mixdog 1.3.4 → 1.4.0

package/src/runtime/channels/lib/status-snapshot.mjs

@@ -57,7 +57,7 @@ function* armedScheduleFires(scheduler) {
     const fireAt = cronTaskNextFireAt(task);
     if (fireAt !== null) yield { name, fireAt, kind: 'cron' };
   }
-  const defs = [...(scheduler.nonInteractive || []), ...(scheduler.interactive || [])];
+  const defs = scheduler.schedules || [];
   for (const name of (scheduler.oneShotTimers || new Map()).keys()) {
     if (scheduler.shouldSkip?.(name)) continue;
     const def = defs.find((s) => s.name === name);

package/src/runtime/channels/lib/tool-dispatch.mjs

@@ -1,8 +1,9 @@
 // Worker/HTTP runtime-lifecycle dispatch (activate_channel_bridge /
-// reload_config). Channel messaging — forwarder, transcript binding, typing —
-// is deleted with Discord/Telegram; only the automation lifecycle remains.
+// reload_config). Only the automation lifecycle is dispatched here.
 // Lifecycle functions are threaded in as a bag of lazy getters so the module
 // reads the live file-level references at call time.
+import { scheduleErrorFields } from './schedule-errors.mjs';
+
 function createToolDispatch({ isChannelsDegraded, lifecycle }) {
   const {
     getChannelBridgeActive,
@@ -13,6 +14,7 @@ function createToolDispatch({ isChannelsDegraded, lifecycle }) {
     startChannelBridge,
     stopOwnedRuntime,
     reloadRuntimeConfig,
+    renameSchedule,
   } = lifecycle;
 
   async function handleToolCall(name, args, _signal) {
@@ -82,6 +84,14 @@ function createToolDispatch({ isChannelsDegraded, lifecycle }) {
           };
           break;
         }
+        // The scheduler's owner moves a schedule row only while no run of it
+        // can start or be in flight (Scheduler.renameLocked). Resolves the
+        // renamed row as JSON text; a refusal is an isError result.
+        case 'rename_schedule': {
+          const saved = await renameSchedule(args.name, args.def, { timingChanged: args.timingChanged === true });
+          result = { content: [{ type: 'text', text: JSON.stringify(saved) }] };
+          break;
+        }
         // memory — handled by memory-service.mjs MCP
         default:
           result = {
@@ -94,6 +104,8 @@ function createToolDispatch({ isChannelsDegraded, lifecycle }) {
       result = {
         content: [{ type: 'text', text: `${name} failed: ${msg}` }],
         isError: true,
+        // A schedule refusal keeps its code and public name; nothing else crosses.
+        ...scheduleErrorFields(err),
       };
     }
     return result;

package/src/runtime/channels/lib/webhooks-db.mjs

@@ -26,8 +26,7 @@ CREATE SCHEMA IF NOT EXISTS webhooks;
 CREATE TABLE IF NOT EXISTS webhooks.endpoints (
   name         text PRIMARY KEY,
   description  text NOT NULL DEFAULT '',
-  channel_id   text,
-  role         text NOT NULL DEFAULT '',
+  role        text NOT NULL DEFAULT '',
   model        text,
   parser       text,
   secret       text,
@@ -87,14 +86,13 @@ const getDb = createPgSchemaDb({
 // The stored payload itself is never projected here (readEndpointLastPayload
 // is its only read path); rows carry a presence flag.
 const ENDPOINT_COLS =
-  'name, description, channel_id, parser, secret, cwd, attachments, delivery, instructions, enabled, owner_agent_id, last_event_at, last_success_at, last_failed_at, last_skipped_at, consecutive_failures, result_delivery, (last_payload IS NOT NULL) AS has_last_payload, created_at, updated_at';
+  'name, description, parser, secret, cwd, attachments, delivery, instructions, enabled, owner_agent_id, last_event_at, last_success_at, last_failed_at, last_skipped_at, consecutive_failures, result_delivery, (last_payload IS NOT NULL) AS has_last_payload, created_at, updated_at';
 
 function rowToEndpoint(row) {
   if (!row) return null;
   return {
     name: row.name,
     description: row.description,
-    channelId: row.channel_id,
     parser: row.parser,
     cwd: row.cwd,
     attachments: row.attachments || null,
@@ -180,7 +178,6 @@ export async function upsertEndpoint(def, { dataDir } = {}) {
   const params = [
     def.name,
     def.description ?? '',
-    def.channelId ?? null,
     '',
     def.parser ?? null,
     def.secret ?? null,
@@ -195,13 +192,12 @@ export async function upsertEndpoint(def, { dataDir } = {}) {
   // not the definition.
   const { rows } = await db.query(
     `INSERT INTO webhooks.endpoints
-       (name, description, channel_id, role, parser, secret, cwd, attachments, delivery, instructions, enabled, owner_agent_id)
-     VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12)
+       (name, description, role, parser, secret, cwd, attachments, delivery, instructions, enabled, owner_agent_id)
+     VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11)
      ON CONFLICT (name) DO UPDATE SET
        owner_agent_id = EXCLUDED.owner_agent_id,
        description  = EXCLUDED.description,
-       channel_id   = EXCLUDED.channel_id,
-       role         = EXCLUDED.role,
+       role        = EXCLUDED.role,
        parser       = EXCLUDED.parser,
        secret       = EXCLUDED.secret,
        cwd          = EXCLUDED.cwd,

package/src/runtime/channels/lib/worker-bootstrap.mjs

@@ -102,7 +102,6 @@ export function runWorkerBootstrap({
     // Publish owner identity immediately so the SessionStart shim's
     // owner_lead_alive() sees a live owner and uses the full connect budget
     // instead of the 5s no-owner grace (fixes missing recap/core on restart).
-    // providerReady intentionally omitted — readiness stays gated until connect.
     try {
       refreshActiveInstance(instanceId);
     } catch (e) {

package/src/runtime/channels/lib/worker-ipc.mjs

@@ -11,7 +11,6 @@ export function runWorkerIpc({
   clearServerPid,
   instanceId,
   statusState: _statusState,
-  getProvider: _getProvider,
   getConfig: _getConfig,
   handleMemoryCallResponse,
   handleToolCall,

package/src/runtime/channels/lib/worker-main.mjs

@@ -1,13 +1,13 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { createRequire } from 'node:module';
-import { loadConfig, createProvider, DATA_DIR } from './config.mjs';
+import { loadConfig, DATA_DIR } from './config.mjs';
 import { resolveVoiceRuntime } from './voice-runtime-fetcher.mjs';
 import { whisperThreadCount } from './voice-transcription.mjs';
 import { ensureReady, stopVoiceWhisperServer } from './whisper-server.mjs';
 import { ensurePrivateRuntimeRoot, resolveRuntimeRoot } from '../../shared/runtime-root.mjs';
 import { Scheduler } from './scheduler.mjs';
-import { hasPending as dispatchHasPending } from '../../agent/orchestrator/dispatch-persist.mjs';
+import { renameSchedule as renameScheduleRow } from './schedules-db.mjs';
 import { stripSoftWarns } from '../../agent/orchestrator/tool-loop-guard.mjs';
 import { JsonStateFile } from './state-file.mjs';
 import { writeJsonAtomicSync } from '../../shared/atomic-file.mjs';
@@ -93,7 +93,6 @@ if (isMixdogDebug()) {
   );
 }
 let config = await loadConfig();
-let provider = createProvider(config);
 const INSTANCE_ID = makeInstanceId();
 const TERMINAL_LEAD_PID = getTerminalLeadPid();
 runWorkerBootstrap({
@@ -128,22 +127,13 @@ let _reloadDebounce = null;
 const STATUS_FILE = getStatusPath(INSTANCE_ID);
 const statusState = new JsonStateFile(STATUS_FILE, {});
 statusState.ensure();
-const scheduler = new Scheduler(config.nonInteractive ?? [], config.interactive ?? []);
+const scheduler = new Scheduler(config.schedules ?? []);
 // A schedule fire is a turn in its owner bot's chat; the runner belongs to the
 // session-runtime layer, so this worker entry injects it (lazy, like webhooks).
 scheduler.setScheduleRunner(async (schedule, opts) => {
   const { runScheduleSession } = await import('../../../session-runtime/schedule-session-run.mjs');
   return runScheduleSession(schedule, opts);
 });
-// Register the pending-dispatch probe so the scheduler treats an in-flight
-// bridge dispatch as "active" regardless of user-inbound silence.
-scheduler.setPendingCheck(() => {
-  try {
-    return dispatchHasPending(DATA_DIR);
-  } catch {
-    return false;
-  }
-});
 let webhookServer = null;
 let eventPipeline = null;
 let bridgeRuntimeConnected = false;
@@ -157,10 +147,6 @@ const { startAutomationRuntime, startOwnedRuntime, stopOwnedRuntime, reloadRunti
     setConfig: (v) => {
       config = v;
     },
-    getProvider: () => provider,
-    setProvider: (v) => {
-      provider = v;
-    },
     getBridgeRuntimeConnected: () => bridgeRuntimeConnected,
     setBridgeRuntimeConnected: (v) => {
       bridgeRuntimeConnected = v;
@@ -184,7 +170,7 @@ const { startAutomationRuntime, startOwnedRuntime, stopOwnedRuntime, reloadRunti
     wireWebhookHandlers,
     wireEventQueueHandlers,
   });
-function injectAndRecord(channelId, _name, content, options) {
+function injectAndRecord(content, options) {
   // Strip soft-warn marker blocks (Tool-loop / Repeated-input / legacy
   // Repeated-tool / Mixed-tool / Tool-budget / Same-file multi-chunk /
   // Bash file-lookup / Iteration / 0-match advisory) from anywhere in the
@@ -198,22 +184,14 @@ function injectAndRecord(channelId, _name, content, options) {
   const now = new Date();
   const timeLabel = `${String(now.getHours()).padStart(2, '0')}:${String(now.getMinutes()).padStart(2, '0')} `;
   const sourceLabel = options?.type ? `${timeLabel}: ${options.type}` : timeLabel;
-  const meta = { chat_id: channelId, user: sourceLabel, user_id: 'system', ts };
+  const meta = { user: sourceLabel, user_id: 'system', ts };
   if (options?.instruction) meta.instruction = options.instruction;
   if (options?.type) meta.type = options.type;
   // `silent_to_agent` — lifecycle status pings (worker/iter/started echoes)
-  // must NOT land in Lead's context window. The channel relay that used to
-  // surface them is retired, so silent pings are dropped entirely.
+  // must NOT land in Lead's context window, so silent pings are dropped.
   if (options?.silent_to_agent === true) return;
   sendNotifyToParent('notifications/claude/channel', { content, meta });
 }
-scheduler.setInjectHandler((channelId, name, content, options) => {
-  injectAndRecord(channelId, name, content, options);
-});
-// Interactive schedule fires may only inject while this process
-// actually holds the live bridge seat; otherwise the scheduler falls back to
-// the visible-session run so the fire is never lost.
-scheduler.setInjectReadyCheck(() => bridgeRuntimeConnected && currentOwnerState().owned);
 function wireWebhookHandlers() {
   if (!webhookServer) return;
   webhookServer.setEventPipeline(eventPipeline);
@@ -236,8 +214,8 @@ function wireWebhookHandlers() {
 }
 function wireEventQueueHandlers(eventQueue) {
   if (!eventQueue) return;
-  eventQueue.setInjectHandler((channelId, name, content, options) => {
-    injectAndRecord(channelId, name, content, options);
+  eventQueue.setInjectHandler((_name, content, options) => {
+    injectAndRecord(content, options);
   });
   // Defensive ownership probe: the queue tick should only run in the active
   // owner process. Non-owner instances see bridgeRuntimeConnected=false and
@@ -261,9 +239,17 @@ const { handleToolCall } = createToolDispatch({
     },
     writeBridgeState,
     notifyRemoteAcquired,
-    startChannelBridge: () => start({ messaging: true }),
+    startChannelBridge: () => start({ bridge: true }),
     stopOwnedRuntime,
     reloadRuntimeConfig,
+    // Rename and re-arm under one reservation: the scheduler is reloaded from
+    // the renamed row (timers and one-shots of the old name cleared) before
+    // the name is released for fires.
+    renameSchedule: (name, def, opts) =>
+      scheduler.renameLocked(name, () => renameScheduleRow(name, def, opts), {
+        newName: def.name,
+        reload: reloadRuntimeConfig,
+      }),
   },
 });
 function ensureConfigWatcher() {
@@ -279,7 +265,7 @@ function ensureConfigWatcher() {
   } catch {}
 }
 async function start(options = {}) {
-  if (options?.messaging === false) {
+  if (options?.bridge === false) {
     channelBridgeActive = false;
     writeBridgeState(false);
     await startAutomationRuntime();
@@ -299,7 +285,7 @@ async function start(options = {}) {
   }
   // Hot-reload config on file change (schedules/webhooks/events).
   // Cross-process edits invalidate the raw config cache before the debounced
-  // reload so both messaging and automation-only daemon modes stay current.
+  // reload so both bridge and automation-only daemon modes stay current.
   ensureConfigWatcher();
   // Pre-warm the whisper-server manager once at owner startup so the first
   // voice transcription does not pay cold-start cost. Non-blocking: failures
@@ -352,7 +338,6 @@ if (_isWorkerMode && process.send && process.env.MIXDOG_DAEMON_HOST !== '1') {
     clearServerPid,
     instanceId: INSTANCE_ID,
     statusState,
-    getProvider: () => provider,
     getConfig: () => config,
     handleMemoryCallResponse,
     handleToolCall,

package/src/runtime/computer-bridge/action-schema.mjs

@@ -35,8 +35,13 @@ const ACTIONS = [
   'menu',
   'clipboard',
   'launch',
+  'saved_login',
 ];
 
+// Which value of a saved login saved_login types (the host checks the focused
+// field's kind before typing it).
+const SAVED_LOGIN_FIELDS = ['username', 'password'];
+
 const windowTarget = {
   window_id: {
     type: 'string',
@@ -347,6 +352,28 @@ export const COMPUTER_ACTION_CONTRACTS = [
       ['app']
     )
   ),
+  branch(
+    'saved_login',
+    input(
+      {
+        ...windowTarget,
+        ...appTarget,
+        savedAccount: {
+          type: 'string',
+          minLength: 1,
+          description:
+            "Fallback sign-in in the user's own browser; prefer its existing session/SSO or Browser Use's saved sign-in. Saved login (username or masked label; a miss lists the site's labels) written after host checks into the focused field of a Chrome/Edge HTTPS page. The site receives it. A password is kept from you and its browser's pixels are withheld this turn, but a page that redisplays it can expose it, and other programs of the same Windows user are outside this protection; a username is not hidden. On refusal hand the secret to the user (ask_user secret, surface computer).",
+        },
+        field: {
+          type: 'string',
+          enum: SAVED_LOGIN_FIELDS,
+          description:
+            "username (text field) or password (password field). One-time codes, passkeys, security keys and app approvals are the user's step: ask_user takeover.",
+        },
+      },
+      ['savedAccount', 'field']
+    )
+  ),
 ];
 
 // A JSON Schema 2020-12 object root with no root combinator (Anthropic
@@ -396,7 +423,7 @@ for (const actionBranch of COMPUTER_ACTION_CONTRACTS) {
 // Actions that drive one exact window. They carry exactly one window target:
 // the exact window_id, or an app label the host resolves to one window and
 // refuses when it matches more than one.
-const WINDOW_TARGET_ACTIONS = new Set(['act', 'window', 'menu', 'verify']);
+const WINDOW_TARGET_ACTIONS = new Set(['act', 'window', 'menu', 'verify', 'saved_login']);
 // The host command each window operation becomes; every other operation is a
 // window_state change carrying the operation as its state.
 const WINDOW_OPERATION_ACTIONS = Object.freeze({
@@ -564,6 +591,11 @@ function launchError(input) {
   return null;
 }
 
+function savedLoginError(input) {
+  if (!String(input.savedAccount || '').trim()) return 'Computer Use saved_login savedAccount must not be empty';
+  return null;
+}
+
 function listError(input) {
   if (hasOwn(input, 'limit') && input.kind !== 'history') {
     return 'Computer Use list limit applies to kind="history"';
@@ -584,6 +616,7 @@ const ACTION_RULES = {
   window: windowError,
   clipboard: clipboardError,
   launch: launchError,
+  saved_login: savedLoginError,
 };
 
 export function validateComputerToolArgs(rawArgs) {
@@ -686,6 +719,14 @@ export function toComputerHostCommand(rawArgs) {
       command.action = inputValue.operation === 'write' ? 'clipboard_write' : 'clipboard_read';
       delete command.operation;
       break;
+    case 'saved_login':
+      // Always foreground: the value goes to the field focused in the
+      // browser window the host verified, never through window messages.
+      command.action = 'fill_saved_login';
+      command.saved_account = inputValue.savedAccount;
+      command.delivery = 'foreground';
+      delete command.savedAccount;
+      break;
     default:
       command.action = args.action;
   }

package/src/runtime/computer-bridge/actions.mjs

@@ -29,6 +29,8 @@ action('input_recovery_state', nativeRead);
 action('input_idle_state', nativeRead);
 action('ocr_image', nativeRead);
 action('ocr_status', nativeRead);
+// Host-internal: whether a saved-login owner's runtime process has ended.
+action('process_fate', nativeRead);
 action('release_session', { retainNativeRefs: true });
 action('release_cursor_theme', { retainNativeRefs: true });
 // Handing held input, focus and pointer back changes no target's content, so a
@@ -98,8 +100,14 @@ for (const name of [
   });
 }
 action('clipboard_write', { foreground: true });
+// A saved login written into the focused field of the user's browser window:
+// an input bound to a fresh observation, always on the foreground lane, with no
+// automatic capture (the reply never carries the field it filled).
+action('fill_saved_login', { observationBound: true, foreground: true, policy: 'act' });
 action('sequence', { policy: 'act' });
-for (const name of ['execution_end', 'session_release', 'session_abort']) {
+// turn_settle: the runtime's settlement of one agent turn (turn_id), which
+// alone retires a saved-login fill's protection (desktop secret-input.ts).
+for (const name of ['execution_end', 'session_release', 'session_abort', 'turn_settle']) {
   action(name, { lifecycle: true, observeOnly: true });
 }
 export const COMPUTER_ACTIONS = Object.freeze(catalogue);

package/src/runtime/computer-bridge/client.mjs

@@ -25,6 +25,8 @@ import { MAX_COMPUTER_REQUEST_BYTES, readComputerBridgeJson, validateComputerRep
 import { computerActionHas } from './actions.mjs';
 import { linuxCaptureFallback, linuxComputerPreflight } from './linux-readiness.mjs';
 import { continuePendingComputerWork, isPendingComputerWork } from './pending-continuation.mjs';
+import { randomUUID } from 'node:crypto';
+import { request as httpRequest } from 'node:http';
 
 export { canonicalComputerResultText };
 
@@ -53,6 +55,18 @@ const pendingComputerSessionReleases = new Map();
 // explicit release, so shutdown needs the full set.
 const hostBoundComputerSessions = new Set();
 const activeComputerExecutions = new Set();
+// Per session, the newest agent turn that sent a saved-login fill whose
+// settlement the desktop has not yet accepted. Aborts never clear it.
+const savedLoginTurns = new Map();
+/** This runtime process as the owner of its saved-login fills: the desktop
+ *  keeps a fill's protection until its turn settles or this owner is gone
+ *  (apps/desktop/src/main/secret-input.ts SavedLoginTurn). */
+export const SAVED_LOGIN_OWNER_ID = randomUUID();
+// The owner connection: one held POST /owner (owner id and this process id)
+// to the bridge it was opened on. A close only detaches it on the desktop;
+// the desktop retires this owner early only when the OS proves this process
+// ended. The socket never keeps the process alive.
+let savedLoginOwner = null;
 const BRIDGE_UNAVAILABLE_MESSAGE =
   'computer use is unavailable; open the Mixdog desktop app and enable Computer Use in settings';
 
@@ -269,7 +283,15 @@ async function executeComputerToolInner(rawArgs, context, note) {
     command = fallback.command;
     note.text = fallback.note;
   }
-  const encoded = JSON.stringify({ ...command, ...(sessionId ? { session_id: sessionId } : {}) });
+  // A saved-login fill names its agent turn: the desktop keeps the fill's
+  // protection until that turn's settlement (settleSavedLoginTurn).
+  const turnId = Number(context?.turnId) || 0;
+  const savedLoginTurn = command.action === 'fill_saved_login' && sessionId && turnId > 0 ? turnId : 0;
+  const encoded = JSON.stringify({
+    ...command,
+    ...(sessionId ? { session_id: sessionId } : {}),
+    ...(savedLoginTurn ? { turn_id: savedLoginTurn, runtime_id: SAVED_LOGIN_OWNER_ID } : {}),
+  });
   if (Buffer.byteLength(encoded) > MAX_COMPUTER_REQUEST_BYTES) {
     return computerErrorResult('Error: computer request exceeds byte limit; no input was dispatched');
   }
@@ -286,7 +308,14 @@ async function executeComputerToolInner(rawArgs, context, note) {
   }
   const releaseError = await awaitPendingSessionRelease(sessionId, args, context);
   if (releaseError) return releaseError;
+  if (savedLoginTurn) {
+    const ownerError = await savedLoginOwnerError(discovery, sessionId, args, context);
+    if (ownerError) return ownerError;
+  }
   trackComputerSession(sessionId, command);
+  // Recorded before the request leaves: the fill may arm its protection even
+  // when its reply is lost, so the turn's settlement is owed regardless.
+  if (savedLoginTurn) savedLoginTurns.set(sessionId, Math.max(savedLoginTurns.get(sessionId) || 0, savedLoginTurn));
   const posted = await postWithBridgeRecovery(discovery, command, encoded, sessionId, context);
   if (!posted.response) return posted;
   const { bridge, response } = posted;
@@ -362,7 +391,7 @@ async function settlePendingComputerWork(value, command, bridge, sessionId, cont
   }
 }
 
-async function sendComputerSessionControl(sessionId, action, timeoutMs) {
+async function sendComputerSessionControl(sessionId, action, timeoutMs, extra = {}) {
   const discovery = readBridgeDiscovery(DISCOVERY_FILE);
   if (!discovery) return false;
   try {
@@ -371,6 +400,7 @@ async function sendComputerSessionControl(sessionId, action, timeoutMs) {
       {
         action,
         session_id: sessionId,
+        ...extra,
       },
       { timeoutMs }
     );
@@ -381,12 +411,40 @@ async function sendComputerSessionControl(sessionId, action, timeoutMs) {
   }
 }
 
+/** Runtime-only, at request time: bind `requestId` to the exact window and
+ *  field ref the agent named (desktop secret-input.ts bindComputerSecret).
+ *  Answers 'bound' or 'no_field'; no desktop or an unknown answer is 'blocked'. */
+export async function computerSecretBind(sessionId, requestId, { ref = '', windowId = '', signal } = {}) {
+  const discovery = readBridgeDiscovery(DISCOVERY_FILE);
+  if (!discovery || !sessionId || !requestId) return 'blocked';
+  try {
+    const response = await postComputerCommand(
+      discovery,
+      {
+        action: 'secret_bind',
+        session_id: String(sessionId),
+        request_id: String(requestId),
+        ref: String(ref),
+        window_id: String(windowId),
+      },
+      { signal }
+    );
+    const body = await readComputerBridgeJson(response);
+    const text = response.ok && body?.ok === true ? body.value?.text : '';
+    return ['bound', 'no_field'].includes(text) ? text : 'blocked';
+  } catch {
+    return 'blocked';
+  }
+}
+
 /** Runtime-only: type the secret the user handed the desktop for `requestId`
- *  into the focused field (or `ref`) once. The value never passes through
- *  here; the host answers only whether it was typed. */
+ *  into the window and field it was bound to (computerSecretBind) once. The
+ *  value never passes through here; the host answers only the outcome
+ *  ('entered', 'no_field', 'page_changed', 'blocked', 'expired'); no desktop
+ *  or an unknown answer is 'blocked'. */
 export async function computerSecretInput(sessionId, requestId, { ref = '', windowId = '', signal } = {}) {
   const discovery = readBridgeDiscovery(DISCOVERY_FILE);
-  if (!discovery || !sessionId || !requestId) return 'skipped';
+  if (!discovery || !sessionId || !requestId) return 'blocked';
   try {
     const response = await postComputerCommand(
       discovery,
@@ -400,9 +458,10 @@ export async function computerSecretInput(sessionId, requestId, { ref = '', wind
       { signal }
     );
     const body = await readComputerBridgeJson(response);
-    return response.ok && body?.ok === true && body.value?.text === 'provided' ? 'provided' : 'skipped';
+    const text = response.ok && body?.ok === true ? body.value?.text : '';
+    return ['entered', 'no_field', 'page_changed', 'blocked', 'expired'].includes(text) ? text : 'blocked';
   } catch {
-    return 'skipped';
+    return 'blocked';
   }
 }
 
@@ -423,12 +482,125 @@ async function abortComputerSession(sessionId) {
  * desktop back, keeping the warm worker and observation refs for a possible follow-up. */
 export async function endComputerExecution(sessionId) {
   const id = String(sessionId || '').trim();
-  if (!id || !activeComputerExecutions.has(id)) return false;
+  if (!id) return false;
+  await settleSavedLoginTurn(id);
+  if (!activeComputerExecutions.has(id)) return false;
   const ended = await sendComputerSessionControl(id, 'execution_end', EXECUTION_END_TIMEOUT_MS);
   if (ended) activeComputerExecutions.delete(id);
   return ended;
 }
 
+/** Agent-turn settlement for a session that filled a saved login: tell the
+ *  desktop the turn is over so that fill's protection can retire. Separate
+ *  from input cleanup and independent of any abort; a settlement the desktop
+ *  did not accept stays owed and is sent again at the session's next one.
+ *  `endedTurnId` is the turn that ended when the caller knows it (the
+ *  session's terminal state); otherwise the newest owed turn is the one
+ *  ending (the lead's turn settlement). */
+async function settleSavedLoginTurn(sessionId, endedTurnId = 0) {
+  const owed = savedLoginTurns.get(sessionId);
+  if (!owed) return;
+  if (endedTurnId > 0 && owed > endedTurnId) return;
+  const accepted = await sendComputerSessionControl(sessionId, 'turn_settle', EXECUTION_END_TIMEOUT_MS, {
+    turn_id: owed,
+    runtime_id: SAVED_LOGIN_OWNER_ID,
+  });
+  if (accepted && savedLoginTurns.get(sessionId) === owed) savedLoginTurns.delete(sessionId);
+}
+
+/** A session's agent turn reached its terminal state (done, error or
+ *  cancelled; manager/runtime-liveness.mjs, for lead and sub-agent sessions
+ *  alike): settle its saved-login fills. */
+export async function finishComputerTurn(sessionId, turnId) {
+  const id = String(sessionId || '').trim();
+  if (!id || !(Number(turnId) > 0)) return;
+  await settleSavedLoginTurn(id, Number(turnId));
+}
+
+// Returns the error result that ends a saved-login call whose owner connection
+// is not attached, or null to proceed. Nothing was sent in any of these cases.
+async function savedLoginOwnerError(discovery, sessionId, args, context) {
+  let attached;
+  try {
+    attached = await attachSavedLoginOwner(discovery, context.signal);
+  } catch (error) {
+    if (context.signal?.aborted) return cancelledComputerResult(sessionId, false);
+    return computerErrorResult(
+      formatComputerToolError(
+        `saved_login_unavailable: the desktop did not answer the owner attachment (${error.name}); no input was sent`,
+        args
+      )
+    );
+  }
+  if (attached) return null;
+  return computerErrorResult(
+    formatComputerToolError(
+      'saved_login_unavailable: the desktop did not accept this runtime as the owner of its saved-login fills; no input was sent',
+      args
+    )
+  );
+}
+
+/** Open (or reuse) this runtime's owner connection to `discovery`'s bridge:
+ *  true once the desktop answered it, false when it refused or is unreachable.
+ *  The shared handshake is bounded by the bridge request timeout (rejecting
+ *  with its TimeoutError and resetting the shared state); each caller's wait
+ *  also ends on its own `signal` without closing the shared connection. */
+function attachSavedLoginOwner(discovery, signal) {
+  const current = savedLoginOwner;
+  if (current && current.port === discovery.port && current.token === discovery.token) {
+    return waitForComputerRelease(current.attached, signal);
+  }
+  current?.request.destroy();
+  const owner = { port: discovery.port, token: discovery.token, request: null, attached: null };
+  owner.attached = new Promise((resolve, reject) => {
+    const body = JSON.stringify({ runtime_id: SAVED_LOGIN_OWNER_ID, pid: process.pid });
+    const handshake = AbortSignal.timeout(REQUEST_TIMEOUT_MS);
+    const forget = () => {
+      handshake.removeEventListener('abort', onHandshakeTimeout);
+      if (savedLoginOwner === owner) savedLoginOwner = null;
+      resolve(false);
+    };
+    // Rejects first, so the callers see the timeout; forgetting at once lets
+    // the next fill attach afresh instead of waiting on the closing socket.
+    function onHandshakeTimeout() {
+      reject(handshake.reason);
+      forget();
+      owner.request.destroy();
+    }
+    handshake.addEventListener('abort', onHandshakeTimeout, { once: true });
+    owner.request = httpRequest(
+      {
+        host: '127.0.0.1',
+        port: discovery.port,
+        path: '/owner',
+        method: 'POST',
+        agent: false,
+        headers: { ...computerCommandHeaders(discovery), 'content-length': Buffer.byteLength(body) },
+      },
+      (response) => {
+        response.once('close', forget);
+        response.once('error', forget);
+        if (response.statusCode !== 200) {
+          response.resume();
+          forget();
+          return;
+        }
+        response.once('data', () => {
+          handshake.removeEventListener('abort', onHandshakeTimeout);
+          resolve(true);
+        });
+      }
+    );
+    owner.request.once('socket', (socket) => socket.unref());
+    owner.request.once('error', forget);
+    owner.request.once('close', forget);
+    owner.request.end(body);
+  });
+  savedLoginOwner = owner;
+  return waitForComputerRelease(owner.attached, signal);
+}
+
 function cancelDeferredComputerSessionRelease(sessionId) {
   const id = String(sessionId || '').trim();
   if (!id) return false;

package/src/runtime/computer-bridge/core-actions.mjs

@@ -74,13 +74,13 @@ export const COMPUTER_CORE_ACTION_SCHEMA = {
     text: {
       type: 'string',
       maxLength: 30_000,
-      description: `Literal text; foreground cap ${MAX_COMPUTER_FOREGROUND_TEXT_CHARS} UTF-16 code units per action.`,
+      description: `Literal text; foreground cap ${MAX_COMPUTER_FOREGROUND_TEXT_CHARS} UTF-16 code units per action. Never a password or one-time code, even one shown on screen: saved_login or ask_user.`,
     },
     value: {
       type: 'string',
       maxLength: 30_000,
       description:
-        'set_value replacement for an element that advertises set_value; writes the control directly, without focus or keystrokes.',
+        'set_value replacement for an element that advertises set_value; writes the control directly, without focus or keystrokes. Never a password or one-time code, even one shown on screen: saved_login or ask_user.',
     },
     keys: {
       type: 'string',