          log.error({ err }, "MCP reload after mcp.json change failed");
-        });
-      },
       "SOUL.md": () => {
         evictConversationsForReload();
       },
@@ -234,6 +270,7 @@ export class ConfigWatcher {
     this.startAvatarWatcher();
     this.startSignalsWatcher();
     this.startUsersWatcher();
+    this.startSkillsWatchers();
   }
 
   stop(): void {
@@ -448,6 +485,150 @@ export class ConfigWatcher {
       );
     }
   }
+
+  private startSkillsWatchers(): void {
+    const skillsDir = getWorkspaceSkillsDir();
+    if (!existsSync(skillsDir)) {
+      return;
+    }
+
+    const scheduleSkillsReload = (file: string): void => {
+      if (isSkippedSkillWatchPath(file)) {
+        return;
+      }
+
+      this.debounceTimers.schedule("skills:catalog", () => {
+        log.info({ file }, "Skill catalog changed, reloading");
+        evictConversationsForReload();
+        refreshSkillCapabilityMemories(getConfig());
+      });
+    };
+
+    // Only SKILL.md and TOOLS.json feed the skill catalog, and both live at the
+    // top level of a skill directory. Changes to any other file (scripts,
+    // reference docs, build output) never alter the catalog, so the watchers
+    // react only to those two files — plus skill directories appearing or
+    // disappearing, which is an install or removal.
+    try {
+      const recursiveWatcher = watch(
+        skillsDir,
+        { recursive: true },
+        (_eventType, filename) => {
+          if (!filename || isSkillCatalogFile(String(filename))) {
+            scheduleSkillsReload(filename ? String(filename) : "(unknown)");
+          }
+        },
+      );
+      attachWatcherErrorHandler(recursiveWatcher, skillsDir);
+      this.watchers.push(recursiveWatcher);
+      log.info({ dir: skillsDir }, "Watching skills catalog recursively");
+      return;
+    } catch (err) {
+      log.info(
+        { err, dir: skillsDir },
+        "Recursive skills watch unavailable; using per-skill-directory watchers",
+      );
+    }
+
+    // Fallback when recursive watches are unavailable: watch the skills root
+    // (to detect a skill being installed or removed) plus each immediate skill
+    // directory (to detect SKILL.md / TOOLS.json edits). Nested subdirectories
+    // are deliberately not watched, bounding the descriptor count to one per
+    // skill rather than one per subdirectory.
+    const skillDirWatchers = new Map<string, FSWatcher>();
+
+    const watchDir = (
+      dirPath: string,
+      onChange: (filename: string | null) => void,
+    ): FSWatcher | null => {
+      try {
+        const watcher = watch(dirPath, (_eventType, filename) => {
+          onChange(filename ? String(filename) : null);
+        });
+        attachWatcherErrorHandler(watcher, dirPath);
+        this.watchers.push(watcher);
+        return watcher;
+      } catch (err) {
+        log.warn({ err, dirPath }, "Failed to watch skill directory");
+        return null;
+      }
+    };
+
+    const removeWatcher = (watcher: FSWatcher): void => {
+      const idx = this.watchers.indexOf(watcher);
+      if (idx !== -1) {
+        this.watchers.splice(idx, 1);
+      }
+    };
+
+    const listSkillDirs = (): string[] => {
+      try {
+        return readdirSync(skillsDir, { withFileTypes: true })
+          .filter(
+            (entry) =>
+              entry.isDirectory() && !SKILL_WATCH_SKIPPED_DIRS.has(entry.name),
+          )
+          .map((entry) => join(skillsDir, entry.name));
+      } catch (err) {
+        log.warn({ err, skillsDir }, "Failed to enumerate skill directories");
+        return [];
+      }
+    };
+
+    // Reconcile the per-skill-directory watchers against what is on disk.
+    // Returns true when the set of watched directories changed — i.e. a skill
+    // was installed or removed — so the caller can reload the catalog.
+    const refreshSkillDirWatchers = (): boolean => {
+      const nextDirs = new Set(listSkillDirs());
+      let changed = false;
+
+      for (const [dirPath, watcher] of skillDirWatchers.entries()) {
+        if (nextDirs.has(dirPath)) {
+          continue;
+        }
+        watcher.close();
+        skillDirWatchers.delete(dirPath);
+        removeWatcher(watcher);
+        changed = true;
+      }
+
+      for (const dirPath of nextDirs) {
+        if (skillDirWatchers.has(dirPath)) {
+          continue;
+        }
+        const watcher = watchDir(dirPath, (filename) => {
+          if (!filename || isSkillCatalogFile(filename)) {
+            scheduleSkillsReload(filename ?? "(unknown)");
+          }
+        });
+        if (watcher) {
+          skillDirWatchers.set(dirPath, watcher);
+          changed = true;
+        }
+      }
+
+      return changed;
+    };
+
+    const rootWatcher = watchDir(skillsDir, () => {
+      // A change directly under the skills root means a skill directory was
+      // added, removed, or renamed. Re-sync the per-skill watchers and reload
+      // the catalog when the set actually changed.
+      if (refreshSkillDirWatchers()) {
+        scheduleSkillsReload("(skill installed or removed)");
+      }
+    });
+
+    if (!rootWatcher) {
+      return;
+    }
+
+    refreshSkillDirWatchers();
+    log.info(
+      { dir: skillsDir },
+      "Watching skills catalog with per-skill-directory fallback",
+    );
+  }
 }
 
 /**

package/src/daemon/conversation-process.ts

@@ -646,6 +646,52 @@ export async function kickQueueDrain(
   }
 }
 
+/**
+ * Commit `actor` as the actor the turn about to start runs for: the resting
+ * slot names them, so the history is scoped to them and every reader of the
+ * slot (the `<turn_context>` actor section, memory retrieval, the Slack
+ * transcript filters) describes them rather than whoever sent last, and the
+ * per-turn snapshot then reads back that same actor, which is also returned
+ * for callers that must hold it in a local. A caller with no actor of its own
+ * (internal dispatch, or a queued message whose enqueue found the slot empty)
+ * passes `undefined`, and the resting actor stands.
+ *
+ * `reloadHistory` is off only for a steered drain, which keeps its resident
+ * history: a steer comes from the actor whose turn it cut off, and that
+ * history may hold the in-memory repair of the abandoned `tool_use`, which a
+ * reload would discard.
+ *
+ * The committed actor is captured and snapshotted before the reload awaits:
+ * the slot is writable out-of-band across that await (a wake's stamp, a
+ * pointer elevation), and a read after it would hand the turn that writer's
+ * actor. A reload that fails starts no turn, so the slot is put back to what
+ * it held before, guarded so a writer that legitimately moved it in between
+ * is left alone.
+ */
+async function commitTurnActor(
+  conversation: Conversation,
+  actor: TrustContext | undefined,
+  options: { reloadHistory: boolean },
+): Promise<TrustContext | undefined> {
+  const prior = restingTrust(conversation);
+  if (actor) {
+    conversation.setTrustContext(actor);
+  }
+  const turnTrustContext = restingTrust(conversation);
+  conversation.currentTurnTrustContext = turnTrustContext;
+  if (options.reloadHistory) {
+    try {
+      await conversation.ensureActorScopedHistory();
+    } catch (err) {
+      if (actor && restingTrust(conversation) === actor) {
+        conversation.setTrustContext(prior ?? null);
+      }
+      throw err;
+    }
+  }
+  return turnTrustContext;
+}
+
 async function drainSingleMessage(
   conversation: Conversation,
   next: QueuedMessage,
@@ -748,11 +794,12 @@ async function drainSingleMessage(
   // a different actor's context if a concurrent request mutates the live fields.
   // Trust comes from the queued message, not the live slot: the slot holds
   // whichever actor sent most recently, which is this sender only when nobody
-  // else sent while this message waited. Held in a local as well, because the
-  // field is writable out-of-band across the awaits between here and the loop
-  // call below.
-  const turnTrustContext = next.trustContext ?? restingTrust(conversation);
-  conversation.currentTurnTrustContext = turnTrustContext;
+  // else sent while this message waited.
+  const turnTrustContext = await commitTurnActor(
+    conversation,
+    next.trustContext,
+    { reloadHistory: !steered },
+  );
   conversation.currentTurnChannelCapabilities =
     conversation.channelCapabilities;
 
@@ -1360,9 +1407,12 @@ async function drainBatch(
   // The head's trust governs the batch, which is sound only because
   // `buildPassthroughBatch` refuses to coalesce messages from different
   // actors; without that boundary this would run a tail under the head's
-  // trust. Held in a local for the same reason as the single-message drain.
-  const turnTrustContext = head.trustContext ?? restingTrust(conversation);
-  conversation.currentTurnTrustContext = turnTrustContext;
+  // trust.
+  const turnTrustContext = await commitTurnActor(
+    conversation,
+    head.trustContext,
+    { reloadHistory: true },
+  );
   conversation.currentTurnChannelCapabilities =
     conversation.channelCapabilities;
 
@@ -1840,37 +1890,16 @@ export async function processMessage(
     metadata: callerMetadata,
     trustContext: committingTrustContext,
   } = options;
-  const priorRestingTrust = restingTrust(conversation);
-  if (committingTrustContext) {
-    conversation.setTrustContext(committingTrustContext);
-  }
   // Held in a local as well as on the conversation: the field is writable
   // out-of-band while this turn is in flight (`agent-wake` stamps it and
   // restores the prior value in a `finally`), so reading it back at the agent
   // loop call below would reintroduce the late read this capture exists to
-  // avoid. The local is what the loop runs under. Captured before the history
-  // reload for the same reason: that await is one of the windows a writer can
-  // land in.
-  const turnTrustContext = restingTrust(conversation);
-  conversation.currentTurnTrustContext = turnTrustContext;
-  try {
-    await conversation.ensureActorScopedHistory();
-  } catch (err) {
-    // This is the commitment point for the turn, so the stamp above is
-    // correct, but a reload that fails starts no turn: the conversation must
-    // not be left attributed to a sender that never ran. Guarded on identity
-    // so a writer that legitimately moved the slot across the await keeps it.
-    // Only the resting slot needs putting back; `runAgentLoopImpl` re-seeds
-    // the per-turn field at the head of every turn, so no later dispatch can
-    // inherit it.
-    if (
-      committingTrustContext &&
-      restingTrust(conversation) === committingTrustContext
-    ) {
-      conversation.setTrustContext(priorRestingTrust ?? null);
-    }
-    throw err;
-  }
+  // avoid. The local is what the loop runs under.
+  const turnTrustContext = await commitTurnActor(
+    conversation,
+    committingTrustContext,
+    { reloadHistory: true },
+  );
   conversation.currentTurnAuthContext = conversation.authContext;
   conversation.currentTurnSourceActorPrincipalId =
     sourceActorPrincipalId ?? conversation.authContext?.actorPrincipalId;

package/src/daemon/conversation-skill-tools.ts

@@ -75,13 +75,11 @@ export interface SkillToolProjection {
 }
 
 /**
- * Conversation-scoped cache for skill projection. Avoids re-scanning the
- * conversation history on every agent turn. Catalog membership is not stored
- * here: each projection reads a fresh `loadSkillCatalog()` so newly
- * installed or removed skills are visible on the next turn.
+ * Conversation-scoped cache for skill projection. Avoids re-scanning the entire
+ * conversation history and re-reading the filesystem on every agent turn.
  *
- * Each conversation should own its own cache instance to prevent
- * cross-conversation state bleed.
+ * Each conversation should own its own cache instance to prevent cross-conversation
+ * state bleed.
  */
 export interface SkillProjectionCache {
   /** Cached deriveActiveSkills result. */
@@ -97,6 +95,9 @@ export interface SkillProjectionCache {
     /** The accumulated active skill entries. */
     entries: ActiveSkillEntry[];
   };
+  /** Cached skill catalog. Invalidated when the conversation is marked stale
+   *  (e.g. skill directories changed on disk while a run is in progress). */
+  catalog?: SkillSummary[];
 }
 
 export interface ProjectSkillToolsOptions {
@@ -112,9 +113,9 @@ export interface ProjectSkillToolsOptions {
    */
   previouslyActiveSkillIds?: Map<string, string>;
   /**
-   * Conversation-scoped projection cache. When provided, projectSkillTools
-   * avoids redundant deriveActiveSkills scans across agent turns. Catalog
-   * membership is always a fresh `loadSkillCatalog()` read.
+   * Conversation-scoped projection cache. When provided, projectSkillTools will
+   * avoid redundant deriveActiveSkills scans and loadSkillCatalog filesystem
+   * reads across agent turns.
    */
   cache?: SkillProjectionCache;
   /**
@@ -309,6 +310,23 @@ function getCachedActiveSkills(
   return entries;
 }
 
+/**
+ * Return the skill catalog, caching it across agent turns.
+ *
+ * The cache is invalidated when the conversation is marked stale (e.g. skill
+ * directories changed on disk while the conversation is still processing).
+ */
+function getCachedCatalog(cache?: SkillProjectionCache): SkillSummary[] {
+  if (!cache) {
+    return loadSkillCatalog();
+  }
+
+  if (!cache.catalog) {
+    cache.catalog = loadSkillCatalog();
+  }
+  return cache.catalog;
+}
+
 // ---------------------------------------------------------------------------
 // Main export
 // ---------------------------------------------------------------------------
@@ -345,11 +363,11 @@ export function projectSkillTools(
   const contextIds = contextEntries.map((e) => e.id);
   const allCandidateIds = new Set<string>([...contextIds, ...preactivated]);
 
-  // Load the catalog, then scope it to the conversation's per-chat plugin
-  // selection so plugin-contributed skills from unselected plugins are not
-  // resolvable for this run (null = no restriction).
+  // Load the catalog (cached for conversation lifetime), then scope it to the
+  // conversation's per-chat plugin selection so plugin-contributed skills from
+  // unselected plugins are not resolvable for this run (null = no restriction).
   const catalog = filterSkillsByEnabledPlugins(
-    loadSkillCatalog(),
+    getCachedCatalog(options?.cache),
     options?.effectiveEnabledPluginSet ?? null,
   );
   const catalogById = new Map<string, SkillSummary>();

package/src/daemon/conversation-store.ts

@@ -548,7 +548,7 @@ export function clearAllActiveConversations(): number {
 }
 
 /**
- * Evict in-memory conversations after a config/prompt reload so the next
+ * Evict in-memory conversations after a config/prompt/skills reload so the next
  * turn rebuilds them against the new config. Conversations with in-flight work
  * (a live turn, a queued successor, or an active subagent) are marked stale
  * and rebuilt by `getOrCreateConversation` once that work finishes. Idle

package/src/daemon/conversation-surfaces.ts

@@ -55,7 +55,6 @@ import {
   isActivationMomentParam,
 } from "../telemetry/activation-funnel.js";
 import { resolveAppId } from "../tools/apps/resolve-app-id.js";
-import { formatDesktopAppRequired } from "../tools/capability-offer.js";
 import { POINT_AT_PROXY_TOOL } from "../tools/computer-use/skill-proxy-bridge.js";
 import type { ToolExecutionResult } from "../tools/types.js";
 import { getLogger } from "../util/logger.js";
@@ -2937,7 +2936,7 @@ export function buildAppOpenPreview(
 function describeComputerUseUnavailable(ctx: Conversation): string {
   const capable = assistantEventHub.listClientsByCapability("host_cu");
   if (capable.length === 0) {
-    return formatDesktopAppRequired("screen");
+    return "Computer use is not available — no desktop client connected. Open the Vellum desktop app on the machine you want to control, then retry.";
   }
   return `Computer use is not available for this conversation — ${capable.length} desktop client(s) advertise host_cu, but none of them can be driven from this conversation's interface (${ctx.transportInterface ?? "unknown"}) as its current user.`;
 }
@@ -3252,7 +3251,8 @@ export async function surfaceProxyResolver(
 
     if (!ctx.hostAppControlProxy || !ctx.hostAppControlProxy.isAvailable()) {
       return {
-        content: formatDesktopAppRequired("apps"),
+        content:
+          "App control is not available — enable the `app-control` feature flag and connect a macOS client.",
         isError: true,
       };
     }
@@ -3344,7 +3344,6 @@ export async function surfaceProxyResolver(
     const caps = ctx.channelCapabilities;
     if (
       caps &&
-      !ctx.hasNoClient &&
       !caps.supportsDynamicUi &&
       !isSlackTaskProgressUiException(ctx, toolName, input)
     ) {
@@ -3553,12 +3552,11 @@ export async function surfaceProxyResolver(
           : surfaceType === "table"
             ? hasActions
             : INTERACTIVE_SURFACE_TYPES.includes(surfaceType);
-    // Background turns persist surfaces for a later conversation open and
-    // return immediately. An actionless surface also has nothing to await.
-    const awaitAction =
-      !ctx.hasNoClient &&
-      !isActionless &&
-      ((input.await_action as boolean) ?? isInteractive);
+    // An explicit `await_action: true` is honored for every other type; an
+    // actionless surface has nothing to await, so it is forced false.
+    const awaitAction = isActionless
+      ? false
+      : ((input.await_action as boolean) ?? isInteractive);
 
     // Only one non-persistent interactive surface at a time. If another
     // surface is already awaiting user input, reject this one so the LLM

package/src/daemon/conversation-tool-setup.ts

@@ -28,6 +28,7 @@ import { getAllDefaultPluginNames } from "../plugins/defaults/main.js";
 import { isActivationSession } from "../plugins/defaults/memory/activation-session-store.js";
 import { isPluginDisabled } from "../plugins/disabled-state.js";
 import type { Message, ToolDefinition } from "../providers/types.js";
+import { assistantEventHub } from "../runtime/assistant-event-hub.js";
 import { registerConversationSender } from "../tools/browser/browser-screencast.js";
 import { supportsClientOsForSkillTool } from "../tools/client-os.js";
 import type { ToolExecutor } from "../tools/executor.js";
@@ -259,24 +260,6 @@ export function createToolExecutor(
   // see {@link SubagentToolGateMode}): rejects non-allowlisted calls BEFORE
   // any executor dispatch, so a non-allowlisted tool's executor never runs.
   // The error tool_result lets the model continue or finish.
-  const rejectUnattendedHostTool = (
-    toolName: string,
-  ): ToolExecutionResult | null => {
-    const { transportInterface } = resolveTurnClientOs(ctx);
-    const isUnattended = ctx.currentTurnIsNonInteractive ?? ctx.hasNoClient;
-    if (
-      HOST_TOOL_NAMES.has(toolName) &&
-      isUnattended &&
-      transportInterface !== "chrome-extension"
-    ) {
-      return {
-        content: `The "${toolName}" tool requires an interactive user turn and cannot run in the background.`,
-        isError: true,
-      };
-    }
-    return null;
-  };
-
   const rejectNonAllowlistedTool = (
     toolName: string,
   ): ToolExecutionResult | null => {
@@ -404,10 +387,6 @@ export function createToolExecutor(
       if (rejection) {
         return rejection;
       }
-      const unattendedRejection = rejectUnattendedHostTool(executionName);
-      if (unattendedRejection) {
-        return unattendedRejection;
-      }
     }
 
     if (isDoordashCommand(executionName, executionInput)) {
@@ -571,10 +550,6 @@ export function createToolExecutor(
       if (innerRejection) {
         return innerRejection;
       }
-      const unattendedRejection = rejectUnattendedHostTool(toolName);
-      if (unattendedRejection) {
-        return unattendedRejection;
-      }
 
       // Per-chat plugin scope: reject the resolved inner tool when it belongs
       // to a plugin outside the conversation's effective set.
@@ -653,6 +628,7 @@ export const DEFAULT_PREACTIVATED_SKILL_IDS = ["notifications", "subagent"];
 // ── Conditional tool sets ────────────────────────────────────────────
 
 const UI_SURFACE_TOOL_NAMES = new Set(["ui_show", "ui_update", "ui_dismiss"]);
+const SLACK_TASK_PROGRESS_UI_TOOL_NAMES = new Set(["ui_show", "ui_update"]);
 /**
  * Single source of truth for which tools are host tools and the capability
  * each one requires from the connected client interface. Adding a tool here
@@ -880,26 +856,56 @@ export function isToolActiveForContext(
     return supportsChannelReaction(turnChannel);
   }
   if (UI_SURFACE_TOOL_NAMES.has(name)) {
-    // Surface calls write conversation content. Background turns persist that
-    // content for the next client that opens the conversation, so presence
-    // cannot change whether the model receives these definitions.
-    return true;
+    if (
+      channelCapabilities?.channel === "slack" &&
+      SLACK_TASK_PROGRESS_UI_TOOL_NAMES.has(name)
+    ) {
+      return !hasNoClient;
+    }
+    return channelCapabilities?.supportsDynamicUi ?? !hasNoClient;
   }
   if (HOST_TOOL_NAMES.has(name)) {
     const capability = HOST_TOOL_TO_CAPABILITY.get(name);
     const transport = transportInterface;
 
-    // A transport that does not implement a capability can invoke it through
-    // an eligible same-user client. Client selection happens when the call
-    // runs, so the wire schema stays stable across live and background turns.
+    // Per-capability check is authoritative for structural support: if the
+    // transport cannot service this capability, the tool is filtered out.
     if (transport && capability && !supportsHostProxy(transport, capability)) {
-      return (
+      // Cross-client exception: allow host tools whose capabilities have
+      // cross-client routing infrastructure (Phases 1–3 plus host_browser
+      // via PR #27489) to be exposed for non-host-proxy transports (e.g.
+      // "web", "ios") when at least one capable client is connected via
+      // the event hub. Members of CROSS_CLIENT_EXPOSED_CAPABILITIES
+      // (host_bash, host_file, host_browser) qualify.
+      // chrome-extension transport is excluded as a security boundary
+      // (extension only gets host_browser via its own executor path);
+      // hasNoClient turns are excluded (no interactive approval UI
+      // available).
+      if (
+        capability &&
         CROSS_CLIENT_EXPOSED_CAPABILITIES.has(capability) &&
-        transport !== "chrome-extension"
-      );
+        transport !== "chrome-extension" &&
+        !hasNoClient &&
+        assistantEventHub.listClientsByCapability(capability).length > 0
+      ) {
+        return true;
+      }
+      return false;
     }
 
-    return true;
+    // chrome-extension is its own executor — the extension's popup gates
+    // commands via its own UI, and the transport does not use an SSE-level
+    // interactive approval channel. hasNoClient is intentionally `true` for
+    // chrome-extension turns (chrome-extension is not in INTERACTIVE_INTERFACES)
+    // and must not gate host_browser. Trust the per-capability check.
+    if (transport === "chrome-extension") {
+      return true;
+    }
+
+    // For transports that surface approvals over SSE (macos, backwards-compat
+    // fallback), deny when no client is present so the guardian auto-approve
+    // path cannot execute host commands unattended.
+    return !hasNoClient;
   }
   if (CLIENT_CAPABILITY_TOOL_NAMES.has(name)) {
     if (name === "ask_question" && channelCapabilities?.clientOS === "macos") {

package/src/daemon/conversation.ts

@@ -2366,6 +2366,9 @@ export class Conversation {
 
   markStale(): void {
     this.stale = true;
+    // Invalidate the cached skill catalog so the next projection picks up
+    // filesystem changes (e.g. a skill created during this run).
+    this.skillProjectionCache.catalog = undefined;
   }
 
   isStale(): boolean {