dsh-codex-style-computer-use 2.2.5 → 2.2.6

package/README.md

@@ -187,7 +187,7 @@ fields are detected through UI Automation's `IsPassword` and refused by default.
 ## Safety model
 
 - **Shared input** — ordinary user activity is allowed while the agent is thinking, observing or preparing. During actual actuation, typing, scrolling and buttons yield immediately; pointer movement has a 16-pixel displacement tolerance. Continued input or a held key/button for 2 seconds enters automatic waiting. After release and 3 quiet seconds, the agent must inspect the current target and continue the original task, without blindly replaying partial writes. A gentle pale-yellow edge gradient shows human ownership.
-- **Release by the next action, not by task completion** — while a cycle is open, if the next call does not need the mouse, keyboard, UI Automation, a screenshot or the same live clipboard, call `computer_ctrl {action:"release"}` first. A shell/file/network/npm/chat/analysis step is not a desktop action. The lease ends when the desktop artifact is obtained (token/clipboard text, a value, a path, a saved file, a verified field, a captured image), not when the user's whole task ends. Do not hold "in case I need the desktop later"; reacquiring is cheap and a later need starts a fresh cycle. An explicit `hold` is the only exception; `free` then `release` when done.
+- **Release by desktop block, not by every call** — one cycle covers one continuous desktop block, not the whole task. When you leave that block for publish, upload, install, build, test, network, a file write, analysis or chat, call `computer_ctrl {action:"release"}` first. Keep the cycle only while the next call is still in the same block, including one quick readback you type straight back. An artifact in hand (token, clipboard text, value, path, screenshot) is a signal that the block may be ending, not an automatic release point. Do not hold "in case I need the desktop later"; reacquiring the lease is cheap, while a lit border and an exclusive lease during a long command are not. `hold` is only for position-sensitive readback inside the block, never across a build/publish/upload or long command; `free` then `release`.
 - **Manual pause** — only physical `Ctrl+Esc` raises a persistent input brake; `Ctrl+Alt+R` resumes. Ordinary Esc, typing, scrolling, pointer distance/frequency and the screen corner do not create this pause. Explicit question/diagnostic holds remain separate.
 - **Exit** — `Ctrl+Alt+Q` ends the session: the overlay goes away, its listeners are torn down, and
   further actuation is refused until a later turn opens a new one.

package/README.zh.md

@@ -178,8 +178,7 @@ ID**：派发输入前会核对窗口身份与采样像素，因此过期的 mar
 ## 安全模型
 
 - **人机共用输入** —— 思考、观察和预告期间允许用户正常操作。实际操控时，键盘、滚轮和按钮立即触发让出；鼠标位移有 16 像素容差。持续输入或按住键/按钮 2 秒进入自动等待；全部松开并静默 3 秒后，agent 必须重新观察并接续原任务，不盲目重放部分写入。人操作时显示温和的淡黄色边缘渐变。
-- **用完即释放（按下一步判断）** —— 只要下一步不需要鼠标、键盘、UIA、截图或同一份剪贴板，就先 `computer_ctrl {action:"release"}`，再去做 shell、文件、网络、npm 或聊天；不要一边处理桌面产物一边持有桌面。拿到 token/值/路径/截图/已保存文件就是本次桌面租约的结束点，不是等整个任务做完；重新获取很便宜。`release` 只结束电脑控制，聊天继续；正常收尾自动释放，不弹确认选项单。暂停和待回答问题不会被自动清除。
-- **不要“等会儿可能还要用”而持有** —— 明确的 `computer_ctrl {action:"hold"}` 是唯一例外；`free` 后立刻 `release`。如果已经调用了非 `computer_*` 工具而 cycle 还开着，说明漏了释放，应立即 release。
+- **按“桌面块”释放，不按每次调用** —— 一个 cycle 覆盖一段连续的桌面工作，不是整个任务。离开这一段去做发布、上传、安装、构建、测试、网络、写文件、分析或聊天时，先 `computer_ctrl {action:"release"}`；只有下一步仍是同一桌面块里的普通点击/输入，或一次很快的读数后马上输入回去，才保留 cycle。拿到的 token/值/路径/截图只是“这块可能快结束了”的信号，不是自动释放点；如果下一步是粘贴/回读/继续点，就保留。不要为了“等会儿可能还要用”而持有；重新获取租约很便宜，长命令期间亮着边框和独占锁并不便宜。`hold` 只用于块内对位置敏感的读数，不能跨 build/publish/upload 或长命令；`free` 后 release。暂停和待回答问题不会被自动清除。
 - **一个操作者** —— 会话／agent 所有权与跨 worker 独占锁覆盖整个控制周期，另一 agent 必须等当前操作者释放。
 - **人工暂停** —— 只有实体 `Ctrl+Esc` 触发持续输入刹车，`Ctrl+Alt+R` 恢复。普通 Esc、打字、滚动、鼠标距离/频率和屏幕左上角不再触发这种暂停；显式提问、诊断暂停保持独立。
 - **退出** —— `Ctrl+Alt+Q` 结束会话：覆盖层消失、监听全部拆除，后续注入被拒，直到之后某一轮重新开启。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-codex-style-computer-use",
-  "version": "2.2.5",
+  "version": "2.2.6",
   "description": "Codex-style Computer Use for DeepSeek Harness: Windows desktop control, screenshots, UI Automation, human input handoff, approval gates and prebuilt native workers. Install and update from dsh-market without PowerShell 7 or build steps.",
   "type": "module",
   "main": "lib/index.js",

package/skills/computer-use/SKILL.md

@@ -11,24 +11,22 @@ Read this entry before driving. The skill gate requires this receipt once per se
 
 Tools load for the current Agent after a successful `skill` load or this receipt; if invisible, call `computer_use_activate` (opens no cycle, releases no brake). Stop/exit and computer_ask work before activation. Issue real tool calls: a target handle is a string argument to computer_uia_act — tags, examples and prose do not execute; in a run_code-only host, call tools through run_code. Observation and the safety direction (ask, stop, exit) are not gated; a human brake still refuses observation. Read a referenced file only when its condition applies.
 
-## Release gate (applies before EVERY tool call)
+## Cycle boundary (one rule)
 
-A desktop cycle is a lease on the live desktop, not a flag for the whole task. Before every tool call while a cycle is open, ask with the **next-action test**:
+A desktop cycle covers **one continuous desktop block**, not the user's task and not the turn.
 
-> Does my NEXT call need the mouse, keyboard, UI Automation, a screenshot, or this same live clipboard?
+When your next call is not `computer_*`, use this two-part test:
 
-- **NO → call `computer_ctrl {action:"release"}` FIRST**, before that shell/file/network/npm/chat/analysis call. Do not keep the lease while you use the desktop artifact somewhere else.
-- **YES → keep it**, but only for that continuous desktop step.
+1. Can you name the next desktop action in this same block?
+2. Is this non-desktop step a short helper needed for that action, rather than a different work item?
 
-The lease ends when the desktop **artifact** is obtained: clipboard text read, UIA value/control read, screenshot captured, field typed and verified, file saved, or window activated. It does not wait for the user's whole task, the final answer, or a turn boundary. Examples that all require immediate release after the `computer_*` result:
+Keep the cycle only if both answers are yes and the helper is quick. Otherwise release first: `computer_ctrl {action:"release"}`. Publish, upload, install, build, test, network, a file write, analysis and a chat answer are different work items, so release before them. `todo_write` or a quick local read between two desktop actions is a helper, not a block boundary. A `run_code` call that itself dispatches the next desktop action, and an observation helper used for that action, remain part of the block.
 
-- `computer_clip` returned a token/password/text and the next step is `npm publish`, a shell command, or a file write.
-- `computer_shot` returned an image and the next step analyzes or edits it outside the desktop.
-- `computer_uia` / `computer_state` returned a value and the next step is a shell/file/network call.
-- `computer_type` verified a field and the next step is not another `computer_*` call.
-- A save/open dialog returned a path and the next step uses that path in a non-desktop tool.
+An artifact in hand (token, clipboard text, a value, a path, a screenshot) means the desktop block **may** be ending; it is not an automatic release point. If the next call is another desktop action (paste, verify, click), keep the cycle; if it is non-desktop and you cannot name the next desktop action, release.
 
-Holding “because I may need the desktop again later” is not allowed: reacquiring is cheap, and a later need starts a fresh cycle with fresh evidence. Holding while publishing, uploading, running a command, writing a file or composing a chat answer is the exact failure this gate prevents. An explicit `computer_ctrl {action:"hold"}` is the only reason to stay on the desktop across non-desktop work; `free` and then `release` when that readback is done. Human pause/question/exit still take precedence. **Self-audit:** if you have made any non-`computer_*` tool call since your last `computer_*` call and the cycle is still open, you missed this gate — release now before continuing.
+`hold` is only for a position-sensitive readback inside the continuous block — never across a build, publish, upload or long command. `free`, then release when the readback is done. Pauses, questions and human handoffs still own the desktop; release does not override them.
+
+When in doubt, release: reacquiring the lease is cheap, while a lit border and an exclusive lease during long non-desktop work are not.
 
 ## Start, act, verify
 
@@ -38,7 +36,7 @@ Holding “because I may need the desktop again later” is not allowed: reacqui
 4. Otherwise use an observed mark or measured coordinate. A mark is a snapshot ID and does not follow scrolling; each mark action checks window identity, position and sampled pixels, and STALE_MARK means no input was dispatched. Refresh with `computer_marks {refresh:true}` and pick by NEW id (old ids retire); refresh after known scrolling/navigation even if a sample misses it. dx/dy offsets work in direct and batch clicks.
 5. Batch a coherent set to a natural checkpoint — no fixed step count. Steps run serially; failure, failed activation or cancellation stops later ones. Reuse returned evidence; `shot:"auto"` adds at most one observation when needed, `shot:"never"` suits text/readback verification. Batch known inputs rather than paying an intermediate image per keystroke.
 6. Verify the outcome: field value, saved record/document, selected range, app status or image. A provider accepting input proves neither a save nor the business result. Report what was observed and any unresolved uncertainty, then finish.
-7. Release at the boundary defined by the release gate above — when the next action no longer needs the live desktop; do not wait for task completion, a final summary, or the turn end. `computer_ctrl {action:"release"}` closes desktop control only, not the conversation; a later desktop need opens a fresh cycle and requires fresh evidence. If a pause, question or handoff currently owns the desktop, finish that state first. Normal turn completion also releases without a question card; explicit pauses/questions are preserved.
+7. Release at the cycle boundary above — when the next step leaves this continuous desktop block for a different work item, or when you cannot name the next desktop action. Do not wait for task completion, a final summary, or the turn end. `computer_ctrl {action:"release"}` closes desktop control only, not the conversation; a later desktop need opens a fresh cycle and requires fresh evidence. If a pause, question or handoff currently owns the desktop, finish that state first. Normal turn completion also releases without a question card; explicit pauses/questions are preserved.
 
 `since` (same query + previous observation id) returns added/changed/removed elements and order changes; omitted elements keep their state, while no/expired base, changed scope, partial results or an uneconomical diff return full. `snapshot` retrieves a retained observation without capturing — not fresh verification; page it with `offset`/`limit`. `computer_ctrl {action:"clear_cache"}` clears this Agent's cache without a cycle. Caches are bounded and expire; storage failure falls back to bounded memory and memory pressure to inline results without a fake snapshot id. Omit since/snapshot for fresh evidence after losing the baseline. See [progressive-control.md](references/progressive-control.md).
 
@@ -78,7 +76,7 @@ Before replaying a write, inspect whether it already took effect, then focus, mo
 
 **Document editors (Word/WPS/PDF) — destructive selection:** never triple-click, never `ctrl+a`, never select-then-paste as an edit strategy. Triple-click selects an unpredictable scope (measured 2026-11-07: it replaced an entire one-page form in Word). Edit one line at a time: click inside the line, `home`, then `shift+end`, CAPTURE and confirm the selection covers only that line, then type. After any unexpected document change press `ctrl+z` immediately and capture before continuing; never save a document you have not seen in full after the edit. Save As a NEW file and never overwrite the original.
 
-**Downloads:** resolve the real download directory from `HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders` (`{374DE290-123F-4565-9164-39C4925E467B}`) — a redirected profile puts it outside `%USERPROFILE%`. Edge refuses some HTTP documents with "无法安全下载" and leaves a small `.crdownload` stub; there may be no Keep option. Attempt the download at most twice, then report the block and use an already-downloaded copy or the site's preview if it exists; do not loop on the security UI. Preserve the breakpoint and live cycle; elapsed time cannot release a human brake. Use computer_wait for transient readiness; selftest/calibration are for observed input-delivery or coordinate problems, not every failure.
+**Downloads:** resolve the real download directory from `HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders` (`{374DE290-123F-4565-9164-39C4925E467B}`) — a redirected profile puts it outside `%USERPROFILE%`. Edge refuses some HTTP documents with "无法安全下载" and leaves a small `.crdownload` stub; there may be no Keep option. Attempt the download at most twice, then report the block and use an already-downloaded copy or the site's preview if it exists; do not loop on the security UI. Keep the cycle only for this blocked-download retry; elapsed time cannot release a human brake. Use computer_wait for transient readiness; selftest/calibration are for observed input-delivery or coordinate problems, not every failure.
 
 For pixel waits pass the observed hwnd to `computer_wait` (stable/change) so animation elsewhere does not delay you; the default covers the whole virtual desktop. A caret inside the region can still prevent settling — verify with UIA state instead of spending full timeouts. `lastDiffPct` describes only the final sample pair; a moved/minimized target needs a fresh observation.
 
@@ -101,7 +99,7 @@ A cold tree may expose only window chrome/an ancestor: use a point query and one
 
 ## Human control and permission
 
-Initial observation is free; dispatching input and preserving the scene are the two held states described below. Use `computer_ctrl {action:"hold"}` before a position-sensitive readback and `{action:"free"}` as soon as thinking no longer needs an unchanged desktop; neither creates a cycle nor releases a manual brake. Release the cycle when desktop work is done.
+Initial observation is free; dispatching input and preserving the scene are the two held states described below. Use `computer_ctrl {action:"hold"}` before a position-sensitive readback and `{action:"free"}` as soon as thinking no longer needs an unchanged desktop; neither creates a cycle nor releases a manual brake. Release at the cycle boundary above, not when the user's task or the turn ends.
 
 During acting/holding a compact tilted blue kite temporarily replaces the pointer; its tip is the exact native hotspot and its centre symbol follows recognized native shapes, neutral when unknown. Native cursor handles and visibility are preserved for cursor checks and screenshot burn-in, so tool images intentionally show the application cursor, not the kite. Free, handoff, pause and release restore native presentation; a short-lived visibility lease restores it if rendering or the worker stops. The symbol proves no target or effect.
 

package/skills/computer-use/references/lifecycle.md

@@ -17,9 +17,9 @@ The human's own words are the spec here; this section is what they mean.
   it ("Computer use 周期结束之后, 所有跟 computer use 相关的监听, 全部都要终结").
 - **A pause NEVER ends the cycle.** The cycle stays live while paused. Normal desktop completion can release an unpaused cycle before the chat turn ends; an explicit Q remains a terminal exit for that turn.
 
-## Release as soon as desktop work is done
+## Release at the cycle boundary
 
-Call `computer_ctrl {action:"release"}` immediately after the final desktop action and its verification. This closes the indicator/listeners and releases the exclusive desktop lease while the conversation continues. Subsequent explanation, computation and other tools do not require a computer-use cycle. When new desktop work becomes necessary, a later real tool call can open a new cycle in the same turn.
+Call `computer_ctrl {action:"release"}` when the next step leaves this continuous desktop block for a different work item (publish, upload, install, build, test, network, a file write, analysis or chat), or when you cannot name the next desktop action. This closes the indicator/listeners and releases the exclusive desktop lease while the conversation continues. A quick readback you type straight back, a `run_code`/observation helper that itself continues the desktop action, or a single short helper needed for the next click is still inside the block; keep the cycle. An artifact in hand is a signal that the block may be ending, not an automatic release point. `hold` is only for position-sensitive readback inside the block, never across a long command; `free` then release. When in doubt, release; a later real tool call can open a new cycle in the same turn.
 
 Release is owner-checked and distinct from `exit`: it does not cancel the conversation or write an EXITED latch. It cannot release an explicit human pause or a pending question. Closure is serialized with ownership acquisition so an old owner's delayed release cannot close a new owner's cycle. An explicit Ctrl+Alt+Q still prevents reopening in that same turn.