@aibo204/dsh-plugin-computer-use

LIMITATIONS

Known limitations

- **The desktop is real and cannot roll back actions** — the plugin provides no VM, browser sandbox, domain allowlist, transaction awareness, or rollback. High-risk classification matches phrases in the latest accessibility snapshot; icon-only, misleading, uncovered-language, or dynamically changed controls can remain ambiguous and therefore use the unknown-activation policy. - **OS security surfaces remain inaccessible** — secure password fields, macOS authorization dialogs, Windows UAC secure desktop, locked sessions, remote desktops, and custom-rendered controls may not be observable or controllable. - **Element indexes are runtime-local and ephemeral** — a new Session, reconnect, app/window change, or fresh state capture can invalidate earlier indexes. The provider reports stale or unsupported operations; callers must recapture rather than guess. - **One preset instance serves one active desktop owner** — a second joined Session cannot use Computer Use until the owner Session is disposed. Deploy separate authored preset instances when multiple Sessions require concurrent desktop control. - **Cross-platform behavior follows the pinned upstream runtime** — DSH owns integration, approval, cleanup, and lifecycle, while platform capture and input defects must be fixed or upgraded in `open-computer-use`. - **Evidence can contain sensitive screen pixels** — the default archive captures recognized high-risk actions and stores its private copies locally. Set `archiveMode: off` to disable that archive; `automaticScreenshots` separately controls model-visible evidence for other actions. Attachment or image admission failure can still leave only a safe capture diagnostic.