mixdog 1.3.5 → 1.4.1

package/src/runtime/channels/lib/worker-main.mjs

@@ -1,14 +1,13 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { createRequire } from 'node:module';
-import { loadConfig, createProvider, DATA_DIR } from './config.mjs';
+import { loadConfig, DATA_DIR } from './config.mjs';
 import { resolveVoiceRuntime } from './voice-runtime-fetcher.mjs';
 import { whisperThreadCount } from './voice-transcription.mjs';
 import { ensureReady, stopVoiceWhisperServer } from './whisper-server.mjs';
 import { ensurePrivateRuntimeRoot, resolveRuntimeRoot } from '../../shared/runtime-root.mjs';
 import { Scheduler } from './scheduler.mjs';
 import { renameSchedule as renameScheduleRow } from './schedules-db.mjs';
-import { hasPending as dispatchHasPending } from '../../agent/orchestrator/dispatch-persist.mjs';
 import { stripSoftWarns } from '../../agent/orchestrator/tool-loop-guard.mjs';
 import { JsonStateFile } from './state-file.mjs';
 import { writeJsonAtomicSync } from '../../shared/atomic-file.mjs';
@@ -94,7 +93,6 @@ if (isMixdogDebug()) {
   );
 }
 let config = await loadConfig();
-let provider = createProvider(config);
 const INSTANCE_ID = makeInstanceId();
 const TERMINAL_LEAD_PID = getTerminalLeadPid();
 runWorkerBootstrap({
@@ -129,22 +127,13 @@ let _reloadDebounce = null;
 const STATUS_FILE = getStatusPath(INSTANCE_ID);
 const statusState = new JsonStateFile(STATUS_FILE, {});
 statusState.ensure();
-const scheduler = new Scheduler(config.nonInteractive ?? [], config.interactive ?? []);
+const scheduler = new Scheduler(config.schedules ?? []);
 // A schedule fire is a turn in its owner bot's chat; the runner belongs to the
 // session-runtime layer, so this worker entry injects it (lazy, like webhooks).
 scheduler.setScheduleRunner(async (schedule, opts) => {
   const { runScheduleSession } = await import('../../../session-runtime/schedule-session-run.mjs');
   return runScheduleSession(schedule, opts);
 });
-// Register the pending-dispatch probe so the scheduler treats an in-flight
-// bridge dispatch as "active" regardless of user-inbound silence.
-scheduler.setPendingCheck(() => {
-  try {
-    return dispatchHasPending(DATA_DIR);
-  } catch {
-    return false;
-  }
-});
 let webhookServer = null;
 let eventPipeline = null;
 let bridgeRuntimeConnected = false;
@@ -158,10 +147,6 @@ const { startAutomationRuntime, startOwnedRuntime, stopOwnedRuntime, reloadRunti
     setConfig: (v) => {
       config = v;
     },
-    getProvider: () => provider,
-    setProvider: (v) => {
-      provider = v;
-    },
     getBridgeRuntimeConnected: () => bridgeRuntimeConnected,
     setBridgeRuntimeConnected: (v) => {
       bridgeRuntimeConnected = v;
@@ -185,7 +170,7 @@ const { startAutomationRuntime, startOwnedRuntime, stopOwnedRuntime, reloadRunti
     wireWebhookHandlers,
     wireEventQueueHandlers,
   });
-function injectAndRecord(channelId, _name, content, options) {
+function injectAndRecord(content, options) {
   // Strip soft-warn marker blocks (Tool-loop / Repeated-input / legacy
   // Repeated-tool / Mixed-tool / Tool-budget / Same-file multi-chunk /
   // Bash file-lookup / Iteration / 0-match advisory) from anywhere in the
@@ -199,22 +184,14 @@ function injectAndRecord(channelId, _name, content, options) {
   const now = new Date();
   const timeLabel = `${String(now.getHours()).padStart(2, '0')}:${String(now.getMinutes()).padStart(2, '0')} `;
   const sourceLabel = options?.type ? `${timeLabel}: ${options.type}` : timeLabel;
-  const meta = { chat_id: channelId, user: sourceLabel, user_id: 'system', ts };
+  const meta = { user: sourceLabel, user_id: 'system', ts };
   if (options?.instruction) meta.instruction = options.instruction;
   if (options?.type) meta.type = options.type;
   // `silent_to_agent` — lifecycle status pings (worker/iter/started echoes)
-  // must NOT land in Lead's context window. The channel relay that used to
-  // surface them is retired, so silent pings are dropped entirely.
+  // must NOT land in Lead's context window, so silent pings are dropped.
   if (options?.silent_to_agent === true) return;
   sendNotifyToParent('notifications/claude/channel', { content, meta });
 }
-scheduler.setInjectHandler((channelId, name, content, options) => {
-  injectAndRecord(channelId, name, content, options);
-});
-// Interactive schedule fires may only inject while this process
-// actually holds the live bridge seat; otherwise the scheduler falls back to
-// the visible-session run so the fire is never lost.
-scheduler.setInjectReadyCheck(() => bridgeRuntimeConnected && currentOwnerState().owned);
 function wireWebhookHandlers() {
   if (!webhookServer) return;
   webhookServer.setEventPipeline(eventPipeline);
@@ -237,8 +214,8 @@ function wireWebhookHandlers() {
 }
 function wireEventQueueHandlers(eventQueue) {
   if (!eventQueue) return;
-  eventQueue.setInjectHandler((channelId, name, content, options) => {
-    injectAndRecord(channelId, name, content, options);
+  eventQueue.setInjectHandler((_name, content, options) => {
+    injectAndRecord(content, options);
   });
   // Defensive ownership probe: the queue tick should only run in the active
   // owner process. Non-owner instances see bridgeRuntimeConnected=false and
@@ -262,7 +239,7 @@ const { handleToolCall } = createToolDispatch({
     },
     writeBridgeState,
     notifyRemoteAcquired,
-    startChannelBridge: () => start({ messaging: true }),
+    startChannelBridge: () => start({ bridge: true }),
     stopOwnedRuntime,
     reloadRuntimeConfig,
     // Rename and re-arm under one reservation: the scheduler is reloaded from
@@ -288,7 +265,7 @@ function ensureConfigWatcher() {
   } catch {}
 }
 async function start(options = {}) {
-  if (options?.messaging === false) {
+  if (options?.bridge === false) {
     channelBridgeActive = false;
     writeBridgeState(false);
     await startAutomationRuntime();
@@ -308,7 +285,7 @@ async function start(options = {}) {
   }
   // Hot-reload config on file change (schedules/webhooks/events).
   // Cross-process edits invalidate the raw config cache before the debounced
-  // reload so both messaging and automation-only daemon modes stay current.
+  // reload so both bridge and automation-only daemon modes stay current.
   ensureConfigWatcher();
   // Pre-warm the whisper-server manager once at owner startup so the first
   // voice transcription does not pay cold-start cost. Non-blocking: failures
@@ -361,7 +338,6 @@ if (_isWorkerMode && process.send && process.env.MIXDOG_DAEMON_HOST !== '1') {
     clearServerPid,
     instanceId: INSTANCE_ID,
     statusState,
-    getProvider: () => provider,
     getConfig: () => config,
     handleMemoryCallResponse,
     handleToolCall,

package/src/runtime/computer-bridge/action-schema.mjs

@@ -35,8 +35,13 @@ const ACTIONS = [
   'menu',
   'clipboard',
   'launch',
+  'saved_login',
 ];
 
+// Which value of a saved login saved_login types (the host checks the focused
+// field's kind before typing it).
+const SAVED_LOGIN_FIELDS = ['username', 'password'];
+
 const windowTarget = {
   window_id: {
     type: 'string',
@@ -347,6 +352,28 @@ export const COMPUTER_ACTION_CONTRACTS = [
       ['app']
     )
   ),
+  branch(
+    'saved_login',
+    input(
+      {
+        ...windowTarget,
+        ...appTarget,
+        savedAccount: {
+          type: 'string',
+          minLength: 1,
+          description:
+            "Fallback sign-in in the user's own browser; prefer its existing session/SSO or Browser Use's saved sign-in. Saved login (username or masked label; a miss lists the site's labels) written after host checks into the focused field of a Chrome/Edge HTTPS page. The site receives it. A password is kept from you and its browser's pixels are withheld this turn, but a page that redisplays it can expose it, and other programs of the same Windows user are outside this protection; a username is not hidden. On refusal hand the secret to the user (handoff_user secret, surface computer).",
+        },
+        field: {
+          type: 'string',
+          enum: SAVED_LOGIN_FIELDS,
+          description:
+            "username (text field) or password (password field). One-time codes, passkeys, security keys and app approvals are the user's step: handoff_user takeover.",
+        },
+      },
+      ['savedAccount', 'field']
+    )
+  ),
 ];
 
 // A JSON Schema 2020-12 object root with no root combinator (Anthropic
@@ -396,7 +423,7 @@ for (const actionBranch of COMPUTER_ACTION_CONTRACTS) {
 // Actions that drive one exact window. They carry exactly one window target:
 // the exact window_id, or an app label the host resolves to one window and
 // refuses when it matches more than one.
-const WINDOW_TARGET_ACTIONS = new Set(['act', 'window', 'menu', 'verify']);
+const WINDOW_TARGET_ACTIONS = new Set(['act', 'window', 'menu', 'verify', 'saved_login']);
 // The host command each window operation becomes; every other operation is a
 // window_state change carrying the operation as its state.
 const WINDOW_OPERATION_ACTIONS = Object.freeze({
@@ -564,6 +591,11 @@ function launchError(input) {
   return null;
 }
 
+function savedLoginError(input) {
+  if (!String(input.savedAccount || '').trim()) return 'Computer Use saved_login savedAccount must not be empty';
+  return null;
+}
+
 function listError(input) {
   if (hasOwn(input, 'limit') && input.kind !== 'history') {
     return 'Computer Use list limit applies to kind="history"';
@@ -584,6 +616,7 @@ const ACTION_RULES = {
   window: windowError,
   clipboard: clipboardError,
   launch: launchError,
+  saved_login: savedLoginError,
 };
 
 export function validateComputerToolArgs(rawArgs) {
@@ -686,6 +719,14 @@ export function toComputerHostCommand(rawArgs) {
       command.action = inputValue.operation === 'write' ? 'clipboard_write' : 'clipboard_read';
       delete command.operation;
       break;
+    case 'saved_login':
+      // Always foreground: the value goes to the field focused in the
+      // browser window the host verified, never through window messages.
+      command.action = 'fill_saved_login';
+      command.saved_account = inputValue.savedAccount;
+      command.delivery = 'foreground';
+      delete command.savedAccount;
+      break;
     default:
       command.action = args.action;
   }

package/src/runtime/computer-bridge/actions.mjs

@@ -29,6 +29,8 @@ action('input_recovery_state', nativeRead);
 action('input_idle_state', nativeRead);
 action('ocr_image', nativeRead);
 action('ocr_status', nativeRead);
+// Host-internal: whether a saved-login owner's runtime process has ended.
+action('process_fate', nativeRead);
 action('release_session', { retainNativeRefs: true });
 action('release_cursor_theme', { retainNativeRefs: true });
 // Handing held input, focus and pointer back changes no target's content, so a
@@ -98,8 +100,14 @@ for (const name of [
   });
 }
 action('clipboard_write', { foreground: true });
+// A saved login written into the focused field of the user's browser window:
+// an input bound to a fresh observation, always on the foreground lane, with no
+// automatic capture (the reply never carries the field it filled).
+action('fill_saved_login', { observationBound: true, foreground: true, policy: 'act' });
 action('sequence', { policy: 'act' });
-for (const name of ['execution_end', 'session_release', 'session_abort']) {
+// turn_settle: the runtime's settlement of one agent turn (turn_id), which
+// alone retires a saved-login fill's protection (desktop secret-input.ts).
+for (const name of ['execution_end', 'session_release', 'session_abort', 'turn_settle']) {
   action(name, { lifecycle: true, observeOnly: true });
 }
 export const COMPUTER_ACTIONS = Object.freeze(catalogue);

package/src/runtime/computer-bridge/client.mjs

@@ -25,6 +25,8 @@ import { MAX_COMPUTER_REQUEST_BYTES, readComputerBridgeJson, validateComputerRep
 import { computerActionHas } from './actions.mjs';
 import { linuxCaptureFallback, linuxComputerPreflight } from './linux-readiness.mjs';
 import { continuePendingComputerWork, isPendingComputerWork } from './pending-continuation.mjs';
+import { randomUUID } from 'node:crypto';
+import { request as httpRequest } from 'node:http';
 
 export { canonicalComputerResultText };
 
@@ -53,6 +55,18 @@ const pendingComputerSessionReleases = new Map();
 // explicit release, so shutdown needs the full set.
 const hostBoundComputerSessions = new Set();
 const activeComputerExecutions = new Set();
+// Per session, the newest agent turn that sent a saved-login fill whose
+// settlement the desktop has not yet accepted. Aborts never clear it.
+const savedLoginTurns = new Map();
+/** This runtime process as the owner of its saved-login fills: the desktop
+ *  keeps a fill's protection until its turn settles or this owner is gone
+ *  (apps/desktop/src/main/secret-input.ts SavedLoginTurn). */
+export const SAVED_LOGIN_OWNER_ID = randomUUID();
+// The owner connection: one held POST /owner (owner id and this process id)
+// to the bridge it was opened on. A close only detaches it on the desktop;
+// the desktop retires this owner early only when the OS proves this process
+// ended. The socket never keeps the process alive.
+let savedLoginOwner = null;
 const BRIDGE_UNAVAILABLE_MESSAGE =
   'computer use is unavailable; open the Mixdog desktop app and enable Computer Use in settings';
 
@@ -269,7 +283,15 @@ async function executeComputerToolInner(rawArgs, context, note) {
     command = fallback.command;
     note.text = fallback.note;
   }
-  const encoded = JSON.stringify({ ...command, ...(sessionId ? { session_id: sessionId } : {}) });
+  // A saved-login fill names its agent turn: the desktop keeps the fill's
+  // protection until that turn's settlement (settleSavedLoginTurn).
+  const turnId = Number(context?.turnId) || 0;
+  const savedLoginTurn = command.action === 'fill_saved_login' && sessionId && turnId > 0 ? turnId : 0;
+  const encoded = JSON.stringify({
+    ...command,
+    ...(sessionId ? { session_id: sessionId } : {}),
+    ...(savedLoginTurn ? { turn_id: savedLoginTurn, runtime_id: SAVED_LOGIN_OWNER_ID } : {}),
+  });
   if (Buffer.byteLength(encoded) > MAX_COMPUTER_REQUEST_BYTES) {
     return computerErrorResult('Error: computer request exceeds byte limit; no input was dispatched');
   }
@@ -286,7 +308,14 @@ async function executeComputerToolInner(rawArgs, context, note) {
   }
   const releaseError = await awaitPendingSessionRelease(sessionId, args, context);
   if (releaseError) return releaseError;
+  if (savedLoginTurn) {
+    const ownerError = await savedLoginOwnerError(discovery, sessionId, args, context);
+    if (ownerError) return ownerError;
+  }
   trackComputerSession(sessionId, command);
+  // Recorded before the request leaves: the fill may arm its protection even
+  // when its reply is lost, so the turn's settlement is owed regardless.
+  if (savedLoginTurn) savedLoginTurns.set(sessionId, Math.max(savedLoginTurns.get(sessionId) || 0, savedLoginTurn));
   const posted = await postWithBridgeRecovery(discovery, command, encoded, sessionId, context);
   if (!posted.response) return posted;
   const { bridge, response } = posted;
@@ -362,7 +391,7 @@ async function settlePendingComputerWork(value, command, bridge, sessionId, cont
   }
 }
 
-async function sendComputerSessionControl(sessionId, action, timeoutMs) {
+async function sendComputerSessionControl(sessionId, action, timeoutMs, extra = {}) {
   const discovery = readBridgeDiscovery(DISCOVERY_FILE);
   if (!discovery) return false;
   try {
@@ -371,6 +400,7 @@ async function sendComputerSessionControl(sessionId, action, timeoutMs) {
       {
         action,
         session_id: sessionId,
+        ...extra,
       },
       { timeoutMs }
     );
@@ -381,12 +411,40 @@ async function sendComputerSessionControl(sessionId, action, timeoutMs) {
   }
 }
 
+/** Runtime-only, at request time: bind `requestId` to the exact window and
+ *  field ref the agent named (desktop secret-input.ts bindComputerSecret).
+ *  Answers 'bound' or 'no_field'; no desktop or an unknown answer is 'blocked'. */
+export async function computerSecretBind(sessionId, requestId, { ref = '', windowId = '', signal } = {}) {
+  const discovery = readBridgeDiscovery(DISCOVERY_FILE);
+  if (!discovery || !sessionId || !requestId) return 'blocked';
+  try {
+    const response = await postComputerCommand(
+      discovery,
+      {
+        action: 'secret_bind',
+        session_id: String(sessionId),
+        request_id: String(requestId),
+        ref: String(ref),
+        window_id: String(windowId),
+      },
+      { signal }
+    );
+    const body = await readComputerBridgeJson(response);
+    const text = response.ok && body?.ok === true ? body.value?.text : '';
+    return ['bound', 'no_field'].includes(text) ? text : 'blocked';
+  } catch {
+    return 'blocked';
+  }
+}
+
 /** Runtime-only: type the secret the user handed the desktop for `requestId`
- *  into the focused field (or `ref`) once. The value never passes through
- *  here; the host answers only whether it was typed. */
+ *  into the window and field it was bound to (computerSecretBind) once. The
+ *  value never passes through here; the host answers only the outcome
+ *  ('entered', 'no_field', 'page_changed', 'blocked', 'expired'); no desktop
+ *  or an unknown answer is 'blocked'. */
 export async function computerSecretInput(sessionId, requestId, { ref = '', windowId = '', signal } = {}) {
   const discovery = readBridgeDiscovery(DISCOVERY_FILE);
-  if (!discovery || !sessionId || !requestId) return 'skipped';
+  if (!discovery || !sessionId || !requestId) return 'blocked';
   try {
     const response = await postComputerCommand(
       discovery,
@@ -400,9 +458,10 @@ export async function computerSecretInput(sessionId, requestId, { ref = '', wind
       { signal }
     );
     const body = await readComputerBridgeJson(response);
-    return response.ok && body?.ok === true && body.value?.text === 'provided' ? 'provided' : 'skipped';
+    const text = response.ok && body?.ok === true ? body.value?.text : '';
+    return ['entered', 'no_field', 'page_changed', 'blocked', 'expired'].includes(text) ? text : 'blocked';
   } catch {
-    return 'skipped';
+    return 'blocked';
   }
 }
 
@@ -423,12 +482,125 @@ async function abortComputerSession(sessionId) {
  * desktop back, keeping the warm worker and observation refs for a possible follow-up. */
 export async function endComputerExecution(sessionId) {
   const id = String(sessionId || '').trim();
-  if (!id || !activeComputerExecutions.has(id)) return false;
+  if (!id) return false;
+  await settleSavedLoginTurn(id);
+  if (!activeComputerExecutions.has(id)) return false;
   const ended = await sendComputerSessionControl(id, 'execution_end', EXECUTION_END_TIMEOUT_MS);
   if (ended) activeComputerExecutions.delete(id);
   return ended;
 }
 
+/** Agent-turn settlement for a session that filled a saved login: tell the
+ *  desktop the turn is over so that fill's protection can retire. Separate
+ *  from input cleanup and independent of any abort; a settlement the desktop
+ *  did not accept stays owed and is sent again at the session's next one.
+ *  `endedTurnId` is the turn that ended when the caller knows it (the
+ *  session's terminal state); otherwise the newest owed turn is the one
+ *  ending (the lead's turn settlement). */
+async function settleSavedLoginTurn(sessionId, endedTurnId = 0) {
+  const owed = savedLoginTurns.get(sessionId);
+  if (!owed) return;
+  if (endedTurnId > 0 && owed > endedTurnId) return;
+  const accepted = await sendComputerSessionControl(sessionId, 'turn_settle', EXECUTION_END_TIMEOUT_MS, {
+    turn_id: owed,
+    runtime_id: SAVED_LOGIN_OWNER_ID,
+  });
+  if (accepted && savedLoginTurns.get(sessionId) === owed) savedLoginTurns.delete(sessionId);
+}
+
+/** A session's agent turn reached its terminal state (done, error or
+ *  cancelled; manager/runtime-liveness.mjs, for lead and sub-agent sessions
+ *  alike): settle its saved-login fills. */
+export async function finishComputerTurn(sessionId, turnId) {
+  const id = String(sessionId || '').trim();
+  if (!id || !(Number(turnId) > 0)) return;
+  await settleSavedLoginTurn(id, Number(turnId));
+}
+
+// Returns the error result that ends a saved-login call whose owner connection
+// is not attached, or null to proceed. Nothing was sent in any of these cases.
+async function savedLoginOwnerError(discovery, sessionId, args, context) {
+  let attached;
+  try {
+    attached = await attachSavedLoginOwner(discovery, context.signal);
+  } catch (error) {
+    if (context.signal?.aborted) return cancelledComputerResult(sessionId, false);
+    return computerErrorResult(
+      formatComputerToolError(
+        `saved_login_unavailable: the desktop did not answer the owner attachment (${error.name}); no input was sent`,
+        args
+      )
+    );
+  }
+  if (attached) return null;
+  return computerErrorResult(
+    formatComputerToolError(
+      'saved_login_unavailable: the desktop did not accept this runtime as the owner of its saved-login fills; no input was sent',
+      args
+    )
+  );
+}
+
+/** Open (or reuse) this runtime's owner connection to `discovery`'s bridge:
+ *  true once the desktop answered it, false when it refused or is unreachable.
+ *  The shared handshake is bounded by the bridge request timeout (rejecting
+ *  with its TimeoutError and resetting the shared state); each caller's wait
+ *  also ends on its own `signal` without closing the shared connection. */
+function attachSavedLoginOwner(discovery, signal) {
+  const current = savedLoginOwner;
+  if (current && current.port === discovery.port && current.token === discovery.token) {
+    return waitForComputerRelease(current.attached, signal);
+  }
+  current?.request.destroy();
+  const owner = { port: discovery.port, token: discovery.token, request: null, attached: null };
+  owner.attached = new Promise((resolve, reject) => {
+    const body = JSON.stringify({ runtime_id: SAVED_LOGIN_OWNER_ID, pid: process.pid });
+    const handshake = AbortSignal.timeout(REQUEST_TIMEOUT_MS);
+    const forget = () => {
+      handshake.removeEventListener('abort', onHandshakeTimeout);
+      if (savedLoginOwner === owner) savedLoginOwner = null;
+      resolve(false);
+    };
+    // Rejects first, so the callers see the timeout; forgetting at once lets
+    // the next fill attach afresh instead of waiting on the closing socket.
+    function onHandshakeTimeout() {
+      reject(handshake.reason);
+      forget();
+      owner.request.destroy();
+    }
+    handshake.addEventListener('abort', onHandshakeTimeout, { once: true });
+    owner.request = httpRequest(
+      {
+        host: '127.0.0.1',
+        port: discovery.port,
+        path: '/owner',
+        method: 'POST',
+        agent: false,
+        headers: { ...computerCommandHeaders(discovery), 'content-length': Buffer.byteLength(body) },
+      },
+      (response) => {
+        response.once('close', forget);
+        response.once('error', forget);
+        if (response.statusCode !== 200) {
+          response.resume();
+          forget();
+          return;
+        }
+        response.once('data', () => {
+          handshake.removeEventListener('abort', onHandshakeTimeout);
+          resolve(true);
+        });
+      }
+    );
+    owner.request.once('socket', (socket) => socket.unref());
+    owner.request.once('error', forget);
+    owner.request.once('close', forget);
+    owner.request.end(body);
+  });
+  savedLoginOwner = owner;
+  return waitForComputerRelease(owner.attached, signal);
+}
+
 function cancelDeferredComputerSessionRelease(sessionId) {
   const id = String(sessionId || '').trim();
   if (!id) return false;

package/src/runtime/computer-bridge/core-actions.mjs

@@ -74,13 +74,13 @@ export const COMPUTER_CORE_ACTION_SCHEMA = {
     text: {
       type: 'string',
       maxLength: 30_000,
-      description: `Literal text; foreground cap ${MAX_COMPUTER_FOREGROUND_TEXT_CHARS} UTF-16 code units per action.`,
+      description: `Literal text; foreground cap ${MAX_COMPUTER_FOREGROUND_TEXT_CHARS} UTF-16 code units per action. Never a password or one-time code, even one shown on screen: saved_login or handoff_user.`,
     },
     value: {
       type: 'string',
       maxLength: 30_000,
       description:
-        'set_value replacement for an element that advertises set_value; writes the control directly, without focus or keystrokes.',
+        'set_value replacement for an element that advertises set_value; writes the control directly, without focus or keystrokes. Never a password or one-time code, even one shown on screen: saved_login or handoff_user.',
     },
     keys: {
       type: 'string',

package/src/runtime/computer-bridge/error-recovery.mjs

@@ -20,7 +20,7 @@ function targetLabel(args) {
 
 const LIST_WINDOW_CODES = new Set(['ambiguous_window_target', 'window_stale', 'window_target_not_found']);
 const STALE_TARGET_CODES = new Set(['stale_frame', 'stale_target', 'target_mismatch']);
-const USER_YIELD_CODES = new Set(['computer_user_control_active', 'computer_user_takeover', 'user_input_active']);
+const USER_YIELD_CODES = new Set(['computer_user_control_active', 'computer_user_takeover']);
 const DIAGNOSE_CODES = new Set(['input_observation_unavailable', 'computer_cursor_unavailable']);
 const CLEANUP_CODES = new Set([
   'computer_cleanup_pending',
@@ -29,6 +29,11 @@ const CLEANUP_CODES = new Set([
   'privileged_worker_cleanup_unconfirmed',
 ]);
 const PIXEL_CODES = new Set(['pixel_unavailable', 'observation_unavailable']);
+// Saved-login refusals made before anything was written (host/saved-login.ts).
+const SAVED_LOGIN_REFUSAL_CODES = new Set(['saved_login_refused', 'saved_login_changed', 'saved_login_unavailable']);
+const SECRET_HANDOFF = 'hand the secret to the user with handoff_user (kind "secret", surface "computer")';
+const STEP_HANDOFF =
+  'hand the step to the user with handoff_user (kind "takeover", surface "computer", need "sign_in")';
 // Reads send no input, so their timeout is a provider budget, not an uncertain
 // mutation: the caller needs another read route, not a cleanup investigation.
 const READ_ONLY_ACTIONS = new Set(['capture', 'list', 'diagnose', 'verify']);
@@ -109,7 +114,14 @@ function recoveryForCode(code, args) {
       code,
       next: 'wait_for_user',
       guidance:
-        "Computer Use yielded to the user. Call wait_for_user for bounded waiting. The user's Resume on the overlay continues the pause, and ordinary physical input may also resume after the host-configured quiet interval (default 5 seconds); explicit stops and uncertain cleanup/observation require the user. Stop cancels the task. Timeout does not authorize input. After resumed, capture fresh state; never replay interrupted input.",
+        "Computer Use yielded to the user. Call wait_for_user for bounded waiting. The user's Resume on the overlay continues the pause. Physical input alone never pauses the session; only an explicit Pause/Stop or uncertain cleanup/observation does, and those require the user. Stop cancels the task. Timeout does not authorize input. After resumed, capture fresh state; never replay interrupted input.",
+    };
+  }
+  if (code === 'user_input_active') {
+    return {
+      code,
+      next: 'capture',
+      guidance: `The user's own input interrupted this action only; the session keeps running and this is not a pause. Do not call wait_for_user for it. Capture ${target} again before any further input, and never replay the interrupted input, which may have been partly delivered. If the step needed foreground, retry it after the user pauses or use a supported background route.`,
     };
   }
   if (code === 'input_recovery_unconfirmed') {
@@ -143,6 +155,20 @@ function recoveryForCode(code, args) {
       guidance: `No input was sent. Foreground delivery needs an observation taken while the user's own input was idle. Let their input settle and capture ${target} again, or send this action through background delivery when it supports one.`,
     };
   }
+  if (SAVED_LOGIN_REFUSAL_CODES.has(code)) {
+    return {
+      code,
+      next: 'handoff_user',
+      guidance: `Nothing was written. If the refusal lists stored masked labels and the user's account is one of them, use that label; otherwise ${SECRET_HANDOFF}. Never type the secret yourself or try another window or field to get past the check.`,
+    };
+  }
+  if (code === 'saved_login_unconfirmed') {
+    return {
+      code,
+      next: 'handoff_user',
+      guidance: `The saved value may have been written. Do not call saved_login again for this field and do not type it yourself; ${STEP_HANDOFF} to check the field and finish signing in.`,
+    };
+  }
   if (code === 'computer_command_timeout') return timeoutRecovery(code, args, target);
   if (code.startsWith('menu_')) {
     return {

package/src/runtime/computer-bridge/linux-action-capabilities.mjs

@@ -14,15 +14,34 @@
 //   pointer/keyboard the input device (uinput on Wayland, XTest on X11).
 
 const WINDOW_ACTIONS = new Set([
-  'list_windows', 'window_snapshot', 'related_windows', 'window_bounds', 'window_capture',
-  'window_integrity', 'validate_background_input', 'list_apps', 'verify', 'focus_window',
-  'move_window', 'window_state', 'close_window', 'terminate_process',
+  'list_windows',
+  'window_snapshot',
+  'related_windows',
+  'window_bounds',
+  'window_capture',
+  'window_integrity',
+  'validate_background_input',
+  'list_apps',
+  'verify',
+  'focus_window',
+  'move_window',
+  'window_state',
+  'close_window',
+  'terminate_process',
 ]);
 const ACCESSIBILITY_ACTIONS = new Set(['snapshot', 'find', 'window_predicates', 'accessibility_probe']);
 const SEMANTIC_ACTIONS = new Set(['invoke', 'set_value', 'toggle', 'invoke_menu']);
 const POINTER_ACTIONS = new Set([
-  'click', 'double_click', 'right_click', 'middle_click', 'triple_click',
-  'mouse_down', 'mouse_up', 'mouse_move', 'drag', 'scroll',
+  'click',
+  'double_click',
+  'right_click',
+  'middle_click',
+  'triple_click',
+  'mouse_down',
+  'mouse_up',
+  'mouse_move',
+  'drag',
+  'scroll',
 ]);
 const KEYBOARD_ACTIONS = new Set(['type', 'key', 'key_down', 'key_up']);
 

package/src/runtime/computer-bridge/linux-readiness.d.mts

@@ -35,7 +35,10 @@ export interface LinuxComputerRefusal {
 export const MIN_WINDOW_HELPER_VERSION: number;
 export const CAPABILITY_UNAVAILABLE_CODE: 'computer_capability_unavailable';
 export function detectSession(env: Record<string, string | undefined>): 'wayland' | 'x11';
-export function detectDesktop(env: Record<string, string | undefined>, session: 'wayland' | 'x11'): LinuxComputerReadiness['desktop'];
+export function detectDesktop(
+  env: Record<string, string | undefined>,
+  session: 'wayland' | 'x11'
+): LinuxComputerReadiness['desktop'];
 export function checkLinuxComputerReadiness(options?: Record<string, unknown>): Promise<LinuxComputerReadiness>;
 export function getLinuxComputerReadiness(options?: Record<string, unknown>): Promise<LinuxComputerReadiness>;
 export function missingCapabilities(
@@ -47,4 +50,6 @@ export function resetLinuxComputerPreflightCache(): void;
 export const GNOME_EXTENSION_UUID: 'mixdog-windows@mixdog.io';
 export function gnomeExtensionDirs(env?: Record<string, string | undefined>): string[];
 export const CAPTURE_FALLBACK_NOTE: string;
-export function linuxCaptureFallback(options?: Record<string, unknown>): Promise<{ command: Record<string, unknown>; note: string } | null>;
+export function linuxCaptureFallback(
+  options?: Record<string, unknown>
+): Promise<{ command: Record<string, unknown>; note: string } | null>;