From 340f20ab533f867bce62542e6e19498a8ffddb3b Mon Sep 17 00:00:00 2001 From: Rahul Sethuram Date: Fri, 21 Aug 2026 13:41:38 +0400 Subject: [PATCH] Ask for the wheel by calling for it, not by asking in words MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Handing the browser over is a tool call. A sentence in the transcript is not one: nothing is offered, nobody can help, and the page stays where it is. The guidance said to call computer_request_help at a sign-in, which is true but not emphatic enough to beat the obvious-looking alternative, so Bots wrote "please sign in and let me know" and stopped. Worse, one went on to ask for a username and password to be typed into a sign-in page the person cannot see, which the prompt already forbids in the narrow form of telling the Bot a secret. So: calling it IS how you ask, the sentences that are not it are named, and the reason is given — the person is not looking at this page and cannot type into it until control is handed over. The tool description says the same thing, since that is what the model weighs when choosing. --- CHANGELOG.md | 8 ++++++++ app/src/lib/copilot/computer-tools.tsx | 5 ++++- shared/bot-prompt.ts | 8 +++++++- 3 files changed, 19 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 945ff421..eca56280 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -116,6 +116,14 @@ Sessions survive and nobody signs in again. laptop `http://localhost` counts as one, so this never showed up in development; on a real address it does not, and the surface did nothing at all when you pressed send. No message, no error. Ids now come from an API with no such restriction. +- **A Bot asked to be signed in, in words, and nothing happened.** Handing over the browser is a tool + call, and a sentence in the transcript is not one: "please sign in and let me know" leaves the + person with no wheel to take and the page where it was. Bots wrote that sentence anyway, and one + went further and asked for a username and password to be typed into a sign-in page nobody could + reach. The guidance now says that calling `computer_request_help` is what asking means, names the + sentences that are not it, and says the person cannot see the page at all until control is handed + over. Asked to file an issue on a site it was not signed in to, a Bot now offers the wheel on the + first attempt instead of the third. ### Changed diff --git a/app/src/lib/copilot/computer-tools.tsx b/app/src/lib/copilot/computer-tools.tsx index d72f35f9..1ebf426f 100644 --- a/app/src/lib/copilot/computer-tools.tsx +++ b/app/src/lib/copilot/computer-tools.tsx @@ -494,7 +494,10 @@ export function ComputerTools() { "Ask the person to take control of your computer and do something you cannot: sign in, enter a " + "password or a one-time code, or clear a CAPTCHA. Say specifically what you need done. They " + "will drive the browser themselves and hand it back, and you carry on in the same session. " + - "Use this INSTEAD of giving up, and instead of ever asking them to type a password to you.", + "Use this INSTEAD of giving up, and instead of ever asking them to type a password to you. " + + "This call is the only thing that reaches them: until you make it they are not looking at the " + + "page and have no way to help, so saying you need them to sign in, or asking whether they would " + + "like to proceed, hands over nothing and leaves the page where it is.", parameters: z.object({ reason: z .string() diff --git a/shared/bot-prompt.ts b/shared/bot-prompt.ts index 8e924902..0028f190 100644 --- a/shared/bot-prompt.ts +++ b/shared/bot-prompt.ts @@ -40,7 +40,13 @@ export const SYSTEM_PROMPT = [ "Some pages need a person: a sign-in, a password, a code sent to their phone, a CAPTCHA.", "When you hit one, call computer_request_help and say exactly what you need done. The person takes", "control of your browser, does that part, and hands it back, and you continue in the same session.", - "NEVER ask the person to tell you a password or a code. You do not need it and must not have it.", + "Calling it IS how you ask. Words in your answer are not: nobody is offered the wheel by a sentence,", + "and the page stays exactly where it is. So NEVER write 'please sign in and let me know', 'would you", + "like to proceed', or 'once you have signed in, tell me' instead of calling it. If you are about to", + "say the task needs somebody signed in, that sentence is the tool call: make it.", + "The person is not looking at this page and cannot type into it until you hand it over. NEVER ask", + "them to enter a username, a password or a code, neither into this conversation nor 'on the sign-in", + "page': you do not need it, must not have it, and they cannot reach the page anyway.", "When you need ONE value only, a password, a code, a card number, do not hand over the whole", "browser. Click the field first, then call computer_request_secret with that field's ref and a short", "label. They type it into a masked box that goes straight to the page and you never see it.",