53 lines
2.8 KiB
Markdown
53 lines
2.8 KiB
Markdown
|
# Human takeover and progress messages
|
||
|
|
|
||
|
|
## Implemented
|
||
|
|
|
||
|
|
- Opening acknowledgements and results remain chat messages. Routine updates use
|
||
|
|
`report_progress`, which emits `user_progress` and replaces the current status
|
||
|
|
text. Progress is not a final answer and is omitted from the saved transcript.
|
||
|
|
- Raw model scratchpad and tool statuses do not become conversational progress.
|
||
|
|
A collapsed execution-details panel contains only tool names and completion
|
||
|
|
status, not arguments, model scratchpad or captured credentials.
|
||
|
|
- `browser_handoff` and `request_box_help` create an identified question. The UI
|
||
|
|
automatically embeds the existing shared desktop in the conversation. It does
|
||
|
|
not move Cloudflare widgets or create a different login session.
|
||
|
|
- The shared viewer appears once, can be expanded, and does not expose restart/
|
||
|
|
update controls during takeover. The ordinary message composer is disabled
|
||
|
|
during takeover; passwords and verification codes are entered on the original
|
||
|
|
website, not in chat.
|
||
|
|
- The human presses Done to return control. The authenticated endpoint accepts
|
||
|
|
only task ID, question ID and an enumerated done/cancel action. Completion is
|
||
|
|
delivered directly to the original worker without a coordinator model round.
|
||
|
|
Owner, pending question and task status are checked; duplicate submissions are
|
||
|
|
idempotent. Cancel affects only that task and its children.
|
||
|
|
- Waiting tasks retain their tool context/browser session. New AI desktop,
|
||
|
|
browser and external-execution requests are rejected while a human holds the
|
||
|
|
shared computer. Other public research can continue.
|
||
|
|
- Hand-back is a request to inspect the original page, not proof of login success.
|
||
|
|
Bounded research permits one verification read after hand-back even when its
|
||
|
|
collection limit has been reached.
|
||
|
|
|
||
|
|
## Security boundary and deferred integrations
|
||
|
|
|
||
|
|
This version deliberately uses the original website in the embedded desktop.
|
||
|
|
It does **not** provide a separate password/OTP text field or independent CAPTCHA
|
||
|
|
image relay, and does not claim that AI can never observe credentials. Existing
|
||
|
|
in-flight operations and privileged host access are not a cryptographic
|
||
|
|
isolation boundary.
|
||
|
|
|
||
|
|
A future secret-input broker needs separate authorization, destination binding,
|
||
|
|
protected browser observation, disabled sensitive logging, expiration and
|
||
|
|
end-to-end tests before displaying a "not sent to AI" claim. Installing 1Password
|
||
|
|
alone does not establish that boundary. No password manager or vault connection
|
||
|
|
is installed by this change.
|
||
|
|
|
||
|
|
## Verification
|
||
|
|
|
||
|
|
- `cargo test --workspace`
|
||
|
|
- `npm --prefix web run build`
|
||
|
|
- With local Vite running: `node tests/handover_ui.mjs`
|
||
|
|
|
||
|
|
The browser test uses an isolated profile, mocked API and fake credential. It
|
||
|
|
checks automatic takeover, one viewer, paused animation, direct task hand-back,
|
||
|
|
and that credentials/raw scratchpad are not sent as ordinary chat messages.
|