@vellumai/assistant 0.12.1 → 0.12.2-staging.1

package/src/tools/filesystem/search.ts

@@ -5,6 +5,7 @@ import { minimatch } from "minimatch";
 import { RE2JS } from "re2js";
 
 import { RiskLevel } from "../../permissions/types.js";
+import { safeStringSlice } from "../../util/unicode.js";
 import { declareDaemonActivityField } from "../schema-transforms.js";
 import {
   isDeniedBasename,
@@ -246,7 +247,7 @@ export const codeSearchTool = {
     // emitting a multi-megabyte output line. Normal lines pass through verbatim.
     const truncateForDisplay = (text: string): string =>
       text.length > MAX_DISPLAY_LINE_LENGTH
-        ? `${text.slice(0, MAX_DISPLAY_LINE_LENGTH)} …[line truncated]`
+        ? `${safeStringSlice(text, 0, MAX_DISPLAY_LINE_LENGTH)} …[line truncated]`
         : text;
 
     // Append an output line, tracking its byte cost. Returns false once the

package/src/tools/host-filesystem/edit.test.ts

@@ -71,8 +71,9 @@ describe("host_file_edit cross-client guards", () => {
     );
     expect(result.isError).toBe(true);
     expect(result.content).toContain(
-      "no client with host_file capability is connected",
+      "The Vellum desktop app is needed to access files on your computer",
     );
+    expect(result.content).toContain("https://www.vellum.ai/downloads");
   });
 
   test("returns 'specified client disconnected' error when targetClientId set but proxy unavailable on web", async () => {

package/src/tools/host-filesystem/edit.ts

@@ -4,7 +4,7 @@ import { supportsHostProxy } from "../../channels/types.js";
 import { HostFileProxy } from "../../daemon/host-file-proxy.js";
 import { RiskLevel } from "../../permissions/types.js";
 import { assistantEventHub } from "../../runtime/assistant-event-hub.js";
-import { desktopClientName } from "../client-os.js";
+import { formatDesktopAppRequired } from "../capability-offer.js";
 import { FileSystemOps } from "../shared/filesystem/file-ops-service.js";
 import { formatEditDiff } from "../shared/filesystem/format-diff.js";
 import { hostPolicy } from "../shared/filesystem/path-policy.js";
@@ -115,7 +115,7 @@ export const hostFileEditTool = {
       !HostFileProxy.instance.isAvailable()
     ) {
       return {
-        content: `Error: no client with host_file capability is connected. Connect a ${desktopClientName(context)} client to use host_file from a non-desktop interface.`,
+        content: formatDesktopAppRequired("files"),
         isError: true,
       };
     }

package/src/tools/host-filesystem/read.test.ts

@@ -67,8 +67,9 @@ describe("host_file_read cross-client guards", () => {
     );
     expect(result.isError).toBe(true);
     expect(result.content).toContain(
-      "no client with host_file capability is connected",
+      "The Vellum desktop app is needed to access files on your computer",
     );
+    expect(result.content).toContain("https://www.vellum.ai/downloads");
   });
 
   test("returns 'specified client disconnected' error when targetClientId set but proxy unavailable on web", async () => {

package/src/tools/host-filesystem/read.ts

@@ -6,7 +6,7 @@ import { supportsHostProxy } from "../../channels/types.js";
 import { HostFileProxy } from "../../daemon/host-file-proxy.js";
 import { RiskLevel } from "../../permissions/types.js";
 import { assistantEventHub } from "../../runtime/assistant-event-hub.js";
-import { desktopClientName } from "../client-os.js";
+import { formatDesktopAppRequired } from "../capability-offer.js";
 import {
   AUDIO_EXTENSIONS,
   readAudioFile,
@@ -121,7 +121,7 @@ export const hostFileReadTool = {
       !HostFileProxy.instance.isAvailable()
     ) {
       return {
-        content: `Error: no client with host_file capability is connected. Connect a ${desktopClientName(context)} client to use host_file from a non-desktop interface.`,
+        content: formatDesktopAppRequired("files"),
         isError: true,
       };
     }

package/src/tools/host-filesystem/transfer.test.ts

@@ -335,8 +335,9 @@ describe("host_file_transfer cross-client guards", () => {
 
     expect(result.isError).toBe(true);
     expect(result.content).toContain(
-      "no client with host_file capability is connected",
+      "The Vellum desktop app is needed to access files on your computer",
     );
+    expect(result.content).toContain("https://www.vellum.ai/downloads");
     expect(toSandboxCalls.length).toBe(0);
   });
 

package/src/tools/host-filesystem/transfer.ts

@@ -6,7 +6,7 @@ import { supportsHostProxy } from "../../channels/types.js";
 import { HostTransferProxy } from "../../daemon/host-transfer-proxy.js";
 import { RiskLevel } from "../../permissions/types.js";
 import { assistantEventHub } from "../../runtime/assistant-event-hub.js";
-import { desktopClientName } from "../client-os.js";
+import { formatDesktopAppRequired } from "../capability-offer.js";
 import { declareDaemonActivityField } from "../schema-transforms.js";
 import { sandboxPolicy } from "../shared/filesystem/path-policy.js";
 import type {
@@ -126,7 +126,7 @@ export const hostFileTransferTool = {
       !HostTransferProxy.instance.isAvailable()
     ) {
       return {
-        content: `Error: no client with host_file capability is connected. Connect a ${desktopClientName(context)} client to use host_file from a non-desktop interface.`,
+        content: formatDesktopAppRequired("files"),
         isError: true,
       };
     }

package/src/tools/host-filesystem/write.test.ts

@@ -67,8 +67,9 @@ describe("host_file_write cross-client guards", () => {
     );
     expect(result.isError).toBe(true);
     expect(result.content).toContain(
-      "no client with host_file capability is connected",
+      "The Vellum desktop app is needed to access files on your computer",
     );
+    expect(result.content).toContain("https://www.vellum.ai/downloads");
   });
 
   test("returns 'specified client disconnected' error when targetClientId set but proxy unavailable on web", async () => {

package/src/tools/host-filesystem/write.ts

@@ -4,7 +4,7 @@ import { supportsHostProxy } from "../../channels/types.js";
 import { HostFileProxy } from "../../daemon/host-file-proxy.js";
 import { RiskLevel } from "../../permissions/types.js";
 import { assistantEventHub } from "../../runtime/assistant-event-hub.js";
-import { desktopClientName } from "../client-os.js";
+import { formatDesktopAppRequired } from "../capability-offer.js";
 import { FileSystemOps } from "../shared/filesystem/file-ops-service.js";
 import { formatWriteSummary } from "../shared/filesystem/format-diff.js";
 import { hostPolicy } from "../shared/filesystem/path-policy.js";
@@ -90,7 +90,7 @@ export const hostFileWriteTool = {
       !HostFileProxy.instance.isAvailable()
     ) {
       return {
-        content: `Error: no client with host_file capability is connected. Connect a ${desktopClientName(context)} client to use host_file from a non-desktop interface.`,
+        content: formatDesktopAppRequired("files"),
         isError: true,
       };
     }

package/src/tools/host-terminal/host-shell.test.ts

@@ -170,6 +170,22 @@ afterEach(() => {
   mockProxyAvailable = false;
 });
 
+describe("host_bash unavailable desktop-app recovery", () => {
+  test("offers the desktop app download when a web turn has no host connection", async () => {
+    const result = await hostShellTool.execute(
+      { command: "pwd" },
+      makeContext({ transportInterface: "web" }),
+    );
+
+    expect(result.isError).toBe(true);
+    expect(result.content).toContain(
+      "The Vellum desktop app is needed to run commands on your computer",
+    );
+    expect(result.content).toContain("https://www.vellum.ai/downloads");
+    expect(result.content).toContain("Open it, then retry.");
+  });
+});
+
 // ---------------------------------------------------------------------------
 // Proxy path — background: true
 // ---------------------------------------------------------------------------

package/src/tools/host-terminal/host-shell.ts

@@ -18,10 +18,7 @@ import { getConfig } from "../../config/loader.js";
 import { HostBashProxy } from "../../daemon/host-bash-proxy.js";
 import { RiskLevel } from "../../permissions/types.js";
 import { wakeAgentForOpportunity } from "../../runtime/agent-wake.js";
-import {
-  assistantEventHub,
-  broadcastMessage,
-} from "../../runtime/assistant-event-hub.js";
+import { broadcastMessage } from "../../runtime/assistant-event-hub.js";
 import { conversationRevealNonce } from "../../runtime/reveal-nonce.js";
 import { redactSecrets } from "../../security/secret-scanner.js";
 import {
@@ -39,7 +36,7 @@ import {
   registerBackgroundTool,
   removeBackgroundTool,
 } from "../background-tool-registry.js";
-import { desktopClientName } from "../client-os.js";
+import { formatDesktopAppRequired } from "../capability-offer.js";
 import {
   attachBoundedStdio,
   MAX_OUTPUT_LENGTH,
@@ -142,7 +139,7 @@ export const hostShellInputSchema = z.looseObject({
   target_client_id: z
     .string()
     .describe(
-      "ID of the specific client to execute this command on. Required when multiple clients support host_bash; omit when only one client is connected. Obtain IDs from `assistant clients list --capability host_bash`.",
+      "Optional ID of the specific client to execute this command on. Without it, the most recently active eligible client is used. Obtain IDs from `assistant clients list --capability host_bash`.",
     )
     .optional()
     .catch(undefined),
@@ -203,20 +200,7 @@ export const hostShellTool = {
     const config = getConfig();
     const { shellDefaultTimeoutSec, shellMaxTimeoutSec } = config.timeouts;
 
-    // Guard: non-host-proxy interfaces need an explicit target when multiple
-    // capable clients are connected to avoid ambiguous untargeted broadcasts.
     const transportInterface = context.transportInterface;
-    if (
-      targetClientId == null &&
-      transportInterface != null &&
-      !supportsHostProxy(transportInterface) &&
-      assistantEventHub.listClientsByCapability("host_bash").length > 1
-    ) {
-      return {
-        content: `Error: multiple clients support host_bash. Specify which client to use with \`target_client_id\`. Run \`assistant clients list --capability host_bash\` to see client IDs and labels.`,
-        isError: true,
-      };
-    }
 
     // Guard: non-host-proxy interfaces with no capable clients connected.
     if (
@@ -226,7 +210,7 @@ export const hostShellTool = {
       !HostBashProxy.instance.isAvailable()
     ) {
       return {
-        content: `Error: no client with host_bash capability is connected. Connect a ${desktopClientName(context)} client to use host_bash from a non-desktop interface.`,
+        content: formatDesktopAppRequired("shell"),
         isError: true,
       };
     }

package/src/tools/network/web-search.ts

@@ -15,6 +15,7 @@ import {
   getHttpRetryDelay,
   sleep,
 } from "../../util/retry.js";
+import { safeStringSlice } from "../../util/unicode.js";
 import type {
   ToolContext,
   ToolDefinition,
@@ -509,7 +510,11 @@ const KEENABLE_SNIPPET_MAX_LENGTH = 500;
  * present rather than nullish. */
 function keenableSnippet(result: KeenableSearchResult): string {
   const text = result.snippet || result.description || "";
-  return text.replace(/\s+/g, " ").trim().slice(0, KEENABLE_SNIPPET_MAX_LENGTH);
+  return safeStringSlice(
+    text.replace(/\s+/g, " ").trim(),
+    0,
+    KEENABLE_SNIPPET_MAX_LENGTH,
+  );
 }
 
 function formatKeenableResults(

package/src/tools/policy-context.ts

@@ -1,5 +1,5 @@
 import { getConfig } from "../config/loader.js";
-import { isV3TierActive } from "../config/memory-v3-gate.js";
+import { isSkillImprovementActive } from "../config/memory-v3-gate.js";
 import type { ExecutionContext } from "../permissions/approval-policy.js";
 import type { ChannelPermissionCoordinates } from "../permissions/channel-permission-query.js";
 import type { PolicyContext } from "../permissions/types.js";
@@ -63,12 +63,11 @@ export function buildPolicyContext(
     requestOrigin: context?.requestOrigin,
     ...channelCoordinatesFromToolContext(context),
     requesterContactId: context?.requesterContactId,
-    // Precompute the proc-to-skills gate — the v3 tier being active, i.e.
-    // memory on AND v3 live — here so the permission checker, a leaf module
-    // that must not read config, can deny the memory-retrospective
-    // skill-authoring grant whenever the feature is inactive just by reading
-    // this boolean.
-    procToSkillsActive: isV3TierActive(getConfig()),
+    // Precompute the retrospective skill-improvement gate here so the
+    // permission checker, a leaf module that must not read config, can deny
+    // the memory-retrospective skill-authoring grant whenever the feature is
+    // inactive just by reading this boolean.
+    procToSkillsActive: isSkillImprovementActive(getConfig()),
   };
 
   const ownerKind = getToolOwner(tool.name)?.kind;

package/src/tools/skills/scaffold-managed.ts

@@ -5,6 +5,7 @@ import type { SkillSource } from "../../config/skills.js";
 import { loadSkillCatalog } from "../../config/skills.js";
 import { refreshSkillCapabilityMemories } from "../../daemon/skill-memory-refresh.js";
 import { emitNotificationSignal } from "../../notifications/emit-signal.js";
+import { sanitizeMultilineMessagePreview } from "../../notifications/notification-utils.js";
 import { getConversation } from "../../persistence/conversation-crud.js";
 import { upsertSkillCardInsertJob } from "../../persistence/jobs-store.js";
 import { MEMORY_RETROSPECTIVE_ORIGIN } from "../../plugins/defaults/memory/memory-retrospective-constants.js";
@@ -37,6 +38,14 @@ function sanitizeFrontmatterValue(value: string): string {
 const MISSING_ACTIVATION_HINTS =
   'activation_hints is required: pass 1-4 short trigger phrases stating the intent this skill serves (for example "user asks to deploy staging") so it can be found later by intent, not just by name.';
 
+/**
+ * Self-correcting error for a background overwrite of an existing skill with
+ * no change summary. The schema cannot express the condition (a create and a
+ * user-directed edit need none), so the executor is the enforcement point.
+ */
+const MISSING_CHANGE_SUMMARY =
+  'change_summary is required when updating an existing skill: pass one or two short sentences (under 200 characters) for the person who reads the "Skill updated" notice, naming what you changed and what in the trace prompted it (for example "Added the retry after an expired session and the export endpoint that held steady.").';
+
 /**
  * Validate + normalize a string-array input (sanitize, drop blanks, dedupe).
  * Returns `{ error }` on the first invalid element, or `{ value }` holding
@@ -90,6 +99,12 @@ function normalizeOptionalStringArray(
  * scheduled jobs, heartbeat), where a user already looks to see what the
  * assistant did on its own.
  *
+ * `changeSummary` is the pass's own account of what it changed and is the
+ * notice's body: the feed item is the only place the change surfaces, and a
+ * reader triaging it there has no diff to look at, so a notice that only
+ * names the skill sends them into the skill to find out what happened. The
+ * executor refuses the overwrite without one, so this never runs without it.
+ *
  * `sourceContextId` is a conversation id so the feed item's "Go to Convo"
  * target resolves (see `home-feed-side-effect.ts`, which looks it up via
  * `getConversation`): the source conversation when lineage resolved, else the
@@ -102,6 +117,7 @@ function notifyBackgroundSkillUpdate(args: {
   skillId: string;
   name: string;
   conversationId: string;
+  changeSummary: string;
 }): void {
   const day = new Date().toISOString().slice(0, 10);
   void emitNotificationSignal({
@@ -121,13 +137,13 @@ function notifyBackgroundSkillUpdate(args: {
       // background, no interruption) leaves the feed writer with no summary
       // and it skips the item entirely, so the quiet case would surface
       // nothing at all.
-      summary: `Updated the skill "${args.name}" from something learned in an earlier conversation.`,
+      summary: args.changeSummary,
       // Named, not just "Skill updated": the feed sits several rows deep and
       // a generic title is unscannable next to entries that name their
       // subject (`Background job failed: memory.v2.sweep`). The word "Skill"
       // stays because a bare skill name does not always read as one.
       title: `Skill updated: ${args.name}`,
-      body: `Updated the skill "${args.name}" from something learned in an earlier conversation.`,
+      body: args.changeSummary,
       skillId: args.skillId,
     },
     attentionHints: {
@@ -313,6 +329,24 @@ export async function executeScaffoldManagedSkill(
     }
   }
 
+  // The update notice's body. Model-authored text bound for a notification
+  // surface, so it gets the same control-character strip and preview clamp as
+  // any other producer-supplied body; blank collapses to absent so the
+  // requirement below treats it as missing rather than posting an empty notice.
+  let changeSummary: string | undefined;
+  if (input.change_summary !== undefined) {
+    if (typeof input.change_summary !== "string") {
+      return {
+        content: "Error: change_summary must be a string",
+        isError: true,
+      };
+    }
+    const sanitized = sanitizeMultilineMessagePreview(input.change_summary);
+    if (sanitized) {
+      changeSummary = sanitized;
+    }
+  }
+
   const id = skillId.trim();
   const fromRetrospective =
     context.requestOrigin === MEMORY_RETROSPECTIVE_ORIGIN;
@@ -366,6 +400,24 @@ export async function executeScaffoldManagedSkill(
     }
   }
 
+  // A background overwrite announces itself through the notice built in
+  // notifyBackgroundSkillUpdate, whose body is this summary, so the write is
+  // refused without one. The error returns to the pass in the same turn and
+  // it retries with the field, the way a missing activation_hints does.
+  // Checked after the ownership backstop so a pass that may not touch the
+  // skill hears that first, and only for a call that asked to overwrite: a
+  // call without the flag is blocked by the managed store's own overwrite
+  // error, and hearing about the summary instead would cost it a retry that
+  // still cannot succeed. Before any write, so nothing is lost.
+  if (
+    fromRetrospective &&
+    managedSkillExistedBefore &&
+    input.overwrite === true &&
+    !changeSummary
+  ) {
+    return { content: `Error: ${MISSING_CHANGE_SUMMARY}`, isError: true };
+  }
+
   // Conversation lineage (retrospective origin only). The retrospective runs
   // in a background fork of the conversation it distilled the procedure from,
   // so the fork's parent is this skill's durable source conversation.
@@ -450,11 +502,17 @@ export async function executeScaffoldManagedSkill(
   // skill.
   const notifyConversationId =
     sourceConversationId ?? retrospectiveConversationId;
-  if (fromRetrospective && managedSkillExistedBefore && notifyConversationId) {
+  if (
+    fromRetrospective &&
+    managedSkillExistedBefore &&
+    notifyConversationId &&
+    changeSummary
+  ) {
     notifyBackgroundSkillUpdate({
       skillId: id,
       name: normalizedName,
       conversationId: notifyConversationId,
+      changeSummary,
     });
   }
 

package/src/tools/subagent/spawn.ts

@@ -484,9 +484,9 @@ function spawnCancelledResult(label: string): ToolExecutionResult {
  * repeat-spawn guard folds, so a consult has to record it the same way every
  * other spawn does or the guard could never match one consult against another.
  *
- * The context pack is best effort: the parent conversation is looked up only
- * for its warm skill catalog, so an unresolvable one (e.g. evicted) costs the
- * skills section of the pack and nothing else.
+ * The context pack is best effort: each section independently falls back to
+ * null on failure, so a missing workspace or empty catalog costs only that
+ * section, never the consult.
  *
  * The budget is the advisor's alone. It is the only spawn the agent may issue
  * unprompted and the only one that runs on the premium profile, so it is the
@@ -502,21 +502,18 @@ async function buildAdvisorFields(
   maxRuntimeMs: number;
   maxToolCalls: number;
 }> {
-  const parentConversation = findConversation(context.conversationId);
   // Situational awareness for the advisor: the parent's live tool set, the
   // full skill catalog, and its workspace. Assembled off the per-turn
   // ToolContext snapshot (trust, channel) so the personal-memory sections are
   // gated exactly like the runtime injectors. A null pack just means the
-  // consult runs on the brief alone.
+  // consult runs on the brief alone. Skills come from a fresh
+  // `loadSkillCatalog()` inside the context pack, not a conversation snapshot.
   const situationalContext = await buildAdvisorContext({
     conversationId: context.conversationId,
     workingDir: context.workingDir,
     allowedToolNames: context.allowedToolNames,
     trustClass: context.trustClass,
     enabledPluginSet: context.enabledPluginSet,
-    // The parent's warm per-turn catalog keeps the synchronous on-disk catalog
-    // scan out of the spawn path.
-    skillCatalog: parentConversation?.skillProjectionCache?.catalog,
   });
   return {
     requestText: advisorRequestText(objective, situationalContext),

package/src/tools/terminal/__tests__/sanitized-bash.test.ts

@@ -0,0 +1,57 @@
+import { afterEach, describe, expect, test } from "bun:test";
+
+import { runSanitizedBash } from "../sanitized-bash.js";
+
+describe("runSanitizedBash", () => {
+  const priorToken = process.env.CES_SERVICE_TOKEN;
+  const priorSocket = process.env.CES_LOCAL_SOCKET;
+
+  afterEach(() => {
+    if (priorToken == null) {
+      delete process.env.CES_SERVICE_TOKEN;
+    } else {
+      process.env.CES_SERVICE_TOKEN = priorToken;
+    }
+    if (priorSocket == null) {
+      delete process.env.CES_LOCAL_SOCKET;
+    } else {
+      process.env.CES_LOCAL_SOCKET = priorSocket;
+    }
+  });
+
+  test("runs a command and returns stdout", async () => {
+    const result = await runSanitizedBash("echo hello", 5_000);
+    expect(result.error).toBeUndefined();
+    expect(result.timedOut).toBe(false);
+    expect(result.exitCode).toBe(0);
+    expect(result.stdout.trim()).toBe("hello");
+  });
+
+  test("forwards CES_SERVICE_TOKEN to the child", async () => {
+    process.env.CES_SERVICE_TOKEN = "vault-bearer";
+    const result = await runSanitizedBash("printenv CES_SERVICE_TOKEN", 5_000);
+    expect(result.error).toBeUndefined();
+    expect(result.exitCode).toBe(0);
+    expect(result.stdout.trim()).toBe("vault-bearer");
+  });
+
+  test("forwards CES_LOCAL_SOCKET to the child", async () => {
+    process.env.CES_LOCAL_SOCKET = "/tmp/ces.sock";
+    const result = await runSanitizedBash("printenv CES_LOCAL_SOCKET", 5_000);
+    expect(result.error).toBeUndefined();
+    expect(result.exitCode).toBe(0);
+    expect(result.stdout.trim()).toBe("/tmp/ces.sock");
+  });
+
+  test("times out a hung command", async () => {
+    const result = await runSanitizedBash("sleep 5", 200);
+    expect(result.error).toBeUndefined();
+    expect(result.timedOut).toBe(true);
+  });
+
+  test("rejects an empty command", async () => {
+    const result = await runSanitizedBash("");
+    expect(result.error).toBe("command is required");
+    expect(result.exitCode).toBeNull();
+  });
+});

package/src/tools/terminal/sanitized-bash.ts

@@ -0,0 +1,105 @@
+/**
+ * Spawn a shell command with the same sanitized environment the bash tool
+ * forwards to tool-call subprocesses.
+ *
+ * Used by `assistant bash` so a CLI invocation sees the same allowlisted
+ * env, workspace cwd, and platform shell as a bash tool call, without
+ * round-tripping through the assistant HTTP or IPC API.
+ */
+
+import { spawn } from "node:child_process";
+
+import {
+  buildShellInvocation,
+  terminateProcessTree,
+} from "../../util/host-process.js";
+import { getWorkspaceDir } from "../../util/platform.js";
+import { buildSanitizedEnv } from "./safe-env.js";
+
+export const DEFAULT_SANITIZED_BASH_TIMEOUT_MS = 30_000;
+
+export interface SanitizedBashResult {
+  stdout: string;
+  stderr: string;
+  exitCode: number | null;
+  timedOut: boolean;
+  error?: string;
+}
+
+export function runSanitizedBash(
+  command: string,
+  timeoutMs: number = DEFAULT_SANITIZED_BASH_TIMEOUT_MS,
+): Promise<SanitizedBashResult> {
+  if (!command) {
+    return Promise.resolve({
+      stdout: "",
+      stderr: "",
+      exitCode: null,
+      timedOut: false,
+      error: "command is required",
+    });
+  }
+
+  const effectiveTimeout =
+    typeof timeoutMs === "number" && timeoutMs > 0
+      ? timeoutMs
+      : DEFAULT_SANITIZED_BASH_TIMEOUT_MS;
+
+  return new Promise<SanitizedBashResult>((resolve) => {
+    const stdoutChunks: Buffer[] = [];
+    const stderrChunks: Buffer[] = [];
+    let timedOut = false;
+    let settled = false;
+
+    const finish = (result: SanitizedBashResult) => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      resolve(result);
+    };
+
+    const wrapped = buildShellInvocation(command);
+    const child = spawn(wrapped.command, wrapped.args, {
+      cwd: getWorkspaceDir(),
+      stdio: ["ignore", "pipe", "pipe"],
+      detached: true,
+      env: buildSanitizedEnv(),
+      windowsHide: true,
+    });
+
+    const timer = setTimeout(() => {
+      timedOut = true;
+      terminateProcessTree(child);
+    }, effectiveTimeout);
+
+    child.stdout.on("data", (data: Buffer) => {
+      stdoutChunks.push(data);
+    });
+
+    child.stderr.on("data", (data: Buffer) => {
+      stderrChunks.push(data);
+    });
+
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      finish({
+        stdout: Buffer.concat(stdoutChunks).toString(),
+        stderr: Buffer.concat(stderrChunks).toString(),
+        exitCode: code,
+        timedOut,
+      });
+    });
+
+    child.on("error", (err) => {
+      clearTimeout(timer);
+      finish({
+        stdout: "",
+        stderr: "",
+        exitCode: null,
+        timedOut: false,
+        error: err.message,
+      });
+    });
+  });
+}

package/src/tools/watch/watch-retro-report.ts

@@ -14,14 +14,6 @@ import type {
 /**
  * How a watch retrospective hands its report to the daemon.
  *
- * **The card cannot come from `ui_show`.** A retrospective runs as a
- * `clientless` wake, which pins the turn non-interactive, and
- * `conversation-tool-setup` gates the whole `ui_surface` tool family on a
- * client being present (`return channelCapabilities?.supportsDynamicUi ??
- * !hasNoClient`). So `ui_show` is not merely denied in this turn, it is absent
- * from the tool set, and a retrospective told to call it can only report that
- * it cannot. This tool is an ordinary one and passes that gate untouched.
- *
  * **It records; it does not render.** The executor validates the payload and
  * returns, and nothing here writes to the conversation. What makes the card is
  * `watch-retro.ts` reading this call back out of the turn's own history once

package/src/types/host-capabilities.ts

@@ -16,6 +16,7 @@ export const HOST_PROXY_CAPABILITIES = [
   "host_file",
   "host_cu",
   "host_cu_window_capture",
+  "host_cu_sequence",
   "host_cu_annotate",
   "host_browser",
   "host_app_control",
@@ -24,11 +25,12 @@ export const HOST_PROXY_CAPABILITIES = [
 
 export type HostProxyCapability = (typeof HOST_PROXY_CAPABILITIES)[number];
 
-/** Every host capability except the three macOS-only ones. */
+/** Every host capability except the macOS-only ones. */
 const DESKTOP_SHARED_CAPABILITIES = HOST_PROXY_CAPABILITIES.filter(
   (capability) =>
     capability !== "host_app_control" &&
     capability !== "host_cu_window_capture" &&
+    capability !== "host_cu_sequence" &&
     capability !== "host_cu_annotate",
 );
 
@@ -47,8 +49,8 @@ export type HostProxyInterfaceId = "macos" | "windows" | "linux";
  * (web, ios, android, and every messaging transport) provide none.
  *
  * Windows and Linux run the same host proxy as macOS minus app control. The
- * two window-scoped CU capabilities ride the host_cu transport and are
- * negotiated per connection; only the macOS native helper answers them, so a
+ * negotiated CU capabilities ride the host_cu transport and are claimed per
+ * connection; only the macOS native helper answers them, so a
  * request elsewhere would reach that helper as an unknown action.
  *
  * macOS additionally provisions its `host_browser` proxy via the assistant