Desktop capture and input injection commands now always ask

Shell commands that capture your screen or type into other apps now stop for confirmation on every policy, including Never ask. The release also makes engine extension search understand plain words, gives refused tool calls a usable error, and steadies voice typing.

Featured

Always-ask guard for desktop capture and input injection

A shell command that captures your desktop or injects input now prompts before it runs, on Windows, macOS and Linux, and the prompt states what it would do in plain words. This is the single exception to Never ask: it asks under every policy, plan mode refuses it, and unattended command-line runs refuse it rather than auto-approving. Every chat's agent is also told not to capture the desktop or drive other apps on its own. (#1298)

Improved

Engine extension search understands plain words

Searching for tools now matches the words people actually type, so a query about foliage scattering finds the PCG Tools extension instead of returning nothing. Matching happens in the app, so every extension source benefits without waiting for an extension release. Related words only count alongside another term, so a search for tree does not fire on behavior tree. (#1304)

Voice typing keeps your key order

Space is now typed when it goes down, so fast typing no longer swaps letters between words and slash commands keep their spaces. Ctrl+G starts and stops dictation on both desktop and command line, and a new setting turns the hold-Space gesture off if you prefer. The composer stays read-only during a desktop take so live partial text does not fight what you type. (#1306)

Refused tool calls now say what to fix

When an agent calls a tool with a wrong or missing argument, the refusal names the argument, lists the declared ones, and for a misspelled tool lists what is available. The agent can correct itself on the next call instead of burning turns on guesses. Argument values are never echoed back, only names. (#1309)

Fixed

Timing races in voice recording and daemon handshakes

A push-to-talk take that stopped right after starting could lose its transcript; activation now happens as recording begins. A daemon handshake frame that arrived before the listener was ready was dropped and broke the connection, so early frames are now held until something reads them. (#1310)

Clock changes and failed starts no longer stall media and daemons

A system clock stepping backwards could refuse a fresh media deployment or leave a compact-before-send timer waiting with nothing to re-arm it; elapsed time now clamps at zero and the timer rereads the clock. A native process that fails to start now rejects immediately instead of hanging its stop barrier. (#1312)

Under the hood

• docs(agent-lab): iterations 14-16 — catalog 100%, GAS 100%, Landscape + PCG island 83% (#1303)
• docs(agent-lab): iterations 17-18 — Niagara 67%, Control Rig 92% (#1305)
• docs(agent-lab): iterations 19-20 — island 92%, Enhanced Input 100%; Niagara Fluids task (#1307)
• docs(agent-lab): iteration 21 — Niagara Fluids smoke plume 92% (#1308)
• test: version-bump guard tests copy one base repo instead of rebuilding it (#1311)