dsh-codex-style-computer-use 2.0.0 → 2.2.3

package/lib/core/index.js

@@ -119,7 +119,11 @@ export class ComputerUse extends EventEmitter {
     // safety knobs (sandraschi SAFETY.md four-piece: HITL + kill switch +
     // rate limit + audit; see DESIGN §8)
     this.dryRun = opts.dryRun ?? false          // simulate actuations, log only
-    this.kickoffRequired = opts.kickoffRequired !== false // pure observation must not require focusing
+    this.kickoffRequired = opts.kickoffRequired !== false // pure observation must not require focusing
+    // ---- host-driving debug gates (lib/host-debug.js): two independent switches, both fail closed
+    this.hostDebugFile = typeof opts.hostDebugFile === 'string' ? opts.hostDebugFile : ''
+    this.hostGate = typeof opts.hostGate === 'function' ? opts.hostGate : null
+    this.onHostBlocked = typeof opts.onHostBlocked === 'function' ? opts.onHostBlocked : null
     this.rateLimit = opts.rateLimit ?? { max: 60, windowMs: 60_000 }
     this.rateWindow = []
     this.humanApproved = opts.autoApprove ?? false // gate for mutating ops
@@ -171,7 +175,8 @@ export class ComputerUse extends EventEmitter {
     this.spawnRuntime = nativeRuntimeIdentity(this.workerExe)
     const env = { ...process.env, DSH_CU_HOST_PID: String(process.pid), DSH_CU_HOST_EXE: process.execPath || '',
       DSH_CU_PACKAGE_VERSION: this.spawnRuntime.packageVersion, DSH_CU_BUILD_ID: this.spawnRuntime.buildId,
-      DSH_CU_SOURCE_HASH: this.spawnRuntime.sourceHash || '', DSH_CU_BINARY_HASH: this.spawnRuntime.binaryHash }
+      DSH_CU_SOURCE_HASH: this.spawnRuntime.sourceHash || '', DSH_CU_BINARY_HASH: this.spawnRuntime.binaryHash,
+      ...(this.hostDebugFile ? { DSH_CU_HOST_DEBUG_FILE: this.hostDebugFile } : {}) }
     this.log(`[core] host guard armed for pid ${process.pid} (${process.execPath})`)
     this.proc = spawn(this.workerExe, [], { env, windowsHide: true, stdio: ['pipe', 'pipe', 'pipe'] })
     // A CHILD THAT FAILS TO START MUST NAME ITSELF (2026-09-13). Every computer_* tool died with a
@@ -322,6 +327,8 @@ export class ComputerUse extends EventEmitter {
         msg.outcome === 'not-dispatched' ? 'not-dispatched' : 'unknown')
       if (msg.glowHealth) error.glowHealth = msg.glowHealth
       for (const key of ['dragStarted', 'expectedCursor', 'actualCursor', 'cursorCheck']) if (msg[key] !== undefined) error[key] = msg[key]
+      // A gate refusal is an ACTIONABLE state, not a crash: the settings page surfaces the last one.
+      if (/HOST_DEBUG_GATE/.test(String(error.message || ''))) { try { this.onHostBlocked?.() } catch { } }
       p.reject(error.code === 'HUMAN_REOBSERVE' ? humanReobserveError(error) : error)
     }
   }
@@ -400,7 +407,17 @@ export class ComputerUse extends EventEmitter {
     })
     // __cycle is signed last. A caller cannot forge another input series or turn.
     const signed = { ...args, __cycle: context?.internalCleanup !== true, __kickoff: this.kickoffRequired }
-    if (input) signed.__inputSeries = context?.inputSeries || randomUUID()
+    if (input) signed.__inputSeries = context?.inputSeries || randomUUID()
+    // The two host-driving gates travel with EVERY call so the worker can decide per request:
+    // gate 1 = the calling conversation is full permission, gate 2 = debug mode was switched on by
+    // hand. Both unknown/absent => false (fail closed). Tools cannot forge these: they are stamped
+    // here, after the caller's args, exactly like __cycle.
+    if (this.hostGate) {
+      let gate = null
+      try { gate = this.hostGate(context) } catch { gate = null }
+      signed.__hostDebug = !!(gate && gate.debug === true)
+      signed.__hostFull = !!(gate && gate.full === true)
+    }
     return new Promise((resolve, reject) => {
       let written = false
       const read = UIA_READS.has(op) && killOnTimeout ? (this.uiaRead = { id, child, timedOut: false }) : null
@@ -719,6 +736,11 @@ export class ComputerUse extends EventEmitter {
       x: pt.x, y: pt.y, button: opts.button || 'left', clicks: opts.clicks || 1,
       settleMs: opts.settleMs ?? 40,
       ...(witness ? { verificationRegion: witness } : {}),
+      // Embedded renderers (a WeChat article panel, an Electron child) belong to a DIFFERENT
+      // process than the window that hosts them, so the occlusion check reads them as "covered"
+      // even though the pixel is inside the app the caller activated. The worker already
+      // implements the escape hatch; forward it, or a whole class of real apps is unclickable.
+      ...(opts.allowCovered ? { allowCovered: true } : {}),
       ...((pt.expectHwnd || opts.expectHwnd) ? { expectHwnd: pt.expectHwnd || opts.expectHwnd } : {}),
     })
   }
@@ -1031,6 +1053,32 @@ export class ComputerUse extends EventEmitter {
   async ocr (region) { return this.call('ocr', region ? { ...region } : {}) }
   async clipWrite (text) { return this.actuate('clipWrite', { text }) }
 
+  /** Open an app/URL/folder/document through ShellExecute, as a real actuation: the halo,
+   *  the brake checks, the audit trail and the rate window all come from actuate() — which
+   *  is exactly why this is an op and not a Node-side spawn (see worker.cs Launch). */
+  async launch (target, opts = {}) {
+    // `args` is an ARRAY of argument values (quoted once, in the worker). Passing a ready-made
+    // command line would make the launcher parse our boundaries differently than the caller meant.
+    return this.actuate('launch', {
+      target,
+      ...(opts.args !== undefined ? { args: opts.args } : {}),
+      ...(opts.tailMs !== undefined ? { tailMs: opts.tailMs } : {}),
+    })
+  }
+
+  /** Put keyboard focus on a FIELD and prove it: clicks (x,y), then reports the UIA focused
+   *  element and whether a caret is provable there (OS caret, else a two-frame blink check).
+   *  Refuse to type when `verified` is false — typing follows the focused control, not the
+   *  window, and a document that kept focus silently swallows the text. */
+  async focusField (opts = {}) {
+    return this.actuate('focusField', {
+      x: opts.x,
+      y: opts.y,
+      ...(opts.hwnd !== undefined ? { hwnd: opts.hwnd } : {}),
+      ...(opts.verifyCaret !== undefined ? { verifyCaret: opts.verifyCaret } : {}),
+    })
+  }
+
   async activateWindow (sel) { return this.actuate('activate', sel) }
   async windowOp (sel, op, opts = {}) { return this.actuate('windowOp', { ...sel, op, ...opts }) }
   /** Deterministic placement (no mouse): move/resize a window to an arbitrary rect. */