@vellumai/assistant 0.7.1 → 0.7.3

package/src/daemon/host-file-proxy.ts

@@ -4,12 +4,16 @@ import {
   assistantEventHub,
   broadcastMessage,
 } from "../runtime/assistant-event-hub.js";
+import {
+  ambiguousSameUserError,
+  enforceSameActorOrErrorResult,
+  pickSameUserAutoResolve,
+} from "../runtime/auth/same-actor.js";
 import * as pendingInteractions from "../runtime/pending-interactions.js";
 import { readImageBase64 } from "../tools/shared/filesystem/image-read.js";
 import type { ToolExecutionResult } from "../tools/types.js";
 import { AssistantError, ErrorCode } from "../util/errors.js";
 import { getLogger } from "../util/logger.js";
-import type { ServerMessage } from "./message-protocol.js";
 import type { HostFileRequest } from "./message-types/host-file.js";
 
 /** Distributive omit that preserves union variant fields. */
@@ -25,17 +29,6 @@ export type HostFileInput = DistributiveOmit<
 
 const log = getLogger("host-file-proxy");
 
-interface PendingRequest {
-  resolve: (result: ToolExecutionResult) => void;
-  reject: (err: Error) => void;
-  timer: ReturnType<typeof setTimeout>;
-  operation: HostFileInput["operation"];
-  path: string;
-  conversationId: string;
-  /** Detach the abort listener from the caller's signal. No-op when no signal was passed. */
-  detachAbort: () => void;
-}
-
 export class HostFileProxy {
   private static _instance: HostFileProxy | null = null;
 
@@ -65,8 +58,6 @@ export class HostFileProxy {
     HostFileProxy._instance = null;
   }
 
-  private pending = new Map<string, PendingRequest>();
-
   /**
    * Whether a client with `host_file` capability is connected.
    * Note: host_file covers both file operations and transfers.
@@ -77,56 +68,106 @@ export class HostFileProxy {
     );
   }
 
-  private send(msg: ServerMessage): void {
-    broadcastMessage(msg, undefined, { targetCapability: "host_file" });
-  }
-
   request(
     input: HostFileInput,
     conversationId: string,
     signal?: AbortSignal,
+    targetClientId?: string,
+    sourceActorPrincipalId?: string,
   ): Promise<ToolExecutionResult> {
     if (signal?.aborted) {
       return Promise.resolve({ content: "Aborted", isError: true });
     }
 
+    // Resolve targetClientId: explicit → validate; single same-user
+    // capable client → auto-resolve. Callers may embed targetClientId in
+    // the input object (tool handlers) or pass it as the 4th parameter
+    // (legacy). Prefer the explicit param; fall back to input field.
+    let resolvedTargetClientId: string | undefined =
+      targetClientId ?? input.targetClientId;
+    if (resolvedTargetClientId != null) {
+      const client = assistantEventHub.getClientById(resolvedTargetClientId);
+      if (!client) {
+        return Promise.resolve({
+          content: `No connected client with id '${resolvedTargetClientId}' supports host_file. Run \`assistant clients list --capability host_file\` to see available clients.`,
+          isError: true,
+        });
+      }
+      if (!client.capabilities.includes("host_file")) {
+        return Promise.resolve({
+          content: `Client '${resolvedTargetClientId}' does not support host_file. Run \`assistant clients list --capability host_file\` to see available clients.`,
+          isError: true,
+        });
+      }
+    } else {
+      // Auto-resolve to the unique same-user client. Reject ambiguous
+      // (multi-machine) cases so a single targeted-style request cannot
+      // fan out across the user's machines.
+      const resolved = pickSameUserAutoResolve({
+        hub: assistantEventHub,
+        capability: "host_file",
+        sourceActorPrincipalId,
+      });
+      if (resolved.kind === "ambiguous") {
+        return Promise.resolve(ambiguousSameUserError("host_file"));
+      }
+      resolvedTargetClientId =
+        resolved.kind === "match" ? resolved.clientId : undefined;
+    }
+
+    // Same-user check: targeted host_file requests must be bound to the same
+    // authenticated user identity that opened the target client's SSE stream.
+    // Prevents cross-user routing through actor token mis-targeting.
+    if (resolvedTargetClientId != null) {
+      const rejection = enforceSameActorOrErrorResult({
+        hub: assistantEventHub,
+        sourceActorPrincipalId,
+        targetClientId: resolvedTargetClientId,
+        op: "host_file",
+      });
+      if (rejection) return Promise.resolve(rejection);
+    }
+
     const requestId = uuid();
 
     return new Promise<ToolExecutionResult>((resolve, reject) => {
-      // File operations should be fast — 30 second timeout.
       const timeoutSec = 30;
 
       let detachAbort: () => void = () => {};
 
       const timer = setTimeout(() => {
-        this.pending.delete(requestId);
-        detachAbort();
         pendingInteractions.resolve(requestId);
         log.warn(
           { requestId, operation: input.operation },
           "Host file proxy request timed out",
         );
         resolve({
-          content: "Host file proxy timed out waiting for client response",
+          content: resolvedTargetClientId
+            ? `Host file proxy timed out waiting for response from client '${resolvedTargetClientId}'`
+            : "Host file proxy timed out waiting for client response",
           isError: true,
         });
       }, timeoutSec * 1000);
 
       if (signal) {
         const onAbort = () => {
-          if (this.pending.has(requestId)) {
-            clearTimeout(timer);
-            this.pending.delete(requestId);
-            detachAbort();
+          if (pendingInteractions.get(requestId)) {
             pendingInteractions.resolve(requestId);
             try {
-              this.send({
-                type: "host_file_cancel",
-                requestId,
+              broadcastMessage(
+                {
+                  type: "host_file_cancel",
+                  requestId,
+                  conversationId,
+                  ...(resolvedTargetClientId != null
+                    ? { targetClientId: resolvedTargetClientId }
+                    : {}),
+                },
                 conversationId,
-              });
+                { targetClientId: resolvedTargetClientId },
+              );
             } catch {
-              // Best-effort cancel notification — connection may already be closed.
+              // Best-effort cancel notification
             }
             resolve({ content: "Aborted", isError: true });
           }
@@ -135,27 +176,40 @@ export class HostFileProxy {
         detachAbort = () => signal.removeEventListener("abort", onAbort);
       }
 
-      this.pending.set(requestId, {
-        resolve,
-        reject,
-        timer,
-        operation: input.operation,
-        path: input.path,
+      pendingInteractions.register(requestId, {
         conversationId,
+        kind: "host_file",
+        targetClientId: resolvedTargetClientId,
+        targetActorPrincipalId:
+          resolvedTargetClientId != null
+            ? assistantEventHub.getActorPrincipalIdForClient(
+                resolvedTargetClientId,
+              )
+            : undefined,
+        rpcResolve: resolve,
+        rpcReject: reject,
+        timer,
         detachAbort,
+        metadata: { operation: input.operation, path: input.path },
       });
 
       try {
-        this.send({
-          ...input,
-          type: "host_file_request",
-          requestId,
+        broadcastMessage(
+          {
+            ...input,
+            type: "host_file_request",
+            requestId,
+            conversationId,
+            // Always include in message body so the receiving client can verify
+            // which endpoint was targeted (even when auto-resolved).
+            ...(resolvedTargetClientId != null
+              ? { targetClientId: resolvedTargetClientId }
+              : {}),
+          },
           conversationId,
-        });
+          { targetClientId: resolvedTargetClientId },
+        );
       } catch (err) {
-        clearTimeout(timer);
-        this.pending.delete(requestId);
-        detachAbort();
         pendingInteractions.resolve(requestId);
         log.warn(
           { requestId, operation: input.operation, err },
@@ -166,55 +220,61 @@ export class HostFileProxy {
     });
   }
 
+  /**
+   * Process a client result and resolve the RPC. Called by route handlers.
+   */
   resolve(
     requestId: string,
     response: { content: string; isError: boolean; imageData?: string },
   ): void {
-    const entry = this.pending.get(requestId);
-    if (!entry) {
+    const interaction = pendingInteractions.resolve(requestId);
+    if (!interaction?.rpcResolve) {
       log.warn({ requestId }, "No pending host file request for response");
       return;
     }
-    clearTimeout(entry.timer);
-    entry.detachAbort();
-    this.pending.delete(requestId);
+    const meta = interaction.metadata ?? {};
     if (
-      entry.operation === "read" &&
+      meta.operation === "read" &&
       !response.isError &&
       typeof response.imageData === "string" &&
       response.imageData.length > 0
     ) {
-      entry.resolve(readImageBase64(response.imageData, entry.path));
+      interaction.rpcResolve(
+        readImageBase64(response.imageData, meta.path as string),
+      );
       return;
     }
-    entry.resolve({ content: response.content, isError: response.isError });
-  }
-
-  hasPendingRequest(requestId: string): boolean {
-    return this.pending.has(requestId);
+    interaction.rpcResolve({
+      content: response.content,
+      isError: response.isError,
+    });
   }
 
   dispose(): void {
-    for (const [requestId, entry] of this.pending) {
-      clearTimeout(entry.timer);
-      entry.detachAbort();
-      pendingInteractions.resolve(requestId);
+    for (const entry of pendingInteractions.getByKind("host_file")) {
+      pendingInteractions.resolve(entry.requestId);
       try {
-        this.send({
-          type: "host_file_cancel",
-          requestId,
-          conversationId: entry.conversationId,
-        });
+        broadcastMessage(
+          {
+            type: "host_file_cancel",
+            requestId: entry.requestId,
+            conversationId: entry.conversationId,
+            ...(entry.targetClientId != null
+              ? { targetClientId: entry.targetClientId }
+              : {}),
+          },
+          entry.conversationId,
+          { targetClientId: entry.targetClientId as string | undefined },
+        );
       } catch {
-        // Best-effort cancel notification — connection may already be closed.
+        // Best-effort cancel notification
       }
-      entry.reject(
+      entry.rpcReject?.(
         new AssistantError(
           "Host file proxy disposed",
           ErrorCode.INTERNAL_ERROR,
         ),
       );
     }
-    this.pending.clear();
   }
 }

package/src/daemon/host-proxy-base.ts

@@ -0,0 +1,294 @@
+/**
+ * Shared lifecycle base for host-proxy classes (HostBashProxy, HostCuProxy,
+ * HostFileProxy, HostTransferProxy, HostBrowserProxy, ...).
+ *
+ * Each host proxy:
+ *  - dispatches a request to the desktop client via the assistant event hub,
+ *  - tracks the request in a pending map keyed by `requestId`,
+ *  - times the request out after a configurable interval,
+ *  - cancels the request when the caller's `AbortSignal` fires,
+ *  - rejects all pending requests on `dispose()`,
+ *  - exposes `isAvailable()` based on the connected client's capabilities.
+ *
+ * Subclasses keep proxy-specific concerns (envelope shape, observation
+ * formatting, per-proxy state like CU's step counter) out of the base.
+ */
+import { v4 as uuid } from "uuid";
+
+import type { HostProxyCapability } from "../channels/types.js";
+import {
+  assistantEventHub,
+  broadcastMessage,
+} from "../runtime/assistant-event-hub.js";
+import type { PendingInteraction } from "../runtime/pending-interactions.js";
+import * as pendingInteractions from "../runtime/pending-interactions.js";
+import { AssistantError, ErrorCode } from "../util/errors.js";
+import { getLogger } from "../util/logger.js";
+import type { ServerMessage } from "./message-protocol.js";
+
+const log = getLogger("host-proxy-base");
+
+/**
+ * `broadcastMessage` is statically typed against the discriminated
+ * `ServerMessage` union. The base class assembles envelopes from
+ * constructor-supplied event names and untyped extra fields, so static
+ * narrowing is impossible — subclasses are responsible for passing event
+ * names that match a real `ServerMessage` variant.
+ */
+function broadcastDynamic(
+  envelope: Record<string, unknown>,
+  targetClientId?: string,
+): void {
+  broadcastMessage(
+    envelope as unknown as ServerMessage,
+    undefined,
+    targetClientId ? { targetClientId } : undefined,
+  );
+}
+
+const DEFAULT_TIMEOUT_MS = 60_000;
+
+/** Reason a pending request was rejected by the base. */
+export type HostProxyRejectionReason = "timeout" | "aborted" | "disposed";
+
+/**
+ * Error thrown by the base when a pending request is rejected via the
+ * lifecycle paths (timeout, abort, dispose). Subclasses inspect `reason`
+ * to map back to their proxy-specific error / observation shape.
+ */
+export class HostProxyRequestError extends AssistantError {
+  constructor(
+    message: string,
+    public readonly reason: HostProxyRejectionReason,
+  ) {
+    super(message, ErrorCode.INTERNAL_ERROR);
+    this.name = "HostProxyRequestError";
+  }
+}
+
+interface PendingEntry<TResultPayload> {
+  resolve: (payload: TResultPayload) => void;
+  reject: (err: Error) => void;
+  timer: ReturnType<typeof setTimeout>;
+  conversationId: string;
+  targetClientId?: string;
+  /** Detach the abort listener from the caller's signal. No-op when no signal was passed. */
+  detachAbort: () => void;
+}
+
+export interface HostProxyBaseOptions {
+  /** Capability advertised by clients that can service this proxy. */
+  capabilityName: HostProxyCapability;
+  /** Outbound message `type` for new requests (e.g. `"host_cu_request"`). */
+  requestEventName: string;
+  /** Outbound message `type` for cancellation (e.g. `"host_cu_cancel"`). */
+  cancelEventName: string;
+  /** Tag used to identify this proxy's requests in `pendingInteractions`. */
+  resultPendingKind: PendingInteraction["kind"];
+  /** Per-request timeout. Defaults to 60s. */
+  timeoutMs?: number;
+  /** Customizable disposed-rejection message (used in test assertions). */
+  disposedMessage?: string;
+}
+
+export abstract class HostProxyBase<TRequest, TResultPayload> {
+  protected pending = new Map<string, PendingEntry<TResultPayload>>();
+
+  protected readonly capabilityName: HostProxyCapability;
+  protected readonly requestEventName: string;
+  protected readonly cancelEventName: string;
+  protected readonly resultPendingKind: PendingInteraction["kind"];
+  protected readonly timeoutMs: number;
+  protected readonly disposedMessage: string;
+
+  constructor(opts: HostProxyBaseOptions) {
+    this.capabilityName = opts.capabilityName;
+    this.requestEventName = opts.requestEventName;
+    this.cancelEventName = opts.cancelEventName;
+    this.resultPendingKind = opts.resultPendingKind;
+    this.timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    this.disposedMessage = opts.disposedMessage ?? "Host proxy disposed";
+  }
+
+  /**
+   * Whether a client advertising the configured capability is connected.
+   */
+  isAvailable(): boolean {
+    return (
+      assistantEventHub.getMostRecentClientByCapability(this.capabilityName) !=
+      null
+    );
+  }
+
+  /**
+   * Dispatch a request envelope to the connected client and return a
+   * promise that resolves when the client responds (via `resolve()`),
+   * rejects on timeout/abort/dispose, or rejects synchronously if the
+   * broadcast itself fails.
+   *
+   * `extraFields` is shallow-merged into the broadcast envelope so
+   * subclasses can include proxy-specific top-level fields (e.g. CU's
+   * `stepNumber` / `reasoning`) without nesting them inside `input`.
+   *
+   * Named `dispatchRequest` rather than `request` so subclasses are free to
+   * expose their own public `request(...)` with a proxy-specific signature
+   * (e.g. CU passes `stepNumber` and `reasoning` to its callers).
+   */
+  protected dispatchRequest(
+    toolName: string,
+    input: TRequest,
+    conversationId: string,
+    signal?: AbortSignal,
+    extraFields?: Record<string, unknown>,
+    targetClientId?: string,
+  ): Promise<TResultPayload> {
+    const requestId = uuid();
+
+    return new Promise<TResultPayload>((resolve, reject) => {
+      // Declared up-front so onAbort can close over a stable reference once
+      // it's wired below.
+      let detachAbort: () => void = () => {};
+
+      const timer = setTimeout(() => {
+        this.pending.delete(requestId);
+        detachAbort();
+        pendingInteractions.resolve(requestId);
+        log.warn(
+          { requestId, toolName, kind: this.resultPendingKind },
+          "Host proxy request timed out",
+        );
+        reject(new HostProxyRequestError("timeout", "timeout"));
+      }, this.timeoutMs);
+
+      if (signal) {
+        const onAbort = () => {
+          if (this.pending.has(requestId)) {
+            clearTimeout(timer);
+            this.pending.delete(requestId);
+            detachAbort();
+            pendingInteractions.resolve(requestId);
+            try {
+              broadcastDynamic(
+                {
+                  type: this.cancelEventName,
+                  requestId,
+                  conversationId,
+                  targetClientId,
+                },
+                targetClientId,
+              );
+            } catch {
+              // Best-effort cancel notification — connection may already be closed.
+            }
+            reject(new HostProxyRequestError("aborted", "aborted"));
+          }
+        };
+        signal.addEventListener("abort", onAbort, { once: true });
+        detachAbort = () => signal.removeEventListener("abort", onAbort);
+      }
+
+      this.pending.set(requestId, {
+        resolve,
+        reject,
+        timer,
+        conversationId,
+        targetClientId,
+        detachAbort,
+      });
+
+      // Register in the global pendingInteractions store so the result-route
+      // handler (e.g. POST /v1/host-app-control-result) can look up the
+      // request by id and route it back to this proxy. Without this the
+      // route silently drops the response — see host-app-control-routes.ts:
+      // `if (!peeked || peeked.kind !== "host_app_control") return ...`.
+      // (HostCuProxy bypasses dispatchRequest entirely with its own inline
+      //  request method that registers directly, which is why CU works
+      //  without this base-level fix.)
+      pendingInteractions.register(requestId, {
+        conversationId,
+        kind: this.resultPendingKind,
+        ...(targetClientId != null ? { targetClientId } : {}),
+      });
+
+      try {
+        broadcastDynamic(
+          {
+            type: this.requestEventName,
+            requestId,
+            conversationId,
+            toolName,
+            input,
+            targetClientId,
+            ...(extraFields ?? {}),
+          },
+          targetClientId,
+        );
+      } catch (err) {
+        clearTimeout(timer);
+        this.pending.delete(requestId);
+        detachAbort();
+        pendingInteractions.resolve(requestId);
+        log.warn(
+          { requestId, toolName, kind: this.resultPendingKind, err },
+          "Host proxy send failed",
+        );
+        reject(err instanceof Error ? err : new Error(String(err)));
+      }
+    });
+  }
+
+  /**
+   * Resolve a pending request with the client-provided payload. No-op when
+   * no entry is registered for `requestId` (late responses after timeout
+   * or abort fall through to here).
+   */
+  resolve(requestId: string, payload: TResultPayload): void {
+    const entry = this.pending.get(requestId);
+    if (!entry) {
+      log.warn(
+        { requestId, kind: this.resultPendingKind },
+        "No pending host proxy request for response",
+      );
+      return;
+    }
+    clearTimeout(entry.timer);
+    entry.detachAbort();
+    this.pending.delete(requestId);
+    entry.resolve(payload);
+  }
+
+  /**
+   * Whether `requestId` is still registered as pending. Useful to subclasses
+   * that need to reason about the lifecycle in tests.
+   */
+  hasPendingRequest(requestId: string): boolean {
+    return this.pending.has(requestId);
+  }
+
+  /**
+   * Reject every pending request and clear the map. Called during graceful
+   * shutdown or proxy teardown.
+   */
+  dispose(): void {
+    for (const [requestId, entry] of this.pending) {
+      clearTimeout(entry.timer);
+      entry.detachAbort();
+      pendingInteractions.resolve(requestId);
+      try {
+        broadcastDynamic(
+          {
+            type: this.cancelEventName,
+            requestId,
+            conversationId: entry.conversationId,
+            targetClientId: entry.targetClientId,
+          },
+          entry.targetClientId,
+        );
+      } catch {
+        // Best-effort cancel notification — connection may already be closed.
+      }
+      entry.reject(new HostProxyRequestError(this.disposedMessage, "disposed"));
+    }
+    this.pending.clear();
+  }
+}

package/src/daemon/host-proxy-preactivation.ts

@@ -0,0 +1,82 @@
+/**
+ * Shared host-proxy skill preactivation registry.
+ *
+ * Several call sites need to mark host-proxy-backed skills as preactivated
+ * for a turn whenever the source interface supports the corresponding
+ * `HostProxyCapability`:
+ *
+ *   - `runtime/routes/conversation-routes.ts` (create path, /v1/messages)
+ *   - `daemon/process-message.ts` (create path, prepareConversationForMessage)
+ *   - `daemon/conversation-process.ts` `drainSingleMessage` (re-add after dequeue)
+ *   - `daemon/conversation-process.ts` `drainBatch` (re-add after dequeue)
+ *
+ * The create paths additionally instantiate the proxy itself; that
+ * instantiation logic is per-proxy-class and stays inline at each create
+ * site (constructors take different argument shapes — `HostCuProxy()` vs
+ * `HostAppControlProxy(conversationId)`). This module owns only the
+ * capability-to-skill mapping and the preactivation step. Adding a new
+ * host-proxy-backed skill is a one-line registry change here instead of
+ * touching all four call sites.
+ *
+ * Why a registry instead of repeated branches: each new host-proxy-backed
+ * skill that ships (e.g. a future `host_focus` capability with a `focus`
+ * skill) would otherwise add four near-identical `if (supportsHostProxy(...))
+ * conversation.addPreactivatedSkillId("...")` blocks across these files.
+ * Centralizing the list makes the contract obvious and prevents drift
+ * where one call site re-adds a skill but another forgets to.
+ */
+
+import type { HostProxyCapability, InterfaceId } from "../channels/types.js";
+import { supportsHostProxy } from "../channels/types.js";
+
+/**
+ * Subset of Conversation/ProcessConversationContext that
+ * `preactivateHostProxySkills` needs. Both `Conversation` and
+ * `ProcessConversationContext` satisfy this structurally.
+ */
+export interface HostProxyPreactivationTarget {
+  addPreactivatedSkillId(id: string): void;
+}
+
+/**
+ * Registry mapping each host-proxy capability to the skill that must be
+ * preactivated when that capability is supported by the source interface.
+ *
+ * Keep this list in sync with `HostProxyCapability` for any capability that
+ * has a corresponding bundled skill.
+ *
+ * Capabilities NOT listed here:
+ *  - `host_bash`, `host_file` — these are surfaced as built-in tools rather
+ *    than skills, so there is nothing to preactivate.
+ *  - `host_browser` — the browser proxy is provisioned via the assistant
+ *    event hub for chrome-extension and its skill projection is governed by
+ *    a different code path (`host-browser-proxy.ts`).
+ */
+export const HOST_PROXY_SKILL_PREACTIVATIONS: ReadonlyArray<{
+  capability: HostProxyCapability;
+  skillId: string;
+}> = [
+  { capability: "host_cu", skillId: "computer-use" },
+  { capability: "host_app_control", skillId: "app-control" },
+];
+
+/**
+ * Preactivate every host-proxy-backed skill that the given source interface
+ * supports. No-op when `sourceInterface` is undefined.
+ *
+ * Callers are responsible for any additional gating (e.g. only preactivating
+ * when the conversation is idle vs. when re-adding after dequeue), since
+ * those constraints differ across create vs. drain paths. This helper just
+ * iterates the registry and dispatches.
+ */
+export function preactivateHostProxySkills(
+  conversation: HostProxyPreactivationTarget,
+  sourceInterface: InterfaceId | undefined,
+): void {
+  if (!sourceInterface) return;
+  for (const { capability, skillId } of HOST_PROXY_SKILL_PREACTIVATIONS) {
+    if (supportsHostProxy(sourceInterface, capability)) {
+      conversation.addPreactivatedSkillId(skillId);
+    }
+  }
+}