@vellumai/assistant 0.8.10 → 0.8.11-staging.1

package/src/telemetry/usage-telemetry-reporter.ts

@@ -23,8 +23,11 @@ import {
 import { queryUnreportedLifecycleEvents } from "../memory/lifecycle-events-store.js";
 import { queryUnreportedUsageEvents } from "../memory/llm-usage-store.js";
 import { queryUnreportedOnboardingEvents } from "../memory/onboarding-events-store.js";
+import { queryUnreportedSkillLoadedEvents } from "../memory/skill-loaded-events-store.js";
+import { queryUnreportedToolExecutedEvents } from "../memory/tool-executed-events-store.js";
 import { queryUnreportedTurnEvents } from "../memory/turn-events-store.js";
 import { VellumPlatformClient } from "../platform/client.js";
+import type { UsageAttributionProfileSource } from "../usage/types.js";
 import { getDeviceId } from "../util/device-id.js";
 import { getLogger } from "../util/logger.js";
 import { APP_VERSION } from "../version.js";
@@ -56,6 +59,39 @@ const CHECKPOINT_KEY_AUTH_FALLBACK_WATERMARK =
   "telemetry:auth_fallback:last_reported_at";
 const CHECKPOINT_KEY_AUTH_FALLBACK_WATERMARK_ID =
   "telemetry:auth_fallback:last_reported_id";
+const CHECKPOINT_KEY_TOOL_EXECUTED_WATERMARK =
+  "telemetry:tool_executed:last_reported_at";
+const CHECKPOINT_KEY_TOOL_EXECUTED_WATERMARK_ID =
+  "telemetry:tool_executed:last_reported_id";
+const CHECKPOINT_KEY_SKILL_LOADED_WATERMARK =
+  "telemetry:skill_loaded:last_reported_at";
+const CHECKPOINT_KEY_SKILL_LOADED_WATERMARK_ID =
+  "telemetry:skill_loaded:last_reported_id";
+// Written into the `*_id` watermark checkpoints by the opt-out flush branch.
+// Sorts lexicographically above every real row ID (all event stores generate
+// lowercase v4 UUIDs), so the compound cursor's same-millisecond arm
+// (`createdAt == watermark AND id > afterId`) can never match an opt-out row.
+const OPT_OUT_WATERMARK_ID_SENTINEL = "ffffffff-ffff-ffff-ffff-ffffffffffff";
+// (timestamp, id) checkpoint-key pairs for every event type's compound
+// cursor — keep in sync when adding an event type.
+const WATERMARK_KEY_PAIRS: ReadonlyArray<readonly [string, string]> = [
+  [CHECKPOINT_KEY_WATERMARK, CHECKPOINT_KEY_WATERMARK_ID],
+  [CHECKPOINT_KEY_TURN_WATERMARK, CHECKPOINT_KEY_TURN_WATERMARK_ID],
+  [CHECKPOINT_KEY_LIFECYCLE_WATERMARK, CHECKPOINT_KEY_LIFECYCLE_WATERMARK_ID],
+  [CHECKPOINT_KEY_ONBOARDING_WATERMARK, CHECKPOINT_KEY_ONBOARDING_WATERMARK_ID],
+  [
+    CHECKPOINT_KEY_AUTH_FALLBACK_WATERMARK,
+    CHECKPOINT_KEY_AUTH_FALLBACK_WATERMARK_ID,
+  ],
+  [
+    CHECKPOINT_KEY_TOOL_EXECUTED_WATERMARK,
+    CHECKPOINT_KEY_TOOL_EXECUTED_WATERMARK_ID,
+  ],
+  [
+    CHECKPOINT_KEY_SKILL_LOADED_WATERMARK,
+    CHECKPOINT_KEY_SKILL_LOADED_WATERMARK_ID,
+  ],
+];
 const REPORT_INTERVAL_MS = 5 * 60 * 1000;
 const INITIAL_FLUSH_DELAY_MS = 30_000; // Delay first flush to let CES handshake complete
 const BATCH_SIZE = 500;
@@ -87,6 +123,41 @@ export class UsageTelemetryReporter {
   private timer: ReturnType<typeof setInterval> | null = null;
   private activeFlush: Promise<void> | null = null;
 
+  constructor() {
+    // `tool_invocations` is an always-on audit table that predates this
+    // reporter shipping its rows: an absent watermark means no flush (opted
+    // in or out) has ever advanced it, so rows recorded before this build —
+    // including any opted-out period under older builds that gated the
+    // reporter on collectUsageData — would otherwise ship retroactively.
+    // Initialize an absent watermark to "now" at construction. Construction
+    // happens during daemon startup before any tool runs, so no legitimate
+    // row falls behind the watermark — initializing at first FLUSH instead
+    // would drop tools used during the 30s+ flush delay. The checkpoint is
+    // persisted immediately so a crash before the first flush can't leave it
+    // absent and re-initialize later. An EXISTING watermark is never touched:
+    // opted-out sessions keep it advancing via the opt-out flush branch, and
+    // overwriting it here would drop a legitimate unshipped backlog.
+    // `skill_loaded` needs no init: recording is gated on collectUsageData,
+    // so opt-out rows never exist and its standard 0 default is safe.
+    //
+    // Best-effort: DB init failures are tolerated at daemon startup (degraded
+    // mode), so this must never throw out of the constructor — matching
+    // flush(), which treats DB errors as non-fatal.
+    try {
+      if (getMemoryCheckpoint(CHECKPOINT_KEY_TOOL_EXECUTED_WATERMARK) == null) {
+        setMemoryCheckpoint(
+          CHECKPOINT_KEY_TOOL_EXECUTED_WATERMARK,
+          String(Date.now()),
+        );
+      }
+    } catch (err) {
+      log.warn(
+        { err },
+        "tool_executed watermark init failed at construction — non-fatal; a later construction with a working DB re-runs the absent-checkpoint init",
+      );
+    }
+  }
+
   start(): void {
     // Delay the first flush to allow the credential infrastructure (CES
     // handshake) to complete. Without this delay, VellumPlatformClient.create()
@@ -134,21 +205,35 @@ export class UsageTelemetryReporter {
     try {
       if (batchCount >= MAX_CONSECUTIVE_BATCHES) return;
 
-      // Respect runtime opt-out: if the user has disabled usage data collection,
-      // skip the flush and advance watermarks so events recorded during the
-      // opt-out window are never sent retroactively.
+      // Respect opt-out: if the user has disabled usage data collection, skip
+      // the flush and advance watermarks so events recorded during the
+      // opt-out window are never sent retroactively. The daemon runs the
+      // reporter even when opted out specifically so this branch keeps
+      // executing — every cycle plus the final flush in stop() — which is
+      // what lets a later opt-in (runtime or via restart) resume from a
+      // watermark that already covers the opt-out window. One caveat: a
+      // RUNTIME false→true flip can still ship up to one flush interval
+      // (≤5 min) of pre-toggle rows recorded since the last opted-out flush;
+      // the restart path is fully covered by the final flush in stop(). The
+      // caveat applies to the always-on tables without a write-time opt-out
+      // gate (llm_usage, turn events) and to tool_invocations rows recorded
+      // under builds predating the audit listener's write-time gate — new
+      // opted-out tool_invocations rows persist NULL telemetry columns and
+      // are unreportable by construction regardless of watermark timing.
       if (!getConfig().collectUsageData) {
-        // Advance only the timestamp watermarks. Leave the ID watermarks
-        // untouched so the compound-cursor branch stays active — setting them
-        // to "" would make the truthy check fail, falling back to a
-        // timestamp-only `gt(createdAt, watermark)` query that silently drops
-        // events created in the same millisecond as the opt-out watermark.
+        // Advance the timestamp watermarks and pin the ID watermarks to a
+        // sentinel that sorts above any real UUID. The sentinel (rather than
+        // "") keeps the compound-cursor branch active — a falsy ID would
+        // downgrade the query to a timestamp-only `gt(createdAt, watermark)`
+        // — while making its same-millisecond arm unsatisfiable, so a row
+        // written in the same millisecond as this flush's Date.now() can
+        // never ship after a later opt-in. The next opted-in flush that
+        // ships events overwrites the sentinel with a real row ID.
         const now = String(Date.now());
-        setMemoryCheckpoint(CHECKPOINT_KEY_WATERMARK, now);
-        setMemoryCheckpoint(CHECKPOINT_KEY_TURN_WATERMARK, now);
-        setMemoryCheckpoint(CHECKPOINT_KEY_LIFECYCLE_WATERMARK, now);
-        setMemoryCheckpoint(CHECKPOINT_KEY_ONBOARDING_WATERMARK, now);
-        setMemoryCheckpoint(CHECKPOINT_KEY_AUTH_FALLBACK_WATERMARK, now);
+        for (const [timestampKey, idKey] of WATERMARK_KEY_PAIRS) {
+          setMemoryCheckpoint(timestampKey, now);
+          setMemoryCheckpoint(idKey, OPT_OUT_WATERMARK_ID_SENTINEL);
+        }
         return;
       }
 
@@ -189,6 +274,27 @@ export class UsageTelemetryReporter {
         getMemoryCheckpoint(CHECKPOINT_KEY_AUTH_FALLBACK_WATERMARK_ID) ??
         undefined;
 
+      // Read tool-executed watermark (compound cursor: createdAt + id).
+      // An absent checkpoint was initialized to construction time (see the
+      // constructor), guarding opt-out windows; the 0 fallback here is a
+      // defensive default matching the other event types. Legacy rows are
+      // excluded at the query level (see queryUnreportedToolExecutedEvents).
+      const toolExecutedWatermark = Number(
+        getMemoryCheckpoint(CHECKPOINT_KEY_TOOL_EXECUTED_WATERMARK) ?? "0",
+      );
+      const toolExecutedWatermarkId =
+        getMemoryCheckpoint(CHECKPOINT_KEY_TOOL_EXECUTED_WATERMARK_ID) ??
+        undefined;
+
+      // Read skill-loaded watermark (compound cursor: createdAt + id).
+      // Brand-new table, so the standard 0 default is safe.
+      const skillLoadedWatermark = Number(
+        getMemoryCheckpoint(CHECKPOINT_KEY_SKILL_LOADED_WATERMARK) ?? "0",
+      );
+      const skillLoadedWatermarkId =
+        getMemoryCheckpoint(CHECKPOINT_KEY_SKILL_LOADED_WATERMARK_ID) ??
+        undefined;
+
       // Query unreported events
       const events = queryUnreportedUsageEvents(
         watermark,
@@ -215,13 +321,25 @@ export class UsageTelemetryReporter {
         authFallbackWatermarkId,
         BATCH_SIZE,
       );
+      const toolExecutedEvents = queryUnreportedToolExecutedEvents(
+        toolExecutedWatermark,
+        toolExecutedWatermarkId,
+        BATCH_SIZE,
+      );
+      const skillLoadedEvents = queryUnreportedSkillLoadedEvents(
+        skillLoadedWatermark,
+        skillLoadedWatermarkId,
+        BATCH_SIZE,
+      );
 
       if (
         events.length === 0 &&
         turnEvents.length === 0 &&
         lifecycleEvents.length === 0 &&
         onboardingEvents.length === 0 &&
-        authFallbackEvents.length === 0
+        authFallbackEvents.length === 0 &&
+        toolExecutedEvents.length === 0 &&
+        skillLoadedEvents.length === 0
       )
         return;
 
@@ -236,6 +354,8 @@ export class UsageTelemetryReporter {
           lifecycleCount: lifecycleEvents.length,
           onboardingCount: onboardingEvents.length,
           authFallbackCount: authFallbackEvents.length,
+          toolExecutedCount: toolExecutedEvents.length,
+          skillLoadedCount: skillLoadedEvents.length,
         },
         "Telemetry flush: resolved auth context",
       );
@@ -375,11 +495,11 @@ export class UsageTelemetryReporter {
             ...(e.stepIndex != null ? { step_index: e.stepIndex } : {}),
             ...(e.completedAt ? { completed_at: e.completedAt } : {}),
             ...(e.funnelVersion ? { funnel_version: e.funnelVersion } : {}),
-            // Onboarding events fall back to the envelope `assistant_version`
-            // — same upload-time attribution risk as before this PR. Adding
-            // the record-time column to `onboarding_events` (#30733) is a
-            // separate follow-up that mirrors what this PR does for
-            // `llm_usage_events`.
+            // Onboarding events fall back to the envelope `assistant_version`,
+            // so events recorded under an older build are attributed to the
+            // version running at upload time. Adding a record-time column to
+            // `onboarding_events` (mirroring `llm_usage_events`) is a known
+            // follow-up.
             assistant_version: APP_VERSION,
           }),
         ),
@@ -402,6 +522,50 @@ export class UsageTelemetryReporter {
             assistant_version: APP_VERSION,
           }),
         ),
+        ...toolExecutedEvents.map(
+          (e): TelemetryEvent => ({
+            type: "tool_executed",
+            daemon_event_id: e.id,
+            recorded_at: e.createdAt,
+            tool_name: e.toolName,
+            // The store filters out permission-denied rows, so the only
+            // non-success decision that reaches here is "error".
+            status: e.decision === "error" ? "errored" : "fulfilled",
+            duration_ms: e.durationMs,
+            arg_bytes: e.argBytes,
+            result_bytes: e.resultBytes,
+            conversation_id: e.conversationId,
+            provider: e.provider,
+            model: e.model,
+            inference_profile: e.inferenceProfile,
+            inference_profile_source:
+              e.inferenceProfileSource as UsageAttributionProfileSource | null,
+            // `tool_invocations` has no record-time version column — stamp
+            // the running binary's `APP_VERSION` so the wire value is
+            // concrete rather than an explicit null that would override the
+            // envelope under the platform's per-event-wins contract.
+            assistant_version: APP_VERSION,
+          }),
+        ),
+        ...skillLoadedEvents.map(
+          (e): TelemetryEvent => ({
+            type: "skill_loaded",
+            daemon_event_id: e.id,
+            recorded_at: e.createdAt,
+            skill_name: e.skillName,
+            skill_updated_at: e.skillUpdatedAt,
+            conversation_id: e.conversationId,
+            provider: e.provider,
+            model: e.model,
+            inference_profile: e.inferenceProfile,
+            inference_profile_source:
+              e.inferenceProfileSource as UsageAttributionProfileSource | null,
+            // `skill_loaded_events` has no record-time version column — same
+            // upload-time APP_VERSION stamping as the other non-llm_usage
+            // event types.
+            assistant_version: APP_VERSION,
+          }),
+        ),
       ];
 
       const organizationId = getPlatformOrganizationId() || undefined;
@@ -501,13 +665,42 @@ export class UsageTelemetryReporter {
         );
       }
 
+      // Advance tool-executed watermark (compound cursor)
+      if (toolExecutedEvents.length > 0) {
+        const lastToolExecuted =
+          toolExecutedEvents[toolExecutedEvents.length - 1];
+        setMemoryCheckpoint(
+          CHECKPOINT_KEY_TOOL_EXECUTED_WATERMARK,
+          String(lastToolExecuted.createdAt),
+        );
+        setMemoryCheckpoint(
+          CHECKPOINT_KEY_TOOL_EXECUTED_WATERMARK_ID,
+          lastToolExecuted.id,
+        );
+      }
+
+      // Advance skill-loaded watermark (compound cursor)
+      if (skillLoadedEvents.length > 0) {
+        const lastSkillLoaded = skillLoadedEvents[skillLoadedEvents.length - 1];
+        setMemoryCheckpoint(
+          CHECKPOINT_KEY_SKILL_LOADED_WATERMARK,
+          String(lastSkillLoaded.createdAt),
+        );
+        setMemoryCheckpoint(
+          CHECKPOINT_KEY_SKILL_LOADED_WATERMARK_ID,
+          lastSkillLoaded.id,
+        );
+      }
+
       // If we got a full batch of any type, there may be more — recurse
       if (
         events.length === BATCH_SIZE ||
         turnEvents.length === BATCH_SIZE ||
         lifecycleEvents.length === BATCH_SIZE ||
         onboardingEvents.length === BATCH_SIZE ||
-        authFallbackEvents.length === BATCH_SIZE
+        authFallbackEvents.length === BATCH_SIZE ||
+        toolExecutedEvents.length === BATCH_SIZE ||
+        skillLoadedEvents.length === BATCH_SIZE
       ) {
         await this._doFlush(batchCount + 1);
       }

package/src/tools/browser/__tests__/browser-execution-acquire.test.ts

@@ -11,14 +11,15 @@ import { beforeEach, describe, expect, mock, test } from "bun:test";
 
 import { createMockLoggerModule } from "../../../__tests__/helpers/mock-logger.js";
 import type { ToolContext } from "../../types.js";
-import type { BrowserMode, CdpClientKind } from "../cdp-client/types.js";
+import { CdpError } from "../cdp-client/errors.js";
+import type { CdpClientKind, InternalBrowserMode } from "../cdp-client/types.js";
 
 // ---------------------------------------------------------------------------
 // Captured call state
 // ---------------------------------------------------------------------------
 
 interface CdpClientCallOpts {
-  mode?: BrowserMode;
+  mode?: InternalBrowserMode;
   targetClientId?: string;
 }
 
@@ -197,4 +198,50 @@ describe("acquireCdpClientWithMode: target_client_id overrides sticky backend mo
     expect(getCdpClientCalls[0].mode).toBe("extension");
     expect(getCdpClientCalls[0].targetClientId).toBe("host-client-fresh");
   });
+
+  test("sticky host-bridge + no target_client_id → getCdpClient receives mode:host-bridge", async () => {
+    // A prior turn succeeded on the desktop SSE bridge; the memo holds the
+    // internal-only "host-bridge" kind and must round-trip through the
+    // factory's pinned path.
+    stickyKind = "host-bridge";
+
+    await executeBrowserAttach({}, makeContext("sticky-bridge-honored"));
+
+    expect(getCdpClientMock).toHaveBeenCalledTimes(1);
+    expect(getCdpClientCalls[0].mode).toBe("host-bridge");
+  });
+
+  test("sticky host-bridge + target_client_id → getCdpClient receives mode:extension", async () => {
+    stickyKind = "host-bridge";
+
+    await executeBrowserAttach(
+      { target_client_id: "host-client-bridge" },
+      makeContext("sticky-bridge-override"),
+    );
+
+    expect(getCdpClientMock).toHaveBeenCalledTimes(1);
+    expect(getCdpClientCalls[0].mode).toBe("extension");
+    expect(getCdpClientCalls[0].targetClientId).toBe("host-client-bridge");
+  });
+
+  test("sticky host-bridge gone → memo cleared and auto retry runs", async () => {
+    // The pinned host-bridge build throws (bridge disconnected or an
+    // extension connected since the memo was written); the acquire layer
+    // must clear the stale memo and retry with fresh auto selection.
+    stickyKind = "host-bridge";
+    getCdpClientMock.mockImplementationOnce(() => {
+      getCdpClientCalls.push({ mode: "host-bridge" });
+      throw new CdpError(
+        "transport_error",
+        'Pinned mode "host-bridge" unavailable: a Chrome Extension is now connected',
+      );
+    });
+
+    await executeBrowserAttach({}, makeContext("sticky-bridge-fallback"));
+
+    expect(getCdpClientMock).toHaveBeenCalledTimes(2);
+    expect(getCdpClientCalls[0].mode).toBe("host-bridge");
+    expect(getCdpClientCalls[1].mode).toBe("auto");
+    expect(clearPreferredBackendKindMock).toHaveBeenCalledTimes(1);
+  });
 });

package/src/tools/browser/__tests__/browser-status.test.ts

@@ -20,11 +20,13 @@ const probeErrors: Record<string, CdpError | null> = {
   [BROWSER_STATUS_MODE.LOCAL]: null,
 };
 
-const buildCandidateListMock = mock((_context: ToolContext) => [
-  { kind: BROWSER_STATUS_MODE.EXTENSION, reason: "mock" },
-  { kind: BROWSER_STATUS_MODE.CDP_INSPECT, reason: "mock" },
-  { kind: BROWSER_STATUS_MODE.LOCAL, reason: "mock" },
-]);
+const buildCandidateListMock = mock(
+  (_context: ToolContext): Array<{ kind: string; reason: string }> => [
+    { kind: BROWSER_STATUS_MODE.EXTENSION, reason: "mock" },
+    { kind: BROWSER_STATUS_MODE.CDP_INSPECT, reason: "mock" },
+    { kind: BROWSER_STATUS_MODE.LOCAL, reason: "mock" },
+  ],
+);
 
 const getCdpClientMock = mock(
   (_context: ToolContext, options?: { mode?: string }) => {
@@ -254,6 +256,28 @@ describe("executeBrowserStatus", () => {
     expect(payload.recommendedMode).toBe(BROWSER_STATUS_MODE.CDP_INSPECT);
   });
 
+  test("host-bridge auto candidate is reported but never recommended as a status mode", async () => {
+    // Bridge-only scenario: the auto candidate list leads with host-bridge,
+    // which is not a pinnable status mode — recommendation must fall to the
+    // first candidate that IS a checkable mode.
+    mockSingletonProxy = {
+      isAvailable: () => true,
+      hasExtensionClient: () => false,
+      request: () => {},
+    };
+    buildCandidateListMock.mockImplementationOnce((_context: ToolContext) => [
+      { kind: "host-bridge", reason: "mock bridge" },
+      { kind: BROWSER_STATUS_MODE.CDP_INSPECT, reason: "mock" },
+      { kind: BROWSER_STATUS_MODE.LOCAL, reason: "mock" },
+    ]);
+
+    const result = await executeBrowserStatus({}, makeContext());
+    expect(result.isError).toBe(false);
+    const payload = JSON.parse(result.content);
+    expect(payload.autoCandidateOrder[0]).toBe("host-bridge");
+    expect(payload.recommendedMode).toBe(BROWSER_STATUS_MODE.CDP_INSPECT);
+  });
+
   test("restricted chrome:// page probe includes transport details", async () => {
     mockSingletonProxy = { isAvailable: () => true, hasExtensionClient: () => true, request: () => {} };
     probeOutcomes[BROWSER_STATUS_MODE.EXTENSION] = "fail";

package/src/tools/browser/browser-execution.ts

@@ -70,6 +70,7 @@ import type {
   AttemptDiagnostic,
   CdpClient,
   CdpClientKind,
+  InternalBrowserMode,
 } from "./cdp-client/types.js";
 import { clearPinnedTab, setPinnedTab } from "./pinned-tabs.js";
 import { checkBrowserRuntime } from "./runtime-check.js";
@@ -227,6 +228,18 @@ const REMEDIATION_HINTS: Record<string, string[]> = {
     "Verify the configured host:port matches Chrome's DevTools listener.",
     "Consider using browser_mode: 'extension' or 'local' as an alternative.",
   ],
+  // Host-bridge backend (desktop SSE bridge → user's Chrome debug port)
+  "host-bridge:unreachable": [
+    "Ensure Chrome on the user's machine is on version 146 or higher (chrome://settings/help).",
+    'Ensure "Allow remote debugging for this browser instance" is toggled on at chrome://inspect/#remote-debugging.',
+    "Verify the desktop client is running and has an active SSE connection to the assistant.",
+    "Installing the Vellum Chrome extension is the preferred path and avoids the debug-port requirement.",
+  ],
+  "host-bridge:transport_error": [
+    "The desktop client could not reach Chrome's remote-debugging endpoint on the user's machine.",
+    "Ensure Chrome is running with remote debugging enabled, or install the Vellum Chrome extension (preferred).",
+    "Verify the desktop client is running and connected.",
+  ],
   // Local/Playwright backend
   "local:transport_error": [
     "The local Playwright-managed browser failed to start or connect.",
@@ -390,7 +403,9 @@ function acquireCdpClientWithMode(
   );
   // target_client_id requires the extension proxy path — bypass any sticky
   // backend remembered from prior turns so the explicit target always wins.
-  const effectiveMode: BrowserMode =
+  // InternalBrowserMode because the memo may hold "host-bridge", which is
+  // pinnable by the factory but never user-requestable.
+  const effectiveMode: InternalBrowserMode =
     targetClientId != null
       ? "extension"
       : browserMode === "auto" && rememberedKind !== null
@@ -1383,14 +1398,17 @@ export async function executeBrowserClose(
       };
     }
 
-    // Extension path: the user owns their Chrome tab — we must not
-    // close it. Detach the debugger (so the Chrome debugging banner
-    // clears promptly) and drop the cached snapshot state so stale
+    // Non-local path: the user owns their Chrome tab — we must not
+    // close it. On the extension backend, detach the debugger (so the
+    // Chrome debugging banner clears promptly); other backends have no
+    // Vellum.detach. Either way drop the cached snapshot state so stale
     // eids from prior snapshots cannot be resolved by later tool calls.
-    try {
-      await cdp.send("Vellum.detach", {}, context.signal);
-    } catch {
-      // Tolerate detach failures (already detached, tab closed, etc.)
+    if (cdp.kind === "extension") {
+      try {
+        await cdp.send("Vellum.detach", {}, context.signal);
+      } catch {
+        // Tolerate detach failures (already detached, tab closed, etc.)
+      }
     }
     browserManager.clearSnapshotBackendNodeMap(context.conversationId);
     browserManager.clearPreferredBackendKind(context.conversationId);
@@ -2382,7 +2400,7 @@ async function checkExtensionModeStatus(
 ): Promise<BrowserStatusModeResult> {
   const proxy = HostBrowserProxy.instance;
 
-  if (!proxy.hasExtensionClient()) {
+  if (!proxy.hasExtensionClient(context.sourceActorPrincipalId)) {
     return {
       mode: BROWSER_STATUS_MODE.EXTENSION,
       available: false,