@vellumai/assistant 0.6.4 → 0.6.6

package/src/tools/browser/cdp-client/__tests__/factory.test.ts

@@ -1058,22 +1058,43 @@ describe("desktop-auto cdp-inspect (macOS)", () => {
     expect(candidates[2].kind).toBe("local");
   });
 
-  test("macOS turn with proxy unavailable skips desktop-auto cdp-inspect (extension intent)", () => {
+  test("macOS turn with registry-routed proxy unavailable skips desktop-auto cdp-inspect (extension intent)", () => {
     const fakeProxy = makeUnavailableProxy();
     const ctx = makeContext({
       conversationId: "macos-proxy-unavailable-no-inspect",
       hostBrowserProxy: fakeProxy,
       transportInterface: "macos",
+      hostBrowserRegistryRouted: true,
     });
 
     const candidates = buildCandidateList(ctx);
 
     // Should only include local -- cdp-inspect is suppressed because extension
-    // transport is expected (proxy exists) but temporarily unavailable.
+    // transport is expected (registry-routed proxy) but temporarily unavailable.
     expect(candidates.length).toBe(1);
     expect(candidates[0].kind).toBe("local");
   });
 
+  test("macOS turn with SSE-backed proxy unavailable still includes desktop-auto cdp-inspect", () => {
+    const fakeProxy = makeUnavailableProxy();
+    const ctx = makeContext({
+      conversationId: "macos-sse-proxy-unavailable-inspect-allowed",
+      hostBrowserProxy: fakeProxy,
+      transportInterface: "macos",
+      // hostBrowserRegistryRouted is NOT set -- SSE-backed proxy
+    });
+
+    const candidates = buildCandidateList(ctx);
+
+    // SSE-backed proxy that is unavailable (non-interactive turn) should NOT
+    // suppress cdp-inspect -- the SSE proxy was never expected to service
+    // browser requests, so cdp-inspect remains available as a fallback.
+    expect(candidates.length).toBe(2);
+    expect(candidates[0].kind).toBe("cdp-inspect");
+    expect(candidates[0].reason).toContain("desktopAuto");
+    expect(candidates[1].kind).toBe("local");
+  });
+
   test("macOS turn with no proxy still includes desktop-auto cdp-inspect", () => {
     const ctx = makeContext({
       conversationId: "macos-no-proxy-inspect-allowed",
@@ -1242,17 +1263,19 @@ describe("desktop-auto cdp-inspect (macOS)", () => {
     expect(candidates[0].kind).toBe("local");
   });
 
-  test("macOS turn with proxy unavailable routes to local without trying cdp-inspect", async () => {
+  test("macOS turn with registry-routed proxy unavailable routes to local without trying cdp-inspect", async () => {
     const fakeProxy = makeUnavailableProxy();
     const ctx = makeContext({
       conversationId: "macos-proxy-unavail-route",
       hostBrowserProxy: fakeProxy,
       transportInterface: "macos",
+      hostBrowserRegistryRouted: true,
     });
 
     const client = getCdpClient(ctx);
 
     // Should go straight to local -- no cdp-inspect candidate inserted
+    // because the registry-routed extension was expected but is unavailable.
     expect(client.kind).toBe("local");
     const result = await client.send<{ ok: boolean; via: string }>(
       "Page.navigate",
@@ -1264,6 +1287,29 @@ describe("desktop-auto cdp-inspect (macOS)", () => {
     client.dispose();
   });
 
+  test("macOS turn with SSE-backed proxy unavailable falls through to cdp-inspect", async () => {
+    const fakeProxy = makeUnavailableProxy();
+    const ctx = makeContext({
+      conversationId: "macos-sse-proxy-unavail-inspect",
+      hostBrowserProxy: fakeProxy,
+      transportInterface: "macos",
+      // hostBrowserRegistryRouted is NOT set -- SSE-backed proxy
+    });
+
+    const client = getCdpClient(ctx);
+
+    // SSE-backed proxy unavailable (non-interactive turn) should NOT
+    // suppress cdp-inspect -- it falls through to desktop-auto cdp-inspect.
+    expect(client.kind).toBe("cdp-inspect");
+    const result = await client.send<{ ok: boolean; via: string }>(
+      "Page.navigate",
+    );
+    expect(result).toEqual({ ok: true, via: "cdp-inspect" });
+    expect(createExtensionCdpClientMock).not.toHaveBeenCalled();
+    expect(createCdpInspectClientMock).toHaveBeenCalledTimes(1);
+    client.dispose();
+  });
+
   test("explicit config cdp-inspect failure does NOT record desktop-auto cooldown", async () => {
     cdpInspectEnabled = true;
 
@@ -1991,3 +2037,100 @@ describe("no-fallback guarantees", () => {
     expect(fallbackLogs.length).toBe(0);
   });
 });
+
+// ── macOS host-browser proxy backend selection ─────────────────────────
+//
+// Verify that macOS turns can use the host browser proxy without requiring
+// extension registry connectivity. When a HostBrowserProxy is provisioned
+// via the SSE sender path (no extension), the factory should select
+// extension as the top candidate (because hostBrowserProxy is available).
+// When both proxy and fallback backends exist, selection is deterministic:
+// extension > cdp-inspect > local.
+
+describe("macOS host-browser proxy without extension registry", () => {
+  beforeEach(() => {
+    createExtensionCdpClientMock.mockClear();
+    createLocalCdpClientMock.mockClear();
+    createCdpInspectClientMock.mockClear();
+    lastExtensionClient = undefined;
+    lastLocalClient = undefined;
+    lastCdpInspectClient = undefined;
+    cdpInspectEnabled = false;
+    desktopAutoConfig = { enabled: true, cooldownMs: 30_000 };
+    _resetDesktopAutoCooldown();
+    logWarnCalls.length = 0;
+    logDebugCalls.length = 0;
+  });
+
+  test("macOS turn with SSE-provisioned hostBrowserProxy selects extension backend", async () => {
+    // Simulates macOS provisioning a HostBrowserProxy via SSE (no extension
+    // registry connection). The proxy is available so extension is selected.
+    const fakeProxy = makeAvailableProxy();
+    const ctx = makeContext({
+      conversationId: "macos-sse-proxy",
+      hostBrowserProxy: fakeProxy,
+      transportInterface: "macos",
+    });
+
+    const client = getCdpClient(ctx);
+
+    expect(client.kind).toBe("extension");
+    const result = await client.send<{ ok: boolean; via: string }>(
+      "Page.navigate",
+      { url: "https://example.com" },
+    );
+    expect(result).toEqual({ ok: true, via: "extension" });
+    expect(createExtensionCdpClientMock).toHaveBeenCalledTimes(1);
+  });
+
+  test("macOS turn with both proxy and cdp-inspect produces deterministic 3-candidate chain", () => {
+    const fakeProxy = makeAvailableProxy();
+    const ctx = makeContext({
+      conversationId: "macos-deterministic",
+      hostBrowserProxy: fakeProxy,
+      transportInterface: "macos",
+    });
+
+    const candidates = buildCandidateList(ctx);
+
+    // Deterministic order: extension > cdp-inspect (desktop-auto) > local
+    expect(candidates.length).toBe(3);
+    expect(candidates[0].kind).toBe("extension");
+    expect(candidates[1].kind).toBe("cdp-inspect");
+    expect(candidates[2].kind).toBe("local");
+  });
+
+  test("macOS turn without proxy falls through to cdp-inspect then local", () => {
+    const ctx = makeContext({
+      conversationId: "macos-no-proxy-fallback",
+      transportInterface: "macos",
+    });
+
+    const candidates = buildCandidateList(ctx);
+
+    // No proxy => skip extension, desktop-auto cdp-inspect + local
+    expect(candidates.length).toBe(2);
+    expect(candidates[0].kind).toBe("cdp-inspect");
+    expect(candidates[1].kind).toBe("local");
+  });
+
+  test("non-macOS interface with proxy still selects extension (unchanged behavior)", async () => {
+    // Verify non-macOS interfaces are unaffected by the macOS host-browser
+    // enablement — proxy presence drives extension selection regardless of
+    // interface.
+    const fakeProxy = makeAvailableProxy();
+    const ctx = makeContext({
+      conversationId: "non-macos-proxy",
+      hostBrowserProxy: fakeProxy,
+      transportInterface: "cli",
+    });
+
+    const client = getCdpClient(ctx);
+
+    expect(client.kind).toBe("extension");
+    const result = await client.send<{ ok: boolean; via: string }>(
+      "Page.navigate",
+    );
+    expect(result).toEqual({ ok: true, via: "extension" });
+  });
+});

package/src/tools/browser/cdp-client/cdp-inspect/discovery.ts

@@ -420,6 +420,19 @@ export async function probeDevToolsJsonVersion(opts: {
         err,
       );
     }
+
+    // Late-timeout guard: Bun's `response.text()` can resolve with the
+    // already-buffered bytes when the underlying socket is cut off by
+    // our abort, rather than rejecting. Without this check, a truncated
+    // body from a stalled server would reach the JSON parser and be
+    // classified as `invalid_response` instead of `timeout`.
+    if (handle.timedOut || opts.signal?.aborted === true) {
+      throw classifyFetchError(
+        new Error("Discovery body read returned before completion."),
+        handle.timedOut,
+        opts.signal?.aborted === true,
+      );
+    }
   } finally {
     handle.cleanup();
   }
@@ -525,6 +538,15 @@ export async function listDevToolsTargets(opts: {
         err,
       );
     }
+
+    // See the matching comment in probeDevToolsJsonVersion.
+    if (handle.timedOut || opts.signal?.aborted === true) {
+      throw classifyFetchError(
+        new Error("Discovery body read returned before completion."),
+        handle.timedOut,
+        opts.signal?.aborted === true,
+      );
+    }
   } finally {
     handle.cleanup();
   }

package/src/tools/browser/cdp-client/extension-cdp-client.ts

@@ -1,10 +1,30 @@
 import type { HostBrowserProxy } from "../../../daemon/host-browser-proxy.js";
 import { getLogger } from "../../../util/logger.js";
+import type { CdpErrorCode } from "./errors.js";
 import { CdpError } from "./errors.js";
 import type { CdpClientKind, ScopedCdpClient } from "./types.js";
 
 const log = getLogger("extension-cdp-client");
 
+/**
+ * Transport-level error codes that the host_browser dispatcher may
+ * embed in a structured `{ code, message }` error envelope. When the
+ * `code` field of a parsed error object matches one of these values,
+ * the error is classified as `transport_error` so the factory's
+ * failover logic can try the next backend candidate.
+ *
+ * Codes that are NOT in this set are treated as CDP command-level
+ * failures (`cdp_error`) and propagate without failover.
+ */
+const TRANSPORT_ERROR_CODES = new Set([
+  "transport_error",
+  "unreachable",
+  "timeout",
+  "non_loopback",
+  "cdp_session_not_found",
+  "cancelled",
+]);
+
 /**
  * CdpClient backed by HostBrowserProxy. Each `send` becomes a
  * host_browser_request / host_browser_result round-trip over the
@@ -102,11 +122,21 @@ export class ExtensionCdpClient implements ScopedCdpClient {
           typeof (parsedError as { message: unknown }).message === "string" &&
           (parsedError as { message: string }).message) ||
         `CDP error for ${method}`;
+
+      // Detect structured transport error envelopes from the
+      // host_browser dispatcher. When the parsed error object
+      // carries a `code` field that matches a known transport-level
+      // code, classify the error as `transport_error` so the
+      // factory can trigger failover to the next backend candidate.
+      // All other structured errors remain `cdp_error` since they
+      // represent command-level CDP failures that would not benefit
+      // from switching transports.
+      const errorCode = classifyHostBrowserError(parsedError);
       log.debug(
-        { method, params, parsedError },
-        "ExtensionCdpClient: CDP error",
+        { method, params, parsedError, classifiedAs: errorCode },
+        "ExtensionCdpClient: host_browser_result error",
       );
-      throw new CdpError("cdp_error", msg, {
+      throw new CdpError(errorCode, msg, {
         cdpMethod: method,
         cdpParams: params,
         underlying: parsedError,
@@ -139,6 +169,27 @@ export class ExtensionCdpClient implements ScopedCdpClient {
   }
 }
 
+/**
+ * Classify a parsed host_browser_result error envelope as either a
+ * transport-level error (`transport_error`) or a command-level CDP
+ * failure (`cdp_error`).
+ *
+ * Structured envelopes from the host_browser dispatcher carry a
+ * `code` string field (e.g. `"transport_error"`, `"unreachable"`,
+ * `"timeout"`, `"non_loopback"`, `"cdp_session_not_found"`,
+ * `"cancelled"`). When the code matches a known
+ * transport-level value, the error is eligible for factory failover.
+ * All other codes (or missing codes) are treated as CDP command
+ * errors that should propagate without failover.
+ */
+function classifyHostBrowserError(parsed: unknown): CdpErrorCode {
+  if (typeof parsed !== "object" || parsed === null) return "cdp_error";
+  if (!("code" in parsed)) return "cdp_error";
+  const code = (parsed as { code: unknown }).code;
+  if (typeof code !== "string") return "cdp_error";
+  return TRANSPORT_ERROR_CODES.has(code) ? "transport_error" : "cdp_error";
+}
+
 export function createExtensionCdpClient(
   proxy: HostBrowserProxy,
   conversationId: string,

package/src/tools/browser/cdp-client/factory.ts

@@ -349,15 +349,26 @@ export function buildCandidateList(context: ToolContext): BackendCandidate[] {
     cdpInspectConfig.desktopAuto.enabled
   ) {
     // macOS desktop-auto: include cdp-inspect as a candidate unless:
-    // (a) the hostBrowserProxy exists but is temporarily unavailable
-    //     (extension transport expected but transiently disconnected --
-    //     inserting cdp-inspect here would cause a silent takeover), or
+    // (a) the hostBrowserProxy is registry-routed (extension-backed) and
+    //     temporarily unavailable — the extension transport was explicitly
+    //     expected and the disconnection is transient, so inserting
+    //     cdp-inspect would cause a silent takeover. Only applies when
+    //     `hostBrowserRegistryRouted` is true (set when
+    //     `hostBrowserSenderOverride` was wired at turn-start).
+    //     SSE-backed proxies (macOS without an extension connection) that
+    //     report unavailable (e.g. non-interactive turns where
+    //     clientConnected=false) should NOT suppress cdp-inspect — the
+    //     SSE proxy was never expected to service browser requests.
     // (b) the cooldown from a recent failure is still active.
     //
     // When no hostBrowserProxy is present at all (extension not
     // provisioned for this conversation), cdp-inspect remains available
     // as a fallback per the desktop-auto contract.
-    if (hostBrowserProxy && !hostBrowserProxy.isAvailable()) {
+    if (
+      hostBrowserProxy &&
+      !hostBrowserProxy.isAvailable() &&
+      context.hostBrowserRegistryRouted
+    ) {
       log.debug(
         { conversationId },
         "CDP factory: desktop-auto cdp-inspect skipped (extension transport expected but temporarily unavailable)",

package/src/tools/credentials/tool-policy.ts

@@ -5,17 +5,48 @@
  * based on the credential's allowed tools list.
  */
 
+/**
+ * Canonical capability key for browser-based credential fills.
+ *
+ * This decouples credential policy from any specific tool name so that
+ * browser fill operations work regardless of whether a
+ * `browser_fill_credential` tool is registered in the manifest.
+ */
+export const BROWSER_FILL_CAPABILITY = "assistant_browser_fill_credential";
+
+/**
+ * Legacy tool names that map to canonical capability keys.
+ *
+ * Credentials stored with `browser_fill_credential` in their
+ * `allowedTools` metadata continue to authorize browser fills
+ * without requiring a manual migration.
+ */
+const LEGACY_ALIASES: ReadonlyMap<string, string> = new Map([
+  ["browser_fill_credential", BROWSER_FILL_CAPABILITY],
+]);
+
+/**
+ * Resolve a tool/capability name to its canonical form.
+ *
+ * If the name is a known legacy alias, returns the canonical key.
+ * Otherwise returns the name unchanged.
+ */
+function resolveCanonical(name: string): string {
+  return LEGACY_ALIASES.get(name) ?? name;
+}
+
 /**
  * Check whether a tool is allowed to use a credential.
  *
  * @param toolName - The name of the tool requesting credential use
  * @param allowedTools - The credential's allowed tools list
- * @returns true if the tool is explicitly listed in allowedTools
+ * @returns true if the tool is authorized after alias resolution
  *
  * Semantics:
- * 1. Explicit allowlist - tool must be listed by exact name
- * 2. No wildcard support in v1
- * 3. Fail-closed on empty or missing list
+ * 1. Both the requesting `toolName` and every entry in `allowedTools`
+ *    are resolved through the legacy-alias map before comparison.
+ * 2. No wildcard support in v1.
+ * 3. Fail-closed on empty or missing list.
  */
 export function isToolAllowed(
   toolName: string,
@@ -24,5 +55,8 @@ export function isToolAllowed(
   if (!Array.isArray(allowedTools) || allowedTools.length === 0) return false;
   if (!toolName || typeof toolName !== "string") return false;
 
-  return allowedTools.includes(toolName);
+  const canonical = resolveCanonical(toolName);
+  return allowedTools.some(
+    (allowed) => resolveCanonical(allowed) === canonical,
+  );
 }

package/src/tools/credentials/vault.ts

@@ -41,9 +41,7 @@ function isSlackChannelCredential(
 ): field is "bot_token" | "app_token" | "user_token" {
   return (
     service === "slack_channel" &&
-    (field === "bot_token" ||
-      field === "app_token" ||
-      field === "user_token")
+    (field === "bot_token" || field === "app_token" || field === "user_token")
   );
 }
 
@@ -128,7 +126,7 @@ class CredentialStoreTool implements Tool {
             type: "array",
             items: { type: "string" },
             description:
-              'Tools allowed to use this credential (for store/prompt actions), e.g. ["browser_fill_credential"]. Empty = deny all.',
+              'Tools/capabilities allowed to use this credential (for store/prompt actions), e.g. ["assistant_browser_fill_credential"]. Empty = deny all.',
           },
           allowed_domains: {
             type: "array",
@@ -693,6 +691,13 @@ class CredentialStoreTool implements Tool {
               : undefined,
         });
         if (!result.value) {
+          if (result.error === "unsupported_channel") {
+            return {
+              content:
+                "Secure credential entry cannot be opened over this channel. The user needs to complete this step from the desktop app, or run this flow from there directly.",
+              isError: true,
+            };
+          }
           return {
             content: "User cancelled the credential prompt.",
             isError: false,