deepseek-computer-use 0.1.0 → 0.1.2

package/lib/build-helper.mjs

@@ -9,6 +9,7 @@
  * @module deepseek-computer-use/build-helper
  */
 import { execFileSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -76,11 +77,24 @@ export function ensureHelper({ force = false, exe = HELPER_EXE, log } = {}) {
   }
 
   fs.mkdirSync(path.dirname(exe), { recursive: true });
-  const args = ['/nologo', '/target:exe', '/platform:anycpu', '/out:' + exe, ...SOURCES, ...refs];
   log?.('[dsh-computer-use] compiling helper with ' + compiler);
-  const output = execFileSync(compiler, args, { encoding: 'utf8', windowsHide: true });
-  if (!fs.existsSync(exe)) throw new Error('helper compilation produced no executable: ' + output);
-  return { exe, built: true };
+  const compile = output => execFileSync(compiler, ['/nologo', '/target:exe', '/platform:anycpu', '/out:' + output, ...SOURCES, ...refs], { encoding: 'utf8', windowsHide: true });
+  try {
+    compile(exe);
+    if (!fs.existsSync(exe)) throw new Error('helper compilation produced no executable');
+    return { exe, built: true };
+  } catch (error) {
+    // Windows locks a running exe. Compile alongside it during an update rather
+    // than stopping a helper owned by another DSH session.
+    if (!fs.existsSync(exe) || !String(error.stdout ?? '').includes('CS0016')) throw error;
+    const hash = createHash('sha256');
+    for (const source of SOURCES) hash.update(fs.readFileSync(source));
+    const cached = path.join(path.dirname(exe), path.basename(exe, '.exe') + '-' + hash.digest('hex').slice(0, 16) + '.exe');
+    if (isHelperFresh(cached)) return { exe: cached, built: false };
+    log?.('[dsh-computer-use] helper is in use; compiling alongside it');
+    compile(cached);
+    return { exe: cached, built: true };
+  }
 }
 
 /** The in-use indicator (breathing frame + virtual cursor) is a separate win-exe. */

package/lib/build.mjs

@@ -6,13 +6,13 @@
  *   capture  Windows.Graphics.Capture             (needs .NET SDK)
  *   audio    WASAPI loopback recorder             (needs .NET SDK)
  */
-import { ensureHelper, ensureOverlay, HELPER_EXE, OVERLAY_EXE } from './build-helper.mjs';
+import { ensureHelper, ensureOverlay, OVERLAY_EXE } from './build-helper.mjs';
 import { buildNative } from './build-native.mjs';
 
 const log = message => console.log(message);
 
 const helper = ensureHelper({ force: process.argv.includes('--force'), log });
-log('[dsh-computer-use] helper  ' + (helper.built ? 'built' : 'up to date') + ' -> ' + HELPER_EXE);
+log('[dsh-computer-use] helper  ' + (helper.built ? 'built' : 'up to date') + ' -> ' + helper.exe);
 
 const overlay = ensureOverlay({ force: process.argv.includes('--force'), log });
 log('[dsh-computer-use] overlay ' + (overlay.built ? 'built' : 'up to date') + ' -> ' + OVERLAY_EXE);

package/lib/index.js

@@ -16,6 +16,7 @@ import { HelperBridge } from './bridge.js';
 import { resolveConfig } from './config.js';
 import { ensureHelper, ensureOverlay, findCompiler, HELPER_EXE, isHelperFresh, isOverlayFresh } from './build-helper.mjs';
 import { buildTools } from './tools.js';
+import { assertTurnOpen, turnTokenOf } from './safety.js';
 
 export const name = 'deepseek-computer-use';
 /** Only the tool registry is mandatory; skills/attachments/approval are optional. */
@@ -52,67 +53,70 @@ export function apply(ctx, rawConfig = {}) {
   };
 
   const states = new Map();
-  let bridge = null;
-  let starting = null;
+  const runtimes = new Map();
+  const defaultSession = Symbol('unscoped');
+  let disposed = false;
   const exePath = config.helperPath ?? HELPER_EXE;
+  let activeExePath = exePath;
 
   async function startBridge() {
     const built = ensureHelper({ exe: exePath, log: warn });
+    activeExePath = built.exe;
     // The in-use indicator is a second exe; build it eagerly so the very first
     // action already shows the breathing frame instead of a silent no-op.
     try { ensureOverlay({ log: warn }); } catch (error) { warn('overlay build skipped: ' + error.message); }
     return new HelperBridge({ exe: built.exe, timeoutMs: config.timeoutMs, log: warn });
   }
 
-  async function getBridge() {
-    if (bridge !== null) return bridge;
-    if (starting === null) starting = startBridge();
-    try {
-      bridge = await starting;
-      return bridge;
-    } catch (error) {
-      starting = null;
-      throw error;
-    }
-  }
-
-  let configured = false;
-  let lastToken = null;
-
   async function request(method, params = {}, opts = {}) {
-    const active = await getBridge();
+    if (disposed) throw new Error('the Computer Use plugin was disposed');
+    const key = opts.session ?? defaultSession;
+    let runtime = runtimes.get(key);
+    if (!runtime) {
+      runtime = { bridge: await startBridge(), configured: false, lastToken: null };
+      runtimes.set(key, runtime);
+    }
+    const active = runtime.bridge;
+    if (!active.running) runtime.configured = false;
 
-    if (!configured) {
+    if (!runtime.configured) {
       // The helper refuses windows whose app was never approved; keep that switch in
       // sync with the plugin policy.
-      try {
-        await active.request('configure', { requireAppApproval: config.appConsent !== 'never' }, { timeoutMs: config.timeoutMs });
-      } catch { /* older helper */ }
-      configured = true;
+      await active.request('configure', { requireAppApproval: config.appConsent !== 'never' }, { timeoutMs: config.timeoutMs, signal: opts.signal });
+      runtime.configured = true;
     }
 
     const token = opts.turnToken;
-    if (token !== undefined && token !== lastToken) {
-      if (lastToken !== null) {
+    if (token !== undefined && token !== runtime.lastToken) {
+      if (runtime.lastToken !== null) {
         // Turn boundary: drop element snapshots, screenshot regions and the Esc block.
-        try { await active.request('end_turn', {}, { timeoutMs: 5000 }); } catch { /* best effort */ }
+        await active.request('end_turn', {}, { timeoutMs: 5000, signal: opts.signal });
       }
-      lastToken = token;
+      runtime.lastToken = token;
     }
 
     const timeoutMs = opts.timeoutMs ?? (method === 'launch_app' ? config.launchTimeoutMs : config.timeoutMs);
-    return active.request(method, params, { ...opts, timeoutMs });
+    if (opts.session) assertTurnOpen({ agent: { session: opts.session } });
+    try {
+      return await active.request(method, params, { ...opts, timeoutMs });
+    } catch (error) {
+      if (active.running && !['configure', 'approve_app', 'invalidate_state'].includes(method)) {
+        try { await active.request('invalidate_state', {}, { timeoutMs: 2000 }); } catch { /* transport failure stops the child */ }
+      }
+      throw error;
+    }
   }
 
   const describeHelper = () => {
     try {
       return {
-        path: exePath,
-        exists: fs.existsSync(exePath),
-        fresh: isHelperFresh(exePath),
+        path: activeExePath,
+        exists: fs.existsSync(activeExePath),
+        fresh: isHelperFresh(activeExePath),
         compiler: findCompiler(),
         overlay: isOverlayFresh(),
         platform: process.platform,
+        pids: [...runtimes.values()].map(runtime => runtime.bridge.pid).filter(pid => pid !== null),
       };
     } catch (error) {
       return { path: exePath, error: error.message };
@@ -142,9 +146,24 @@ export function apply(ctx, rawConfig = {}) {
   }
 
   if (typeof ctx.on === 'function') {
-    ctx.on('dispose', () => {
-      try { bridge?.dispose(); } catch { /* already gone */ }
-      bridge = null;
+    ctx.on('session/event', (session, event) => {
+      if (event?.type !== 'turn/end') return;
+      const runtime = runtimes.get(session);
+      if (runtime) return runtime.bridge.stopTurn(turnTokenOf({ agent: { session } })).catch(error => warn(error.message));
+    });
+    ctx.on('session/disposed', session => {
+      const runtime = runtimes.get(session);
+      if (runtime) {
+        runtimes.delete(session);
+        return runtime.bridge.dispose().catch(error => warn(error.message));
+      }
+    });
+    ctx.on('dispose', async () => {
+      disposed = true;
+      // The overlay hides the system cursor while it is up; make sure teardown puts it
+      // back even if the overlay process was killed instead of exiting cleanly.
+      await Promise.allSettled([...runtimes.values()].map(({ bridge }) => bridge.dispose()));
+      runtimes.clear();
       for (const dispose of disposers) {
         try { dispose(); } catch { /* registry may be tearing down */ }
       }

package/lib/parameters.js

@@ -0,0 +1,50 @@
+/** Compile the local parameter shorthand to the JSON Schema DSH exposes to models. */
+export function compileParameters(properties) {
+  const compiled = {};
+  const required = [];
+  for (const [name, spec] of Object.entries(properties)) {
+    if (spec.required === true) required.push(name);
+    const { required: _required, ...node } = spec;
+    if (node.type === 'object') Object.assign(node, compileParameters(node.properties ?? {}));
+    if (node.items) node.items = compileParameters({ item: node.items }).properties.item;
+    if (node.oneOf) node.oneOf = node.oneOf.map(branch => compileParameters({ branch }).properties.branch);
+    compiled[name] = node;
+  }
+  return { type: 'object', properties: compiled, ...(required.length ? { required } : {}) };
+}
+
+/** DSH raw registrations own argument validation; reject before starting the helper. */
+export function assertArguments(schema, value, at = 'arguments') {
+  const fail = detail => {
+    throw Object.assign(new Error(at + ': ' + detail), { code: 'invalid_arguments' });
+  };
+  if (schema.oneOf) {
+    let matches = 0;
+    for (const branch of schema.oneOf) {
+      try { assertArguments(branch, value, at); matches += 1; } catch (error) {
+        if (error.code !== 'invalid_arguments') throw error;
+      }
+    }
+    if (matches !== 1) fail('must match exactly one supported shape');
+    return;
+  }
+  if (schema.type === 'object') {
+    if (value === null || typeof value !== 'object' || Array.isArray(value)) fail('must be an object');
+    for (const key of schema.required ?? []) {
+      if (!Object.hasOwn(value, key)) fail('missing required field ' + key);
+    }
+    for (const [key, item] of Object.entries(value)) {
+      const property = schema.properties?.[key];
+      if (property) assertArguments(property, item, at + '.' + key);
+      else if (schema.additionalProperties === false) fail('unknown field ' + key);
+    }
+  } else if (schema.type === 'array') {
+    if (!Array.isArray(value)) fail('must be an array');
+    if (schema.items) value.forEach((item, i) => assertArguments(schema.items, item, at + '[' + i + ']'));
+  } else if (schema.type === 'number') {
+    if (typeof value !== 'number' || !Number.isFinite(value)) fail('must be a finite number');
+  } else if (schema.type && typeof value !== schema.type) {
+    fail('must be a ' + schema.type);
+  }
+  if (schema.enum && !schema.enum.includes(value)) fail('unsupported value');
+}

package/lib/safety.js

@@ -163,15 +163,8 @@ export function needsApproval(config, { toolName, label = '' }) {
  */
 export async function requestApproval(ctx, exec, { toolName, reason }) {
   const approval = ctx?.get?.('approval');
-  // The user's session preset may disable prompting entirely ("approval: never",
-  // e.g. the full-access preset). Honour that instead of failing every action:
-  // the hard denies above still apply, and asking would only return "rejected".
-  try {
-    if (typeof approval?.effectivePolicy === 'function') {
-      const policy = approval.effectivePolicy(exec?.agent?.session);
-      if (policy === 'never') return;
-    }
-  } catch { /* policy lookup is best effort */ }
+  // DSH's approval policy 'never' rejects asks; it is not an implicit grant.
+  // Let the public seam enforce policy and persist the asked/decided audit pair.
   if (approval === undefined || approval === null || typeof approval.request !== 'function') {
     throw new PolicyError(
       'approval_unavailable',

package/lib/tools.js

@@ -21,6 +21,8 @@ import {
   needsApproval,
   requestApproval,
 } from './safety.js';
+import { assertArguments, compileParameters } from './parameters.js';
+import { setTimeout as delay } from 'node:timers/promises';
 
 const WINDOW_SCHEMA = {
   type: 'object',
@@ -28,7 +30,13 @@ const WINDOW_SCHEMA = {
   description: 'Target window object taken from list_windows() / list_apps() / get_window_state(). Pass the same object back; only its numeric id is used for addressing.',
   properties: {
     id: { type: 'number', required: true, description: 'Opaque window id (HWND) from list_windows() or list_apps().' },
-    app: { type: 'string', required: true, description: 'App identifier carried forward from the same window object (required by the window2 contract).' },
+    app: {
+      description: 'App metadata returned by DSH, or a Codex-style app identifier. Optional for id-only window bindings.',
+      oneOf: [
+        { type: 'string' },
+        { type: 'object', additionalProperties: true, properties: { id: { type: 'string', required: true } } },
+      ],
+    },
     title: { type: 'string', description: 'Window title from the same window object; informational only.' },
   },
   additionalProperties: true,
@@ -53,10 +61,21 @@ function describeWindow(window) {
 
 export function buildTools(config, deps) {
   const { request, ctx, log, states } = deps;
-  const lastActionAt = new Map();
-  const consentedApps = new Set();
-  /** Codex treats computer audio as its own app ("computer-audio") and asks once. */
-  let audioApproved = false;
+  const scopes = new WeakMap();
+  const createScope = () => ({ consentedApps: new Set(), audioApproved: false, lastActionAt: new Map(), states: new Map(), shots: new Map(), primaryShots: new Map(), invalidWindows: new Set(), observedWindows: new Set() });
+  const unscoped = { ...createScope(), states };
+  const scopeOf = exec => {
+    const session = exec?.agent?.session;
+    if (session === null || typeof session !== 'object') return unscoped;
+    if (!scopes.has(session)) scopes.set(session, createScope());
+    return scopes.get(session);
+  };
+  // A physical desktop has one pointer and focus. Serialize whole executions,
+  // including authorization, rather than just individual native RPC requests.
+  let queue = Promise.resolve();
+  const inputTools = new Set(['launch_app', 'click', 'press_key', 'type_text', 'scroll', 'drag',
+    'set_value', 'perform_secondary_action', 'activate_window', 'start_audio_recording']);
+  const observedInputs = new Set(['click', 'press_key', 'type_text', 'scroll', 'drag', 'set_value', 'perform_secondary_action']);
 
   /**
    * Codex asks the user to allow Computer Use per application before it drives
@@ -65,22 +84,49 @@ export function buildTools(config, deps) {
    */
   async function ensureAppConsent(window, exec) {
     if (config.appConsent === 'never') return;
+    const { consentedApps } = scopeOf(exec);
     const app = window?.app ?? {};
     const key = String(app.id ?? app.name ?? window?.id ?? 'unknown');
-    if (consentedApps.has(key)) return;
-    await requestApproval(ctx, exec, {
-      toolName: toolName('get_window_state'),
-      reason: 'Computer Use is about to drive "' + (app.displayName ?? app.name ?? key) + '" (' + key + '). Approve this app for the session.',
-    });
-    consentedApps.add(key);
+    if (!consentedApps.has(key)) {
+      await requestApproval(ctx, exec, {
+        toolName: toolName('get_window_state'),
+        reason: 'Computer Use is about to drive "' + (app.displayName ?? app.name ?? key) + '" (' + key + '). Approve this app for the session.',
+      });
+    }
     // Tell the helper, which enforces the same fact on its side (Codex does this
     // through x-oai-cua-approved-app on every request).
-    try { await request('approve_app', { app: key }, callOpts(exec)); } catch { /* enforcement is best effort */ }
+    // Re-send the grant so a restarted helper can recover without another prompt.
+    // Cache only after acknowledgement; a failed grant must remain a failed call.
+    await request('approve_app', { app: key }, callOpts(exec));
+    consentedApps.add(key);
   }
-  const markAction = window => { if (window?.id !== undefined) lastActionAt.set(Number(window.id), Date.now()); };
+  const markAction = (window, exec) => { if (window?.id !== undefined) scopeOf(exec).lastActionAt.set(Number(window.id), Date.now()); };
   const toolName = base => config.toolPrefix + base;
   // The request budget is chosen per method in index.js (10s / 15s, Codex parity).
-  const callOpts = exec => ({ signal: exec?.signal, turnToken: turnTokenOf(exec) });
+  const callOpts = exec => {
+    const turnToken = turnTokenOf(exec);
+    const scope = scopeOf(exec);
+    if (scope.turnToken !== turnToken) {
+      scope.states.clear();
+      scope.lastActionAt.clear();
+      scope.shots.clear();
+      scope.primaryShots.clear();
+      scope.turnToken = turnToken;
+    }
+    return { signal: exec?.signal, turnToken, session: exec?.agent?.session };
+  };
+  const coordinateParams = (params, window, exec) => {
+    const scope = scopeOf(exec);
+    const id = params.screenshotId ?? scope.primaryShots.get(Number(window.id));
+    const shot = scope.shots.get(id);
+    if (!shot || shot.windowId !== Number(window.id)) return params;
+    const mapped = { ...params };
+    for (const [key, scale] of [['x', shot.scaleX], ['y', shot.scaleY],
+      ['from_x', shot.scaleX], ['to_x', shot.scaleX], ['from_y', shot.scaleY], ['to_y', shot.scaleY]]) {
+      if (typeof mapped[key] === 'number') mapped[key] = Math.floor(mapped[key] * scale);
+    }
+    return mapped;
+  };
 
   /** Resolve + authorize a window before any action touches it. */
   async function authorizeWindow(args, exec) {
@@ -97,7 +143,7 @@ export function buildTools(config, deps) {
 
   async function gate(action, exec, { window, toolName: tool, label, reason }) {
     assertTurnOpen(exec);
-    const state = window?.id !== undefined ? states.get(Number(window.id)) : undefined;
+    const state = window?.id !== undefined ? scopeOf(exec).states.get(Number(window.id)) : undefined;
     const targetLabel = label ?? labelOfElement(state, action?.element_index);
     if (needsApproval(config, { toolName: tool, label: targetLabel })) {
       await requestApproval(ctx, exec, {
@@ -108,13 +154,48 @@ export function buildTools(config, deps) {
   }
 
   function action(name, description, parameters, run) {
+    const schema = compileParameters(parameters);
     return {
       name: toolName(name),
       description,
-      parameters,
+      parameters: schema,
       output: { schema: OUTPUT_SCHEMA, render: (_args, value) => [json(value)] },
       isConcurrencySafe: () => false,
-      execute: run,
+      execute: (args, exec) => {
+        const execute = async () => {
+          assertArguments(schema, args);
+          exec?.signal?.throwIfAborted();
+          if (inputTools.has(name)) assertTurnOpen(exec);
+          const scope = scopeOf(exec);
+          const windowId = Number(args?.window?.id);
+          if (observedInputs.has(name) && scope.invalidWindows.has(windowId)) {
+            throw Object.assign(new Error('the previous input or observation failed; call get_window_state again and inspect the new state before retrying input'), { code: 'fresh_observation_required' });
+          }
+          try {
+            const value = await run(args, exec);
+            if (name === 'get_window_state') {
+              scope.invalidWindows.delete(windowId);
+              scope.observedWindows.add(windowId);
+            }
+            return value;
+          } catch (error) {
+            if (inputTools.has(name) || name === 'get_window_state') {
+              for (const id of scope.observedWindows) scope.invalidWindows.add(id);
+              scope.states.clear();
+              scope.shots.clear();
+              scope.primaryShots.clear();
+              if (Number.isFinite(windowId)) scope.invalidWindows.add(windowId);
+              if (!['cancelled_by_user', 'turn_stopped', 'turn_ended', 'cancelled', 'AbortError'].includes(error.code ?? error.name)) {
+                error.message += ' Re-observe with get_window_state before retrying; the previous input outcome may be unknown.';
+              }
+            }
+            throw error;
+          }
+        };
+        const result = queue.then(execute, execute);
+        queue = result.catch(() => {});
+        return result;
+      },
     };
   }
 
@@ -183,10 +264,11 @@ export function buildTools(config, deps) {
         if (!includeText && !includeShot) throw new Error('get_window_state must request include_text, include_screenshot, or both');
         // Codex waits for the UI to settle before capturing after an action; the
         // harness-side equivalent is a short settle window here.
-        const last = lastActionAt.get(Number(window.id));
+        const scope = scopeOf(exec);
+        const last = scope.lastActionAt.get(Number(window.id));
         if (last !== undefined) {
           const wait = Math.min(config.settleMs, config.settleMs - (Date.now() - last));
-          if (wait > 0) await new Promise(resolve => setTimeout(resolve, wait));
+          if (wait > 0) await delay(wait, undefined, { signal: exec?.signal });
         }
         const result = await request('get_window_state', {
           window: { id: window.id },
@@ -196,7 +278,7 @@ export function buildTools(config, deps) {
           ttlMs: config.snapshotTtlMs,
         }, callOpts(exec));
         if (result?.accessibility) {
-          states.set(Number(window.id), { ...result.accessibility, at: Date.now() });
+          scope.states.set(Number(window.id), { ...result.accessibility, at: Date.now() });
         }
         if (redacted) {
           // appshot guard: never let these pixels leave the machine
@@ -204,7 +286,21 @@ export function buildTools(config, deps) {
           result.redactedNote = 'screenshots are disabled for this application by the redactApps policy';
           result.screenshots = [];
         } else if (Array.isArray(result?.screenshots)) {
+          // Attachment normalization can resize a captured window. The model aims
+          // in the stored image, while the helper owns the original capture pixels.
+          for (const [id, shot] of scope.shots) {
+            if (shot.windowId === Number(window.id)) scope.shots.delete(id);
+          }
           const attached = await attachScreenshots(ctx, result.screenshots, window);
+          for (let index = 0; index < attached.length; index++) {
+            const source = result.screenshots[index];
+            const stored = attached[index];
+            if (source.width > 0 && source.height > 0 && stored.width > 0 && stored.height > 0) {
+              scope.shots.set(stored.id, { windowId: Number(window.id), scaleX: source.width / stored.width, scaleY: source.height / stored.height });
+            }
+          }
+          scope.primaryShots.delete(Number(window.id));
+          if (attached.length) scope.primaryShots.set(Number(window.id), attached[0].id);
           result.screenshots = attached;
         }
         return result;
@@ -254,8 +350,8 @@ export function buildTools(config, deps) {
         params.screenshotId = args.screenshotId;
         await gate(params, exec, { window, toolName: 'click' });
         if (config.dryRun) return { dryRun: true, wouldClick: params };
-        const clicked = await request('click', stripUndefined(params), callOpts(exec));
-        markAction(window);
+        const clicked = await request('click', stripUndefined(coordinateParams(params, window, exec)), callOpts(exec));
+        markAction(window, exec);
         return clicked;
       },
     ),
@@ -275,7 +371,7 @@ export function buildTools(config, deps) {
       await gate({}, exec, { window, toolName: 'press_key', label: 'key ' + args.key, reason: undefined });
       if (config.dryRun) return { dryRun: true, wouldPress: args.key };
       const pressed = await request('press_key', { window: { id: window.id }, key: args.key }, callOpts(exec));
-      markAction(window);
+      markAction(window, exec);
       return pressed;
     },
   ));
@@ -292,7 +388,7 @@ export function buildTools(config, deps) {
       await gate({}, exec, { window, toolName: 'type_text', label: 'text ' + String(args.text).slice(0, 40) });
       if (config.dryRun) return { dryRun: true, wouldType: args.text };
       const typed = await request('type_text', { window: { id: window.id }, text: String(args.text) }, callOpts(exec));
-      markAction(window);
+      markAction(window, exec);
       return typed;
     },
   ));
@@ -320,8 +416,8 @@ export function buildTools(config, deps) {
       });
       await gate(params, exec, { window, toolName: 'scroll' });
       if (config.dryRun) return { dryRun: true, wouldScroll: params };
-      const scrolled = await request('scroll', params, callOpts(exec));
-      markAction(window);
+      const scrolled = await request('scroll', coordinateParams(params, window, exec), callOpts(exec));
+      markAction(window, exec);
       return scrolled;
     },
   ));
@@ -347,8 +443,8 @@ export function buildTools(config, deps) {
       };
       await gate(params, exec, { window, toolName: 'drag' });
       if (config.dryRun) return { dryRun: true, wouldDrag: params };
-      const dragged = await request('drag', params, callOpts(exec));
-      markAction(window);
+      const dragged = await request('drag', stripUndefined(coordinateParams(params, window, exec)), callOpts(exec));
+      markAction(window, exec);
       return dragged;
     },
   ));
@@ -367,7 +463,7 @@ export function buildTools(config, deps) {
       await gate(params, exec, { window, toolName: 'set_value' });
       if (config.dryRun) return { dryRun: true, wouldSetValue: params };
       const setValue = await request('set_value', params, callOpts(exec));
-      markAction(window);
+      markAction(window, exec);
       return setValue;
     },
   ));
@@ -386,7 +482,7 @@ export function buildTools(config, deps) {
       await gate(params, exec, { window, toolName: 'perform_secondary_action' });
       if (config.dryRun) return { dryRun: true, wouldPerform: params };
       const performed = await request('perform_secondary_action', params, callOpts(exec));
-      markAction(window);
+      markAction(window, exec);
       return performed;
     },
   ));
@@ -410,12 +506,13 @@ export function buildTools(config, deps) {
       if (!config.audio) throw new Error('audio recording is disabled for this plugin: set audio: true in the plugin config (or DSH_CU_AUDIO=1) and restart the host');
       // Codex elicits "Allow Computer Use to record computer audio?" before the first
       // recording of a session, separate from the per-app consent it asks for windows.
-      if (!audioApproved) {
+      const scope = scopeOf(exec);
+      if (!scope.audioApproved) {
         await requestApproval(ctx, exec, {
           toolName: toolName('start_audio_recording'),
           reason: 'Allow Computer Use to record computer audio?',
         });
-        audioApproved = true;
+        scope.audioApproved = true;
       }
       return request('start_audio_recording', {
         maxDurationMs: Number(args.max_duration_ms ?? 60000),
@@ -448,6 +545,8 @@ export function buildTools(config, deps) {
       return {
         ok: true,
         platform: ping?.platform ?? 'unknown',
+        pid: ping?.pid ?? null,
+        overlayPid: ping?.overlayPid ?? null,
         helper: deps.describeHelper?.() ?? null,
         windows,
         policy: {