SOLIDWORKS Bridge

Measured 2026-10-12: ten days after a launch, with SOLIDWORKS not running, swx_status.launch still said up and COM-attached. The record is now checked against live processes (pid plus creation time) and reports stage ended, endedWhy and honest advice. The skills say where signInWindow lives (top level of swx_status, beside waitingOn).

ab hands a saved password only to a local caller, never to a bridge or over the relay, and a cloud agent may not start that local caller either (both measured 2026-10-12). The page now ships tools/local-sign-in.ps1: run on the PC, it asks the vault behind ab's consent card, sets the password into the login window, ticks Remember me, clicks Log in and verifies. The sign-in skill says exactly who may touch the password. Docs and a tool; no runtime change.

Measured 2026-10-12 on the updater-hosted window: 0.9.25 called page 2 page 1, tried to set the prefilled read-only user name, blamed the refusal on a 'Manage cookies' link it took for a banner, toasted the user, and never asked for the password. Now a page with the password edit is page 2; a name holding text is left alone and a read-only refusal means prefilled; cookieBanner means accept/reject buttons only and a failed set is never banner evidence; Remember me is toggled in the background and reported from its read-back. 561 tests.

Measured 2026-10-12: ab refuses pup_credential_reveal to a bridge ('requires a VERIFIED local transport ... origin "bridge"') - ab policy, never worked around. swx_sign_in now fills the user name (from pup_credentials' host list, no secret) and presses Continue BEFORE asking for the password; a refused reveal is sign_in_vault_policy with abSaid, pagePrepared {page, userNameFilled} and waysOut (the user types the password; ab issue #237 for a fill verb that keeps the secret inside ab). Asked once, never retried. Status and Visualize hints say the same. 560 tests.

Measured live: pup verbs reply error:"" on success and the bridge read any non-null error as a failure, so swx_sign_in reported the vault unavailable with an empty message. An error is now a non-empty string or success:false/ok:false. One line; nothing else changed.

Measured 2026-10-12: the platform updater SWXDesktopUpdate.exe showed the 3DEXPERIENCE ID login in a window titled just '3DEXPERIENCE'; the bridge saw nothing and refused it when named. Now: SWXDesktopUpdate.exe is in the census; a login is recognised by content (an Edit 'Email or username' or 'Password' found by desktop_find_control), title/class stay the fast path; swx_sign_in window: is probed by content and never refused on census grounds (sign_in_window_not_a_login with what was found); when the tree holds only the frame, controls are located by find_control (automation id first, never a role alone) and fields are cleared then set; swx_status and swx_start (both apps) report waitingOn userSignIn with signInWindow {hwnd,title,ownerImage,host:desktopUpdate} (signInWindow is now an object), and a Visualize start parked behind it says stage waitingOn instead of launching. 558 tests.

Docs only: the public solidworks-bridge skill's everyday flow now covers rendering (swx_render_image recipe, zoomFactor), SOLIDWORKS Visualize (swx_start {app:visualize}; the first-run content-folder dialog is the user's), pulling exports back with pull_file, and keeping the bridge current with refresh_bridges. No runtime change.

Docs only: the solidworks-sign-in skill records that Visualize, started through its platform shortcut while the Launcher holds the session, raises no login (measured 2026-10-05); the separate login seen on 10-02 came from starting its exe directly, which this edition refuses. No runtime change.

Every render set is read back: a setting SOLIDWORKS accepts and leaves unchanged (RealView on an uncertified GPU, measured 2026-10-05) is why:setIgnored, changed:false, restored:null, never in appliedSettings, and the reply's notes[] says so; no machine-wide workaround. zoomFactor measured: >1 zooms in; 1.4-1.6 after a fit (2.0 clipped the Moveo). swconst ids recorded on 2026 SP3: AO 485, shadows 131. swx_status.visualize reads the real WPF first-run dialog (measured) and reports the top-level hwnd whenever the HwndWrapper main window exists; prefilledPath reported as UIA gave it. 553 tests.

0.9.19. swx_render_image is MEASURED live (2026-10-05, the 110-document Moveo assembly, window minimized): 3840x2160 in 11.6 s, 1080p in 10.4 s, every setting restored. It now accounts for every requested setting (settings: {requested, before, after, changed, restored, why}), takes zoomFactor to frame an assembly after a fit, and reports the swconst ids it read. swx_start {app:"visualize"} starts SOLIDWORKS Visualize through its platform shortcut (this edition refuses a direct start — measured) and reports, never answers, its dialogs: the platform notice, the first-run content folder, the 3DEXPERIENCE login. 552 tests.

0.9.18 (track A, UNMEASURED live): swx_render_image draws the active document with SOLIDWORKS's own viewport — view, display style, RealView, ambient occlusion, shadows, perspective, a plain background — at up to 8192 px a side through IModelDoc2::SaveBMP, converts it to PNG and reads the size back from the file (capped:true if only the window size came out). Every display setting it changes is captured, restored on every path, read back and listed; the document is never saved; a render that changes the screen respects the user-presence guard; the swconst preference ids are read from the installed interop DLL, never guessed. SOLIDWORKS Visualize (track B) is designed in docs/RENDERING.md with a measure-first list. 545 tests.

The cookie-banner clearance step now calls desktop_set_window_bounds {hwnd,x:300,y:30,w:1100,h:1450}, measured on 2026-10-02 to put the email box at y=787 above the banner at y=1020, instead of a resize verb never observed on ab. No other behaviour changed.

0.9.16, measured on the Visualize login window 2026-10-02: page 2 is known (its off-screen Remember-me box is ticked by its visible label); clicks land at the field's own fresh centre after any re-layout, and a cookie banner over a field is never clicked through; the login window is raised and confirmed in front before typing. Typing a password from the cloud is refused by policy, so swx_sign_in — which reads the vault and types on the desktop — now answers any 3DEXPERIENCE ID login window on the user's say-so (userAuthorized:true; window:visualize|solidworks|hwnd), naming the process that owns it. 536 tests.

0.9.15, from the first real 3DEXPERIENCE ID login window (measured 2026-10-02): its accessibility tree is lazy (woken before reading), the form is two pages (one flow, one consent toast), a cookie banner is never touched, and it refuses a background text set — so swx_sign_in types real keystrokes only safely: never while the user is typing (a measured collision put the user's keystrokes in the box), only with the login window in front, select-all first, the user name read back before Continue, Enter never pressed. A missing login names every way to grow the vault. A second user skill, solidworks-sign-in, ships the measured flow for every agent, with no credentials. 533 tests.

0.9.14, from ab's verbs measured on Drew's laptop (ab 2.1.163) before the first real sign-in: desktop_ui_set takes text (0.9.13 sent value — every fill would have failed); the UI tree is read by role with invokable/settable and the password edit found by its name, a truncated tree refused; clicks target by name; the vault reveal's per-use consent toast is waited for with a plain sentence for the user (sign_in_consent_pending / _denied), relay_forbidden is reported as a wiring bug; and a missing login is found from the vault's host list without raising the toast. 523 tests.

0.9.13, Drew's request 2026-10-02: unattended 3DEXPERIENCE sign-in. Every time a launch reaches the sign-in window its accessible inventory is captured (never a value). swx_sign_in recognizes the form from that inventory, takes the login from the user's own pup vault on their laptop through ab, types it through UI Automation, ticks Remember me and verifies the window closed; the password never appears in a reply, log or ledger, and a rejected password is never retried. It fails closed on a missing vault entry (with the import command), an unknown form or a second step. swx_start {signIn:"auto"} does it once by itself; the default waits. A respawned bridge sees a sign-in from a live census, and a record left at helperSignIn is reconciled when SOLIDWORKS attaches. 521 tests.

0.9.12, from Drew's 34-document crate session (0.9.11 proven live 2026-10-02: lock-out fixed, presence guard held, Part1 preserved, 33 closed in place untouched, quit 3.5 s). The sweep now preserves the whole session first and closes in a global order — assemblies (active first) before parts — deferring components held by an open assembly and counting those that go out with their parent (closedByParent). Sweeping verbs declare ab budgets longer than the sweep's 540 s ceiling; swx_progress shows a sweep's stage and counts; a DirectUIHWND task dialog whose words cannot be read says contentsReadable:false; a relaunch waiting on the user's sign-in reports waitingOn:userSignIn and the launch gate exits 4; tools/release.sh --publish is the whole wiki sync in one verified command. 510 tests.

A session cannot be 'starting' for hours. Measured live: after an update respawned the bridge, a three-hour-old session with 34 documents refused every verb, because an UNLOAD_ADDIN log line was read as the platform add-in loading. Load events are now the exact LOAD_ADDIN token; a long-running session with COM complete is ready unless startup lines changed within the quiet window; periodic memory lines no longer count as startup activity; swx_user_presence is exempt from the startup gate; the ready latch persists across a bridge respawn. The README verb table lists all 67 verbs. 502 tests.

The user-presence guard's baseline now holds only documents a bridge verb itself opened or created, never a re-read of the open set. In a session the user launched, every document is the user's, so stop, shutdown, the sweeps and the drain refuse user_is_active without an explicit, ledgered override. No foreground window (lock screen, permission prompt) counts as present. The re-check before quit priming is pinned. 497 tests.

0.9.9, from an event measured 2026-10-01 on 0.9.8: Drew took over a bridge-launched session (a 'leave as found' quit met his File Open dialog; minutes later it held his 34-document crate assembly). Every quit, sweep and priming now measures user presence first — SOLIDWORKS in the foreground with input in the last 120 s, documents the bridge did not open, or an earlier take-over — and refuses user_is_active with the evidence; unreadable counts as present; positive evidence marks the session taken over for good; only userPresentOverride + userAuthorized + a reason proceeds; the quit and drain gates refuse on presence and never override. New verb swx_user_presence. Adversary pass 45: an existing-but-unreadable performance log is unverifiable (never COM alone), and the ready latch is keyed by pid + creation time. 491 tests.