@vellumai/assistant 0.12.1 → 0.12.2-staging.1

package/src/__tests__/credential-routes.test.ts

@@ -1,6 +1,10 @@
 import { beforeEach, describe, expect, mock, test } from "bun:test";
 
-import { BadRequestError, ForbiddenError } from "../runtime/routes/errors.js";
+import {
+  BadRequestError,
+  ForbiddenError,
+  InternalError,
+} from "../runtime/routes/errors.js";
 import type { CredentialMetadata } from "../tools/credentials/metadata-store.js";
 
 // ---------------------------------------------------------------------------
@@ -15,6 +19,8 @@ let disconnectedProviders: string[];
 let credentialIdCounter: number;
 let scrubbedValues: string[];
 let scrubRejects: boolean;
+let liveRecordsUnreachable: boolean;
+let secretGetUnreachable: boolean;
 
 function metaKey(service: string, field: string): string {
   return `${service}:${field}`;
@@ -49,7 +55,7 @@ mock.module("../security/secure-keys.js", () => ({
   getSecureKeyAsync: mock(async (key: string) => secureStore.get(key)),
   getSecureKeyResultAsync: mock(async (key: string) => ({
     value: secureStore.get(key),
-    unreachable: false,
+    unreachable: secretGetUnreachable,
   })),
   deleteSecureKeyAsync: mock(async (key: string) =>
     secureStore.delete(key) ? "deleted" : "not-found",
@@ -60,7 +66,10 @@ mock.module("../security/secure-keys.js", () => ({
 
 mock.module("../tools/credentials/metadata-store.js", () => ({
   assertMetadataWritable: () => {},
-  listCredentialMetadata: mock(() => Array.from(metadataStore.values())),
+  listCredentialRecordsLive: mock(async () => ({
+    records: Array.from(metadataStore.values()),
+    unreachable: liveRecordsUnreachable,
+  })),
   getCredentialMetadata: mock((service: string, field: string) =>
     metadataStore.get(metaKey(service, field)),
   ),
@@ -201,6 +210,8 @@ describe("credentials routes", () => {
     credentialIdCounter = 0;
     scrubbedValues = [];
     scrubRejects = false;
+    liveRecordsUnreachable = false;
+    secretGetUnreachable = false;
     _resetRevealSuccessRegistryForTest();
     resetForChatMintRegistryForTest();
     chatCredentialRevealFlag = false;
@@ -799,6 +810,204 @@ describe("credentials routes", () => {
       expect(result.credentials).toHaveLength(1);
       expect(result.credentials[0].service).toBe("github");
     });
+
+    test("fails immediately when the credential vault is unreachable", async () => {
+      liveRecordsUnreachable = true;
+      await setRoute!.handler({
+        body: { service: "vercel", field: "api_token", value: SECRET_VALUE },
+      });
+
+      await expect(listRoute!.handler({ body: {} })).rejects.toThrow(
+        InternalError,
+      );
+      await expect(listRoute!.handler({ body: {} })).rejects.toThrow(
+        /Credential store is unreachable/,
+      );
+    });
+
+    test("fails immediately when a secret fetch reports the vault unreachable", async () => {
+      await setRoute!.handler({
+        body: { service: "vercel", field: "api_token", value: SECRET_VALUE },
+      });
+      secretGetUnreachable = true;
+
+      await expect(listRoute!.handler({ body: {} })).rejects.toThrow(
+        InternalError,
+      );
+    });
+  });
+
+  describe("platform-managed credentials", () => {
+    const PLATFORM_KEY = "vk-platform-provisioned-key";
+    const PLATFORM_BASE_URL = "https://platform.example";
+
+    /**
+     * The platform provisions the pod's own credentials by POSTing them to
+     * `/v1/secrets` as `credential` entries, which land in the same secure
+     * store and metadata table as a user's own credentials.
+     */
+    function seedPlatformCredential(field: string, value: string): string {
+      const key = `vellum:${field}`;
+      secureStore.set(key, value);
+      const now = Date.now();
+      metadataStore.set(key, {
+        credentialId: `cred-${++credentialIdCounter}`,
+        service: "vellum",
+        field,
+        allowedTools: [],
+        allowedDomains: [],
+        createdAt: now,
+        updatedAt: now,
+      });
+      return metadataStore.get(key)!.credentialId;
+    }
+
+    test("the listing omits platform credentials and keeps the user's own", async () => {
+      // GIVEN the platform's provisioned credentials alongside a user's
+      seedPlatformCredential("assistant_api_key", PLATFORM_KEY);
+      seedPlatformCredential("platform_base_url", PLATFORM_BASE_URL);
+      await setRoute!.handler({
+        body: { service: "vercel", field: "api_token", value: SECRET_VALUE },
+      });
+
+      // WHEN the credentials are listed
+      const result = (await listRoute!.handler({ body: {} })) as ListResponse;
+
+      // THEN only the user's credential is a row, and no platform value leaks
+      expect(result.credentials.map((c) => `${c.service}:${c.field}`)).toEqual([
+        "vercel:api_token",
+      ]);
+      expect(JSON.stringify(result)).not.toContain(PLATFORM_KEY);
+    });
+
+    test("reveal refuses the platform API key for every principal", async () => {
+      /**
+       * Both farming paths land on this handler: the assistant's own tool
+       * shell arrives as `local`, a Settings click as `user`.
+       */
+      seedPlatformCredential("assistant_api_key", PLATFORM_KEY);
+
+      for (const principal of ["local", "user", "svc_gateway"]) {
+        await expect(
+          revealRoute!.handler({
+            body: { service: "vellum", field: "assistant_api_key" },
+            headers: { "x-vellum-principal-type": principal },
+          }),
+        ).rejects.toThrow(ForbiddenError);
+      }
+    });
+
+    test("reveal refuses a platform credential looked up by UUID", async () => {
+      const credentialId = seedPlatformCredential(
+        "assistant_api_key",
+        PLATFORM_KEY,
+      );
+
+      await expect(
+        revealRoute!.handler({
+          body: { id: credentialId },
+          headers: { "x-vellum-principal-type": "local" },
+        }),
+      ).rejects.toThrow(/owned by the Vellum platform/);
+    });
+
+    test("inspect refuses platform credentials", async () => {
+      seedPlatformCredential("assistant_api_key", PLATFORM_KEY);
+      seedPlatformCredential("platform_base_url", PLATFORM_BASE_URL);
+
+      for (const field of ["assistant_api_key", "platform_base_url"]) {
+        await expect(
+          inspectRoute!.handler({
+            body: { service: "vellum", field },
+          }),
+        ).rejects.toThrow(ForbiddenError);
+      }
+    });
+
+    test("set refuses platform credentials", async () => {
+      /**
+       * A write is a read by another name: repointing `platform_base_url`
+       * sends the next platform call, bearing the API key, to a host the
+       * writer chose. The platform's own provisioning does not come through
+       * this route; it writes over `POST /v1/secrets`.
+       */
+      for (const field of ["assistant_api_key", "platform_base_url"]) {
+        await expect(
+          setRoute!.handler({
+            body: { service: "vellum", field, value: "https://attacker.test" },
+          }),
+        ).rejects.toThrow(ForbiddenError);
+      }
+
+      expect(secureStore.has("vellum:assistant_api_key")).toBe(false);
+      expect(secureStore.has("vellum:platform_base_url")).toBe(false);
+    });
+
+    test("set does not overwrite an already-provisioned platform credential", async () => {
+      seedPlatformCredential("platform_base_url", PLATFORM_BASE_URL);
+
+      await expect(
+        setRoute!.handler({
+          body: {
+            service: "vellum",
+            field: "platform_base_url",
+            value: "https://attacker.test",
+          },
+        }),
+      ).rejects.toThrow(/owned by the Vellum platform/);
+
+      expect(secureStore.get("vellum:platform_base_url")).toBe(
+        PLATFORM_BASE_URL,
+      );
+    });
+
+    test("delete refuses platform credentials", async () => {
+      seedPlatformCredential("assistant_api_key", PLATFORM_KEY);
+      seedPlatformCredential("platform_base_url", PLATFORM_BASE_URL);
+
+      for (const field of ["assistant_api_key", "platform_base_url"]) {
+        await expect(
+          deleteRoute!.handler({ body: { service: "vellum", field } }),
+        ).rejects.toThrow(ForbiddenError);
+      }
+
+      expect(secureStore.get("vellum:assistant_api_key")).toBe(PLATFORM_KEY);
+      expect(secureStore.get("vellum:platform_base_url")).toBe(
+        PLATFORM_BASE_URL,
+      );
+    });
+
+    test("a user credential is still writable and deletable", async () => {
+      const stored = (await setRoute!.handler({
+        body: { service: "vercel", field: "api_token", value: SECRET_VALUE },
+      })) as SetResponse;
+      expect(stored.service).toBe("vercel");
+      expect(secureStore.get("vercel:api_token")).toBe(SECRET_VALUE);
+
+      const deleted = (await deleteRoute!.handler({
+        body: { service: "vercel", field: "api_token" },
+      })) as DeleteResponse;
+      expect(deleted.field).toBe("api_token");
+      expect(secureStore.has("vercel:api_token")).toBe(false);
+    });
+
+    test("a user credential still inspects and reveals", async () => {
+      seedPlatformCredential("assistant_api_key", PLATFORM_KEY);
+      await setRoute!.handler({
+        body: { service: "vercel", field: "api_token", value: SECRET_VALUE },
+      });
+
+      const inspected = (await inspectRoute!.handler({
+        body: { service: "vercel", field: "api_token" },
+      })) as { scrubbedValue: string };
+      expect(inspected.scrubbedValue).toBe("supe****");
+
+      const revealed = (await revealRoute!.handler({
+        body: { service: "vercel", field: "api_token" },
+        headers: { "x-vellum-principal-type": "user" },
+      })) as { value: string };
+      expect(revealed.value).toBe(SECRET_VALUE);
+    });
   });
 
   describe("platform-managed credentials", () => {

package/src/__tests__/credential-security-invariants.test.ts

@@ -204,6 +204,7 @@ describe("Invariant 2: no generic plaintext secret read API", () => {
       "providers/registry.ts", // provider registry API key lookup for initialization
       "providers/inference/resolve-auth.ts", // provider_connection auth resolver (api_key path reads vault, mirrors registry.ts)
       "providers/inference/codex-token-refresh.ts", // Codex OAuth token refresh (reads/writes access_token, refresh_token, expires_at)
+      "providers/inference/service-account-token.ts", // Google service-account JWT exchange (reads service-account JSON, writes token_cache blob)
       "providers/inference/chatgpt-subscription-credentials.ts", // ChatGPT subscription sign-in token storage, shared by the daemon routes and the CLI (setSecureKeyAsync only; no reads)
       "providers/provider-availability.ts", // provider availability API key check
       "media/image-credentials.ts", // shared image-gen credential resolver (provider API key lookup)
@@ -211,7 +212,8 @@ describe("Invariant 2: no generic plaintext secret read API", () => {
       "persistence/llm-request-log-source-clickhouse.ts", // ClickHouse read source — lazy lookup of clickhouse:url + clickhouse:password + vellum:platform_assistant_id for self-scoped mirror reads
       "persistence/llm-request-log-sink-clickhouse.ts", // ClickHouse write sink — lazy lookup of clickhouse:url + clickhouse:password + vellum:platform_assistant_id for self-scoped log writes
       "persistence/compaction-log-store-clickhouse.ts", // ClickHouse compaction log writer — lazy lookup of clickhouse:url + clickhouse:password + vellum:platform_assistant_id for self-scoped event writes
-      "config/platform-rehydration.ts", // startup rehydration of platform base URL + IDs from credential store (daemon and schedule worker)
+      "config/platform-identity.ts", // assistant API key lookup for platform identity validate
+      "config/platform-rehydration.ts", // startup rehydration of platform base URL from the credential store and ids from platform validate
       "workspace/migrations/006-services-config.ts", // services config migration reads provider API keys
       "workspace/migrations/018-rekey-compound-credential-keys.ts", // re-key compound credential storage keys
       "daemon/conversation-process.ts", // masked provider key display
@@ -224,7 +226,7 @@ describe("Invariant 2: no generic plaintext secret read API", () => {
       "runtime/routes/sanity-routes.ts", // Sanity connect/discover routes (reads stored api_token from credential store)
       "runtime/routes/platform-routes.ts", // CLI platform connect/disconnect/status routes (CLI-migrated to IPC)
       "runtime/routes/roadmap-routes.ts", // signs public-roadmap calls with the assistant API key (outbound Authorization header only; the value never reaches a response, a log, or the CLI process)
-      "inbound/platform-callback-registration.ts", // managed credential lookup for platform base URL, assistant ID, and API key
+      "inbound/platform-callback-registration.ts", // managed credential lookup for platform base URL and API key
       "tts/providers/elevenlabs-provider.ts", // ElevenLabs TTS API key lookup
       "tts/providers/deepgram-provider.ts", // Deepgram TTS API key lookup
       "tts/providers/xai-provider.ts", // xAI TTS API key lookup

package/src/__tests__/cu-unified-flow.test.ts

@@ -224,7 +224,10 @@ describe("surfaceProxyResolver — CU tool routing", () => {
       );
 
       expect(result.isError).toBe(true);
-      expect(result.content).toContain("no desktop client connected");
+      expect(result.content).toContain(
+        "The Vellum desktop app is needed to view or control your screen",
+      );
+      expect(result.content).toContain("https://www.vellum.ai/downloads");
     });
 
     test("returns error when proxy exists but client not connected", async () => {
@@ -237,7 +240,10 @@ describe("surfaceProxyResolver — CU tool routing", () => {
       });
 
       expect(result.isError).toBe(true);
-      expect(result.content).toContain("no desktop client connected");
+      expect(result.content).toContain(
+        "The Vellum desktop app is needed to view or control your screen",
+      );
+      expect(result.content).toContain("https://www.vellum.ai/downloads");
       proxyObj.dispose();
     });
 

package/src/__tests__/document-sync-tags.test.ts

@@ -143,6 +143,31 @@ describe("document write routes publish documents:list", () => {
     expectDocumentsChanged(events);
   });
 
+  test("an existing document with a missing conversation can save before relinking", async () => {
+    await saveViaRoute();
+    const db = getDb();
+    db.run("PRAGMA foreign_keys = OFF");
+    try {
+      db.run("DELETE FROM conversations");
+    } finally {
+      db.run("PRAGMA foreign_keys = ON");
+    }
+
+    await expect(
+      saveViaRoute({ title: "Renamed notes", content: "Edited body" }),
+    ).resolves.toMatchObject({ success: true, surfaceId: "doc-sync" });
+    createConversation({ id: OTHER_CONVERSATION_ID });
+    await expect(
+      linkViaRoute("doc-sync", OTHER_CONVERSATION_ID),
+    ).resolves.toMatchObject({ success: true });
+    await expect(
+      invoke("getDocument", { pathParams: { id: "doc-sync" } }),
+    ).resolves.toMatchObject({
+      title: "Renamed notes",
+      content: "Edited body",
+    });
+  });
+
   test("a content-only save publishes", async () => {
     // The save moves `updated_at` and the word count, which order and fill the
     // Library and the assets list on every other client. The saving client

package/src/__tests__/drain-kick-guard.test.ts

@@ -79,8 +79,6 @@ function makeFakeConversation(
     getTurnInterfaceContext: () => null,
     setTurnInterfaceContext: () => {},
     setTransportHints: () => {},
-    setTrustContext: () => {},
-    ensureActorScopedHistory: async () => {},
     emitActivityState: () => {
       if (activityFailures > 0) {
         activityFailures -= 1;

package/src/__tests__/drain-requeue-on-contention.test.ts

@@ -78,12 +78,6 @@ function makeFakeConversation(options: {
     setTransportHints: () => {
       mutationCalls.push("setTransportHints");
     },
-    setTrustContext: () => {
-      mutationCalls.push("setTrustContext");
-    },
-    ensureActorScopedHistory: async () => {
-      mutationCalls.push("ensureActorScopedHistory");
-    },
     emitActivityState: () => {
       mutationCalls.push("emitActivityState");
     },

package/src/__tests__/evict-conversations-for-reload.test.ts

@@ -1,6 +1,6 @@
 /**
  * `evictConversationsForReload` drops in-memory conversations after a
- * config/prompt/skills reload so the next turn rebuilds them against the new
+ * config/prompt reload so the next turn rebuilds them against the new
  * config. Queued messages live only on the instance being disposed, so the
  * same "not idle while a queue is pending" rule the periodic evictor applies
  * has to hold here: `isProcessing()` reads false in the window between a turn

package/src/__tests__/git-porcelain.test.ts

@@ -0,0 +1,47 @@
+import { describe, expect, test } from "bun:test";
+
+import {
+  collectDirtyPathsFromPorcelain,
+  parsePorcelainZ,
+} from "../workspace/git-porcelain.js";
+
+describe("parsePorcelainZ", () => {
+  test("parses ordinary modified and untracked records", () => {
+    expect(parsePorcelainZ("M  tracked.txt\0?? new.txt\0")).toEqual([
+      { status: "M ", path: "tracked.txt" },
+      { status: "??", path: "new.txt" },
+    ]);
+  });
+
+  test("captures rename origin on the same record", () => {
+    expect(parsePorcelainZ("R  dest.txt\0src.txt\0")).toEqual([
+      { status: "R ", path: "dest.txt", origin: "src.txt" },
+    ]);
+  });
+
+  test("captures copy origin on the same record", () => {
+    expect(parsePorcelainZ("C  dest.txt\0src.txt\0")).toEqual([
+      { status: "C ", path: "dest.txt", origin: "src.txt" },
+    ]);
+  });
+
+  test("skips short leftover NUL entries", () => {
+    expect(parsePorcelainZ("M  a.txt\0\0")).toEqual([
+      { status: "M ", path: "a.txt" },
+    ]);
+  });
+});
+
+describe("collectDirtyPathsFromPorcelain", () => {
+  test("flattens rename origin so both paths are staged", () => {
+    expect(
+      collectDirtyPathsFromPorcelain("R  dest.txt\0src.txt\0?? extra.txt\0"),
+    ).toEqual(["dest.txt", "src.txt", "extra.txt"]);
+  });
+
+  test("dedupes a path that appears as both origin and destination", () => {
+    expect(collectDirtyPathsFromPorcelain("R  same.txt\0same.txt\0")).toEqual([
+      "same.txt",
+    ]);
+  });
+});

package/src/__tests__/heartbeat-service.test.ts

@@ -557,52 +557,52 @@ describe("HeartbeatService", () => {
     expect(processMessageCalls).toHaveLength(1);
   });
 
-    test("active hours handles overnight window", async () => {
-      setHeartbeatConfig({ activeHoursStart: 22, activeHoursEnd: 6 });
+  test("active hours handles overnight window", async () => {
+    setHeartbeatConfig({ activeHoursStart: 22, activeHoursEnd: 6 });
 
-      // 23:00 should be within the window
-      const service = createService({ getCurrentHour: () => 23 });
-      await service.runOnce();
-      expect(processMessageCalls).toHaveLength(1);
+    // 23:00 should be within the window
+    const service = createService({ getCurrentHour: () => 23 });
+    await service.runOnce();
+    expect(processMessageCalls).toHaveLength(1);
 
-      // 10:00 should be outside the window
-      processMessageCalls.length = 0;
-      createdConversations.length = 0;
-      const service2 = createService({ getCurrentHour: () => 10 });
-      await service2.runOnce();
-      expect(processMessageCalls).toHaveLength(0);
-    });
+    // 10:00 should be outside the window
+    processMessageCalls.length = 0;
+    createdConversations.length = 0;
+    const service2 = createService({ getCurrentHour: () => 10 });
+    await service2.runOnce();
+    expect(processMessageCalls).toHaveLength(0);
+  });
 
-    test("active hours guard uses user timezone in interval mode", async () => {
-      setConfig("ui", { detectedTimezone: "America/Los_Angeles" });
-      setHeartbeatConfig({
-        cronExpression: null,
-        timezone: null,
-        activeHoursStart: 8,
-        activeHoursEnd: 22,
-      });
+  test("active hours guard uses user timezone in interval mode", async () => {
+    setConfig("ui", { detectedTimezone: "America/Los_Angeles" });
+    setHeartbeatConfig({
+      cronExpression: null,
+      timezone: null,
+      activeHoursStart: 8,
+      activeHoursEnd: 22,
+    });
 
-      // 23:00 UTC is 16:00 Pacific (inside 8-22) and 23:00 host-local
-      // (outside 8-22). If the guard still used the host clock this would skip.
-      const inside = createService({
-        now: () => new Date("2026-09-08T23:00:00Z"),
-        getCurrentHour: () => 23,
-      });
-      expect(await inside.runOnce()).toBe(true);
-      expect(processMessageCalls).toHaveLength(1);
+    // 23:00 UTC is 16:00 Pacific (inside 8-22) and 23:00 host-local
+    // (outside 8-22). If the guard still used the host clock this would skip.
+    const inside = createService({
+      now: () => new Date("2026-09-08T23:00:00Z"),
+      getCurrentHour: () => 23,
+    });
+    expect(await inside.runOnce()).toBe(true);
+    expect(processMessageCalls).toHaveLength(1);
 
-      processMessageCalls.length = 0;
-      createdConversations.length = 0;
+    processMessageCalls.length = 0;
+    createdConversations.length = 0;
 
-      // 06:00 UTC is 23:00 Pacific, outside 8-22, even though 6 is inside
-      // a naive UTC 8-22 window.
-      const outside = createService({
-        now: () => new Date("2026-09-09T06:00:00Z"),
-        getCurrentHour: () => 6,
-      });
-      expect(await outside.runOnce()).toBe(false);
-      expect(processMessageCalls).toHaveLength(0);
+    // 06:00 UTC is 23:00 Pacific, outside 8-22, even though 6 is inside
+    // a naive UTC 8-22 window.
+    const outside = createService({
+      now: () => new Date("2026-09-09T06:00:00Z"),
+      getCurrentHour: () => 6,
     });
+    expect(await outside.runOnce()).toBe(false);
+    expect(processMessageCalls).toHaveLength(0);
+  });
 
   test("overlap prevention works", async () => {
     let resolveFirst: () => void;
@@ -1004,7 +1004,23 @@ describe("HeartbeatService", () => {
         "slack",
       ]);
 
-      expect(prompt).toContain("google, slack");
+      expect(prompt).toContain(
+        "google (integration, acts as the connected person), slack (integration, acts as the connected person)",
+      );
+    });
+
+    test("prompt tells an integration apart from the channel bot of the same name", () => {
+      const service = createService();
+      const { prompt } = service.buildPrompt("- Check things", ["slack"]);
+
+      expect(prompt).toContain(
+        "slack (integration, acts as the connected person)",
+      );
+      expect(prompt).not.toContain("slack_channel");
+      expect(prompt).toContain("A channel bot is the assistant's own identity");
+
+      const bot = service.buildPrompt("- Check things", ["slack_channel"]);
+      expect(bot.prompt).toContain("slack_channel (the slack channel bot)");
     });
   });
 

package/src/__tests__/helpers/set-workspace-mcp.ts

@@ -0,0 +1,11 @@
+/**
+ * Seed `$VELLUM_WORKSPACE_DIR/mcp.json` for tests that go through the
+ * real workspace MCP loader.
+ */
+
+import type { McpConfig } from "../../config/schemas/mcp.js";
+import { saveWorkspaceMcpConfig } from "../../mcp/workspace-mcp-config.js";
+
+export function setWorkspaceMcp(servers: McpConfig["servers"]): void {
+  saveWorkspaceMcpConfig({ servers });
+}

package/src/__tests__/host-bash-proxy.test.ts

@@ -669,23 +669,31 @@ describe("HostBashProxy", () => {
       expect(sentMessages).toHaveLength(0);
     });
 
-    test("rejects ambiguously when multiple same-user capable clients are connected and no targetClientId", async () => {
-      // Regression: previously fell through to untargeted broadcast, fanning
-      // a single targeted-style request out across every same-user machine.
+    test("selects the most recently active same-user client when several are connected", async () => {
       setup();
       setupMultipleClients(["client-1", "client-2", "client-3"]);
 
-      const result = await proxy.request(
+      const resultPromise = proxy.request(
         { command: "echo hello" },
         "session-1",
         undefined,
         "user-A",
       );
 
-      expect(result.isError).toBe(true);
-      expect(result.content).toContain("target_client_id");
-      // No broadcast happened
-      expect(sentMessages).toHaveLength(0);
+      const sent = sentMessages[0] as Record<string, unknown>;
+      expect(sent.targetClientId).toBe("client-1");
+      const options = sentMessageOptions[0] as
+        | Record<string, unknown>
+        | undefined;
+      expect(options?.targetClientId).toBe("client-1");
+
+      proxy.resolveResult(sent.requestId as string, {
+        stdout: "hello\n",
+        stderr: "",
+        exitCode: 0,
+        timedOut: false,
+      });
+      expect((await resultPromise).isError).toBe(false);
     });
 
     test("falls through to broadcast when zero capable clients (existing timeout path)", async () => {
@@ -832,30 +840,19 @@ describe("HostBashProxy", () => {
       expect(sentMessages).toHaveLength(0);
     });
 
-    test("untargeted local flow unchanged when no auto-resolve match", async () => {
+    test("rejects when the actor has no capable client", async () => {
       setup();
-      // No capable clients connected — untargeted path runs.
 
-      const resultPromise = proxy.request(
+      const result = await proxy.request(
         { command: "echo hello" },
         "session-1",
         undefined,
         "user-A",
       );
 
-      expect(sentMessages).toHaveLength(1);
-      const sent = sentMessages[0] as Record<string, unknown>;
-      expect(sent.type).toBe("host_bash_request");
-      expect(sent.targetClientId).toBeUndefined();
-
-      const requestId = sent.requestId as string;
-      proxy.resolveResult(requestId, {
-        stdout: "hello\n",
-        stderr: "",
-        exitCode: 0,
-        timedOut: false,
-      });
-      await resultPromise;
+      expect(result).toMatchObject({ isError: true });
+      expect(result.content).toContain("belongs to this user");
+      expect(sentMessages).toHaveLength(0);
     });
 
     test("auto-resolve to same-user client succeeds", async () => {
@@ -883,36 +880,20 @@ describe("HostBashProxy", () => {
       await resultPromise;
     });
 
-    test("auto-resolve to different-user client falls through to untargeted", async () => {
+    test("rejects when only a different user has a capable client", async () => {
       setup();
-      // Single capable client owned by user-B; caller is user-A.
       setupSingleClient("client-abc", "user-B");
 
-      const resultPromise = proxy.request(
+      const result = await proxy.request(
         { command: "echo hello" },
         "session-1",
         undefined,
         "user-A",
       );
 
-      // Auto-resolve must NOT pick the cross-user client; the untargeted
-      // broadcast path runs instead.
-      expect(sentMessages).toHaveLength(1);
-      const sent = sentMessages[0] as Record<string, unknown>;
-      expect(sent.type).toBe("host_bash_request");
-      expect(sent.targetClientId).toBeUndefined();
-
-      const opts = sentMessageOptions[0] as Record<string, unknown> | undefined;
-      expect(opts?.targetClientId).toBeUndefined();
-
-      const requestId = sent.requestId as string;
-      proxy.resolveResult(requestId, {
-        stdout: "hello\n",
-        stderr: "",
-        exitCode: 0,
-        timedOut: false,
-      });
-      await resultPromise;
+      expect(result).toMatchObject({ isError: true });
+      expect(result.content).toContain("belongs to this user");
+      expect(sentMessages).toHaveLength(0);
     });
   });
 });