# Native computer visuals `/computer-settings` controls human-only presentation on the machine that executes computer use. Native visuals require a driver advertising both `set_agent_visuals` and `present_agent_activity`. The adapter uses that driver's renderer and theme. It starts no viewer, HTTP listener or separate overlay process. A driver without these capabilities keeps the legacy cursor behavior described in [complete input](complete-input.md). A version number alone does not enable native presentation. ## Human controls Open `/computer-settings` to view the current settings and choose a visual preset: - `off` disables presentation and discards pending previews. - `subtle` keeps activity cues and disables previews by default. - `full` enables previews by default. The panel also controls individual categories, opacity, quality and reduced motion. Action cards show available key combinations and pointer details. Printable keys are shown only when a native observation identifies a non-password focused element; otherwise they are omitted unless part of a non-text shortcut. `keyboard` and `typed_text` must both be on for keyboard details and typed text. Text going into a field that UI Automation reports as a password is never sent to the renderer. Pointer and scroll details follow their respective visual settings. Control characters show as spaces, and only the last 200 characters are sent. `opacity` is 0..1. `quality` is `performance`, `balanced` or `high`. Scoped visual preferences override older session-branch preferences. Where no scoped value exists, navigating to another branch restores that branch's preference. Visual settings do not change Safe/YOLO, capture sizing, input delivery or permission checks. The panel controls screenshot size, scale, hints and guides for future captures. Resetting them clears overrides in the selected scope. An individual Read can still override its capture options. Existing images keep their bytes. ## What a cue means The agent cursor carries a label: the Pi session's name, or the project folder's name while the session has none. The adapter passes it to the driver process as `CUA_SESSION_LABEL` when the process starts; renaming the session takes effect with the next driver process. A card stays on screen until the next card replaces it, so consecutive actions do not blink. A card that nothing replaces stays about two seconds and fades out over 500 ms. A clear, a settings change or the end of the session hides it at once. An overview identifies a captured window or display. A detail cue marks a requested physical region only when the adapter has a proven transform. Inspection and browser cues associate the operation with its native window; a Playwright CSS box does not establish a desktop rectangle. Element inspection uses native element bounds when available. Action cues can report `delivered`, `refused` or `unknown`. `delivered` means input was sent, not that the application changed. Only a completed condition check can report `verified`. Quiet verification samples and background watch frames do not each create another cue. Optional previews use a final PNG/JPEG returned by the operation, after cropping, resizing and annotation. A `changes` Read previews a returned change crop. A selected-frame batch admits at most its last returned image; a contact sheet or composite admits its final image. Capturing a sequence without returning images produces no preview. No extra capture or inference runs for presentation. A preview does not establish that arbitrary Codemode forwarded that image or that a remote model received it. [Normal Pi image context](image-context.md) owns image retention and provider boundaries. Preview images are not archived or written to disk by presentation. ## Safety contract Native presentation must be input-transparent, non-activating and protected from capture. It must not move the operating system cursor merely to animate. Input execution and visual playback have separate clocks: rendering and visual travel must not delay dispatch, while intentional typing, drag and system input timing stays intact. Window events carry the existing HWND/PID lifetime identity and physical source bounds. The native renderer must revalidate them and hide stale drawings after movement, resize, minimize, closure or handle reuse. Selected displays use their exact native monitor bounds, including negative desktop origins. Ambiguous geometry never becomes a guessed rectangle or point. The adapter admits one native request at a time and retains one replaceable pending activity. Pending activity expires after 250 ms; preview transport accepts only bounded PNG/JPEG payloads. Cancellation and mode changes revoke older generations. A cancellation of an old operation cannot clear a newer one. Capture companions disable their own presentation. `highlight.status: queued` records adapter admission, not proof that a person saw pixels. An unavailable renderer does not repeat capture or input. Failed or cancelled startup releases the connection while keeping presentation preferences subscribed for a later attempt. Final session shutdown disposes those subscriptions. Backend refusal and capture exclusion still need qualification on the exact Windows runtime; the adapter alone cannot prove focus, transparency, screenshot exclusion or visual quality. ## Browser screenshots without a flash A visible Chromium window shrinks for a moment while Chrome takes a screenshot with a clip or scale of its own, so the human would see a flash on every element crop and every page action's pixel comparison. The browser worker therefore takes one plain viewport screenshot, which does not move the window, and the host derives the image from it: an element crop is cut from it at the element's pixels, and the page image used by the change list is scaled to one pixel per CSS pixel (exactly `innerWidth` x `innerHeight`). The image the agent gets and its coordinates stay the same; an element crop is the same size as Chrome's own, and its pixels match except for slight resampling at fractional device pixels. The worker falls back to Chrome's own screenshot, which can flash, when the derived image would not be exact: an element that is not wholly inside the viewport (for example taller than the window), a pinch-zoomed page, or a page that scrolls or resizes during the capture. In testing Firefox showed no flash with this path. ## Runtime qualification Use the exact source and file hashes in [the runtime pins](bundled-runtime.md). Before shipping a native visual runtime, check a real Windows desktop for focus and hit testing, capture exclusion, source changes, multi-monitor geometry, concurrent sessions, reduced motion, cancellation and cleanup. Measure input latency independently of animation and bound idle/active resource use. Keep private desktop recordings in ignored local artifacts.