@vellumai/assistant 0.7.1 → 0.7.3

package/src/daemon/host-browser-proxy.ts

@@ -1,11 +1,14 @@
 import { v4 as uuid } from "uuid";
 
-import { buildAssistantEvent } from "../runtime/assistant-event.js";
-import { assistantEventHub } from "../runtime/assistant-event-hub.js";
+import type { InterfaceId } from "../channels/types.js";
+import {
+  assistantEventHub,
+  broadcastMessage,
+} from "../runtime/assistant-event-hub.js";
+import * as pendingInteractions from "../runtime/pending-interactions.js";
 import type { ToolExecutionResult } from "../tools/types.js";
 import { AssistantError, ErrorCode } from "../util/errors.js";
 import { getLogger } from "../util/logger.js";
-import type { ServerMessage } from "./message-protocol.js";
 import type { HostBrowserRequest } from "./message-types/host-browser.js";
 
 /** Distributive omit that preserves union variant fields. */
@@ -21,13 +24,11 @@ export type HostBrowserInput = DistributiveOmit<
 
 const log = getLogger("host-browser-proxy");
 
-interface PendingRequest {
-  resolve: (result: ToolExecutionResult) => void;
-  reject: (err: Error) => void;
-  timer: ReturnType<typeof setTimeout>;
-  /** Detach the abort listener from the caller's signal. No-op when no signal was passed. */
-  detachAbort: () => void;
-}
+/** Interface priority order for host_browser: Chrome Extension first, macOS SSE bridge second. */
+const HOST_BROWSER_INTERFACE_PREFERENCE: InterfaceId[] = [
+  "chrome-extension",
+  "macos",
+];
 
 export class HostBrowserProxy {
   private static _instance: HostBrowserProxy | null = null;
@@ -58,29 +59,29 @@ export class HostBrowserProxy {
     HostBrowserProxy._instance = null;
   }
 
-  private pending = new Map<string, PendingRequest>();
-
   /**
    * Whether a client with `host_browser` capability is connected.
+   * Returns `true` when either the Chrome Extension or the macOS SSE
+   * bridge is available — i.e. any transport can forward host-browser
+   * requests.
    */
   isAvailable(): boolean {
     return (
-      assistantEventHub.getMostRecentClientByCapability("host_browser") != null
+      assistantEventHub.getPreferredClientByCapability(
+        "host_browser",
+        HOST_BROWSER_INTERFACE_PREFERENCE,
+      ) != null
     );
   }
 
   /**
-   * Publish a ServerMessage through the assistant event hub, targeted at
-   * subscribers with the `host_browser` capability.
+   * Whether a Chrome Extension client specifically is connected.
+   * Returns `false` when only the macOS SSE bridge is available.
+   * Unlike {@link isAvailable}, this does not consider the macOS bridge
+   * a valid extension transport.
    */
-  private send(msg: ServerMessage): void {
-    void assistantEventHub
-      .publish(buildAssistantEvent(msg), {
-        targetCapability: "host_browser",
-      })
-      .catch((err) => {
-        log.warn({ err }, "failed to publish host_browser event to hub");
-      });
+  hasExtensionClient(): boolean {
+    return assistantEventHub.listClientsByInterface("chrome-extension").length > 0;
   }
 
   request(
@@ -95,42 +96,34 @@ export class HostBrowserProxy {
     const requestId = uuid();
 
     return new Promise<ToolExecutionResult>((resolve, reject) => {
-      // CDP operations should be fast — 30 second default timeout matches host_file.
       const timeoutSec = input.timeout_seconds ?? 30;
 
-      // Declared up-front so onAbort (defined before detachAbort is assigned)
-      // can close over a stable reference once it's wired below.
       let detachAbort: () => void = () => {};
 
       const timer = setTimeout(() => {
-        this.pending.delete(requestId);
-        detachAbort();
+        pendingInteractions.resolve(requestId);
         log.warn(
           { requestId, cdpMethod: input.cdpMethod },
           "Host browser proxy request timed out",
         );
         resolve({
           content:
-            "Host browser proxy timed out waiting for extension response (check browser-relay connectivity and /v1/host-browser-result callback failures such as 404/401).",
+            "Host browser proxy timed out waiting for extension response (check SSE connectivity and /v1/host-browser-result callback failures such as 404/401).",
           isError: true,
         });
       }, timeoutSec * 1000);
 
       if (signal) {
         const onAbort = () => {
-          if (this.pending.has(requestId)) {
-            clearTimeout(timer);
-            this.pending.delete(requestId);
-            // Abort fired — nothing to detach, but call the no-op for symmetry
-            // so callers can rely on detachAbort being idempotent.
-            detachAbort();
+          if (pendingInteractions.get(requestId)) {
+            pendingInteractions.resolve(requestId);
             try {
-              this.send({
+              broadcastMessage({
                 type: "host_browser_cancel",
                 requestId,
-              } as ServerMessage);
+              });
             } catch {
-              // Best-effort cancel notification — connection may already be closed.
+              // Best-effort cancel notification
             }
             resolve({ content: "Aborted", isError: true });
           }
@@ -139,13 +132,22 @@ export class HostBrowserProxy {
         detachAbort = () => signal.removeEventListener("abort", onAbort);
       }
 
-      this.pending.set(requestId, { resolve, reject, timer, detachAbort });
+      pendingInteractions.register(requestId, {
+        conversationId,
+        kind: "host_browser",
+        rpcResolve: resolve,
+        rpcReject: reject,
+        timer,
+        detachAbort,
+      });
 
       try {
-        if (!this.isAvailable()) {
-          clearTimeout(timer);
-          this.pending.delete(requestId);
-          detachAbort();
+        const preferredClient = assistantEventHub.getPreferredClientByCapability(
+          "host_browser",
+          HOST_BROWSER_INTERFACE_PREFERENCE,
+        );
+        if (!preferredClient) {
+          pendingInteractions.resolve(requestId);
           reject(
             new Error(
               "host_browser send failed: no active extension connection",
@@ -154,19 +156,13 @@ export class HostBrowserProxy {
           return;
         }
 
-        this.send({
-          ...input,
-          type: "host_browser_request",
-          requestId,
+        broadcastMessage(
+          { ...input, type: "host_browser_request", requestId, conversationId },
           conversationId,
-        } as ServerMessage);
+          { targetClientId: preferredClient.clientId },
+        );
       } catch (err) {
-        // Sender threw synchronously (e.g. client transport error during
-        // event emission). Clean up pending state and timer so we don't
-        // leak an in-flight entry that nothing will ever resolve.
-        clearTimeout(timer);
-        this.pending.delete(requestId);
-        detachAbort();
+        pendingInteractions.resolve(requestId);
         log.warn(
           { requestId, cdpMethod: input.cdpMethod, err },
           "Host browser proxy send failed",
@@ -176,55 +172,44 @@ export class HostBrowserProxy {
     });
   }
 
-  resolve(
+  /**
+   * Process a client result and resolve the RPC. Called by route handlers.
+   */
+  resolveResult(
     requestId: string,
     response: { content: string; isError: boolean },
   ): void {
-    const entry = this.pending.get(requestId);
-    if (!entry) {
-      // Benign race, not an error. A late result frame with no matching
-      // pending entry means one of:
-      //   - the proxy-side setTimeout has already resolved the caller;
-      //   - the caller's AbortSignal fired and the entry was torn down;
-      //   - a duplicate result frame was delivered (e.g. retry after a
-      //     transient WS drop).
-      // Log at debug so operators don't chase false-positive "timeout"
-      // alerts on what is actually a cleanly-handled race.
+    const interaction = pendingInteractions.resolve(requestId);
+    if (!interaction?.rpcResolve) {
       log.debug(
         { requestId },
         "Ignoring host_browser_result for unknown or already-resolved request",
       );
       return;
     }
-    clearTimeout(entry.timer);
-    entry.detachAbort();
-    this.pending.delete(requestId);
-    entry.resolve({ content: response.content, isError: response.isError });
-  }
-
-  hasPendingRequest(requestId: string): boolean {
-    return this.pending.has(requestId);
+    interaction.rpcResolve({
+      content: response.content,
+      isError: response.isError,
+    });
   }
 
   dispose(): void {
-    for (const [requestId, entry] of this.pending) {
-      clearTimeout(entry.timer);
-      entry.detachAbort();
+    for (const entry of pendingInteractions.getByKind("host_browser")) {
+      pendingInteractions.resolve(entry.requestId);
       try {
-        this.send({
+        broadcastMessage({
           type: "host_browser_cancel",
-          requestId,
-        } as ServerMessage);
+          requestId: entry.requestId,
+        });
       } catch {
-        // Best-effort cancel notification — connection may already be closed.
+        // Best-effort cancel notification
       }
-      entry.reject(
+      entry.rpcReject?.(
         new AssistantError(
           "Host browser proxy disposed",
           ErrorCode.INTERNAL_ERROR,
         ),
       );
     }
-    this.pending.clear();
   }
 }

package/src/daemon/host-cu-proxy.ts

@@ -9,6 +9,9 @@
  * Unlike HostBashProxy/HostFileProxy/HostTransferProxy, this is NOT a
  * singleton — each conversation gets its own instance because CU state
  * (step count, AX tree history, loop detection) is per-conversation.
+ *
+ * RPC lifecycle (resolve/reject/timer/detachAbort) is stored in
+ * pendingInteractions alongside routing metadata.
  */
 
 import { v4 as uuid } from "uuid";
@@ -20,11 +23,11 @@ import {
   assistantEventHub,
   broadcastMessage,
 } from "../runtime/assistant-event-hub.js";
+import { enforceSameActorOrErrorResult } from "../runtime/auth/same-actor.js";
 import * as pendingInteractions from "../runtime/pending-interactions.js";
 import type { ToolExecutionResult } from "../tools/types.js";
 import { AssistantError, ErrorCode } from "../util/errors.js";
 import { getLogger } from "../util/logger.js";
-import type { ServerMessage } from "./message-protocol.js";
 
 const log = getLogger("host-cu-proxy");
 
@@ -62,28 +65,19 @@ export interface ActionRecord {
   reasoning?: string;
 }
 
-interface PendingRequest {
-  resolve: (result: ToolExecutionResult) => void;
-  reject: (err: Error) => void;
-  timer: ReturnType<typeof setTimeout>;
-  conversationId: string;
-  /** Detach the abort listener from the caller's signal. No-op when no signal was passed. */
-  detachAbort: () => void;
-}
-
 // ---------------------------------------------------------------------------
 // HostCuProxy
 // ---------------------------------------------------------------------------
 
 export class HostCuProxy {
-  private pending = new Map<string, PendingRequest>();
-
   // CU state tracking (per-conversation)
   private _stepCount = 0;
   private _maxSteps: number;
   private _previousAXTree: string | undefined;
   private _consecutiveUnchangedSteps = 0;
   private _actionHistory: ActionRecord[] = [];
+  /** Request IDs owned by this instance — used to scope dispose(). */
+  private _ownedRequests = new Set<string>();
 
   constructor(maxSteps = loadConfig().maxStepsPerSession) {
     this._maxSteps = maxSteps;
@@ -121,23 +115,23 @@ export class HostCuProxy {
    * Whether a client with `host_cu` capability is connected.
    */
   isAvailable(): boolean {
-    return (
-      assistantEventHub.getMostRecentClientByCapability("host_cu") != null
-    );
-  }
-
-  // ---------------------------------------------------------------------------
-  // Send helper
-  // ---------------------------------------------------------------------------
-
-  private send(msg: ServerMessage): void {
-    broadcastMessage(msg, undefined, { targetCapability: "host_cu" });
+    return assistantEventHub.getMostRecentClientByCapability("host_cu") != null;
   }
 
   // ---------------------------------------------------------------------------
   // Request / resolve lifecycle
   // ---------------------------------------------------------------------------
 
+  /**
+   * Send a CU request to the connected desktop client.
+   *
+   * When `targetClientId` is supplied, the proxy validates that the target
+   * exists and advertises the `host_cu` capability, mirroring HostFileProxy's
+   * resolver-side checks so that the proxy is safe to call as a standalone
+   * API. It additionally enforces that the caller (`sourceActorPrincipalId`)
+   * and the target client share the same actor principal — cross-user
+   * targeted dispatch is rejected.
+   */
   request(
     toolName: string,
     input: Record<string, unknown>,
@@ -145,6 +139,8 @@ export class HostCuProxy {
     stepNumber: number,
     reasoning?: string,
     signal?: AbortSignal,
+    targetClientId?: string,
+    sourceActorPrincipalId?: string,
   ): Promise<ToolExecutionResult> {
     if (signal?.aborted) {
       return Promise.resolve({
@@ -153,7 +149,6 @@ export class HostCuProxy {
       });
     }
 
-    // Enforce step limit before sending to client
     if (this._stepCount > this._maxSteps) {
       return Promise.resolve({
         content: `Step limit (${this._maxSteps}) exceeded. Call computer_use_done to finish.`,
@@ -161,14 +156,45 @@ export class HostCuProxy {
       });
     }
 
+    // Existence + capability validation for explicit targets. Mirrors
+    // HostFileProxy's resolver-side guard so that the proxy is safe even
+    // when called outside the conversation-surfaces dispatch (which has
+    // its own validation layer).
+    if (targetClientId != null) {
+      const client = assistantEventHub.getClientById(targetClientId);
+      if (!client) {
+        return Promise.resolve({
+          content: `No connected client with id '${targetClientId}' supports host_cu. Run \`assistant clients list --capability host_cu\` to see available clients.`,
+          isError: true,
+        });
+      }
+      if (!client.capabilities.includes("host_cu")) {
+        return Promise.resolve({
+          content: `Client '${targetClientId}' does not support host_cu. Run \`assistant clients list --capability host_cu\` to see available clients.`,
+          isError: true,
+        });
+      }
+
+      // Same-user enforcement: targeted CU dispatch must be owned by the
+      // same actor on both sides. This is the authoritative gate — the
+      // dispatch layer (conversation-surfaces.ts) skips its own check
+      // and relies on the proxy.
+      const rejection = enforceSameActorOrErrorResult({
+        hub: assistantEventHub,
+        sourceActorPrincipalId,
+        targetClientId,
+        op: "host_cu",
+      });
+      if (rejection) return Promise.resolve(rejection);
+    }
+
     const requestId = uuid();
 
     return new Promise<ToolExecutionResult>((resolve, reject) => {
       let detachAbort: () => void = () => {};
 
       const timer = setTimeout(() => {
-        this.pending.delete(requestId);
-        detachAbort();
+        this._ownedRequests.delete(requestId);
         pendingInteractions.resolve(requestId);
         log.warn({ requestId, toolName }, "Host CU proxy request timed out");
         resolve({
@@ -179,19 +205,22 @@ export class HostCuProxy {
 
       if (signal) {
         const onAbort = () => {
-          if (this.pending.has(requestId)) {
-            clearTimeout(timer);
-            this.pending.delete(requestId);
-            detachAbort();
+          if (pendingInteractions.get(requestId)) {
+            this._ownedRequests.delete(requestId);
             pendingInteractions.resolve(requestId);
             try {
-              this.send({
-                type: "host_cu_cancel",
-                requestId,
+              broadcastMessage(
+                {
+                  type: "host_cu_cancel",
+                  requestId,
+                  conversationId,
+                  ...(targetClientId != null ? { targetClientId } : {}),
+                },
                 conversationId,
-              });
+                { targetClientId },
+              );
             } catch {
-              // Best-effort cancel notification — connection may already be closed.
+              // Best-effort cancel notification
             }
             resolve({ content: "Aborted", isError: true });
           }
@@ -200,22 +229,40 @@ export class HostCuProxy {
         detachAbort = () => signal.removeEventListener("abort", onAbort);
       }
 
-      this.pending.set(requestId, { resolve, reject, timer, conversationId, detachAbort });
+      this._ownedRequests.add(requestId);
+
+      pendingInteractions.register(requestId, {
+        conversationId,
+        kind: "host_cu",
+        targetClientId,
+        targetActorPrincipalId:
+          targetClientId != null
+            ? assistantEventHub.getActorPrincipalIdForClient(targetClientId)
+            : undefined,
+        rpcResolve: resolve,
+        rpcReject: reject,
+        timer,
+        detachAbort,
+      });
 
       try {
-        this.send({
-          type: "host_cu_request",
-          requestId,
+        broadcastMessage(
+          {
+            type: "host_cu_request",
+            requestId,
+            conversationId,
+            toolName,
+            input,
+            stepNumber,
+            reasoning,
+            // Include in body so receiving client can verify targeted endpoint.
+            ...(targetClientId != null ? { targetClientId } : {}),
+          },
           conversationId,
-          toolName,
-          input,
-          stepNumber,
-          reasoning,
-        });
+          { targetClientId },
+        );
       } catch (err) {
-        clearTimeout(timer);
-        this.pending.delete(requestId);
-        detachAbort();
+        this._ownedRequests.delete(requestId);
         pendingInteractions.resolve(requestId);
         log.warn({ requestId, toolName, err }, "Host CU proxy send failed");
         reject(err instanceof Error ? err : new Error(String(err)));
@@ -223,28 +270,27 @@ export class HostCuProxy {
     });
   }
 
-  resolve(requestId: string, observation: CuObservationResult): void {
-    const entry = this.pending.get(requestId);
-    if (!entry) {
+  /**
+   * Process a CU observation from the client and resolve the RPC.
+   * Updates CU state (step tracking, AX tree history) and formats
+   * the observation into a ToolExecutionResult.
+   */
+  processObservation(
+    requestId: string,
+    observation: CuObservationResult,
+  ): ToolExecutionResult | undefined {
+    this._ownedRequests.delete(requestId);
+    const interaction = pendingInteractions.resolve(requestId);
+    if (!interaction?.rpcResolve) {
       log.warn({ requestId }, "No pending host CU request for response");
-      return;
+      return undefined;
     }
-    clearTimeout(entry.timer);
-    entry.detachAbort();
-    this.pending.delete(requestId);
 
-    // Capture pre-update state so formatObservation sees the correct previous AX tree
     const prevAXTree = this._previousAXTree;
-
-    // Update CU state from observation
     this.updateStateFromObservation(observation);
-
     const result = this.formatObservation(observation, prevAXTree);
-    entry.resolve(result);
-  }
-
-  hasPendingRequest(requestId: string): boolean {
-    return this.pending.has(requestId);
+    interaction.rpcResolve(result);
+    return result;
   }
 
   // ---------------------------------------------------------------------------
@@ -267,7 +313,6 @@ export class HostCuProxy {
       input,
       reasoning,
     });
-    // Keep history bounded
     if (this._actionHistory.length > MAX_HISTORY_ENTRIES) {
       this._actionHistory = this._actionHistory.slice(-MAX_HISTORY_ENTRIES);
     }
@@ -297,7 +342,6 @@ export class HostCuProxy {
     const prevTree = previousAXTree;
     const parts: string[] = [];
 
-    // Surface user guidance prominently so the model sees it first
     if (obs.userGuidance) {
       parts.push(`USER GUIDANCE: ${obs.userGuidance}`);
       parts.push("");
@@ -308,12 +352,10 @@ export class HostCuProxy {
       parts.push("");
     }
 
-    // AX tree diff / unchanged warning
     if (obs.axDiff) {
       parts.push(obs.axDiff);
       parts.push("");
     } else if (prevTree != null && obs.axTree != null) {
-      // Skip unchanged warning after wait actions — they intentionally yield no immediate change
       const lastAction =
         this._actionHistory.length > 0
           ? this._actionHistory[this._actionHistory.length - 1]
@@ -321,7 +363,6 @@ export class HostCuProxy {
       const isWaitAction = lastAction?.toolName === "computer_use_wait";
 
       if (!isWaitAction) {
-        // No diff means the screen didn't change
         if (
           this._consecutiveUnchangedSteps >=
           CONSECUTIVE_UNCHANGED_WARNING_THRESHOLD
@@ -338,7 +379,6 @@ export class HostCuProxy {
       }
     }
 
-    // Loop detection: identical actions repeated
     if (this._actionHistory.length >= LOOP_DETECTION_WINDOW) {
       const recent = this._actionHistory.slice(-LOOP_DETECTION_WINDOW);
       const allIdentical = recent.every(
@@ -354,7 +394,6 @@ export class HostCuProxy {
       }
     }
 
-    // Current screen state wrapped in markers for history compaction
     if (obs.axTree) {
       parts.push("<ax-tree>");
       parts.push("CURRENT SCREEN STATE:");
@@ -362,7 +401,6 @@ export class HostCuProxy {
       parts.push("</ax-tree>");
     }
 
-    // Secondary windows for cross-app awareness
     if (obs.secondaryWindows) {
       parts.push("");
       parts.push(obs.secondaryWindows);
@@ -372,7 +410,6 @@ export class HostCuProxy {
       );
     }
 
-    // Screenshot metadata
     const screenshotMeta = this.formatScreenshotMetadata(obs);
     if (screenshotMeta.length > 0) {
       parts.push("");
@@ -381,7 +418,6 @@ export class HostCuProxy {
 
     const content = parts.join("\n").trim() || "Action executed";
 
-    // Build content blocks for screenshot
     const contentBlocks: ContentBlock[] = [];
     if (obs.screenshot) {
       contentBlocks.push({
@@ -410,31 +446,36 @@ export class HostCuProxy {
   // ---------------------------------------------------------------------------
 
   dispose(): void {
-    for (const [requestId, entry] of this.pending) {
-      clearTimeout(entry.timer);
-      entry.detachAbort();
-      pendingInteractions.resolve(requestId);
+    for (const requestId of this._ownedRequests) {
+      const entry = pendingInteractions.resolve(requestId);
+      if (!entry) continue;
       try {
-        this.send({
-          type: "host_cu_cancel",
-          requestId,
-          conversationId: entry.conversationId,
-        });
+        broadcastMessage(
+          {
+            type: "host_cu_cancel",
+            requestId,
+            conversationId: entry.conversationId,
+            ...(entry.targetClientId != null
+              ? { targetClientId: entry.targetClientId }
+              : {}),
+          },
+          entry.conversationId,
+          { targetClientId: entry.targetClientId as string | undefined },
+        );
       } catch {
-        // Best-effort cancel notification — connection may already be closed.
+        // Best-effort cancel notification
       }
-      entry.reject(
+      entry.rpcReject?.(
         new AssistantError("Host CU proxy disposed", ErrorCode.INTERNAL_ERROR),
       );
     }
-    this.pending.clear();
+    this._ownedRequests.clear();
   }
 
   // ---------------------------------------------------------------------------
   // Private helpers
   // ---------------------------------------------------------------------------
 
-  /** Update consecutive-unchanged tracking from an incoming observation. */
   private updateStateFromObservation(obs: CuObservationResult): void {
     if (this._stepCount > 0) {
       if (