1.3.1 — worker-side OCR, UAC awareness, IME-safe text

1.3.1 — worker-side grounding, UAC awareness and IME-safe text

Released 2026-11-04 · previous release 1.3.0

Why this release exists

1.3.0 made the desktop lifecycle and the indicators honest. A measured WeChat run then showed where
the remaining cost sat: a zero-UIA application forced one screenshot per decision, an IME turned
unicode typing into a garbled outbound message, and a UAC prompt left the agent retrying into a
surface it could never reach. 1.3.1 moves grounding into the worker and turns those failures into
detected, reported states.

New and changed tools

Area	What changed
computer_ocr	New observation tool. Inbox Windows OCR returns lines and per-word boxes in absolute screen pixels, so controls can be located by name. The union Windows.winmd ships inside the package; no SDK, language pack download or extra dependency.
computer_wait (change)	Returns changeBounds — the bounding box of the differing region — so "message sent" (input area) can be told apart from "caret blinking" (one line).
computer_wait (stable)	Reports caretSteady: true when the only motion is a ~1–2 Hz caret blink, instead of waiting out the full timeout.
computer_marks	New uiaOnly option pins identity to window handle and geometry when an animated neighbour keeps invalidating the sampled pixel signature. Occlusion checking at dispatch still applies.
computer_type (paste)	When the clipboard holds private or oversized formats that cannot be snapshotted, the paste proceeds without restoration and reports clipboardRestore: "skipped-unpreservable-clipboard" with a warning. It no longer refuses and fall back to unicode keystrokes.

Secure desktop (UAC / lock screen)

The worker probes the input desktop every monitor tick. Three consecutive misses engage a paused
state: input ops refuse to dispatch with SECURE_DESKTOP_ACTIVE, the human receives a bilingual
notice, and the agent is told what only the human can do. One success clears the state and dispatch
resumes automatically — no cycle, lease or light is torn down by the wait.

Windows does not allow automation to answer the prompt itself; this release reports and waits
instead of pretending otherwise.

Indicators

• All colours share one DPI-derived rail: 1.6 cm of physical screen (about 106 px at 175% scaling,
  previously a fixed 8 px).
• Breathing bands keep a visible floor: thinking and asking 50..140, human handoff 90..160. Deep
  blue while actuating stays steady.
• The pre-operation notice counts down 1.2 s (was 1.5 s).
• A deliberate 16-pixel pointer move between actuations now yields the desktop for the remainder of
  the live cycle, not only while an injection is in flight.

Reliability and noise

• computer_state no longer lists the worker's own indicator overlay.
• KICKOFF-FOCUS-REQUIRED names the foreground window (hwnd, pid, title).
• High-risk batch refusals name the offending action[i] and its argument.
• The no-change click warning explains that an already-focused editor is an expected cause.

Docs

The computer-use skill now leads with the generalised zero-UIA ladder (OCR first, keyboard flow,
crop-and-verify), the IME/clipboard rule for editors that cannot be read back, and the new wait
fields. The measured WeChat case moved to
skills/computer-use/references/zero-uia-apps.md.

Compatibility

No tool was removed or renamed. computer_ocr is new; existing calls behave as before except the
paste downgrade and the two computer_wait fields, which are additive. Windows x64, Node >= 22,
same host range as 1.3.0. Both native helpers ship prebuilt.

Computer Use 1.3.0 — 控制周期、接管与灯效升级

桌面控制周期、人工接管、多 agent 隔离与灯效升级。

• 仅实际键鼠操控期间接管；16 像素鼠标容差，1.5 秒操作前提示。
• 人工中断保留任务，交回后要求重新观察并继续原任务。
• 跨进程独占控制；聊天继续时可主动释放，正常结束不再弹出确认菜单。
• 直角连续细边线和柔光，不遮挡正文；保留状态逻辑和动画时序。
• 完整插件包含两份预编译原生组件，并保留 1.2.3 审批归因修复。

46 组回归通过，1 组真实前台键盘测试跳过；实际归档和 18 个 DSH / 21 个 MCP 工具加载验证通过。

此发布先进入预发布频道。npm 发布及 latest 提升是单独步骤；默认市场更新须等待 npm latest 提升，不应仅凭 GitHub 发布判断已完成市场更新。

详细说明

发布状态：npm 1.3.0 已发布至 next（2026-11-02 17:35:51 UTC），下载归档与 GitHub 附件及本机安装一致。latest 仍为 1.2.3；按发布流程，2026-11-03 17:35:51 UTC（北京时间 11 月 4 日 01:35:51）起才可提升。

Computer Use · Codex-style 1.2.3 — 完整自动修复

完整更新：正常安装即可生效

1.2.3 已将审批误报修复集成到插件运行时。正常安装或更新插件后，computer-use 调用无需再单独修改 DSH 宿主文件。

• never 策略导致的自动拒绝会明确提示“审批弹窗已禁用，操作自动拒绝，未询问用户”。
• computer_key、computer_batch 等 computer-use 调用均覆盖。
• 宿主仍决定审批结果并记录完整审计；原有放行、取消和按键策略保留。
• 修复已兼容的宿主不会重复改写结果，卸载插件时恢复原服务方法。
• 包含 1.2.1 的原生提醒修复，以及两份预编译原生组件。

安装和更新

在 DSH 插件市场更新 dsh-codex-style-computer-use，或按宿主支持的方式安装 dsh-codex-style-computer-use@1.2.3。已经加载旧版的宿主请按其提示重启。

附完整插件包 dsh-codex-style-computer-use-1.2.3.tgz 和 SHA256SUMS.txt。GitHub 自动生成的源码归档也包含全部修复和测试。

验证

• 23 项审批归因回归，包含自动安装、卸载恢复、Cordis 服务代理和批处理使用的统一审批路径。
• 对实际 TGZ 解压后的运行时重复测试通过。
• 原审批策略、16 项提醒测试、发布守卫、原生组件哈希及隔离原生往返通过。
• 真实运行中的 DSH Cordis 服务验证通过；验证使用内存会话，没有键鼠输入或真实会话写入。
• Windows CI 通过。

版本说明

---

Full runtime update: the plugin automatically corrects the known legacy approval-attribution message for computer-use calls. Normal package installation/update is sufficient on the tested host; no separate host-file patch is required. Host approvals, audit, cancellation and key policy remain authoritative. Includes both prebuilt native helpers and the native attention fix. 23 attribution regressions, packed-module verification and Windows CI passed.

Computer Use · Codex-style 1.2.2 — 宿主审批归因补丁

已由 1.2.3 完整正式版 替代：正常安装或更新插件即可自动修复 computer-use 审批归因，无需单独修改宿主文件。以下保留 1.2.2 工具预发布的原始说明。

审批误报修复工具

本版包含修复提交 ca3e3f7，以及 1.2.1 的原生提醒请求修复。

DSH 宿主将 never 策略下的自动拒绝误报成“用户拒绝工具”。补丁会明确说明：审批弹窗已禁用，操作被自动拒绝，未询问用户，并保留原始审批原因。

**部署范围：**误报发生在 DSH 宿主。安装本版 computer-use 插件不会自动替换宿主代码；宿主补丁需单独部署。你原有的审批限制、取消和审计行为保持不变。

下载

• dsh-codex-style-computer-use-1.2.2.tgz：完整插件包，包含两份预编译原生组件及补丁工具。
• computer-use-approval-patch-1.2.2.zip：独立宿主补丁工具、说明及 14 项回归测试。解压后先读 README.md；工具默认只预览，指定输出路径才生成新文件。
• SHA256SUMS.txt：附件 SHA-256 校验值。

补丁工具适用于已验证的 DSH Desktop 0.2.1-rc.2 宿主模块，其他构建需重新核对源代码。

验证

• 14 项审批归因回归通过；ZIP 解压后的独立运行复验通过。
• 原有提醒、发布策略和插件包校验通过；TGZ 解压后原生 probe/raise/cleanup 往返验证通过。
• 本机修复曾通过当前宿主真实审批服务的内存会话验证，以及独立 Electron 加载验证。
• Windows CI 已纳入本次新增回归。

这是 GitHub 预发布。本次没有发布到 npm，也没有调整 npm 的 latest 或市场版本。

完整说明 · 宿主补丁用法

---

Includes the host approval-attribution patch utility and regression suite, plus the 1.2.1 native attention fix. Automatic refusals under disabled prompts identify their actual policy source. Host deployment is separate from plugin installation. This GitHub pre-release does not publish or promote an npm package.

Computer Use 1.2.1 — native attention fix (next)

Fixes issue #2: a missing node:crypto import caused every native attention probe/raise request in 1.2.0 to throw before reaching the helper. Version 1.2.1 adds the import and exercises real request/response round trips in the native guard and package smoke test.

Published npm version: dsh-codex-style-computer-use@1.2.1, tag next. The latest tag remains 1.2.0 while the fix goes through the release-age window. The 24-hour publisher threshold is 2026-10-04 07:01:20 UTC / 北京时间 15:01:20; moving latest requires the separate guarded promotion command after that time. This GitHub release is a prerelease and does not replace v1.2.0 as the latest release.

To explicitly install the fix now, enter dsh-codex-style-computer-use@1.2.1 in DSH Settings → Plugins → Add plugin. Strict release-age policies still apply. Existing 1.2.0 installations need an update for this runtime fix; reinstalling 1.2.0 does not apply it. Follow DSH's restart indication when replacing a loaded module.

Verified with the installed DSH Desktop 0.2.0-rc.2 manager, bundled Electron/Node and pnpm 11.7.0, and dshmarket 1.66.7 in isolated profiles: fresh npm 1.2.1 installation; reproduction of the error in published 1.2.0; upgrade to 1.2.1; native probe/raise/cleanup responses with unique IDs and matching native journal entries; empty-PATH/cold-cache helper and read-only screenshot smoke tests; all 18 tool schemas. The 16 existing attention event tests pass. The native request tests use an absent executable and do not raise real application windows.

Remaining host boundary: immediately re-adding the same new 1.2.1 version failed pnpm's lockfile cooling check with ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION even with automatic version exceptions present. The installed 1.2.1 remained selected. Same-version reinstallation during the cooling period is not claimed to work.

The npm archive was downloaded and matched byte-for-byte. Both attached archives contain the same 326,611-byte package. SHA-256: 458600caa5ccdccc6302366a6294c7381f4c4b5b699ab883f70debba63fb5828. Native C# sources and binaries are unchanged.

Validation · npm

Computer Use · Codex-style 1.2.0

npm package: dsh-codex-style-computer-use@1.2.0. Both tgz assets are the same verified runtime; native helpers are prebuilt and run outside node_modules. No PowerShell 7, SDK or install lifecycle scripts are required.

Distribution correction, 2026-10-03

Default non-strict pnpm 11.7.0 installs automatically and records a single-version exception. Only an explicit strict policy (minimumReleaseAgeStrict: true, or explicit minimumReleaseAge without an overriding false) blocks a too-young version without a matching exception. Under that strict policy, the bare name, an exact @1.2.0 pin and the npm tarball URL were all verified to fail. The previous default-policy tests automatically added a version exception and did not cover this case. A clean-cache test with explicit minimumReleaseAge: 1440 now reproduces all three refusals. An exception for only dsh-codex-style-computer-use@1.2.0 was verified to install successfully.

If a strict policy blocks installation, waiting keeps that policy unchanged. Version 1.2.0 reaches the 24-hour cutoff on 2026-10-04 03:50:12 UTC / 北京时间 11:50:12. Custom longer policies and registry mirror propagation still apply. The corrected installation guide gives the precise optional per-version exception. Future builds are to be published to next first; the new promotion command refuses to move latest before 24 hours. The npm runtime stays at 1.2.0, preserving its original publication clock.

Preserve old configuration

Changing the package name also requires migrating old id: computer-use override names in the target profile's cordis.patch.yml. Otherwise DSH skips the override, including read-only, dryRun and disabled-state settings. The attached computer-use-profile-migration.zip includes an explicit repair utility: extract and double-click migrate-profile.cmd after the new bundle is installed and the old one removed. It backs up and atomically updates only those name scalars. The official app-boot composition test verifies retained settings, and the launcher was tested with Windows PowerShell 5.1 and DSH's bundled Node. The utility does not change release-age policy.

New bundles can load live; verify that tools and the skill appear. Restart when replacing an already loaded version, when the client is stale or when the host reports restart-required.

Validation and publisher procedure · npm · market submission

Runtime tgz SHA-256 remains a764b42737f9bca18a2fb2f05a88a4045443fd5d609fbe82754dd705df31881e. Migration utility SHA-256: c5efcfbd5822ed82d33d7d868ccdd2fd837e51c91f1e1bbbede766d931041723.

Issue #1 follow-up

The publisher check now accepts CU_REGISTRY for a read-only mirror query and reports its registry provenance. Promotion always rechecks and writes the official npm registry. Live checks passed against npmmirror directly and npm origin through a proxy; failed requests report unknown readiness instead of implying an unpublished package. These are documentation and publisher-tool changes only; existing 1.2.0 users do not need to reinstall.

dsh-computer-use 1.2.0-rc.2

Physical input now yields control immediately. Continued input or a held key/button for 2 seconds enters automatic waiting; releasing all input and staying quiet for 3 seconds permits fresh observation and automatic continuation. A gentle pale-yellow edge gradient shows human ownership.

Only physical Ctrl+Esc triggers the persistent input pause. Ctrl+Alt+R resumes; Ctrl+Alt+Q exits. Interrupted writes are read back before continuing, and waiting uses local events without model polling. DSH Pet and original-topmost fixes are retained.

Validation: 36 public-tree guard scripts passed; 18 definitions loaded by the real DSH DSL; the final installed candidate passed 11 native operation checks and 5 cancellation/recovery checks. Physical mouse/hotkey events and three configured model routes were also tested with the scope documented in release verification. Model tests used a synthetic target.

Install the attached dsh-computer-use.tgz through DSH's plugin installer, then fully restart the host. This is a pre-release candidate. Runtime/config/skill files match the locally verified rc.2 installation; the public package corrects its two README files.

SHA-256: 9ed3d4bc151b6a239100d9c87925a180d3490b5d60e4e238f9fe61c70a641bf3

dsh-computer-use 1.1.0

1.1.0

Desktop tasks can now activate their tools per Agent, recover an observed UIA control after replacement with explicit unique-evidence checks, and request incremental observations while retaining complete snapshots.

• Idle Agents receive three activation/safety tools; active Agents receive the existing 18 controls plus the activation entry. Other Agents and children activate independently.
• Scoped name/id UIA queries issue target handles. Opt-in rebinding refuses ambiguous, changed-context or incomplete evidence. Broad queries avoid witness overhead by default.
• Explicit since bases produce lossless changes, including order. Each Agent retains 64 full observations, retrievable with snapshot. Missing or unsuitable bases return full output.
• Native screenshot transport, approval modes, cycle ownership and human brakes remain in place. Public installs keep the existing standard approval default.

Validation: 31 Windows guard scripts passed on the flattened release tree; the production DSH runtime/Node PTC compatibility checks cover Agent isolation and snapshot retrieval. Controlled native fixtures test successful recovery and zero extra button callbacks on refusals. Earlier model tests used the configured DeepSeek route; these are small controlled samples, not a claim of universal speed or reliability.

Requires Windows, Node.js >=22 and a DSH host providing scoped tool registration (including @deepseek-ai/dsh-scope). progressiveTools:false retains the original global tool surface on hosts providing those packages.

中文：新增按 Agent 加载工具、显式且唯一的 UIA 目标恢复、增量观察与完整快照取回。宽查询默认不生成恢复句柄，以控制额外开销；人为刹车、审批和控制会话归属仍然生效。

dsh-computer-use 1.0.0

Windows desktop computer use for DeepSeek Harness: 18 computer_* tools over a native C# worker compiled on first use, with Set-of-Marks grounding, UI Automation targeting, batched actions, four approval modes, a JSONL audit trail, and a human brake announced into the running session. See README.md for install, the tool list, the approval modes and the safety model. The attached tarball is the packaged plugin (lib, mcp, skills, cordis.patch.yml).