diff --git a/website/docs/user-guide/features/computer-use.md b/website/docs/user-guide/features/computer-use.md index 223004263d9..e8b00968b74 100644 --- a/website/docs/user-guide/features/computer-use.md +++ b/website/docs/user-guide/features/computer-use.md @@ -255,6 +255,19 @@ of screenshot context, not ~600K. drawing (Logic, Final Cut, some games) have sparse or empty AX trees. Fall back to pixel coordinates if the tree is empty — or skip the task entirely. +- **Windows: elevated (admin) windows can't be driven from a normal + agent.** Windows UIPI (User Interface Privilege Isolation) enforces + integrity-level boundaries: a Medium-integrity process (the default + Hermes agent) cannot enumerate the UIA tree of, or inject mouse input + into, a window owned by a High-integrity (Administrator) process. + Symptom: `capture(mode='som')` returns 0 elements and `click(...)` + reports success while doing nothing, even though the screenshot + renders fine (GDI capture sits below the integrity check). Keyboard + events partially bypass UIPI, so Tab / Enter can still navigate an + elevated dialog. This is an OS constraint, not a cua-driver bug — it + affects every Windows automation stack. To drive elevated windows, + run the Hermes agent itself at High integrity (launch from an + elevated terminal); otherwise target non-elevated windows. - **Platform-specific deployment gotchas:** - **macOS** uses private SkyLight SPIs. Apple can change them in any OS update. Hermes warns when the installed cua-driver is older than