farming-code 2.2.30 → 2.2.32

package/extensions/computer/backend/cua-tools.json

@@ -0,0 +1,3067 @@
+{
+  "version": 1,
+  "driverVersion": "0.12.4",
+  "sourceImage": "trycua/xfce-cua@sha256:274eb636f5cf3fc58f705916ee72b7a701270b3877369d08533a385c5325be9b",
+  "toolCount": 53,
+  "tools": [
+    {
+      "name": "computer_list_apps",
+      "upstreamName": "list_apps",
+      "description": "List Linux apps — both currently running and installed-but-not-running — with per-app state flags:\n\n- running: is a process for this app live? (pid is 0 when false)\n- active: reserved (Linux X11/Wayland focus model differs from frontmost-app); always false.\n- kind: `\"desktop\"` for XDG `.desktop` launcher entries.\n- launch_path: the launcher command from `Exec=` (field codes stripped). Pass to `launch_app(launch_path=...)`.\n- bundle_id: the XDG \"desktop file id\" — the `.desktop` file's path relative to its XDG `applications/` root with the `.desktop` suffix stripped and path separators replaced with `-` (e.g. `kde4/konqbrowser.desktop` → `kde4-konqbrowser`).\n- last_used: RFC3339 mtime of the `.desktop` file, when readable.\n\nRunning apps come from `/proc`. Installed apps come from XDG Desktop Entry files in $XDG_DATA_HOME/applications and each $XDG_DATA_DIRS entry's applications/ subdir. Entries with `NoDisplay=true` or `Hidden=true` are filtered. A `.desktop` file whose launcher matches a running process (by basename) is merged into a single entry with `running: true`.\n\nUse this for \"is X installed?\" as well as \"is X running?\". For per-window state — visibility, geometry, titles — call list_windows instead.",
+      "inputSchema": {
+        "additionalProperties": false,
+        "properties": {},
+        "type": "object"
+      },
+      "annotations": {
+        "destructiveHint": false,
+        "idempotentHint": true,
+        "openWorldHint": false,
+        "readOnlyHint": true
+      },
+      "_meta": {
+        "farming.dev/upstream": "cua-driver",
+        "farming.dev/capabilities": [
+          "app.list"
+        ],
+        "farming.dev/risk": {
+          "class": "r1",
+          "enforcement": "metadata_only",
+          "operation_sensitive": false,
+          "version": "1"
+        }
+      }
+    },
+    {
+      "name": "computer_list_windows",
+      "upstreamName": "list_windows",
+      "description": "List top-level X11 windows via _NET_CLIENT_LIST.",
+      "inputSchema": {
+        "additionalProperties": false,
+        "properties": {
+          "on_screen_only": {
+            "description": "When true, filter to visible windows only. Default false.",
+            "type": "boolean"
+          },
+          "pid": {
+            "type": "integer"
+          }
+        },
+        "type": "object"
+      },
+      "annotations": {
+        "destructiveHint": false,
+        "idempotentHint": true,
+        "openWorldHint": false,
+        "readOnlyHint": true
+      },
+      "_meta": {
+        "farming.dev/upstream": "cua-driver",
+        "farming.dev/capabilities": [
+          "window.list"
+        ],
+        "farming.dev/risk": {
+          "class": "r1",
+          "enforcement": "metadata_only",
+          "operation_sensitive": false,
+          "version": "1"
+        }
+      }
+    },
+    {
+      "name": "computer_get_window_state",
+      "upstreamName": "get_window_state",
+      "description": "Walk a running app's AT-SPI tree and return BOTH a structured `elements` array (preferred) AND a Markdown rendering of the same tree (back-compat). Every actionable element is tagged with [element_index N] in the markdown and as `element_index` in the structured array.\n\nPREFERRED CONSUMERS read `structuredContent.elements` (one entry per indexed row with `element_index`, `role`, `label`, `frame: {x,y,w,h}` when AT-SPI reports usable bounds, `parent_index`, `depth`). The markdown `tree_markdown` stays available and unchanged in shape for existing text-parsing callers — but new fields will only be added to the structured side.\n\nAlways returns BOTH the element tree AND a screenshot — ground on both and cross-check (the tree lies on some surfaces). Choose the modality at ACTION time: an element ax action (element_index/element_token → accessibility rung) or an element px action (x,y → pixel rung off this screenshot). capture_mode is deprecated and ignored.\n\nOptional `max_elements` / `max_depth` bound the AT-SPI walk to mitigate context-window blow-up on Electron / large web apps that produce 10k+ element trees. When applied, BOTH the markdown and the structured elements are truncated identically. Omit both for current default behaviour.",
+      "inputSchema": {
+        "additionalProperties": false,
+        "properties": {
+          "capture_mode": {
+            "description": "DEPRECATED and ignored. get_window_state always returns BOTH the element tree and a screenshot — ground on both. The modality is chosen at action time by how you address the target: an element ax action (element_index/element_token) or an element px action (x,y). Any value (including the old \"som\"/\"screenshot\" aliases) is accepted but has no effect.",
+            "enum": [
+              "ax",
+              "vision"
+            ],
+            "type": "string"
+          },
+          "include_screenshot": {
+            "description": "Default true — returns a grounding screenshot alongside the tree. Set false to skip the grab and return tree only (the cheap path for re-indexing before an element ax action).",
+            "type": "boolean"
+          },
+          "max_depth": {
+            "description": "Cap on the AT-SPI tree walk depth. Omit for the default (uncapped). Lower for deeply nested apps.",
+            "minimum": 1,
+            "type": "integer"
+          },
+          "max_elements": {
+            "description": "Cap on total AT-SPI nodes walked. Omit for the default (5 000). Lower for huge web/Electron trees.",
+            "minimum": 1,
+            "type": "integer"
+          },
+          "pid": {
+            "type": "integer"
+          },
+          "query": {
+            "type": "string"
+          },
+          "screenshot_out_file": {
+            "description": "When set, write the PNG to this file path (~ expanded) instead of embedding base64 in the response. The structured output carries screenshot_file_path instead.",
+            "type": "string"
+          },
+          "session": {
+            "description": "Optional session id: declares/uses the agent cursor and per-session state for this run. The same id works over MCP, the CLI, or the raw socket, and follows the run across apps/windows. Omit to run cursor-less.",
+            "type": "string"
+          },
+          "window_id": {
+            "description": "X11 XID from list_windows.",
+            "type": "integer"
+          }
+        },
+        "required": [
+          "pid",
+          "window_id"
+        ],
+        "type": "object"
+      },
+      "annotations": {
+        "destructiveHint": false,
+        "idempotentHint": true,
+        "openWorldHint": false,
+        "readOnlyHint": true
+      },
+      "_meta": {
+        "farming.dev/upstream": "cua-driver",
+        "farming.dev/capabilities": [
+          "accessibility.window_state",
+          "accessibility.tree",
+          "accessibility.tree.structured",
+          "accessibility.tree.bounded",
+          "accessibility.element_tokens",
+          "screen.capture",
+          "screen.capture.window"
+        ],
+        "farming.dev/risk": {
+          "class": "r2",
+          "enforcement": "metadata_only",
+          "operation_sensitive": false,
+          "version": "1"
+        }
+      }
+    },
+    {
+      "name": "computer_launch_app",
+      "upstreamName": "launch_app",
+      "description": "Launch a Linux app in the background. Provide launch_path (preferred — round-trip the value from list_apps), name (app name, launched via xdg-open or direct exec), bundle_id (ignored on Linux), or urls (list of URLs to open). Resolution precedence: launch_path > name > bundle_id.",
+      "inputSchema": {
+        "additionalProperties": false,
+        "properties": {
+          "additional_arguments": {
+            "description": "Extra command-line arguments passed to the launched process.",
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "bundle_id": {
+            "description": "Ignored on Linux (macOS/Windows concept).",
+            "type": "string"
+          },
+          "launch_path": {
+            "description": "Round-trip the `launch_path` returned by `list_apps` — the Exec= command from the .desktop file with XDG field codes already stripped. Highest precedence on Linux; spawned directly via the system shell.",
+            "type": "string"
+          },
+          "name": {
+            "description": "App name or command to launch.",
+            "type": "string"
+          },
+          "urls": {
+            "description": "URLs to open via xdg-open.",
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          }
+        },
+        "type": "object"
+      },
+      "annotations": {
+        "destructiveHint": false,
+        "idempotentHint": false,
+        "openWorldHint": true,
+        "readOnlyHint": false
+      },
+      "_meta": {
+        "farming.dev/upstream": "cua-driver",
+        "farming.dev/capabilities": [
+          "app.launch"
+        ],
+        "farming.dev/risk": {
+          "class": "r1",
+          "enforcement": "metadata_only",
+          "operation_sensitive": false,
+          "version": "1"
+        }
+      }
+    },
+    {
+      "name": "computer_kill_app",
+      "upstreamName": "kill_app",
+      "description": "Force-terminate a process by pid (kill -9 equivalent on Linux). Use as escalation when the cooperative close path failed to make the process exit. Unsaved state is lost — prefer the cooperative path first.",
+      "inputSchema": {
+        "additionalProperties": false,
+        "properties": {
+          "pid": {
+            "description": "PID of the process to terminate.",
+            "type": "integer"
+          }
+        },
+        "required": [
+          "pid"
+        ],
+        "type": "object"
+      },
+      "annotations": {
+        "destructiveHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false,
+        "readOnlyHint": false
+      },
+      "_meta": {
+        "farming.dev/upstream": "cua-driver",
+        "farming.dev/capabilities": [
+          "app.kill"
+        ],
+        "farming.dev/risk": {
+          "class": "r1",
+          "enforcement": "metadata_only",
+          "operation_sensitive": false,
+          "version": "1"
+        }
+      }
+    },
+    {
+      "name": "computer_bring_to_front",
+      "upstreamName": "bring_to_front",
+      "description": "Persistently activate a window so subsequent input lands on it. X11: EWMH _NET_ACTIVE_WINDOW activation (the `wmctrl -a` equivalent, proper timestamp handling to beat focus-stealing prevention) — call it before `delivery_mode:\"foreground\"` input to avoid a per-call flash, or to escalate when background injection didn't land. Wayland: activates through a target-addressable compositor adapter (wlroots foreign-toplevel or the GNOME Shell helper) and refuses when the compositor offers no safe adapter. Matches the macOS / Windows bring_to_front rung.",
+      "inputSchema": {
+        "additionalProperties": false,
+        "properties": {
+          "pid": {
+            "type": "integer"
+          },
+          "window_id": {
+            "description": "X11 window id (xid) to activate. If omitted, the first window of `pid` is used.",
+            "type": "integer"
+          }
+        },
+        "required": [
+          "pid"
+        ],
+        "type": "object"
+      },
+      "annotations": {
+        "destructiveHint": false,
+        "idempotentHint": true,
+        "openWorldHint": false,
+        "readOnlyHint": false
+      },
+      "_meta": {
+        "farming.dev/upstream": "cua-driver",
+        "farming.dev/capabilities": [
+          "window.activate"
+        ],
+        "farming.dev/risk": {
+          "class": "r1",
+          "enforcement": "metadata_only",
+          "operation_sensitive": false,
+          "version": "1"
+        }
+      }
+    },
+    {
+      "name": "computer_click",
+      "upstreamName": "click",
+      "description": "Click against a target pid. **Prefer `element_index` over pixel coordinates** — element_index works on backgrounded / hidden windows, surfaces a stable handle, and tells you what you're clicking via the cached AT-SPI element's role + label. Reach for `x, y` only when the target is a canvas / custom-drawn surface that doesn't appear in the AT-SPI tree.\n\nProvide either (window_id + x/y) or (pid + element_index). Routes via XSendEvent (no focus steal). element_index cache is scoped per (pid, window_id) and is replaced by the next get_window_state of the same window — re-snapshot every turn before clicking.\n\nAfter a zoom call, pass from_zoom=true to auto-translate zoom-image coords back to full-window space.\n\nbutton: \"left\" (default), \"right\", or \"middle\". Defaults to left so the field is fully back-compat. X11: routes through XSendEvent ButtonPress/Release with the matching button code. Native Wayland: only left-button is supported via the virtual-pointer protocol — right/middle return an error rather than silently degrading to left.",
+      "inputSchema": {
+        "additionalProperties": false,
+        "properties": {
+          "button": {
+            "description": "Mouse button. Default: \"left\" (legacy back-compat). X11: routed via ButtonPress/Release with the matching evdev code. Native Wayland: only left-button is supported via the virtual-pointer protocol; right/middle return an error.",
+            "enum": [
+              "left",
+              "right",
+              "middle"
+            ],
+            "type": "string"
+          },
+          "count": {
+            "type": "integer"
+          },
+          "cursor_id": {
+            "description": "Optional multi-cursor instance id. Default: 'default'.",
+            "type": "string"
+          },
+          "delivery_mode": {
+            "default": "background",
+            "description": "Input delivery mode. 'background' (default) never activates or raises the target window. On X11 it injects via XTEST / the XInput2 master pointer (no focus steal). On Wayland it goes through libei + xdg-desktop-portal, which injects to the compositor's input focus — Wayland's security model has no per-window background targeting, so a specific non-focused window cannot be aimed at; when no libei backend is available the tool returns a structured background_unavailable error. 'foreground' is the explicit escalation: activate the target (X11 _NET_ACTIVE_WINDOW; Wayland compositor activate), inject, then restore the prior active window — a brief focus swap unless the target was already active. Call bring_to_front first to avoid the flash. Matches the macOS / Windows delivery_mode surface.",
+            "enum": [
+              "background",
+              "foreground"
+            ],
+            "type": "string"
+          },
+          "element_index": {
+            "description": "Element index from the last get_window_state. REQUIRES `pid` and `window_id` alongside it — element_index alone (no pid) fails fast, it is not a silent no-op.",
+            "type": "integer"
+          },
+          "element_token": {
+            "description": "Opaque per-snapshot element handle from `structuredContent.elements[].element_token`. Takes precedence over element_index when both are supplied. Returns an explicit \"stale\" error once a newer snapshot supersedes it — re-snapshot in that case.",
+            "type": "string"
+          },
+          "from_zoom": {
+            "description": "Set true after a zoom call to auto-translate zoom-image pixel coordinates back to full-window space.",
+            "type": "boolean"
+          },
+          "pid": {
+            "type": "integer"
+          },
+          "scope": {
+            "default": "window",
+            "enum": [
+              "window",
+              "desktop"
+            ],
+            "type": "string"
+          },
+          "session": {
+            "description": "Optional session id: declares/uses the agent cursor and per-session state for this run. The same id works over MCP, the CLI, or the raw socket, and follows the run across apps/windows. Omit to run cursor-less.",
+            "type": "string"
+          },
+          "window_id": {
+            "type": "integer"
+          },
+          "x": {
+            "type": "number"
+          },
+          "y": {
+            "type": "number"
+          }
+        },
+        "required": [],
+        "type": "object"
+      },
+      "annotations": {
+        "destructiveHint": true,
+        "idempotentHint": false,
+        "openWorldHint": true,
+        "readOnlyHint": false
+      },
+      "_meta": {
+        "farming.dev/upstream": "cua-driver",
+        "farming.dev/capabilities": [
+          "input.pointer.click",
+          "input.pointer.click.left",
+          "accessibility.element_tokens",
+          "input.delivery_mode"
+        ],
+        "farming.dev/risk": {
+          "class": "r1",
+          "enforcement": "metadata_only",
+          "operation_sensitive": false,
+          "version": "1"
+        }
+      }
+    },
+    {
+      "name": "computer_double_click",
+      "upstreamName": "double_click",
+      "description": "Double-click at (x,y) or an element_index (AT-SPI bounds) via XSendEvent. No focus steal. Provide either (window_id + x/y) or (pid + element_index). After a zoom call, pass from_zoom=true to auto-translate zoom-image coords.",
+      "inputSchema": {
+        "additionalProperties": false,
+        "properties": {
+          "cursor_id": {
+            "description": "Optional multi-cursor instance id. Default: 'default'.",
+            "type": "string"
+          },
+          "delivery_mode": {
+            "default": "background",
+            "description": "Input delivery mode. 'background' (default) never activates or raises the target window. On X11 it injects via XTEST / the XInput2 master pointer (no focus steal). On Wayland it goes through libei + xdg-desktop-portal, which injects to the compositor's input focus — Wayland's security model has no per-window background targeting, so a specific non-focused window cannot be aimed at; when no libei backend is available the tool returns a structured background_unavailable error. 'foreground' is the explicit escalation: activate the target (X11 _NET_ACTIVE_WINDOW; Wayland compositor activate), inject, then restore the prior active window — a brief focus swap unless the target was already active. Call bring_to_front first to avoid the flash. Matches the macOS / Windows delivery_mode surface.",
+            "enum": [
+              "background",
+              "foreground"
+            ],
+            "type": "string"
+          },
+          "element_index": {
+            "description": "Element index from the last get_window_state. REQUIRES `pid` and `window_id` alongside it — element_index alone (no pid) fails fast, it is not a silent no-op.",
+            "type": "integer"
+          },
+          "element_token": {
+            "description": "Opaque per-snapshot element handle from `structuredContent.elements[].element_token`. Takes precedence over element_index when both are supplied. Returns an explicit \"stale\" error once a newer snapshot supersedes it — re-snapshot in that case.",
+            "type": "string"
+          },
+          "from_zoom": {
+            "description": "Set true after a zoom call to auto-translate zoom-image pixel coordinates back to full-window space.",
+            "type": "boolean"
+          },
+          "pid": {
+            "type": "integer"
+          },
+          "session": {
+            "description": "Optional session id: declares/uses the agent cursor and per-session state for this run. The same id works over MCP, the CLI, or the raw socket, and follows the run across apps/windows. Omit to run cursor-less.",
+            "type": "string"
+          },
+          "window_id": {
+            "type": "integer"
+          },
+          "x": {
+            "type": "number"
+          },
+          "y": {
+            "type": "number"
+          }
+        },
+        "required": [
+          "pid"
+        ],
+        "type": "object"
+      },
+      "annotations": {
+        "destructiveHint": true,
+        "idempotentHint": false,
+        "openWorldHint": true,
+        "readOnlyHint": false
+      },
+      "_meta": {
+        "farming.dev/upstream": "cua-driver",
+        "farming.dev/capabilities": [
+          "input.pointer.click",
+          "input.pointer.click.left",
+          "input.pointer.click.double",
+          "accessibility.element_tokens",
+          "input.delivery_mode"
+        ],
+        "farming.dev/risk": {
+          "class": "r1",
+          "enforcement": "metadata_only",
+          "operation_sensitive": false,
+          "version": "1"
+        }
+      }
+    },
+    {
+      "name": "computer_right_click",
+      "upstreamName": "right_click",
+      "description": "Right-click at (x,y) or an element_index (AT-SPI bounds) via XSendEvent. No focus steal. Provide either (window_id + x/y) or (pid + element_index). After a zoom call, pass from_zoom=true to auto-translate zoom-image coords.",
+      "inputSchema": {
+        "additionalProperties": false,
+        "properties": {
+          "cursor_id": {
+            "description": "Optional multi-cursor instance id. Default: 'default'.",
+            "type": "string"
+          },
+          "delivery_mode": {
+            "default": "background",
+            "description": "Input delivery mode. 'background' (default) never activates or raises the target window. On X11 it injects via XTEST / the XInput2 master pointer (no focus steal). On Wayland it goes through libei + xdg-desktop-portal, which injects to the compositor's input focus — Wayland's security model has no per-window background targeting, so a specific non-focused window cannot be aimed at; when no libei backend is available the tool returns a structured background_unavailable error. 'foreground' is the explicit escalation: activate the target (X11 _NET_ACTIVE_WINDOW; Wayland compositor activate), inject, then restore the prior active window — a brief focus swap unless the target was already active. Call bring_to_front first to avoid the flash. Matches the macOS / Windows delivery_mode surface.",
+            "enum": [
+              "background",
+              "foreground"
+            ],
+            "type": "string"
+          },
+          "element_index": {
+            "description": "Element index from the last get_window_state. REQUIRES `pid` and `window_id` alongside it — element_index alone (no pid) fails fast, it is not a silent no-op.",
+            "type": "integer"
+          },
+          "element_token": {
+            "description": "Opaque per-snapshot element handle from `structuredContent.elements[].element_token`. Takes precedence over element_index when both are supplied. Returns an explicit \"stale\" error once a newer snapshot supersedes it — re-snapshot in that case.",
+            "type": "string"
+          },
+          "from_zoom": {
+            "description": "Set true after a zoom call to auto-translate zoom-image pixel coordinates back to full-window space.",
+            "type": "boolean"
+          },
+          "modifier": {
+            "description": "Modifier keys held during the action: cmd, shift, option/alt, ctrl.",
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "pid": {
+            "type": "integer"
+          },
+          "session": {
+            "description": "Optional session id: declares/uses the agent cursor and per-session state for this run. The same id works over MCP, the CLI, or the raw socket, and follows the run across apps/windows. Omit to run cursor-less.",
+            "type": "string"
+          },
+          "window_id": {
+            "type": "integer"
+          },
+          "x": {
+            "type": "number"
+          },
+          "y": {
+            "type": "number"
+          }
+        },
+        "required": [
+          "pid"
+        ],
+        "type": "object"
+      },
+      "annotations": {
+        "destructiveHint": true,
+        "idempotentHint": false,
+        "openWorldHint": true,
+        "readOnlyHint": false
+      },
+      "_meta": {
+        "farming.dev/upstream": "cua-driver",
+        "farming.dev/capabilities": [
+          "input.pointer.click",
+          "input.pointer.click.right",
+          "accessibility.element_tokens",
+          "input.delivery_mode"
+        ],
+        "farming.dev/risk": {
+          "class": "r1",
+          "enforcement": "metadata_only",
+          "operation_sensitive": false,
+          "version": "1"
+        }
+      }
+    },
+    {
+      "name": "computer_drag",
+      "upstreamName": "drag",
+      "description": "Press-drag-release gesture from (from_x, from_y) to (to_x, to_y) in window-local screenshot pixels via XSendEvent (ButtonPress + MotionNotify × steps + ButtonRelease). duration_ms (default 500), steps (default 20). No focus steal.",
+      "inputSchema": {
+        "additionalProperties": false,
+        "properties": {
+          "button": {
+            "description": "Mouse button. Default \"left\".",
+            "enum": [
+              "left",
+              "right",
+              "middle"
+            ],
+            "type": "string"
+          },
+          "cursor_id": {
+            "description": "Optional multi-cursor instance id. Default: 'default'.",
+            "type": "string"
+          },
+          "delivery_mode": {
+            "default": "background",
+            "description": "Input delivery mode. 'background' (default) never activates or raises the target window. On X11 it injects via XTEST / the XInput2 master pointer (no focus steal). On Wayland it goes through libei + xdg-desktop-portal, which injects to the compositor's input focus — Wayland's security model has no per-window background targeting, so a specific non-focused window cannot be aimed at; when no libei backend is available the tool returns a structured background_unavailable error. 'foreground' is the explicit escalation: activate the target (X11 _NET_ACTIVE_WINDOW; Wayland compositor activate), inject, then restore the prior active window — a brief focus swap unless the target was already active. Call bring_to_front first to avoid the flash. Matches the macOS / Windows delivery_mode surface.",
+            "enum": [
+              "background",
+              "foreground"
+            ],
+            "type": "string"
+          },
+          "duration_ms": {
+            "description": "Total drag duration. Default: 500.",
+            "maximum": 10000,
+            "minimum": 0,
+            "type": "integer"
+          },
+          "from_x": {
+            "type": "number"
+          },
+          "from_y": {
+            "type": "number"
+          },
+          "from_zoom": {
+            "type": "boolean"
+          },
+          "modifier": {
+            "description": "Modifier keys held during the action: cmd, shift, option/alt, ctrl.",
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "pid": {
+            "type": "integer"
+          },
+          "scope": {
+            "default": "window",
+            "enum": [
+              "window",
+              "desktop"
+            ],
+            "type": "string"
+          },
+          "session": {
+            "description": "Optional session id: declares/uses the agent cursor and per-session state for this run. The same id works over MCP, the CLI, or the raw socket, and follows the run across apps/windows. Omit to run cursor-less.",
+            "type": "string"
+          },
+          "steps": {
+            "description": "Intermediate MotionNotify events. Default: 20.",
+            "maximum": 200,
+            "minimum": 1,
+            "type": "integer"
+          },
+          "to_x": {
+            "type": "number"
+          },
+          "to_y": {
+            "type": "number"
+          },
+          "window_id": {
+            "description": "Target window XID. Required.",
+            "type": "integer"
+          }
+        },
+        "required": [
+          "from_x",
+          "from_y",
+          "to_x",
+          "to_y"
+        ],
+        "type": "object"
+      },
+      "annotations": {
+        "destructiveHint": true,
+        "idempotentHint": false,
+        "openWorldHint": true,
+        "readOnlyHint": false
+      },
+      "_meta": {
+        "farming.dev/upstream": "cua-driver",
+        "farming.dev/capabilities": [
+          "input.pointer.drag",
+          "input.delivery_mode"
+        ],
+        "farming.dev/risk": {
+          "class": "r1",
+          "enforcement": "metadata_only",
+          "operation_sensitive": false,
+          "version": "1"
+        }
+      }
+    },
+    {
+      "name": "computer_mouse_button_down",
+      "upstreamName": "mouse_button_down",
+      "description": "Press and hold a mouse button at (x,y) via background X11 delivery. Does not release the button; pair with mouse_drag / mouse_button_up. Returns the current held-button state.",
+      "inputSchema": {
+        "additionalProperties": false,
+        "properties": {
+          "button": {
+            "description": "Mouse button. Default \"left\".",
+            "enum": [
+              "left",
+              "right",
+              "middle"
+            ],
+            "type": "string"
+          },
+          "cursor_id": {
+            "description": "Optional multi-cursor instance id. Default: 'default'.",
+            "type": "string"
+          },
+          "from_zoom": {
+            "description": "Set true after a zoom call to auto-translate zoom-image pixel coordinates back to full-window space.",
+            "type": "boolean"
+          },
+          "pid": {
+            "type": "integer"
+          },
+          "session": {
+            "description": "Optional multi-cursor session id; takes precedence over cursor_id.",
+            "type": "string"
+          },
+          "window_id": {
+            "type": "integer"
+          },
+          "x": {
+            "type": "number"
+          },
+          "y": {
+            "type": "number"
+          }
+        },
+        "required": [
+          "pid",
+          "window_id",
+          "x",
+          "y"
+        ],
+        "type": "object"
+      },
+      "annotations": {
+        "destructiveHint": true,
+        "idempotentHint": false,
+        "openWorldHint": true,
+        "readOnlyHint": false
+      },
+      "_meta": {
+        "farming.dev/upstream": "cua-driver",
+        "farming.dev/capabilities": [
+          "input.pointer.button"
+        ],
+        "farming.dev/risk": {
+          "class": "r1",
+          "enforcement": "metadata_only",
+          "operation_sensitive": false,
+          "version": "1"
+        }
+      }
+    },
+    {
+      "name": "computer_mouse_drag",
+      "upstreamName": "mouse_drag",
+      "description": "Move a previously-held mouse button to a new point via background X11 delivery. Requires an active mouse_button_down state; does not release the button. Returns the updated held-button state.",
+      "inputSchema": {
+        "additionalProperties": false,
+        "properties": {
+          "cursor_id": {
+            "description": "Optional multi-cursor instance id. Default: 'default'.",
+            "type": "string"
+          },
+          "duration_ms": {
+            "description": "Total drag duration. Default: 500.",
+            "maximum": 10000,
+            "minimum": 0,
+            "type": "integer"
+          },
+          "from_zoom": {
+            "description": "Set true after a zoom call to auto-translate zoom-image pixel coordinates back to full-window space.",
+            "type": "boolean"
+          },
+          "pid": {
+            "type": "integer"
+          },
+          "session": {
+            "description": "Optional multi-cursor session id; takes precedence over cursor_id.",
+            "type": "string"
+          },
+          "steps": {
+            "description": "Intermediate MotionNotify events. Default: 20.",
+            "maximum": 200,
+            "minimum": 1,
+            "type": "integer"
+          },
+          "window_id": {
+            "type": "integer"
+          },
+          "x": {
+            "type": "number"
+          },
+          "y": {
+            "type": "number"
+          }
+        },
+        "required": [
+          "x",
+          "y"
+        ],
+        "type": "object"
+      },
+      "annotations": {
+        "destructiveHint": true,
+        "idempotentHint": false,
+        "openWorldHint": true,
+        "readOnlyHint": false
+      },
+      "_meta": {
+        "farming.dev/upstream": "cua-driver",
+        "farming.dev/capabilities": [
+          "input.pointer.drag"
+        ],
+        "farming.dev/risk": {
+          "class": "r1",
+          "enforcement": "metadata_only",
+          "operation_sensitive": false,
+          "version": "1"
+        }
+      }
+    },
+    {
+      "name": "computer_mouse_button_up",
+      "upstreamName": "mouse_button_up",
+      "description": "Release a previously-held mouse button via background X11 delivery. If x/y are omitted, releases at the last held position. Returns the current held-button state.",
+      "inputSchema": {
+        "additionalProperties": false,
+        "properties": {
+          "cursor_id": {
+            "description": "Optional multi-cursor instance id. Default: 'default'.",
+            "type": "string"
+          },
+          "from_zoom": {
+            "description": "Set true after a zoom call to auto-translate zoom-image pixel coordinates back to full-window space.",
+            "type": "boolean"
+          },
+          "pid": {
+            "type": "integer"
+          },
+          "session": {
+            "description": "Optional multi-cursor session id; takes precedence over cursor_id.",
+            "type": "string"
+          },
+          "window_id": {
+            "type": "integer"
+          },
+          "x": {
+            "type": "number"
+          },
+          "y": {
+            "type": "number"
+          }
+        },
+        "type": "object"
+      },
+      "annotations": {
+        "destructiveHint": true,
+        "idempotentHint": false,
+        "openWorldHint": true,
+        "readOnlyHint": false
+      },
+      "_meta": {
+        "farming.dev/upstream": "cua-driver",
+        "farming.dev/capabilities": [
+          "input.pointer.button"
+        ],
+        "farming.dev/risk": {
+          "class": "r1",
+          "enforcement": "metadata_only",
+          "operation_sensitive": false,
+          "version": "1"
+        }
+      }
+    },
+    {
+      "name": "computer_parallel_mouse_drag",
+      "upstreamName": "parallel_mouse_drag",
+      "description": "Run multiple mouse drag gestures concurrently via Linux MPX/XI2 virtual master pointers. Each drag item runs on its own session-scoped master pointer (true same-window concurrent draws on X11). Each item presses once, glides continuously through its whole path, and releases once — one smooth held drag, not a chain of clicks. A path is given either as a straight segment (from_x/from_y → to_x/to_y) or as a function `fn` = y(x) sampled over [x_from, x_to] in window-local pixels (e.g. fn:\"x\" is a diagonal, fn:\"300+120*sin(x/40)\" a sine wave). Functions support + - * / ^, sin/cos/tan, sqrt, abs, exp, ln, pi, e.",
+      "inputSchema": {
+        "additionalProperties": false,
+        "properties": {
+          "drags": {
+            "items": {
+              "additionalProperties": false,
+              "properties": {
+                "button": {
+                  "description": "Mouse button. Default \"left\".",
+                  "enum": [
+                    "left",
+                    "right",
+                    "middle"
+                  ],
+                  "type": "string"
+                },
+                "duration_ms": {
+                  "description": "Default: 1500 for fn paths, 500 for straight.",
+                  "maximum": 10000,
+                  "minimum": 0,
+                  "type": "integer"
+                },
+                "fn": {
+                  "description": "Expression y(x) in window-local pixels; sampled over [x_from,x_to]. Mutually exclusive with from_x/to_x.",
+                  "type": "string"
+                },
+                "from_x": {
+                  "type": "number"
+                },
+                "from_y": {
+                  "type": "number"
+                },
+                "path": {
+                  "description": "Explicit window-local waypoints [[x,y],...] (>=2); pressed once, glided through, released once. Takes precedence over fn/from-to.",
+                  "items": {
+                    "items": {
+                      "type": "number"
+                    },
+                    "type": "array"
+                  },
+                  "type": "array"
+                },
+                "samples": {
+                  "description": "Waypoints sampled along `fn`. Default: 80.",
+                  "maximum": 400,
+                  "minimum": 2,
+                  "type": "integer"
+                },
+                "session": {
+                  "description": "Session/cursor id; also keys the virtual master pointer.",
+                  "type": "string"
+                },
+                "steps": {
+                  "description": "Motion sub-steps along the whole path. Default: scaled to path length.",
+                  "maximum": 300,
+                  "minimum": 1,
+                  "type": "integer"
+                },
+                "to_x": {
+                  "type": "number"
+                },
+                "to_y": {
+                  "type": "number"
+                },
+                "window_id": {
+                  "type": "integer"
+                },
+                "x_from": {
+                  "description": "Domain start (window-local x) when `fn` is used.",
+                  "type": "number"
+                },
+                "x_to": {
+                  "description": "Domain end (window-local x) when `fn` is used.",
+                  "type": "number"
+                }
+              },
+              "required": [
+                "session",
+                "window_id"
+              ],
+              "type": "object"
+            },
+            "minItems": 2,
+            "type": "array"
+          }
+        },
+        "required": [
+          "drags"
+        ],
+        "type": "object"
+      },
+      "annotations": {
+        "destructiveHint": true,
+        "idempotentHint": false,
+        "openWorldHint": true,
+        "readOnlyHint": false
+      },
+      "_meta": {
+        "farming.dev/upstream": "cua-driver",
+        "farming.dev/capabilities": [
+          "input.pointer.drag"
+        ],
+        "farming.dev/risk": {
+          "class": "r1",
+          "enforcement": "metadata_only",
+          "operation_sensitive": false,
+          "version": "1"
+        }
+      }
+    },
+    {
+      "name": "computer_type_text",
+      "upstreamName": "type_text",
+      "description": "Type text to a window via XSendEvent (KeyPress/KeyRelease). No focus steal.",
+      "inputSchema": {
+        "additionalProperties": false,
+        "properties": {
+          "delivery_mode": {
+            "default": "background",
+            "description": "Input delivery mode. 'background' (default) never activates or raises the target window. On X11 it injects via XTEST / the XInput2 master pointer (no focus steal). On Wayland it goes through libei + xdg-desktop-portal, which injects to the compositor's input focus — Wayland's security model has no per-window background targeting, so a specific non-focused window cannot be aimed at; when no libei backend is available the tool returns a structured background_unavailable error. 'foreground' is the explicit escalation: activate the target (X11 _NET_ACTIVE_WINDOW; Wayland compositor activate), inject, then restore the prior active window — a brief focus swap unless the target was already active. Call bring_to_front first to avoid the flash. Matches the macOS / Windows delivery_mode surface.",
+            "enum": [
+              "background",
+              "foreground"
+            ],
+            "type": "string"
+          },
+          "element_index": {
+            "description": "Element index from the last get_window_state. REQUIRES `pid` and `window_id` alongside it — element_index alone (no pid) fails fast, it is not a silent no-op.",
+            "type": "integer"
+          },
+          "element_token": {
+            "description": "Opaque per-snapshot element handle from `structuredContent.elements[].element_token`. Takes precedence over element_index when both are supplied. Returns an explicit \"stale\" error once a newer snapshot supersedes it — re-snapshot in that case.",
+            "type": "string"
+          },
+          "pid": {
+            "type": "integer"
+          },
+          "scope": {
+            "default": "window",
+            "enum": [
+              "window",
+              "desktop"
+            ],
+            "type": "string"
+          },
+          "session": {
+            "description": "Optional session id: declares/uses the agent cursor and per-session state for this run. The same id works over MCP, the CLI, or the raw socket, and follows the run across apps/windows. Omit to run cursor-less.",
+            "type": "string"
+          },
+          "text": {
+            "type": "string"
+          },
+          "window_id": {
+            "type": "integer"
+          },
+          "x": {
+            "description": "Screenshot-pixel X of the field to type into — the element px action form. Pass x,y (no element_index) and the tool pixel-clicks there to establish real renderer focus, then types. Use for Chromium/Electron inputs the AX path can't reach. Read straight off the get_window_state PNG, same convention as click.",
+            "type": "number"
+          },
+          "y": {
+            "description": "Screenshot-pixel Y of the field (see x).",
+            "type": "number"
+          }
+        },
+        "required": [
+          "text"
+        ],
+        "type": "object"
+      },
+      "annotations": {
+        "destructiveHint": true,
+        "idempotentHint": false,
+        "openWorldHint": true,
+        "readOnlyHint": false
+      },
+      "_meta": {
+        "farming.dev/upstream": "cua-driver",
+        "farming.dev/capabilities": [
+          "input.keyboard.type",
+          "input.keyboard.type.terminal_safe",
+          "accessibility.element_tokens",
+          "input.delivery_mode"
+        ],
+        "farming.dev/risk": {
+          "class": "r1",
+          "enforcement": "metadata_only",
+          "operation_sensitive": false,
+          "version": "1"
+        }
+      }
+    },
+    {
+      "name": "computer_press_key",
+      "upstreamName": "press_key",
+      "description": "Press a key via XSendEvent to a window. No focus steal.",
+      "inputSchema": {
+        "additionalProperties": false,
+        "properties": {
+          "delivery_mode": {
+            "default": "background",
+            "description": "Input delivery mode. 'background' (default) never activates or raises the target window. On X11 it injects via XTEST / the XInput2 master pointer (no focus steal). On Wayland it goes through libei + xdg-desktop-portal, which injects to the compositor's input focus — Wayland's security model has no per-window background targeting, so a specific non-focused window cannot be aimed at; when no libei backend is available the tool returns a structured background_unavailable error. 'foreground' is the explicit escalation: activate the target (X11 _NET_ACTIVE_WINDOW; Wayland compositor activate), inject, then restore the prior active window — a brief focus swap unless the target was already active. Call bring_to_front first to avoid the flash. Matches the macOS / Windows delivery_mode surface.",
+            "enum": [
+              "background",
+              "foreground"
+            ],
+            "type": "string"
+          },
+          "element_index": {
+            "description": "Element index from the last get_window_state. REQUIRES `pid` and `window_id` alongside it — element_index alone (no pid) fails fast, it is not a silent no-op.",
+            "type": "integer"
+          },
+          "element_token": {
+            "description": "Opaque per-snapshot element handle from `structuredContent.elements[].element_token`. Takes precedence over element_index when both are supplied. Returns an explicit \"stale\" error once a newer snapshot supersedes it — re-snapshot in that case.",
+            "type": "string"
+          },
+          "key": {
+            "type": "string"
+          },
+          "modifiers": {
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "pid": {
+            "type": "integer"
+          },
+          "scope": {
+            "default": "window",
+            "enum": [
+              "window",
+              "desktop"
+            ],
+            "type": "string"
+          },
+          "session": {
+            "description": "Optional session id: declares/uses the agent cursor and per-session state for this run. The same id works over MCP, the CLI, or the raw socket, and follows the run across apps/windows. Omit to run cursor-less.",
+            "type": "string"
+          },
+          "window_id": {
+            "type": "integer"
+          },
+          "x": {
+            "description": "Screenshot-pixel X — the element px action form: pixel-click there to focus, then send the key. Use when the key must go to a Chromium/Electron surface the AX path can't focus. Pass with y, no element_index.",
+            "type": "number"
+          },
+          "y": {
+            "description": "Screenshot-pixel Y (see x).",
+            "type": "number"
+          }
+        },
+        "required": [
+          "key"
+        ],
+        "type": "object"
+      },
+      "annotations": {
+        "destructiveHint": true,
+        "idempotentHint": false,
+        "openWorldHint": true,
+        "readOnlyHint": false
+      },
+      "_meta": {
+        "farming.dev/upstream": "cua-driver",
+        "farming.dev/capabilities": [
+          "input.keyboard.press",
+          "accessibility.element_tokens",
+          "input.delivery_mode"
+        ],
+        "farming.dev/risk": {
+          "class": "r1",
+          "enforcement": "metadata_only",
+          "operation_sensitive": false,
+          "version": "1"
+        }
+      }
+    },
+    {
+      "name": "computer_hotkey",
+      "upstreamName": "hotkey",
+      "description": "Press a combination of keys simultaneously, e.g. [\"ctrl\",\"c\"] for Copy. Sent via XSendEvent directly to the target pid; target does NOT need to be frontmost.",
+      "inputSchema": {
+        "additionalProperties": false,
+        "properties": {
+          "delivery_mode": {
+            "default": "background",
+            "description": "Input delivery mode. 'background' (default) never activates or raises the target window. On X11 it injects via XTEST / the XInput2 master pointer (no focus steal). On Wayland it goes through libei + xdg-desktop-portal, which injects to the compositor's input focus — Wayland's security model has no per-window background targeting, so a specific non-focused window cannot be aimed at; when no libei backend is available the tool returns a structured background_unavailable error. 'foreground' is the explicit escalation: activate the target (X11 _NET_ACTIVE_WINDOW; Wayland compositor activate), inject, then restore the prior active window — a brief focus swap unless the target was already active. Call bring_to_front first to avoid the flash. Matches the macOS / Windows delivery_mode surface.",
+            "enum": [
+              "background",
+              "foreground"
+            ],
+            "type": "string"
+          },
+          "element_index": {
+            "description": "Element index from the last get_window_state. REQUIRES `pid` and `window_id` alongside it — element_index alone (no pid) fails fast, it is not a silent no-op.",
+            "type": "integer"
+          },
+          "element_token": {
+            "description": "Opaque per-snapshot element handle from `structuredContent.elements[].element_token`. Takes precedence over element_index when both are supplied. Returns an explicit \"stale\" error once a newer snapshot supersedes it — re-snapshot in that case.",
+            "type": "string"
+          },
+          "keys": {
+            "description": "Modifier(s) + one non-modifier key, e.g. [\"ctrl\",\"c\"].",
+            "items": {
+              "type": "string"
+            },
+            "minItems": 2,
+            "type": "array"
+          },
+          "pid": {
+            "type": "integer"
+          },
+          "scope": {
+            "default": "window",
+            "enum": [
+              "window",
+              "desktop"
+            ],
+            "type": "string"
+          },
+          "session": {
+            "description": "Optional session id: declares/uses the agent cursor and per-session state for this run. The same id works over MCP, the CLI, or the raw socket, and follows the run across apps/windows. Omit to run cursor-less.",
+            "type": "string"
+          },
+          "window_id": {
+            "type": "integer"
+          },
+          "x": {
+            "description": "Screenshot-pixel X — the element px action form: pixel-click there to focus, then send the combo (so e.g. Ctrl+V pastes into that field). Pass with y. Use for Chromium/Electron surfaces the background combo can't reach.",
+            "type": "number"
+          },
+          "y": {
+            "description": "Screenshot-pixel Y (see x).",
+            "type": "number"
+          }
+        },
+        "required": [
+          "keys"
+        ],
+        "type": "object"
+      },
+      "annotations": {
+        "destructiveHint": true,
+        "idempotentHint": false,
+        "openWorldHint": true,
+        "readOnlyHint": false
+      },
+      "_meta": {
+        "farming.dev/upstream": "cua-driver",
+        "farming.dev/capabilities": [
+          "input.keyboard.hotkey",
+          "input.delivery_mode"
+        ],
+        "farming.dev/risk": {
+          "class": "r1",
+          "enforcement": "metadata_only",
+          "operation_sensitive": false,
+          "version": "1"
+        }
+      }
+    },
+    {
+      "name": "computer_set_value",
+      "upstreamName": "set_value",
+      "description": "Set value of an AT-SPI element via SetValue action.",
+      "inputSchema": {
+        "additionalProperties": false,
+        "properties": {
+          "element_index": {
+            "description": "Element index from the last get_window_state. REQUIRES `pid` and `window_id` alongside it — element_index alone (no pid) fails fast, it is not a silent no-op.",
+            "type": "integer"
+          },
+          "element_token": {
+            "description": "Opaque per-snapshot element handle from `structuredContent.elements[].element_token`. Takes precedence over element_index when both are supplied. Returns an explicit \"stale\" error once a newer snapshot supersedes it — re-snapshot in that case.",
+            "type": "string"
+          },
+          "pid": {
+            "type": "integer"
+          },
+          "session": {
+            "description": "Optional session id: declares/uses the agent cursor and per-session state for this run. The same id works over MCP, the CLI, or the raw socket, and follows the run across apps/windows. Omit to run cursor-less.",
+            "type": "string"
+          },
+          "value": {
+            "type": "string"
+          },
+          "window_id": {
+            "description": "Required when element_index is used; optional when element_token is supplied (the token carries it).",
+            "type": "integer"
+          }
+        },
+        "required": [
+          "pid",
+          "value"
+        ],
+        "type": "object"
+      },
+      "annotations": {
+        "destructiveHint": true,
+        "idempotentHint": false,
+        "openWorldHint": true,
+        "readOnlyHint": false
+      },
+      "_meta": {
+        "farming.dev/upstream": "cua-driver",
+        "farming.dev/capabilities": [
+          "input.keyboard.type",
+          "accessibility.element_tokens"
+        ],
+        "farming.dev/risk": {
+          "class": "r1",
+          "enforcement": "metadata_only",
+          "operation_sensitive": false,
+          "version": "1"
+        }
+      }
+    },
+    {
+      "name": "computer_scroll",
+      "upstreamName": "scroll",
+      "description": "Scroll the target pid's focused region via XSendEvent Button4/5. direction required; by defaults to line, amount defaults to 3.",
+      "inputSchema": {
+        "additionalProperties": false,
+        "properties": {
+          "amount": {
+            "maximum": 50,
+            "minimum": 1,
+            "type": "integer"
+          },
+          "by": {
+            "enum": [
+              "line",
+              "page"
+            ],
+            "type": "string"
+          },
+          "cursor_id": {
+            "description": "Optional multi-cursor instance id. Default: 'default'.",
+            "type": "string"
+          },
+          "delivery_mode": {
+            "default": "background",
+            "description": "Input delivery mode. 'background' (default) never activates or raises the target window. On X11 it injects via XTEST / the XInput2 master pointer (no focus steal). On Wayland it goes through libei + xdg-desktop-portal, which injects to the compositor's input focus — Wayland's security model has no per-window background targeting, so a specific non-focused window cannot be aimed at; when no libei backend is available the tool returns a structured background_unavailable error. 'foreground' is the explicit escalation: activate the target (X11 _NET_ACTIVE_WINDOW; Wayland compositor activate), inject, then restore the prior active window — a brief focus swap unless the target was already active. Call bring_to_front first to avoid the flash. Matches the macOS / Windows delivery_mode surface.",
+            "enum": [
+              "background",
+              "foreground"
+            ],
+            "type": "string"
+          },
+          "direction": {
+            "enum": [
+              "up",
+              "down",
+              "left",
+              "right"
+            ],
+            "type": "string"
+          },
+          "element_index": {
+            "description": "Element index from the last get_window_state. REQUIRES `pid` and `window_id` alongside it — element_index alone (no pid) fails fast, it is not a silent no-op.",
+            "type": "integer"
+          },
+          "element_token": {
+            "description": "Opaque per-snapshot element handle from `structuredContent.elements[].element_token`. Takes precedence over element_index when both are supplied. Returns an explicit \"stale\" error once a newer snapshot supersedes it — re-snapshot in that case.",
+            "type": "string"
+          },
+          "pid": {
+            "type": "integer"
+          },
+          "scope": {
+            "default": "window",
+            "enum": [
+              "window",
+              "desktop"
+            ],
+            "type": "string"
+          },
+          "session": {
+            "description": "Optional session id: declares/uses the agent cursor and per-session state for this run. The same id works over MCP, the CLI, or the raw socket, and follows the run across apps/windows. Omit to run cursor-less.",
+            "type": "string"
+          },
+          "window_id": {
+            "type": "integer"
+          },
+          "x": {
+            "description": "Window-local screenshot-pixel X of the scroll target. Pass with y and without element_index.",
+            "type": "number"
+          },
+          "y": {
+            "description": "Window-local screenshot-pixel Y of the scroll target. Pass with x and without element_index.",
+            "type": "number"
+          }
+        },
+        "required": [
+          "direction"
+        ],
+        "type": "object"
+      },
+      "annotations": {
+        "destructiveHint": false,
+        "idempotentHint": false,
+        "openWorldHint": true,
+        "readOnlyHint": false
+      },
+      "_meta": {
+        "farming.dev/upstream": "cua-driver",
+        "farming.dev/capabilities": [
+          "input.pointer.scroll",
+          "accessibility.element_tokens",
+          "input.delivery_mode"
+        ],
+        "farming.dev/risk": {
+          "class": "r1",
+          "enforcement": "metadata_only",
+          "operation_sensitive": false,
+          "version": "1"
+        }
+      }
+    },
+    {
+      "name": "computer_get_screen_size",
+      "upstreamName": "get_screen_size",
+      "description": "Return the logical size of the main display in points plus its backing scale factor. Agents click in points; Retina displays have scale_factor 2.0. Requires no TCC permissions.",
+      "inputSchema": {
+        "additionalProperties": false,
+        "properties": {
+          "session": {
+            "description": "Optional session id: declares/uses the agent cursor and per-session state for this run. The same id works over MCP, the CLI, or the raw socket, and follows the run across apps/windows. Omit to run cursor-less.",
+            "type": "string"
+          }
+        },
+        "type": "object"
+      },
+      "annotations": {
+        "destructiveHint": false,
+        "idempotentHint": true,
+        "openWorldHint": false,
+        "readOnlyHint": true
+      },
+      "_meta": {
+        "farming.dev/upstream": "cua-driver",
+        "farming.dev/capabilities": [
+          "screen.dimensions"
+        ],
+        "farming.dev/risk": {
+          "class": "r0",
+          "enforcement": "metadata_only",
+          "operation_sensitive": false,
+          "version": "1"
+        }
+      }
+    },
+    {
+      "name": "computer_get_desktop_state",
+      "upstreamName": "get_desktop_state",
+      "description": "Full-display vision screenshot in true screen pixels (no downscale), for capture_scope=\"desktop\" GUI loops. Captures the entire display (root window) as native-size PNG so screen-absolute pixel coordinates land exactly. No AT-SPI walk.",
+      "inputSchema": {
+        "additionalProperties": false,
+        "properties": {
+          "screenshot_out_file": {
+            "description": "Write PNG here instead of base64.",
+            "type": "string"
+          },
+          "session": {
+            "description": "Optional session id.",
+            "type": "string"
+          }
+        },
+        "type": "object"
+      },
+      "annotations": {
+        "destructiveHint": false,
+        "idempotentHint": false,
+        "openWorldHint": false,
+        "readOnlyHint": true
+      },
+      "_meta": {
+        "farming.dev/upstream": "cua-driver",
+        "farming.dev/capabilities": [
+          "screen.capture",
+          "screen.dimensions"
+        ],
+        "farming.dev/risk": {
+          "class": "r2",
+          "enforcement": "metadata_only",
+          "operation_sensitive": false,
+          "version": "1"
+        }
+      }
+    },
+    {
+      "name": "computer_get_cursor_position",
+      "upstreamName": "get_cursor_position",
+      "description": "Return the current mouse cursor position in screen points (origin top-left).",
+      "inputSchema": {
+        "additionalProperties": false,
+        "properties": {
+          "session": {
+            "description": "Optional session id: declares/uses the agent cursor and per-session state for this run. The same id works over MCP, the CLI, or the raw socket, and follows the run across apps/windows. Omit to run cursor-less.",
+            "type": "string"
+          }
+        },
+        "type": "object"
+      },
+      "annotations": {
+        "destructiveHint": false,
+        "idempotentHint": true,
+        "openWorldHint": false,
+        "readOnlyHint": true
+      },
+      "_meta": {
+        "farming.dev/upstream": "cua-driver",
+        "farming.dev/capabilities": [
+          "screen.cursor.position"
+        ],
+        "farming.dev/risk": {
+          "class": "r0",
+          "enforcement": "metadata_only",
+          "operation_sensitive": false,
+          "version": "1"
+        }
+      }
+    },
+    {
+      "name": "computer_move_cursor",
+      "upstreamName": "move_cursor",
+      "description": "Move the agent cursor overlay, or with scope=desktop move the real OS pointer in get_desktop_state coordinates.",
+      "inputSchema": {
+        "additionalProperties": false,
+        "properties": {
+          "cursor_id": {
+            "type": "string"
+          },
+          "scope": {
+            "default": "window",
+            "enum": [
+              "window",
+              "desktop"
+            ],
+            "type": "string"
+          },
+          "session": {
+            "description": "Optional session id: declares/uses the agent cursor and per-session state for this run. The same id works over MCP, the CLI, or the raw socket, and follows the run across apps/windows. Omit to run cursor-less.",
+            "type": "string"
+          },
+          "x": {
+            "type": "number"
+          },
+          "y": {
+            "type": "number"
+          }
+        },
+        "required": [
+          "x",
+          "y"
+        ],
+        "type": "object"
+      },
+      "annotations": {
+        "destructiveHint": false,
+        "idempotentHint": true,
+        "openWorldHint": false,
+        "readOnlyHint": false
+      },
+      "_meta": {
+        "farming.dev/upstream": "cua-driver",
+        "farming.dev/capabilities": [
+          "agent_cursor.move",
+          "input.pointer.move"
+        ],
+        "farming.dev/risk": {
+          "class": "r1",
+          "enforcement": "metadata_only",
+          "operation_sensitive": false,
+          "version": "1"
+        }
+      }
+    },
+    {
+      "name": "computer_set_agent_cursor_enabled",
+      "upstreamName": "set_agent_cursor_enabled",
+      "description": "Show or hide the agent cursor overlay.",
+      "inputSchema": {
+        "additionalProperties": false,
+        "properties": {
+          "cursor_id": {
+            "type": "string"
+          },
+          "enabled": {
+            "type": "boolean"
+          },
+          "session": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "enabled"
+        ],
+        "type": "object"
+      },
+      "annotations": {
+        "destructiveHint": false,
+        "idempotentHint": true,
+        "openWorldHint": false,
+        "readOnlyHint": false
+      },
+      "_meta": {
+        "farming.dev/upstream": "cua-driver",
+        "farming.dev/capabilities": [
+          "agent_cursor.set_enabled"
+        ],
+        "farming.dev/risk": {
+          "class": "r1",
+          "enforcement": "metadata_only",
+          "operation_sensitive": false,
+          "version": "1"
+        }
+      }
+    },
+    {
+      "name": "computer_set_agent_cursor_motion",
+      "upstreamName": "set_agent_cursor_motion",
+      "description": "Configure the visual appearance and motion curve of an agent cursor instance.\n\n- cursor_id: instance name (default='default')\n- cursor_icon: built-in ('arrow' | 'teardrop') or a path to a PNG/JPEG/SVG/ICO file; '' reverts to the default cursor\n- cursor_color: hex color e.g. '#00FFFF' or CSS name\n- cursor_label: short text shown near the cursor\n- cursor_size: dot radius in points (default=16)\n- cursor_opacity: 0.0–1.0 (default=0.85)\n\nMotion curve (Bezier):\n- arc_size: perpendicular deflection as fraction of path length [0,1]. Default 0.25\n- spring: settle damping [0.3,1.0]; 1.0=no overshoot. Default 0.72\n- glide_duration_ms: fixed flight duration per move [50,5000]; omit for speed-based\n- dwell_after_click_ms: pause after click ripple [0,5000]. Default 80\n- idle_hide_ms: auto-hide delay [0,60000]; 0=never. Default 20000",
+      "inputSchema": {
+        "additionalProperties": false,
+        "properties": {
+          "arc_flow": {
+            "description": "Asymmetry bias [-1,1]. Default 0.0.",
+            "type": "number"
+          },
+          "arc_size": {
+            "description": "Arc deflection as fraction of path length [0,1]. Default 0.25.",
+            "type": "number"
+          },
+          "cursor_color": {
+            "type": "string"
+          },
+          "cursor_icon": {
+            "type": "string"
+          },
+          "cursor_id": {
+            "type": "string"
+          },
+          "cursor_label": {
+            "type": "string"
+          },
+          "cursor_opacity": {
+            "type": "number"
+          },
+          "cursor_size": {
+            "type": "number"
+          },
+          "dwell_after_click_ms": {
+            "maximum": 5000,
+            "minimum": 0,
+            "type": "number"
+          },
+          "end_handle": {
+            "description": "End-handle fraction [0,1]. Default 0.3.",
+            "type": "number"
+          },
+          "glide_duration_ms": {
+            "maximum": 5000,
+            "minimum": 50,
+            "type": "number"
+          },
+          "idle_hide_ms": {
+            "maximum": 60000,
+            "minimum": 0,
+            "type": "number"
+          },
+          "session": {
+            "type": "string"
+          },
+          "spring": {
+            "description": "Settle damping [0.3,1.0]. Default 0.72.",
+            "type": "number"
+          },
+          "start_handle": {
+            "description": "Start-handle fraction [0,1]. Default 0.3.",
+            "type": "number"
+          },
+          "turn_radius": {
+            "maximum": 1000,
+            "minimum": 1,
+            "type": "number"
+          }
+        },
+        "type": "object"
+      },
+      "annotations": {
+        "destructiveHint": false,
+        "idempotentHint": true,
+        "openWorldHint": false,
+        "readOnlyHint": false
+      },
+      "_meta": {
+        "farming.dev/upstream": "cua-driver",
+        "farming.dev/capabilities": [
+          "agent_cursor.set_motion"
+        ],
+        "farming.dev/risk": {
+          "class": "r1",
+          "enforcement": "metadata_only",
+          "operation_sensitive": false,
+          "version": "1"
+        }
+      }
+    },
+    {
+      "name": "computer_get_agent_cursor_state",
+      "upstreamName": "get_agent_cursor_state",
+      "description": "Return the current state of all agent cursor instances.",
+      "inputSchema": {
+        "additionalProperties": false,
+        "properties": {
+          "cursor_id": {
+            "type": "string"
+          },
+          "session": {
+            "type": "string"
+          }
+        },
+        "type": "object"
+      },
+      "annotations": {
+        "destructiveHint": false,
+        "idempotentHint": true,
+        "openWorldHint": false,
+        "readOnlyHint": true
+      },
+      "_meta": {
+        "farming.dev/upstream": "cua-driver",
+        "farming.dev/capabilities": [
+          "agent_cursor.state"
+        ],
+        "farming.dev/risk": {
+          "class": "r0",
+          "enforcement": "metadata_only",
+          "operation_sensitive": false,
+          "version": "1"
+        }
+      }
+    },
+    {
+      "name": "computer_set_agent_cursor_style",
+      "upstreamName": "set_agent_cursor_style",
+      "description": "Update the visual style of the agent cursor overlay.\n\n- gradient_colors: array of CSS hex strings (e.g. [\"#FF0000\",\"#0000FF\"]) used as the arrow fill gradient from tip to tail. Empty array reverts to the default palette colours.\n- bloom_color: hex string for the radial halo/bloom behind the cursor (e.g. \"#00FFFF\"). Empty string reverts to the default.\n- image_path: path to a PNG, JPEG, SVG, or ICO file to use as the cursor icon instead of the default silhouette. Empty string reverts to the default cursor.\nAll parameters are optional; omit any you do not want to change.",
+      "inputSchema": {
+        "additionalProperties": false,
+        "properties": {
+          "bloom_color": {
+            "description": "Hex bloom/halo colour (e.g. '#00FFFF'). '' = revert to default.",
+            "type": "string"
+          },
+          "cursor_id": {
+            "description": "Cursor instance. Default: 'default'.",
+            "type": "string"
+          },
+          "gradient_colors": {
+            "description": "CSS hex gradient stops tip→tail. [] = revert to default.",
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "image_path": {
+            "description": "Path to PNG/JPEG/SVG/ICO cursor image. '' = revert to the default cursor.",
+            "type": "string"
+          },
+          "session": {
+            "description": "Optional multi-cursor session id; takes precedence over cursor_id.",
+            "type": "string"
+          }
+        },
+        "type": "object"
+      },
+      "annotations": {
+        "destructiveHint": false,
+        "idempotentHint": true,
+        "openWorldHint": false,
+        "readOnlyHint": false
+      },
+      "_meta": {
+        "farming.dev/upstream": "cua-driver",
+        "farming.dev/capabilities": [
+          "agent_cursor.set_style"
+        ],
+        "farming.dev/risk": {
+          "class": "r1",
+          "enforcement": "metadata_only",
+          "operation_sensitive": false,
+          "version": "1"
+        }
+      }
+    },
+    {
+      "name": "computer_check_permissions",
+      "upstreamName": "check_permissions",
+      "description": "Check required permissions for cua-driver-rs on Linux.",
+      "inputSchema": {
+        "additionalProperties": false,
+        "properties": {},
+        "type": "object"
+      },
+      "annotations": {
+        "destructiveHint": false,
+        "idempotentHint": true,
+        "openWorldHint": false,
+        "readOnlyHint": true
+      },
+      "_meta": {
+        "farming.dev/upstream": "cua-driver",
+        "farming.dev/capabilities": [
+          "system.permissions.tcc",
+          "system.permissions.tcc.accessibility",
+          "system.permissions.tcc.screen_recording"
+        ],
+        "farming.dev/risk": {
+          "class": "r0",
+          "enforcement": "metadata_only",
+          "operation_sensitive": false,
+          "version": "1"
+        }
+      }
+    },
+    {
+      "name": "computer_health_report",
+      "upstreamName": "health_report",
+      "description": "Single-call end-to-end driver diagnostics. Designed to let downstream consumers ship one stable call instead of stitching together check_permissions, doctor, version, bundle attribution, and platform capability status. On macOS, prompt-capable direct capture is deliberately skipped; use `cua-driver permissions grant` to verify it explicitly. cua-driver owns the health model; consumers stay thin.\n\nInput — all optional:\n  {\n    \"include\": [\"<check_name>\", ...],   // run only these\n    \"skip\":    [\"<check_name>\", ...]    // skip these\n  }\nIf both are given, `include` wins.\n\nCanonical check names:\n  macOS  : binary_version, platform_supported, session_active,\n           bundle_identity, tcc_accessibility, tcc_screen_recording,\n           ax_capability, screen_capture_capability\n  Windows: binary_version, platform_supported, session_active,\n           ax_capability (via UIA), screen_capture_capability (via DXGI)\n  Linux  : binary_version, platform_supported, session_active,\n           ax_capability (via AT-SPI), screen_capture_capability (via X11)\n\nOutput — stable contract, schema_version=\"1\":\n  {\n    \"schema_version\": \"1\",\n    \"platform\": \"darwin\" | \"win32\" | \"linux\",\n    \"driver_version\": \"<semver>\",\n    \"overall\": \"ok\" | \"degraded\" | \"failed\",\n    \"checks\": [\n      {\n        \"name\": \"<one of the canonical names above>\",\n        \"status\": \"pass\" | \"fail\" | \"skip\",\n        \"message\": \"<one-line summary, always present>\",\n        \"hint\": \"<remediation step, present when status=fail>\",\n        \"data\": { /* check-specific structured fields */ }\n      },\n      ...\n    ]\n  }\n\n`overall` rules:\n  - `ok`       — every non-skipped check passes\n  - `degraded` — at least one non-core check fails (binary is still usable)\n  - `failed`   — any core check fails (binary_version, platform_supported, session_active)\n\nStability: schema_version=\"1\" is the contract. Future breaking changes will be `\"2\"`. Adding new check names under the same schema_version is non-breaking; consumers must tolerate unknown check names.",
+      "inputSchema": {
+        "additionalProperties": false,
+        "properties": {
+          "include": {
+            "description": "Only run these checks (canonical names). Wins over `skip`.",
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "skip": {
+            "description": "Skip these checks (canonical names). Ignored when `include` is set.",
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          }
+        },
+        "type": "object"
+      },
+      "annotations": {
+        "destructiveHint": false,
+        "idempotentHint": true,
+        "openWorldHint": false,
+        "readOnlyHint": true
+      },
+      "_meta": {
+        "farming.dev/upstream": "cua-driver",
+        "farming.dev/capabilities": [],
+        "farming.dev/risk": {
+          "class": "r0",
+          "enforcement": "metadata_only",
+          "operation_sensitive": false,
+          "version": "1"
+        }
+      }
+    },
+    {
+      "name": "computer_get_config",
+      "upstreamName": "get_config",
+      "description": "Return current cua-driver-rs configuration.",
+      "inputSchema": {
+        "additionalProperties": false,
+        "properties": {},
+        "type": "object"
+      },
+      "annotations": {
+        "destructiveHint": false,
+        "idempotentHint": true,
+        "openWorldHint": false,
+        "readOnlyHint": true
+      },
+      "_meta": {
+        "farming.dev/upstream": "cua-driver",
+        "farming.dev/capabilities": [
+          "system.config.read"
+        ],
+        "farming.dev/risk": {
+          "class": "r0",
+          "enforcement": "metadata_only",
+          "operation_sensitive": false,
+          "version": "1"
+        }
+      }
+    },
+    {
+      "name": "computer_set_config",
+      "upstreamName": "set_config",
+      "description": "Update cua-driver-rs configuration. capture_mode / max_image_dimension take effect immediately.\n\nTwo input shapes (both accepted, matching Windows/Swift):\n- **{key, value}** (preferred): `{\"key\": \"max_image_dimension\", \"value\": 800}` — single leaf write.\n- **Legacy per-field**: `{\"capture_mode\": \"som\", \"max_image_dimension\": 0}`.\n\nThe experimental_pip keys persist to ~/.cua-driver/config.json and apply on next daemon restart (the PiP backend is initialised once at startup; Linux ships only the trait stub today — see issue #1729).",
+      "inputSchema": {
+        "additionalProperties": false,
+        "properties": {
+          "capture_mode": {
+            "description": "Legacy per-field shape. Default capture mode for get_window_state. (\"som\"/\"screenshot\" still decode as deprecated aliases.)",
+            "enum": [
+              "ax",
+              "vision"
+            ],
+            "type": "string"
+          },
+          "experimental_pip": {
+            "description": "Enable the experimental PiP preview window (applies next restart; Linux backend stubbed).",
+            "type": "boolean"
+          },
+          "experimental_pip_geometry": {
+            "description": "PiP window size + optional position in `WxH` or `WxH+X+Y` form.",
+            "type": "string"
+          },
+          "key": {
+            "description": "Name of a single config field to write ({key, value} shape). Pair with `value`.",
+            "type": "string"
+          },
+          "max_image_dimension": {
+            "description": "Legacy per-field shape. Max dimension for screenshot resizing (0 = no limit).",
+            "type": "integer"
+          },
+          "value": {
+            "description": "New value for `key`. JSON type depends on the key."
+          }
+        },
+        "type": "object"
+      },
+      "annotations": {
+        "destructiveHint": false,
+        "idempotentHint": true,
+        "openWorldHint": false,
+        "readOnlyHint": false
+      },
+      "_meta": {
+        "farming.dev/upstream": "cua-driver",
+        "farming.dev/capabilities": [
+          "system.config.write"
+        ],
+        "farming.dev/risk": {
+          "class": "r2",
+          "enforcement": "metadata_only",
+          "operation_sensitive": false,
+          "version": "1"
+        }
+      }
+    },
+    {
+      "name": "computer_get_accessibility_tree",
+      "upstreamName": "get_accessibility_tree",
+      "description": "Return a lightweight snapshot of the desktop: running processes and on-screen visible X11 windows with their bounds and owner pid.\n\nFor the full AT-SPI subtree of a single window (with interactive element indices you can click by), use get_window_state instead — this is a fast discovery read.",
+      "inputSchema": {
+        "additionalProperties": false,
+        "properties": {},
+        "type": "object"
+      },
+      "annotations": {
+        "destructiveHint": false,
+        "idempotentHint": true,
+        "openWorldHint": false,
+        "readOnlyHint": true
+      },
+      "_meta": {
+        "farming.dev/upstream": "cua-driver",
+        "farming.dev/capabilities": [
+          "accessibility.tree",
+          "accessibility.tree.structured"
+        ],
+        "farming.dev/risk": {
+          "class": "r2",
+          "enforcement": "metadata_only",
+          "operation_sensitive": false,
+          "version": "1"
+        }
+      }
+    },
+    {
+      "name": "computer_zoom",
+      "upstreamName": "zoom",
+      "description": "Capture a cropped JPEG of a window region (x1,y1)–(x2,y2) in screenshot pixels, with 20% padding. Output is at most 500 px wide.\n\nAfter a zoom, pass from_zoom=true to click/type_text to auto-translate coordinates back to full-window space.",
+      "inputSchema": {
+        "additionalProperties": false,
+        "properties": {
+          "pid": {
+            "description": "Target pid — required for from_zoom click/type translation.",
+            "type": "integer"
+          },
+          "window_id": {
+            "type": "integer"
+          },
+          "x1": {
+            "type": "number"
+          },
+          "x2": {
+            "type": "number"
+          },
+          "y1": {
+            "type": "number"
+          },
+          "y2": {
+            "type": "number"
+          }
+        },
+        "required": [
+          "window_id",
+          "x1",
+          "y1",
+          "x2",
+          "y2"
+        ],
+        "type": "object"
+      },
+      "annotations": {
+        "destructiveHint": false,
+        "idempotentHint": true,
+        "openWorldHint": false,
+        "readOnlyHint": true
+      },
+      "_meta": {
+        "farming.dev/upstream": "cua-driver",
+        "farming.dev/capabilities": [
+          "screen.capture",
+          "screen.capture.window",
+          "screen.capture.region"
+        ],
+        "farming.dev/risk": {
+          "class": "r2",
+          "enforcement": "metadata_only",
+          "operation_sensitive": false,
+          "version": "1"
+        }
+      }
+    },
+    {
+      "name": "computer_page",
+      "upstreamName": "page",
+      "description": "Legacy browser compatibility tool. Prefer get_browser_state and the typed browser_* tools for exact targeting, endpoint ownership, and consent. Read-only get_text and query_dom remain available by default. Mutating actions require the daemon operator to set CUA_DRIVER_ENABLE_LEGACY_PAGE_MUTATIONS=1 before daemon startup (restart the daemon after changing it); this escape hatch does not provide the typed browser surface's exact binding or existing-profile grant guarantees. Supports Chrome, Brave, Edge, Safari (via AppleScript on macOS), Electron apps (via CDP), Chromium/Firefox on Windows (via UIA for read; CDP for execute_javascript when --remote-debugging-port is set), and WKWebView/Tauri/AT-SPI fallbacks.\n\nActions:\n- execute_javascript: Run JS and return the result.\n- get_text: Extract visible text from the page.\n- query_dom: Find elements matching a CSS selector.\n- click_element: Click a CSS-selected element AND animate the agent cursor to its on-screen center first (so the user sees what the agent is doing). Prefer over `execute_javascript('el.click()')` whenever you want visible cursor feedback.\n- insert_text: Insert `text` at whatever currently holds DOM focus in one native operation (CDP Input.insertText) — no synthesized key events, but more durable than a one-shot execute_javascript write since rich-text editors already have to treat it like an IME commit. Try this before type_keystrokes on a contenteditable that discarded an execute_javascript write. Click/focus the target field first.\n- type_keystrokes: Type `text` via real per-character keystroke events into whatever currently holds DOM focus. Slower than insert_text but the most durable rung — use it when insert_text also gets discarded, or the editor's own keydown/keyup handlers need to see real keys. Click/focus the target field first.\n- enable_javascript_apple_events: macOS-only — patch the browser's Preferences to allow JS from Apple Events (Chrome/Brave/Edge, requires user confirmation and a browser restart).",
+      "inputSchema": {
+        "additionalProperties": false,
+        "properties": {
+          "action": {
+            "description": "Action to perform.",
+            "enum": [
+              "execute_javascript",
+              "get_text",
+              "query_dom",
+              "click_element",
+              "insert_text",
+              "type_keystrokes",
+              "enable_javascript_apple_events"
+            ],
+            "type": "string"
+          },
+          "attributes": {
+            "description": "Element attributes to include in query_dom results.",
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "bundle_id": {
+            "description": "Bundle ID of the browser. Required for enable_javascript_apple_events (macOS only).",
+            "type": "string"
+          },
+          "cdp_port": {
+            "description": "Optional, for execute_javascript/insert_text/type_keystrokes: use this exact CDP port instead of auto-discovering one from pid. Needed when the port was opened via the browser's own remote-debugging toggle rather than a launch-time flag, since that path may not answer the auto-discovery probe.",
+            "maximum": 65535,
+            "minimum": 1,
+            "type": "integer"
+          },
+          "css_selector": {
+            "description": "CSS selector for query_dom (e.g. 'a', 'button', 'input', 'h1'-'h6', 'p', 'img', 'select', '*').",
+            "type": "string"
+          },
+          "javascript": {
+            "description": "JavaScript to execute. Required for execute_javascript.",
+            "type": "string"
+          },
+          "pid": {
+            "description": "Target process ID.",
+            "type": "integer"
+          },
+          "selector": {
+            "description": "CSS selector for click_element (e.g. 'button.submit', '#login a').",
+            "type": "string"
+          },
+          "target_url_contains": {
+            "description": "Optional, for execute_javascript/insert_text/type_keystrokes: require exactly one browser tab whose URL contains this substring. Use this on a multi-tab browser — there's no built-in link between window_id and which tab a CDP call reaches.",
+            "type": "string"
+          },
+          "text": {
+            "description": "Text to insert or type. Required for insert_text and type_keystrokes. The target field must already have DOM focus (click/focus it first).",
+            "type": "string"
+          },
+          "user_has_confirmed_enabling": {
+            "description": "Must be true to proceed with enable_javascript_apple_events. This will quit and relaunch the browser.",
+            "type": "boolean"
+          },
+          "window_id": {
+            "description": "Target window ID from list_windows.",
+            "type": "integer"
+          }
+        },
+        "required": [
+          "action"
+        ],
+        "type": "object"
+      },
+      "annotations": {
+        "destructiveHint": false,
+        "idempotentHint": false,
+        "openWorldHint": true,
+        "readOnlyHint": false
+      },
+      "_meta": {
+        "farming.dev/upstream": "cua-driver",
+        "farming.dev/capabilities": [
+          "page.action"
+        ],
+        "farming.dev/risk": {
+          "class": "r3",
+          "enforcement": "metadata_only",
+          "operation_sensitive": true,
+          "version": "1"
+        }
+      }
+    },
+    {
+      "name": "computer_get_browser_state",
+      "upstreamName": "get_browser_state",
+      "description": "Read-only browser inspection. Mode 1 (bind): pass pid + window_id of a native browser window to classify it, correlate it to a CDP target (exact-or-refuse), and mint a session-scoped target id plus tab ids. Mode 2 (snapshot): pass target_id + tab_id. The dom_refs_v1 compatibility format returns composed DOM refs. semantic_v2 joins accessibility, DOM, layout, and viewport state; ranks visible content before retained/offscreen state; and returns a semantic outline, typed action refs, content refs, scoped reads, and opaque continuation. Never performs setup — a missing endpoint is a structured browser_requires_setup refusal pointing at browser_prepare.",
+      "inputSchema": {
+        "additionalProperties": true,
+        "properties": {
+          "continuation": {
+            "description": "Opaque continuation minted by an earlier semantic_v2 response.",
+            "type": "string"
+          },
+          "include_screenshot": {
+            "default": false,
+            "description": "Capture the exact tab viewport as PNG through CDP without selecting the tab or foregrounding its native window. The request refuses if capture cannot be completed.",
+            "type": "boolean"
+          },
+          "pid": {
+            "description": "Native browser process id (bind mode).",
+            "type": "integer"
+          },
+          "query": {
+            "description": "Read-only semantic match over role, accessible name, and visible text.",
+            "type": "string"
+          },
+          "scope_ref": {
+            "description": "Current semantic/content ref whose subtree should be observed.",
+            "type": "string"
+          },
+          "session": {
+            "description": "Stable caller-declared session id. Browser targets, tabs, and refs are scoped to this session.",
+            "type": "string"
+          },
+          "snapshot_format": {
+            "description": "Versioned snapshot contract. dom_refs_v1 remains the compatibility default.",
+            "enum": [
+              "dom_refs_v1",
+              "semantic_v2"
+            ],
+            "type": "string"
+          },
+          "tab_id": {
+            "description": "Opaque tab id from get_browser_state (session-scoped).",
+            "type": "string"
+          },
+          "target_id": {
+            "description": "Opaque browser target id minted by get_browser_state (session-scoped; never a CDP id).",
+            "type": "string"
+          },
+          "window_id": {
+            "description": "Native window id owned by pid (bind mode).",
+            "type": "integer"
+          }
+        },
+        "type": "object"
+      },
+      "annotations": {
+        "destructiveHint": false,
+        "idempotentHint": true,
+        "openWorldHint": false,
+        "readOnlyHint": true
+      },
+      "_meta": {
+        "farming.dev/upstream": "cua-driver",
+        "farming.dev/capabilities": [
+          "browser.state"
+        ],
+        "farming.dev/risk": {
+          "class": "r2",
+          "enforcement": "metadata_only",
+          "operation_sensitive": false,
+          "version": "1"
+        }
+      }
+    },
+    {
+      "name": "computer_browser_prepare",
+      "upstreamName": "browser_prepare",
+      "description": "Explicitly prepare an owned DevTools endpoint for a browser pid. Existing endpoints are detected without side effects. Acting setup for an isolated profile requires host approval or a short-lived setup token plus allow_launch=true. It launches a separate browser and never copies, modifies, or terminates the requested user profile. Existing-profile attachment is explicit and follows the daemon's immutable permission mode: standard requires a certified protected-consent provider, bounded requires a launch-approved exact resource manifest plus protected indicator, and unrestricted requires explicit trusted startup risk acceptance. Ordinary MCP transport approval never proves profile consent. On proven platforms, an authorized request also permits one bounded exact-window setup: open the recognized browser product's fixed remote-debugging page, toggle its uniquely matched per-instance checkbox, prove the PID-owned loopback endpoint, and close the temporary tab. Every visible effect is reported; ambiguity is refused.",
+      "inputSchema": {
+        "additionalProperties": true,
+        "properties": {
+          "allow_launch": {
+            "description": "Allow a separate driver-owned isolated Chromium process to be launched (default false).",
+            "type": "boolean"
+          },
+          "approval_token": {
+            "description": "Legacy single-use setup token. Existing-profile use is disabled unless a trusted launcher explicitly enables the same-user-writable compatibility path.",
+            "type": "string"
+          },
+          "pid": {
+            "description": "Browser process id to prepare.",
+            "type": "integer"
+          },
+          "profile": {
+            "additionalProperties": false,
+            "properties": {
+              "mode": {
+                "enum": [
+                  "isolated_new",
+                  "isolated_named"
+                ],
+                "type": "string"
+              },
+              "name": {
+                "description": "Required only for isolated_named; 1-64 path-safe ASCII characters.",
+                "type": "string"
+              }
+            },
+            "required": [
+              "mode"
+            ],
+            "type": "object"
+          },
+          "session": {
+            "description": "Stable caller-declared session id. Browser targets, tabs, and refs are scoped to this session.",
+            "type": "string"
+          },
+          "strategy": {
+            "additionalProperties": false,
+            "properties": {
+              "kind": {
+                "enum": [
+                  "existing_profile"
+                ],
+                "type": "string"
+              }
+            },
+            "required": [
+              "kind"
+            ],
+            "type": "object"
+          },
+          "window_id": {
+            "description": "Exact native window approval anchor; required for strategy.kind=existing_profile.",
+            "type": "integer"
+          }
+        },
+        "required": [
+          "pid"
+        ],
+        "type": "object"
+      },
+      "annotations": {
+        "destructiveHint": true,
+        "idempotentHint": false,
+        "openWorldHint": true,
+        "readOnlyHint": false
+      },
+      "_meta": {
+        "farming.dev/upstream": "cua-driver",
+        "farming.dev/capabilities": [
+          "browser.prepare"
+        ],
+        "farming.dev/risk": {
+          "class": "r2",
+          "enforcement": "metadata_only",
+          "operation_sensitive": true,
+          "version": "1"
+        }
+      }
+    },
+    {
+      "name": "computer_browser_navigate",
+      "upstreamName": "browser_navigate",
+      "description": "Navigate one tab of an exactly-bound browser target to a new URL (http/https/about only). Refused for heuristic bindings. Navigation invalidates all p<snapshot>:<index> refs for the tab.",
+      "inputSchema": {
+        "additionalProperties": true,
+        "properties": {
+          "session": {
+            "description": "Stable caller-declared session id. Browser targets, tabs, and refs are scoped to this session.",
+            "type": "string"
+          },
+          "tab_id": {
+            "description": "Opaque tab id from get_browser_state (session-scoped).",
+            "type": "string"
+          },
+          "target_id": {
+            "description": "Opaque browser target id minted by get_browser_state (session-scoped; never a CDP id).",
+            "type": "string"
+          },
+          "url": {
+            "description": "Destination URL (http:, https:, or about:).",
+            "type": "string"
+          }
+        },
+        "required": [
+          "target_id",
+          "tab_id",
+          "url"
+        ],
+        "type": "object"
+      },
+      "annotations": {
+        "destructiveHint": false,
+        "idempotentHint": false,
+        "openWorldHint": true,
+        "readOnlyHint": false
+      },
+      "_meta": {
+        "farming.dev/upstream": "cua-driver",
+        "farming.dev/capabilities": [
+          "browser.navigate"
+        ],
+        "farming.dev/risk": {
+          "class": "r2",
+          "enforcement": "metadata_only",
+          "operation_sensitive": false,
+          "version": "1"
+        }
+      }
+    },
+    {
+      "name": "computer_browser_click",
+      "upstreamName": "browser_click",
+      "description": "Click a page element (by ref) or viewport coordinates in an exactly-bound tab. Default route is trusted hardware-like input (Input.dispatchMouseEvent), and refuses where that route cannot preserve standalone-browser background posture. input_route=\"dom_event\" (synthetic el.click(), ref required) is used only when explicitly requested. Refused for heuristic bindings.",
+      "inputSchema": {
+        "additionalProperties": true,
+        "properties": {
+          "input_route": {
+            "description": "\"trusted\" (default): Input.dispatchMouseEvent. It refuses rather than foregrounding a standalone browser. \"dom_event\": synthetic full-background DOM click, only when explicitly requested.",
+            "enum": [
+              "trusted",
+              "dom_event"
+            ],
+            "type": "string"
+          },
+          "ref": {
+            "description": "Page element ref in the p<snapshot>:<index> namespace from get_browser_state. Refs are invalidated by navigation and by newer snapshots of the same tab.",
+            "type": "string"
+          },
+          "session": {
+            "description": "Stable caller-declared session id. Browser targets, tabs, and refs are scoped to this session.",
+            "type": "string"
+          },
+          "tab_id": {
+            "description": "Opaque tab id from get_browser_state (session-scoped).",
+            "type": "string"
+          },
+          "target_id": {
+            "description": "Opaque browser target id minted by get_browser_state (session-scoped; never a CDP id).",
+            "type": "string"
+          },
+          "x": {
+            "description": "Viewport x (CSS px) — alternative to ref.",
+            "type": "number"
+          },
+          "y": {
+            "description": "Viewport y (CSS px) — alternative to ref.",
+            "type": "number"
+          }
+        },
+        "required": [
+          "target_id",
+          "tab_id"
+        ],
+        "type": "object"
+      },
+      "annotations": {
+        "destructiveHint": false,
+        "idempotentHint": false,
+        "openWorldHint": true,
+        "readOnlyHint": false
+      },
+      "_meta": {
+        "farming.dev/upstream": "cua-driver",
+        "farming.dev/capabilities": [
+          "browser.input.click"
+        ],
+        "farming.dev/risk": {
+          "class": "r2",
+          "enforcement": "metadata_only",
+          "operation_sensitive": false,
+          "version": "1"
+        }
+      }
+    },
+    {
+      "name": "computer_browser_type",
+      "upstreamName": "browser_type",
+      "description": "Type text into an exactly-bound tab via the Input domain. mode=\"insert_text\" (default) uses Input.insertText; mode=\"keystrokes\" dispatches per-character key events. Pass a ref to an editable element from the latest snapshot. A ref is required; heuristic bindings are refused.",
+      "inputSchema": {
+        "additionalProperties": true,
+        "properties": {
+          "mode": {
+            "description": "insert_text (default): bulk Input.insertText. keystrokes: per-character Input.dispatchKeyEvent.",
+            "enum": [
+              "insert_text",
+              "keystrokes"
+            ],
+            "type": "string"
+          },
+          "ref": {
+            "description": "Page element ref in the p<snapshot>:<index> namespace from get_browser_state. Refs are invalidated by navigation and by newer snapshots of the same tab.",
+            "type": "string"
+          },
+          "session": {
+            "description": "Stable caller-declared session id. Browser targets, tabs, and refs are scoped to this session.",
+            "type": "string"
+          },
+          "tab_id": {
+            "description": "Opaque tab id from get_browser_state (session-scoped).",
+            "type": "string"
+          },
+          "target_id": {
+            "description": "Opaque browser target id minted by get_browser_state (session-scoped; never a CDP id).",
+            "type": "string"
+          },
+          "text": {
+            "description": "Text to type.",
+            "type": "string"
+          }
+        },
+        "required": [
+          "target_id",
+          "tab_id",
+          "ref",
+          "text"
+        ],
+        "type": "object"
+      },
+      "annotations": {
+        "destructiveHint": false,
+        "idempotentHint": false,
+        "openWorldHint": true,
+        "readOnlyHint": false
+      },
+      "_meta": {
+        "farming.dev/upstream": "cua-driver",
+        "farming.dev/capabilities": [
+          "browser.input.type"
+        ],
+        "farming.dev/risk": {
+          "class": "r2",
+          "enforcement": "metadata_only",
+          "operation_sensitive": false,
+          "version": "1"
+        }
+      }
+    },
+    {
+      "name": "computer_browser_dialog",
+      "upstreamName": "browser_dialog",
+      "description": "Inspect or resolve a page-owned JavaScript alert, confirm, prompt, or beforeunload dialog on one exactly-bound tab. This never handles browser permission UI, extension UI, native dialogs, or file pickers. Inspect returns an opaque dialog_id; accept/dismiss require that exact current id. Resolution defaults to background delivery; Linux callers must explicitly request foreground delivery because Chromium's native modal cannot be resolved there without changing foreground posture.",
+      "inputSchema": {
+        "additionalProperties": true,
+        "properties": {
+          "action": {
+            "enum": [
+              "inspect",
+              "accept",
+              "dismiss"
+            ],
+            "type": "string"
+          },
+          "delivery_mode": {
+            "default": "background",
+            "description": "Requested foreground posture for accept/dismiss. Linux Chromium requires foreground; inspect is read-only.",
+            "enum": [
+              "background",
+              "foreground"
+            ],
+            "type": "string"
+          },
+          "dialog_id": {
+            "description": "Opaque current dialog generation returned by action=inspect.",
+            "type": "string"
+          },
+          "prompt_text": {
+            "description": "Sensitive response text, valid only when accepting a prompt dialog.",
+            "type": "string"
+          },
+          "session": {
+            "description": "Stable caller-declared session id. Browser targets, tabs, and refs are scoped to this session.",
+            "type": "string"
+          },
+          "tab_id": {
+            "description": "Opaque tab id from get_browser_state (session-scoped).",
+            "type": "string"
+          },
+          "target_id": {
+            "description": "Opaque browser target id minted by get_browser_state (session-scoped; never a CDP id).",
+            "type": "string"
+          }
+        },
+        "required": [
+          "target_id",
+          "tab_id",
+          "action"
+        ],
+        "type": "object"
+      },
+      "annotations": {
+        "destructiveHint": false,
+        "idempotentHint": false,
+        "openWorldHint": true,
+        "readOnlyHint": false
+      },
+      "_meta": {
+        "farming.dev/upstream": "cua-driver",
+        "farming.dev/capabilities": [
+          "browser.dialog",
+          "input.delivery_mode"
+        ],
+        "farming.dev/risk": {
+          "class": "r3",
+          "enforcement": "metadata_only",
+          "operation_sensitive": true,
+          "version": "1"
+        }
+      }
+    },
+    {
+      "name": "computer_browser_set_input_files",
+      "upstreamName": "browser_set_input_files",
+      "description": "Assign one or more explicit absolute local files to an exact live <input type=file> ref through CDP. This bypasses native file pickers, rejects symlinks and non-regular files, and never returns local paths.",
+      "inputSchema": {
+        "additionalProperties": true,
+        "properties": {
+          "files": {
+            "items": {
+              "description": "Absolute path to one local regular file.",
+              "type": "string"
+            },
+            "maxItems": 32,
+            "minItems": 1,
+            "type": "array"
+          },
+          "ref": {
+            "description": "Page element ref in the p<snapshot>:<index> namespace from get_browser_state. Refs are invalidated by navigation and by newer snapshots of the same tab.",
+            "type": "string"
+          },
+          "session": {
+            "description": "Stable caller-declared session id. Browser targets, tabs, and refs are scoped to this session.",
+            "type": "string"
+          },
+          "tab_id": {
+            "description": "Opaque tab id from get_browser_state (session-scoped).",
+            "type": "string"
+          },
+          "target_id": {
+            "description": "Opaque browser target id minted by get_browser_state (session-scoped; never a CDP id).",
+            "type": "string"
+          }
+        },
+        "required": [
+          "target_id",
+          "tab_id",
+          "ref",
+          "files"
+        ],
+        "type": "object"
+      },
+      "annotations": {
+        "destructiveHint": false,
+        "idempotentHint": false,
+        "openWorldHint": true,
+        "readOnlyHint": false
+      },
+      "_meta": {
+        "farming.dev/upstream": "cua-driver",
+        "farming.dev/capabilities": [
+          "browser.input.files"
+        ],
+        "farming.dev/risk": {
+          "class": "r3",
+          "enforcement": "metadata_only",
+          "operation_sensitive": false,
+          "version": "1"
+        }
+      }
+    },
+    {
+      "name": "computer_browser_download",
+      "upstreamName": "browser_download",
+      "description": "Trigger one download through an exact live browser ref and save it inside an explicitly approved directory. Requires MCP-host destructive-tool approval, refuses ambiguous or stale capabilities, and never returns the source URL, filename, or destination path.",
+      "inputSchema": {
+        "additionalProperties": true,
+        "properties": {
+          "destination_root": {
+            "description": "Absolute, existing, canonical directory approved to receive the download.",
+            "type": "string"
+          },
+          "ref": {
+            "description": "Live page ref whose activation initiates the download.",
+            "type": "string"
+          },
+          "session": {
+            "description": "Explicit caller session owning the browser capabilities.",
+            "type": "string"
+          },
+          "tab_id": {
+            "description": "Opaque exact tab id from get_browser_state.",
+            "type": "string"
+          },
+          "target_id": {
+            "description": "Opaque exact browser target id from get_browser_state.",
+            "type": "string"
+          }
+        },
+        "required": [
+          "session",
+          "target_id",
+          "tab_id",
+          "ref",
+          "destination_root"
+        ],
+        "type": "object"
+      },
+      "annotations": {
+        "destructiveHint": true,
+        "idempotentHint": false,
+        "openWorldHint": true,
+        "readOnlyHint": false
+      },
+      "_meta": {
+        "farming.dev/upstream": "cua-driver",
+        "farming.dev/capabilities": [
+          "browser.download"
+        ],
+        "farming.dev/risk": {
+          "class": "r3",
+          "enforcement": "metadata_only",
+          "operation_sensitive": false,
+          "version": "1"
+        }
+      }
+    },
+    {
+      "name": "computer_browser_pointer",
+      "upstreamName": "browser_pointer",
+      "description": "Perform hover, right-click, double-click, scroll, or drag in an exactly-bound browser tab. Semantic refs must declare pointer for hover, right-click, double-click, and drag; scroll accepts a scroll or pointer capability. The trusted route uses CDP Input events and refuses if standalone background posture cannot be preserved. The explicit dom_event route requires a page ref and synthesizes full-background DOM events. Never activates or brings a tab to the foreground.",
+      "inputSchema": {
+        "additionalProperties": true,
+        "properties": {
+          "action": {
+            "enum": [
+              "hover",
+              "right_click",
+              "double_click",
+              "scroll",
+              "drag"
+            ],
+            "type": "string"
+          },
+          "delta_x": {
+            "description": "Horizontal scroll delta in CSS pixels.",
+            "type": "number"
+          },
+          "delta_y": {
+            "description": "Vertical scroll delta in CSS pixels.",
+            "type": "number"
+          },
+          "destination_ref": {
+            "description": "Drag destination page ref in the exact same frame.",
+            "type": "string"
+          },
+          "input_route": {
+            "default": "trusted",
+            "enum": [
+              "trusted",
+              "dom_event"
+            ],
+            "type": "string"
+          },
+          "ref": {
+            "description": "Origin page ref. Alternative to x/y.",
+            "type": "string"
+          },
+          "session": {
+            "description": "Explicit caller session owning the browser capabilities.",
+            "type": "string"
+          },
+          "tab_id": {
+            "description": "Opaque tab id minted by get_browser_state.",
+            "type": "string"
+          },
+          "target_id": {
+            "description": "Opaque target id minted by get_browser_state.",
+            "type": "string"
+          },
+          "to_x": {
+            "description": "Drag destination viewport x in CSS pixels.",
+            "type": "number"
+          },
+          "to_y": {
+            "description": "Drag destination viewport y in CSS pixels.",
+            "type": "number"
+          },
+          "x": {
+            "description": "Origin viewport x in CSS pixels.",
+            "type": "number"
+          },
+          "y": {
+            "description": "Origin viewport y in CSS pixels.",
+            "type": "number"
+          }
+        },
+        "required": [
+          "target_id",
+          "tab_id",
+          "session",
+          "action"
+        ],
+        "type": "object"
+      },
+      "annotations": {
+        "destructiveHint": false,
+        "idempotentHint": false,
+        "openWorldHint": true,
+        "readOnlyHint": false
+      },
+      "_meta": {
+        "farming.dev/upstream": "cua-driver",
+        "farming.dev/capabilities": [
+          "browser.input.pointer"
+        ],
+        "farming.dev/risk": {
+          "class": "r2",
+          "enforcement": "metadata_only",
+          "operation_sensitive": false,
+          "version": "1"
+        }
+      }
+    },
+    {
+      "name": "computer_start_recording",
+      "upstreamName": "start_recording",
+      "description": "Start trajectory recording. Every subsequent action-tool invocation (click, right_click, scroll, type_text, press_key, hotkey, set_value) writes a turn folder under `output_dir`:\n\n- `before_state.json` / `after_state.json` — application AX/UIA/AT-SPI state immediately before and after the action.\n- `before.png` / `after.png` — target-window screenshots immediately before and after the action.\n- `evidence.json` — capture status and a stable classification when an expected artifact could not be captured.\n- `app_state.json` — post-action AX/UIA snapshot for the target pid.\n- `screenshot.png` — compatibility alias of `after.png`.\n- `action.json` — tool name, full input arguments, result summary, pid, click point (when applicable), ISO-8601 timestamp.\n- `click.png` — for click-family actions only, `before.png` with a red marker at the click point.\n\nTurn folders are named `turn-00001/`, `turn-00002/`, etc.  Turn numbering restarts at 1 each time recording is (re-)started.\n\n**Video is off by default.** Pass `record_video: true` to also capture the main display to `<output_dir>/recording.mp4` (H.264 / 30 fps) for the lifetime of the session. The recording is torn down automatically when the MCP client disconnects.\n\n**macOS uses native ScreenCaptureKit** (daemon-owned SCStream + SCRecordingOutput) so video inherits the daemon's Screen Recording grant — no extra TCC prompt, no ffmpeg subprocess. Requires macOS 15.0+.\n\n**Windows + Linux use an ffmpeg subprocess** (`gdigrab` / `x11grab` + libx264). Requires ffmpeg on PATH (winget install Gyan.FFmpeg / apt install ffmpeg); when ffmpeg is missing or fails on startup the per-turn capture (screenshots + action.json) still runs and the session's `last_error` field carries the diagnostic.\n\nState persists for the life of the daemon; a restart resets to disabled with no on-disk state. Call `stop_recording` to disable + finalize the mp4.",
+      "inputSchema": {
+        "additionalProperties": false,
+        "properties": {
+          "output_dir": {
+            "description": "Absolute or ~-rooted directory where turn folders and (when enabled) the video file are written.",
+            "type": "string"
+          },
+          "record_video": {
+            "description": "Capture the main display to <output_dir>/recording.mp4. Default: false. Set to true to also capture the main display to recording.mp4 (otherwise only the per-turn screenshots + JSON are recorded). On macOS this uses native ScreenCaptureKit (no extra TCC prompt, macOS 15.0+); on Windows + Linux it requires ffmpeg on PATH.",
+            "type": "boolean"
+          }
+        },
+        "required": [
+          "output_dir"
+        ],
+        "type": "object"
+      },
+      "annotations": {
+        "destructiveHint": false,
+        "idempotentHint": true,
+        "openWorldHint": false,
+        "readOnlyHint": false
+      },
+      "_meta": {
+        "farming.dev/upstream": "cua-driver",
+        "farming.dev/capabilities": [
+          "recording.start"
+        ],
+        "farming.dev/risk": {
+          "class": "r2",
+          "enforcement": "metadata_only",
+          "operation_sensitive": false,
+          "version": "1"
+        }
+      }
+    },
+    {
+      "name": "computer_stop_recording",
+      "upstreamName": "stop_recording",
+      "description": "Stop trajectory recording. Disables further per-turn capture and, when video was enabled, gracefully terminates the ffmpeg subprocess so the mp4's moov atom is finalized (the file is playable). Calling stop on an already-stopped session is a no-op. The response carries `last_video_path` pointing at the finalized mp4 (when video was on).\n\nA manual `stop_recording` is **unconditional** — it stops whatever recording is active regardless of which session started it. Ownership-scoped teardown (so one MCP client disconnecting can't stop a recording a later client started) is handled by the daemon's `session_end` lifecycle signal, not by this tool.",
+      "inputSchema": {
+        "additionalProperties": false,
+        "properties": {},
+        "type": "object"
+      },
+      "annotations": {
+        "destructiveHint": false,
+        "idempotentHint": true,
+        "openWorldHint": false,
+        "readOnlyHint": false
+      },
+      "_meta": {
+        "farming.dev/upstream": "cua-driver",
+        "farming.dev/capabilities": [
+          "recording.stop"
+        ],
+        "farming.dev/risk": {
+          "class": "r1",
+          "enforcement": "metadata_only",
+          "operation_sensitive": false,
+          "version": "1"
+        }
+      }
+    },
+    {
+      "name": "computer_get_recording_state",
+      "upstreamName": "get_recording_state",
+      "description": "Report the current trajectory recorder state: whether recording is enabled, the output directory (when enabled), and the 1-based counter for the next turn folder that will be written. Counter increments on every recorded action tool call and resets to 1 each time recording is (re-)enabled.\n\nPure read-only.",
+      "inputSchema": {
+        "additionalProperties": false,
+        "properties": {},
+        "type": "object"
+      },
+      "annotations": {
+        "destructiveHint": false,
+        "idempotentHint": true,
+        "openWorldHint": false,
+        "readOnlyHint": true
+      },
+      "_meta": {
+        "farming.dev/upstream": "cua-driver",
+        "farming.dev/capabilities": [
+          "recording.state"
+        ],
+        "farming.dev/risk": {
+          "class": "r0",
+          "enforcement": "metadata_only",
+          "operation_sensitive": false,
+          "version": "1"
+        }
+      }
+    },
+    {
+      "name": "computer_replay_trajectory",
+      "upstreamName": "replay_trajectory",
+      "description": "Replay a recorded trajectory by re-invoking every turn's tool call in lexical order. `dir` must point at a directory previously written by `start_recording`. Each `turn-NNNNN/` is parsed for `action.json`, and the recorded tool is called with its recorded `arguments` via the same dispatch path an MCP / CLI call uses.\n\nCaveats:\n- Element-indexed actions (`click({pid, element_index})` etc.) will fail because element indices are per-snapshot and don't survive across sessions. Pixel clicks (`click({pid, x, y})`) and all keyboard tools replay cleanly. Failures are reported but don't stop replay unless `stop_on_error` is true.\n- `get_window_state` and other read-only tools are NOT currently recorded, so replays do not re-populate the per-(pid, window_id) element cache.\n- If recording is ENABLED while replay runs, the replay itself is recorded into the currently configured output directory.  That's deliberate: recording a replay against a new build and diffing the two trajectories is the regression-test workflow.",
+      "inputSchema": {
+        "additionalProperties": false,
+        "properties": {
+          "delay_ms": {
+            "description": "Milliseconds to sleep between turns, for human-observable pacing. Default 500.",
+            "maximum": 10000,
+            "minimum": 0,
+            "type": "integer"
+          },
+          "dir": {
+            "description": "Trajectory directory previously written by `start_recording`. Absolute or ~-rooted.",
+            "type": "string"
+          },
+          "stop_on_error": {
+            "description": "Stop replay on the first tool-call error. Default true — set false to best-effort through the full trajectory.",
+            "type": "boolean"
+          }
+        },
+        "required": [
+          "dir"
+        ],
+        "type": "object"
+      },
+      "annotations": {
+        "destructiveHint": true,
+        "idempotentHint": false,
+        "openWorldHint": false,
+        "readOnlyHint": false
+      },
+      "_meta": {
+        "farming.dev/upstream": "cua-driver",
+        "farming.dev/capabilities": [
+          "recording.replay"
+        ],
+        "farming.dev/risk": {
+          "class": "r1",
+          "enforcement": "metadata_only",
+          "operation_sensitive": false,
+          "version": "1"
+        }
+      }
+    },
+    {
+      "name": "computer_install_ffmpeg",
+      "upstreamName": "install_ffmpeg",
+      "description": "Install the ffmpeg binary used by start_recording's video capture (Linux/Windows; macOS records natively and needs no ffmpeg). Two-step and confirmed: called without `confirm` it only REPORTS the exact install command for this platform's package manager; pass `confirm: true` to actually run it. No-op if ffmpeg is already on PATH. ffmpeg is run as a separate process, never linked into the driver.",
+      "inputSchema": {
+        "additionalProperties": false,
+        "properties": {
+          "confirm": {
+            "description": "Run the install command. Without it, only the planned command is reported.",
+            "type": "boolean"
+          }
+        },
+        "type": "object"
+      },
+      "annotations": {
+        "destructiveHint": true,
+        "idempotentHint": false,
+        "openWorldHint": true,
+        "readOnlyHint": false
+      },
+      "_meta": {
+        "farming.dev/upstream": "cua-driver",
+        "farming.dev/capabilities": [
+          "recording.install_dependency"
+        ],
+        "farming.dev/risk": {
+          "class": "r3",
+          "enforcement": "metadata_only",
+          "operation_sensitive": false,
+          "version": "1"
+        }
+      }
+    },
+    {
+      "name": "computer_start_session",
+      "upstreamName": "start_session",
+      "description": "Declare a session — a named, color-coded identity for THIS agent run. Pass a stable `session` id and choose capture_scope=auto|window|desktop; the agent cursor, capture policy, per-session config, and recording all key on it, and it follows the run across any apps/windows. The cursor's color is derived from the id, so distinct runs are visually distinct. A cursor is shown only for a declared session — call this (or pass `session` on your first action) to opt in. Idempotent: re-calling with the same id just refreshes its idle-TTL. End it with `end_session` (or let the idle-TTL reclaim it). Concurrent runs/subagents each pass their own `session` to get their own cursor.",
+      "inputSchema": {
+        "additionalProperties": true,
+        "properties": {
+          "capture_scope": {
+            "default": "auto",
+            "description": "Per-session perception/action modality. auto starts window-only and requires explicit escalation before desktop tools; window and desktop are strict. Immutable for the live session.",
+            "enum": [
+              "auto",
+              "window",
+              "desktop"
+            ],
+            "type": "string"
+          },
+          "session": {
+            "description": "Stable session id for this run (e.g. \"research-run-1\").",
+            "type": "string"
+          }
+        },
+        "required": [
+          "session"
+        ],
+        "type": "object"
+      },
+      "annotations": {
+        "destructiveHint": false,
+        "idempotentHint": true,
+        "openWorldHint": false,
+        "readOnlyHint": false
+      },
+      "_meta": {
+        "farming.dev/upstream": "cua-driver",
+        "farming.dev/capabilities": [
+          "session.lifecycle.start",
+          "session.capture_scope"
+        ],
+        "farming.dev/risk": {
+          "class": "r1",
+          "enforcement": "metadata_only",
+          "operation_sensitive": false,
+          "version": "1"
+        }
+      }
+    },
+    {
+      "name": "computer_escalate_session",
+      "upstreamName": "escalate_session",
+      "description": "Unlock the desktop phase of an auto capture-scope session after the window action ladder has been exhausted and verified. This is a one-way transition for the live session and records a bounded reason.",
+      "inputSchema": {
+        "additionalProperties": true,
+        "properties": {
+          "detail": {
+            "description": "Optional bounded diagnostic detail. Never use secrets or page content.",
+            "maxLength": 200,
+            "type": "string"
+          },
+          "reason": {
+            "enum": [
+              "ax_tree_pixel_mismatch",
+              "background_delivery_failed",
+              "foreground_ineffective",
+              "no_window_target",
+              "other"
+            ],
+            "type": "string"
+          },
+          "session": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "session",
+          "reason"
+        ],
+        "type": "object"
+      },
+      "annotations": {
+        "destructiveHint": false,
+        "idempotentHint": false,
+        "openWorldHint": false,
+        "readOnlyHint": false
+      },
+      "_meta": {
+        "farming.dev/upstream": "cua-driver",
+        "farming.dev/capabilities": [
+          "session.capture_scope.escalate"
+        ],
+        "farming.dev/risk": {
+          "class": "r2",
+          "enforcement": "metadata_only",
+          "operation_sensitive": false,
+          "version": "1"
+        }
+      }
+    },
+    {
+      "name": "computer_get_session_state",
+      "upstreamName": "get_session_state",
+      "description": "Read the live session's capture policy and effective scope.",
+      "inputSchema": {
+        "additionalProperties": true,
+        "properties": {
+          "session": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "session"
+        ],
+        "type": "object"
+      },
+      "annotations": {
+        "destructiveHint": false,
+        "idempotentHint": true,
+        "openWorldHint": false,
+        "readOnlyHint": true
+      },
+      "_meta": {
+        "farming.dev/upstream": "cua-driver",
+        "farming.dev/capabilities": [
+          "session.capture_scope.read"
+        ],
+        "farming.dev/risk": {
+          "class": "r0",
+          "enforcement": "metadata_only",
+          "operation_sensitive": false,
+          "version": "1"
+        }
+      }
+    },
+    {
+      "name": "computer_end_session",
+      "upstreamName": "end_session",
+      "description": "End a session declared with `start_session`: removes its agent cursor, stops any recording it owns, and clears its per-session config. Call this when a run finishes so its cursor doesn't linger (otherwise the idle-TTL reclaims it after a period of inactivity). Idempotent.",
+      "inputSchema": {
+        "additionalProperties": true,
+        "properties": {
+          "session": {
+            "description": "The session id to end.",
+            "type": "string"
+          }
+        },
+        "required": [
+          "session"
+        ],
+        "type": "object"
+      },
+      "annotations": {
+        "destructiveHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false,
+        "readOnlyHint": false
+      },
+      "_meta": {
+        "farming.dev/upstream": "cua-driver",
+        "farming.dev/capabilities": [
+          "session.lifecycle.end"
+        ],
+        "farming.dev/risk": {
+          "class": "r1",
+          "enforcement": "metadata_only",
+          "operation_sensitive": false,
+          "version": "1"
+        }
+      }
+    },
+    {
+      "name": "computer_check_for_update",
+      "upstreamName": "check_for_update",
+      "description": "Check whether a newer cua-driver-rs release is available on GitHub. Returns the current and latest versions, an `update_available` boolean, the install one-liner, and the release notes URL. Read-only — never installs. Mirror of `cua-driver check-update --json`.",
+      "inputSchema": {
+        "additionalProperties": false,
+        "properties": {},
+        "type": "object"
+      },
+      "annotations": {
+        "destructiveHint": false,
+        "idempotentHint": true,
+        "openWorldHint": true,
+        "readOnlyHint": true
+      },
+      "_meta": {
+        "farming.dev/upstream": "cua-driver",
+        "farming.dev/capabilities": [
+          "driver.update_check"
+        ],
+        "farming.dev/risk": {
+          "class": "r0",
+          "enforcement": "metadata_only",
+          "operation_sensitive": false,
+          "version": "1"
+        }
+      }
+    }
+  ]
+}