@frontendxlab/opencode-computer-use 0.1.3 → 0.1.4

package/README.md

@@ -115,6 +115,22 @@ Use `--dry-run` to inspect the action without changing files. Set
 skips automatically when `CI=1` or `CI=true`. Restart OpenCode after a
 successful setup so the plugin is loaded.
 
+The postinstall flow also runs the native permission check. To rerun it later:
+
+```sh
+npx opencode-computer-use-permissions
+# or, from a pnpm project
+pnpm exec opencode-computer-use-permissions
+```
+
+The command delegates to the native `open-computer-use doctor` flow. macOS runs
+the native Accessibility and Screen Recording onboarding when needed. Linux
+reports AT-SPI and desktop-session requirements. Windows reports UI Automation
+and interactive-session requirements. The command never changes permissions
+automatically. Use `--strict` when a missing or failed native
+check should return a nonzero exit status, or set
+`OPENCODE_COMPUTER_USE_SKIP_PERMISSIONS=1` to skip it.
+
 Recent pnpm releases may require explicit approval before running lifecycle
 scripts from dependencies. If pnpm reports `ERR_PNPM_IGNORED_BUILDS`, approve
 this package once and rerun the install:

package/SECURITY.md

@@ -28,6 +28,8 @@ sandbox.
   conflicting or malformed configuration. Ambiguous setup is non-destructive
   and prints manual instructions. CI and explicit skip environments bypass
   postinstall mutation.
+- The permission command delegates to the native runtime's `doctor` flow. It
+  may open macOS onboarding, but it never grants or changes permissions.
 
 ## Operator responsibilities
 

package/bin/opencode-computer-use-permissions.js

@@ -0,0 +1,108 @@
+#!/usr/bin/env node
+
+import { spawnSync } from "node:child_process";
+import { realpathSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import process from "node:process";
+import { fileURLToPath } from "node:url";
+import { backendEnvironment, resolveBackend } from "../lib/backend.js";
+
+const SKIP_ENV = "OPENCODE_COMPUTER_USE_SKIP_PERMISSIONS";
+const PACKAGE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+
+function print(text, stream = "stdout") {
+  process[stream].write(`${text}\n`);
+}
+
+export function usage() {
+  return `Usage: opencode-computer-use-permissions [options]
+
+Run the native Open Computer Use permission and runtime onboarding check.
+
+Options:
+  --strict       Return a failure when the native check cannot run
+  --help, -h     Show this help
+
+The command uses the installed open-computer-use runtime:
+  macOS   checks or launches Accessibility and Screen Recording onboarding
+  Linux   reports AT-SPI and signed-in desktop-session requirements
+  Windows reports UI Automation and interactive-session requirements
+`;
+}
+
+function parseArguments(argv) {
+  const options = { strict: false, help: false };
+  for (const argument of argv) {
+    if (argument === "--strict") options.strict = true;
+    else if (argument === "--help" || argument === "-h") options.help = true;
+    else throw new Error(`Unknown permission option: ${argument}`);
+  }
+  return options;
+}
+
+function shouldSkip(env) {
+  const developmentInstall = env.npm_lifecycle_event === "postinstall"
+    && env.INIT_CWD
+    && resolve(env.INIT_CWD) === PACKAGE_ROOT;
+  return developmentInstall || env.CI === "true" || env.CI === "1" || env[SKIP_ENV] === "1";
+}
+
+export function main(argv = process.argv.slice(2), env = process.env, io = print) {
+  let options;
+  try {
+    options = parseArguments(argv);
+  } catch (error) {
+    io(`[opencode-computer-use-permissions] ${error instanceof Error ? error.message : String(error)}`, "stderr");
+    io(usage(), "stderr");
+    return 2;
+  }
+  if (options.help) {
+    io(usage());
+    return 0;
+  }
+  if (shouldSkip(env)) {
+    io("OpenCode Computer Use permission onboarding skipped.");
+    return 0;
+  }
+
+  let backend;
+  try {
+    backend = resolveBackend({ backend: "native" }, env);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    io(`[opencode-computer-use-permissions] Native permission check unavailable: ${message}`);
+    if (options.strict) return 1;
+    io("Install the optional open-computer-use runtime, then run this command again.");
+    return 0;
+  }
+
+  const result = spawnSync(backend.command, ["doctor"], {
+    env: backendEnvironment(env),
+    stdio: "inherit",
+    windowsHide: false,
+    timeout: 120_000,
+  });
+  if (result.error) {
+    io(`[opencode-computer-use-permissions] Permission check failed: ${result.error.message}`);
+    return options.strict ? 1 : 0;
+  }
+  if (result.status !== 0) {
+    io(`[opencode-computer-use-permissions] Native permission check exited with status ${result.status}.`);
+    return options.strict ? 1 : 0;
+  }
+  return 0;
+}
+
+function sameFile(left, right) {
+  try {
+    return realpathSync(left) === realpathSync(right);
+  } catch {
+    return resolve(left) === resolve(right);
+  }
+}
+
+const invokedPath = process.argv[1] ? resolve(process.argv[1]) : "";
+const scriptPath = fileURLToPath(import.meta.url);
+if (invokedPath && sameFile(invokedPath, scriptPath)) {
+  process.exitCode = main();
+}

package/docs/index.html

@@ -460,6 +460,7 @@ npm install</code></pre><button class="copy" type="button" data-copy="#clone">Co
 # pnpm install @frontendxlab/opencode-computer-use also works</code></pre><button class="copy" type="button" data-copy="#npm-install">Copy</button></div>
           <p>The package postinstall step detects OpenCode 1 versus OpenCode2 and local versus global installation. It edits JSONC without discarding comments, avoids duplicate entries, and prints both manual formats when the choice is ambiguous. Run it explicitly with <code>npx opencode-computer-use-setup</code>, or add <code>--local</code>, <code>--global</code>, <code>--v1</code>, or <code>--v2</code> when you want to choose explicitly.</p>
           <p>Recent pnpm releases can require explicit lifecycle-script approval. If pnpm reports <code>ERR_PNPM_IGNORED_BUILDS</code>, run <code>pnpm approve-builds @frontendxlab/opencode-computer-use</code> once, then rerun <code>pnpm install</code>. If scripts are disabled, run <code>pnpm exec opencode-computer-use-setup</code> manually. CI environments skip setup automatically.</p>
+          <p>The postinstall flow also runs the native <code>open-computer-use doctor</code> permission check. To rerun it, use <code>npx opencode-computer-use-permissions</code> or <code>pnpm exec opencode-computer-use-permissions</code>. macOS can launch Accessibility and Screen Recording onboarding, Linux reports AT-SPI requirements, and Windows reports UI Automation requirements. Permissions are never changed automatically.</p>
           <div class="tabs" role="tablist" aria-label="OpenCode generation">
             <button role="tab" id="tab-v1" aria-controls="panel-v1" aria-selected="true">OpenCode 1</button>
             <button role="tab" id="tab-v2" aria-controls="panel-v2" aria-selected="false" tabindex="-1">OpenCode2</button>
@@ -626,7 +627,8 @@ nodeRepl.write(state);</code></pre><button class="copy" type="button" data-copy=
           <h2>When the session is quiet.</h2>
           <details><summary><code>cua_repl</code> is not listed</summary><p>Check that the plugin path is in the active OpenCode generation's configuration, restart the TUI, and run <code>opencode mcp list</code>. Do not register the same plugin and MCP server twice.</p></details>
           <details><summary>Node cannot be found</summary><p>Set <code>OPENCODE_NODE</code> to an absolute Node executable before starting OpenCode, or make <code>node</code> available on the server PATH.</p></details>
-          <details><summary>The app list is empty</summary><p>Run <code>open-computer-use list-apps</code> in the same graphical session. Confirm the app is already running and that the desktop accessibility session is available.</p></details>
+          <details><summary>Permission onboarding needs to be rerun</summary><p>Run <code>opencode-computer-use-permissions</code>. On macOS it can reopen Accessibility and Screen Recording onboarding; Linux and Windows print the relevant runtime requirements.</p></details>
+          <details><summary>The app list is empty</summary><p>Run <code>open-computer-use-permissions</code>, then <code>open-computer-use list-apps</code> in the same graphical session. Confirm the app is already running and that the desktop accessibility session is available.</p></details>
           <details><summary>Screenshots are unavailable</summary><p>Screen capture depends on the OS compositor and permissions. The plugin can still provide bounded accessibility text when capture is unavailable.</p></details>
           <details><summary>Linux input returns success but nothing changes</summary><p>Check the desktop session type and native runtime prerequisites. A pseudo-window or Wayland compositor can expose state without accepting synthetic input. Observe again before retrying a mutating action.</p></details>
           <details><summary>Global pointer fallback is rejected</summary><p>This is the expected safety gate. Enable <code>allowGlobalPointerFallbacks</code> only for an explicit diagnostic session where moving the real pointer and changing focus are acceptable.</p></details>

package/docs/llms-full.txt

@@ -90,7 +90,11 @@ manual instructions. Run it explicitly with npx opencode-computer-use-setup;
 use --local, --global, --v1, or --v2 to choose explicitly. If pnpm reports
 ERR_PNPM_IGNORED_BUILDS, approve the package once with pnpm approve-builds
 @frontendxlab/opencode-computer-use, or run pnpm exec
-opencode-computer-use-setup manually. CI environments skip setup.
+opencode-computer-use-setup manually. CI environments skip setup. The
+postinstall flow also runs the native permission check. Rerun it with
+npx opencode-computer-use-permissions or pnpm exec
+opencode-computer-use-permissions. macOS can launch onboarding, Linux reports
+AT-SPI requirements, and Windows reports UI Automation requirements.
 OpenCode 1 (opencode.json or opencode.jsonc, plugin list):
   { "$schema": "https://opencode.ai/config.json",
     "plugin": [["@frontendxlab/opencode-computer-use", { "backend": "auto" }]] }

package/docs/llms.txt

@@ -27,6 +27,6 @@
 - Safety profiles: safetyMode=read-only blocks mutating CUA methods and changes js annotations; appAccess supports exact-name and ID allow/deny rules.
 - Reliability: app bindings and output are bounded; native timeouts send cancellation; shutdown sends a best-effort turn-ended notification.
 - No arbitrary shell escape. No run_shell in the model-facing API. Restricted VM blocks require, process, fetch, filesystem, dynamic import, and code generation.
-- Published package: @frontendxlab/opencode-computer-use. Its postinstall setup detects OpenCode generation and local/global scope, preserves JSONC, and prints manual instructions when ambiguous. Explicit setup: npx opencode-computer-use-setup --local|--global --v1|--v2.
+- Published package: @frontendxlab/opencode-computer-use. Its postinstall setup detects OpenCode generation and local/global scope, preserves JSONC, and prints manual instructions when ambiguous. Explicit setup: npx opencode-computer-use-setup --local|--global --v1|--v2. Permission onboarding rerun: npx opencode-computer-use-permissions.
 - Requirements: Node.js 18 or newer, OpenCode 1.18.29 or newer (V1) or OpenCode2 V2, plus a signed-in graphical desktop session with OS accessibility and capture permissions.
 - Native runtimes packaged for darwin-arm64, darwin-x64, linux-arm64, linux-x64, win32-arm64, win32-x64. Live smoke tests passed on Linux x64 only; macOS and Windows need on-host validation.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontendxlab/opencode-computer-use",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "A dual OpenCode and OpenCode2 plugin for local cross-platform desktop control.",
   "license": "MIT",
   "repository": {
@@ -29,7 +29,8 @@
   },
   "bin": {
     "opencode-computer-use-repl": "bin/opencode-computer-use-repl.js",
-    "opencode-computer-use-setup": "bin/opencode-computer-use-setup.js"
+    "opencode-computer-use-setup": "bin/opencode-computer-use-setup.js",
+    "opencode-computer-use-permissions": "bin/opencode-computer-use-permissions.js"
   },
   "files": [
     "bin/",
@@ -46,10 +47,10 @@
     "opencode": ">=0.0.0-beta-18684"
   },
   "scripts": {
-    "postinstall": "node bin/opencode-computer-use-setup.js --auto",
-    "lint": "node --check index.js && node --check bin/opencode-computer-use-repl.js && node --check bin/opencode-computer-use-setup.js && node --check lib/backend.js && node --check lib/json-line-peer.mjs && node --check lib/options.js && node --check lib/output.mjs && node --check lib/repl.mjs && node --check lib/repl-kernel.mjs && node --check lib/sandbox.mjs",
+    "postinstall": "node bin/opencode-computer-use-setup.js --auto && node bin/opencode-computer-use-permissions.js",
+    "lint": "node --check index.js && node --check bin/opencode-computer-use-repl.js && node --check bin/opencode-computer-use-setup.js && node --check bin/opencode-computer-use-permissions.js && node --check lib/backend.js && node --check lib/json-line-peer.mjs && node --check lib/options.js && node --check lib/output.mjs && node --check lib/repl.mjs && node --check lib/repl-kernel.mjs && node --check lib/sandbox.mjs",
     "test": "node --test",
-    "prepack": "node --check index.js && node --check bin/opencode-computer-use-repl.js && node --check bin/opencode-computer-use-setup.js && node -e \"JSON.parse(require('fs').readFileSync('package.json','utf8'))\"",
+    "prepack": "node --check index.js && node --check bin/opencode-computer-use-repl.js && node --check bin/opencode-computer-use-setup.js && node --check bin/opencode-computer-use-permissions.js && node -e \"JSON.parse(require('fs').readFileSync('package.json','utf8'))\"",
     "prepublishOnly": "npm run lint && npm test"
   },
   "optionalDependencies": {