@vellumai/assistant 0.12.2-staging.2 → 0.12.2-staging.3

package/src/__tests__/mcp-list-plugin-servers.test.ts

@@ -8,38 +8,35 @@
  *
  * 1. A workspace entry of the same id wins. Getting precedence backwards
  *    would let a plugin redirect a server the user configured by hand.
- * 2. A plugin server is never health-checked. `McpClient.connect` resolves
- *    `mcp:<serverId>:headers` and `mcp:<serverId>:tokens` from the
- *    credential store, and a plugin controls both its server key and its
- *    URL, so probing one would send a workspace credential to an endpoint
- *    the plugin chose whenever an id happens to match a stored key.
+ * 2. A plugin server is never health-checked as a side effect of listing.
+ *    OAuth status is read from the plugin and endpoint-scoped credential
+ *    identity, while workspace static headers remain isolated.
  */
 
 import { mkdirSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { beforeEach, describe, expect, jest, mock, test } from "bun:test";
 
-const mockConnect = jest.fn();
-const mockDisconnect = jest.fn();
-/** Server ids the route actually constructed an MCP client for. */
-const connectedServerIds: string[] = [];
+const getServerState = jest.fn();
+const hasMcpOAuthTokens = jest.fn(async (target: any) => {
+  if (target.source === "plugin" && target.url === "not a url") {
+    throw new TypeError("invalid URL");
+  }
+  return true;
+});
 
 mock.module("../mcp/client.js", () => ({
   McpClient: class {
-    constructor(serverId: string) {
-      connectedServerIds.push(serverId);
-    }
-    get isConnected() {
-      return true;
+    constructor() {
+      throw new Error("list route must not construct an MCP client");
     }
-    get lastError() {
-      return null;
-    }
-    connect = mockConnect;
-    disconnect = mockDisconnect;
   },
 }));
 
+mock.module("../mcp/manager.js", () => ({
+  getMcpServerManager: () => ({ getServerState }),
+}));
+
 mock.module("../mcp/mcp-auth-orchestrator.js", () => ({
   orchestrateMcpOAuthConnect: async () => ({
     auth_url: "",
@@ -52,9 +49,7 @@ mock.module("../mcp/mcp-auth-state.js", () => ({
 }));
 
 mock.module("../mcp/mcp-oauth-provider.js", () => ({
-  // Stand in for a credential store that holds tokens for every id, which
-  // is the condition under which a leak would be observable.
-  hasMcpOAuthTokens: async () => true,
+  hasMcpOAuthTokens,
   deleteMcpOAuthCredentials: async () => ({ ok: true, failedKeys: [] }),
 }));
 
@@ -108,6 +103,19 @@ function writePlugin(name: string, mcpJson: unknown): void {
   writeFileSync(join(dir, "mcp.json"), JSON.stringify(mcpJson));
 }
 
+function writeStandardPlugin(name: string, mcpJson: unknown): void {
+  const dir = join(getWorkspacePluginsDir(), name);
+  mkdirSync(dir, { recursive: true });
+  writeFileSync(
+    join(dir, "plugin.json"),
+    JSON.stringify({
+      $schema: "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
+      name,
+    }),
+  );
+  writeFileSync(join(dir, "mcp.json"), JSON.stringify(mcpJson));
+}
+
 function unabyssManifest(): unknown {
   return {
     mcpServers: {
@@ -123,9 +131,8 @@ async function listServers(): Promise<ListedServer[]> {
 
 describe("internal_mcp_list, plugin-declared servers", () => {
   beforeEach(() => {
-    mockConnect.mockReset();
-    mockDisconnect.mockReset();
-    connectedServerIds.length = 0;
+    getServerState.mockReset();
+    hasMcpOAuthTokens.mockClear();
     rmSync(getWorkspacePluginsDir(), { recursive: true, force: true });
     mkdirSync(getWorkspacePluginsDir(), { recursive: true });
   });
@@ -138,6 +145,14 @@ describe("internal_mcp_list, plugin-declared servers", () => {
     expect(ids).toContain("unabyss");
   });
 
+  test("a standard-only plugin keeps its server identity", async () => {
+    writeStandardPlugin("unabyss", unabyssManifest());
+
+    const plugin = (await listServers()).find((s) => s.id === "unabyss")!;
+    expect(plugin.source).toBe("plugin");
+    expect(plugin.pluginName).toBe("unabyss");
+  });
+
   test("plugin servers are labelled with their origin, workspace servers are not", async () => {
     writePlugin("unabyss", unabyssManifest());
 
@@ -171,20 +186,36 @@ describe("internal_mcp_list, plugin-declared servers", () => {
     const servers = await listServers();
 
     expect(servers.find((s) => s.id === "unabyss")!.status).toEqual("declared");
-    // The credential mocks above return a token and an Authorization header
-    // for every id. Constructing a client for the plugin server is what
-    // would ship them to the plugin-declared URL.
-    expect(connectedServerIds).toContain("from-workspace");
-    expect(connectedServerIds).not.toContain("unabyss");
+    expect(getServerState).toHaveBeenCalledWith("from-workspace", "workspace");
+    expect(getServerState).toHaveBeenCalledWith("unabyss", "plugin");
   });
 
-  test("plugin servers report no assistant-owned auth even when the store has some", async () => {
+  test("plugin status uses only state recorded for the plugin source", async () => {
+    writePlugin("unabyss", unabyssManifest());
+    getServerState.mockImplementation(
+      (serverId: string, source: "workspace" | "plugin") =>
+        serverId === "unabyss" && source === "plugin" ? "connected" : undefined,
+    );
+
+    const plugin = (await listServers()).find((s) => s.id === "unabyss")!;
+    expect(plugin.status).toBe("connected");
+  });
+
+  test("plugin servers report endpoint-scoped OAuth without static auth", async () => {
     writePlugin("unabyss", unabyssManifest());
 
     const plugin = (await listServers()).find((s) => s.id === "unabyss")!;
-    expect(plugin.hasOAuth).toBe(false);
+    expect(plugin.hasOAuth).toBe(true);
     expect(plugin.hasStaticAuth).toBe(false);
     expect(plugin.authType).toEqual("none");
+    expect(hasMcpOAuthTokens).toHaveBeenCalledWith(
+      expect.objectContaining({
+        source: "plugin",
+        pluginName: "unabyss",
+        serverKey: "unabyss",
+        url: "https://mcp.unabyss.com",
+      }),
+    );
   });
 
   test("workspace servers keep reporting their auth state", async () => {
@@ -225,6 +256,20 @@ describe("internal_mcp_list, plugin-declared servers", () => {
     expect(ids).toContain("from-workspace");
   });
 
+  test("an invalid plugin transport URL does not break the listing", async () => {
+    writePlugin("bad-url", {
+      mcpServers: {
+        remote: { type: "streamable-http", url: "not a url" },
+      },
+    });
+
+    const servers = await listServers();
+    expect(servers.find((s) => s.id === "bad-url__remote")?.hasOAuth).toBe(
+      false,
+    );
+    expect(servers.some((s) => s.id === "from-workspace")).toBe(true);
+  });
+
   test("no plugins installed leaves the listing unchanged", async () => {
     const servers = await listServers();
     expect(servers.every((s) => s.source === "workspace")).toBe(true);

package/src/__tests__/mcp-tool-annotations-risk.test.ts

@@ -32,10 +32,12 @@ const { RiskLevel } = await import("../permissions/types.js");
 type ServerSource = "workspace" | "plugin";
 
 function serverConfig(source: ServerSource) {
-  return {
+  const base = {
     transport: { type: "stdio" as const, command: "echo", args: [] },
-    source,
   };
+  return source === "workspace"
+    ? { ...base, source }
+    : { ...base, source, pluginName: "plugin", serverKey: "server" };
 }
 
 interface RiskAnnotations {

package/src/__tests__/skills.test.ts

@@ -1054,6 +1054,16 @@ describe("ingress-dependent setup skills declare public-ingress intentionally",
     expect(includes ?? []).not.toContain("public-ingress");
   });
 
+  test("telegram-setup documents the private-chat limitation", () => {
+    const content = readFileSync(
+      join(FIRST_PARTY_SKILLS_DIR, "telegram-setup", "SKILL.md"),
+      "utf-8",
+    );
+    expect(content).toMatch(/private-chat only/i);
+    expect(content).toMatch(/group, supergroup, and channel/i);
+    expect(content).toMatch(/button taps/i);
+  });
+
   test("twilio-setup includes public-ingress", () => {
     const includes = readSkillIncludes(FIRST_PARTY_SKILLS_DIR, "twilio-setup");
     expect(includes).toBeDefined();

package/src/__tests__/user-plugin-loader.test.ts

@@ -93,6 +93,27 @@ describe("user plugin loader", () => {
     expect(initHooks).toHaveLength(1);
   });
 
+  test("loads a plugin via a standard plugin.json manifest", async () => {
+    const pluginDir = join(PLUGINS_DIR, "standard-plugin");
+    mkdirSync(join(pluginDir, "hooks"), { recursive: true });
+    writeFileSync(
+      join(pluginDir, "plugin.json"),
+      JSON.stringify({
+        $schema: "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
+        name: "standard-plugin",
+        version: "1.0.0",
+      }),
+    );
+    writeFileSync(
+      join(pluginDir, "hooks", "init.ts"),
+      "export default async function init(_ctx: unknown): Promise<void> {}\n",
+    );
+
+    await loadUserPlugins();
+
+    expect(await getUserHooksFor("init")).toHaveLength(1);
+  });
+
   test("per-plugin failure is isolated: other plugins still load", async () => {
     // Plugin A has a malformed package.json; the loader must isolate the
     // failure and still load the healthy sibling.

package/src/apps/app-store.ts

@@ -43,6 +43,7 @@ import type { EditEngineResult } from "../tools/shared/filesystem/edit-engine.js
 import { applyEdit } from "../tools/shared/filesystem/edit-engine.js";
 import { getLogger } from "../util/logger.js";
 import { getDataDir, getWorkspacePluginsDir } from "../util/platform.js";
+import { hasPluginManifest } from "../util/plugin-manifest.js";
 
 const log = getLogger("app-store");
 
@@ -787,8 +788,8 @@ function listAppsForPlugin(
  * `<workspace>/plugins/<name>/apps/`.
  *
  * Plugin discovery mirrors the plugin loader's `scanPlugins`: a plugin is an
- * entry that resolves to a directory (following symlinks) and carries a
- * `package.json` manifest. Stray directories without a manifest are ignored,
+ * entry that resolves to a directory (following symlinks) and carries a root
+ * plugin manifest. Stray directories without a manifest are ignored,
  * and disabled plugins (those with a `.disabled` sentinel) contribute nothing,
  * matching how their other surfaces (tools, hooks, routes) are gated.
  */
@@ -813,7 +814,7 @@ export function listPluginApps(): EnumeratedApp[] {
     } catch {
       continue;
     }
-    if (!existsSync(join(pluginDir, "package.json"))) {
+    if (!hasPluginManifest(pluginDir)) {
       continue;
     }
     if (isPluginDisabled(name)) {
@@ -874,7 +875,7 @@ function isSafeIdSegment(segment: string): boolean {
  * (`plugins~<name>~<app>`, resolved by direct path build). Returns null when
  * the app does not exist, when the id is not a safe path segment, or when a
  * plugin id fails the same installed-plugin gates as discovery (directory,
- * `package.json` manifest, not disabled).
+ * root manifest, not disabled).
  */
 export function resolveAppSource(id: string): ResolvedAppSource | null {
   if (id.startsWith(PLUGIN_APP_ID_PREFIX)) {
@@ -900,7 +901,7 @@ export function resolveAppSource(id: string): ResolvedAppSource | null {
     } catch {
       return null;
     }
-    if (!existsSync(join(pluginDir, "package.json"))) {
+    if (!hasPluginManifest(pluginDir)) {
       return null;
     }
     if (isPluginDisabled(pluginName)) {

package/src/browser/operations.ts

@@ -32,7 +32,8 @@ import {
 } from "../tools/browser/browser-execution.js";
 import { browserManager } from "../tools/browser/browser-manager.js";
 import { normalizeBrowserMode } from "../tools/browser/browser-mode.js";
-import type { ToolContext, ToolExecutionResult } from "../tools/types.js";
+import type { ToolExecutionResult } from "../tools/types.js";
+import type { BrowserOperationContext as ToolContext } from "./types.js";
 import type { BrowserOperation } from "./types.js";
 
 // ── Dispatch handlers ────────────────────────────────────────────────

package/src/browser/types.ts

@@ -1,3 +1,10 @@
+import type { ScopedCdpClient } from "../tools/browser/cdp-client/types.js";
+import type { ToolContext } from "../tools/types.js";
+
+export interface BrowserOperationContext extends ToolContext {
+  cdpClient?: ScopedCdpClient;
+}
+
 /**
  * Canonical browser operation identifiers and typed metadata.
  *

package/src/browser/virtual-desktop-target.ts

@@ -0,0 +1,34 @@
+import { getConfig } from "../config/loader.js";
+import { isVirtualDesktopEnabled } from "../desktop/virtual-desktop-feature.js";
+import { browserManager } from "../tools/browser/browser-manager.js";
+import { normalizeBrowserMode } from "../tools/browser/browser-mode.js";
+import { getPinnedTab } from "../tools/browser/pinned-tabs.js";
+import type { ToolContext } from "../tools/types.js";
+
+export function shouldUseVirtualDesktopBrowser(
+  desktop: boolean | undefined,
+  input: Record<string, unknown>,
+  context: ToolContext,
+): boolean {
+  if (desktop !== undefined) {
+    return desktop;
+  }
+  const mode = normalizeBrowserMode(input.browser_mode);
+  if (
+    "error" in mode ||
+    mode.mode !== "auto" ||
+    input.target_client_id ||
+    input.use_active_tab ||
+    context.transportInterface !== "web" ||
+    context.clientOs === "macos" ||
+    context.clientOs === "windows" ||
+    context.clientOs === "linux" ||
+    context.trustClass !== "guardian" ||
+    !context.sourceActorPrincipalId ||
+    browserManager.getPreferredBackendKind(context.conversationId) !== null ||
+    getPinnedTab(context.conversationId)
+  ) {
+    return false;
+  }
+  return isVirtualDesktopEnabled(getConfig());
+}

package/src/calls/__tests__/progress-narration.test.ts

@@ -185,6 +185,29 @@ describe("createVoiceProgressNarrator", () => {
     expect(Date.now() - startedAt).toBeLessThan(1000);
   });
 
+  test("an update that runs out of budget aborts as a narration timeout, not a session abort", async () => {
+    // The budget lapsing means this beat goes unspoken; it does not mean the
+    // call ended. Sharing `voice_session_aborted` made a narrator whose budget
+    // sat below the model's roundtrip read in the logs as a session dying once
+    // per update, which is what hid a turn that had gone silent for minutes.
+    let seen: AbortSignal | undefined;
+    const narrator = createVoiceProgressNarrator({
+      config: VoiceProgressConfigSchema.parse({ generationTimeoutMs: 20 }),
+      getProvider: async () =>
+        stubProvider((_messages, options) => {
+          seen = options?.signal;
+          return new Promise<ProviderResponse>(() => {});
+        }),
+    });
+
+    expect(await narrator.generateProgressText(progressInput)).toBeNull();
+    expect(seen?.aborted).toBe(true);
+    expect(seen?.reason).toMatchObject({
+      kind: "voice_progress_narration_timeout",
+      source: "voice-progress-narration",
+    });
+  });
+
   test("a caller abort settles promptly", async () => {
     const narrator = createVoiceProgressNarrator({
       config: VoiceProgressConfigSchema.parse({

package/src/calls/__tests__/voice-control-protocol.test.ts

@@ -154,11 +154,18 @@ describe("session control markers", () => {
     expect(isIncompleteControlMarkerTail("[MUTE:30]")).toBe(false);
     expect(isIncompleteControlMarkerTail("[UPDATES:FEW")).toBe(true);
     expect(isIncompleteControlMarkerTail("[UPDATES:FEWER]")).toBe(false);
+    expect(isIncompleteControlMarkerTail("[LOOK:SCR")).toBe(true);
+    expect(
+      stripInternalSpeechMarkers("Taking a look. [LOOK:SCREEN]").trim(),
+    ).toBe("Taking a look.");
   });
 
   test.each([
     ["Okay, talk soon. [END_CALL]", { action: "end" }],
     ["Muted. [MUTE]", { action: "mute" }],
+    ["Taking a look. [LOOK:SCREEN]", { action: "look_screen" }],
+    ["Show me. [LOOK:CAMERA]", { action: "look_camera" }],
+    ["Okay, I'll stop looking. [LOOK:STOP]", { action: "look_stop" }],
     [
       "I'll check in less. [UPDATES:FEWER]",
       { action: "updates", cadence: "fewer" },

package/src/calls/__tests__/voice-session-bridge.test.ts

@@ -2146,6 +2146,68 @@ describe("front-door leg tool suppression", () => {
   });
 });
 
+describe("desktop skill preactivation", () => {
+  async function preactivatedFor(turn: Record<string, unknown>): Promise<{
+    skillIds: string[];
+    proxyInterfaces: unknown[];
+    skillIdsDuringLoop: string[];
+  }> {
+    const skillIds: string[] = [];
+    const proxyInterfaces: unknown[] = [];
+    let skillIdsDuringLoop: string[] = [];
+    const fake = makeFakeConversation({
+      processing: false,
+      runAgentLoop: async () => {
+        skillIdsDuringLoop = [...skillIds];
+      },
+    });
+    Object.assign(fake.conversation, {
+      addPreactivatedSkillId: (id: string) => {
+        skillIds.push(id);
+      },
+      ensureHostProxiesForTurn: (sourceInterface: unknown) => {
+        proxyInterfaces.push(sourceInterface);
+      },
+    });
+    fakeConversation = fake.conversation;
+
+    await startVoiceTurn({
+      ...makeTurnOptions(undefined, "conv-desktop-skills"),
+      userMessageInterface: "macos",
+      ...turn,
+    });
+    await flushMicrotasks();
+    return { skillIds, proxyInterfaces, skillIdsDuringLoop };
+  }
+
+  test("an escalated leg of a macOS desktop session starts with computer use active", async () => {
+    const result = await preactivatedFor({
+      routingLeg: "escalated",
+      macosDesktopSession: true,
+    });
+
+    expect(result.skillIdsDuringLoop).toContain("computer-use");
+    expect(result.proxyInterfaces).toEqual(["macos"]);
+  });
+
+  test("a session from any other client leaves the desktop skills to be loaded", async () => {
+    const result = await preactivatedFor({ routingLeg: "escalated" });
+
+    expect(result.skillIds).toEqual([]);
+    expect(result.proxyInterfaces).toEqual([]);
+  });
+
+  test("the toolless front-door leg is never preactivated", async () => {
+    const result = await preactivatedFor({
+      routingLeg: "front-door",
+      macosDesktopSession: true,
+    });
+
+    expect(result.skillIds).toEqual([]);
+    expect(result.proxyInterfaces).toEqual([]);
+  });
+});
+
 describe("cutFrontDoorContentAtVerdict", () => {
   test("null when the content carries no verdict token (committed answer)", () => {
     expect(

package/src/calls/progress-narration.ts

@@ -16,7 +16,7 @@ import type {
   ProviderResponse,
   ToolDefinition,
 } from "../providers/types.js";
-import { createAbortReason } from "../util/abort-reasons.js";
+import { createAbortReason, isAbortReason } from "../util/abort-reasons.js";
 import { getLogger } from "../util/logger.js";
 
 const log = getLogger("voice-progress-narration");
@@ -164,7 +164,10 @@ async function requestBoundedResponse(args: {
   const timeoutTimer = setTimeout(
     () =>
       timeoutController.abort(
-        createAbortReason("voice_session_aborted", "voice-progress-narration"),
+        createAbortReason(
+          "voice_progress_narration_timeout",
+          "voice-progress-narration",
+        ),
       ),
     args.timeoutMs,
   );
@@ -260,9 +263,19 @@ export function createVoiceProgressNarrator(options: {
         }
         return trimmed;
       } catch (error) {
+        // Why the beat went unspoken, as one greppable field. A narrator whose
+        // budget is below the model's real roundtrip drops every update at the
+        // deadline and reads in the logs as a run of unrelated failures; naming
+        // the outcome is what makes that run legible as "the feature is off".
+        const outcome = isAbortReason(error)
+          ? error.kind === "voice_progress_narration_timeout"
+            ? "timed_out"
+            : "session_ended"
+          : "error";
         log.info(
           {
             error,
+            outcome,
             providerResolveMs,
             totalMs: Math.round(performance.now() - startedAt),
             timeoutMs: options.config.generationTimeoutMs,

package/src/calls/voice-control-protocol.ts

@@ -60,6 +60,18 @@ export const FEWER_UPDATES_MARKER = "[UPDATES:FEWER]";
 export const NORMAL_UPDATES_MARKER = "[UPDATES:NORMAL]";
 const UPDATES_MARKER_PREFIX = "[UPDATES:";
 
+/**
+ * Look session controls for live voice: turn on a screen share
+ * ({@link LOOK_SCREEN_MARKER}) or the camera ({@link LOOK_CAMERA_MARKER}) so
+ * the call can see what the user means by "take a look". Carried out by the
+ * client, like mute and end.
+ */
+export const LOOK_SCREEN_MARKER = "[LOOK:SCREEN]";
+export const LOOK_CAMERA_MARKER = "[LOOK:CAMERA]";
+/** Stop showing the call the screen and the camera, whichever is on. */
+export const LOOK_STOP_MARKER = "[LOOK:STOP]";
+const LOOK_MARKER_PREFIX = "[LOOK:";
+
 // ---------------------------------------------------------------------------
 // Regexes
 // ---------------------------------------------------------------------------
@@ -82,6 +94,7 @@ const ESCALATE_VERDICT_TOKEN_REGEX = /\[1\]/g;
 const MINIMIZE_ROOM_MARKER_REGEX = /\[-1\]/g;
 const MUTE_MARKER_REGEX = /\[MUTE(?::\s*[^\]]*)?\]/g;
 const UPDATES_MARKER_REGEX = /\[UPDATES:\s*[^\]]*\]/g;
+const LOOK_MARKER_REGEX = /\[LOOK:\s*[^\]]*\]/g;
 const GUARDIAN_TIMEOUT_MARKER_REGEX = /\[GUARDIAN_TIMEOUT\]/g;
 const GUARDIAN_UNAVAILABLE_MARKER_REGEX = /\[GUARDIAN_UNAVAILABLE\]/g;
 
@@ -209,6 +222,7 @@ export function stripInternalSpeechMarkers(text: string): string {
     .replace(MINIMIZE_ROOM_MARKER_REGEX, "")
     .replace(MUTE_MARKER_REGEX, "")
     .replace(UPDATES_MARKER_REGEX, "")
+    .replace(LOOK_MARKER_REGEX, "")
     .replace(GUARDIAN_TIMEOUT_MARKER_REGEX, "")
     .replace(GUARDIAN_UNAVAILABLE_MARKER_REGEX, "");
   return result;
@@ -237,6 +251,7 @@ const CONTROL_MARKER_STRINGS = [
   MUTE_MARKER,
   MUTE_MARKER_PREFIX,
   UPDATES_MARKER_PREFIX,
+  LOOK_MARKER_PREFIX,
   "[GUARDIAN_TIMEOUT]",
   "[GUARDIAN_UNAVAILABLE]",
 ];
@@ -252,6 +267,7 @@ const FIRST_BRACKET_TERMINATED_PREFIXES = [
   "[USER_INSTRUCTION:",
   MUTE_MARKER_PREFIX,
   UPDATES_MARKER_PREFIX,
+  LOOK_MARKER_PREFIX,
 ];
 
 const GUARDIAN_APPROVAL_PREFIX = "[ASK_GUARDIAN_APPROVAL:";
@@ -339,15 +355,19 @@ export function createControlMarkerHoldback(
 /**
  * A session control a live-voice reply asked for with a terminal marker:
  * `end` from {@link END_CALL_MARKER}, `mute` from {@link MUTE_MARKER} or its
- * timed form, `updates` from the progress-cadence markers.
+ * timed form, `updates` from the progress-cadence markers, `look_screen` and
+ * `look_camera` and `look_stop` from the look markers.
  */
 export type SessionControlRequest =
   | { readonly action: "end" }
   | { readonly action: "mute"; readonly durationMs?: number }
-  | { readonly action: "updates"; readonly cadence: "fewer" | "normal" };
+  | { readonly action: "updates"; readonly cadence: "fewer" | "normal" }
+  | { readonly action: "look_screen" }
+  | { readonly action: "look_camera" }
+  | { readonly action: "look_stop" };
 
 const TERMINAL_SESSION_CONTROL_REGEX =
-  /(\[END_CALL\]|\[UPDATES:(FEWER|NORMAL)\]|\[MUTE\]|\[MUTE:\s*([^\]]*)\])\s*$/;
+  /(\[END_CALL\]|\[UPDATES:(FEWER|NORMAL)\]|\[LOOK:(SCREEN|CAMERA|STOP)\]|\[MUTE\]|\[MUTE:\s*([^\]]*)\])\s*$/;
 
 /**
  * The session control a reply ends with, or null.
@@ -378,7 +398,17 @@ export function parseTerminalSessionControl(
       cadence: match[2] === "FEWER" ? "fewer" : "normal",
     };
   }
-  const seconds = match[3] === undefined ? NaN : Number(match[3].trim());
+  if (match[3] !== undefined) {
+    return {
+      action:
+        match[3] === "SCREEN"
+          ? "look_screen"
+          : match[3] === "CAMERA"
+            ? "look_camera"
+            : "look_stop",
+    };
+  }
+  const seconds = match[4] === undefined ? NaN : Number(match[4].trim());
   if (
     Number.isFinite(seconds) &&
     seconds > 0 &&

package/src/calls/voice-session-bridge.ts

@@ -31,6 +31,7 @@ import {
 import { CONVERSATION_BUSY_MESSAGE } from "../daemon/conversation-messaging.js";
 import { resolveChannelCapabilities } from "../daemon/conversation-runtime-assembly.js";
 import { getOrCreateConversation } from "../daemon/conversation-store.js";
+import { preactivateHostProxySkills } from "../daemon/host-proxy-preactivation.js";
 import type { TrustContext } from "../daemon/trust-context-types.js";
 import {
   newestPersistedSightFrame,
@@ -464,6 +465,14 @@ export interface VoiceTurnOptions {
    * path has always used.
    */
   actorFallbackSuppressed?: boolean;
+  /**
+   * Whether the session was opened from the macOS desktop client. A leg that
+   * can run tools then starts with the desktop skills (computer use, app
+   * control, screen annotation) already active, as a typed turn from that
+   * client does. The turn interface cannot answer this: every live-voice
+   * session reports `macos` for its channel capabilities, iOS included.
+   */
+  macosDesktopSession?: boolean;
   /** Whether this is an inbound call (no outbound task). */
   isInbound: boolean;
   /** The outbound call task, if any. */
@@ -2016,6 +2025,20 @@ export async function startVoiceTurn(
         (needsImagePin
           ? VOICE_IMAGE_PROFILE
           : (conversationProfile?.profile ?? null));
+      if (opts.macosDesktopSession === true && !frontDoorToolsSuppressed) {
+        const sourceInterface = turnInterfaceContext.userMessageInterface;
+        const sourceActorPrincipalId =
+          voiceTurnValues.actorPrincipalId ?? undefined;
+        conversation.ensureHostProxiesForTurn(
+          sourceInterface,
+          sourceActorPrincipalId,
+        );
+        preactivateHostProxySkills(
+          conversation,
+          sourceInterface,
+          sourceActorPrincipalId,
+        );
+      }
       await conversation.runAgentLoop(persistedContent, messageId, {
         onEvent: (msg: AssistantEvent) => {
           if (msg.type === "assistant_turn_start") {