@vellumai/assistant 0.12.1 → 0.12.2-staging.2

package/src/daemon/conversation-surfaces.ts

@@ -55,6 +55,7 @@ import {
   isActivationMomentParam,
 } from "../telemetry/activation-funnel.js";
 import { resolveAppId } from "../tools/apps/resolve-app-id.js";
+import { formatDesktopAppRequired } from "../tools/capability-offer.js";
 import { POINT_AT_PROXY_TOOL } from "../tools/computer-use/skill-proxy-bridge.js";
 import type { ToolExecutionResult } from "../tools/types.js";
 import { getLogger } from "../util/logger.js";
@@ -100,6 +101,7 @@ export {
   type SurfaceShowPair,
   type SurfaceStateEntry,
 } from "./conversation-surface-state.js";
+import { safeStringSlice } from "../util/unicode.js";
 import type { HostAppControlInput } from "./message-types/host-app-control.js";
 import type { UserMessageAttachment } from "./message-types/shared.js";
 
@@ -1486,7 +1488,10 @@ function handleDocumentContentChanged(
         updateApp(appId, {
           name: title || app.name,
           description: `Document with ${wordCount ?? 0} words`,
-          preview: content?.slice(0, 200),
+          preview:
+            content === undefined
+              ? undefined
+              : safeStringSlice(content, 0, 200),
           htmlDefinition: updatedHtml,
         });
 
@@ -2936,7 +2941,7 @@ export function buildAppOpenPreview(
 function describeComputerUseUnavailable(ctx: Conversation): string {
   const capable = assistantEventHub.listClientsByCapability("host_cu");
   if (capable.length === 0) {
-    return "Computer use is not available — no desktop client connected. Open the Vellum desktop app on the machine you want to control, then retry.";
+    return formatDesktopAppRequired("screen");
   }
   return `Computer use is not available for this conversation — ${capable.length} desktop client(s) advertise host_cu, but none of them can be driven from this conversation's interface (${ctx.transportInterface ?? "unknown"}) as its current user.`;
 }
@@ -3175,7 +3180,7 @@ export async function surfaceProxyResolver(
           : typeof input.answer === "string"
             ? input.answer
             : "Task complete";
-      hostCuProxy.reset();
+      hostCuProxy.endTask(ctx.conversationId);
       return { content: summary, isError: false };
     }
 
@@ -3251,8 +3256,7 @@ export async function surfaceProxyResolver(
 
     if (!ctx.hostAppControlProxy || !ctx.hostAppControlProxy.isAvailable()) {
       return {
-        content:
-          "App control is not available — enable the `app-control` feature flag and connect a macOS client.",
+        content: formatDesktopAppRequired("apps"),
         isError: true,
       };
     }
@@ -3342,8 +3346,14 @@ export async function surfaceProxyResolver(
 
   if (toolName === "ui_show" || toolName === "ui_update") {
     const caps = ctx.channelCapabilities;
+    // Live non-dynamic channels reject unsupported surfaces. Clientless turns
+    // skip this gate so surfaces persist for a later capable client.
+    // `canShowInteractiveUi` fails closed on clientless turns because
+    // standalone surfaces have nobody to answer them, so it is not the
+    // predicate here.
     if (
       caps &&
+      !ctx.hasNoClient &&
       !caps.supportsDynamicUi &&
       !isSlackTaskProgressUiException(ctx, toolName, input)
     ) {
@@ -3552,11 +3562,12 @@ export async function surfaceProxyResolver(
           : surfaceType === "table"
             ? hasActions
             : INTERACTIVE_SURFACE_TYPES.includes(surfaceType);
-    // An explicit `await_action: true` is honored for every other type; an
-    // actionless surface has nothing to await, so it is forced false.
-    const awaitAction = isActionless
-      ? false
-      : ((input.await_action as boolean) ?? isInteractive);
+    // Background turns persist surfaces for a later conversation open and
+    // return immediately. An actionless surface also has nothing to await.
+    const awaitAction =
+      !ctx.hasNoClient &&
+      !isActionless &&
+      ((input.await_action as boolean) ?? isInteractive);
 
     // Only one non-persistent interactive surface at a time. If another
     // surface is already awaiting user input, reject this one so the LLM

package/src/daemon/conversation-tool-setup.ts

@@ -28,7 +28,6 @@ import { getAllDefaultPluginNames } from "../plugins/defaults/main.js";
 import { isActivationSession } from "../plugins/defaults/memory/activation-session-store.js";
 import { isPluginDisabled } from "../plugins/disabled-state.js";
 import type { Message, ToolDefinition } from "../providers/types.js";
-import { assistantEventHub } from "../runtime/assistant-event-hub.js";
 import { registerConversationSender } from "../tools/browser/browser-screencast.js";
 import { supportsClientOsForSkillTool } from "../tools/client-os.js";
 import type { ToolExecutor } from "../tools/executor.js";
@@ -63,10 +62,7 @@ import {
   type ToolContext,
   type ToolExecutionResult,
 } from "../tools/types.js";
-import {
-  injectActivationMomentParam,
-  projectUiToolsForChannel,
-} from "../tools/ui-surface/channel-variants.js";
+import { injectActivationMomentParam } from "../tools/ui-surface/channel-variants.js";
 import { loadWorkspaceTools } from "../tools/workspace-tools/loader.js";
 import {
   resolveUsageAttribution,
@@ -260,6 +256,24 @@ export function createToolExecutor(
   // see {@link SubagentToolGateMode}): rejects non-allowlisted calls BEFORE
   // any executor dispatch, so a non-allowlisted tool's executor never runs.
   // The error tool_result lets the model continue or finish.
+  const rejectUnattendedHostTool = (
+    toolName: string,
+  ): ToolExecutionResult | null => {
+    const { transportInterface } = resolveTurnClientOs(ctx);
+    const isUnattended = ctx.currentTurnIsNonInteractive ?? ctx.hasNoClient;
+    if (
+      HOST_TOOL_NAMES.has(toolName) &&
+      isUnattended &&
+      transportInterface !== "chrome-extension"
+    ) {
+      return {
+        content: `The "${toolName}" tool requires an interactive user turn and cannot run in the background.`,
+        isError: true,
+      };
+    }
+    return null;
+  };
+
   const rejectNonAllowlistedTool = (
     toolName: string,
   ): ToolExecutionResult | null => {
@@ -387,6 +401,10 @@ export function createToolExecutor(
       if (rejection) {
         return rejection;
       }
+      const unattendedRejection = rejectUnattendedHostTool(executionName);
+      if (unattendedRejection) {
+        return unattendedRejection;
+      }
     }
 
     if (isDoordashCommand(executionName, executionInput)) {
@@ -550,6 +568,10 @@ export function createToolExecutor(
       if (innerRejection) {
         return innerRejection;
       }
+      const unattendedRejection = rejectUnattendedHostTool(toolName);
+      if (unattendedRejection) {
+        return unattendedRejection;
+      }
 
       // Per-chat plugin scope: reject the resolved inner tool when it belongs
       // to a plugin outside the conversation's effective set.
@@ -628,7 +650,6 @@ export const DEFAULT_PREACTIVATED_SKILL_IDS = ["notifications", "subagent"];
 // ── Conditional tool sets ────────────────────────────────────────────
 
 const UI_SURFACE_TOOL_NAMES = new Set(["ui_show", "ui_update", "ui_dismiss"]);
-const SLACK_TASK_PROGRESS_UI_TOOL_NAMES = new Set(["ui_show", "ui_update"]);
 /**
  * Single source of truth for which tools are host tools and the capability
  * each one requires from the connected client interface. Adding a tool here
@@ -856,56 +877,26 @@ export function isToolActiveForContext(
     return supportsChannelReaction(turnChannel);
   }
   if (UI_SURFACE_TOOL_NAMES.has(name)) {
-    if (
-      channelCapabilities?.channel === "slack" &&
-      SLACK_TASK_PROGRESS_UI_TOOL_NAMES.has(name)
-    ) {
-      return !hasNoClient;
-    }
-    return channelCapabilities?.supportsDynamicUi ?? !hasNoClient;
+    // Surface calls write conversation content. Background turns persist that
+    // content for the next client that opens the conversation, so presence
+    // cannot change whether the model receives these definitions.
+    return true;
   }
   if (HOST_TOOL_NAMES.has(name)) {
     const capability = HOST_TOOL_TO_CAPABILITY.get(name);
     const transport = transportInterface;
 
-    // Per-capability check is authoritative for structural support: if the
-    // transport cannot service this capability, the tool is filtered out.
+    // A transport that does not implement a capability can invoke it through
+    // an eligible same-user client. Client selection happens when the call
+    // runs, so the wire schema stays stable across live and background turns.
     if (transport && capability && !supportsHostProxy(transport, capability)) {
-      // Cross-client exception: allow host tools whose capabilities have
-      // cross-client routing infrastructure (Phases 1–3 plus host_browser
-      // via PR #27489) to be exposed for non-host-proxy transports (e.g.
-      // "web", "ios") when at least one capable client is connected via
-      // the event hub. Members of CROSS_CLIENT_EXPOSED_CAPABILITIES
-      // (host_bash, host_file, host_browser) qualify.
-      // chrome-extension transport is excluded as a security boundary
-      // (extension only gets host_browser via its own executor path);
-      // hasNoClient turns are excluded (no interactive approval UI
-      // available).
-      if (
-        capability &&
+      return (
         CROSS_CLIENT_EXPOSED_CAPABILITIES.has(capability) &&
-        transport !== "chrome-extension" &&
-        !hasNoClient &&
-        assistantEventHub.listClientsByCapability(capability).length > 0
-      ) {
-        return true;
-      }
-      return false;
-    }
-
-    // chrome-extension is its own executor — the extension's popup gates
-    // commands via its own UI, and the transport does not use an SSE-level
-    // interactive approval channel. hasNoClient is intentionally `true` for
-    // chrome-extension turns (chrome-extension is not in INTERACTIVE_INTERFACES)
-    // and must not gate host_browser. Trust the per-capability check.
-    if (transport === "chrome-extension") {
-      return true;
+        transport !== "chrome-extension"
+      );
     }
 
-    // For transports that surface approvals over SSE (macos, backwards-compat
-    // fallback), deny when no client is present so the guardian auto-approve
-    // path cannot execute host commands unattended.
-    return !hasNoClient;
+    return true;
   }
   if (CLIENT_CAPABILITY_TOOL_NAMES.has(name)) {
     if (name === "ask_question" && channelCapabilities?.clientOS === "macos") {
@@ -1153,18 +1144,13 @@ export function createResolveToolsCallback(
         : currentWorkspaceDefs
     ).filter((d) => !readOnlyHidesFromWire(d.name));
     const excluded = new Set(getConfig().tools.exclude);
-    // Swap UI surface tools for channel-appropriate variants (e.g. Slack's
-    // task_progress-only ui_show). Mirrors the pin handling in
-    // `isToolActiveForContext`: execution-gate-mode wakes pin channel
-    // capabilities to undefined, which resolves to the unprojected defs.
-    const channelForUiTools = ctx.toolContextPin
-      ? undefined
-      : ctx.channelCapabilities?.channel;
-    let allBaseDefs = projectUiToolsForChannel(
-      [...scopedCoreDefs, ...scopedWorkspaceDefs, ...scopedMcpDefs].filter(
-        (d) => !excluded.has(d.name),
-      ),
-      channelForUiTools,
+    // UI definitions stay identical across channel and background turns.
+    // Channel renderers enforce their supported surface subset at execution,
+    // while background calls persist the full surface content for the next
+    // capable client that opens the conversation. Skill tools stay off this
+    // list (`skill_execute` dispatch) and are a separate disclosure path.
+    let allBaseDefs = [...scopedCoreDefs, ...scopedWorkspaceDefs, ...scopedMcpDefs].filter(
+      (d) => !excluded.has(d.name),
     );
     // Activation-rail conversations carry the optional `activation_moment`
     // telemetry param on ui_show. The marker is written before the first

package/src/daemon/conversation.ts

@@ -2366,9 +2366,6 @@ export class Conversation {
 
   markStale(): void {
     this.stale = true;
-    // Invalidate the cached skill catalog so the next projection picks up
-    // filesystem changes (e.g. a skill created during this run).
-    this.skillProjectionCache.catalog = undefined;
   }
 
   isStale(): boolean {

package/src/daemon/dictation-profile-store.ts

@@ -10,6 +10,7 @@ import { join } from "node:path";
 
 import { getLogger } from "../util/logger.js";
 import { getWorkspaceDir } from "../util/platform.js";
+import { safeStringSlice } from "../util/unicode.js";
 
 const log = getLogger("dictation-profile-store");
 
@@ -130,7 +131,7 @@ function validateAndClampConfig(raw: unknown): DictationProfilesConfig {
         { profileId: profile.id },
         `stylePrompt exceeds ${MAX_STYLE_PROMPT_LENGTH} chars, truncating`,
       );
-      stylePrompt = stylePrompt.slice(0, MAX_STYLE_PROMPT_LENGTH);
+      stylePrompt = safeStringSlice(stylePrompt, 0, MAX_STYLE_PROMPT_LENGTH);
     }
 
     // Validate dictionary entries

package/src/daemon/handlers/shared.ts

@@ -32,6 +32,7 @@ import { unwrapExternalContentForDisplay } from "../../security/untrusted-conten
 import type { CredentialInjectionTemplate } from "../../tools/credentials/policy-types.js";
 import { getLogger } from "../../util/logger.js";
 import { joinWithSpacing } from "../../util/text-spacing.js";
+import { safeStringSlice } from "../../util/unicode.js";
 import { estimateBase64Bytes } from "../assistant-attachments.js";
 import { conversationSupportsDynamicUi } from "../channel-ui-capability.js";
 import { findConversation } from "../conversation-registry.js";
@@ -264,7 +265,7 @@ function clampAttachmentText(text: string): string {
   if (text.length <= HISTORY_ATTACHMENT_TEXT_LIMIT) {
     return text;
   }
-  return `${text.slice(0, HISTORY_ATTACHMENT_TEXT_LIMIT)}<truncated />`;
+  return `${safeStringSlice(text, 0, HISTORY_ATTACHMENT_TEXT_LIMIT)}<truncated />`;
 }
 
 interface FileBlockMetadata {

package/src/daemon/handlers/skills.ts

@@ -82,6 +82,7 @@ import {
   searchSkillsRegistry,
 } from "../../skills/skillssh-registry.js";
 import { getWorkspaceSkillsDir } from "../../util/platform.js";
+import { safeStringSlice } from "../../util/unicode.js";
 import { getConfigWatcher } from "../config-watcher.js";
 import type {
   SkillDetailResponse,
@@ -237,9 +238,11 @@ function heuristicDraft(body: string): {
   const lines = body.split("\n").filter((l) => l.trim());
   const firstLine = lines[0]?.trim() ?? "";
   const name =
-    firstLine.replace(/^#+\s*/, "").slice(0, 100) || "Untitled Skill";
+    safeStringSlice(firstLine.replace(/^#+\s*/, ""), 0, 100) ||
+    "Untitled Skill";
   const skillId = toSkillSlug(name) || "untitled-skill";
-  const description = body.trim().slice(0, 200) || "No description provided";
+  const description =
+    safeStringSlice(body.trim(), 0, 200) || "No description provided";
   return { skillId, name, description, emoji: "\u{1F4DD}" };
 }
 
@@ -1732,7 +1735,7 @@ export async function draftSkill(params: {
               "- emoji: a single emoji character representing the skill",
               "",
               "Skill body:",
-              body.slice(0, 2000),
+              safeStringSlice(body, 0, 2000),
             ].join("\n");
 
             const response = await provider.sendMessage([userMessage(prompt)], {

package/src/daemon/host-bash-proxy.ts

@@ -1,9 +1,9 @@
 import { getConfig } from "../config/loader.js";
 import { assistantEventHub } from "../runtime/assistant-event-hub.js";
 import {
-  ambiguousSameUserError,
   enforceSameActorOrErrorResult,
-  pickSameUserAutoResolve,
+  pickMostRecentSameUserClient,
+  unavailableSameUserClientError,
 } from "../runtime/auth/same-actor.js";
 import * as pendingInteractions from "../runtime/pending-interactions.js";
 import { formatShellOutput } from "../tools/shared/shell-output.js";
@@ -93,21 +93,17 @@ export class HostBashProxy extends HostProxyBase<
       }
       resolvedTargetClientId = input.targetClientId;
     } else {
-      // Auto-resolve to the unique same-user client. Reject (rather than
-      // broadcast) when multiple same-user clients are connected so that
-      // a single targeted-style request cannot fan out across every one
-      // of the user's machines. Zero same-user matches falls through to
-      // the existing untargeted code path.
-      const resolved = pickSameUserAutoResolve({
+      resolvedTargetClientId = pickMostRecentSameUserClient({
         hub: assistantEventHub,
         capability: "host_bash",
         sourceActorPrincipalId,
       });
-      if (resolved.kind === "ambiguous") {
-        return ambiguousSameUserError("host_bash");
+      if (
+        resolvedTargetClientId === undefined &&
+        sourceActorPrincipalId !== undefined
+      ) {
+        return unavailableSameUserClientError("host_bash");
       }
-      resolvedTargetClientId =
-        resolved.kind === "match" ? resolved.clientId : undefined;
     }
 
     // Targeted requests must be bound to the same authenticated user as the

package/src/daemon/host-browser-proxy.ts

@@ -5,7 +5,10 @@ import {
   assistantEventHub,
   broadcastMessage,
 } from "../runtime/assistant-event-hub.js";
-import { enforceSameActorOrErrorResult } from "../runtime/auth/same-actor.js";
+import {
+  enforceSameActorOrErrorResult,
+  unavailableSameUserClientError,
+} from "../runtime/auth/same-actor.js";
 import * as pendingInteractions from "../runtime/pending-interactions.js";
 import type { ToolExecutionResult } from "../tools/types.js";
 import { AssistantError, ErrorCode } from "../util/errors.js";
@@ -284,6 +287,17 @@ export class HostBrowserProxy {
       targetClientId,
     );
 
+    if (
+      preferredClient === undefined &&
+      sourceActorPrincipalId !== undefined &&
+      targetClientId === undefined
+    ) {
+      if (isExtensionOnlyMethod(input.cdpMethod)) {
+        return Promise.resolve(extensionRequiredResult(input.cdpMethod));
+      }
+      return Promise.resolve(unavailableSameUserClientError("host_browser"));
+    }
+
     // Same-user enforcement: when the caller's actor is known, refuse to
     // dispatch to a client owned by a different actor. This covers the
     // cross-client exposure case where a web/iOS turn for actor A would