List open windows: hwnd, title, process (the real application for UWP), position, foreground. by_app=true: grouped by application. Example: {"by_app": false}

GOLDEN RULE: look → act in one batch, targets by label; never resend a batch without looking. See a NAMED window (hwnd: number, title or process) WITHOUT bringing it to the front (covered ones too): one line per element "[N] role "name" = "value" states @x,y"; image (WebP ≤ 2000 px) only if the tree is too thin, or with capture_screenshot=true, annotate (numbers drawn) or zoom=box_2d (area enlarged); query filters; format="json": compact JSON (box_2d 0-1000 per element). Same screen as the last image sent: not attached again. Unlocks a batch. Example: {"hwnd": "Notepad", "query": "save"}

Act in ONE batch, in the background, on a NAMED window (hwnd), without reading the code: shared token, emergency stop and the user's pause are handled here. Actions: click, double_click, right_click, type, set, clear, check, uncheck, select (option), expand, collapse, menu (path), key, scroll, drag, hover, wait (seconds, text), focus. Target: target="Exact label", "#N", box_2d or x/y; ambiguous label refused. Steps ✓ = ~ ✗, status = the worst; follow next. Batch stopped on ~ or ✗, nothing more sent and no replay; look before resuming after an unknown outcome. Outward actions (paying, sending, publishing, transferring, and the Enter key that would trigger them): confirm: true AND accord: "<token>" (on the step or as a parameter), returned by the first refusal that describes the exact action. Local destruction (permanent deletion, uninstalling, formatting, resetting): confirm: true alone. The user's explicit order = confirmation; your own initiative = ask first. Same batch without a look: refused. foreground=True: real mouse/keyboard as a fallback only. Example: {"hwnd": "Order", "steps": [{"action": "set", "target": "Name", "text": "Alice"}, {"action": "check", "target": "Accept"}, {"action": "click", "target": "Submit"}]}

Open an application (name such as "notepad.exe", or path), a folder or a document, like a double-click; the opening is read back. Settings page: app="ms-settings:display" (opened behind the user's window, read back). Refused: web addresses http, https, ftp (web pages: nexus-browser). args: arguments of a .exe program (a file to open…), never for a document, a folder or an address; also accepted after the program in app, a path with spaces is never split. Chromium/Electron apps: files only, never a switch. Example: {"app": "notepad.exe", "args": "C:\Dev\notes.txt"}

Manage a NAMED window (hwnd: number, title or process). action="close": close it cleanly (UI Automation, then WM_CLOSE), the closing is read back; a "Save?" prompt, if any, is reported, never answered. Example: {"action": "close", "hwnd": 123456}