@frontendxlab/opencode-computer-use 0.1.2 → 0.1.4

package/README.md

@@ -111,8 +111,25 @@ npx opencode-computer-use-setup --global --v1
 ```
 
 Use `--dry-run` to inspect the action without changing files. Set
-`OPENCODE_COMPUTER_USE_SKIP_SETUP=1` to disable the postinstall hook. Restart
-OpenCode after a successful setup so the plugin is loaded.
+`OPENCODE_COMPUTER_USE_SKIP_SETUP=1` to disable the postinstall hook. Setup also
+skips automatically when `CI=1` or `CI=true`. Restart OpenCode after a
+successful setup so the plugin is loaded.
+
+The postinstall flow also runs the native permission check. To rerun it later:
+
+```sh
+npx opencode-computer-use-permissions
+# or, from a pnpm project
+pnpm exec opencode-computer-use-permissions
+```
+
+The command delegates to the native `open-computer-use doctor` flow. macOS runs
+the native Accessibility and Screen Recording onboarding when needed. Linux
+reports AT-SPI and desktop-session requirements. Windows reports UI Automation
+and interactive-session requirements. The command never changes permissions
+automatically. Use `--strict` when a missing or failed native
+check should return a nonzero exit status, or set
+`OPENCODE_COMPUTER_USE_SKIP_PERMISSIONS=1` to skip it.
 
 Recent pnpm releases may require explicit approval before running lifecycle
 scripts from dependencies. If pnpm reports `ERR_PNPM_IGNORED_BUILDS`, approve

package/SECURITY.md

@@ -26,7 +26,10 @@ sandbox.
 - The postinstall setup only adds this package to OpenCode's plugin list, keeps
   JSONC comments, creates a `.bak` before replacement, and never edits a
   conflicting or malformed configuration. Ambiguous setup is non-destructive
-  and prints manual instructions.
+  and prints manual instructions. CI and explicit skip environments bypass
+  postinstall mutation.
+- The permission command delegates to the native runtime's `doctor` flow. It
+  may open macOS onboarding, but it never grants or changes permissions.
 
 ## Operator responsibilities
 

package/bin/opencode-computer-use-permissions.js

@@ -0,0 +1,108 @@
+#!/usr/bin/env node
+
+import { spawnSync } from "node:child_process";
+import { realpathSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import process from "node:process";
+import { fileURLToPath } from "node:url";
+import { backendEnvironment, resolveBackend } from "../lib/backend.js";
+
+const SKIP_ENV = "OPENCODE_COMPUTER_USE_SKIP_PERMISSIONS";
+const PACKAGE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+
+function print(text, stream = "stdout") {
+  process[stream].write(`${text}\n`);
+}
+
+export function usage() {
+  return `Usage: opencode-computer-use-permissions [options]
+
+Run the native Open Computer Use permission and runtime onboarding check.
+
+Options:
+  --strict       Return a failure when the native check cannot run
+  --help, -h     Show this help
+
+The command uses the installed open-computer-use runtime:
+  macOS   checks or launches Accessibility and Screen Recording onboarding
+  Linux   reports AT-SPI and signed-in desktop-session requirements
+  Windows reports UI Automation and interactive-session requirements
+`;
+}
+
+function parseArguments(argv) {
+  const options = { strict: false, help: false };
+  for (const argument of argv) {
+    if (argument === "--strict") options.strict = true;
+    else if (argument === "--help" || argument === "-h") options.help = true;
+    else throw new Error(`Unknown permission option: ${argument}`);
+  }
+  return options;
+}
+
+function shouldSkip(env) {
+  const developmentInstall = env.npm_lifecycle_event === "postinstall"
+    && env.INIT_CWD
+    && resolve(env.INIT_CWD) === PACKAGE_ROOT;
+  return developmentInstall || env.CI === "true" || env.CI === "1" || env[SKIP_ENV] === "1";
+}
+
+export function main(argv = process.argv.slice(2), env = process.env, io = print) {
+  let options;
+  try {
+    options = parseArguments(argv);
+  } catch (error) {
+    io(`[opencode-computer-use-permissions] ${error instanceof Error ? error.message : String(error)}`, "stderr");
+    io(usage(), "stderr");
+    return 2;
+  }
+  if (options.help) {
+    io(usage());
+    return 0;
+  }
+  if (shouldSkip(env)) {
+    io("OpenCode Computer Use permission onboarding skipped.");
+    return 0;
+  }
+
+  let backend;
+  try {
+    backend = resolveBackend({ backend: "native" }, env);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    io(`[opencode-computer-use-permissions] Native permission check unavailable: ${message}`);
+    if (options.strict) return 1;
+    io("Install the optional open-computer-use runtime, then run this command again.");
+    return 0;
+  }
+
+  const result = spawnSync(backend.command, ["doctor"], {
+    env: backendEnvironment(env),
+    stdio: "inherit",
+    windowsHide: false,
+    timeout: 120_000,
+  });
+  if (result.error) {
+    io(`[opencode-computer-use-permissions] Permission check failed: ${result.error.message}`);
+    return options.strict ? 1 : 0;
+  }
+  if (result.status !== 0) {
+    io(`[opencode-computer-use-permissions] Native permission check exited with status ${result.status}.`);
+    return options.strict ? 1 : 0;
+  }
+  return 0;
+}
+
+function sameFile(left, right) {
+  try {
+    return realpathSync(left) === realpathSync(right);
+  } catch {
+    return resolve(left) === resolve(right);
+  }
+}
+
+const invokedPath = process.argv[1] ? resolve(process.argv[1]) : "";
+const scriptPath = fileURLToPath(import.meta.url);
+if (invokedPath && sameFile(invokedPath, scriptPath)) {
+  process.exitCode = main();
+}

package/bin/opencode-computer-use-setup.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 
-import { copyFileSync, existsSync, mkdirSync, readFileSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { chmodSync, copyFileSync, existsSync, mkdirSync, readFileSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { randomUUID } from "node:crypto";
 import { homedir } from "node:os";
 import { delimiter, dirname, join, resolve } from "node:path";
 import { spawnSync } from "node:child_process";
@@ -189,6 +190,7 @@ function configFlavor(text) {
 }
 
 function existingConfigFiles(root, scope, env = process.env) {
+  if (env.OPENCODE_CONFIG) return [resolve(env.OPENCODE_CONFIG)];
   const bases = scope === "global"
     ? [globalConfigDir(env)]
     : [root, join(root, ".opencode")];
@@ -290,15 +292,29 @@ export function updateConfigText(text, flavor) {
 function writeConfig(file, content, dryRun) {
   if (dryRun) return;
   mkdirSync(dirname(file), { recursive: true });
+  const mode = existsSync(file) ? statSync(file).mode & 0o777 : 0o600;
   if (existsSync(file)) {
-    copyFileSync(file, `${file}.bak`);
+    const backup = `${file}.bak`;
+    copyFileSync(file, backup);
+    chmodSync(backup, mode);
   }
-  const temporary = `${file}.tmp-${process.pid}`;
-  writeFileSync(temporary, content, "utf8");
+  const temporary = `${file}.tmp-${process.pid}-${randomUUID()}`;
+  writeFileSync(temporary, content, { encoding: "utf8", mode, flag: "wx" });
+  chmodSync(temporary, mode);
   if (process.platform === "win32" && existsSync(file)) rmSync(file, { force: true });
   renameSync(temporary, file);
 }
 
+function validateConfigFiles(root, scope, env) {
+  for (const file of existingConfigFiles(root, scope, env)) {
+    const text = readFileSync(file, "utf8");
+    const data = parse(text);
+    if (text.trim() && (data === undefined || data === null || typeof data !== "object" || Array.isArray(data))) {
+      throw new Error(`configuration is not valid JSON or JSONC: ${file}`);
+    }
+  }
+}
+
 function packageAlreadyConfigured(root, scope, env) {
   for (const file of existingConfigFiles(root, scope, env)) {
     try {
@@ -312,6 +328,12 @@ function packageAlreadyConfigured(root, scope, env) {
   return undefined;
 }
 
+function redactMessage(value) {
+  return String(value)
+    .replace(/\b(token|secret|password|api[_-]?key|authorization)\s*[:=]\s*(?:bearer|basic)?[^\n\r,;]*/giu, "$1=[redacted]")
+    .slice(0, 500);
+}
+
 function runPluginCli(flavor, scope, root, env) {
   const command = flavor === "v1" ? "opencode" : "opencode2";
   const args = ["plugin", "add", PACKAGE_NAME];
@@ -325,7 +347,7 @@ function runPluginCli(flavor, scope, root, env) {
     timeout: 120_000,
   });
   if (result.error || result.status !== 0) {
-    const detail = `${result.stdout || ""}${result.stderr || ""}`.trim().slice(0, 500);
+    const detail = redactMessage(`${result.stdout || ""}${result.stderr || ""}`.trim());
     throw new Error(`${command} plugin add failed${detail ? `: ${detail}` : ""}`);
   }
 }
@@ -388,12 +410,16 @@ export async function setup(options = {}, env = process.env, io = print) {
   const requestedFlavor = options.flavor || "auto";
   const scope = inferScope(requestedScope, env);
   const root = chooseRoot(scope, env);
+  if (env.OPENCODE_CONFIG_CONTENT) {
+    throw new Error("OPENCODE_CONFIG_CONTENT is immutable; add the plugin to that configuration manually");
+  }
   const detection = detectOpenCode(env);
   const config = detectConfigFlavor(root, scope, env);
   const flavor = chooseFlavor(requestedFlavor, detection, config);
   const dryRun = Boolean(options.dryRun);
   let result;
   if (scope === "global" && !dryRun) {
+    validateConfigFiles(root, scope, env);
     const existing = packageAlreadyConfigured(root, scope, env);
     if (existing) {
       result = { file: existing, changed: false };
@@ -406,9 +432,10 @@ export async function setup(options = {}, env = process.env, io = print) {
   } else {
     result = configForSetup(root, scope, flavor, env, dryRun);
   }
-  io(
-    `OpenCode Computer Use setup ${result.changed ? "configured" : "already configured"} for ${flavor.toUpperCase()} (${scope}).`,
-  );
+  const action = options.dryRun
+    ? (result.changed ? "would configure" : "already configured")
+    : (result.changed ? "configured" : "already configured");
+  io(`OpenCode Computer Use setup ${action} for ${flavor.toUpperCase()} (${scope}).`);
   if (result.changed) io(`Configuration: ${result.file}`);
   return { ...result, scope, flavor, detection };
 }
@@ -423,14 +450,6 @@ function isDevelopmentInstall(env) {
 }
 
 export async function main(argv = process.argv.slice(2), env = process.env, io = print) {
-  if (isDevelopmentInstall(env)) {
-    io("OpenCode Computer Use setup skipped for a package-development install.");
-    return 0;
-  }
-  if (env.OPENCODE_COMPUTER_USE_SKIP_SETUP === "1") {
-    io("OpenCode Computer Use setup skipped by OPENCODE_COMPUTER_USE_SKIP_SETUP.");
-    return 0;
-  }
   let options;
   try {
     options = parseArguments(argv);
@@ -443,6 +462,18 @@ export async function main(argv = process.argv.slice(2), env = process.env, io =
     printHelp();
     return 0;
   }
+  if (env.CI === "true" || env.CI === "1") {
+    io("OpenCode Computer Use setup skipped in CI.");
+    return 0;
+  }
+  if (isDevelopmentInstall(env)) {
+    io("OpenCode Computer Use setup skipped for a package-development install.");
+    return 0;
+  }
+  if (env.OPENCODE_COMPUTER_USE_SKIP_SETUP === "1") {
+    io("OpenCode Computer Use setup skipped by OPENCODE_COMPUTER_USE_SKIP_SETUP.");
+    return 0;
+  }
   return setup(options, env, io)
     .then(() => 0)
     .catch((error) => {

package/docs/index.html

@@ -459,7 +459,8 @@ npm install</code></pre><button class="copy" type="button" data-copy="#clone">Co
           <div class="code"><pre><code id="npm-install">npm install @frontendxlab/opencode-computer-use
 # pnpm install @frontendxlab/opencode-computer-use also works</code></pre><button class="copy" type="button" data-copy="#npm-install">Copy</button></div>
           <p>The package postinstall step detects OpenCode 1 versus OpenCode2 and local versus global installation. It edits JSONC without discarding comments, avoids duplicate entries, and prints both manual formats when the choice is ambiguous. Run it explicitly with <code>npx opencode-computer-use-setup</code>, or add <code>--local</code>, <code>--global</code>, <code>--v1</code>, or <code>--v2</code> when you want to choose explicitly.</p>
-          <p>Recent pnpm releases can require explicit lifecycle-script approval. If pnpm reports <code>ERR_PNPM_IGNORED_BUILDS</code>, run <code>pnpm approve-builds @frontendxlab/opencode-computer-use</code> once, then rerun <code>pnpm install</code>. If scripts are disabled, run <code>pnpm exec opencode-computer-use-setup</code> manually.</p>
+          <p>Recent pnpm releases can require explicit lifecycle-script approval. If pnpm reports <code>ERR_PNPM_IGNORED_BUILDS</code>, run <code>pnpm approve-builds @frontendxlab/opencode-computer-use</code> once, then rerun <code>pnpm install</code>. If scripts are disabled, run <code>pnpm exec opencode-computer-use-setup</code> manually. CI environments skip setup automatically.</p>
+          <p>The postinstall flow also runs the native <code>open-computer-use doctor</code> permission check. To rerun it, use <code>npx opencode-computer-use-permissions</code> or <code>pnpm exec opencode-computer-use-permissions</code>. macOS can launch Accessibility and Screen Recording onboarding, Linux reports AT-SPI requirements, and Windows reports UI Automation requirements. Permissions are never changed automatically.</p>
           <div class="tabs" role="tablist" aria-label="OpenCode generation">
             <button role="tab" id="tab-v1" aria-controls="panel-v1" aria-selected="true">OpenCode 1</button>
             <button role="tab" id="tab-v2" aria-controls="panel-v2" aria-selected="false" tabindex="-1">OpenCode2</button>
@@ -626,7 +627,8 @@ nodeRepl.write(state);</code></pre><button class="copy" type="button" data-copy=
           <h2>When the session is quiet.</h2>
           <details><summary><code>cua_repl</code> is not listed</summary><p>Check that the plugin path is in the active OpenCode generation's configuration, restart the TUI, and run <code>opencode mcp list</code>. Do not register the same plugin and MCP server twice.</p></details>
           <details><summary>Node cannot be found</summary><p>Set <code>OPENCODE_NODE</code> to an absolute Node executable before starting OpenCode, or make <code>node</code> available on the server PATH.</p></details>
-          <details><summary>The app list is empty</summary><p>Run <code>open-computer-use list-apps</code> in the same graphical session. Confirm the app is already running and that the desktop accessibility session is available.</p></details>
+          <details><summary>Permission onboarding needs to be rerun</summary><p>Run <code>opencode-computer-use-permissions</code>. On macOS it can reopen Accessibility and Screen Recording onboarding; Linux and Windows print the relevant runtime requirements.</p></details>
+          <details><summary>The app list is empty</summary><p>Run <code>open-computer-use-permissions</code>, then <code>open-computer-use list-apps</code> in the same graphical session. Confirm the app is already running and that the desktop accessibility session is available.</p></details>
           <details><summary>Screenshots are unavailable</summary><p>Screen capture depends on the OS compositor and permissions. The plugin can still provide bounded accessibility text when capture is unavailable.</p></details>
           <details><summary>Linux input returns success but nothing changes</summary><p>Check the desktop session type and native runtime prerequisites. A pseudo-window or Wayland compositor can expose state without accepting synthetic input. Observe again before retrying a mutating action.</p></details>
           <details><summary>Global pointer fallback is rejected</summary><p>This is the expected safety gate. Enable <code>allowGlobalPointerFallbacks</code> only for an explicit diagnostic session where moving the real pointer and changing focus are acceptable.</p></details>

package/docs/llms-full.txt

@@ -90,7 +90,11 @@ manual instructions. Run it explicitly with npx opencode-computer-use-setup;
 use --local, --global, --v1, or --v2 to choose explicitly. If pnpm reports
 ERR_PNPM_IGNORED_BUILDS, approve the package once with pnpm approve-builds
 @frontendxlab/opencode-computer-use, or run pnpm exec
-opencode-computer-use-setup manually.
+opencode-computer-use-setup manually. CI environments skip setup. The
+postinstall flow also runs the native permission check. Rerun it with
+npx opencode-computer-use-permissions or pnpm exec
+opencode-computer-use-permissions. macOS can launch onboarding, Linux reports
+AT-SPI requirements, and Windows reports UI Automation requirements.
 OpenCode 1 (opencode.json or opencode.jsonc, plugin list):
   { "$schema": "https://opencode.ai/config.json",
     "plugin": [["@frontendxlab/opencode-computer-use", { "backend": "auto" }]] }

package/docs/llms.txt

@@ -27,6 +27,6 @@
 - Safety profiles: safetyMode=read-only blocks mutating CUA methods and changes js annotations; appAccess supports exact-name and ID allow/deny rules.
 - Reliability: app bindings and output are bounded; native timeouts send cancellation; shutdown sends a best-effort turn-ended notification.
 - No arbitrary shell escape. No run_shell in the model-facing API. Restricted VM blocks require, process, fetch, filesystem, dynamic import, and code generation.
-- Published package: @frontendxlab/opencode-computer-use. Its postinstall setup detects OpenCode generation and local/global scope, preserves JSONC, and prints manual instructions when ambiguous. Explicit setup: npx opencode-computer-use-setup --local|--global --v1|--v2.
+- Published package: @frontendxlab/opencode-computer-use. Its postinstall setup detects OpenCode generation and local/global scope, preserves JSONC, and prints manual instructions when ambiguous. Explicit setup: npx opencode-computer-use-setup --local|--global --v1|--v2. Permission onboarding rerun: npx opencode-computer-use-permissions.
 - Requirements: Node.js 18 or newer, OpenCode 1.18.29 or newer (V1) or OpenCode2 V2, plus a signed-in graphical desktop session with OS accessibility and capture permissions.
 - Native runtimes packaged for darwin-arm64, darwin-x64, linux-arm64, linux-x64, win32-arm64, win32-x64. Live smoke tests passed on Linux x64 only; macOS and Windows need on-host validation.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontendxlab/opencode-computer-use",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "A dual OpenCode and OpenCode2 plugin for local cross-platform desktop control.",
   "license": "MIT",
   "repository": {
@@ -29,7 +29,8 @@
   },
   "bin": {
     "opencode-computer-use-repl": "bin/opencode-computer-use-repl.js",
-    "opencode-computer-use-setup": "bin/opencode-computer-use-setup.js"
+    "opencode-computer-use-setup": "bin/opencode-computer-use-setup.js",
+    "opencode-computer-use-permissions": "bin/opencode-computer-use-permissions.js"
   },
   "files": [
     "bin/",
@@ -46,10 +47,10 @@
     "opencode": ">=0.0.0-beta-18684"
   },
   "scripts": {
-    "postinstall": "node bin/opencode-computer-use-setup.js --auto",
-    "lint": "node --check index.js && node --check bin/opencode-computer-use-repl.js && node --check bin/opencode-computer-use-setup.js && node --check lib/backend.js && node --check lib/json-line-peer.mjs && node --check lib/options.js && node --check lib/output.mjs && node --check lib/repl.mjs && node --check lib/repl-kernel.mjs && node --check lib/sandbox.mjs",
+    "postinstall": "node bin/opencode-computer-use-setup.js --auto && node bin/opencode-computer-use-permissions.js",
+    "lint": "node --check index.js && node --check bin/opencode-computer-use-repl.js && node --check bin/opencode-computer-use-setup.js && node --check bin/opencode-computer-use-permissions.js && node --check lib/backend.js && node --check lib/json-line-peer.mjs && node --check lib/options.js && node --check lib/output.mjs && node --check lib/repl.mjs && node --check lib/repl-kernel.mjs && node --check lib/sandbox.mjs",
     "test": "node --test",
-    "prepack": "node --check index.js && node --check bin/opencode-computer-use-repl.js && node --check bin/opencode-computer-use-setup.js && node -e \"JSON.parse(require('fs').readFileSync('package.json','utf8'))\"",
+    "prepack": "node --check index.js && node --check bin/opencode-computer-use-repl.js && node --check bin/opencode-computer-use-setup.js && node --check bin/opencode-computer-use-permissions.js && node -e \"JSON.parse(require('fs').readFileSync('package.json','utf8'))\"",
     "prepublishOnly": "npm run lint && npm test"
   },
   "optionalDependencies": {