From 6eb0aa17fb6c9cfc41723c9a3c4903a065a16824 Mon Sep 17 00:00:00 2001 From: Etienne Lescot Date: Fri, 14 Aug 2026 12:06:56 +0200 Subject: [PATCH 1/2] docs(testing): batch the computer-use grants so the operator can leave MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A full capture-to-export pass is dozens of computer-use actions and, once the grants are in place, not one of them prompts again. Verified across the 2026-08-14 run: four dialogs, all at unpredictable moments, then forty-odd uninterrupted actions. So what pins a human to the keyboard is not the grant model, it is that the requests arrive scattered through the run. One batched call at the start and the operator answers once and walks away; discovering a fourth app you need an hour in and they cannot. Names the two easy-to-forget ones: the desktop shell, because the tray is the only reliable route back to the HUD and the save dialogs live there too, and the OS settings app, because changing display scaling is how DPI checks get run at all. Also records why batching is the whole mitigation rather than a preference — there is no config to pre-approve any of it (claude-code#46907, closed stale), and bypassPermissions does not cover it (#43172). --- technical-documentation/testing/manual-e2e-checklist.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/technical-documentation/testing/manual-e2e-checklist.md b/technical-documentation/testing/manual-e2e-checklist.md index 7f5ea08d..57eee2d9 100644 --- a/technical-documentation/testing/manual-e2e-checklist.md +++ b/technical-documentation/testing/manual-e2e-checklist.md @@ -14,6 +14,13 @@ Sections marked **v1.8.0** cover what this release changed: chat-driven editing 2. The app is single-instance per `userData` path. If a leftover Electron/OpenScreen process still holds the lock, stop that process before relaunching; a second launch can exit successfully without opening a window. The lock is held by the OS and is released when the process dies, so there is nothing to delete on disk. 3. From a worktree, link or junction `node_modules` to the main checkout and provide the prebuilt native capture binaries for the platform before starting the dev build. **Date those binaries against the change you came to test.** Nothing rebuilds them, so an older helper runs the old code path in silence: the recording succeeds and the thing you were checking for is simply absent. See AGENTS.md for how to check one and how to rebuild it; when you cannot, test the CI-built artifact, because a dev build cannot answer a native question. 4. Grant computer-use access to the process name that actually owns the window: `electron.exe` or `Electron.app` for a dev build, and `Openscreen.exe` or `Openscreen.app` for a packaged build. Do not grant access only to the installed app name when testing a dev build — it resolves to the *installed* executable and reports success while the dev window stays masked. This is step 4 and not step 1 for a reason: a dev build is not an installed app, so the resolver cannot find it until it is running and owns a window, and one unresolvable name voids the whole request. + + **Ask for everything in ONE call, here, before anything else.** `request_access` takes a list, and once a grant is in place the rest of the pass runs without a single further prompt — a full capture-to-export run is dozens of clicks and none of them ask again. So the only thing keeping a human at the keyboard is *how many* dialogs you raise and *when*. Raise one, at the start, and the operator can walk away for the rest of the run; discover a fourth app you need an hour in and they cannot. Beyond the app under test, ask for: + + - the desktop shell (`Explorateur de fichiers` / Finder) — the tray icon and the native save dialogs live there, and the tray is the only reliable way back to the HUD; + - the OS settings app (`systemsettings.exe` / System Settings) — needed to change display scaling, which is how DPI checks are run (see AGENTS.md; "the machine is at 100%" is not a reason to skip them). + + There is no way to pre-approve any of this in config: the request has to be answered live. That is upstream ([claude-code#46907](https://github.com/anthropics/claude-code/issues/46907), closed stale), and `bypassPermissions` does not cover it either ([#43172](https://github.com/anthropics/claude-code/issues/43172)). Batching is the whole mitigation. 5. Read [AGENTS.md](../../AGENTS.md) for the computer-use mechanics, screenshot permissions, tray interaction, and cleanup procedure. Read one check, perform it, observe the result, then continue; close each modal or popover with `Esc` before the next check. 6. The recording HUD is protected from capture by default and is invisible in screenshots. For this session only, launch with `OPENSCREEN_DISABLE_CONTENT_PROTECTION=1`; this is the environment variable checked before `setContentProtection(true)`. Unset it before making any recording whose HUD must not appear in the video. 7. A preview screenshot is downscaled. Settle every pixel-level question by exporting a frame and measuring the exported frame, not by judging fine edges, corners, shadows, or alignment from the preview screenshot. From 60e3bda03c7c63c827bfa95ac4f4ece10eb6caa1 Mon Sep 17 00:00:00 2001 From: Etienne Lescot Date: Fri, 14 Aug 2026 12:57:29 +0200 Subject: [PATCH 2/2] docs(testing): fix the grant ordering, and name apps the way the resolver does MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two review findings, one valid and one that would have broken the recipe. Valid: "here, before anything else" contradicted the launch-first rule stated three lines above it. Now "after the launches above, before the first check", with the reason attached so nobody moves it back. Not valid: the suggestion to use `explorer.exe` instead of the localized label. Tested it — `explorer.exe` returns notInstalled and suggests "Windows Software Development Kit", while `Explorateur de fichiers` resolves to c:\windows\explorer.exe. The resolver matches Start-menu display names, not executables, so that change would have short-circuited the whole batch: exactly the failure this step warns about. The concern underneath it was real though — a localized label is machine-specific and this doc is not. So the step now says the names are display names in the system's language, gives both spellings for the shell, and says to ask rather than guess. --- technical-documentation/testing/manual-e2e-checklist.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/technical-documentation/testing/manual-e2e-checklist.md b/technical-documentation/testing/manual-e2e-checklist.md index 57eee2d9..e8b3020e 100644 --- a/technical-documentation/testing/manual-e2e-checklist.md +++ b/technical-documentation/testing/manual-e2e-checklist.md @@ -15,10 +15,12 @@ Sections marked **v1.8.0** cover what this release changed: chat-driven editing 3. From a worktree, link or junction `node_modules` to the main checkout and provide the prebuilt native capture binaries for the platform before starting the dev build. **Date those binaries against the change you came to test.** Nothing rebuilds them, so an older helper runs the old code path in silence: the recording succeeds and the thing you were checking for is simply absent. See AGENTS.md for how to check one and how to rebuild it; when you cannot, test the CI-built artifact, because a dev build cannot answer a native question. 4. Grant computer-use access to the process name that actually owns the window: `electron.exe` or `Electron.app` for a dev build, and `Openscreen.exe` or `Openscreen.app` for a packaged build. Do not grant access only to the installed app name when testing a dev build — it resolves to the *installed* executable and reports success while the dev window stays masked. This is step 4 and not step 1 for a reason: a dev build is not an installed app, so the resolver cannot find it until it is running and owns a window, and one unresolvable name voids the whole request. - **Ask for everything in ONE call, here, before anything else.** `request_access` takes a list, and once a grant is in place the rest of the pass runs without a single further prompt — a full capture-to-export run is dozens of clicks and none of them ask again. So the only thing keeping a human at the keyboard is *how many* dialogs you raise and *when*. Raise one, at the start, and the operator can walk away for the rest of the run; discover a fourth app you need an hour in and they cannot. Beyond the app under test, ask for: + **Ask for everything in ONE call — after the launches above, before the first check.** `request_access` takes a list, and once a grant is in place the rest of the pass runs without a single further prompt: a full capture-to-export run is dozens of clicks and none of them ask again. So the only thing keeping a human at the keyboard is *how many* dialogs you raise and *when*. Raise one, before the first check, and the operator can walk away for the rest of the run; discover a fourth app you need an hour in and they cannot. That is also why this cannot move earlier — the resolver needs the app running, and one unresolvable name voids the batch. Beyond the app under test, ask for: - - the desktop shell (`Explorateur de fichiers` / Finder) — the tray icon and the native save dialogs live there, and the tray is the only reliable way back to the HUD; - - the OS settings app (`systemsettings.exe` / System Settings) — needed to change display scaling, which is how DPI checks are run (see AGENTS.md; "the machine is at 100%" is not a reason to skip them). + - the desktop shell — the tray icon and the native save dialogs live there, and the tray is the only reliable way back to the HUD; + - the OS settings app — needed to change display scaling, which is how DPI checks are run (see AGENTS.md; "the machine is at 100%" is not a reason to skip them). + + **Name them the way the Start menu does, in the system's own language.** The resolver matches installed-app display names, not executables: on a French Windows the shell is `Explorateur de fichiers` and `explorer.exe` fails outright — `notInstalled`, with a nonsense suggestion attached — which then voids every other name in the same call. On an English install it is `File Explorer`. When unsure, ask rather than guess; the tool lists the installed names it knows. There is no way to pre-approve any of this in config: the request has to be answered live. That is upstream ([claude-code#46907](https://github.com/anthropics/claude-code/issues/46907), closed stale), and `bypassPermissions` does not cover it either ([#43172](https://github.com/anthropics/claude-code/issues/43172)). Batching is the whole mitigation. 5. Read [AGENTS.md](../../AGENTS.md) for the computer-use mechanics, screenshot permissions, tray interaction, and cleanup procedure. Read one check, perform it, observe the result, then continue; close each modal or popover with `Esc` before the next check.