v1.9.7

[1.9.7] - 2026-11-01

Added

• tm_goal 听得见宿主的 changed 事件了。 宿主的 goal RPC 声明了 events.changed 并在每次写入时
  emit（2.2.5 实测：client.events.on 是一条真的订阅，返回 abort）。tm_goal 订阅它，按
  status|rounds|objective 长度 去重——我们自己的 set/pause 也会经由同一条事件回来，不去重就是
  "自己通知自己"；每次真实变更落一条 goal_changed 轨迹（不含 objective 正文，R6），并把一行一次性
  提示放进领队的下一张状态卡（渲染即消费）：🎯 宿主刚刚把目标改成 complete（第 N 轮）… 这是宿主的判断， 不是你的验收。
• status 打印 boot：这条目标是在哪次插件启动时设的。

Changed

• 目标结束只有两条路，clear 不是常走的那条。 宿主的 reviewer 读你最后一条消息就能判 complete，
  所以一句自信的"做完了"才是目标真正的死因。领队提示词现在把这件事说出来；status 不再把宿主的
  complete 渲染成"已完成/验收通过"，clear/pause 的回复也带同一句提醒。
• 账本闸门：clear / pause 在账本还有未完成项时直接拒绝，并点名是哪些 id；resume 从不拦。
  读不到账本时回复明说"这道闸门没有生效"，绝不把"没看见"当成"没有"；拒绝发生在任何宿主调用之前。

Verified

• 写接口确认（行为测试，不是读代码）：在客户端定义里声明 set/clear/pause 再真的调用，宿主原话
  是 Unknown RPC method: opencode.goal.set（.clear / .pause 同），而 get 正常。目标状态存在它自己的
  kv 命名空间里，ctx.storage 读回 undefined。/goal <objective> | pause | resume | clear 仍是唯一写路径。

v1.9.6

[1.9.6] - 2026-10-31

Fixed

• 修剪把 tool-result.result 换成了裸字符串——那会让整轮请求失败并杀掉会话。 宿主读的是
  part.result.type / .value；裸字符串让 type 变成 undefined，encodeJson(undefined) 抛
  SchemaError: Expected a JSON-serializable value，而它是 Effect defect，直接掀翻整轮
  （实测：4 秒后 Failed to drain Session，会话不再恢复）。现在只把 stub 写进原信封
  （{type:"text", value:stub}，content 类型的数组槽单独处理），tool-call.input 一律保持
  对象（{} 或 {pruned: …}）——字符串形状在 Anthropic 上会 400，在 OpenAI 上会被当成带引号
  的字面量而不是参数。修复来自 @HX-Wrdzgzs（PR #3），合入前已在本地跑过它的分支与反例对照。

v1.9.5

[1.9.5] - 2026-10-31

Added

• window: —— 一次调用只关于一个窗口，不是整个桌面。 七个计算机使用工具都接受
  window: "<标题子串>"，只在 call_tool 一处实现：screenshot 裁剪到该窗口且不改焦点，
  五个变更类工具先聚焦、执行、再把用户原来的前台窗口还原。零匹配不是崩溃
  （window-not-found 点名子串并让你先截图看 active_window）；多个匹配取面积最大者。
  钉了 6 条测试，其中两条是"工具本体永远看不到这个 key"和"截图不许抢焦点"。
• 工具描述改成第一句就是契约。 宿主在 Code Mode 目录里只显示描述的第一行（约 120 字符），
  我们原来把 expect_title 必填 / include_image 默认 false / no-observable-change 不是失败
  都写在第二句以后——模型一个字都没看到，这才是每个 agent 都得先摸索一遍的原因。现在 7 个
  工具的首行窗口里装的就是用法，initialize.instructions 收成一张速查卡。

Changed

• 新增第七个角色 ComputerUser，桌面控制收紧成 Team + 它。 模板常驻生成（mode: subagent，选择器里仍然只有 Team），
  Lead 的提示词写明：只有真的存在 computer-use MCP（我们的或任何等价的）时才派它，没有就直说缺这个能力。
  researcher / tester 从允许列表里移除——让一个读不可信网页的角色同时握着鼠标，是本产品能凑出的最坏组合；
  被拒角色走三条已有的拦截层，且每次拦截都计数。
• computer-use 的文档从安装手册里分出去。 新增 docs/computer-use.md，承载升级规程
  （两次重启：摘条目 → 重启 → 装 → 写回 → 重启，因为 Windows 不让替换运行中的 exe；
  或退出 OpenCode 再装一次）、边界、审计格式与排错。docs/installation-v2.md 只保留
  "问一次 + 指针"，并明写装插件时不要顺手去读那一页——没选择加入这个功能的用户，
  不该在例行安装里读到桌面控制的操作规程。

computer-use 0.0.6

Window scope: every tool accepts window: '<title substring>' - screenshot crops to that window and never steals focus, the five mutating tools focus it, act, and restore the previous foreground window. Also: tool descriptions now lead with their contract, because the Code Mode catalog only shows the first ~120 characters.

v1.9.4

[1.9.4] - 2026-10-30

Added

• Bounded divergence in the Lead's Step 0. When the ask has more than one plausible
  reading and none is blocking, the Lead now names up to three readings with a one-line
  consequence each, picks one and records the discarded ones — then never re-opens the
  choice once the plan is approved. Deliberately not a brainstorm: quantity is not a
  goal and rounds are the unit of cost.
• The Architect lists two or three candidate designs (or says why only one exists)
  with a one-line trade-off each, before the recommended one. Convergence is one-way.
• Child session ids are printed whole. A bare full ses_… in a reply is rendered by
  the desktop as a chip carrying that session's title, which is the only way the user can
  open the child being described; an abbreviated id is a dead reference and a fenced one
  stays literal.

Fixed

• The installer keeps the wheel's filename when downloading it. uv tool install
  derives the distribution name, version and Python tag from the FILENAME, so the
  guid-named temp file failed with "Must have a Python tag" even though the sha256
  verified. The download now keeps the asset's own name.
• The installer names the locked-exe cause instead of retrying a rename. Upgrading
  while the host runs the MCP server fails with os error 5/32, and renaming the running
  image is not reliable either (measured: sharing violation). It now prints the exact next
  move — quit OpenCode, re-run, reopen — while still writing zero config bytes.
• computeruse 0.0.3: the server reported 0.1.0 from a hardcoded string while the
  wheel was 0.0.2 (it now reads importlib.metadata), and its panic hotkey never armed
  because Ctrl+Alt+Shift+F12 was already registered (err=1409) — it now tries a short
  ladder and reports the combination that actually armed.

v1.9.3

[1.9.3] - 2026-10-30

Added

• 可选：计算机使用 MCP（computeruse）—— 三层按角色收窄，失败可计数。 宿主从
  mcp.computeruse 拉起一个桌面控制服务器（截屏 / 点击 / 输入 / 按键 / 滚轮 / 拖拽 / 状态），
  插件侧不做控制，只做收窄与观测。2026-10-30 真机实测后重写： 请求层删
  event.tools 在 2.2.1 上删不到任何东西——MCP 工具只出现在 execute 的 Code Mode
  目录里，被 deny 的 architect 照样调用成功。所以现在是三层：① permission.evaluate
  （主防线）：实测宿主以 action=computeruse_control_status 触发这条钩子，被拒角色返回
  effect:"deny"，拒绝语点名角色；② 内层 execute 事件：宿主把程序里的 MCP 调用单独
  报成 tool=computeruse_control_status 且 input 为空，这层只判角色、不读参数；③ 外层
  程序文本：读 input.code（实测 wire format）再回落 program，拼写表
  computer[\s._-]?use（点/下划线/连字符/空格全认）。请求层的 event.tools 删除保留但
  不再是防线，注释写明它是遗留。诚实边界写进拒绝语：③ 是文本级门禁不是沙箱，
  "computer"+"use" 拼名能绕过去；绕过去会当场写一行 computeruse_bypass 轨迹
  （角色 + 工具名）并进 computeruse_deny_leak——"没被拦住"不等于"被允许"。计数器：
  computeruse_tools（运行时量到的真名）/ computeruse_deny_leak / computeruse_absent，
  外加第五态 declared-off-surface（配置了、也连上了，但不在 event.tools 里——不是
  "服务器没注册"，措辞上必须分开）。安装指导书（docs/installation-v2.md）新增可选小节：
  先检测、已配置就不问；否则只问一次（两条硬边界：UAC 提权窗口不可达、打进终端的
  文本绕过 R2/R6）；同意 → -ComputerUse / --computer-use 再验证再重启；拒绝 →
  team-mode.computeruse-declined 标记（不能启动任何东西；共用配置助手也拒绝没有 command
  的 MCP 空壳）；并给出四步撤销。README 双语同步这一节的边界，包括 researcher 读网页 +
  控屏是本功能里最高注入风险组合。

Fixed

• The agent picker shows Team only. The five specialists are mode: "subagent" and every
  /team-* command now runs as the Lead (agent: "Team") with a dispatch preamble, so a
  command still reaches the named specialist without putting five extra entries in the picker.
  This changes the reason the specialists were mode: "all" (working around a command that
  selected a subagent-only role); the commands now select Team and dispatch, which keeps both
  the command and the picker correct.

computer-use 0.0.4

Documentation and prompt-level change only: the screenshot description and the server instructions now tell a vision-capable model to prefer include_image=true for the observation step, and to use the sha1/changed_pixels_pct when it only needs to know whether the screen moved. Upgrade note: quit OpenCode before installing, because the running server holds its exe open. Wheel sha256 b8c9a17093fd163552bc4f595e4ae58d4b8a1a4f1b1c2adf3f2e3a82465ca403

computer-use 0.0.3

Fixes two defects found by running the installed 0.0.2: the server reported version 0.1.0 (a hardcoded string that never followed pyproject.toml - it now reads the wheel metadata), and the panic hotkey never armed because Ctrl+Alt+Shift+F12 was already taken (RegisterHotKey err=1409) - it now tries a short ladder and reports the combination that actually armed. Wheel sha256 976ff36581111bff9c1be5058e713bbc853f08ee3eef07ce02c7909848d448f3

computer-use 0.0.2

0.0.2 - documentation and packaging only; the server behaviour is unchanged from 0.0.1. The README now states the thing the first release got wrong: the role split lives in the plugin (permission.evaluate / the inner execute event / the outer program text), not in this server, because an MCP server cannot see which agent is calling it. Wheel sha256 19e00f2e2033915b0ab4d05b2001d0938eec2cc4c195e7f123f1d0a2fede94d5

computer-use 0.0.1

First public release of the optional desktop-control MCP server — a GitHub Release asset, not an npm artifact.

Install

.\scripts\install.ps1 -ComputerUse          # Windows
bash scripts/install.sh --computer-use      # POSIX

The installer verifies this wheel's sha256 before installing it, runs --selftest, and only then writes the mcp.computeruse entry. A hash that does not match fails closed and writes nothing.

What it is

Seven tools: screenshot, click, type_text, key, scroll, drag, control_status. Every mutating tool returns {before_sha1, after_sha1, changed_pixels_pct, verdict} — no-observable-change is a first-class answer, never an error.

What it is not

• Not a security boundary. A 200-action budget, an audit trail, a panic hotkey and "someone is watching" bound the blast radius; they do not secure it.
• Elevated (UAC) windows are unreachable — only a Windows process can touch the secure desktop.
• Typed text bypasses this project's R2/R6 classifiers. Typing into a terminal is delivered as keystrokes; the env-variable red line does not exist on that path.
• Screenshots are not JIT-governed — they are non-text parts, so the offload pipeline passes them through. Use include_image:false unless the model can read pixels.

Audit

One row per action under %LOCALAPPDATA%\te-river\computeruse\audit\<date>\<sid8>\. Window titles and expect_title are stored as length + sha1 fingerprint, never as text; type_text records text_len + text_sha1_8 only. 7-day TTL.

Wheel

computeruse_mcp-0.0.1-py3-none-any.whl · sha256 6212f9b7eb814ea558514c1d886b3765036628e28dc72192c03a524b377e0f04