feat(macos): targetClientId acceptance guard and x-vellum-client-id headers for host_transfer

clients/macos/vellum-assistant/App/AppDelegate+ConnectionSetup.swift

@@ -446,6 +446,12 @@ extension AppDelegate {
                     self.hostBrowserExecutor.cancel(msg.requestId)
 
                 case .hostTransferRequest(let msg):
+                    let localClientId = DeviceIdStore.getOrCreate()
+                    let isLocalConversation = self.mainWindow?.conversationManager
+                        .conversations.contains(where: { $0.conversationId == msg.conversationId }) ?? false
+                    let isTargeted = msg.targetClientId == localClientId
+                    let isUntargetedLocal = msg.targetClientId == nil && isLocalConversation
+                    guard isTargeted || isUntargetedLocal else { break }
                     HostToolExecutor.executeHostTransferRequest(msg)
                 case .hostTransferCancel(let msg):
                     HostToolExecutor.cancelHostTransferRequest(msg.requestId)

clients/shared/Network/EventStreamClient.swift

@@ -634,6 +634,7 @@ public final class EventStreamClient {
             log.warning("Ignoring host_browser_request for non-local conversation \(msg.conversationId, privacy: .public)")
             return true
         case .hostTransferRequest(let msg):
+            if msg.targetClientId != nil { return false }   // pass through targeted requests
             if locallyOwnedConversationIds.contains(msg.conversationId) { return false }
             log.warning("Ignoring host_transfer_request for non-local conversation \(msg.conversationId, privacy: .public)")
             return true

clients/shared/Network/GatewayHTTPClient.swift

@@ -64,8 +64,8 @@ public enum GatewayHTTPClient {
     ///   - quiet: When `true`, suppresses HTTP request/response logging for this request.
     /// - Returns: A `Response` with the raw data and HTTP status code.
     /// - Throws: `ClientError` if the request cannot be constructed, or network errors from `URLSession`.
-    public static func get(path: String, params: [String: String]? = nil, timeout: TimeInterval = 30, quiet: Bool = false, unprefixed: Bool = false) async throws -> Response {
-        return try await executeWithRetry(path: path, params: params, method: "GET", timeout: timeout, quiet: quiet, unprefixed: unprefixed)
+    public static func get(path: String, params: [String: String]? = nil, timeout: TimeInterval = 30, quiet: Bool = false, unprefixed: Bool = false, extraHeaders: [String: String]? = nil) async throws -> Response {
+        return try await executeWithRetry(path: path, params: params, method: "GET", timeout: timeout, quiet: quiet, unprefixed: unprefixed, configure: extraHeaders.map { h in { req in for (k, v) in h { req.setValue(v, forHTTPHeaderField: k) } } })
     }
 
     /// Performs an authenticated GET request and decodes the JSON response into the given type.

clients/shared/Network/HostProxyClient.swift

@@ -136,6 +136,7 @@ public struct HostProxyClient: HostProxyClientProtocol {
             let response = try await GatewayHTTPClient.post(
                 path: "host-transfer-result",
                 body: body,
+                extraHeaders: ["X-Vellum-Client-Id": DeviceIdStore.getOrCreate()],
                 timeout: timeout
             )
             guard response.isSuccess else {
@@ -153,7 +154,8 @@ public struct HostProxyClient: HostProxyClientProtocol {
         // Use a generous timeout — large files may take a while to download.
         let response = try await GatewayHTTPClient.get(
             path: "transfers/\(transferId)/content",
-            timeout: 300
+            timeout: 300,
+            extraHeaders: ["X-Vellum-Client-Id": DeviceIdStore.getOrCreate()]
         )
         guard response.isSuccess else {
             throw TransferError.pullFailed(statusCode: response.statusCode)
@@ -169,7 +171,7 @@ public struct HostProxyClient: HostProxyClientProtocol {
             body: data,
             params: ["sourcePath": sourcePath],
             contentType: "application/octet-stream",
-            extraHeaders: ["X-Transfer-SHA256": sha256],
+            extraHeaders: ["X-Transfer-SHA256": sha256, "X-Vellum-Client-Id": DeviceIdStore.getOrCreate()],
             timeout: timeout
         )
         guard response.isSuccess else {

clients/shared/Network/MessageTypes.swift

@@ -2044,11 +2044,15 @@ public struct HostTransferRequest: Decodable, Sendable {
     public let sizeBytes: Int?
     public let sha256: String?
     public let overwrite: Bool?
+    /// When set, this request is targeted at a specific client ID. Non-nil only for
+    /// cross-client proxy requests routed through HostTransferProxy.
+    public let targetClientId: String?
 
     private enum CodingKeys: String, CodingKey {
         case type, requestId, conversationId, direction
         case transferId, destPath, sourcePath, sizeBytes
         case sha256, overwrite
+        case targetClientId
     }
 }