@vellumai/assistant 0.12.1 → 0.12.2-staging.1

package/src/daemon/conversation-tool-setup.ts

@@ -28,7 +28,6 @@ import { getAllDefaultPluginNames } from "../plugins/defaults/main.js";
 import { isActivationSession } from "../plugins/defaults/memory/activation-session-store.js";
 import { isPluginDisabled } from "../plugins/disabled-state.js";
 import type { Message, ToolDefinition } from "../providers/types.js";
-import { assistantEventHub } from "../runtime/assistant-event-hub.js";
 import { registerConversationSender } from "../tools/browser/browser-screencast.js";
 import { supportsClientOsForSkillTool } from "../tools/client-os.js";
 import type { ToolExecutor } from "../tools/executor.js";
@@ -260,6 +259,24 @@ export function createToolExecutor(
   // see {@link SubagentToolGateMode}): rejects non-allowlisted calls BEFORE
   // any executor dispatch, so a non-allowlisted tool's executor never runs.
   // The error tool_result lets the model continue or finish.
+  const rejectUnattendedHostTool = (
+    toolName: string,
+  ): ToolExecutionResult | null => {
+    const { transportInterface } = resolveTurnClientOs(ctx);
+    const isUnattended = ctx.currentTurnIsNonInteractive ?? ctx.hasNoClient;
+    if (
+      HOST_TOOL_NAMES.has(toolName) &&
+      isUnattended &&
+      transportInterface !== "chrome-extension"
+    ) {
+      return {
+        content: `The "${toolName}" tool requires an interactive user turn and cannot run in the background.`,
+        isError: true,
+      };
+    }
+    return null;
+  };
+
   const rejectNonAllowlistedTool = (
     toolName: string,
   ): ToolExecutionResult | null => {
@@ -387,6 +404,10 @@ export function createToolExecutor(
       if (rejection) {
         return rejection;
       }
+      const unattendedRejection = rejectUnattendedHostTool(executionName);
+      if (unattendedRejection) {
+        return unattendedRejection;
+      }
     }
 
     if (isDoordashCommand(executionName, executionInput)) {
@@ -550,6 +571,10 @@ export function createToolExecutor(
       if (innerRejection) {
         return innerRejection;
       }
+      const unattendedRejection = rejectUnattendedHostTool(toolName);
+      if (unattendedRejection) {
+        return unattendedRejection;
+      }
 
       // Per-chat plugin scope: reject the resolved inner tool when it belongs
       // to a plugin outside the conversation's effective set.
@@ -628,7 +653,6 @@ export const DEFAULT_PREACTIVATED_SKILL_IDS = ["notifications", "subagent"];
 // ── Conditional tool sets ────────────────────────────────────────────
 
 const UI_SURFACE_TOOL_NAMES = new Set(["ui_show", "ui_update", "ui_dismiss"]);
-const SLACK_TASK_PROGRESS_UI_TOOL_NAMES = new Set(["ui_show", "ui_update"]);
 /**
  * Single source of truth for which tools are host tools and the capability
  * each one requires from the connected client interface. Adding a tool here
@@ -856,56 +880,26 @@ export function isToolActiveForContext(
     return supportsChannelReaction(turnChannel);
   }
   if (UI_SURFACE_TOOL_NAMES.has(name)) {
-    if (
-      channelCapabilities?.channel === "slack" &&
-      SLACK_TASK_PROGRESS_UI_TOOL_NAMES.has(name)
-    ) {
-      return !hasNoClient;
-    }
-    return channelCapabilities?.supportsDynamicUi ?? !hasNoClient;
+    // Surface calls write conversation content. Background turns persist that
+    // content for the next client that opens the conversation, so presence
+    // cannot change whether the model receives these definitions.
+    return true;
   }
   if (HOST_TOOL_NAMES.has(name)) {
     const capability = HOST_TOOL_TO_CAPABILITY.get(name);
     const transport = transportInterface;
 
-    // Per-capability check is authoritative for structural support: if the
-    // transport cannot service this capability, the tool is filtered out.
+    // A transport that does not implement a capability can invoke it through
+    // an eligible same-user client. Client selection happens when the call
+    // runs, so the wire schema stays stable across live and background turns.
     if (transport && capability && !supportsHostProxy(transport, capability)) {
-      // Cross-client exception: allow host tools whose capabilities have
-      // cross-client routing infrastructure (Phases 1–3 plus host_browser
-      // via PR #27489) to be exposed for non-host-proxy transports (e.g.
-      // "web", "ios") when at least one capable client is connected via
-      // the event hub. Members of CROSS_CLIENT_EXPOSED_CAPABILITIES
-      // (host_bash, host_file, host_browser) qualify.
-      // chrome-extension transport is excluded as a security boundary
-      // (extension only gets host_browser via its own executor path);
-      // hasNoClient turns are excluded (no interactive approval UI
-      // available).
-      if (
-        capability &&
+      return (
         CROSS_CLIENT_EXPOSED_CAPABILITIES.has(capability) &&
-        transport !== "chrome-extension" &&
-        !hasNoClient &&
-        assistantEventHub.listClientsByCapability(capability).length > 0
-      ) {
-        return true;
-      }
-      return false;
-    }
-
-    // chrome-extension is its own executor — the extension's popup gates
-    // commands via its own UI, and the transport does not use an SSE-level
-    // interactive approval channel. hasNoClient is intentionally `true` for
-    // chrome-extension turns (chrome-extension is not in INTERACTIVE_INTERFACES)
-    // and must not gate host_browser. Trust the per-capability check.
-    if (transport === "chrome-extension") {
-      return true;
+        transport !== "chrome-extension"
+      );
     }
 
-    // For transports that surface approvals over SSE (macos, backwards-compat
-    // fallback), deny when no client is present so the guardian auto-approve
-    // path cannot execute host commands unattended.
-    return !hasNoClient;
+    return true;
   }
   if (CLIENT_CAPABILITY_TOOL_NAMES.has(name)) {
     if (name === "ask_question" && channelCapabilities?.clientOS === "macos") {

package/src/daemon/conversation.ts

@@ -2366,9 +2366,6 @@ export class Conversation {
 
   markStale(): void {
     this.stale = true;
-    // Invalidate the cached skill catalog so the next projection picks up
-    // filesystem changes (e.g. a skill created during this run).
-    this.skillProjectionCache.catalog = undefined;
   }
 
   isStale(): boolean {

package/src/daemon/dictation-profile-store.ts

@@ -10,6 +10,7 @@ import { join } from "node:path";
 
 import { getLogger } from "../util/logger.js";
 import { getWorkspaceDir } from "../util/platform.js";
+import { safeStringSlice } from "../util/unicode.js";
 
 const log = getLogger("dictation-profile-store");
 
@@ -130,7 +131,7 @@ function validateAndClampConfig(raw: unknown): DictationProfilesConfig {
         { profileId: profile.id },
         `stylePrompt exceeds ${MAX_STYLE_PROMPT_LENGTH} chars, truncating`,
       );
-      stylePrompt = stylePrompt.slice(0, MAX_STYLE_PROMPT_LENGTH);
+      stylePrompt = safeStringSlice(stylePrompt, 0, MAX_STYLE_PROMPT_LENGTH);
     }
 
     // Validate dictionary entries

package/src/daemon/handlers/shared.ts

@@ -32,6 +32,7 @@ import { unwrapExternalContentForDisplay } from "../../security/untrusted-conten
 import type { CredentialInjectionTemplate } from "../../tools/credentials/policy-types.js";
 import { getLogger } from "../../util/logger.js";
 import { joinWithSpacing } from "../../util/text-spacing.js";
+import { safeStringSlice } from "../../util/unicode.js";
 import { estimateBase64Bytes } from "../assistant-attachments.js";
 import { conversationSupportsDynamicUi } from "../channel-ui-capability.js";
 import { findConversation } from "../conversation-registry.js";
@@ -264,7 +265,7 @@ function clampAttachmentText(text: string): string {
   if (text.length <= HISTORY_ATTACHMENT_TEXT_LIMIT) {
     return text;
   }
-  return `${text.slice(0, HISTORY_ATTACHMENT_TEXT_LIMIT)}<truncated />`;
+  return `${safeStringSlice(text, 0, HISTORY_ATTACHMENT_TEXT_LIMIT)}<truncated />`;
 }
 
 interface FileBlockMetadata {

package/src/daemon/handlers/skills.ts

@@ -82,6 +82,7 @@ import {
   searchSkillsRegistry,
 } from "../../skills/skillssh-registry.js";
 import { getWorkspaceSkillsDir } from "../../util/platform.js";
+import { safeStringSlice } from "../../util/unicode.js";
 import { getConfigWatcher } from "../config-watcher.js";
 import type {
   SkillDetailResponse,
@@ -237,9 +238,11 @@ function heuristicDraft(body: string): {
   const lines = body.split("\n").filter((l) => l.trim());
   const firstLine = lines[0]?.trim() ?? "";
   const name =
-    firstLine.replace(/^#+\s*/, "").slice(0, 100) || "Untitled Skill";
+    safeStringSlice(firstLine.replace(/^#+\s*/, ""), 0, 100) ||
+    "Untitled Skill";
   const skillId = toSkillSlug(name) || "untitled-skill";
-  const description = body.trim().slice(0, 200) || "No description provided";
+  const description =
+    safeStringSlice(body.trim(), 0, 200) || "No description provided";
   return { skillId, name, description, emoji: "\u{1F4DD}" };
 }
 
@@ -1732,7 +1735,7 @@ export async function draftSkill(params: {
               "- emoji: a single emoji character representing the skill",
               "",
               "Skill body:",
-              body.slice(0, 2000),
+              safeStringSlice(body, 0, 2000),
             ].join("\n");
 
             const response = await provider.sendMessage([userMessage(prompt)], {

package/src/daemon/host-bash-proxy.ts

@@ -1,9 +1,9 @@
 import { getConfig } from "../config/loader.js";
 import { assistantEventHub } from "../runtime/assistant-event-hub.js";
 import {
-  ambiguousSameUserError,
   enforceSameActorOrErrorResult,
-  pickSameUserAutoResolve,
+  pickMostRecentSameUserClient,
+  unavailableSameUserClientError,
 } from "../runtime/auth/same-actor.js";
 import * as pendingInteractions from "../runtime/pending-interactions.js";
 import { formatShellOutput } from "../tools/shared/shell-output.js";
@@ -93,21 +93,17 @@ export class HostBashProxy extends HostProxyBase<
       }
       resolvedTargetClientId = input.targetClientId;
     } else {
-      // Auto-resolve to the unique same-user client. Reject (rather than
-      // broadcast) when multiple same-user clients are connected so that
-      // a single targeted-style request cannot fan out across every one
-      // of the user's machines. Zero same-user matches falls through to
-      // the existing untargeted code path.
-      const resolved = pickSameUserAutoResolve({
+      resolvedTargetClientId = pickMostRecentSameUserClient({
         hub: assistantEventHub,
         capability: "host_bash",
         sourceActorPrincipalId,
       });
-      if (resolved.kind === "ambiguous") {
-        return ambiguousSameUserError("host_bash");
+      if (
+        resolvedTargetClientId === undefined &&
+        sourceActorPrincipalId !== undefined
+      ) {
+        return unavailableSameUserClientError("host_bash");
       }
-      resolvedTargetClientId =
-        resolved.kind === "match" ? resolved.clientId : undefined;
     }
 
     // Targeted requests must be bound to the same authenticated user as the

package/src/daemon/host-browser-proxy.ts

@@ -5,7 +5,10 @@ import {
   assistantEventHub,
   broadcastMessage,
 } from "../runtime/assistant-event-hub.js";
-import { enforceSameActorOrErrorResult } from "../runtime/auth/same-actor.js";
+import {
+  enforceSameActorOrErrorResult,
+  unavailableSameUserClientError,
+} from "../runtime/auth/same-actor.js";
 import * as pendingInteractions from "../runtime/pending-interactions.js";
 import type { ToolExecutionResult } from "../tools/types.js";
 import { AssistantError, ErrorCode } from "../util/errors.js";
@@ -284,6 +287,17 @@ export class HostBrowserProxy {
       targetClientId,
     );
 
+    if (
+      preferredClient === undefined &&
+      sourceActorPrincipalId !== undefined &&
+      targetClientId === undefined
+    ) {
+      if (isExtensionOnlyMethod(input.cdpMethod)) {
+        return Promise.resolve(extensionRequiredResult(input.cdpMethod));
+      }
+      return Promise.resolve(unavailableSameUserClientError("host_browser"));
+    }
+
     // Same-user enforcement: when the caller's actor is known, refuse to
     // dispatch to a client owned by a different actor. This covers the
     // cross-client exposure case where a web/iOS turn for actor A would

package/src/daemon/host-cu-proxy.ts

@@ -42,6 +42,11 @@ const MAX_HISTORY_ENTRIES = 10;
 const LOOP_DETECTION_WINDOW = 3;
 const CONSECUTIVE_UNCHANGED_WARNING_THRESHOLD = 2;
 
+const SEQUENCE_TOOL = "computer_use_sequence";
+
+const SCREENSHOT_OMITTED_MESSAGE =
+  "Screenshot omitted: the accessibility tree above is current. Pass include_screenshot: true on computer_use_observe to see the screen.";
+
 // computer_use_key combos that change only selection/cursor/clipboard state.
 // The AX tree models none of these, so they always produce an empty diff —
 // exempt them from the "NO VISIBLE EFFECT" signal (mirrors computer_use_wait).
@@ -113,6 +118,8 @@ export interface CuObservationResult {
   executionResult?: string;
   executionError?: string;
   userGuidance?: string;
+  /** Per-phase helper timings in milliseconds, absent on older helpers. */
+  timings?: Record<string, number>;
 }
 
 export interface ActionRecord {
@@ -161,6 +168,40 @@ function actionSignature(record: ActionRecord): string {
   return `${record.toolName}:${JSON.stringify(record.input)}`;
 }
 
+/**
+ * The key a desktop's first look is tracked under. An untargeted request has
+ * no client id, so it gets a key no real id can take.
+ */
+function observedTargetKey(targetClientId: string | undefined): string {
+  return targetClientId === undefined
+    ? "\u0000untargeted"
+    : `client:${targetClientId}`;
+}
+
+/** Whether `input` scopes the observation to one window or display. */
+function hasCaptureTarget(input: Record<string, unknown>): boolean {
+  return (
+    Object.hasOwn(input, "capture_window_id") ||
+    Object.hasOwn(input, "captureWindowId") ||
+    Object.hasOwn(input, "captureDisplayId")
+  );
+}
+
+/**
+ * Whether the resolved client claimed `capability` on its connection. An
+ * untargeted request has no client to vouch for it, so it never qualifies.
+ */
+function clientAdvertises(
+  targetClientId: string | undefined,
+  capability: "host_cu_window_capture" | "host_cu_sequence",
+): boolean {
+  const client =
+    targetClientId == null
+      ? undefined
+      : assistantEventHub.getClientById(targetClientId);
+  return client?.capabilities.includes(capability) ?? false;
+}
+
 // ---------------------------------------------------------------------------
 // HostCuProxy
 // ---------------------------------------------------------------------------
@@ -172,8 +213,36 @@ export class HostCuProxy {
   private _previousAXTree: string | undefined;
   private _consecutiveUnchangedSteps = 0;
   private _actionHistory: ActionRecord[] = [];
-  /** Owned request IDs mapped to whether their observation is scoped. */
-  private _ownedRequests = new Map<string, boolean>();
+  /**
+   * Desktops an unscoped observation has come back from since the last reset,
+   * keyed by `observedTargetKey`. A first look is per desktop: having seen one
+   * machine says nothing about another the conversation switches to.
+   */
+  private _observedTargets = new Set<string>();
+  /**
+   * Bumped on every reset. A request carries the value it was dispatched
+   * under, so an observation that lands after a reset cannot restore state
+   * that reset cleared.
+   */
+  private _resetGeneration = 0;
+  /**
+   * Owned request IDs mapped to whether their observation is scoped, whether
+   * the helper was told to skip the screenshot, and when the request was
+   * dispatched. The dispatch time gives the round trip, which is the part of
+   * a step the helper's own timings cannot see.
+   */
+  private _ownedRequests = new Map<
+    string,
+    {
+      scoped: boolean;
+      screenshotSkipped: boolean;
+      targetKey: string;
+      resetGeneration: number;
+      dispatchedAt: number;
+      toolName: string;
+      step: number;
+    }
+  >();
 
   constructor(maxSteps = loadConfig().maxStepsPerSession) {
     this._maxSteps = maxSteps;
@@ -288,11 +357,7 @@ export class HostCuProxy {
       }
       // Never dispatch this option to a legacy executor: it would forward the
       // unknown snake-case key and silently capture the entire desktop.
-      const client =
-        resolvedTargetClientId == null
-          ? undefined
-          : assistantEventHub.getClientById(resolvedTargetClientId);
-      if (!client?.capabilities.includes("host_cu_window_capture")) {
+      if (!clientAdvertises(resolvedTargetClientId, "host_cu_window_capture")) {
         return Promise.resolve({
           content:
             "Window-only observation requires a connected client advertising host_cu_window_capture; update the desktop app before retrying. No capture was requested.",
@@ -300,14 +365,40 @@ export class HostCuProxy {
         });
       }
     }
-    const scopedObservation =
-      hasWindowTarget ||
-      Object.hasOwn(input, "captureWindowId") ||
-      Object.hasOwn(input, "captureDisplayId");
+    // An older helper answers an unknown tool name as done, which would end
+    // the session with nothing run.
+    if (
+      toolName === SEQUENCE_TOOL &&
+      !clientAdvertises(resolvedTargetClientId, "host_cu_sequence")
+    ) {
+      return Promise.resolve({
+        content:
+          "Batched actions require a desktop app that supports computer_use_sequence; update the desktop app, or send the actions one at a time. Nothing was run.",
+        isError: true,
+      });
+    }
+    const scopedObservation = hasCaptureTarget(input);
     if (scopedObservation) {
       this._previousAXTree = undefined;
       this._consecutiveUnchangedSteps = 0;
     }
+    const targetKey = observedTargetKey(resolvedTargetClientId);
+    // Pointing never reaches the helper's capture path, so its input goes out
+    // as given. Every other request carries the screenshot decision made now,
+    // at dispatch, and never the model-facing snake_case key.
+    let dispatchInput = input;
+    let screenshotSkipped = false;
+    if (toolName !== POINT_AT_PROXY_TOOL) {
+      const { include_screenshot: _includeScreenshot, ...rest } = input;
+      screenshotSkipped = !this.shouldAttachScreenshot(
+        toolName,
+        input,
+        targetKey,
+      );
+      dispatchInput = screenshotSkipped
+        ? { ...rest, includeScreenshot: false }
+        : rest;
+    }
     const requestId = uuid();
 
     return new Promise<ToolExecutionResult>((resolve, reject) => {
@@ -351,7 +442,15 @@ export class HostCuProxy {
         detachAbort = () => signal.removeEventListener("abort", onAbort);
       }
 
-      this._ownedRequests.set(requestId, scopedObservation);
+      this._ownedRequests.set(requestId, {
+        scoped: scopedObservation,
+        screenshotSkipped,
+        targetKey,
+        resetGeneration: this._resetGeneration,
+        dispatchedAt: Date.now(),
+        toolName,
+        step: stepNumber,
+      });
 
       pendingInteractions.register(requestId, {
         conversationId,
@@ -375,7 +474,7 @@ export class HostCuProxy {
             requestId,
             conversationId,
             toolName,
-            input,
+            input: dispatchInput,
             stepNumber,
             reasoning,
             ...(resolvedTargetClientId != null
@@ -403,7 +502,8 @@ export class HostCuProxy {
     requestId: string,
     observation: CuObservationResult,
   ): ToolExecutionResult | undefined {
-    const scopedObservation = this._ownedRequests.get(requestId) ?? false;
+    const owned = this._ownedRequests.get(requestId);
+    const scopedObservation = owned?.scoped ?? false;
     this._ownedRequests.delete(requestId);
     const interaction = pendingInteractions.resolve(requestId, "answered");
     if (!interaction?.rpcResolve) {
@@ -411,9 +511,33 @@ export class HostCuProxy {
       return undefined;
     }
 
+    // Label the line from what this request was dispatched with, never from
+    // current proxy state. One model response can dispatch several CU tools,
+    // and the agent loop runs them concurrently, so a later call can advance
+    // the history and the step count before an earlier observation lands.
+    // Reading them here would file each measurement under whichever tool was
+    // dispatched last, and would mislabel computer_use_point_at, which never
+    // records an action at all.
+    if (owned) {
+      log.info(
+        {
+          requestId,
+          toolName: owned.toolName,
+          step: owned.step,
+          roundTripMs: Date.now() - owned.dispatchedAt,
+          ...(observation.timings ? { helper: observation.timings } : {}),
+        },
+        "Host CU step timings",
+      );
+    }
+
     // A targeted snapshot has no comparable action/diff baseline; neither it
     // nor the first desktop observation after it can imply "no visible effect".
-    if (scopedObservation) {
+    // A response dispatched before the last reset belongs to a finished run,
+    // so it must not change any state the new run has started building.
+    const fromCurrentRun =
+      owned === undefined || owned.resetGeneration === this._resetGeneration;
+    if (scopedObservation && fromCurrentRun) {
       this._previousAXTree = undefined;
       this._consecutiveUnchangedSteps = 0;
     }
@@ -421,10 +545,24 @@ export class HostCuProxy {
     const comparableObservation = scopedObservation
       ? { ...observation, axDiff: undefined, secondaryWindows: undefined }
       : observation;
-    if (!scopedObservation) {
+    // Pointing observes nothing, so its response leaves the screen state alone.
+    if (
+      fromCurrentRun &&
+      !scopedObservation &&
+      owned?.toolName !== POINT_AT_PROXY_TOOL
+    ) {
       this.updateStateFromObservation(comparableObservation);
+      // A desktop has had its first look only once pixels from it arrived,
+      // so a failed capture leaves the next request asking again.
+      if (owned && observation.screenshot) {
+        this._observedTargets.add(owned.targetKey);
+      }
     }
-    const result = this.formatObservation(comparableObservation, prevAXTree);
+    const result = this.formatObservation(
+      comparableObservation,
+      prevAXTree,
+      owned?.screenshotSkipped ?? false,
+    );
     interaction.rpcResolve(result);
     return result;
   }
@@ -460,6 +598,27 @@ export class HostCuProxy {
     this._previousAXTree = undefined;
     this._consecutiveUnchangedSteps = 0;
     this._actionHistory = [];
+    this._observedTargets.clear();
+    this._resetGeneration++;
+  }
+
+  /**
+   * Whether the request about to be dispatched should carry a screenshot. The
+   * accessibility tree comes back every step. Pixels come back on the first
+   * look since the last reset, for a window- or display-scoped capture, and
+   * when the model asks for them. Otherwise whether the tree is enough is the
+   * model's call.
+   */
+  private shouldAttachScreenshot(
+    toolName: string,
+    input: Record<string, unknown>,
+    targetKey: string,
+  ): boolean {
+    return (
+      !this._observedTargets.has(targetKey) ||
+      hasCaptureTarget(input) ||
+      (toolName === "computer_use_observe" && input.include_screenshot === true)
+    );
   }
 
   // ---------------------------------------------------------------------------
@@ -474,6 +633,7 @@ export class HostCuProxy {
   formatObservation(
     obs: CuObservationResult,
     previousAXTree?: string,
+    screenshotSkipped = false,
   ): ToolExecutionResult {
     const prevTree = previousAXTree;
     const parts: string[] = [];
@@ -552,6 +712,15 @@ export class HostCuProxy {
       parts.push(...screenshotMeta);
     }
 
+    // Only a deliberate omission is announced, and only beside a tree the line
+    // can point at. A step that asked for pixels and got none is a capture
+    // failure, which this line must not disguise. A refused or failed step
+    // still carries the line, since that is where asking for pixels helps most.
+    const isError = obs.executionError != null;
+    if (screenshotSkipped && !obs.screenshot && obs.axTree) {
+      parts.push("", SCREENSHOT_OMITTED_MESSAGE);
+    }
+
     const content = parts.join("\n").trim() || "Action executed";
 
     const contentBlocks: ContentBlock[] = [];
@@ -566,8 +735,6 @@ export class HostCuProxy {
       });
     }
 
-    const isError = obs.executionError != null;
-
     return {
       content: isError
         ? `Action failed: ${obs.executionError}\n\n${content}`

package/src/daemon/host-file-proxy.ts

@@ -6,10 +6,10 @@ import {
   broadcastMessage,
 } from "../runtime/assistant-event-hub.js";
 import {
-  ambiguousSameUserError,
   enforceSameActorOrErrorResult,
-  pickSameUserAutoResolve,
+  pickMostRecentSameUserClient,
   snapshotHostProxyActorPrincipalId,
+  unavailableSameUserClientError,
 } from "../runtime/auth/same-actor.js";
 import * as pendingInteractions from "../runtime/pending-interactions.js";
 import { readAudioBase64 } from "../tools/shared/filesystem/audio-read.js";
@@ -102,19 +102,17 @@ export class HostFileProxy {
         });
       }
     } else {
-      // Auto-resolve to the unique same-user client. Reject ambiguous
-      // (multi-machine) cases so a single targeted-style request cannot
-      // fan out across the user's machines.
-      const resolved = pickSameUserAutoResolve({
+      resolvedTargetClientId = pickMostRecentSameUserClient({
         hub: assistantEventHub,
         capability: "host_file",
         sourceActorPrincipalId,
       });
-      if (resolved.kind === "ambiguous") {
-        return Promise.resolve(ambiguousSameUserError("host_file"));
+      if (
+        resolvedTargetClientId === undefined &&
+        sourceActorPrincipalId !== undefined
+      ) {
+        return Promise.resolve(unavailableSameUserClientError("host_file"));
       }
-      resolvedTargetClientId =
-        resolved.kind === "match" ? resolved.clientId : undefined;
     }
 
     // Same-user check: targeted host_file requests must be bound to the same

package/src/daemon/host-proxy-preactivation.ts

@@ -105,12 +105,13 @@ export const HOST_PROXY_SKILL_PREACTIVATIONS: ReadonlyArray<{
  */
 /**
  * Capabilities a client asks for on its connection rather than getting from
- * what it is. Both ride the host_cu transport and are answered only by a
+ * what it is. Each rides the host_cu transport and is answered only by a
  * macOS build new enough to send the header (`events-routes.ts`), so the
  * interface alone cannot say whether one is really there.
  */
 const NEGOTIATED_CAPABILITIES: ReadonlySet<HostProxyCapability> = new Set([
   "host_cu_window_capture",
+  "host_cu_sequence",
   "host_cu_annotate",
 ]);