dsh-codex-style-computer-use 1.3.1 → 2.0.0

package/README.md

@@ -9,7 +9,7 @@ English | [中文](README.zh.md) · [Install](#install-and-update-in-dsh-market)
 ![Codex-style Windows desktop control: observe, act, verify](docs/images/01-codex-style.png)
 
 - **See the target. Take the action.** Combine screenshots, UI Automation and numbered targets with mouse, keyboard, drag, scroll and window tools.
-- **Take over. Let the agent wait. Hand back and continue.** Version 1.3.0 adds a 1.5-second notice before input. Use your computer normally outside actual actuation; after handback, the agent re-observes and resumes the original task.
+- **Take over. Let the agent wait. Hand back and continue.** Version 2.0.0 shows a 1-second notice before input, or 0.1 second when the previous notice was less than 3 minutes ago. After handback, the agent re-observes and resumes the original task.
 - **Fewer round trips. More efficient token use.** Incremental control observations, cropped or downsampled screenshots and batches of known actions reduce repeated context and model calls.
 
 ![Human handoff: prepare, take over, continue](docs/images/02-handoff.png)
@@ -18,12 +18,12 @@ English | [中文](README.zh.md) · [Install](#install-and-update-in-dsh-market)
 
 These are **1.3.0 feature illustrations**. Actual token use depends on the task, model and observation strategy. Approvals remain enabled by default; explicit pause, cancellation and exit remain authoritative.
 
-**Ready to install.** 18 desktop tools, with native helpers included. No SDK or install-time compilation. Requires Windows, Node.js ≥ 22 and the .NET Framework 4.x included with Windows. An independent community plugin; Codex describes the interaction style.
+**Ready to install.** 19 desktop tools, with native helpers included. No SDK or install-time compilation. Requires Windows, Node.js ≥ 22 and the .NET Framework 4.x included with Windows. An independent community plugin; Codex describes the interaction style.
 
 <details>
 <summary>Current release and compatibility</summary>
 
-**1.3.1** is the current release on npm's `latest` channel: `dsh-codex-style-computer-use@1.3.1`. It adds worker-side OCR with per-word coordinates, change/caret-aware waits, UAC and lock-screen awareness with automatic continuation, and IME-safe clipboard text. Follow the host's restart indication when updating a loaded version. See [1.3.1](docs/RELEASE-1.3.1.md) and [GitHub Releases](https://github.com/ltmroberthk915/dsh-computer-use/releases).
+**2.0.0** is the new major release, initially distributed on npm `next` while the 24-hour release gate runs. See [2.0.0 changes and migration](docs/RELEASE-2.0.0.md). Check registry tags for current stable availability.
 
 Version 1.3.1 reads text from the screen by name, notices the Windows secure desktop and resumes on its own, and keeps every colour on the same DPI-derived edge rail with a visible breathing floor. Version 1.3.0 releases desktop control when work ends while the chat continues.
 
@@ -33,6 +33,12 @@ Earlier fixes: [1.2.3 approval attribution](docs/RELEASE-1.2.3.md) · [1.2.1 nat
 
 ## What it does
 
+Version 2.0.0 also uses a compact blue kite pointer during AI operation and scene hold. Its tilted tip marks the click point, with small text/resize symbols inside the kite. A breathing kite means the page and pointer position should stay in place; free mode restores the application's normal cursor. The user's Windows cursor theme is preserved.
+
+Version 2.0.0 bounds UIA traversal and defaults to compact post-action text. Existing image feedback remains available; `feedback: compact|full|none` controls detail, and click `verificationRegion: "x,y,w,h"` names the expected effect area independently of the input point. Compact text normally adds at most 6 KiB to the original action receipt. Complete point evidence can be retained in a bounded, expiring local cache and retrieved on demand. Disk failure falls back to bounded memory; if no retrievable snapshot can be retained, the current evidence is returned inline in full, outside that compact budget, without another observation or input.
+
+Filtered UIA queries require `hwnd`. Defaults are depth 6, 120 nodes and a 1200 ms soft budget. A query deeper than 6 or larger than 300 nodes requires a measured `anchor:"x,y"` in that window; an exact `id` does not bypass this rule. A provider call can exceed the soft budget, and partial results cannot establish absence or uniqueness. After a window-management shortcut, inspect `computer_state {windows:true}`, activate the intended window successfully, then observe it before more keyboard input.
+
 - **Observe** — window list, screenshots (region / JPEG / PNG / downscaled), a Set-of-Marks map of
   clickable elements, and the UI Automation tree with exact `AutomationId`s.
 - **Act** — click, move, drag, scroll, select a text range, type, press keys, and drive controls
@@ -44,9 +50,10 @@ Earlier fixes: [1.2.3 approval attribution](docs/RELEASE-1.2.3.md) · [1.2.1 nat
 - **A human brake that reaches the model** — a stop is pushed into the running session, so the agent
   learns it was interrupted instead of discovering it on the next turn.
 
-The tools read the desktop; they do not read your files. The only file the plugin writes on its own
-is the Worker binary in `%LOCALAPPDATA%\dsh-computer-use\worker\`, plus the audit log and screenshots
-under `$DSH_HOME/data/computer-use/`.
+The tools observe the desktop rather than crawl user documents. The plugin manages native helpers in
+`%LOCALAPPDATA%\dsh-computer-use\worker\`, and audit logs, screenshots and its own bounded
+`observation-cache` under `$DSH_HOME/data/computer-use/`. `computer_ctrl {action:"clear_cache"}` clears
+this Agent's observation cache; it does not delete screenshots, attachments or user documents.
 
 ## Install and update in dsh-market
 
@@ -112,9 +119,9 @@ The configured GLM 5.3 Max, GLM 5.3 Flash and DeepSeek Flash routes passed a con
 
 ## On-demand controls in 1.1
 
-- **Per-Agent tools:** idle Agents see `computer_use_activate`, `computer_ctrl` and `computer_ask`. A successful computer-use skill load, receipt or activation exposes the 18 existing tools plus the activation entry to that Agent. Other Agents and children activate independently. Native calls and Node `run_code` are supported. Activation does not start control or release a human brake.
+- **Per-Agent tools:** idle Agents see `computer_use_activate`, `computer_ctrl` and `computer_ask`. A successful computer-use skill load, receipt or activation exposes the 19 desktop tools plus the activation entry to that Agent. Other Agents and children activate independently. Native calls and Node `run_code` are supported. Activation does not start control or release a human brake.
 - **Observed UIA targets:** a scoped name/id query returns an opaque target handle. Use it for pattern actions; opt-in `rebind:true` allows unique identity or semantic recovery after replacement in the same window. Changed context, ambiguity and incomplete scans refuse. Broad queries skip recovery handles unless `targets:true`; creating witnesses for a large list costs extra native work.
-- **Incremental observations:** pass the previous observation ID as `since` with the same query. Deltas preserve additions, changes, removals and ordering. Each Agent retains 64 complete snapshots; `snapshot` retrieves an exact historical result. Missing bases, changed scope, incomplete evidence or a larger delta fall back to full output.
+- **Incremental observations:** pass the previous observation ID as `since` with the same query. Deltas preserve additions, changes, removals and ordering. Snapshots are isolated by Agent, with at most 64 indexed observations and 4 MiB of retained JSON per store. `snapshot` retrieves a retained historical result; `offset` and `limit` page its arrays. Missing bases, changed scope, incomplete evidence or a larger delta fall back to full output.
 
 See [the detailed protocol](skills/computer-use/references/progressive-control.md) for cache limits and recovery boundaries. UIA snapshots preserve provider-returned fields within existing provider limits; historical retrieval is not fresh outcome verification.
 
@@ -123,7 +130,7 @@ See [the detailed protocol](skills/computer-use/references/progressive-control.m
 | Group | Tools |
 |---|---|
 | Activate | `computer_use_activate` |
-| Observe | `computer_state` `computer_shot` `computer_marks` `computer_uia` |
+| Observe | `computer_state` `computer_shot` `computer_ocr` `computer_marks` `computer_uia` |
 | Act | `computer_click` `computer_move` `computer_drag` `computer_scroll` `computer_select` `computer_key` `computer_type` `computer_uia_act` `computer_window` `computer_clip` |
 | Flow | `computer_wait` `computer_batch` |
 | Meta | `computer_ask` `computer_ctrl` |
@@ -166,7 +173,9 @@ fields are detected through UI Automation's `IsPassword` and refused by default.
 | Key | Default | Meaning |
 |---|---:|---|
 | `automationMode` | `standard` | approval mode (above) |
-| `progressiveTools` | `true` | per-Agent activation; `false` keeps the original 18 global tools |
+| `progressiveTools` | `true` | per-Agent activation; `false` exposes the 19 desktop tools globally |
+| `actionFeedback` | `true` | automatically observe after direct actions and batches |
+| `actionFeedbackDetail` | `compact` | `compact`, `full` or `none`; a call's `feedback` overrides this default; uncached evidence falls back to full inline output |
 | `dryRun` | `false` | simulate actuations, log only |
 | `maxActionsPerMinute` | `60` | core-level actuation rate limit |
 | `annotateMarks` | `true` | draw Set-of-Marks boxes on screenshots |
@@ -182,6 +191,19 @@ than Cordis:
 node mcp/src/index.js
 ```
 
+The embedded server reports the version of this root package. It starts with observation only.
+The launching host may set `DSH_CU_ALLOW_INPUT=1` when it owns authorization for desktop actions;
+MCP tool calls cannot enable input. The compatibility tool `cu_approve` only reports this rule and
+never grants consent. DSH's `automationMode` policy belongs to the Cordis adapter and is not an
+MCP approval service. `DSH_CU_DRY_RUN=1` simulates input that the host has already enabled.
+
+Both adapters use the same key-command grammar, batch failure and continuation rules, and image
+coordinate mapping. MCP returns structured capture metadata and one latest PNG/JPEG image, without
+serializing image bytes into JSON text. `cu_hold` / `cu_free` reserve or release the scene between
+actions; `cu_release` ends the desktop cycle. `cu_drag` accepts `expectCursor` and `hwnd` checks.
+MCP exposes a smaller tool surface; DSH-specific human-question and host-lifecycle integration are
+provided by the Cordis adapter.
+
 ## Development
 
 Publisher release checks use npm's official registry by default. If that origin is unreachable on your network, `CU_REGISTRY` selects an explicit mirror for the read-only `check` command; the JSON result includes `registry` and `authoritative`. Example in PowerShell (this changes only the current shell):

package/README.zh.md

@@ -9,7 +9,7 @@
 ![Codex 风格 Windows 桌面操控：观察、操作、验证](docs/images/01-codex-style.png)
 
 - **看得准，也点得动。** 截图、控件树与编号定位配合使用，支持点击、输入、拖拽、滚动和窗口操作。
-- **你接手，AI 等待，再接着做。** 1.3.0 提供 1.5 秒操作预告；非实际操控期间正常使用电脑，交回后重新观察并接续原任务。
+- **你接手，AI 等待，再接着做。** 2.0.0首次操作预告倒计时 1 秒；距上次提示不足 3 分钟时为 0.1 秒。交回后重新观察并接续原任务。
 - **更少往返，更省 Token。** 控件增量观察、区域与降采样截图，加上连续动作批量执行，减少重复观察和模型往返。
 
 ![人工接管与续接：先提醒、可接管、再继续](docs/images/02-handoff.png)
@@ -18,12 +18,12 @@
 
 上图为 **1.3.0 功能示意**。实际 Token 用量取决于任务、模型和观察方式。默认保留操作审批；明确暂停、取消和退出始终有效。
 
-**安装即用。** 18 个桌面工具，原生组件随包提供，无需 SDK 或安装时编译。支持 Windows、Node.js ≥ 22 和系统自带的 .NET Framework 4.x。独立社区插件；Codex 用于说明交互风格。
+**安装即用。** 19 个桌面工具，原生组件随包提供，无需 SDK 或安装时编译。支持 Windows、Node.js ≥ 22 和系统自带的 .NET Framework 4.x。独立社区插件；Codex 用于说明交互风格。
 
 <details>
 <summary>当前版本与兼容性</summary>
 
-**1.3.1** 是 npm `latest` 频道的当前版本：`dsh-codex-style-computer-use@1.3.1`。新增 worker 侧 OCR（逐词坐标）、可定位变化与识别光标闪烁的等待、UAC/锁屏感知与自动续接、以及绕过 IME 的剪贴板文本通道。更新已加载的旧版本后，按宿主提示重启。详见 [1.3.1](docs/RELEASE-1.3.1.md) 与 [GitHub Releases](https://github.com/ltmroberthk915/dsh-computer-use/releases)。
+**2.0.0** 为本次大版本，先发布至 npm `next`，通过仓库规定的 24 小时成熟期后再升稳定频道。详见 [2.0.0 变更与迁移](docs/RELEASE-2.0.0.md)，稳定版以 registry 标签为准。
 
 1.3.1 可直接从屏幕读字定位控件，察觉 Windows 安全桌面并在其结束后自动续接；所有颜色共用同一条按 DPI 换算的边缘光环，呼吸谷值保持可见。1.3.0 起工具用完可主动释放，聊天继续；正常收尾自动退出。
 
@@ -33,6 +33,12 @@
 
 ## 它能做什么
 
+2.0.0在 AI 操作和保留现场时使用小巧的蓝色风筝光标：倾斜的尖端就是点击位置，文本、缩放等提示收在风筝中央。呼吸状态表示仍需保持页面与鼠标位置；放开现场后恢复应用原来的鼠标。Windows 鼠标主题保持原样。
+
+2.0.0进一步收紧 UIA 查询范围，并默认精简动作后的文字反馈；视觉模型仍保留原有图片检查。调用可用 `feedback: compact|full|none`，点击可用 `verificationRegion: "x,y,w,h"` 指定真正的结果区域。正常精简反馈在原动作回执之外最多增加 6 KiB 文字。完整点查证据可留在有容量与期限限制的本地缓存，按需读快照。磁盘失败先回退有界内存；如果无法保留可回读的快照，则直接完整返回已有证据，此时不受精简文字预算限制，不重复查询或操作。
+
+带过滤条件的 UIA 查询必须指定 `hwnd`，默认深度 6、最多 120 节点和 1200 毫秒软预算。深度大于 6 或节点上限大于 300 时，须提供该窗口内已测量的 `anchor:"x,y"`；精确 `id` 也不豁免。单次提供器调用可能超过软预算，部分结果不能证明目标不存在或唯一。窗口管理快捷键后，先用 `computer_state {windows:true}` 查看窗口，再成功激活目标并重新观察，随后才能继续键盘输入。
+
 - **观察** —— 窗口列表、截图（区域 / JPEG / PNG / 降采样）、可点元素的 Set-of-Marks 编号图，
   以及带精确 `AutomationId` 的 UI Automation 树。
 - **操作** —— 点击、移动、拖拽、滚动、选中文本区间、键入、按键，并可走控件**自身的 UI
@@ -42,8 +48,7 @@
 - **能传到模型的人为刹车** —— 停止事件被推入正在运行的会话，agent 当场知道自己被打断，
   而不是等到下一轮才发现。
 
-工具读的是桌面，不读你的文件。插件自己只写三处：worker 二进制
-（`%LOCALAPPDATA%\dsh-computer-use\worker\`）、审计日志与截图（`$DSH_HOME/data/computer-use/`）。
+工具观察桌面，不遍历用户文档。插件管理原生组件（`%LOCALAPPDATA%\dsh-computer-use\worker\`），以及 `$DSH_HOME/data/computer-use/` 下的审计日志、截图和自有 `observation-cache` 有界缓存。`computer_ctrl {action:"clear_cache"}` 只清理本 Agent 的观察缓存，不删除截图、附件或用户文档。
 
 ## 在 dsh-market 安装和更新
 
@@ -108,9 +113,9 @@ $CuDshInstall = Join-Path $env:LOCALAPPDATA 'Programs\DeepSeek Harness'
 
 ## 1.1 的按需控制
 
-- **按 Agent 加载：**未激活时暴露 `computer_use_activate`、`computer_ctrl`、`computer_ask`。成功读取 computer-use skill、确认规程或调用激活入口后，该 Agent 获得原有 18 个工具，加入口共 19 个。其他 Agent 和子 Agent 独立启用，支持原生调用和 Node `run_code`。激活本身不启动控制，也不释放人为刹车。
+- **按 Agent 加载：**未激活时暴露 `computer_use_activate`、`computer_ctrl`、`computer_ask`。成功读取 computer-use skill、确认规程或调用激活入口后，该 Agent 获得 19 个桌面工具，加入口共 20 个。其他 Agent 和子 Agent 独立启用，支持原生调用和 Node `run_code`。激活本身不启动控制，也不释放人为刹车。
 - **已观察的 UIA 目标：**指定窗口和 name/id 的聚焦查询默认生成 target 句柄。控件重建时，显式 `rebind:true` 才允许在同一窗口内进行唯一身份或语义匹配。上下文变化、歧义、扫描不完整时拒绝动作。宽查询需 `targets:true` 才生成恢复句柄，避免普通观察承担额外开销。
-- **增量观察：**重复相同查询并传入上一 observation 的 `since`，返回新增、变化、删除及顺序信息。每 Agent 保留最近 64 份完整快照，`snapshot` 可取回确切的历史结果。缺少基线、范围变化、证据不完整或增量更大时自动回退全量。
+- **增量观察：**重复相同查询并传入上一 observation 的 `since`，返回新增、变化、删除及顺序信息。快照按 Agent 隔离，每个 store 总计最多索引 64 份观察、在内存保留 4 MiB JSON。`snapshot` 可取回仍保留的历史结果，`offset` 和 `limit` 可分页读取数组。缺少基线、范围变化、证据不完整或增量更大时自动回退全量。
 
 保留的是提供器实际返回的完整字段，沿用原有提供器限制；历史快照不代替动作后的新验证。缓存上限和恢复边界见[详细协议](skills/computer-use/references/progressive-control.md)。
 
@@ -119,7 +124,7 @@ $CuDshInstall = Join-Path $env:LOCALAPPDATA 'Programs\DeepSeek Harness'
 | 分组 | 工具 |
 |---|---|
 | 激活 | `computer_use_activate` |
-| 观察 | `computer_state` `computer_shot` `computer_marks` `computer_uia` |
+| 观察 | `computer_state` `computer_shot` `computer_ocr` `computer_marks` `computer_uia` |
 | 操作 | `computer_click` `computer_move` `computer_drag` `computer_scroll` `computer_select` `computer_key` `computer_type` `computer_uia_act` `computer_window` `computer_clip` |
 | 流程 | `computer_wait` `computer_batch` |
 | 元 | `computer_ask` `computer_ctrl` |
@@ -157,7 +162,9 @@ ID**：派发输入前会核对窗口身份与采样像素，因此过期的 mar
 | 键 | 默认 | 含义 |
 |---|---:|---|
 | `automationMode` | `standard` | 审批模式（见上） |
-| `progressiveTools` | `true` | 按 Agent 激活；设为 `false` 可保留原有 18 个全局工具 |
+| `progressiveTools` | `true` | 按 Agent 激活；设为 `false` 全局暴露 19 个桌面工具 |
+| `actionFeedback` | `true` | 直接动作及批处理后自动观察 |
+| `actionFeedbackDetail` | `compact` | `compact`、`full` 或 `none`；单次调用的 `feedback` 可覆盖默认值；无法缓存时完整内联返回证据 |
 | `dryRun` | `false` | 只模拟操作并记录 |
 | `maxActionsPerMinute` | `60` | 核心层操作限速 |
 | `annotateMarks` | `true` | 在截图上绘制 Set-of-Marks 方框 |
@@ -172,6 +179,16 @@ ID**：派发输入前会核对窗口身份与采样像素，因此过期的 mar
 node mcp/src/index.js
 ```
 
+该入口随根包发布，运行时报告根包版本；默认只能观察桌面。启动它的宿主在负责桌面操作授权时，
+可以设置 `DSH_CU_ALLOW_INPUT=1`。模型调用工具不能开启输入：兼容工具 `cu_approve` 只说明授权来源，
+不会授予同意。DSH 的 `automationMode` 属于 Cordis 入口，不是 MCP 的审批服务。
+`DSH_CU_DRY_RUN=1` 只模拟已由宿主启用的输入。
+
+两个入口共享按键规范化、批次失败与接管后续行语义，以及图像坐标换算。MCP 保留截图时间、光标、
+稳定性和区域元数据，只附最后一张 PNG/JPEG，不把图像字节重复塞进 JSON。`cu_hold` / `cu_free`
+用于操作间保护或放开现场，`cu_release` 结束桌面周期；`cu_drag` 支持 `expectCursor` 与 `hwnd` 校验。
+MCP 工具范围较小，DSH 的人类提问和宿主生命周期集成仍由 Cordis 入口提供。
+
 ## 开发
 
 发布者检查默认查询 npm 官方源。若本地无法访问，可用 `CU_REGISTRY` 为只读的 `check` 命令指定镜像；JSON 输出会注明 `registry` 和 `authoritative`。PowerShell 示例（只影响当前终端）：

package/lib/audit.js

@@ -28,3 +28,10 @@ export function appendAudit (dataDir, rec) {
     appendFileSync(join(dataDir.root, 'audit.jsonl'), JSON.stringify(rec) + '\n')
   } catch { /* audit must never break the action */ }
 }
+
+export function installAudit (cu, dataDir) {
+  const events = ['action', 'action:settled', 'handoff-wait']
+  const write = record => appendAudit(dataDir, record)
+  for (const event of events) cu.on(event, write)
+  return () => { for (const event of events) cu.off(event, write) }
+}

package/lib/batch.js

@@ -1,32 +1,21 @@
 // Serial execution and observation selection; no desktop or lifecycle side effects here.
 import { handoffResult } from './continuation.js'
-const reads = new Set(['computer_state', 'computer_uia', 'computer_marks', 'computer_shot', 'computer_wait'])
-const isRead = (step) => reads.has(step?.tool) || (step?.tool === 'computer_clip' && step.args?.text === undefined)
-const isReadback = (step) => ['computer_state', 'computer_uia', 'computer_marks', 'computer_shot'].includes(step.tool) ||
-  (step.tool === 'computer_clip' && step.args?.text === undefined)
-
-export function actionRefusal (step, result) {
-  if (result?.ok === false || result?.success === false) return result.error || 'action reported failure'
-  if (step.tool === 'computer_window' && (step.args?.op || 'activate') === 'activate' && result?.activated !== true) {
-    return 'target window activation was not confirmed; subsequent actions were not dispatched'
-  }
-  if (step.tool === 'computer_ctrl' && step.args?.action === 'recover' && result?.recovered !== true) return result.reason || 'temporary pause recovery refused'
-  if (step.tool === 'computer_ctrl' && step.args?.action === 'release' && !result?.released && !result?.alreadyReleased) return result.reason || 'cycle release refused'
-  return null
-}
+import { actionRefusal, actionError, isReadStep as isRead, isReadbackStep as isReadback, endsBatch } from './tool-contract.js'
+export { actionRefusal } from './tool-contract.js'
 
 export async function runBatch ({ steps, handlers, signal, stopped, screenshot, shot = 'auto', exec, assertOwnership }) {
   if (!Array.isArray(steps) || !['auto', 'always', 'never'].includes(shot)) throw new Error('invalid batch actions or shot mode')
   const actions = []
   let failed = false
   let continuation = null
+  let endedBy = null
   for (const step of steps) {
     const name = step?.tool
     if (failed || signal?.aborted) {
       actions.push({ tool: name || '', ok: false, outcome: 'not-dispatched',
         ...(continuation && !signal?.aborted
           ? { status: 'deferred', message: 'Resume this unfinished step after fresh target evidence; the original task must continue.' }
-          : { error: signal?.aborted ? 'cancelled' : 'earlier action failed' }) })
+          : { error: signal?.aborted ? 'cancelled' : endedBy ? 'batch ended by control action' : 'earlier action failed' }) })
       failed = true
       continue
     }
@@ -38,22 +27,28 @@ export async function runBatch ({ steps, handlers, signal, stopped, screenshot,
       const result = await fn(step.args || {}, exec)
       const refusal = actionRefusal(step, result)
       actions.push({ tool: name, ok: !refusal, result, ...(refusal ? { error: refusal } : {}) })
-      failed = !!refusal || (!stoppedBefore && stopped()) ||
-        (name === 'computer_ctrl' && ['stop', 'exit', 'release'].includes(step.args?.action))
+      if (result?.taskStatus === 'continuing' && result.continuation?.required && !signal?.aborted && !stopped()) {
+        const nestedPath = result.continuation.resumeActionPath || [result.continuation.resumeFromActionIndex]
+        continuation = { ...result.continuation, resumeFromActionIndex: actions.length - 1,
+          resumeActionPath: [actions.length - 1, ...nestedPath.filter(Number.isInteger)] }
+      }
+      if (endsBatch(step)) endedBy = { tool: name, action: step.args?.action || name.replace(/^cu_/, '') }
+      else if (result?.endedBy) endedBy = result.endedBy
+      failed = !!refusal || !!continuation || (!stoppedBefore && stopped()) || !!endedBy
     } catch (error) {
       const checkpoint = !signal?.aborted && !stopped() ? handoffResult(error) : null
       if (checkpoint) {
         continuation = { ...checkpoint.continuation, resumeFromActionIndex: actions.length }
         actions.push({ tool: name, ...checkpoint, continuation })
       } else {
-        actions.push({ tool: name, ok: false, error: String(error.message || error),
-          code: error.code || 'action-error', outcome: error.outcome || 'unknown' })
+        actions.push({ tool: name, ...actionError(error) })
       }
       failed = true
     }
   }
   const needsShot = shot === 'always' || (shot === 'auto' && steps.some(s => !isRead(s)) && !isReadback(steps.at(-1) || {}))
   const result = { actions, attachedShot: null }
+  if (endedBy) result.endedBy = endedBy
   if (continuation) Object.assign(result, {
     status: 'continuation-required', taskStatus: 'continuing', transient: true, continuation,
   })

package/lib/bin/attention-worker.exe.json

@@ -3,5 +3,5 @@
   "platform": "win32",
   "architecture": "x64",
   "sourceSha256": "6e17308fc1cb0de1ece6f3164866b6de03ecdf74a42a6e78c0a8e6d02912c3bf",
-  "binarySha256": "f39e79148d0f1c8fa527f55607eb4e7440e82c3ab5b33162bde773528418fe5a"
+  "binarySha256": "897c8dfd1ef2c0722105311d4775241999fab42d77a0ed1ecfc95ae290bf456f"
 }

package/lib/compact-feedback.js

@@ -0,0 +1,175 @@
+// Small post-action evidence, shared by host/MCP adapters. Never dispatches input,
+// retries a read, inventories a UIA tree, or changes the original action receipt.
+export const COMPACT_FEEDBACK_BYTES = 6144
+export const COMPACT_OBSERVATION_MS = 6000
+export const COMPACT_POINT_MS = 5000
+
+const finite = value => typeof value === 'number' && Number.isFinite(value)
+const bytes = value => Buffer.byteLength(JSON.stringify(value), 'utf8')
+const rectKeys = ['x', 'y', 'width', 'height']
+const windowKeys = ['hwnd', 'pid', 'process', 'title', 'class', 'active', 'minimized']
+const elementKeys = ['name', 'role', 'controlType', 'automationId', 'className', 'value', 'text', 'enabled', 'isEnabled', 'offscreen', 'isOffscreen', 'editable', 'focused', 'hasKeyboardFocus', 'selected', 'checked', 'toggleState', 'expanded', 'expandCollapseState', 'hwnd', 'pid']
+
+function point (value) {
+  if (typeof value === 'string') {
+    const parts = value.trim().split(/[,\s]+/)
+    if (parts.length !== 2 || parts.some(p => !p)) return null
+    value = { x: Number(parts[0]), y: Number(parts[1]) }
+  }
+  return value && finite(value.x) && finite(value.y) ? { x: Math.round(value.x), y: Math.round(value.y) } : null
+}
+export function feedbackRegion (value) {
+  if (typeof value === 'string') {
+    const parts = value.trim().split(/[,\s]+/)
+    if (parts.length !== 4 || parts.some(p => !p)) return null
+    value = Object.fromEntries(rectKeys.map((k, i) => [k, Number(parts[i])]))
+  }
+  if (!value || !rectKeys.every(k => finite(value[k])) || value.width <= 0 || value.height <= 0) return null
+  return Object.fromEntries(rectKeys.map(k => [k, value[k]]))
+}
+
+// A native default verification crop is NOT authorization to narrow vision.
+// Only an explicitly requested region changes the automatic image viewport.
+export function feedbackViewport (args = {}, receipt = {}) {
+  args ||= {}; receipt ||= {}
+  const requested = (receipt.verificationSource === 'requested-region' ? feedbackRegion(receipt.verificationRegion) : null) ||
+    feedbackRegion(args.verificationRegion)
+  if (requested) return { region: rectKeys.map(k => requested[k]).join(','),
+    point: { x: Math.floor(requested.x + requested.width / 2), y: Math.floor(requested.y + requested.height / 2) }, source: 'requested-region' }
+  const actual = point(receipt)
+  if (actual) return { point: actual, source: 'action-receipt' }
+  const target = point(args.to) || point(args.at)
+  if (target) return { point: { x: target.x + (finite(args.dx) ? args.dx : 0), y: target.y + (finite(args.dy) ? args.dy : 0) }, source: 'requested-point' }
+  return { source: 'no-point' }
+}
+
+function clipped (value, limit, cuts, path) {
+  const text = String(value), raw = Buffer.from(text, 'utf8')
+  if (raw.length <= limit) return text
+  let end = limit - 3
+  while (end > 0 && (raw[end] & 0xc0) === 0x80) end--
+  cuts.push(path)
+  return raw.subarray(0, end).toString('utf8') + '…'
+}
+function brief (value, keys, cuts, path, limit = 768) {
+  if (!value || typeof value !== 'object') return null
+  const result = {}
+  for (const key of keys) {
+    const item = value[key]
+    if (typeof item === 'string') result[key] = clipped(item, limit, cuts, path + '.' + key)
+    else if (typeof item === 'boolean' || finite(item) || item === null) result[key] = item
+  }
+  const rect = feedbackRegion(value.rect || value.bounds)
+  if (rect) result.rect = rect
+  return result
+}
+
+// Budget applies to the ADDED observation envelope, never to an input receipt.
+// Whole fields are omitted if needed; a truncated field is never silently complete.
+export function limitCompactFeedback (envelope, maxBytes = COMPACT_FEEDBACK_BYTES) {
+  const limit = Number.isInteger(maxBytes) && maxBytes >= 1024 ? Math.min(maxBytes, COMPACT_FEEDBACK_BYTES) : COMPACT_FEEDBACK_BYTES
+  const result = JSON.parse(JSON.stringify(envelope))
+  const omitted = []
+  const existing = result.observation?.truncatedFields || []
+  const budget = result.budget = { maxBytes: limit, returnedBytes: 0, truncated: existing.length > 0, omittedFields: omitted }
+  const fit = () => {
+    // returnedBytes is part of its own JSON; stabilize decimal width.
+    for (let i = 0; i < 4; i++) budget.returnedBytes = bytes(result)
+    return budget.returnedBytes <= limit
+  }
+  if (fit()) return result
+  for (const field of ['ancestors', 'focused', 'element', 'receiver', 'window', 'contextFromAction']) {
+    if (result.observation && Object.hasOwn(result.observation, field)) {
+      delete result.observation[field]; omitted.push('observation.' + field); budget.truncated = true
+      if (fit()) return result
+    }
+  }
+  // Unknown adapter metadata is not allowed to evade the byte contract. Retain
+  // the truth that this observation could not fit, rather than cut JSON or paths.
+  result.observation = { scope: 'compact', incomplete: true, reason: 'observation exceeded compact byte budget; request feedback full for complete readback' }
+  omitted.push('observation'); budget.truncated = true
+  if (result.feedback) result.feedback = { kind: result.feedback.kind, detail: 'compact', reason: 'bounded post-action observation' }
+  if (!fit()) {
+    for (const key of Object.keys(result)) if (!['observation', 'feedback', 'verification', 'budget'].includes(key)) delete result[key]
+    if (typeof result.verification === 'string') result.verification = clipped(result.verification, 512, omitted, 'verification')
+    fit()
+  }
+  return result
+}
+
+export async function collectCompactState (cu, { args = {}, receipt = {}, checkAllowed = () => {}, archive, now = Date.now } = {}) {
+  args ||= {}; receipt ||= {}
+  const began = now(), deadline = began + COMPACT_OBSERVATION_MS, cuts = [], failures = []
+  const observation = { scope: 'local-post-action', ts: began, elementAvailable: false }
+  const raw = { scope: 'local-post-action', ts: began }
+  let viewport = feedbackViewport(args, receipt), calls = 0
+  const read = async (op, params, cap) => {
+    checkAllowed()
+    const remaining = Math.floor(deadline - now())
+    if (remaining <= 0) throw new Error('compact observation time budget exhausted')
+    calls++
+    return cu.call(op, params, Math.min(cap, remaining))
+  }
+  if (!viewport.point) {
+    try {
+      raw.cursor = await read('cursor', {}, 1000)
+      const current = point(raw.cursor)
+      if (current) viewport = { point: current, source: 'current-cursor' }
+      else failures.push({ channel: 'cursor', error: 'cursor position unavailable' })
+    } catch (error) { failures.push({ channel: 'cursor', error: clipped(error.message || error, 320, cuts, 'errors.cursor') }) }
+  }
+  if (viewport.point) {
+    observation.point = { ...viewport.point, source: viewport.source }
+    raw.point = observation.point
+    if (viewport.source === 'action-receipt' || viewport.source === 'current-cursor') observation.cursor = { ...viewport.point, source: viewport.source }
+    try {
+      const probe = await read('uiaFromPoint', viewport.point, COMPACT_POINT_MS)
+      raw.probe = probe
+      observation.window = brief(probe.root, windowKeys, cuts, 'window', 320)
+      observation.receiver = brief(probe.receives, windowKeys, cuts, 'receiver', 320)
+      observation.element = brief(probe.element, elementKeys, cuts, 'element')
+      observation.focused = brief(probe.focused, elementKeys, cuts, 'focused', 320)
+      if (typeof probe.typingWouldReach === 'boolean') observation.typingWouldReach = probe.typingWouldReach
+      const ancestors = probe.ancestors || probe.element?.ancestors || []
+      observation.ancestors = Array.isArray(ancestors) ? ancestors.slice(0, 3).map((a, i) => brief(a, elementKeys, cuts, `ancestors.${i}`, 160)) : []
+      if (Array.isArray(ancestors) && ancestors.length > 3) cuts.push('ancestors')
+      observation.elementAvailable = !!probe.element
+      if (!probe.element) failures.push({ channel: 'uiaFromPoint', error: 'no UIA element at this point; absence does not prove task failure' })
+    } catch (error) { failures.push({ channel: 'uiaFromPoint', error: clipped(error.message || error, 320, cuts, 'errors.uiaFromPoint') }) }
+  }
+  if (!viewport.point) observation.reason = 'No action, witness-region or current-cursor point was available; no UIA tree was read.'
+  if (receipt.receiver || receipt.focus || receipt.cursor) observation.contextFromAction = {
+    source: 'action-receipt, not an independent post-action read',
+    receiver: brief(receipt.receiver, windowKeys, cuts, 'context.receiver', 160),
+    focus: brief(receipt.focus, windowKeys, cuts, 'context.focus', 160),
+    cursor: point(receipt.cursor),
+  }
+  if (failures.length) observation.errors = failures
+  if (archive && (raw.probe || raw.cursor)) {
+    try {
+      const archived = await archive({ ...raw, ...(failures.length ? { errors: failures } : {}) })
+      const snapshot = typeof archived === 'string' ? archived : archived?.snapshot || archived?.observation
+      if (typeof snapshot === 'string' && /^O[\w-]{1,127}$/.test(snapshot)) observation.snapshot = snapshot
+      const cache = archived?.cache || archived?.archive
+      if (cache && (cache.status === 'memory-only' || cache.reason || cache.fallback)) {
+        observation.cache = brief(cache, ['status', 'reason', 'fallback'], cuts, 'cache', 160)
+      }
+      if (!observation.snapshot) {
+        // Once neither disk nor memory retains the evidence, truncation would
+        // make the omitted fields irretrievable. Return the existing raw value
+        // inline without another probe, input replay, clone or disk attempt.
+        observation.cache = { status: 'uncached', reason: cache?.reason || 'cache-unavailable', fallback: 'inline' }
+        observation.inlineEvidence = raw
+      }
+    } catch (error) {
+      observation.archiveError = clipped(error.message || error, 240, cuts, 'archiveError')
+      observation.cache = { status: 'uncached', reason: 'cache-unavailable', fallback: 'inline' }
+      observation.inlineEvidence = raw
+    }
+  }
+  if (cuts.length) observation.truncatedFields = [...new Set(cuts)]
+  observation.reads = calls
+  observation.elapsedMs = Math.max(0, now() - began)
+  observation.limitations = 'A local point/focus read may miss remote or visual changes. It does not verify the task effect; use explicit UIA/visual or application readback when needed.'
+  return observation
+}

package/lib/continuation.js

@@ -1,6 +1,6 @@
 // Temporary ownership handoff is a task checkpoint, not a failed/cancelled task.
 export function handoffResult (error) {
-  if (error?.code !== 'HUMAN_REOBSERVE' || !error.continuation?.required) return null
+  if (!['HUMAN_REOBSERVE', 'WORKER_REOBSERVE'].includes(error?.code) || !error.continuation?.required) return null
   return {
     ok: false,
     status: 'continuation-required',

package/lib/core/bin/dsh-computer-use-worker.exe.json

@@ -2,6 +2,6 @@
   "format": 1,
   "platform": "win32",
   "architecture": "x64",
-  "sourceSha256": "8427a18e1f161959043f638cab821e701714f3d83138911dc9c4fb2cbeb152bf",
-  "binarySha256": "0e9212f628ebd73655de1235b3e7bb4ce176c4b60da16c336f2ebae7397084a2"
+  "sourceSha256": "a7496b49b57ca8a505ecf12abad049e9b1b5d4b70f3ae574a5b55cb3fa76bd42",
+  "binarySha256": "60bbcd1bd6638b1088e65e7b4a6e68deeecc83cb470967499ed4d9911d98c99a"
 }