@vellumai/assistant 0.7.3 → 0.8.1

package/src/daemon/host-bash-proxy.ts

@@ -1,10 +1,5 @@
-import { v4 as uuid } from "uuid";
-
 import { getConfig } from "../config/loader.js";
-import {
-  assistantEventHub,
-  broadcastMessage,
-} from "../runtime/assistant-event-hub.js";
+import { assistantEventHub } from "../runtime/assistant-event-hub.js";
 import {
   ambiguousSameUserError,
   enforceSameActorOrErrorResult,
@@ -13,14 +8,42 @@ import {
 import * as pendingInteractions from "../runtime/pending-interactions.js";
 import { formatShellOutput } from "../tools/shared/shell-output.js";
 import type { ToolExecutionResult } from "../tools/types.js";
-import { AssistantError, ErrorCode } from "../util/errors.js";
 import { getLogger } from "../util/logger.js";
+import { HostProxyBase, HostProxyRequestError } from "./host-proxy-base.js";
 
 const log = getLogger("host-bash-proxy");
 
-export class HostBashProxy {
+export type HostBashInput = {
+  command: string;
+  working_dir?: string;
+  timeout_seconds?: number;
+  env?: Record<string, string>;
+  targetClientId?: string;
+};
+
+type HostBashResultPayload = {
+  stdout: string;
+  stderr: string;
+  exitCode: number | null;
+  timedOut: boolean;
+};
+
+export class HostBashProxy extends HostProxyBase<
+  Record<string, unknown>,
+  HostBashResultPayload
+> {
   private static _instance: HostBashProxy | null = null;
 
+  constructor() {
+    super({
+      capabilityName: "host_bash",
+      requestEventName: "host_bash_request",
+      cancelEventName: "host_bash_cancel",
+      resultPendingKind: "host_bash",
+      disposedMessage: "Host bash proxy disposed",
+    });
+  }
+
   /**
    * Lazily-initialized singleton. Availability of an actual desktop
    * connection is checked at send time via the assistant event hub,
@@ -47,31 +70,15 @@ export class HostBashProxy {
     HostBashProxy._instance = null;
   }
 
-  /**
-   * Whether a client with `host_bash` capability is connected.
-   */
-  isAvailable(): boolean {
-    return (
-      assistantEventHub.getMostRecentClientByCapability("host_bash") != null
-    );
-  }
-
-  request(
-    input: {
-      command: string;
-      working_dir?: string;
-      timeout_seconds?: number;
-      env?: Record<string, string>;
-      targetClientId?: string;
-    },
+  async request(
+    input: HostBashInput,
     conversationId: string,
     signal?: AbortSignal,
     // Principal ID of the actor on whose behalf this request is initiated.
     sourceActorPrincipalId?: string,
   ): Promise<ToolExecutionResult> {
     if (signal?.aborted) {
-      const result = formatShellOutput("", "Aborted", null, false, 0);
-      return Promise.resolve(result);
+      return formatShellOutput("", "Aborted", null, false, 0);
     }
 
     let resolvedTargetClientId: string | undefined;
@@ -79,10 +86,10 @@ export class HostBashProxy {
     if (input.targetClientId) {
       const target = assistantEventHub.getClientById(input.targetClientId);
       if (!target || !target.capabilities.includes("host_bash")) {
-        return Promise.resolve({
+        return {
           content: `Error: client "${input.targetClientId}" is not connected or does not support host_bash. Run \`assistant clients list --capability host_bash\` to see available clients.`,
           isError: true,
-        });
+        };
       }
       resolvedTargetClientId = input.targetClientId;
     } else {
@@ -97,7 +104,7 @@ export class HostBashProxy {
         sourceActorPrincipalId,
       });
       if (resolved.kind === "ambiguous") {
-        return Promise.resolve(ambiguousSameUserError("host_bash"));
+        return ambiguousSameUserError("host_bash");
       }
       resolvedTargetClientId =
         resolved.kind === "match" ? resolved.clientId : undefined;
@@ -114,98 +121,56 @@ export class HostBashProxy {
         targetClientId: resolvedTargetClientId,
         op: "host_bash",
       });
-      if (rejection) return Promise.resolve(rejection);
+      if (rejection) return rejection;
     }
 
-    const requestId = uuid();
-
-    return new Promise<ToolExecutionResult>((resolve, reject) => {
-      const shellMaxTimeoutSec = getConfig().timeouts.shellMaxTimeoutSec;
-      const timeoutSec = input.timeout_seconds ?? shellMaxTimeoutSec;
-      const proxyTimeoutSec = timeoutSec + 3;
-
-      let detachAbort: () => void = () => {};
-
-      const timer = setTimeout(() => {
-        pendingInteractions.resolve(requestId);
-        log.warn(
-          { requestId, command: input.command },
-          "Host bash proxy request timed out",
-        );
-        const timeoutMessage = resolvedTargetClientId
-          ? `Host bash proxy timed out waiting for response from client ${resolvedTargetClientId}`
-          : "Host bash proxy timed out waiting for client response";
-        resolve(formatShellOutput("", timeoutMessage, null, true, timeoutSec));
-      }, proxyTimeoutSec * 1000);
-
-      if (signal) {
-        const onAbort = () => {
-          if (pendingInteractions.get(requestId)) {
-            pendingInteractions.resolve(requestId);
-            try {
-              broadcastMessage(
-                {
-                  type: "host_bash_cancel",
-                  requestId,
-                  conversationId,
-                  targetClientId: resolvedTargetClientId,
-                },
-                conversationId,
-                { targetClientId: resolvedTargetClientId },
-              );
-            } catch {
-              // Best-effort cancel notification
-            }
-            resolve(formatShellOutput("", "Aborted", null, false, 0));
-          }
-        };
-        signal.addEventListener("abort", onAbort, { once: true });
-        detachAbort = () => signal.removeEventListener("abort", onAbort);
-      }
-
-      pendingInteractions.register(requestId, {
+    const shellMaxTimeoutSec = getConfig().timeouts.shellMaxTimeoutSec;
+    const timeoutSec = input.timeout_seconds ?? shellMaxTimeoutSec;
+    const proxyTimeoutMs = (timeoutSec + 3) * 1000;
+
+    // Spread command fields at the top level of the envelope so the desktop
+    // client receives the same flat message shape it has always expected.
+    const extraFields: Record<string, unknown> = { command: input.command };
+    if (input.working_dir !== undefined) extraFields.working_dir = input.working_dir;
+    if (input.timeout_seconds !== undefined)
+      extraFields.timeout_seconds = input.timeout_seconds;
+    if (input.env && Object.keys(input.env).length > 0) extraFields.env = input.env;
+
+    try {
+      const payload = await this.dispatchRequest(
+        "host_bash",
+        {},
         conversationId,
-        kind: "host_bash",
-        rpcResolve: resolve,
-        rpcReject: reject,
-        timer,
-        detachAbort,
-        targetClientId: resolvedTargetClientId,
-        targetActorPrincipalId:
-          resolvedTargetClientId != null
-            ? assistantEventHub.getActorPrincipalIdForClient(
-                resolvedTargetClientId,
-              )
-            : undefined,
-        metadata: { timeoutSec },
-      });
-
-      try {
-        broadcastMessage(
-          {
-            type: "host_bash_request",
-            requestId,
-            conversationId,
-            command: input.command,
-            working_dir: input.working_dir,
-            timeout_seconds: input.timeout_seconds,
-            targetClientId: resolvedTargetClientId,
-            ...(input.env && Object.keys(input.env).length > 0
-              ? { env: input.env }
-              : {}),
-          },
-          conversationId,
-          { targetClientId: resolvedTargetClientId },
-        );
-      } catch (err) {
-        pendingInteractions.resolve(requestId);
-        log.warn(
-          { requestId, command: input.command, err },
-          "Host bash proxy send failed",
-        );
-        reject(err instanceof Error ? err : new Error(String(err)));
+        signal,
+        extraFields,
+        resolvedTargetClientId,
+        proxyTimeoutMs,
+      );
+      return formatShellOutput(
+        payload.stdout,
+        payload.stderr,
+        payload.exitCode,
+        payload.timedOut,
+        timeoutSec,
+      );
+    } catch (err) {
+      if (err instanceof HostProxyRequestError) {
+        if (err.reason === "timeout") {
+          log.warn(
+            { command: input.command },
+            "Host bash proxy request timed out",
+          );
+          const msg = resolvedTargetClientId
+            ? `Host bash proxy timed out waiting for response from client ${resolvedTargetClientId}`
+            : "Host bash proxy timed out waiting for client response";
+          return formatShellOutput("", msg, null, true, timeoutSec);
+        }
+        if (err.reason === "aborted") {
+          return formatShellOutput("", "Aborted", null, false, 0);
+        }
       }
-    });
+      throw err;
+    }
   }
 
   /**
@@ -220,45 +185,7 @@ export class HostBashProxy {
       timedOut: boolean;
     },
   ): void {
-    const interaction = pendingInteractions.resolve(requestId);
-    if (!interaction?.rpcResolve) {
-      log.warn({ requestId }, "No pending host bash request for response");
-      return;
-    }
-    const timeoutSec = (interaction.metadata?.timeoutSec as number) ?? 0;
-    const result = formatShellOutput(
-      response.stdout,
-      response.stderr,
-      response.exitCode,
-      response.timedOut,
-      timeoutSec,
-    );
-    interaction.rpcResolve(result);
-  }
-
-  dispose(): void {
-    for (const entry of pendingInteractions.getByKind("host_bash")) {
-      pendingInteractions.resolve(entry.requestId);
-      try {
-        broadcastMessage(
-          {
-            type: "host_bash_cancel",
-            requestId: entry.requestId,
-            conversationId: entry.conversationId,
-            targetClientId: entry.targetClientId,
-          },
-          entry.conversationId,
-          { targetClientId: entry.targetClientId },
-        );
-      } catch {
-        // Best-effort cancel notification — connection may already be closed.
-      }
-      entry.rpcReject?.(
-        new AssistantError(
-          "Host bash proxy disposed",
-          ErrorCode.INTERNAL_ERROR,
-        ),
-      );
-    }
+    pendingInteractions.resolve(requestId);
+    this.resolve(requestId, response);
   }
 }

package/src/daemon/host-browser-proxy.ts

@@ -1,10 +1,10 @@
 import { v4 as uuid } from "uuid";
 
-import type { InterfaceId } from "../channels/types.js";
 import {
   assistantEventHub,
   broadcastMessage,
 } from "../runtime/assistant-event-hub.js";
+import { enforceSameActorOrErrorResult } from "../runtime/auth/same-actor.js";
 import * as pendingInteractions from "../runtime/pending-interactions.js";
 import type { ToolExecutionResult } from "../tools/types.js";
 import { AssistantError, ErrorCode } from "../util/errors.js";
@@ -24,11 +24,49 @@ export type HostBrowserInput = DistributiveOmit<
 
 const log = getLogger("host-browser-proxy");
 
-/** Interface priority order for host_browser: Chrome Extension first, macOS SSE bridge second. */
-const HOST_BROWSER_INTERFACE_PREFERENCE: InterfaceId[] = [
-  "chrome-extension",
-  "macos",
-];
+/**
+ * Pick the host_browser-capable client to dispatch to.
+ *
+ * When `targetClientId` is supplied, the client with that id is looked
+ * up directly in the `host_browser`-capable roster. The same-actor check
+ * in `request()` still runs on the returned client when
+ * `sourceActorPrincipalId` is present.
+ *
+ * When `sourceActorPrincipalId` is supplied (and no explicit target),
+ * candidate clients are filtered down to those owned by the same actor.
+ * Returns `undefined` when no same-actor client is connected; the
+ * caller surfaces this as the existing "no active extension connection"
+ * rejection.
+ *
+ * When neither is supplied (legacy callers without a resolved actor
+ * identity), falls through to the most-recently-active host_browser
+ * client so the registry singleton continues to work for single-client
+ * setups.
+ *
+ * Within each branch, ties are broken by `lastActiveAt` descending —
+ * the natural order returned by `listClientsByCapability`. Callers that
+ * need a specific transport (e.g. Chrome Extension's `chrome.debugger`
+ * over the macOS CDP bridge) must pass `targetClientId` explicitly via
+ * the LLM-facing param added in #30066.
+ */
+function resolveTargetClient(
+  sourceActorPrincipalId: string | undefined,
+  targetClientId?: string,
+) {
+  if (targetClientId != null) {
+    const clients = assistantEventHub.listClientsByCapability("host_browser");
+    return clients.find((c) => c.clientId === targetClientId);
+  }
+
+  const candidates =
+    assistantEventHub.listClientsByCapability("host_browser");
+  if (sourceActorPrincipalId == null) {
+    return candidates[0];
+  }
+  return candidates.find(
+    (c) => c.actorPrincipalId === sourceActorPrincipalId,
+  );
+}
 
 export class HostBrowserProxy {
   private static _instance: HostBrowserProxy | null = null;
@@ -67,10 +105,7 @@ export class HostBrowserProxy {
    */
   isAvailable(): boolean {
     return (
-      assistantEventHub.getPreferredClientByCapability(
-        "host_browser",
-        HOST_BROWSER_INTERFACE_PREFERENCE,
-      ) != null
+      assistantEventHub.getMostRecentClientByCapability("host_browser") != null
     );
   }
 
@@ -84,15 +119,64 @@ export class HostBrowserProxy {
     return assistantEventHub.listClientsByInterface("chrome-extension").length > 0;
   }
 
+  /**
+   * Send a host_browser request to the connected extension/macOS bridge.
+   *
+   * When `targetClientId` is supplied, the proxy dispatches to that specific
+   * client (subject to the `host_browser` capability check and the same-actor
+   * gate below). This mirrors the `target_client_id` pattern on `host_bash`,
+   * `host_file_*`, and `host_cu`.
+   *
+   * When `sourceActorPrincipalId` is supplied, the proxy refuses to dispatch
+   * to a client owned by a different actor — same-user enforcement is the
+   * authoritative gate against routing one actor's CDP request onto another
+   * actor's connected extension. The resolved target's `clientId` and
+   * `actorPrincipalId` are then persisted alongside the pending interaction
+   * so that the result-route's same-actor check can verify the submitting
+   * client at result time.
+   *
+   * When `sourceActorPrincipalId` is undefined (legacy/internal flows
+   * with no resolved actor identity), falls back to the most-recently-
+   * active host_browser client without an actor filter so the registry
+   * singleton continues to work for single-client setups.
+   */
   request(
     input: HostBrowserInput,
     conversationId: string,
     signal?: AbortSignal,
+    sourceActorPrincipalId?: string,
+    targetClientId?: string,
   ): Promise<ToolExecutionResult> {
     if (signal?.aborted) {
       return Promise.resolve({ content: "Aborted", isError: true });
     }
 
+    // Resolve the target client up front so we can persist the actor binding
+    // alongside the pending interaction registration. Same shape as
+    // host-cu-proxy: the result-route same-actor check compares the
+    // submitting client's actor against this captured value.
+    const preferredClient = resolveTargetClient(sourceActorPrincipalId, targetClientId);
+
+    // Same-user enforcement: when the caller's actor is known, refuse to
+    // dispatch to a client owned by a different actor. This covers the
+    // cross-client exposure case where a web/iOS turn for actor A would
+    // otherwise auto-resolve to actor B's connected extension.
+    if (
+      sourceActorPrincipalId != null &&
+      preferredClient != null &&
+      preferredClient.actorPrincipalId !== sourceActorPrincipalId
+    ) {
+      const rejection = enforceSameActorOrErrorResult({
+        hub: assistantEventHub,
+        sourceActorPrincipalId,
+        targetClientId: preferredClient.clientId,
+        op: "host_browser",
+      });
+      if (rejection) return Promise.resolve(rejection);
+    }
+
+    const resolvedClientId = preferredClient?.clientId;
+    const targetActorPrincipalId = preferredClient?.actorPrincipalId;
     const requestId = uuid();
 
     return new Promise<ToolExecutionResult>((resolve, reject) => {
@@ -135,17 +219,15 @@ export class HostBrowserProxy {
       pendingInteractions.register(requestId, {
         conversationId,
         kind: "host_browser",
-        rpcResolve: resolve,
+        targetClientId: resolvedClientId,
+        targetActorPrincipalId,
+        rpcResolve: resolve as (v: unknown) => void,
         rpcReject: reject,
         timer,
         detachAbort,
       });
 
       try {
-        const preferredClient = assistantEventHub.getPreferredClientByCapability(
-          "host_browser",
-          HOST_BROWSER_INTERFACE_PREFERENCE,
-        );
         if (!preferredClient) {
           pendingInteractions.resolve(requestId);
           reject(
@@ -172,27 +254,6 @@ export class HostBrowserProxy {
     });
   }
 
-  /**
-   * Process a client result and resolve the RPC. Called by route handlers.
-   */
-  resolveResult(
-    requestId: string,
-    response: { content: string; isError: boolean },
-  ): void {
-    const interaction = pendingInteractions.resolve(requestId);
-    if (!interaction?.rpcResolve) {
-      log.debug(
-        { requestId },
-        "Ignoring host_browser_result for unknown or already-resolved request",
-      );
-      return;
-    }
-    interaction.rpcResolve({
-      content: response.content,
-      isError: response.isError,
-    });
-  }
-
   dispose(): void {
     for (const entry of pendingInteractions.getByKind("host_browser")) {
       pendingInteractions.resolve(entry.requestId);

package/src/daemon/host-cu-proxy.ts

@@ -239,7 +239,7 @@ export class HostCuProxy {
           targetClientId != null
             ? assistantEventHub.getActorPrincipalIdForClient(targetClientId)
             : undefined,
-        rpcResolve: resolve,
+        rpcResolve: resolve as (v: unknown) => void,
         rpcReject: reject,
         timer,
         detachAbort,

package/src/daemon/host-file-proxy.ts

@@ -186,7 +186,7 @@ export class HostFileProxy {
                 resolvedTargetClientId,
               )
             : undefined,
-        rpcResolve: resolve,
+        rpcResolve: resolve as (v: unknown) => void,
         rpcReject: reject,
         timer,
         detachAbort,

package/src/daemon/host-proxy-base.ts

@@ -141,8 +141,10 @@ export abstract class HostProxyBase<TRequest, TResultPayload> {
     signal?: AbortSignal,
     extraFields?: Record<string, unknown>,
     targetClientId?: string,
+    timeoutMsOverride?: number,
   ): Promise<TResultPayload> {
     const requestId = uuid();
+    const effectiveTimeoutMs = timeoutMsOverride ?? this.timeoutMs;
 
     return new Promise<TResultPayload>((resolve, reject) => {
       // Declared up-front so onAbort can close over a stable reference once
@@ -158,7 +160,7 @@ export abstract class HostProxyBase<TRequest, TResultPayload> {
           "Host proxy request timed out",
         );
         reject(new HostProxyRequestError("timeout", "timeout"));
-      }, this.timeoutMs);
+      }, effectiveTimeoutMs);
 
       if (signal) {
         const onAbort = () => {
@@ -204,10 +206,20 @@ export abstract class HostProxyBase<TRequest, TResultPayload> {
       // (HostCuProxy bypasses dispatchRequest entirely with its own inline
       //  request method that registers directly, which is why CU works
       //  without this base-level fix.)
+      // Snapshot the target's actorPrincipalId at registration time so the
+      // result-route same-actor check has a stable value to compare against —
+      // the target client's SSE subscription may briefly disconnect between
+      // dispatch and result submission, which would make a live hub lookup
+      // falsely 403 a legitimate result.
+      const targetActorPrincipalId =
+        targetClientId != null
+          ? assistantEventHub.getActorPrincipalIdForClient(targetClientId)
+          : undefined;
       pendingInteractions.register(requestId, {
         conversationId,
         kind: this.resultPendingKind,
         ...(targetClientId != null ? { targetClientId } : {}),
+        ...(targetActorPrincipalId != null ? { targetActorPrincipalId } : {}),
       });
 
       try {

package/src/daemon/host-proxy-preactivation.ts

@@ -28,6 +28,7 @@
 
 import type { HostProxyCapability, InterfaceId } from "../channels/types.js";
 import { supportsHostProxy } from "../channels/types.js";
+import { assistantEventHub } from "../runtime/assistant-event-hub.js";
 
 /**
  * Subset of Conversation/ProcessConversationContext that
@@ -60,6 +61,29 @@ export const HOST_PROXY_SKILL_PREACTIVATIONS: ReadonlyArray<{
   { capability: "host_app_control", skillId: "app-control" },
 ];
 
+/**
+ * Returns true when a host-proxy for the given capability should be attached
+ * (instantiated and preactivated) for the current turn. Two cases qualify:
+ *
+ *  1. The source interface natively supports the capability (e.g. macOS → host_cu).
+ *  2. The source interface doesn't support the capability natively but at least
+ *     one connected client does — cross-client routing. `chrome-extension` is
+ *     excluded as a security boundary: it is its own executor context and cannot
+ *     broker cross-client routing to a macOS client.
+ *
+ * This is the single source of truth for both preactivation and proxy
+ * instantiation, so the two decisions stay in sync.
+ */
+export function shouldAttachHostProxyForCapability(
+  capability: HostProxyCapability,
+  sourceInterface: InterfaceId | undefined,
+): boolean {
+  if (!sourceInterface) return false;
+  if (supportsHostProxy(sourceInterface, capability)) return true;
+  if (sourceInterface === "chrome-extension") return false;
+  return assistantEventHub.listClientsByCapability(capability).length > 0;
+}
+
 /**
  * Preactivate every host-proxy-backed skill that the given source interface
  * supports. No-op when `sourceInterface` is undefined.
@@ -75,7 +99,7 @@ export function preactivateHostProxySkills(
 ): void {
   if (!sourceInterface) return;
   for (const { capability, skillId } of HOST_PROXY_SKILL_PREACTIVATIONS) {
-    if (supportsHostProxy(sourceInterface, capability)) {
+    if (shouldAttachHostProxyForCapability(capability, sourceInterface)) {
       conversation.addPreactivatedSkillId(skillId);
     }
   }

package/src/daemon/host-transfer-proxy.ts

@@ -273,7 +273,7 @@ export class HostTransferProxy {
                     resolvedTargetClientId,
                   )
                 : undefined,
-            rpcResolve: resolve,
+            rpcResolve: resolve as (v: unknown) => void,
             rpcReject: reject,
             timer,
             detachAbort,
@@ -462,7 +462,7 @@ export class HostTransferProxy {
                 resolvedTargetClientId,
               )
             : undefined,
-        rpcResolve: resolve,
+        rpcResolve: resolve as (v: unknown) => void,
         rpcReject: reject,
         timer,
         detachAbort,

package/src/daemon/identity-helpers.ts

@@ -1,4 +1,5 @@
 import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
 
 import { getWorkspacePromptPath } from "../util/platform.js";
 
@@ -14,3 +15,21 @@ export function getAssistantName(): string | null {
     return null;
   }
 }
+
+/**
+ * Read the guardian's display name from `users/default.md`. We look for the
+ * markdown-bold "Name" label (matching the IDENTITY.md convention) and fall
+ * back to `null` on any miss; callers substitute a generic label.
+ */
+export function resolveUserName(workspaceDir: string): string | null {
+  try {
+    const content = readFileSync(
+      join(workspaceDir, "users", "default.md"),
+      "utf-8",
+    );
+    const match = content.match(/\*\*Name:\*\*\s*(.+)/);
+    return match?.[1]?.trim() || null;
+  } catch {
+    return null;
+  }
+}