dsh-codex-style-computer-use 2.2.4 → 2.2.5

package/README.md

@@ -187,6 +187,7 @@ fields are detected through UI Automation's `IsPassword` and refused by default.
 ## Safety model
 
 - **Shared input** — ordinary user activity is allowed while the agent is thinking, observing or preparing. During actual actuation, typing, scrolling and buttons yield immediately; pointer movement has a 16-pixel displacement tolerance. Continued input or a held key/button for 2 seconds enters automatic waiting. After release and 3 quiet seconds, the agent must inspect the current target and continue the original task, without blindly replaying partial writes. A gentle pale-yellow edge gradient shows human ownership.
+- **Release by the next action, not by task completion** — while a cycle is open, if the next call does not need the mouse, keyboard, UI Automation, a screenshot or the same live clipboard, call `computer_ctrl {action:"release"}` first. A shell/file/network/npm/chat/analysis step is not a desktop action. The lease ends when the desktop artifact is obtained (token/clipboard text, a value, a path, a saved file, a verified field, a captured image), not when the user's whole task ends. Do not hold "in case I need the desktop later"; reacquiring is cheap and a later need starts a fresh cycle. An explicit `hold` is the only exception; `free` then `release` when done.
 - **Manual pause** — only physical `Ctrl+Esc` raises a persistent input brake; `Ctrl+Alt+R` resumes. Ordinary Esc, typing, scrolling, pointer distance/frequency and the screen corner do not create this pause. Explicit question/diagnostic holds remain separate.
 - **Exit** — `Ctrl+Alt+Q` ends the session: the overlay goes away, its listeners are torn down, and
   further actuation is refused until a later turn opens a new one.

package/README.zh.md

@@ -178,7 +178,8 @@ ID**：派发输入前会核对窗口身份与采样像素，因此过期的 mar
 ## 安全模型
 
 - **人机共用输入** —— 思考、观察和预告期间允许用户正常操作。实际操控时，键盘、滚轮和按钮立即触发让出；鼠标位移有 16 像素容差。持续输入或按住键/按钮 2 秒进入自动等待；全部松开并静默 3 秒后，agent 必须重新观察并接续原任务，不盲目重放部分写入。人操作时显示温和的淡黄色边缘渐变。
-- **工具用完即释放** —— `computer_ctrl {action:"release"}` 结束电脑控制但保持聊天继续；正常收尾自动释放，不弹确认选项单。暂停和待回答问题不会被自动清除。
+- **用完即释放（按下一步判断）** —— 只要下一步不需要鼠标、键盘、UIA、截图或同一份剪贴板，就先 `computer_ctrl {action:"release"}`，再去做 shell、文件、网络、npm 或聊天；不要一边处理桌面产物一边持有桌面。拿到 token/值/路径/截图/已保存文件就是本次桌面租约的结束点，不是等整个任务做完；重新获取很便宜。`release` 只结束电脑控制，聊天继续；正常收尾自动释放，不弹确认选项单。暂停和待回答问题不会被自动清除。
+- **不要“等会儿可能还要用”而持有** —— 明确的 `computer_ctrl {action:"hold"}` 是唯一例外；`free` 后立刻 `release`。如果已经调用了非 `computer_*` 工具而 cycle 还开着，说明漏了释放，应立即 release。
 - **一个操作者** —— 会话／agent 所有权与跨 worker 独占锁覆盖整个控制周期，另一 agent 必须等当前操作者释放。
 - **人工暂停** —— 只有实体 `Ctrl+Esc` 触发持续输入刹车，`Ctrl+Alt+R` 恢复。普通 Esc、打字、滚动、鼠标距离/频率和屏幕左上角不再触发这种暂停；显式提问、诊断暂停保持独立。
 - **退出** —— `Ctrl+Alt+Q` 结束会话：覆盖层消失、监听全部拆除，后续注入被拒，直到之后某一轮重新开启。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-codex-style-computer-use",
-  "version": "2.2.4",
+  "version": "2.2.5",
   "description": "Codex-style Computer Use for DeepSeek Harness: Windows desktop control, screenshots, UI Automation, human input handoff, approval gates and prebuilt native workers. Install and update from dsh-market without PowerShell 7 or build steps.",
   "type": "module",
   "main": "lib/index.js",

package/skills/computer-use/SKILL.md

@@ -11,6 +11,25 @@ Read this entry before driving. The skill gate requires this receipt once per se
 
 Tools load for the current Agent after a successful `skill` load or this receipt; if invisible, call `computer_use_activate` (opens no cycle, releases no brake). Stop/exit and computer_ask work before activation. Issue real tool calls: a target handle is a string argument to computer_uia_act — tags, examples and prose do not execute; in a run_code-only host, call tools through run_code. Observation and the safety direction (ask, stop, exit) are not gated; a human brake still refuses observation. Read a referenced file only when its condition applies.
 
+## Release gate (applies before EVERY tool call)
+
+A desktop cycle is a lease on the live desktop, not a flag for the whole task. Before every tool call while a cycle is open, ask with the **next-action test**:
+
+> Does my NEXT call need the mouse, keyboard, UI Automation, a screenshot, or this same live clipboard?
+
+- **NO → call `computer_ctrl {action:"release"}` FIRST**, before that shell/file/network/npm/chat/analysis call. Do not keep the lease while you use the desktop artifact somewhere else.
+- **YES → keep it**, but only for that continuous desktop step.
+
+The lease ends when the desktop **artifact** is obtained: clipboard text read, UIA value/control read, screenshot captured, field typed and verified, file saved, or window activated. It does not wait for the user's whole task, the final answer, or a turn boundary. Examples that all require immediate release after the `computer_*` result:
+
+- `computer_clip` returned a token/password/text and the next step is `npm publish`, a shell command, or a file write.
+- `computer_shot` returned an image and the next step analyzes or edits it outside the desktop.
+- `computer_uia` / `computer_state` returned a value and the next step is a shell/file/network call.
+- `computer_type` verified a field and the next step is not another `computer_*` call.
+- A save/open dialog returned a path and the next step uses that path in a non-desktop tool.
+
+Holding “because I may need the desktop again later” is not allowed: reacquiring is cheap, and a later need starts a fresh cycle with fresh evidence. Holding while publishing, uploading, running a command, writing a file or composing a chat answer is the exact failure this gate prevents. An explicit `computer_ctrl {action:"hold"}` is the only reason to stay on the desktop across non-desktop work; `free` and then `release` when that readback is done. Human pause/question/exit still take precedence. **Self-audit:** if you have made any non-`computer_*` tool call since your last `computer_*` call and the cycle is still open, you missed this gate — release now before continuing.
+
 ## Start, act, verify
 
 1. Identify the app with `computer_state {windows:true}`, reusing a known window; activate its hwnd with `computer_window` and require `activated:true` before capturing or driving; bind the intended record/field/document too. Minimized: restore, then activate. An occlusion error means inspect what covers it.
@@ -19,7 +38,7 @@ Tools load for the current Agent after a successful `skill` load or this receipt
 4. Otherwise use an observed mark or measured coordinate. A mark is a snapshot ID and does not follow scrolling; each mark action checks window identity, position and sampled pixels, and STALE_MARK means no input was dispatched. Refresh with `computer_marks {refresh:true}` and pick by NEW id (old ids retire); refresh after known scrolling/navigation even if a sample misses it. dx/dy offsets work in direct and batch clicks.
 5. Batch a coherent set to a natural checkpoint — no fixed step count. Steps run serially; failure, failed activation or cancellation stops later ones. Reuse returned evidence; `shot:"auto"` adds at most one observation when needed, `shot:"never"` suits text/readback verification. Batch known inputs rather than paying an intermediate image per keystroke.
 6. Verify the outcome: field value, saved record/document, selected range, app status or image. A provider accepting input proves neither a save nor the business result. Report what was observed and any unresolved uncertainty, then finish.
-7. When desktop work is done call `computer_ctrl {action:"release"}` — even while you keep explaining or using other tools. Do not retain ownership because the chat is alive; a later real need opens a fresh cycle. Normal turn completion releases without a question card; explicit pauses/questions are preserved.
+7. Release at the boundary defined by the release gate above — when the next action no longer needs the live desktop; do not wait for task completion, a final summary, or the turn end. `computer_ctrl {action:"release"}` closes desktop control only, not the conversation; a later desktop need opens a fresh cycle and requires fresh evidence. If a pause, question or handoff currently owns the desktop, finish that state first. Normal turn completion also releases without a question card; explicit pauses/questions are preserved.
 
 `since` (same query + previous observation id) returns added/changed/removed elements and order changes; omitted elements keep their state, while no/expired base, changed scope, partial results or an uneconomical diff return full. `snapshot` retrieves a retained observation without capturing — not fresh verification; page it with `offset`/`limit`. `computer_ctrl {action:"clear_cache"}` clears this Agent's cache without a cycle. Caches are bounded and expire; storage failure falls back to bounded memory and memory pressure to inline results without a fake snapshot id. Omit since/snapshot for fresh evidence after losing the baseline. See [progressive-control.md](references/progressive-control.md).