dsh-codex-style-computer-use 1.2.1 → 1.2.3

package/README.md

@@ -1,5 +1,9 @@
 # dsh-codex-style-computer-use · Codex-style desktop control
 
+**Give DeepSeek eyes and hands for Windows.**
+
+Ask your agent to work with desktop apps: see the screen, find controls, click and type. Take over with your own mouse or keyboard whenever needed; the agent waits before continuing. Approval prompts remain enabled by default.
+
 Windows desktop computer use for **DeepSeek Harness**: 18 desktop tools plus an Agent activation entry that observe and drive
 native Windows applications through prebuilt C# workers included in the package. No PowerShell 7,
 SDK or install-time builds are needed.
@@ -8,8 +12,12 @@ English | [中文](README.zh.md)
 
 Windows only (`os: win32`). Requires Node.js ≥ 22 and the .NET Framework 4.x that Windows ships with.
 
+**1.2.3 automatic fix:** normal installation/update now installs the approval-attribution correction for computer-use calls on affected DSH hosts. No manual host patch is required for those calls. Host approvals and audit remain authoritative; follow the host's restart indication after updating an already loaded plugin. See [1.2.3](docs/RELEASE-1.2.3.md).
+
 **1.2.1 attention fix:** fixes a missing crypto import that prevented 1.2.0's native `probe` and `raise` requests from reaching the helper. Updating from 1.2.0 is required for this runtime fix; reinstalling 1.2.0 does not fix it. New releases are staged on npm's `next` tag before promotion to `latest`; the market's normal update follows `latest`. See [1.2.1 validation and release status](docs/RELEASE-1.2.1.md).
 
+**1.2.2 GitHub pre-release:** includes a separately deployed DSH host approval-attribution patch and 14 regression cases. Plugin input and approval behavior is retained from 1.2.1. See [release contents and deployment scope](docs/RELEASE-1.2.2.md); GitHub publication does not update npm or the market automatically.
+
 ## What it does
 
 - **Observe** — window list, screenshots (region / JPEG / PNG / downscaled), a Set-of-Marks map of
@@ -31,7 +39,7 @@ under `$DSH_HOME/data/computer-use/`.
 
 Once the catalog submission is merged and synced, search **computer-use** and select **dsh-codex-style-computer-use**, by **ltmroberthk915** (npm maintainer: **ltmroberthk**). Click **Install**. Later, use **Update** or **Update all** for versions admitted by the host's release policy. The package includes both native helpers; no PowerShell 7 or build permission is needed.
 
-Before catalog sync, use **Settings → Plugins → Add plugin** and enter `dsh-codex-style-computer-use`. The default non-strict pnpm 11.7.0 configuration installs this published package immediately; an explicitly strict host policy can require waiting as described below. A newly added bundle can load live on the official Desktop host; check that its tools and skill appear. Restart from the tray when replacing an already loaded version, when the client remains stale, or when DSH reports **restart-required**.
+Before catalog sync, use **Settings → Plugins → Add plugin**. The corrected version is **`dsh-codex-style-computer-use@1.2.1`**; the unversioned name still resolves to 1.2.0 until promotion. Do not paste the GitHub repository URL: that selects the source-download path instead of the small prebuilt npm package. The default non-strict pnpm 11.7.0 configuration can install 1.2.1 immediately; an explicitly strict host policy can require waiting as described below. A newly added bundle can load live on the official Desktop host; check that its tools and skill appear. Restart from the tray when replacing an already loaded version, when the client remains stale, or when DSH reports **restart-required**.
 
 ### Releases less than 24 hours old
 
@@ -113,6 +121,8 @@ clicked at the wrong place.
 
 ## Approval modes
 
+For a host that reports a disabled-prompt automatic refusal as “the user rejected tool”, see the [DSH approval attribution patch and regression test](docs/APPROVAL-ATTRIBUTION.md).
+
 `automationMode` is set in the plugin's settings and defaults to `standard`:
 
 | Mode | Observation | Actuation |

package/README.zh.md

@@ -1,5 +1,9 @@
 # dsh-codex-style-computer-use · Codex 风格桌面操控
 
+**让 DeepSeek 看得见，也点得动。**
+
+把 Windows 应用里的重复操作交给 AI：看屏幕、找控件、点鼠标、敲键盘。你一碰鼠标键盘，它就让出控制，等你操作完再继续；默认保留操作审批。
+
 给 **DeepSeek Harness** 用的 Windows 桌面操控插件：18 个桌面工具加一个 Agent 激活入口，通过一个 C# worker
 观察并驱动原生 Windows 应用。发布包已包含编译好的原生组件，无需安装 PowerShell 7、SDK 或执行编译命令。
 
@@ -7,8 +11,14 @@
 
 仅支持 Windows（`os: win32`）。需要 Node.js ≥ 22 与 Windows 自带的 .NET Framework 4.x。
 
+**1.2.3 自动修复：**正常安装或更新插件，即会为受影响宿主中的 computer-use 调用安装审批归因修正，无需手工修改宿主。审批决定与审计仍由宿主处理；更新已加载插件后按宿主提示重启。详见 [1.2.3](docs/RELEASE-1.2.3.md)。
+
 **1.2.1 提醒修复：**补齐 crypto 导入，修复 1.2.0 原生 `probe` / `raise` 请求还未发送就抛错的问题。这次是运行时代码修复，需要从 1.2.0 更新；重复安装 1.2.0 无效。新版本先发布到 npm 的 `next`，再提升为 `latest`，市场普通更新跟随 `latest`。详见 [1.2.1 验证和发布状态](docs/RELEASE-1.2.1.md)。
 
+宿主在禁用审批弹窗时仍提示“用户拒绝工具”的问题，详见 [DSH 审批归因补丁与回归测试](docs/APPROVAL-ATTRIBUTION.md)。
+
+**1.2.2 GitHub 预发布：**收录独立部署的宿主审批归因补丁和 14 项回归测试。插件输入与审批行为延续 1.2.1，详见 [发布内容及部署范围](docs/RELEASE-1.2.2.md)。GitHub 发布不会自动更新 npm 或市场版本。
+
 ## 它能做什么
 
 - **观察** —— 窗口列表、截图（区域 / JPEG / PNG / 降采样）、可点元素的 Set-of-Marks 编号图，
@@ -27,7 +37,7 @@
 
 市场收录同步后，搜索 **computer-use**，选择 **dsh-codex-style-computer-use**，作者 **ltmroberthk915**（npm 维护者 **ltmroberthk**），点击**安装**。以后通过市场的**更新**或**全部更新**安装符合宿主发布策略的版本。两份原生组件都已随包提供，无需 PowerShell 7、SDK 或构建白名单。
 
-目录尚未同步时，可在 **设置 → 插件 → 添加插件** 输入 `dsh-codex-style-computer-use`。默认非严格 pnpm 11.7.0 配置可以直接安装这个已发布的包；宿主显式启用严格策略时，才可能需要按下节等待冷却。首次新增 bundle 在官方桌面端可热加载；确认工具与 skill 已出现即可使用。替换已经加载的版本、客户端界面未刷新或界面明确提示 **restart-required / 需要重启** 时，再从托盘完整退出 DSH 并重新打开。
+目录尚未同步时，在 **设置 → 插件 → 添加插件** 输入修复版 **`dsh-codex-style-computer-use@1.2.1`**。正式标签提升前，省略版本号仍会装到 1.2.0。这里填 npm 包名即可；填写 GitHub 仓库网址会转为下载源码，容易受 GitHub 下载线路影响。默认非严格 pnpm 11.7.0 配置可以直接安装 1.2.1；宿主显式启用严格策略时，才可能需要等待冷却。首次新增 bundle 在官方桌面端可热加载；确认工具与 skill 已出现即可使用。替换已经加载的版本、客户端界面未刷新或界面明确提示 **restart-required / 需要重启** 时，再从托盘完整退出 DSH 并重新打开。
 
 ### 发布未满 24 小时
 

package/lib/approval-attribution.js

@@ -0,0 +1,39 @@
+// Compatibility with hosts that conflate policy refusals and answerer refusals.
+// Delegate first so the host still owns every approval and durable audit pair.
+export function installApprovalAttribution (ctx, log) {
+  const tools = ctx.get('tools')
+  const original = tools?.serviceAsk
+  if (typeof original !== 'function') {
+    log.warn('approval attribution: host compatibility seam unavailable')
+    return
+  }
+  const ownDescriptor = Object.getOwnPropertyDescriptor(tools, 'serviceAsk')
+  const wrapped = async function (exec, ask) {
+    let policy
+    if (exec?.name?.startsWith('computer_') && exec.agent) {
+      const approval = this.ctx?.get?.('approval')
+      if (typeof approval?.effectivePolicy === 'function') policy = approval.effectivePolicy(exec.agent.session)
+    }
+    const result = await original.call(this, exec, ask)
+    // Newer/fixed hosts already provide their own reason. Only repair the exact
+    // known legacy attribution; never reinterpret cancellation or a grant.
+    if (!exec?.name?.startsWith('computer_') || result?.decision?.kind !== 'deny' ||
+        result.decision.reason !== `the user rejected tool "${exec.name}"`) return result
+    const reason = (policy === 'never'
+      ? `tool "${exec.name}" requires approval, but approval prompts are disabled in this session (approval policy: never); the request was automatically rejected without asking the user`
+      : `approval for tool "${exec.name}" was rejected by the approval channel`) +
+      (ask?.reason ? `; approval required because: ${ask.reason}` : '')
+    return { ...result, decision: { ...result.decision, reason } }
+  }
+  ctx.effect(() => {
+    tools.serviceAsk = wrapped
+    return () => {
+      // Cordis returns a traced callable on get(); compare the stored method,
+      // not that newly created callable, to identify our own replacement.
+      if (Object.getOwnPropertyDescriptor(tools, 'serviceAsk')?.value !== wrapped) return
+      if (ownDescriptor) Object.defineProperty(tools, 'serviceAsk', ownDescriptor)
+      else delete tools.serviceAsk
+    }
+  })
+  log.info('approval attribution: installed for computer-use; host approvals and audit retained')
+}

package/lib/index.js

@@ -1,4 +1,5 @@
 import { installHumanAttention } from './attention.js'
+import { installApprovalAttribution } from './approval-attribution.js'
 // dsh-computer-use — DSH Cordis plugin
 //
 // Native DSH integration for computer use. Mirrors the @anweat/dsh-browser
@@ -438,6 +439,7 @@ export function apply (ctx, config) {
     return
   }
   if (!config.enabled) return
+  installApprovalAttribution(ctx, log)
   registerBundledSkill(ctx, log)
   raiseHuman = enableHumanAttention(ctx, log)
   // THE QUESTION SERVICE, INJECTED LAZILY (merge-design.md §5.3 item 16 — defence in depth).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-codex-style-computer-use",
-  "version": "1.2.1",
+  "version": "1.2.3",
   "description": "Codex-style Computer Use for DeepSeek Harness: Windows desktop control, screenshots, UI Automation, human input handoff, approval gates and prebuilt native workers. Install and update from dsh-market without PowerShell 7 or build steps.",
   "type": "module",
   "main": "lib/index.js",

package/scripts/patch-approval-attribution.mjs

@@ -0,0 +1,86 @@
+import fs from 'node:fs'
+import path from 'node:path'
+import { createHash } from 'node:crypto'
+import { fileURLToPath } from 'node:url'
+
+const automaticReason = 'the request was automatically rejected without asking the user'
+const channelReason = 'was rejected by the approval channel'
+
+function replaceOnce (source, before, after) {
+  if (source.split(before).length !== 2) throw new Error('Unsupported DSH tools source: missing or ambiguous patch anchor')
+  return source.replace(before, after)
+}
+
+/** Patch the compiled DSH 0.2.1-rc.2 tool runtime; policy and audit stay unchanged. */
+export function patchApprovalAttribution (source) {
+  const start = source.indexOf('\tasync serviceAsk(exec, ask) {')
+  const end = source.indexOf('\n\t/**', start)
+  if (start < 0 || end < start) throw new Error('Unsupported DSH tools source: serviceAsk not found')
+  const method = source.slice(start, end)
+  const originalReason = '\t\t\t\t\treason: `the user rejected tool "${exec.name}"`'
+  if (method.includes(automaticReason) && method.includes(channelReason) &&
+      method.includes('const approvalPolicy = approval.effectivePolicy(exec.agent.session);') &&
+      !method.includes(originalReason)) return { source, changed: false }
+  let patched = replaceOnce(method,
+    '\t\tconst outcome = await approval.request({',
+    '\t\tconst approvalPolicy = approval.effectivePolicy(exec.agent.session);\n\t\tconst outcome = await approval.request({')
+  patched = replaceOnce(patched, originalReason,
+    '\t\t\t\t\treason: (approvalPolicy === "never"\n' +
+    '\t\t\t\t\t\t? `tool "${exec.name}" requires approval, but approval prompts are disabled in this session (approval policy: never); the request was automatically rejected without asking the user`\n' +
+    '\t\t\t\t\t\t: `approval for tool "${exec.name}" was rejected by the approval channel`) + (ask.reason ? `; approval required because: ${ask.reason}` : "")')
+  // Replace the obsolete attribution comment; this also keeps the verified
+  // compiled module small enough for a separate fixed-layout ASAR deployment.
+  const docStart = source.lastIndexOf('\t/**\n\t* Resolve an `ask` decision', start)
+  if (docStart < 0) throw new Error('Unsupported DSH tools source: expected serviceAsk documentation')
+  const doc = '\t/**\n\t* Resolve asks through approval, retaining fail-closed behavior.\n\t* Snapshot policy before requesting: the never policy skips all answerers.\n\t* A channel rejection alone does not identify a human as its source.\n\t*/\n'
+  return { source: source.slice(0, docStart) + doc + patched + source.slice(end), changed: true }
+}
+
+/** Preserve the original UTF-8 byte length, using trailing whitespace only. */
+export function fixedLengthPayload (original, patched) {
+  const size = Buffer.byteLength(original)
+  const content = Buffer.from(patched)
+  if (content.length > size) throw new Error('Patched source exceeds the original byte length')
+  const output = Buffer.alloc(size, 0x20)
+  content.copy(output)
+  if (content.length < size) output[output.length - 1] = 0x0a
+  return output
+}
+
+function main (args) {
+  let input, output, fixedLength = false
+  for (let i = 0; i < args.length; i++) {
+    if (args[i] === '--input' || args[i] === '--output') {
+      const option = args[i], value = args[++i]
+      if (!value || value.startsWith('--')) throw new Error(`Missing value for ${option}`)
+      if (option === '--input') {
+        if (input) throw new Error('Duplicate --input')
+        input = path.resolve(value)
+      } else {
+        if (output) throw new Error('Duplicate --output')
+        output = path.resolve(value)
+      }
+    } else if (args[i] === '--fixed-length') fixedLength = true
+    else throw new Error(`Unknown option: ${args[i]}`)
+  }
+  if (!input) throw new Error('Usage: node scripts/patch-approval-attribution.mjs --input <extracted dsh-tools/lib/index.js> [--output <new file>] [--fixed-length]')
+  if (output === input) throw new Error('--output must be a new file; installation replacement is a separate step')
+  const original = fs.readFileSync(input, 'utf8')
+  const patch = patchApprovalAttribution(original)
+  const payload = fixedLength ? fixedLengthPayload(original, patch.source) : Buffer.from(patch.source)
+  if (output) fs.writeFileSync(output, payload, { flag: 'wx' })
+  const hash = bytes => createHash('sha256').update(bytes).digest('hex')
+  console.log(JSON.stringify({
+    status: patch.changed ? 'patched' : 'already-patched',
+    preview: !output,
+    originalBytes: Buffer.byteLength(original), patchedBytes: payload.length,
+    originalSha256: hash(Buffer.from(original)), patchedSha256: hash(payload),
+  }, null, 2))
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  try { main(process.argv.slice(2)) } catch (error) {
+    console.error(error.message)
+    process.exitCode = 1
+  }
+}

package/scripts/verify-package.mjs

@@ -22,7 +22,7 @@ for (const [source, binary] of [
   assert.equal(manifest.platform, 'win32')
   assert.equal(manifest.architecture, 'x64')
 }
-for (const file of ['lib/index.js', 'lib/core/native-runtime.js', 'lib/attention-native.js', 'skills/computer-use/SKILL.md', 'mcp/src/index.js']) assert(fs.existsSync(path.join(root, file)), file)
+for (const file of ['lib/index.js', 'lib/approval-attribution.js', 'lib/core/native-runtime.js', 'lib/attention-native.js', 'skills/computer-use/SKILL.md', 'mcp/src/index.js']) assert(fs.existsSync(path.join(root, file)), file)
 const attention = fs.readFileSync(path.join(root, 'lib/attention-native.js'), 'utf8')
 assert(attention.includes("'./core/native-runtime.js'"), 'attention helper must use the bundled core')
 console.log(`ok package: ${pkg.name}@${pkg.version}; prebuilt helpers verified; no install hooks`)