@vellumai/assistant 0.12.5 → 0.12.6-dev.202609292116.41f7caa

package/src/daemon/conversation-agent-loop-handlers.ts

@@ -107,6 +107,7 @@ import { faviconUrlForDomain } from "../util/favicon.js";
 import { redactLogString } from "../util/log-redact.js";
 import { getLogger } from "../util/logger.js";
 import { withSqliteRetry } from "../util/sqlite-retry.js";
+import { safeStringSlice } from "../util/unicode.js";
 import type { DirectiveRequest } from "./assistant-attachments.js";
 import {
   cleanAssistantContent,
@@ -640,6 +641,8 @@ export interface EventHandlerState {
    * rather than on every delta.
    */
   readonly surfacePendingScannedToolUseIds: Set<string>;
+  /** App previews whose cumulative JSON reached the client payload cap. */
+  readonly cappedAppPreviewToolUseIds: Set<string>;
   /**
    * In-flight priming of {@link liveRevealGuardEntries}. The dispatcher
    * awaits this before processing a `text_delta` (and before the
@@ -777,6 +780,7 @@ export function createEventHandlerState(): EventHandlerState {
     forChatMintWatermark: currentForChatMintWatermark(),
     stagedRevealIdentities: new Set(),
     surfacePendingScannedToolUseIds: new Set(),
+    cappedAppPreviewToolUseIds: new Set(),
     liveRevealGuardPriming: undefined,
   };
 }
@@ -1411,6 +1415,7 @@ function schedulePartialFlush(
 // tools the client discards it (extractCodePreview only handles app tools),
 // so we skip forwarding entirely to avoid transport/decode overhead.
 const APP_TOOL_NAMES = new Set(["app_create"]);
+const APP_INPUT_PREVIEW_CHAR_LIMIT = 256_000;
 
 // ── Surface Placeholder Detection ────────────────────────────────────
 // A `visual` ui_show streams the longest tool input the model produces, and
@@ -2111,13 +2116,24 @@ export function handleInputJsonDelta(
   // Only forward input deltas for app tools — the client only uses this
   // stream for app_create code previews. Non-app tools would send large
   // cumulative JSON on every delta with no benefit.
-  if (!APP_TOOL_NAMES.has(event.toolName)) {
+  if (
+    !APP_TOOL_NAMES.has(event.toolName) ||
+    state.cappedAppPreviewToolUseIds.has(event.toolUseId)
+  ) {
     return;
   }
+  const content = safeStringSlice(
+    event.accumulatedJson,
+    0,
+    APP_INPUT_PREVIEW_CHAR_LIMIT,
+  );
+  if (content.length < event.accumulatedJson.length) {
+    state.cappedAppPreviewToolUseIds.add(event.toolUseId);
+  }
   deps.onEvent({
     type: "tool_input_delta",
     toolName: event.toolName,
-    content: event.accumulatedJson,
+    content,
     conversationId: deps.ctx.conversationId,
     toolUseId: event.toolUseId,
     messageId: state.lastAssistantMessageId,

package/src/daemon/conversation-agent-loop.ts

@@ -44,6 +44,7 @@ import { isSendUserMessageActiveForTurn } from "../config/send-user-message-gate
 import { desktopAutomationLease } from "../desktop/desktop-automation-lease.js";
 import { writeRelationshipState } from "../home/relationship-state-writer.js";
 import type { UserPromptSubmitInputContext } from "../hooks/types.js";
+import type { SupportedLocale } from "../i18n/index.js";
 import {
   addMessage,
   deleteMessageById,
@@ -500,6 +501,7 @@ export async function runAgentLoopImpl(
      * loop defaults to `'mainAgent'` for user-initiated turns.
      */
     callSite?: LLMCallSite;
+    locale?: SupportedLocale;
     /** Skip fresh retrieval while keeping resident memory and static context. */
     skipMemoryRetrieval?: boolean;
     /**
@@ -1719,10 +1721,12 @@ export async function runAgentLoopImpl(
           onCheckpoint,
           callSite: turnCallSite,
           inferenceCallSite,
+          locale: options?.locale,
           suppressAssistantText: sendUserMessageActive,
           supportsDynamicUi: conversationSupportsDynamicUi(ctx),
           trust: loopTrust,
           overrideProfile: turnOverrideProfile,
+          ...(autoRoute ? { overrideProfileOrigin: "auto" as const } : {}),
           ...(forceOverrideProfile ? { forceOverrideProfile: true } : {}),
           resolveOverrideProfile: refreshCurrentProfileState,
           ...(onModelCallPrepared !== undefined ? { onModelCallPrepared } : {}),
@@ -2147,6 +2151,9 @@ export async function runAgentLoopImpl(
     // path to the terminal SSE that re-enables the composer.
     ctx.messages = restoredHistory;
 
+    // The row's override is whichever profile served the last call.
+    const mainRowOverrideProfile =
+      state.exchangeInferenceProfile ?? refreshCurrentProfileState() ?? null;
     emitUsage(
       ctx,
       state.exchangeInputTokens,
@@ -2171,16 +2178,17 @@ export async function runAgentLoopImpl(
       // backup (via `state.exchangeProviderName` / `state.model`), so
       // attributing the profile from the primary would write a row that
       // contradicts itself. `forceOverrideProfile` floats it above the
-      // call-site profile exactly as the fallback dispatch did.
+      // call-site profile exactly as the fallback dispatch did. The Auto
+      // origin applies only while the row's override is still the router's
+      // pick: a profile switched in mid-turn is the user's.
       {
         callSite: inferenceCallSite,
-        overrideProfile:
-          state.exchangeInferenceProfile ??
-          refreshCurrentProfileState() ??
-          null,
+        overrideProfile: mainRowOverrideProfile,
         ...(state.exchangeInferenceProfile !== undefined
           ? { forceOverrideProfile: true }
-          : {}),
+          : autoRoute && mainRowOverrideProfile === autoRoute.profile
+            ? { overrideProfileOrigin: "auto" as const }
+            : {}),
       },
       turnCronRunId,
     );

package/src/daemon/conversation-evictor.ts

@@ -1,4 +1,5 @@
 import { getSubagentManager } from "../subagent/index.js";
+import { getContainerMemoryLimitBytes } from "../util/cgroup-memory.js";
 import { getLogger } from "../util/logger.js";
 import { getConversationMap } from "./conversation-registry.js";
 
@@ -15,7 +16,7 @@ export interface EvictorOptions {
   ttlMs?: number;
   /** Max number of in-memory conversations before LRU eviction kicks in. Default: 100. */
   maxConversations?: number;
-  /** RSS threshold (bytes) above which idle conversations are aggressively evicted. Default: 3 GB. */
+  /** RSS threshold (bytes) above which idle conversations are aggressively evicted. Default: {@link defaultMemoryThresholdBytes}. */
   memoryThresholdBytes?: number;
   /** Interval between periodic sweeps (ms). Default: 60 s. */
   sweepIntervalMs?: number;
@@ -34,13 +35,34 @@ export interface EvictionResult {
 
 const DEFAULT_TTL_MS = 30 * 60 * 1000; // 30 minutes
 const DEFAULT_MAX_CONVERSATIONS = 100;
-const DEFAULT_MEMORY_THRESHOLD_BYTES = 3072 * 1024 * 1024; // 3 GB
+/** Threshold when no container limit is known (local hosts). */
+const FALLBACK_MEMORY_THRESHOLD_BYTES = 3072 * 1024 * 1024; // 3 GiB
+/**
+ * Share of the container memory limit the daemon's own RSS may reach before
+ * idle conversations are evicted. The rest of the limit is Qdrant, the
+ * workers, and tool children, so the daemon cannot have it all.
+ */
+const MEMORY_THRESHOLD_LIMIT_FRACTION = 0.5;
 const DEFAULT_SWEEP_INTERVAL_MS = 60 * 1000; // 60 seconds
+/**
+ * Idle conversations evicted per sweep under memory pressure. RSS cannot fall
+ * until the disposed heap is collected after the sweep returns, so the sweep
+ * evicts a bounded batch and the next sweep re-measures.
+ */
+const MEMORY_EVICTION_BATCH = 10;
+
+/** Default memory-pressure threshold: half the container limit, or 3 GiB when there is none. */
+export function defaultMemoryThresholdBytes(limitBytes: number | null): number {
+  return limitBytes != null
+    ? Math.floor(limitBytes * MEMORY_THRESHOLD_LIMIT_FRACTION)
+    : FALLBACK_MEMORY_THRESHOLD_BYTES;
+}
 
 export class ConversationEvictor {
   private readonly ttlMs: number;
   private readonly maxConversations: number;
-  private readonly memoryThresholdBytes: number;
+  /** Explicit threshold, or null to derive it from the container limit on first use. */
+  private memoryThresholdBytes: number | null;
   private readonly sweepIntervalMs: number;
 
   /** Tracks last access time per conversation ID. */
@@ -57,8 +79,7 @@ export class ConversationEvictor {
     this.ttlMs = options?.ttlMs ?? DEFAULT_TTL_MS;
     this.maxConversations =
       options?.maxConversations ?? DEFAULT_MAX_CONVERSATIONS;
-    this.memoryThresholdBytes =
-      options?.memoryThresholdBytes ?? DEFAULT_MEMORY_THRESHOLD_BYTES;
+    this.memoryThresholdBytes = options?.memoryThresholdBytes ?? null;
     this.sweepIntervalMs =
       options?.sweepIntervalMs ?? DEFAULT_SWEEP_INTERVAL_MS;
   }
@@ -155,25 +176,26 @@ export class ConversationEvictor {
       }
     }
 
-    // Phase 3: Memory pressure — if RSS exceeds threshold, evict idle conversations
-    // starting from least-recently-used until we're under the threshold or
-    // no more idle conversations remain.
+    // Phase 3: Memory pressure — if RSS exceeds threshold, evict a batch of
+    // idle conversations starting from least-recently-used.
     const rss = process.memoryUsage.rss();
-    if (rss > this.memoryThresholdBytes) {
-      const sorted = this.idleConversationsByLru();
-      if (sorted.length > 0) {
+    const thresholdBytes = this.resolveMemoryThresholdBytes();
+    if (rss > thresholdBytes) {
+      const batch = this.idleConversationsByLru().slice(
+        0,
+        MEMORY_EVICTION_BATCH,
+      );
+      if (batch.length > 0) {
         log.warn(
           {
             rssBytes: rss,
-            thresholdBytes: this.memoryThresholdBytes,
+            thresholdBytes,
             conversationCount: this.conversations.size,
+            evicting: batch.length,
           },
           "Memory pressure detected, evicting idle conversations",
         );
-        for (const [id, conversation] of sorted) {
-          if (process.memoryUsage.rss() <= this.memoryThresholdBytes) {
-            break;
-          }
+        for (const [id, conversation] of batch) {
           this.evict(id, conversation);
           result.memoryEvicted++;
         }
@@ -198,6 +220,18 @@ export class ConversationEvictor {
 
   // ── Internals ──────────────────────────────────────────────────────
 
+  /**
+   * Resolved on first sweep rather than at construction: the module-level
+   * singleton is built at import, before the daemon has loaded its dotenv
+   * file, and VELLUM_MEMORY_LIMIT may come from there.
+   */
+  private resolveMemoryThresholdBytes(): number {
+    this.memoryThresholdBytes ??= defaultMemoryThresholdBytes(
+      getContainerMemoryLimitBytes(),
+    );
+    return this.memoryThresholdBytes;
+  }
+
   private evict(id: string, conversation: EvictableConversation): void {
     conversation.dispose();
     this.conversations.delete(id);

package/src/daemon/conversation-messaging.ts

@@ -26,6 +26,7 @@ import {
   parseInterfaceId,
 } from "../channels/types.js";
 import { parseImageDimensions } from "../context/image-dimensions.js";
+import type { SupportedLocale } from "../i18n/index.js";
 import {
   type ProviderMessageMetadata,
   providerMessageMetadataSchema,
@@ -824,6 +825,7 @@ export interface EnqueueMessageOptions {
   currentPage?: string;
   metadata?: Record<string, unknown>;
   isInteractive?: boolean;
+  locale?: SupportedLocale;
   displayContent?: string;
   transport?: ConversationTransportMetadata;
   clientMessageId?: string;
@@ -873,6 +875,7 @@ export function enqueueMessage(
     currentPage,
     metadata,
     isInteractive,
+    locale,
     displayContent,
     transport,
     clientMessageId,
@@ -912,6 +915,7 @@ export function enqueueMessage(
     turnChannelContext,
     turnInterfaceContext,
     isInteractive,
+    locale,
     sourceActorPrincipalId,
     authContext: queuedAuthContext,
     trustContext: queuedTrustContext,

package/src/daemon/conversation-process.ts

@@ -20,6 +20,7 @@ import {
   type TurnInterfaceContext,
 } from "../channels/types.js";
 import type { LLMCallSite } from "../config/schemas/llm.js";
+import type { SupportedLocale } from "../i18n/index.js";
 import { extractPreferences } from "../notifications/preference-extractor.js";
 import { createPreference } from "../notifications/preferences-store.js";
 import {
@@ -1278,6 +1279,7 @@ async function drainSingleMessage(
     titleText?: string;
     isHiddenPrompt?: boolean;
     turnTrustContext?: TrustContext;
+    locale?: SupportedLocale;
     cronRunId?: string | null;
   } = {
     isUserMessage: true,
@@ -1289,6 +1291,9 @@ async function drainSingleMessage(
   if (next.isInteractive !== undefined) {
     drainLoopOptions.isInteractive = next.isInteractive;
   }
+  if (next.locale !== undefined) {
+    drainLoopOptions.locale = next.locale;
+  }
   if (agentLoopContent !== resolvedContent) {
     drainLoopOptions.titleText = resolvedContent;
   }
@@ -1797,6 +1802,7 @@ async function drainBatch(
     isHiddenPrompt?: boolean;
     notifyUserMessageId?: string;
     turnTrustContext?: TrustContext;
+    locale?: SupportedLocale;
     cronRunId?: string | null;
   } = {
     isUserMessage: true,
@@ -1816,6 +1822,9 @@ async function drainBatch(
   if (lastSuccessfulBatchEntry?.isInteractive !== undefined) {
     drainLoopOptions.isInteractive = lastSuccessfulBatchEntry.isInteractive;
   }
+  if (lastSuccessfulBatchEntry?.locale !== undefined) {
+    drainLoopOptions.locale = lastSuccessfulBatchEntry.locale;
+  }
   // A batch counts as a hidden turn only when every message in it is a
   // hidden machine signal — one genuine user prompt justifies the
   // prompt-as-user-speech consumers (title generation).
@@ -1871,6 +1880,7 @@ export interface ProcessMessageOptions {
   currentPage?: string;
   isInteractive?: boolean;
   callSite?: LLMCallSite;
+  locale?: SupportedLocale;
   /**
    * Optional ad-hoc inference-profile override applied to every LLM call
    * this turn issues (e.g. a schedule's pinned profile). Forwarded to
@@ -1928,6 +1938,7 @@ export async function processMessage(
     currentPage,
     isInteractive,
     callSite,
+    locale,
     overrideProfile,
     displayContent,
     sourceActorPrincipalId,
@@ -2451,6 +2462,7 @@ export async function processMessage(
     isUserMessage?: boolean;
     titleText?: string;
     callSite?: LLMCallSite;
+    locale?: SupportedLocale;
     overrideProfile?: string;
     turnTrustContext?: TrustContext;
   } = {
@@ -2471,6 +2483,9 @@ export async function processMessage(
   if (callSite !== undefined) {
     loopOptions.callSite = callSite;
   }
+  if (locale !== undefined) {
+    loopOptions.locale = locale;
+  }
   if (overrideProfile !== undefined) {
     loopOptions.overrideProfile = overrideProfile;
   }

package/src/daemon/conversation-queue-manager.ts

@@ -10,6 +10,7 @@ import type {
   TurnChannelContext,
   TurnInterfaceContext,
 } from "../channels/types.js";
+import type { SupportedLocale } from "../i18n/index.js";
 import type { AuthContext } from "../runtime/auth/types.js";
 import { getLogger } from "../util/logger.js";
 import type { UserMessageAttachment } from "./message-protocol.js";
@@ -30,6 +31,7 @@ export interface QueuedMessage {
   turnInterfaceContext?: TurnInterfaceContext;
   /** When false, the turn has no interactive user and should skip clarification prompts. */
   isInteractive?: boolean;
+  locale?: SupportedLocale;
   /** Requester identity captured from the verified auth context at enqueue time. */
   sourceActorPrincipalId?: string;
   /** Full auth snapshot captured at enqueue time for turn-scoped authorization decisions. */

package/src/daemon/conversation.ts

@@ -44,6 +44,7 @@ import {
   derefToolResultReReads,
   postTurnTruncateToolResults,
 } from "../context/post-turn-tool-result-truncation.js";
+import type { SupportedLocale } from "../i18n/index.js";
 import { readProviderMetadata } from "../messaging/read-provider-metadata.js";
 import { isGuardianCardRow } from "../notifications/approval-card-data.js";
 import { PermissionPrompter } from "../permissions/prompter.js";
@@ -3528,6 +3529,7 @@ export class Conversation {
        */
       replyDeliveredInAppOnly?: boolean;
       callSite?: LLMCallSite;
+      locale?: SupportedLocale;
       /** Skip fresh retrieval while keeping resident memory and static context. */
       skipMemoryRetrieval?: boolean;
       /** Provider configuration source when distinct from turn semantics. */

package/src/daemon/doordash-steps.ts

@@ -78,7 +78,7 @@ function updateDoordashSteps(
     return undefined;
   }
 
-  const updated = steps.map((s, i) => {
+  return steps.map((s, i) => {
     if (i < stepIndex) {
       // Steps before current should be completed
       return s.status === "completed" ? s : { ...s, status: "completed" };
@@ -96,8 +96,6 @@ function updateDoordashSteps(
     }
     return s;
   });
-
-  return updated;
 }
 
 // ── Helpers for reading/writing the task_progress surface ─────────────

package/src/daemon/handlers/__tests__/config-a2a-accept.test.ts

@@ -21,7 +21,11 @@ import {
 } from "../../../contacts/contact-store.js";
 import { getSqlite } from "../../../persistence/db-connection.js";
 import { initializeDb } from "../../../persistence/db-init.js";
-import { acceptA2AInvite, createA2AInvite } from "../config-a2a.js";
+import {
+  acceptA2AInvite,
+  assertSafeSenderGatewayUrl,
+  createA2AInvite,
+} from "../config-a2a.js";
 
 await initializeDb();
 
@@ -487,4 +491,42 @@ describe("acceptA2AInvite", () => {
     const contacts = searchContacts({ channelType: "a2a" });
     expect(contacts).toHaveLength(0);
   });
+
+  test("rejects http, credentials, and loopback or metadata hosts", async () => {
+    const originalFetch = globalThis.fetch;
+    let fetchCalls = 0;
+    globalThis.fetch = (async () => {
+      fetchCalls += 1;
+      throw new Error("fetch should not run");
+    }) as unknown as typeof fetch;
+
+    try {
+      for (const url of [
+        "http://sender.example.com",
+        "https://user:pass@sender.example.com",
+        "https://127.0.0.1",
+        "https://localhost",
+        "https://169.254.169.254",
+        "https://metadata.google.internal",
+      ]) {
+        const result = await acceptA2AInvite({
+          senderGatewayUrl: url,
+          senderAssistantId: SENDER_ASSISTANT_ID,
+          token: "any-token",
+        });
+        expect(result.success).toBe(false);
+        expect(result.errorCode).toBe("invalid_sender_url");
+      }
+      expect(fetchCalls).toBe(0);
+    } finally {
+      globalThis.fetch = originalFetch;
+    }
+  });
+
+  test("allows https LAN peers used by self-hosted accept", () => {
+    expect(assertSafeSenderGatewayUrl("https://192.168.1.20:8787").ok).toBe(
+      true,
+    );
+    expect(assertSafeSenderGatewayUrl("https://peer.ts.net").ok).toBe(true);
+  });
 });

package/src/daemon/handlers/__tests__/config-channels.test.ts

@@ -68,7 +68,7 @@ mock.module("../../../ipc/gateway-client.js", () => ({
     }
     if (method === "contacts_get_rich") {
       if (mockGwContactChannels == null) {
-        return { ok: true, contact: null };
+        return null;
       }
       return {
         ok: true,

package/src/daemon/handlers/config-a2a.ts

@@ -303,6 +303,54 @@ export function redeemA2AInvite(params: {
 // ── Self-hosted broker ──────────────────────────────────────────────
 
 const ACCEPT_TIMEOUT_MS = 15_000;
+const ACCEPT_MAX_BODY_BYTES = 64_000;
+
+const BLOCKED_SENDER_HOSTS = new Set([
+  "localhost",
+  "localhost.localdomain",
+  "metadata.google.internal",
+]);
+
+/**
+ * Self-hosted accept brokers an outbound POST to the peer's invite/complete
+ * URL. Require https, reject credentials, and refuse loopback/metadata
+ * literals so a settings.write caller cannot steer the daemon at link-local
+ * or cloud-metadata endpoints. RFC1918 and Tailscale hostnames stay allowed
+ * because that is how self-hosted peers reach each other on a LAN.
+ */
+export function assertSafeSenderGatewayUrl(
+  raw: string,
+): { ok: true; origin: string } | { ok: false; error: string } {
+  let parsed: URL;
+  try {
+    parsed = new URL(raw);
+  } catch {
+    return { ok: false, error: "senderGatewayUrl must be a valid URL" };
+  }
+  if (parsed.protocol !== "https:") {
+    return { ok: false, error: "senderGatewayUrl must use https" };
+  }
+  if (parsed.username || parsed.password) {
+    return {
+      ok: false,
+      error: "senderGatewayUrl must not include credentials",
+    };
+  }
+  const host = parsed.hostname.replace(/^\[|\]$/g, "").toLowerCase();
+  if (!host) {
+    return { ok: false, error: "senderGatewayUrl must include a host" };
+  }
+  if (BLOCKED_SENDER_HOSTS.has(host) || host.endsWith(".localhost")) {
+    return { ok: false, error: "senderGatewayUrl host is not allowed" };
+  }
+  if (host === "127.0.0.1" || host === "::1" || host === "0.0.0.0") {
+    return { ok: false, error: "senderGatewayUrl host is not allowed" };
+  }
+  if (host.startsWith("169.254.") || host === "169.254.169.254") {
+    return { ok: false, error: "senderGatewayUrl host is not allowed" };
+  }
+  return { ok: true, origin: parsed.origin };
+}
 
 /**
  * Extract a human-readable error message from a daemon HTTP error
@@ -339,7 +387,15 @@ export async function acceptA2AInvite(params: {
   senderAssistantId: string;
   token: string;
 }): Promise<AcceptA2AInviteResult> {
-  const senderGatewayUrl = params.senderGatewayUrl.replace(/\/+$/, "");
+  const safety = assertSafeSenderGatewayUrl(params.senderGatewayUrl);
+  if (!safety.ok) {
+    return {
+      success: false,
+      error: safety.error,
+      errorCode: "invalid_sender_url",
+    };
+  }
+  const senderGatewayUrl = safety.origin;
 
   // 1. Validate local config
   const displayName = getAssistantName() ?? "Vellum Assistant";
@@ -380,10 +436,27 @@ export async function acceptA2AInvite(params: {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify(completeBody),
+      redirect: "error",
       signal: AbortSignal.timeout(ACCEPT_TIMEOUT_MS),
     });
 
-    completeData = (await response.json()) as Record<string, unknown>;
+    const rawBody = await response.text();
+    if (new TextEncoder().encode(rawBody).byteLength > ACCEPT_MAX_BODY_BYTES) {
+      return {
+        success: false,
+        error: "Sender invite/complete response exceeded size limit",
+        errorCode: "complete_failed",
+      };
+    }
+    try {
+      completeData = JSON.parse(rawBody) as Record<string, unknown>;
+    } catch {
+      return {
+        success: false,
+        error: "Sender invite/complete returned invalid JSON",
+        errorCode: "complete_failed",
+      };
+    }
 
     if (!response.ok) {
       const error =

package/src/daemon/handlers/shared.ts

@@ -19,6 +19,10 @@ import type {
 import { ConfirmationDecisionSchema } from "../../api/responses/conversation-message.js";
 import { getConfig } from "../../config/loader.js";
 import type { LLMCallSite, Speed } from "../../config/schemas/llm.js";
+import {
+  resolveStoredMessageText,
+  type SupportedLocale,
+} from "../../i18n/index.js";
 import { ipcCall as gatewayIpcCall } from "../../ipc/gateway-client.js";
 import type { ProviderMessageMetadata } from "../../messaging/provider-message-metadata.js";
 import type { SecretPromptResult } from "../../permissions/secret-prompt-types.js";
@@ -409,6 +413,7 @@ export function renderHistoryContent(
   >,
   messageId?: string,
   metadata?: unknown,
+  locale?: SupportedLocale,
 ): RenderedHistoryContent {
   // A row whose turn routed its reply through `send_user_message` carries
   // private working notes, so every consumer of this render (web history,
@@ -575,8 +580,14 @@ export function renderHistoryContent(
       const rawText =
         typeof block._redactionVersion === "number" &&
         block._redactionVersion >= SENTINEL_REDACTION_VERSION
-          ? block.text
-          : neutralizeRedactedSentinels(block.text);
+          ? locale
+            ? resolveStoredMessageText(block.text, locale)
+            : block.text
+          : neutralizeRedactedSentinels(
+              locale
+                ? resolveStoredMessageText(block.text, locale)
+                : block.text,
+            );
       const displayText = unwrapExternalContentForDisplay(rawText);
       // Skip empty/whitespace-only text blocks. During streaming the client
       // discards empty text deltas (guard !text.isEmpty), so including them

package/src/daemon/host-cu-proxy.ts

@@ -28,6 +28,7 @@ import { POINT_AT_PROXY_TOOL } from "../tools/computer-use/skill-proxy-bridge.js
 import type { ToolExecutionResult } from "../tools/types.js";
 import { AssistantError, ErrorCode } from "../util/errors.js";
 import { getLogger } from "../util/logger.js";
+import { prepareComputerUseObservation } from "./computer-use-observation.js";
 import { resolveHostCuTarget } from "./host-cu-target.js";
 import { bestEffortModeSessionTracking } from "./mode-session-tracking.js";
 
@@ -615,7 +616,7 @@ export class HostCuProxy {
     this.recordAction(toolName, input, reasoning);
     this._previousAXTree = undefined;
     this._consecutiveUnchangedSteps = 0;
-    const observation = await execute();
+    const observation = await prepareComputerUseObservation(await execute());
     return this.formatObservation(observation, undefined, false, {
       toolName,
       input,
@@ -791,7 +792,7 @@ export class HostCuProxy {
       );
     }
 
-    const screenshotMeta = this.formatScreenshotMetadata(obs);
+    const screenshotMeta = this.formatScreenshotMetadata(obs, action);
     if (screenshotMeta.length > 0) {
       parts.push("");
       parts.push(...screenshotMeta);
@@ -898,7 +899,10 @@ export class HostCuProxy {
     }
   }
 
-  private formatScreenshotMetadata(obs: CuObservationResult): string[] {
+  private formatScreenshotMetadata(
+    obs: CuObservationResult,
+    action: ActionIdentity | undefined,
+  ): string[] {
     if (!obs.screenshot) {
       return [];
     }
@@ -914,6 +918,33 @@ export class HostCuProxy {
         `Screen metadata: ${obs.screenWidthPt}x${obs.screenHeightPt} pt`,
       );
     }
+    if (action && hasCaptureTarget(action.input)) {
+      lines.push(
+        "This screenshot is capture-relative. Full-screen dimensions do not map its pixels to action coordinates. Use accessibility element IDs, or request an unscoped desktop observation before using coordinates.",
+      );
+    } else if (
+      [
+        obs.screenshotWidthPx,
+        obs.screenshotHeightPx,
+        obs.screenWidthPt,
+        obs.screenHeightPt,
+      ].every(
+        (dimension) =>
+          typeof dimension === "number" &&
+          Number.isFinite(dimension) &&
+          dimension > 0,
+      )
+    ) {
+      const scaleX = obs.screenWidthPt! / obs.screenshotWidthPx!;
+      const scaleY = obs.screenHeightPt! / obs.screenshotHeightPx!;
+      lines.push(
+        `Action coordinates are screen points, not screenshot pixels. Convert this image's pixels: x = round(image_x * ${scaleX.toFixed(6)}), y = round(image_y * ${scaleY.toFixed(6)}). Prefer accessibility element IDs when available.`,
+      );
+    } else {
+      lines.push(
+        "Screenshot-to-screen coordinate mapping is unavailable. Use accessibility element IDs or obtain an observation with both screenshot and screen dimensions before using coordinates.",
+      );
+    }
     return lines;
   }
 }