@agent-sh/computer-use-linux 0.7.16 → 0.7.17

package/README.md

@@ -473,6 +473,8 @@ files.
 - **DBus where desktops expose it** — [`zbus`](https://crates.io/crates/zbus) for portal calls (`org.freedesktop.portal.Screenshot`, `…RemoteDesktop`, `…ScreenCast`), GNOME Shell screenshots (`org.gnome.Shell.Screenshot`), the bundled GNOME extension's `dev.avifenesh.ComputerUseLinux.WindowControl` service, and temporary KWin scripting.
 - **MCP transport** — [`rmcp`](https://crates.io/crates/rmcp) with the `transport-io` feature; stdio framing, no network.
 - **Input fallback** — on X11, keyboard input prefers `xdotool`/XTEST and falls back only when xdotool cannot launch. On Wayland, literal text uses `wtype` when installed and the remote-desktop portal is unavailable; `wtype` supports Unicode through the virtual-keyboard protocol on compatible compositors such as Hyprland/wlroots. If wtype is unavailable, the binary falls back to a compatible ydotool 1.0.3+ CLI and `ydotoold` socket. A launched wtype failure is returned without replaying the text. `install.sh` can configure `ydotoold`; the `setup` command only enables the GNOME AT-SPI bridge.
+- **Hyprland/Electron text** — for classified nonsecret fields on Hyprland, wtype passes one literal argument after `--` to avoid stdin keymap-refresh corruption. Argument text is visible in process listings; confirmed password fields are rejected. Terminals and ambiguous fields (with or without AT-SPI) use private stdin for at most 100 Unicode characters per call; split larger input into smaller calls or expose accessibility. The input probe has its own 1.5-second budget; the 250 ms indicator probe only masks text. Other compatible compositors retain their existing stdin path. NUL and text over 131,071 UTF-8 bytes are rejected before focus or indicators. Success confirms dispatch only; re-observe the field before retrying.
+- **Limited accessibility feedback** — when exact window focus was verified before input but AT-SPI reports no focused element, the result describes the missing feedback without claiming the input was lost. It still does not verify the field contents. A complete scoped tree containing only application/window containers adds an Electron/Chromium `--force-renderer-accessibility` hint; a truncated tree instead retains its traversal-limit guidance.
 - **Wayland coordinate input** — coordinate clicks, drags, and targeted scrolls require the absolute uinput pointer or an approved RemoteDesktop portal session. Targeted scroll positions through uinput before sending only wheel events through ydotool. If accurate positioning is unavailable, the call returns `ok: false` before sending coordinate input. The absolute pointer still requires a successful full-desktop capture when first created; an existing device does not need another capture. Scrolling without a point or window/element target keeps using the current pointer position.
 - **Native X11 coordinate clicks** — eligible native X11 sessions use one supervised `xdotool mousemove -- X Y click --repeat N BUTTON` command for left, middle, and right clicks; ydotool is used only when xdotool cannot launch, while a launched nonzero xdotool command is reported as an error without replay. `COMPUTER_USE_LINUX_FORCE_YDOTOOL_POINTER=1` skips this xdotool path.
 - **Native X11 scroll.** The same sessions send one `xdotool` command, `mousemove -- X Y click --delay 12 --repeat N BUTTON` when a point is set, or `click` alone when it is not. Buttons are 4 up, 5 down, 6 left, and 7 right, and `N` is the same notch count ydotool would pass to `mousemove --wheel` (five per page). ydotool's absolute move warps through (0, 0); GTK 3 then drops the single following wheel event because re-entry resets its XI2 scroll valuators. XTEST has no scroll valuators, so GTK takes the button path. A missing xdotool falls back to ydotool; a launched nonzero xdotool command does not. `COMPUTER_USE_LINUX_FORCE_YDOTOOL_POINTER=1` skips this path.

package/npm/README.md

@@ -99,3 +99,22 @@ that executable instead.
 X11 text input sends LF and CRLF line endings as Return. Focused terminals
 accept keyboard input even when AT-SPI does not expose EditableText. Focus
 feedback describes the target; re-observe its contents to confirm input.
+
+On Hyprland, `type_text` passes one literal wtype argument after `--` for a
+classified nonsecret field, avoiding stdin keymap-refresh corruption in Electron.
+Argument text is visible in process listings, so confirmed password roles are
+rejected. Terminals and ambiguous roles (`Entry`/`Text`, `text box`, unreadable
+roles), or a missing/incomplete/timed-out probe, use private stdin for at most
+100 Unicode characters per call. This includes terminals with AT-SPI support;
+they can still contain password prompts. Larger ambiguous-field text must be
+split into smaller calls or, for a nonterminal field, accessibility enabled.
+The input probe has its own 1.5-second budget; the 250 ms indicator probe only
+masks text. Both protections apply with the indicator disabled. Other compatible
+compositors retain their existing stdin path. Wtype rejects NUL and text over
+131,071 UTF-8 bytes before focusing a window or displaying text. `ok: true`
+confirms dispatch only; every text backend leaves field contents unverified.
+Re-observe before retrying. Exact window focus alone does not suppress missing-focus
+warnings: only a complete scoped tree containing window/menu chrome without
+content makes the feedback informational. Such trees get a conditional
+Electron/Chromium hint computed before compaction; this is not positive Electron
+detection.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-sh/computer-use-linux",
-  "version": "0.7.16",
+  "version": "0.7.17",
   "description": "Linux desktop-control MCP server: AT-SPI accessibility trees, Wayland/X11 input, screenshots, and compositor window targeting.",
   "license": "MIT",
   "type": "commonjs",

package/pi/extension/generated-tools.ts

@@ -7,9 +7,9 @@ export interface GeneratedMcpToolDefinition {
 	annotations: Record<string, unknown>;
 }
 
-export const GENERATED_SERVER_VERSION = "0.7.16";
-export const GENERATED_TOOL_CATALOG_HASH = "666f4649084b7c1a240e6a0eacc01a55379b64a579355f50071211437e91229c";
-export const GENERATED_SHELL_TOOL_CATALOG_HASH = "554322e70886f5c1e1a3ad06869c5be91c140103f71350ad635160e128c1563d";
+export const GENERATED_SERVER_VERSION = "0.7.17";
+export const GENERATED_TOOL_CATALOG_HASH = "17febb6d652f7b89b2dacdd002d09fb0f5d97ce801943cdf9f4e661c47eb535b";
+export const GENERATED_SHELL_TOOL_CATALOG_HASH = "eba50023d71fdded440f0cf6ed15abda711c640c8d5708735624a0ae22f2bb0a";
 export const GENERATED_MCP_TOOLS =
 [
   {
@@ -1199,7 +1199,7 @@ export const GENERATED_MCP_TOOLS =
       "openWorldHint": true,
       "readOnlyHint": false
     },
-    "description": "Type literal text using keyboard input, optionally after focusing a target window or terminal selector.",
+    "description": "Type literal text using keyboard input, optionally after focusing a target window or terminal selector. Success confirms dispatch, not field-content verification; re-observe the target before retrying. The wtype backend rejects NUL and text over 131071 UTF-8 bytes before focus or indicators; Hyprland rejects confirmed password fields; ambiguous fields and terminals use private stdin for at most 100 Unicode characters per call.",
     "inputSchema": {
       "$schema": "https://json-schema.org/draft/2020-12/schema",
       "properties": {

package/skills/computer-use-linux/SKILL.md

@@ -144,6 +144,25 @@ Pi native tools skip this MCP `command` config; see [Pi setup](references/pi-set
 9. For text input, prefer `type_text` with a target selector (`window_id`, `pid`, `app_id`, `wm_class`, `title`, `tty`, `terminal_pid`, `terminal_command`, or `terminal_cwd`) rather than relying on current focus.
 10. After mutating actions, re-check state with `get_app_state`, `focused_window`, or an app-specific readback.
 
+On Hyprland, `type_text` passes one literal wtype argument after `--` for a
+classified nonsecret field, avoiding stdin keymap-refresh corruption in Electron.
+Argument text is visible in process listings, so confirmed password roles are
+rejected. Terminals and ambiguous roles (`Entry`/`Text`, `text box`, unreadable
+roles), or a missing/incomplete/timed-out probe, use private stdin for at most
+100 Unicode characters per call. This includes terminals with AT-SPI support;
+they can still contain password prompts. Larger ambiguous-field text must be
+split into smaller calls or, for a nonterminal field, accessibility enabled.
+The input probe has its own 1.5-second budget; the 250 ms indicator probe only
+masks text. Both protections apply with the indicator disabled. Other compatible
+compositors retain their existing stdin path. Wtype rejects NUL and text over
+131,071 UTF-8 bytes before focusing a window or displaying text. `ok: true`
+confirms dispatch only; every text backend leaves field contents unverified.
+Re-observe before retrying. Exact window focus alone does not suppress missing-focus
+warnings: only a complete scoped tree containing window/menu chrome without
+content makes the feedback informational. Such trees get a conditional
+Electron/Chromium hint computed before compaction; this is not positive Electron
+detection.
+
 Plain left element/index/selector `click` prefers native AT-SPI `click`,
 `press`, or `toggle` over toolkit bounds, avoiding coordinate
 conversion when available. This preference does not replace a coordinate click