feat(windows): add native maka.cu/2 executor

[sunheyi6]

Summary

• Enforce the shared maka.cu/2 snapshot, image, response-size, cancellation, and shutdown boundaries.
• Make the Windows executor strictly background-only at its public mutation boundary: advertise and accept only semantic UIA click and set_value; unconditionally refuse keyboard, point, launch, scroll, text-selection, and secondary actions.
• Remove foreground/global input and process-launch implementations, including SetForegroundWindow, SetFocus, SendInput, and the obsolete scroll readback subsystem.
• Refuse mutation when the target is foreground and monitor the full action window for foreground HWND/PID, physical-pointer, or clipboard changes. Any detected interference changes the result to unknown, and unknown mutations are not retried.
• Initialize Per-Monitor-V2 DPI awareness before worker creation and report measured window/monitor scale factors.
• Build the Windows artifact for explicit x86_64-pc-windows-msvc with static CRT linkage. distributionReady remains false until the exact signed artifact passes clean-machine, mixed-DPI, concurrent-user, and packaged conversation E2E.

Why browser automation is excluded

Browser workflows belong to Maka Browser Use/OpenCLI. That layer has browser-native DOM/accessibility, tab, navigation, page lifecycle, and command state, which are more reliable than treating a browser as an opaque desktop window. Duplicating browser control here would widen permissions and test scope and would create pressure to add coordinate/global-input fallbacks that violate the non-interference contract. This executor is intentionally for native desktop applications only.

Validation

• cargo fmt -- --check
• cargo test --locked --all-targets — 14 passed
• cargo clippy --locked --all-targets -- -D warnings
• cargo build --locked --release --target x86_64-pc-windows-msvc
• Real stdio handshake: elementActions=click,set_value, empty point/key capabilities; launch returns unsupported_action
• Static import inspection: no dynamic Visual C++ or Universal CRT runtime DLL

Interactive concurrent-user/mixed-DPI packaged E2E and Authenticode qualification remain release blockers, so this PR does not claim distribution readiness.

中文说明

摘要

• 完整落实 maka.cu/2 的 snapshot、图片、响应大小、取消和关闭边界。
• Windows 执行器在公开修改入口严格只允许后台语义操作：仅声明并接受 UIA click 和 set_value；键盘、点位、启动应用、滚动、文本选择和次级操作一律明确拒绝。
• 删除前台/全局输入及进程启动实现，包括 SetForegroundWindow、SetFocus、SendInput 和已无用途的滚动读回子系统。
• 目标位于前台时拒绝修改，并在整个操作窗口监测前台 HWND/PID、物理指针和剪贴板变化；检测到干扰就返回 unknown，且不会自动重试。
• 在创建工作线程前启用 Per-Monitor-V2 DPI 感知，并报告实测窗口/显示器缩放。
• 使用明确的 x86_64-pc-windows-msvc 目标和静态 CRT 构建。只有同一份已签名 artifact 通过 clean-machine、混合 DPI、并发用户和 packaged conversation E2E 后，才能开启 distributionReady。

为什么排除浏览器

浏览器流程由 Maka Browser Use/OpenCLI 负责。该层能直接使用 DOM/可访问性树、标签页、导航、页面生命周期和浏览器命令状态，比把浏览器当作不透明桌面窗口更可靠。若在本执行器重复实现浏览器控制，会扩大权限和测试范围，也会诱导加入坐标或全局输入兜底，破坏“不干扰用户”的约束。因此本执行器只面向原生桌面应用。

验证

• Rust 格式、14 项测试、严格 Clippy 和明确 Windows target 的 release 构建均通过。
• 真实 stdio 握手只声明 click,set_value，点位/键盘能力为空；启动应用返回 unsupported_action。
• 静态导入检查未发现动态 Visual C++ 或 Universal CRT 运行库依赖。

并发用户/混合 DPI 的 packaged E2E 和 Authenticode 资格验证仍是发布阻断项，所以本 PR 不宣称可分发。

[hqhq1025]

Review of d722afda8517cd3f7557b895b2603cb6087c4278

This is the correct architectural direction: a Windows direct-COM executor behind the existing maka.cu/2 protocol, with no second model-facing schema or supervisor. The current revision is not merge-ready yet.

Blocking findings:

1. The advertised snapshot/image lifecycle is not implemented. The handshake promises a 120-second snapshot TTL and a 256 MiB image-directory budget, but snapshots have no timestamp, no expiry/eviction path exists, and image files are not tracked or deleted when a snapshot is spent, superseded, expired, evicted, or released by session.end. After 64 unspent observations the executor permanently returns snapshot_registry_full, and image files accumulate until the host restarts. This violates the shared protocol's resource and stale-image guarantees.
2. limits.maxResponseBytes is advertised as 6 MiB while the shared maka.cu/2 contract fixes this limit at 1 MiB. The implementation also replaces an oversized response with an RPC error instead of reducing/truncating the observation to the declared bound. Please use the shared 1 MiB limit and add conformance coverage for bounded observations.
3. The stated local validation is not reproducible on this revision: cargo test --all-targets passes 7 tests, not 8, and cargo clippy --all-targets -- -D warnings fails on the current checkout. This repository currently has no GitHub checks for the PR. Please make fmt/clippy/test green on both the normal Windows build and the non-Windows CI analysis target, then add the checks as an actual merge gate.

The implementation is otherwise aligned with the agreed boundary: semantic element actions use UIA patterns, keyboard dispatch is observation/focus-bound, and dispatch.point is fail-closed. I recommend fixing the lifecycle contract first, then rerunning the real Windows matrix against the new head.

Production code that can be removed or simplified: the #[cfg(test)] compatibility authorization/input subsystem is historical experiment code and does not exercise the production maka.cu/2 path. Move any useful vectors into protocol tests and delete the inactive production-file implementation.

Test quality: keep lifecycle and real-application tests, but make the authoritative tests run against this repository revision and report the exact head/artifact digest. Current downstream reports alone cannot replace repository CI.

Verdict: not ready to merge. A deeper architectural rewrite is not required; focused lifecycle/resource accounting, protocol-limit conformance, test cleanup, and CI are required.

[hqhq1025]

Re-review of 47972926c8c938f4ccaa6563d8241849d1d161a1

The revision makes substantial progress on the previous findings: it adds explicit live/spent/superseded/expired/evicted states, 120-second cleanup, eight-live-snapshot enforcement, image accounting, the 1 MiB advertised limit, focused lifecycle tests, removal of the compatibility experiment, and a CI workflow. The current revision is still not merge-ready.

Blocking findings:

1. Snapshot IDs are still deterministic process-local counters (s000...) and contain no 128-bit per-process nonce. A restarted executor will mint the same IDs again, so a stale request from the previous generation can resolve to a fresh snapshot instead of returning snapshot_unknown. This violates the explicit restart-isolation requirement in HOST_PROTOCOL.md section 4.1.
2. Terminal snapshots retain their full elements maps indefinitely until session.end. The eight-snapshot limit counts only live entries, so a long session can accumulate an unbounded number of spent, superseded, expired, and evicted snapshots, each retaining up to 512 element records. Keep only compact, bounded tombstones for terminal error classification and release the heavy snapshot payload immediately.
3. Oversized responses are made to fit by recursively truncating every JSON string and then dropping elements/tree nodes. The protocol requires retrying observation with a reduced maxElements and, if it still does not fit, returning response_too_large with {bytes, limit}; it explicitly says fields must not be dropped to fit. The current transformation can also change element text after its digest was computed and does not mark each changed field in element.truncated, so the returned snapshot is not a faithful dispatch authority.
4. The new merge gate is not green on this exact head. I reran cargo clippy --locked --all-targets --manifest-path apps/OpenComputerUseWindows/native/Cargo.toml -- -D warnings on the Linux analysis target and it fails with 16 errors (unused Once, Windows-only constants and fields, readback symbols, and the non-Windows worker stub). GitHub currently reports no checks for this fork head, while the README and execution plan claim clippy passed. cargo fmt --check, cargo test (10/10), and the release build do pass locally.

The previous lifecycle/image-leak and 6 MiB declaration findings are directionally addressed. The architecture remains appropriate: one shared maka.cu/2 contract and a native Windows executor, with no new model-facing schema. No deeper product-side rewrite is required, but the executor still needs protocol-conformant response generation, bounded tombstones, nonce-based IDs, and a genuinely green Windows/Linux gate.

Recommended next revision:

• Add one random 128-bit generation nonce at process startup and include it in every snapshot ID; add a two-generation collision test.
• Split live snapshot payloads from compact terminal tombstones and bound/prune both explicitly.
• Enforce the response budget while constructing/retrying the observation, preserving the protocol's truncation semantics and exact digests.
• Fix cfg scoping/dead-code warnings, make the fork workflow run on the PR head, and attach the exact Windows artifact digest.

Verdict: not ready to merge. After these focused fixes and a green exact-head Windows/Linux run, the next review can move to real Windows application and packaged Maka qualification.

[sunheyi6]

Codex-assisted implementation review, posted on behalf of @sunheyi6. The native executor should implement the background-only desktop contract documented in apache/maka#3785: no successful action may take over the user's foreground window, global keyboard, physical pointer, or clipboard. Browser automation is routed to Browser Use/OpenCLI, where browser-native page/DOM/accessibility state and commands provide more reliable targeting and verification. Duplicating it in this helper would expand permissions and tests and encourage coordinate/global-input fallbacks that conflict with the background-only guarantee. This is a separation of responsibilities, not removal of browser support.

The current PR should not be treated as distribution-ready yet because several advertised/implemented paths violate or cannot prove that contract:

1. The keyed element input path calls SetForegroundWindow and does not restore or verify the previous foreground window. Remove this path; do not turn restoration into a success condition.
2. The handshake advertises key, while SendInput is global and its destination/effect cannot be safely bound to the background target. Disable keyboard capabilities and return typed unsupported until a verified background adapter exists. type should remain unadvertised as well.
3. Generic process launch may allow a launched app to take foreground. Disable generic launch for the strict background profile until a non-activation contract can be enforced and verified; already-running, explicitly selected windows are sufficient for v1.
4. Add Per-Monitor-V2 DPI awareness and per-window DPI handling. The current fixed scale/scaleFactor = 1.0 cannot establish correct UIA/capture coordinate mapping on scaled or mixed-DPI displays.
5. Do not describe the release binary as having no native dependencies without proving it. The reviewed MSVC release artifact imports VCRUNTIME140.dll and Universal CRT API-set DLLs. Either build a truly self-contained/static artifact where intended, or declare, ship, and verify every required runtime dependency.

Recommended v1 advertised surface:

• UIA observation and bounded snapshot-bound element tokens;
• WGC target-window capture;
• read-only app/window/tree/text operations;
• click_element only via supported semantic UIA patterns;
• set_value only via ValuePattern.SetValue with readback;
• keyActions: [], pointActions: [], no generic launch, and typed refusal for everything else.

Required concurrency test: keep a user typing in foreground Notepad while the executor manipulates a different background Notepad/Calculator/WPF fixture. Assert that foreground HWND/PID, mouse position, clipboard, and every user keystroke remain with the foreground app. The background action must be verified or return a typed refusal/unknown result, and an unknown outcome must not be blindly retried.

After the safe semantic slice passes, background text support can be added through an explicit ladder: ValuePattern.SetValue → verified control-specific background APIs/messages → app-specific automation API → unsupported. Never fall through to SetForegroundWindow, SetFocus, global SendInput, clipboard substitution, or physical cursor movement.

Ablation conclusion

The foreground/global compatibility-input paths are not required for the stated product goal and should be removed from the advertised surface. The existing snapshot lifecycle, UIA semantic operations, WGC capture, and supervised helper are the useful core; adding another mode or fallback layer would weaken the guarantee without being necessary for the browser use case.

中文说明

这是一条由 Codex 协助、代表 @sunheyi6 发布的实现审查说明。原生执行器应落实 apache/maka#3785 中的严格后台桌面合同：任何被报告为成功的动作都不能抢占用户前台窗口、全局键盘、物理鼠标或剪贴板。浏览器自动化路由给 Browser Use/OpenCLI，因为浏览器原生的页面/DOM/无障碍状态和命令能提供更可靠的定位与结果验证。在本 helper 中重复实现会扩大权限与测试范围，并诱导加入与严格后台保证冲突的坐标/全局输入 fallback。这是职责分离，不是取消浏览器支持。

当前 PR 还不能视为可分发，因为以下已实现或已声明的路径违反了、或无法证明满足该合同：

1. 元素按键输入路径调用 SetForegroundWindow，且没有恢复或验证之前的前台窗口。应删除该路径；恢复前台也不能作为操作成功的依据。
2. 握手声明了 key，但 SendInput 是全局输入，无法安全地把目标和效果绑定到后台窗口。应暂时关闭 keyboard 能力并返回明确的 unsupported；type 也继续不声明，直到存在可验证的后台适配器。
3. 通用进程启动可能让新应用获得前台。严格后台配置下应暂时关闭通用启动；v1 只操作用户明确选择、已经运行的窗口即可。
4. 增加 Per-Monitor-V2 DPI awareness 和每窗口 DPI 处理。当前固定的 scale/scaleFactor = 1.0 无法保证缩放或混合 DPI 屏幕上的 UIA/截图坐标一致。
5. 在证明前不要把发布二进制描述成无原生依赖。审查的 MSVC release 产物会导入 VCRUNTIME140.dll 和 Universal CRT API-set DLL。应构建真正自包含/静态的产物，或者声明、携带并验证每一项运行时依赖。

建议 v1 只声明以下能力：

• UIA 观察，以及绑定 snapshot 的有限元素 token；
• WGC 目标窗口截图；
• 只读的应用/窗口/控件树/文本操作；
• 只有支持相应 UIA 语义模式时才开放 click_element；
• 只有通过 ValuePattern.SetValue 且能回读验证时才开放 set_value；
• keyActions: []、pointActions: []、无通用启动，其余动作全部返回明确拒绝。

必须增加并发验收：用户持续在前台 Notepad 打字，同时执行器操作另一个后台 Notepad/Calculator/WPF fixture。断言前台 HWND/PID、鼠标位置、剪贴板以及用户每一个按键都保持在前台应用。后台动作必须得到验证，或返回明确的拒绝/未知结果；结果未知时不得盲目重试。

安全语义切片通过后，再按明确阶梯增加后台文本能力：ValuePattern.SetValue → 可验证的控件专用后台接口/消息 → 应用专用自动化 API → unsupported。绝不降级到 SetForegroundWindow、SetFocus、全局 SendInput、剪贴板替换或物理鼠标移动。

消融结论

前台/全局兼容输入路径不是当前产品目标所必需的，应从声明能力中移除。现有 snapshot 生命周期、UIA 语义操作、WGC 截图和受监管 helper 才是有用核心；增加另一种模式或 fallback 层会削弱保证，而且浏览器场景并不需要它。