@vellumai/assistant 0.6.6 → 0.7.1

package/src/tools/browser/cdp-client/factory.ts

@@ -8,6 +8,7 @@ import {
   createLocalBackend,
 } from "../../../browser-session/index.js";
 import { getConfig } from "../../../config/loader.js";
+import { HostBrowserProxy } from "../../../daemon/host-browser-proxy.js";
 import { getLogger } from "../../../util/logger.js";
 import type { ToolContext } from "../../types.js";
 import { createCdpInspectClient } from "./cdp-inspect-client.js";
@@ -103,11 +104,10 @@ export interface GetCdpClientOptions {
  * invocation based on the ToolContext and config. Three backends are
  * considered in priority order:
  *
- *  1. **Extension** -- When `context.hostBrowserProxy` is set AND
- *     `hostBrowserProxy.isAvailable()` returns `true` (i.e. the
- *     proxy exists and the client is actually connected). This
- *     prevents selecting the extension transport when the proxy
- *     object exists but the underlying WebSocket is disconnected.
+ *  1. **Extension** -- When `HostBrowserProxy.instance` is available
+ *     and `isAvailable()` returns `true` (i.e. a chrome extension
+ *     connection exists in the registry). This prevents selecting
+ *     the extension transport when no extension is connected.
  *  2. **cdp-inspect** -- When `hostBrowser.cdpInspect.enabled` is
  *     `true` in config, construct a `CdpInspectClient` that attaches
  *     to an already-running Chrome via the DevTools JSON protocol.
@@ -183,17 +183,15 @@ export function buildPinnedCandidateList(
   context: ToolContext,
   mode: Exclude<BrowserMode, "auto">,
 ): BackendCandidate[] {
-  const { conversationId, hostBrowserProxy } = context;
+  const { conversationId } = context;
 
   switch (mode) {
     case "extension": {
-      if (!hostBrowserProxy || !hostBrowserProxy.isAvailable()) {
-        const reason = !hostBrowserProxy
-          ? "no host browser proxy provisioned for this conversation"
-          : "host browser proxy exists but is not connected";
+      const hostBrowserProxy = HostBrowserProxy.instance;
+      if (!hostBrowserProxy.isAvailable()) {
         throw new CdpError(
           "transport_error",
-          `Pinned mode "extension" unavailable: ${reason}`,
+          `Pinned mode "extension" unavailable: no active extension connection`,
           {
             attemptDiagnostics: [
               {
@@ -201,7 +199,7 @@ export function buildPinnedCandidateList(
                 inclusionReason: `pinned mode: extension`,
                 stage: "candidate_selection",
                 errorCode: "transport_error",
-                errorMessage: reason,
+                errorMessage: "no active extension connection",
               },
             ],
           },
@@ -289,18 +287,16 @@ export function buildPinnedCandidateList(
  * Exported for testing.
  */
 export function buildCandidateList(context: ToolContext): BackendCandidate[] {
-  const { conversationId, hostBrowserProxy } = context;
+  const { conversationId } = context;
   const candidates: BackendCandidate[] = [];
+  const hostBrowserProxy = HostBrowserProxy.instance;
 
-  // 1. Extension -- preferred when a chrome-extension is bound AND
-  //    the proxy reports it is connected. Checking isAvailable()
-  //    prevents selecting the extension transport when the proxy
-  //    object exists (e.g. it was provisioned at conversation start)
-  //    but the client has since disconnected.
-  if (hostBrowserProxy && hostBrowserProxy.isAvailable()) {
+  // 1. Extension -- preferred when the singleton proxy reports an active
+  //    extension connection is available.
+  if (hostBrowserProxy.isAvailable()) {
     candidates.push({
       kind: "extension",
-      reason: "hostBrowserProxy present and available",
+      reason: "extension connected via registry singleton",
       create() {
         const client = createExtensionCdpClient(
           hostBrowserProxy,
@@ -315,10 +311,10 @@ export function buildCandidateList(context: ToolContext): BackendCandidate[] {
         return { client, backend };
       },
     });
-  } else if (hostBrowserProxy) {
+  } else {
     log.debug(
       { conversationId },
-      "CDP factory: hostBrowserProxy present but not available, skipping extension candidate",
+      "CDP factory: no active extension connection, skipping extension candidate",
     );
   }
 
@@ -348,63 +344,39 @@ export function buildCandidateList(context: ToolContext): BackendCandidate[] {
     context.transportInterface === "macos" &&
     cdpInspectConfig.desktopAuto.enabled
   ) {
-    // macOS desktop-auto: include cdp-inspect as a candidate unless:
-    // (a) the hostBrowserProxy is registry-routed (extension-backed) and
-    //     temporarily unavailable — the extension transport was explicitly
-    //     expected and the disconnection is transient, so inserting
-    //     cdp-inspect would cause a silent takeover. Only applies when
-    //     `hostBrowserRegistryRouted` is true (set when
-    //     `hostBrowserSenderOverride` was wired at turn-start).
-    //     SSE-backed proxies (macOS without an extension connection) that
-    //     report unavailable (e.g. non-interactive turns where
-    //     clientConnected=false) should NOT suppress cdp-inspect — the
-    //     SSE proxy was never expected to service browser requests.
-    // (b) the cooldown from a recent failure is still active.
-    //
-    // When no hostBrowserProxy is present at all (extension not
-    // provisioned for this conversation), cdp-inspect remains available
-    // as a fallback per the desktop-auto contract.
-    if (
-      hostBrowserProxy &&
-      !hostBrowserProxy.isAvailable() &&
-      context.hostBrowserRegistryRouted
-    ) {
+    // macOS desktop-auto: include cdp-inspect as a candidate unless
+    // the cooldown from a recent failure is still active. The extension
+    // candidate is already first in the list, so it wins when connected.
+    const { cooldownMs } = cdpInspectConfig.desktopAuto;
+    if (isDesktopAutoCooldownActive(cooldownMs)) {
       log.debug(
-        { conversationId },
-        "CDP factory: desktop-auto cdp-inspect skipped (extension transport expected but temporarily unavailable)",
+        {
+          conversationId,
+          cooldownMs,
+          cooldownSince: _desktopAutoCooldownSince,
+        },
+        "CDP factory: desktop-auto cdp-inspect skipped (cooldown active)",
       );
     } else {
-      const { cooldownMs } = cdpInspectConfig.desktopAuto;
-      if (isDesktopAutoCooldownActive(cooldownMs)) {
-        log.debug(
-          {
-            conversationId,
-            cooldownMs,
-            cooldownSince: _desktopAutoCooldownSince,
-          },
-          "CDP factory: desktop-auto cdp-inspect skipped (cooldown active)",
-        );
-      } else {
-        candidates.push({
-          kind: "cdp-inspect",
-          reason: "desktopAuto: macOS turn, cdp-inspect auto-attempted",
-          create() {
-            const client = createCdpInspectClient(conversationId, {
-              host: cdpInspectConfig.host,
-              port: cdpInspectConfig.port,
-              discoveryTimeoutMs: cdpInspectConfig.probeTimeoutMs,
-              wsConnectTimeoutMs: cdpInspectConfig.probeTimeoutMs,
-            });
-            const backend = createCdpInspectBackend({
-              isAvailable: () => true,
-              sendCdp: (command, signal) =>
-                dispatchThroughClient(client, command, signal),
-              dispose: () => client.dispose(),
-            });
-            return { client, backend };
-          },
-        });
-      }
+      candidates.push({
+        kind: "cdp-inspect",
+        reason: "desktopAuto: macOS turn, cdp-inspect auto-attempted",
+        create() {
+          const client = createCdpInspectClient(conversationId, {
+            host: cdpInspectConfig.host,
+            port: cdpInspectConfig.port,
+            discoveryTimeoutMs: cdpInspectConfig.probeTimeoutMs,
+            wsConnectTimeoutMs: cdpInspectConfig.probeTimeoutMs,
+          });
+          const backend = createCdpInspectBackend({
+            isAvailable: () => true,
+            sendCdp: (command, signal) =>
+              dispatchThroughClient(client, command, signal),
+            dispose: () => client.dispose(),
+          });
+          return { client, backend };
+        },
+      });
     }
   }
 

package/src/tools/browser/cdp-client/index.ts

@@ -1,22 +1,9 @@
 export {
-  CdpInspectClient,
   type CdpInspectClientOptions,
   type CdpInspectHelpers,
-  createCdpInspectClient,
 } from "./cdp-inspect-client.js";
 export { CdpError, type CdpErrorCode } from "./errors.js";
-export {
-  createExtensionCdpClient,
-  ExtensionCdpClient,
-} from "./extension-cdp-client.js";
-export {
-  buildCandidateList,
-  buildChainedClient,
-  buildPinnedCandidateList,
-  getCdpClient,
-  type GetCdpClientOptions,
-} from "./factory.js";
-export { createLocalCdpClient, LocalCdpClient } from "./local-cdp-client.js";
+export { type GetCdpClientOptions } from "./factory.js";
 export type {
   AttemptDiagnostic,
   AttemptStage,

package/src/tools/browser/cdp-client/types.ts

@@ -7,6 +7,9 @@
  * `send(method, params)` with a CDP method name and return the raw
  * CDP result object; errors are thrown as {@link CdpError}.
  */
+
+import type { BrowserBackend } from "../../../browser-session/types.js";
+
 export interface CdpClient {
   /**
    * Send a CDP command and await the result. `method` must be a
@@ -115,6 +118,6 @@ export interface BackendCandidate {
    */
   create(): {
     client: CdpClient;
-    backend: import("../../../browser-session/types.js").BrowserBackend;
+    backend: BrowserBackend;
   };
 }

package/src/tools/computer-use/definitions.ts

@@ -457,7 +457,7 @@ export const computerUseRespondTool: Tool = {
 // observe
 // ---------------------------------------------------------------------------
 
-export const computerUseObserveTool: Tool = {
+const computerUseObserveTool: Tool = {
   name: "computer_use_observe",
   description:
     "Capture the current screen state. Returns the accessibility tree with [ID] element references and optionally a screenshot.\n\nThe accessibility tree shows interactive elements like [3] AXButton 'Save' or [17] AXTextField 'Search'. Use element_id to target these elements in subsequent actions - this is much more reliable than pixel coordinates.\n\nCall this before your first computer use action, or to check screen state without acting.",

package/src/tools/credential-execution/make-authenticated-request.ts

@@ -6,11 +6,11 @@
  * the outbound request internally and returns the sanitised response.
  *
  * The input schema matches the `MakeAuthenticatedRequestSchema` from
- * `@vellumai/ces-contracts` exactly so the LLM-produced parameters pass
+ * `@vellumai/service-contracts/credential-rpc` exactly so the LLM-produced parameters pass
  * straight through to the CES RPC call with no transformation.
  */
 
-import { GrantProposalSchema, renderProposal } from "@vellumai/ces-contracts";
+import { GrantProposalSchema, renderProposal } from "@vellumai/service-contracts/credential-rpc";
 
 import { RiskLevel } from "../../permissions/types.js";
 import type { ToolDefinition } from "../../providers/types.js";

package/src/tools/credential-execution/manage-secure-command-tool.ts

@@ -15,7 +15,7 @@
  * verification, and installation inside the CES sandbox.
  */
 
-import type { ManageSecureCommandTool } from "@vellumai/ces-contracts/rpc";
+import type { ManageSecureCommandTool } from "@vellumai/service-contracts/rpc";
 
 import { RiskLevel } from "../../permissions/types.js";
 import type { ToolDefinition } from "../../providers/types.js";

package/src/tools/credential-execution/run-authenticated-command.ts

@@ -6,11 +6,11 @@
  * runs it inside the CES sandbox - the assistant never sees raw secrets.
  *
  * The input schema matches the `RunAuthenticatedCommandSchema` from
- * `@vellumai/ces-contracts` exactly so the LLM-produced parameters pass
+ * `@vellumai/service-contracts/credential-rpc` exactly so the LLM-produced parameters pass
  * straight through to the CES RPC call with no transformation.
  */
 
-import { GrantProposalSchema, renderProposal } from "@vellumai/ces-contracts";
+import { GrantProposalSchema, renderProposal } from "@vellumai/service-contracts/credential-rpc";
 
 import { RiskLevel } from "../../permissions/types.js";
 import type { ToolDefinition } from "../../providers/types.js";

package/src/tools/credentials/broker-types.ts

@@ -1,4 +1,5 @@
 /** Opaque token representing a policy-checked authorization to use a credential. */
+import type { CredentialInjectionTemplate } from "./policy-types.js";
 export interface UsageToken {
   tokenId: string;
   credentialId: string;
@@ -95,7 +96,7 @@ export interface ServerUseByIdSuccess {
   credentialId: string;
   service: string;
   field: string;
-  injectionTemplates: import("./policy-types.js").CredentialInjectionTemplate[];
+  injectionTemplates: CredentialInjectionTemplate[];
 }
 
 /** Denied or not-found by-id lookup result. */

package/src/tools/document/editor-template.ts

@@ -234,7 +234,7 @@ export function generateEditorHTML(
   `.trim();
 }
 
-export function escapeHtml(str: string): string {
+function escapeHtml(str: string): string {
   return str
     .replace(/&/g, "&")
     .replace(/</g, "&lt;")

package/src/tools/execution-timeout.ts

@@ -2,7 +2,7 @@ import type { ToolExecutionResult } from "./types.js";
 
 const TIMEOUT_SENTINEL = Symbol("tool-timeout");
 
-export const DEFAULT_TOOL_TIMEOUT_SEC = 120;
+const DEFAULT_TOOL_TIMEOUT_SEC = 120;
 
 /**
  * Convert a config-provided seconds value to a safe milliseconds value,

package/src/tools/executor.ts

@@ -22,7 +22,6 @@ import { getLogger } from "../util/logger.js";
 import { resolveExecutionTarget } from "./execution-target.js";
 import { executeWithTimeout, safeTimeoutMs } from "./execution-timeout.js";
 import { PermissionChecker } from "./permission-checker.js";
-import { SecretDetectionHandler } from "./secret-detection-handler.js";
 import { extractAndSanitize } from "./sensitive-output-placeholders.js";
 import { applyEdit } from "./shared/filesystem/edit-engine.js";
 import { sandboxPolicy } from "./shared/filesystem/path-policy.js";
@@ -39,13 +38,11 @@ const log = getLogger("tool-executor");
 export class ToolExecutor {
   private prompter: PermissionPrompter;
   private permissionChecker: PermissionChecker;
-  private secretDetectionHandler: SecretDetectionHandler;
   private approvalHandler: ToolApprovalHandler;
 
   constructor(prompter: PermissionPrompter) {
     this.prompter = prompter;
     this.permissionChecker = new PermissionChecker(prompter);
-    this.secretDetectionHandler = new SecretDetectionHandler(prompter);
     this.approvalHandler = new ToolApprovalHandler();
   }
 
@@ -60,16 +57,14 @@ export class ToolExecutor {
      * middleware registered on the `toolExecute` pipeline sees the same
      * context every other pipeline slot uses. When omitted (CLI/test
      * invocations that call `ToolExecutor.execute` directly), the executor
-     * synthesizes a fallback context from the {@link ToolContext}, which
-     * keeps pre-threading behavior intact for legacy callers.
+     * synthesizes a fallback context from the {@link ToolContext}.
      */
     turnContext?: TurnContext,
   ): Promise<ToolExecutionResult> {
     // Prefer the orchestrator-supplied `turnContext` so the pipeline sees
     // the real conversation identity, per-turn trust, and context-window
     // manager. When absent (CLI / test invocations that bypass the agent
-    // loop), synthesize a minimal context from the `ToolContext` — the
-    // same fallback the executor has used since the pipeline was added.
+    // loop), synthesize a minimal context from the `ToolContext`.
     const turnCtx: TurnContext = turnContext ?? {
       requestId: context.requestId ?? "",
       conversationId: context.conversationId,
@@ -85,14 +80,11 @@ export class ToolExecutor {
 
     // No pipeline-level timeout: `executeInternal` already wraps the real
     // tool invocation in `executeWithTimeout`, which is the sole enforcer
-    // of the per-tool budget. Propagating `perToolTimeoutMs` to
-    // `runPipeline` made the pipeline race everything upstream of the
-    // tool call — permission checks, approval waits, middleware — against
-    // the same budget, so a slow human clicking "allow" produced a
-    // `PluginTimeoutError` thrown past `executeInternal`'s catch block,
-    // breaking the `execute()` never-throws contract. Letting the pipeline
-    // run untimed keeps the contract intact; runaway middleware is a
-    // plugin-health concern handled by per-plugin timeouts, not here.
+    // of the per-tool budget. The pipeline itself runs untimed so that
+    // upstream phases (permission checks, approval waits, middleware) are
+    // not racing the tool budget — only the actual tool call is. Runaway
+    // middleware is a plugin-health concern handled by per-plugin timeouts,
+    // not here.
     return runPipeline<ToolExecuteArgs, ToolExecuteResult>(
       "toolExecute",
       middlewares,
@@ -110,6 +102,19 @@ export class ToolExecutor {
     const startTime = Date.now();
     let decision = "allow";
     let riskLevel: string = RiskLevel.Low;
+    let permRiskMeta:
+      | {
+          riskLevel: string;
+          riskReason: string;
+          riskScopeOptions: Array<{ pattern: string; label: string }>;
+          riskDirectoryScopeOptions?: Array<{ scope: string; label: string }>;
+          isContainerized?: boolean;
+        }
+      | undefined;
+    let permMatchedTrustRuleId: string | undefined;
+    let permApprovalMode: string | undefined;
+    let permApprovalReason: string | undefined;
+    let permRiskThreshold: string | undefined;
     const executionTarget = resolveExecutionTarget(name);
 
     emitLifecycleEvent(context, {
@@ -172,14 +177,6 @@ export class ToolExecutor {
       // Exception: requireFreshApproval tools always go through the
       // permission check even when a grant was consumed - the grant does
       // not substitute for an interactive human review.
-      let permRiskMeta:
-        | {
-            riskLevel: string;
-            riskReason: string;
-            riskScopeOptions: Array<{ pattern: string; label: string }>;
-            isContainerized?: boolean;
-          }
-        | undefined;
       if (!gateResult.grantConsumed || context.requireFreshApproval) {
         // Check permissions via the extracted PermissionChecker
         const permResult = await this.permissionChecker.checkPermission(
@@ -196,6 +193,10 @@ export class ToolExecutor {
         riskLevel = permResult.riskLevel;
         decision = permResult.decision;
         permRiskMeta = permResult.riskMeta;
+        permMatchedTrustRuleId = permResult.matchedTrustRuleId;
+        permApprovalMode = permResult.approvalMode;
+        permApprovalReason = permResult.approvalReason;
+        permRiskThreshold = permResult.riskThreshold;
 
         if (!permResult.allowed) {
           return {
@@ -204,13 +205,23 @@ export class ToolExecutor {
             riskLevel: permRiskMeta?.riskLevel,
             riskReason: permRiskMeta?.riskReason,
             riskScopeOptions: permRiskMeta?.riskScopeOptions,
+            riskDirectoryScopeOptions: permRiskMeta?.riskDirectoryScopeOptions,
             isContainerized: permRiskMeta?.isContainerized,
+            matchedTrustRuleId: permMatchedTrustRuleId,
+            approvalMode: permApprovalMode,
+            approvalReason: permApprovalReason,
+            riskThreshold: permRiskThreshold,
           };
         }
 
         if (permResult.wasPrompted) {
           context.approvedViaPrompt = true;
         }
+      } else {
+        // Grant consumed — permission check was skipped. Set provenance explicitly
+        // so the record shows how this execution was authorized.
+        permApprovalMode = "auto";
+        permApprovalReason = "grant_scoped_consumed";
       }
 
       // Execute the tool - proxy tools delegate to an external resolver.
@@ -234,6 +245,7 @@ export class ToolExecutor {
             conversationId: context.conversationId,
             requestId: context.requestId,
             riskLevel,
+            matchedTrustRuleId: permMatchedTrustRuleId,
             decision: "error",
             durationMs,
             errorMessage: msg,
@@ -271,6 +283,7 @@ export class ToolExecutor {
           conversationId: context.conversationId,
           requestId: context.requestId,
           riskLevel,
+          matchedTrustRuleId: permMatchedTrustRuleId,
           decision: "error",
           durationMs,
           errorMessage: msg,
@@ -337,6 +350,7 @@ export class ToolExecutor {
             conversationId: context.conversationId,
             requestId: context.requestId,
             riskLevel,
+            matchedTrustRuleId: permMatchedTrustRuleId,
             decision: "deny",
             reason: denialReason,
             durationMs,
@@ -355,6 +369,7 @@ export class ToolExecutor {
             conversationId: context.conversationId,
             requestId: context.requestId,
             riskLevel,
+            matchedTrustRuleId: permMatchedTrustRuleId,
             decision: "error",
             durationMs,
             errorMessage: errorMsg,
@@ -367,8 +382,6 @@ export class ToolExecutor {
 
       // Sensitive output extraction: strip directives, replace raw values
       // with placeholders, and attach bindings for agent-loop substitution.
-      // Runs before secret detection so that raw sensitive values are already
-      // replaced and won't trigger entropy-based redaction.
       const { sanitizedContent, bindings } = extractAndSanitize(
         execResult.content,
       );
@@ -380,23 +393,6 @@ export class ToolExecutor {
         };
       }
 
-      // Secret detection on tool output
-      const secretResult = await this.secretDetectionHandler.handle(
-        execResult,
-        name,
-        input,
-        context,
-        executionTarget,
-        riskLevel,
-        decision,
-        startTime,
-        emitLifecycleEvent,
-      );
-      if (secretResult.earlyReturn) {
-        return secretResult.result;
-      }
-      execResult = secretResult.result;
-
       const durationMs = Date.now() - startTime;
       // Strip sensitiveBindings from lifecycle event to prevent raw values leaking
       const { sensitiveBindings: _sb, ...safeResult } = execResult;
@@ -409,6 +405,7 @@ export class ToolExecutor {
         conversationId: context.conversationId,
         requestId: context.requestId,
         riskLevel,
+        matchedTrustRuleId: permMatchedTrustRuleId,
         decision,
         durationMs,
         result: safeResult,
@@ -423,9 +420,22 @@ export class ToolExecutor {
           riskLevel: permRiskMeta.riskLevel,
           riskReason: permRiskMeta.riskReason,
           riskScopeOptions: permRiskMeta.riskScopeOptions,
+          riskDirectoryScopeOptions: permRiskMeta.riskDirectoryScopeOptions,
           isContainerized: permRiskMeta.isContainerized,
         };
       }
+      if (permMatchedTrustRuleId) {
+        execResult = { ...execResult, matchedTrustRuleId: permMatchedTrustRuleId };
+      }
+      if (permApprovalMode) {
+        execResult = { ...execResult, approvalMode: permApprovalMode };
+      }
+      if (permApprovalReason) {
+        execResult = { ...execResult, approvalReason: permApprovalReason };
+      }
+      if (permRiskThreshold) {
+        execResult = { ...execResult, riskThreshold: permRiskThreshold };
+      }
 
       return execResult;
     } catch (err) {
@@ -467,6 +477,7 @@ export class ToolExecutor {
         conversationId: context.conversationId,
         requestId: context.requestId,
         riskLevel,
+        matchedTrustRuleId: permMatchedTrustRuleId,
         decision: "error",
         durationMs,
         errorMessage: msg,
@@ -491,9 +502,6 @@ export class ToolExecutor {
 // `executor.ts` continue to work without changing their imports.
 export { isSideEffectTool } from "./side-effects.js";
 
-// Re-export PermissionChecker for consumers that need direct access
-export { PermissionChecker } from "./permission-checker.js";
-
 /**
  * Compute the effective per-tool execution timeout in milliseconds.
  *

package/src/tools/host-filesystem/edit.ts

@@ -1,3 +1,4 @@
+import { HostFileProxy } from "../../daemon/host-file-proxy.js";
 import { RiskLevel } from "../../permissions/types.js";
 import type { ToolDefinition } from "../../providers/types.js";
 import { FileSystemOps } from "../shared/filesystem/file-ops-service.js";
@@ -85,8 +86,8 @@ class HostFileEditTool implements Tool {
 
     // Proxy to connected client for execution on the user's machine
     // when a capable client is available (managed/cloud-hosted mode).
-    if (context.hostFileProxy?.isAvailable()) {
-      return context.hostFileProxy.request(
+    if (HostFileProxy.instance.isAvailable()) {
+      return HostFileProxy.instance.request(
         {
           operation: "edit",
           path: rawPath,

package/src/tools/host-filesystem/read.ts

@@ -1,5 +1,6 @@
 import { extname } from "node:path";
 
+import { HostFileProxy } from "../../daemon/host-file-proxy.js";
 import { RiskLevel } from "../../permissions/types.js";
 import type { ToolDefinition } from "../../providers/types.js";
 import { FileSystemOps } from "../shared/filesystem/file-ops-service.js";
@@ -57,8 +58,8 @@ class HostFileReadTool implements Tool {
     // Proxy to connected client for execution on the user's machine
     // when a capable client is available (managed/cloud-hosted mode),
     // including image reads that need the host filesystem view.
-    if (context.hostFileProxy?.isAvailable()) {
-      return context.hostFileProxy.request(
+    if (HostFileProxy.instance.isAvailable()) {
+      return HostFileProxy.instance.request(
         {
           operation: "read",
           path: rawPath,