@integrity-labs/agt-cli 0.28.854 → 0.28.856

package/dist/mcp/computer-use-proxy.js

@@ -6,6 +6,89 @@ globalThis.require ??= __augmentedCreateRequire(import.meta.url);
 import { createInterface } from "readline";
 import { spawn } from "child_process";
 import { fileURLToPath } from "url";
+
+// src/computer-use-ssh-identity.ts
+import { chmodSync, mkdtempSync, rmSync, writeFileSync } from "fs";
+import { tmpdir } from "os";
+import { join } from "path";
+var SSH_KEY_ENV = "OPEN_COMPUTER_USE_API_KEY";
+var PEM_PREFIX = "-----BEGIN";
+function decodePrivateKey(raw) {
+  const trimmed = raw.trim();
+  if (trimmed.length === 0) return null;
+  if (trimmed.startsWith(PEM_PREFIX)) return ensureTrailingNewline(trimmed);
+  let decoded;
+  try {
+    decoded = Buffer.from(trimmed, "base64").toString("utf8");
+  } catch {
+    return null;
+  }
+  if (!decoded.trimStart().startsWith(PEM_PREFIX)) return null;
+  return ensureTrailingNewline(decoded.trim());
+}
+function ensureTrailingNewline(pem) {
+  return pem.endsWith("\n") ? pem : `${pem}
+`;
+}
+function removeIdentityDir(dir) {
+  if (dir === void 0) return;
+  try {
+    rmSync(dir, { recursive: true, force: true });
+  } catch {
+  }
+}
+function materializeSshIdentity(upstream, opts = {}) {
+  const env = opts.env ?? process.env;
+  const noop = { upstream: [...upstream], cleanup: () => {
+  }, problem: null, installed: false };
+  const raw = env[SSH_KEY_ENV];
+  if (raw === void 0 || raw.trim().length === 0) {
+    return noop;
+  }
+  if (raw.trim() === `\${${SSH_KEY_ENV}}`) {
+    return {
+      ...noop,
+      problem: `${SSH_KEY_ENV} is still the literal placeholder, so the manager has not materialized the credential for this agent yet`
+    };
+  }
+  if (upstream[0] !== "ssh") return noop;
+  const pem = decodePrivateKey(raw);
+  if (pem === null) {
+    return {
+      ...noop,
+      problem: `${SSH_KEY_ENV} is set but is neither base64-encoded PEM nor raw PEM (no ${PEM_PREFIX} header after decoding)`
+    };
+  }
+  let dir;
+  let keyPath;
+  try {
+    dir = mkdtempSync(join(opts.baseDir ?? tmpdir(), "agt-cu-"));
+    keyPath = join(dir, "id");
+    writeFileSync(keyPath, pem, { mode: 384 });
+    chmodSync(keyPath, 384);
+  } catch (err) {
+    removeIdentityDir(dir);
+    return {
+      ...noop,
+      problem: `could not write the ssh identity file: ${err.message}`
+    };
+  }
+  const createdDir = dir;
+  let removed = false;
+  const cleanup = () => {
+    if (removed) return;
+    removed = true;
+    removeIdentityDir(createdDir);
+  };
+  return {
+    upstream: [upstream[0], "-i", keyPath, ...upstream.slice(1)],
+    cleanup,
+    problem: null,
+    installed: true
+  };
+}
+
+// src/computer-use-proxy.ts
 import { resolve as resolvePath } from "path";
 
 // src/computer-use-gate.ts
@@ -543,9 +626,23 @@ async function main(argv = process.argv) {
     logErr("no upstream command; usage: computer-use-proxy -- <cmd> [args...]");
     process.exit(1);
   }
+  const identity = materializeSshIdentity(upstream);
+  if (identity.problem !== null) {
+    logErr(`ssh identity not installed: ${identity.problem}`);
+  }
+  if (identity.installed) {
+    process.on("exit", identity.cleanup);
+    for (const sig of ["SIGINT", "SIGTERM"]) {
+      process.on(sig, () => {
+        identity.cleanup();
+        process.exit(sig === "SIGINT" ? 130 : 143);
+      });
+    }
+  }
+  const spawnArgv = identity.upstream;
   let child;
   try {
-    child = spawn(upstream[0], upstream.slice(1), { stdio: ["pipe", "pipe", "inherit"] });
+    child = spawn(spawnArgv[0], spawnArgv.slice(1), { stdio: ["pipe", "pipe", "inherit"] });
   } catch (err) {
     logErr(`failed to spawn upstream: ${err.message}`);
     process.exit(1);

package/dist/mcp/direct-chat-channel.js

@@ -33918,6 +33918,71 @@ var INTEGRATION_REGISTRY = [
       }
     }
   },
+  {
+    // ENG-10133 (epic ENG-10127). Drives a HUMAN'S macOS desktop — clicks,
+    // keystrokes, window state — through `open-computer-use` running on that
+    // Mac, reached over an SSH reverse tunnel the Mac itself opens.
+    //
+    // READ THIS BEFORE CHANGING ANY FIELD BELOW. Three properties are what make
+    // this safe to ship at all, and each is easy to undo by accident:
+    //
+    //  1. Every forwarded call is gated per-action against a human-granted
+    //     approval (ENG-10132, packages/mcp/src/computer-use-gate.ts). The gate
+    //     lives INSIDE the proxy binary rather than beside it, so there is no
+    //     build in which the tools exist and the gate does not.
+    //  2. The `open-computer-use` FLAG_REGISTRY flag decides whether the row is
+    //     forwarded to the host at all, and it is `sensitive` — arming it costs
+    //     a confirmation. The flag governs whether the PATH EXISTS; the gate
+    //     governs whether a call may travel it. Neither substitutes for the other.
+    //  3. `beta` keeps it off every customer's picker until the operator runbook
+    //     (ENG-10135) exists. Setting up the Mac side — launchd tunnel, the
+    //     `from="127.0.0.1,::1"` pin on authorized_keys, Accessibility
+    //     permissions — is not something a connect dialog can do, and offering
+    //     it without those steps produces an integration that installs cleanly
+    //     and does nothing.
+    //
+    // NOT a `nativeMcp` spec: the entry needs a host-absolute proxy path and
+    // per-install ssh config (user, port, remote command), neither of which the
+    // ENG-5815 templating vocabulary can express. Rendered by
+    // provisioning/computer-use-mcp.ts instead — see its header.
+    id: "open-computer-use",
+    name: "Computer Use (macOS)",
+    category: "infrastructure",
+    description: "Drive a macOS desktop by accessibility tree \u2014 read window state, click, type and press keys in any app. Every action requires a human approval granted per session and bound to one application.",
+    // The credential is an OpenSSH private key, supplied by the operator who
+    // set up the Mac. `api_key` is this codebase's "customer pastes a secret"
+    // flow; there is no ssh-specific auth type and inventing one would buy
+    // nothing the credential pipeline does not already do.
+    supported_auth_types: ["api_key"],
+    beta: true,
+    // DELIBERATELY NOT `installable`, i.e. never in the Add Integration picker.
+    // It joins augmented-admin / augmented-support / augmented-help-kb as a
+    // GRANTED integration, and for a stronger version of their reason. A picker
+    // entry promises self-service, and there is none to offer: the Mac side
+    // needs a launchd tunnel, an authorized_keys entry pinned to loopback, an
+    // SSH keypair and macOS Accessibility permission, none of which a connect
+    // dialog can do. A customer who "installed" it from a picker would get a
+    // dialog, paste something, and own a broken integration.
+    //
+    // It would also contradict the flag. `open-computer-use` is `sensitive`, so
+    // arming it costs a deliberate confirmation — offering one-click install of
+    // the thing behind it is incoherent.
+    capabilities: [
+      {
+        id: "open-computer-use:read-screen",
+        name: "Read Screen State",
+        description: "List running applications and read a window's accessibility tree (element indices, labels, values). Screenshots are stripped by default and returned only on explicit request.",
+        access: "read"
+      },
+      {
+        id: "open-computer-use:control",
+        name: "Control the Desktop",
+        description: "Open apps, click, scroll, type text, press keys and set field values. Every call is refused unless a human has granted an approval for the target application.",
+        access: "write"
+      }
+    ],
+    docs_url: "https://github.com/anthropics/open-computer-use"
+  },
   {
     // ENG-6195: admin-only debugging surface for Integrity Labs STAFF agents.
     // Provisions the @integrity-labs/augmented-admin-mcp stdio broker, which
@@ -36216,6 +36281,35 @@ var FLAG_REGISTRY = [
     defaultValue: false,
     envVar: "AGT_MODEL_API_ERROR_REPORTING_ENABLED"
   },
+  {
+    key: "model-policy-failover-trigger",
+    description: "Automatic model-policy failover (ENG-10156, ADR-0074). off = the trigger does not run. shadow = it evaluates every ingested model-API error against the policy's failover_trigger config and LOGS the decision with its inputs, acting on nothing. Enum gate; ships OFF.",
+    flagType: "enum",
+    // `armed` is DELIBERATELY not an allowed value yet.
+    //
+    // Nothing writes model_policy_failover_state with source='auto' — that is
+    // the actuation half, and it is gated behind a recorded shadow soak
+    // (ENG-10156 AC8). Offering `armed` now would be a setting an operator can
+    // select, that reports success, and that does nothing: the failure mode is
+    // worse than the missing feature, because it looks like a fleet running
+    // with automatic failover enabled. Add it in the same change that makes it
+    // act, not before.
+    allowedValues: ["off", "shadow"],
+    // OFF, not `shadow`, and the contrast with `channel-quarantine-mode` is the
+    // reason: that flag defaults to `shadow` because shadow WAS the live
+    // manager's compiled behaviour, so anything else would have changed the
+    // fleet. Here there is no incumbent behaviour to preserve — nothing has ever
+    // evaluated this — so `off` is the honest default and turning shadow on is a
+    // deliberate act with a soak attached to it.
+    defaultValue: "off",
+    envVar: "AGT_MODEL_POLICY_FAILOVER_TRIGGER_MODE",
+    // Marked sensitive ahead of `armed` existing: the value this flag will
+    // eventually carry moves a host onto a secondary binding whose credential
+    // may be ours (credential_owner: 'platform'), i.e. it spends money with no
+    // human in the loop. Declaring that now costs nothing and means the audited
+    // -flip behaviour is already in place on the day the value is added.
+    sensitive: true
+  },
   {
     key: "claude-md-skills-index",
     description: `Manager injects the "## Available Skills" bullet list (one line per installed skill, name + frontmatter description) into the agent's project CLAUDE.md. Claude Code already surfaces installed skills to the model natively from .claude/skills/*/SKILL.md, so on current models the list is duplicated context - and an expensive one: it measured 12,045 chars across 29 skills on a prod agent, pushing project/CLAUDE.md to 51k against Claude Code's 40,000-char ceiling, past which the tail of the agent's own system prompt is silently truncated. OFF suppresses ONLY the skill bullets; the "Updating Integrations" guidance in the same managed block is real instruction and is always kept. Defaults ON (today's behaviour) - flip OFF per org to reclaim the headroom.`,
@@ -37520,6 +37614,22 @@ var FLAG_REGISTRY = [
     // No `since` for the same reason: there is no host-side reader and no fleet
     // to converge, so `classifyHostReach` returning `honors` for every host is
     // the literal truth here rather than the trap it is one flag above.
+  },
+  {
+    key: "open-computer-use",
+    description: "ENG-10133 (epic ENG-10127) - gates whether an agent gets the `open-computer-use` stdio MCP server, i.e. whether it can drive a human's macOS desktop at all. OFF (default) = the `.mcp.json` entry is not written, so the tools do not exist for the agent and `--allowedTools` never carries the wildcard (the allowlist is DERIVED from the server keys - see apps/cli/src/lib/claude-tools.ts, which is why there is no second lever to flip). ON = the entry is materialized for any agent that also holds the integration row; the flag is necessary, never sufficient. THE FLAG IS NOT THE SAFETY CONTROL AND MUST NOT BE READ AS ONE. Every forwarded call is gated per-action against a human-granted approval by packages/mcp/src/computer-use-gate.ts (ENG-10132); this flag decides whether the PATH EXISTS, the gate decides whether a call may travel it. Turning this on for an agent whose host runs a proxy build predating that gate hands it an ungated route to someone's desktop - which is why the gate ships in the same proxy binary rather than beside it, so there is no build in which the path exists and the gate does not. Org/agent-scoped rather than global: a desktop belongs to one person, and the blast radius of a wrong answer is that person's open windows, mail client and password manager. Deliberately NO envVar - a host-level env override would let a compromised or misconfigured host arm itself, and this is precisely the gate that must be armed centrally (ENG-8303 pin, ENG-7972 4KB cap).",
+    flagType: "boolean",
+    // Dark. There is no "today's behaviour" to preserve - nothing on the fleet
+    // has this integration - so the safe direction is unambiguous.
+    defaultValue: false,
+    // Enforcement gate (ADR-0022 section 4). Arming it is "relaxing a security
+    // control" in the most literal sense available in this codebase: it is the
+    // difference between an agent that can and cannot move a human's mouse.
+    // One confirmation is a cheap price for that.
+    sensitive: true
+    // Deliberately NOT public. The browser has no decision to make here; the
+    // consumers are the host payload that builds `input.integrations` and the
+    // grant route that refuses to install the row while the flag is off.
   }
 ];
 var REGISTRY_BY_KEY = new Map(FLAG_REGISTRY.map((definition) => [definition.key, definition]));

package/dist/mcp/index.js

@@ -26467,6 +26467,71 @@ var INTEGRATION_REGISTRY = [
       }
     }
   },
+  {
+    // ENG-10133 (epic ENG-10127). Drives a HUMAN'S macOS desktop — clicks,
+    // keystrokes, window state — through `open-computer-use` running on that
+    // Mac, reached over an SSH reverse tunnel the Mac itself opens.
+    //
+    // READ THIS BEFORE CHANGING ANY FIELD BELOW. Three properties are what make
+    // this safe to ship at all, and each is easy to undo by accident:
+    //
+    //  1. Every forwarded call is gated per-action against a human-granted
+    //     approval (ENG-10132, packages/mcp/src/computer-use-gate.ts). The gate
+    //     lives INSIDE the proxy binary rather than beside it, so there is no
+    //     build in which the tools exist and the gate does not.
+    //  2. The `open-computer-use` FLAG_REGISTRY flag decides whether the row is
+    //     forwarded to the host at all, and it is `sensitive` — arming it costs
+    //     a confirmation. The flag governs whether the PATH EXISTS; the gate
+    //     governs whether a call may travel it. Neither substitutes for the other.
+    //  3. `beta` keeps it off every customer's picker until the operator runbook
+    //     (ENG-10135) exists. Setting up the Mac side — launchd tunnel, the
+    //     `from="127.0.0.1,::1"` pin on authorized_keys, Accessibility
+    //     permissions — is not something a connect dialog can do, and offering
+    //     it without those steps produces an integration that installs cleanly
+    //     and does nothing.
+    //
+    // NOT a `nativeMcp` spec: the entry needs a host-absolute proxy path and
+    // per-install ssh config (user, port, remote command), neither of which the
+    // ENG-5815 templating vocabulary can express. Rendered by
+    // provisioning/computer-use-mcp.ts instead — see its header.
+    id: "open-computer-use",
+    name: "Computer Use (macOS)",
+    category: "infrastructure",
+    description: "Drive a macOS desktop by accessibility tree \u2014 read window state, click, type and press keys in any app. Every action requires a human approval granted per session and bound to one application.",
+    // The credential is an OpenSSH private key, supplied by the operator who
+    // set up the Mac. `api_key` is this codebase's "customer pastes a secret"
+    // flow; there is no ssh-specific auth type and inventing one would buy
+    // nothing the credential pipeline does not already do.
+    supported_auth_types: ["api_key"],
+    beta: true,
+    // DELIBERATELY NOT `installable`, i.e. never in the Add Integration picker.
+    // It joins augmented-admin / augmented-support / augmented-help-kb as a
+    // GRANTED integration, and for a stronger version of their reason. A picker
+    // entry promises self-service, and there is none to offer: the Mac side
+    // needs a launchd tunnel, an authorized_keys entry pinned to loopback, an
+    // SSH keypair and macOS Accessibility permission, none of which a connect
+    // dialog can do. A customer who "installed" it from a picker would get a
+    // dialog, paste something, and own a broken integration.
+    //
+    // It would also contradict the flag. `open-computer-use` is `sensitive`, so
+    // arming it costs a deliberate confirmation — offering one-click install of
+    // the thing behind it is incoherent.
+    capabilities: [
+      {
+        id: "open-computer-use:read-screen",
+        name: "Read Screen State",
+        description: "List running applications and read a window's accessibility tree (element indices, labels, values). Screenshots are stripped by default and returned only on explicit request.",
+        access: "read"
+      },
+      {
+        id: "open-computer-use:control",
+        name: "Control the Desktop",
+        description: "Open apps, click, scroll, type text, press keys and set field values. Every call is refused unless a human has granted an approval for the target application.",
+        access: "write"
+      }
+    ],
+    docs_url: "https://github.com/anthropics/open-computer-use"
+  },
   {
     // ENG-6195: admin-only debugging surface for Integrity Labs STAFF agents.
     // Provisions the @integrity-labs/augmented-admin-mcp stdio broker, which
@@ -28486,6 +28551,35 @@ var FLAG_REGISTRY = [
     defaultValue: false,
     envVar: "AGT_MODEL_API_ERROR_REPORTING_ENABLED"
   },
+  {
+    key: "model-policy-failover-trigger",
+    description: "Automatic model-policy failover (ENG-10156, ADR-0074). off = the trigger does not run. shadow = it evaluates every ingested model-API error against the policy's failover_trigger config and LOGS the decision with its inputs, acting on nothing. Enum gate; ships OFF.",
+    flagType: "enum",
+    // `armed` is DELIBERATELY not an allowed value yet.
+    //
+    // Nothing writes model_policy_failover_state with source='auto' — that is
+    // the actuation half, and it is gated behind a recorded shadow soak
+    // (ENG-10156 AC8). Offering `armed` now would be a setting an operator can
+    // select, that reports success, and that does nothing: the failure mode is
+    // worse than the missing feature, because it looks like a fleet running
+    // with automatic failover enabled. Add it in the same change that makes it
+    // act, not before.
+    allowedValues: ["off", "shadow"],
+    // OFF, not `shadow`, and the contrast with `channel-quarantine-mode` is the
+    // reason: that flag defaults to `shadow` because shadow WAS the live
+    // manager's compiled behaviour, so anything else would have changed the
+    // fleet. Here there is no incumbent behaviour to preserve — nothing has ever
+    // evaluated this — so `off` is the honest default and turning shadow on is a
+    // deliberate act with a soak attached to it.
+    defaultValue: "off",
+    envVar: "AGT_MODEL_POLICY_FAILOVER_TRIGGER_MODE",
+    // Marked sensitive ahead of `armed` existing: the value this flag will
+    // eventually carry moves a host onto a secondary binding whose credential
+    // may be ours (credential_owner: 'platform'), i.e. it spends money with no
+    // human in the loop. Declaring that now costs nothing and means the audited
+    // -flip behaviour is already in place on the day the value is added.
+    sensitive: true
+  },
   {
     key: "claude-md-skills-index",
     description: `Manager injects the "## Available Skills" bullet list (one line per installed skill, name + frontmatter description) into the agent's project CLAUDE.md. Claude Code already surfaces installed skills to the model natively from .claude/skills/*/SKILL.md, so on current models the list is duplicated context - and an expensive one: it measured 12,045 chars across 29 skills on a prod agent, pushing project/CLAUDE.md to 51k against Claude Code's 40,000-char ceiling, past which the tail of the agent's own system prompt is silently truncated. OFF suppresses ONLY the skill bullets; the "Updating Integrations" guidance in the same managed block is real instruction and is always kept. Defaults ON (today's behaviour) - flip OFF per org to reclaim the headroom.`,
@@ -29790,6 +29884,22 @@ var FLAG_REGISTRY = [
     // No `since` for the same reason: there is no host-side reader and no fleet
     // to converge, so `classifyHostReach` returning `honors` for every host is
     // the literal truth here rather than the trap it is one flag above.
+  },
+  {
+    key: "open-computer-use",
+    description: "ENG-10133 (epic ENG-10127) - gates whether an agent gets the `open-computer-use` stdio MCP server, i.e. whether it can drive a human's macOS desktop at all. OFF (default) = the `.mcp.json` entry is not written, so the tools do not exist for the agent and `--allowedTools` never carries the wildcard (the allowlist is DERIVED from the server keys - see apps/cli/src/lib/claude-tools.ts, which is why there is no second lever to flip). ON = the entry is materialized for any agent that also holds the integration row; the flag is necessary, never sufficient. THE FLAG IS NOT THE SAFETY CONTROL AND MUST NOT BE READ AS ONE. Every forwarded call is gated per-action against a human-granted approval by packages/mcp/src/computer-use-gate.ts (ENG-10132); this flag decides whether the PATH EXISTS, the gate decides whether a call may travel it. Turning this on for an agent whose host runs a proxy build predating that gate hands it an ungated route to someone's desktop - which is why the gate ships in the same proxy binary rather than beside it, so there is no build in which the path exists and the gate does not. Org/agent-scoped rather than global: a desktop belongs to one person, and the blast radius of a wrong answer is that person's open windows, mail client and password manager. Deliberately NO envVar - a host-level env override would let a compromised or misconfigured host arm itself, and this is precisely the gate that must be armed centrally (ENG-8303 pin, ENG-7972 4KB cap).",
+    flagType: "boolean",
+    // Dark. There is no "today's behaviour" to preserve - nothing on the fleet
+    // has this integration - so the safe direction is unambiguous.
+    defaultValue: false,
+    // Enforcement gate (ADR-0022 section 4). Arming it is "relaxing a security
+    // control" in the most literal sense available in this codebase: it is the
+    // difference between an agent that can and cannot move a human's mouse.
+    // One confirmation is a cheap price for that.
+    sensitive: true
+    // Deliberately NOT public. The browser has no decision to make here; the
+    // consumers are the host payload that builds `input.integrations` and the
+    // grant route that refuses to install the row while the flag is off.
   }
 ];
 var REGISTRY_BY_KEY = new Map(FLAG_REGISTRY.map((definition) => [definition.key, definition]));

package/dist/mcp/origami.js

@@ -40623,6 +40623,71 @@ var INTEGRATION_REGISTRY = [
       }
     }
   },
+  {
+    // ENG-10133 (epic ENG-10127). Drives a HUMAN'S macOS desktop — clicks,
+    // keystrokes, window state — through `open-computer-use` running on that
+    // Mac, reached over an SSH reverse tunnel the Mac itself opens.
+    //
+    // READ THIS BEFORE CHANGING ANY FIELD BELOW. Three properties are what make
+    // this safe to ship at all, and each is easy to undo by accident:
+    //
+    //  1. Every forwarded call is gated per-action against a human-granted
+    //     approval (ENG-10132, packages/mcp/src/computer-use-gate.ts). The gate
+    //     lives INSIDE the proxy binary rather than beside it, so there is no
+    //     build in which the tools exist and the gate does not.
+    //  2. The `open-computer-use` FLAG_REGISTRY flag decides whether the row is
+    //     forwarded to the host at all, and it is `sensitive` — arming it costs
+    //     a confirmation. The flag governs whether the PATH EXISTS; the gate
+    //     governs whether a call may travel it. Neither substitutes for the other.
+    //  3. `beta` keeps it off every customer's picker until the operator runbook
+    //     (ENG-10135) exists. Setting up the Mac side — launchd tunnel, the
+    //     `from="127.0.0.1,::1"` pin on authorized_keys, Accessibility
+    //     permissions — is not something a connect dialog can do, and offering
+    //     it without those steps produces an integration that installs cleanly
+    //     and does nothing.
+    //
+    // NOT a `nativeMcp` spec: the entry needs a host-absolute proxy path and
+    // per-install ssh config (user, port, remote command), neither of which the
+    // ENG-5815 templating vocabulary can express. Rendered by
+    // provisioning/computer-use-mcp.ts instead — see its header.
+    id: "open-computer-use",
+    name: "Computer Use (macOS)",
+    category: "infrastructure",
+    description: "Drive a macOS desktop by accessibility tree \u2014 read window state, click, type and press keys in any app. Every action requires a human approval granted per session and bound to one application.",
+    // The credential is an OpenSSH private key, supplied by the operator who
+    // set up the Mac. `api_key` is this codebase's "customer pastes a secret"
+    // flow; there is no ssh-specific auth type and inventing one would buy
+    // nothing the credential pipeline does not already do.
+    supported_auth_types: ["api_key"],
+    beta: true,
+    // DELIBERATELY NOT `installable`, i.e. never in the Add Integration picker.
+    // It joins augmented-admin / augmented-support / augmented-help-kb as a
+    // GRANTED integration, and for a stronger version of their reason. A picker
+    // entry promises self-service, and there is none to offer: the Mac side
+    // needs a launchd tunnel, an authorized_keys entry pinned to loopback, an
+    // SSH keypair and macOS Accessibility permission, none of which a connect
+    // dialog can do. A customer who "installed" it from a picker would get a
+    // dialog, paste something, and own a broken integration.
+    //
+    // It would also contradict the flag. `open-computer-use` is `sensitive`, so
+    // arming it costs a deliberate confirmation — offering one-click install of
+    // the thing behind it is incoherent.
+    capabilities: [
+      {
+        id: "open-computer-use:read-screen",
+        name: "Read Screen State",
+        description: "List running applications and read a window's accessibility tree (element indices, labels, values). Screenshots are stripped by default and returned only on explicit request.",
+        access: "read"
+      },
+      {
+        id: "open-computer-use:control",
+        name: "Control the Desktop",
+        description: "Open apps, click, scroll, type text, press keys and set field values. Every call is refused unless a human has granted an approval for the target application.",
+        access: "write"
+      }
+    ],
+    docs_url: "https://github.com/anthropics/open-computer-use"
+  },
   {
     // ENG-6195: admin-only debugging surface for Integrity Labs STAFF agents.
     // Provisions the @integrity-labs/augmented-admin-mcp stdio broker, which
@@ -42439,6 +42504,35 @@ var FLAG_REGISTRY = [
     defaultValue: false,
     envVar: "AGT_MODEL_API_ERROR_REPORTING_ENABLED"
   },
+  {
+    key: "model-policy-failover-trigger",
+    description: "Automatic model-policy failover (ENG-10156, ADR-0074). off = the trigger does not run. shadow = it evaluates every ingested model-API error against the policy's failover_trigger config and LOGS the decision with its inputs, acting on nothing. Enum gate; ships OFF.",
+    flagType: "enum",
+    // `armed` is DELIBERATELY not an allowed value yet.
+    //
+    // Nothing writes model_policy_failover_state with source='auto' — that is
+    // the actuation half, and it is gated behind a recorded shadow soak
+    // (ENG-10156 AC8). Offering `armed` now would be a setting an operator can
+    // select, that reports success, and that does nothing: the failure mode is
+    // worse than the missing feature, because it looks like a fleet running
+    // with automatic failover enabled. Add it in the same change that makes it
+    // act, not before.
+    allowedValues: ["off", "shadow"],
+    // OFF, not `shadow`, and the contrast with `channel-quarantine-mode` is the
+    // reason: that flag defaults to `shadow` because shadow WAS the live
+    // manager's compiled behaviour, so anything else would have changed the
+    // fleet. Here there is no incumbent behaviour to preserve — nothing has ever
+    // evaluated this — so `off` is the honest default and turning shadow on is a
+    // deliberate act with a soak attached to it.
+    defaultValue: "off",
+    envVar: "AGT_MODEL_POLICY_FAILOVER_TRIGGER_MODE",
+    // Marked sensitive ahead of `armed` existing: the value this flag will
+    // eventually carry moves a host onto a secondary binding whose credential
+    // may be ours (credential_owner: 'platform'), i.e. it spends money with no
+    // human in the loop. Declaring that now costs nothing and means the audited
+    // -flip behaviour is already in place on the day the value is added.
+    sensitive: true
+  },
   {
     key: "claude-md-skills-index",
     description: `Manager injects the "## Available Skills" bullet list (one line per installed skill, name + frontmatter description) into the agent's project CLAUDE.md. Claude Code already surfaces installed skills to the model natively from .claude/skills/*/SKILL.md, so on current models the list is duplicated context - and an expensive one: it measured 12,045 chars across 29 skills on a prod agent, pushing project/CLAUDE.md to 51k against Claude Code's 40,000-char ceiling, past which the tail of the agent's own system prompt is silently truncated. OFF suppresses ONLY the skill bullets; the "Updating Integrations" guidance in the same managed block is real instruction and is always kept. Defaults ON (today's behaviour) - flip OFF per org to reclaim the headroom.`,
@@ -43743,6 +43837,22 @@ var FLAG_REGISTRY = [
     // No `since` for the same reason: there is no host-side reader and no fleet
     // to converge, so `classifyHostReach` returning `honors` for every host is
     // the literal truth here rather than the trap it is one flag above.
+  },
+  {
+    key: "open-computer-use",
+    description: "ENG-10133 (epic ENG-10127) - gates whether an agent gets the `open-computer-use` stdio MCP server, i.e. whether it can drive a human's macOS desktop at all. OFF (default) = the `.mcp.json` entry is not written, so the tools do not exist for the agent and `--allowedTools` never carries the wildcard (the allowlist is DERIVED from the server keys - see apps/cli/src/lib/claude-tools.ts, which is why there is no second lever to flip). ON = the entry is materialized for any agent that also holds the integration row; the flag is necessary, never sufficient. THE FLAG IS NOT THE SAFETY CONTROL AND MUST NOT BE READ AS ONE. Every forwarded call is gated per-action against a human-granted approval by packages/mcp/src/computer-use-gate.ts (ENG-10132); this flag decides whether the PATH EXISTS, the gate decides whether a call may travel it. Turning this on for an agent whose host runs a proxy build predating that gate hands it an ungated route to someone's desktop - which is why the gate ships in the same proxy binary rather than beside it, so there is no build in which the path exists and the gate does not. Org/agent-scoped rather than global: a desktop belongs to one person, and the blast radius of a wrong answer is that person's open windows, mail client and password manager. Deliberately NO envVar - a host-level env override would let a compromised or misconfigured host arm itself, and this is precisely the gate that must be armed centrally (ENG-8303 pin, ENG-7972 4KB cap).",
+    flagType: "boolean",
+    // Dark. There is no "today's behaviour" to preserve - nothing on the fleet
+    // has this integration - so the safe direction is unambiguous.
+    defaultValue: false,
+    // Enforcement gate (ADR-0022 section 4). Arming it is "relaxing a security
+    // control" in the most literal sense available in this codebase: it is the
+    // difference between an agent that can and cannot move a human's mouse.
+    // One confirmation is a cheap price for that.
+    sensitive: true
+    // Deliberately NOT public. The browser has no decision to make here; the
+    // consumers are the host payload that builds `input.integrations` and the
+    // grant route that refuses to install the row while the flag is off.
   }
 ];
 var REGISTRY_BY_KEY = new Map(FLAG_REGISTRY.map((definition) => [definition.key, definition]));

package/dist/mcp/slack-channel.js

@@ -34771,6 +34771,71 @@ var INTEGRATION_REGISTRY = [
       }
     }
   },
+  {
+    // ENG-10133 (epic ENG-10127). Drives a HUMAN'S macOS desktop — clicks,
+    // keystrokes, window state — through `open-computer-use` running on that
+    // Mac, reached over an SSH reverse tunnel the Mac itself opens.
+    //
+    // READ THIS BEFORE CHANGING ANY FIELD BELOW. Three properties are what make
+    // this safe to ship at all, and each is easy to undo by accident:
+    //
+    //  1. Every forwarded call is gated per-action against a human-granted
+    //     approval (ENG-10132, packages/mcp/src/computer-use-gate.ts). The gate
+    //     lives INSIDE the proxy binary rather than beside it, so there is no
+    //     build in which the tools exist and the gate does not.
+    //  2. The `open-computer-use` FLAG_REGISTRY flag decides whether the row is
+    //     forwarded to the host at all, and it is `sensitive` — arming it costs
+    //     a confirmation. The flag governs whether the PATH EXISTS; the gate
+    //     governs whether a call may travel it. Neither substitutes for the other.
+    //  3. `beta` keeps it off every customer's picker until the operator runbook
+    //     (ENG-10135) exists. Setting up the Mac side — launchd tunnel, the
+    //     `from="127.0.0.1,::1"` pin on authorized_keys, Accessibility
+    //     permissions — is not something a connect dialog can do, and offering
+    //     it without those steps produces an integration that installs cleanly
+    //     and does nothing.
+    //
+    // NOT a `nativeMcp` spec: the entry needs a host-absolute proxy path and
+    // per-install ssh config (user, port, remote command), neither of which the
+    // ENG-5815 templating vocabulary can express. Rendered by
+    // provisioning/computer-use-mcp.ts instead — see its header.
+    id: "open-computer-use",
+    name: "Computer Use (macOS)",
+    category: "infrastructure",
+    description: "Drive a macOS desktop by accessibility tree \u2014 read window state, click, type and press keys in any app. Every action requires a human approval granted per session and bound to one application.",
+    // The credential is an OpenSSH private key, supplied by the operator who
+    // set up the Mac. `api_key` is this codebase's "customer pastes a secret"
+    // flow; there is no ssh-specific auth type and inventing one would buy
+    // nothing the credential pipeline does not already do.
+    supported_auth_types: ["api_key"],
+    beta: true,
+    // DELIBERATELY NOT `installable`, i.e. never in the Add Integration picker.
+    // It joins augmented-admin / augmented-support / augmented-help-kb as a
+    // GRANTED integration, and for a stronger version of their reason. A picker
+    // entry promises self-service, and there is none to offer: the Mac side
+    // needs a launchd tunnel, an authorized_keys entry pinned to loopback, an
+    // SSH keypair and macOS Accessibility permission, none of which a connect
+    // dialog can do. A customer who "installed" it from a picker would get a
+    // dialog, paste something, and own a broken integration.
+    //
+    // It would also contradict the flag. `open-computer-use` is `sensitive`, so
+    // arming it costs a deliberate confirmation — offering one-click install of
+    // the thing behind it is incoherent.
+    capabilities: [
+      {
+        id: "open-computer-use:read-screen",
+        name: "Read Screen State",
+        description: "List running applications and read a window's accessibility tree (element indices, labels, values). Screenshots are stripped by default and returned only on explicit request.",
+        access: "read"
+      },
+      {
+        id: "open-computer-use:control",
+        name: "Control the Desktop",
+        description: "Open apps, click, scroll, type text, press keys and set field values. Every call is refused unless a human has granted an approval for the target application.",
+        access: "write"
+      }
+    ],
+    docs_url: "https://github.com/anthropics/open-computer-use"
+  },
   {
     // ENG-6195: admin-only debugging surface for Integrity Labs STAFF agents.
     // Provisions the @integrity-labs/augmented-admin-mcp stdio broker, which
@@ -36994,6 +37059,35 @@ var FLAG_REGISTRY = [
     defaultValue: false,
     envVar: "AGT_MODEL_API_ERROR_REPORTING_ENABLED"
   },
+  {
+    key: "model-policy-failover-trigger",
+    description: "Automatic model-policy failover (ENG-10156, ADR-0074). off = the trigger does not run. shadow = it evaluates every ingested model-API error against the policy's failover_trigger config and LOGS the decision with its inputs, acting on nothing. Enum gate; ships OFF.",
+    flagType: "enum",
+    // `armed` is DELIBERATELY not an allowed value yet.
+    //
+    // Nothing writes model_policy_failover_state with source='auto' — that is
+    // the actuation half, and it is gated behind a recorded shadow soak
+    // (ENG-10156 AC8). Offering `armed` now would be a setting an operator can
+    // select, that reports success, and that does nothing: the failure mode is
+    // worse than the missing feature, because it looks like a fleet running
+    // with automatic failover enabled. Add it in the same change that makes it
+    // act, not before.
+    allowedValues: ["off", "shadow"],
+    // OFF, not `shadow`, and the contrast with `channel-quarantine-mode` is the
+    // reason: that flag defaults to `shadow` because shadow WAS the live
+    // manager's compiled behaviour, so anything else would have changed the
+    // fleet. Here there is no incumbent behaviour to preserve — nothing has ever
+    // evaluated this — so `off` is the honest default and turning shadow on is a
+    // deliberate act with a soak attached to it.
+    defaultValue: "off",
+    envVar: "AGT_MODEL_POLICY_FAILOVER_TRIGGER_MODE",
+    // Marked sensitive ahead of `armed` existing: the value this flag will
+    // eventually carry moves a host onto a secondary binding whose credential
+    // may be ours (credential_owner: 'platform'), i.e. it spends money with no
+    // human in the loop. Declaring that now costs nothing and means the audited
+    // -flip behaviour is already in place on the day the value is added.
+    sensitive: true
+  },
   {
     key: "claude-md-skills-index",
     description: `Manager injects the "## Available Skills" bullet list (one line per installed skill, name + frontmatter description) into the agent's project CLAUDE.md. Claude Code already surfaces installed skills to the model natively from .claude/skills/*/SKILL.md, so on current models the list is duplicated context - and an expensive one: it measured 12,045 chars across 29 skills on a prod agent, pushing project/CLAUDE.md to 51k against Claude Code's 40,000-char ceiling, past which the tail of the agent's own system prompt is silently truncated. OFF suppresses ONLY the skill bullets; the "Updating Integrations" guidance in the same managed block is real instruction and is always kept. Defaults ON (today's behaviour) - flip OFF per org to reclaim the headroom.`,
@@ -38298,6 +38392,22 @@ var FLAG_REGISTRY = [
     // No `since` for the same reason: there is no host-side reader and no fleet
     // to converge, so `classifyHostReach` returning `honors` for every host is
     // the literal truth here rather than the trap it is one flag above.
+  },
+  {
+    key: "open-computer-use",
+    description: "ENG-10133 (epic ENG-10127) - gates whether an agent gets the `open-computer-use` stdio MCP server, i.e. whether it can drive a human's macOS desktop at all. OFF (default) = the `.mcp.json` entry is not written, so the tools do not exist for the agent and `--allowedTools` never carries the wildcard (the allowlist is DERIVED from the server keys - see apps/cli/src/lib/claude-tools.ts, which is why there is no second lever to flip). ON = the entry is materialized for any agent that also holds the integration row; the flag is necessary, never sufficient. THE FLAG IS NOT THE SAFETY CONTROL AND MUST NOT BE READ AS ONE. Every forwarded call is gated per-action against a human-granted approval by packages/mcp/src/computer-use-gate.ts (ENG-10132); this flag decides whether the PATH EXISTS, the gate decides whether a call may travel it. Turning this on for an agent whose host runs a proxy build predating that gate hands it an ungated route to someone's desktop - which is why the gate ships in the same proxy binary rather than beside it, so there is no build in which the path exists and the gate does not. Org/agent-scoped rather than global: a desktop belongs to one person, and the blast radius of a wrong answer is that person's open windows, mail client and password manager. Deliberately NO envVar - a host-level env override would let a compromised or misconfigured host arm itself, and this is precisely the gate that must be armed centrally (ENG-8303 pin, ENG-7972 4KB cap).",
+    flagType: "boolean",
+    // Dark. There is no "today's behaviour" to preserve - nothing on the fleet
+    // has this integration - so the safe direction is unambiguous.
+    defaultValue: false,
+    // Enforcement gate (ADR-0022 section 4). Arming it is "relaxing a security
+    // control" in the most literal sense available in this codebase: it is the
+    // difference between an agent that can and cannot move a human's mouse.
+    // One confirmation is a cheap price for that.
+    sensitive: true
+    // Deliberately NOT public. The browser has no decision to make here; the
+    // consumers are the host payload that builds `input.integrations` and the
+    // grant route that refuses to install the row while the flag is off.
   }
 ];
 var REGISTRY_BY_KEY = new Map(FLAG_REGISTRY.map((definition) => [definition.key, definition]));