@moxxy/plugin-computer-control 0.41.2 → 0.42.0

package/src/tools/open.ts

@@ -1,96 +0,0 @@
-import { defineTool, MoxxyError, z } from '@moxxy/sdk';
-import { ensureDarwin, procFailureCause, runProcess } from '../shell.js';
-
-export const openTool = defineTool({
-  name: 'computer_open',
-  icon: 'globe',
-  description:
-    'Open a URL, file path, or .app bundle via macOS `open`. Use this to ' +
-    'launch / activate a specific app or jump to a web page. The model should ' +
-    'prefer this over typing into Spotlight when the target is known.',
-  inputSchema: z.object({
-    target: z
-      .string()
-      .min(1)
-      .describe(
-        'URL (https://...), file path (/Users/...), or app name (Safari). ' +
-          'For app names, prefer the `app` field — `target` is treated as a path.',
-      )
-      .optional(),
-    app: z
-      .string()
-      .min(1)
-      .max(120)
-      .describe(
-        'Application name to activate (e.g. "Safari", "Visual Studio Code"). ' +
-          'When `target` is also set, the app opens `target` (e.g. open a file in VS Code).',
-      )
-      .optional(),
-  }),
-  permission: { action: 'prompt' },
-  // `open` only messages LaunchServices: the file read / URL navigation happens
-  // in the launched app, outside this process tree — hence net 'none'. The
-  // broad fs.read is honest for this tool: any user-approved path is a
-  // legitimate `target`, and the cap check validates path-shaped inputs
-  // against these globs.
-  isolation: {
-    capabilities: {
-      subprocess: true,
-      commands: ['open'],
-      fs: { read: ['/**'] },
-      net: { mode: 'none' },
-      timeMs: 15_000,
-    },
-  },
-  async handler({ target, app }, ctx) {
-    ensureDarwin('computer_open');
-    if (!target && !app) {
-      throw new MoxxyError({
-        code: 'TOOL_ERROR',
-        message: 'computer_open: at least one of `target` or `app` is required',
-        context: { tool: 'computer_open' },
-      });
-    }
-    // A target/app beginning with '-' (e.g. '-g', '-n', '-W') is parsed by
-    // /usr/bin/open as an OPTION FLAG, not a path/URL/app — silently changing
-    // behavior (open in background, new instance) the user did not approve.
-    // Reject it: no legitimate path/URL/app name starts with a dash, and
-    // spawn is array-form so this is the only argument-injection vector.
-    for (const [field, value] of [
-      ['target', target],
-      ['app', app],
-    ] as const) {
-      if (value !== undefined && value.startsWith('-')) {
-        throw new MoxxyError({
-          code: 'TOOL_ERROR',
-          message: `computer_open: \`${field}\` must not begin with '-' (would be parsed as an option flag)`,
-          context: { tool: 'computer_open', field },
-        });
-      }
-    }
-    const args: string[] = [];
-    if (app) {
-      args.push('-a', app);
-    }
-    // `--` ends option parsing so the positional target is treated strictly
-    // as a path/URL operand even if a future change relaxes the guard above.
-    if (target) {
-      args.push('--', target);
-    }
-    const proc = await runProcess('open', args, {
-      ...(ctx.signal ? { signal: ctx.signal } : {}),
-      timeoutMs: 10_000,
-    });
-    if (proc.exitCode !== 0) {
-      const cause = procFailureCause(proc, 10_000);
-      throw new MoxxyError({
-        code: 'TOOL_ERROR',
-        message: cause
-          ? `open ${cause}`
-          : `open failed (exit ${proc.exitCode}): ${proc.stderr.trim() || '(no error message)'}`,
-        context: { tool: 'computer_open', exitCode: proc.exitCode, timedOut: proc.timedOut ? 1 : 0 },
-      });
-    }
-    return { ok: true, app, target };
-  },
-});

package/src/tools/screenshot.test.ts

@@ -1,137 +0,0 @@
-import { promises as fs } from 'node:fs';
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-import { MoxxyError } from '@moxxy/sdk';
-
-/**
- * Hermetic cover for the screenshot handler.
- *
- * The previous test shelled out to the real `screencapture`, which made it
- * depend on the host being macOS, having a display, and having been granted
- * Screen Recording. Worse, it accepted a thrown MoxxyError as a pass, so on any
- * machine without that permission (every CI runner) it verified nothing while
- * still reporting green. Faking the process layer means the contract below is
- * actually asserted, on every platform.
- */
-const runProcess = vi.fn();
-const ensureDarwin = vi.fn();
-
-vi.mock('../shell.js', async (importOriginal) => {
-  const actual = await importOriginal<typeof import('../shell.js')>();
-  return {
-    ...actual,
-    ensureDarwin: (...args: unknown[]) => ensureDarwin(...args),
-    runProcess: (...args: unknown[]) => runProcess(...args),
-  };
-});
-
-const { screenshotTool } = await import('./screenshot.js');
-
-const ctx = { signal: new AbortController().signal } as never;
-
-/** Smallest thing that is unmistakably PNG bytes; content is never decoded. */
-const PNG = Buffer.from('89504e470d0a1a0a0000000d49484452', 'hex');
-
-const ok = { exitCode: 0, stdout: '', stderr: '', timedOut: false };
-
-/** Track every temp path either command was pointed at, to assert cleanup. */
-let touched: string[] = [];
-
-const workingTools = (outBytes: Buffer = PNG): void => {
-  runProcess.mockImplementation(async (cmd: string, args: string[]) => {
-    if (cmd === 'screencapture') {
-      const target = args[args.length - 1]!;
-      touched.push(target);
-      await fs.writeFile(target, PNG);
-      return ok;
-    }
-    if (cmd === 'sips') {
-      const out = args[args.indexOf('--out') + 1]!;
-      touched.push(out);
-      await fs.writeFile(out, outBytes);
-      return ok;
-    }
-    throw new Error(`unexpected command ${cmd}`);
-  });
-};
-
-beforeEach(() => {
-  touched = [];
-  ensureDarwin.mockReset();
-  runProcess.mockReset();
-});
-afterEach(async () => {
-  for (const f of touched) await fs.rm(f, { force: true });
-});
-
-describe('computer_screenshot', () => {
-  it('returns { mediaType, base64 }, the shape the model can actually see', async () => {
-    // Load-bearing: the SDK emits a provider `image` block only for exactly
-    // this shape. Anything else is JSON.stringify'd and reaches the model as
-    // base64 TEXT it cannot decode.
-    workingTools();
-
-    const result = (await screenshotTool.handler({}, ctx)) as Record<string, unknown>;
-
-    expect(typeof result).toBe('object');
-    // jpeg is the default: much smaller, and the model reads pixels not bytes.
-    expect(result.mediaType).toBe('image/jpeg');
-    expect(typeof result.base64).toBe('string');
-    expect(result.base64).toBe(PNG.toString('base64'));
-  });
-
-  it('reports image/png when png was asked for', async () => {
-    workingTools();
-
-    const result = (await screenshotTool.handler({ format: 'png' }, ctx)) as Record<
-      string,
-      unknown
-    >;
-
-    expect(result.mediaType).toBe('image/png');
-  });
-
-  it('passes a region through to screencapture as -R', async () => {
-    workingTools();
-
-    await screenshotTool.handler({ region: { x: 1, y: 2, width: 3, height: 4 } }, ctx);
-
-    const args = runProcess.mock.calls.find((c) => c[0] === 'screencapture')![1] as string[];
-    expect(args[args.indexOf('-R') + 1]).toBe('1,2,3,4');
-  });
-
-  it('refuses on a non-darwin host rather than shelling out anyway', async () => {
-    ensureDarwin.mockImplementation(() => {
-      throw new MoxxyError({ code: 'TOOL_ERROR', message: 'darwin only' });
-    });
-
-    await expect(screenshotTool.handler({}, ctx)).rejects.toBeInstanceOf(MoxxyError);
-    expect(runProcess).not.toHaveBeenCalled();
-  });
-
-  it('surfaces a capture failure as a MoxxyError, naming the likely cause', async () => {
-    runProcess.mockResolvedValue({ exitCode: 1, stdout: '', stderr: '', timedOut: false });
-
-    await expect(screenshotTool.handler({}, ctx)).rejects.toThrow(/screencapture failed/);
-  });
-
-  it('refuses an image that is still over the cap after compression', async () => {
-    // Rather than hand the model megabytes it cannot use, say what to lower.
-    workingTools(Buffer.alloc(6 * 1024 * 1024, 1));
-
-    await expect(screenshotTool.handler({}, ctx)).rejects.toThrow(/exceeded/);
-  });
-
-  it('leaves no temp file behind, on success or on failure', async () => {
-    workingTools();
-    await screenshotTool.handler({}, ctx);
-
-    runProcess.mockReset();
-    workingTools(Buffer.alloc(6 * 1024 * 1024, 1));
-    await screenshotTool.handler({}, ctx).catch(() => undefined);
-
-    expect(touched.length).toBeGreaterThan(0);
-    for (const f of touched) {
-      await expect(fs.access(f)).rejects.toThrow();
-    }
-  });
-});

package/src/tools/screenshot.ts

@@ -1,180 +0,0 @@
-import { randomUUID } from 'node:crypto';
-import { promises as fs } from 'node:fs';
-import * as os from 'node:os';
-import * as path from 'node:path';
-import { defineTool, MoxxyError, z } from '@moxxy/sdk';
-import { ensureDarwin, procFailureCause, runProcess } from '../shell.js';
-import { withTemporaryFiles } from '../temporary-files.js';
-
-const regionSchema = z.object({
-  x: z.number().int().min(0),
-  y: z.number().int().min(0),
-  width: z.number().int().positive(),
-  height: z.number().int().positive(),
-});
-
-/**
- * Defaults aggressive on size — a Retina full-screen PNG can pass
- * 5 MB base64-encoded and instantly blow the model's context window.
- * 1280px JPEG @ q72 is ~150 KB for a typical desktop and still
- * legible enough for the model to identify UI elements.
- */
-const DEFAULT_MAX_DIM = 1280;
-const DEFAULT_FORMAT = 'jpeg' as const;
-const DEFAULT_JPEG_QUALITY = 72;
-/** Soft cap on the encoded image size in bytes. We refuse to return
- *  anything bigger than this even after the model asks for high-res —
- *  better to fail loudly than silently nuke the context. */
-const MAX_BYTES = 1_500_000;
-
-export const screenshotTool = defineTool({
-  name: 'computer_screenshot',
-  icon: 'workspace',
-  description:
-    'Take a screenshot of the macOS desktop. Returns base64-encoded image bytes ' +
-    'the model can see directly. By default the image is downscaled to 1280px ' +
-    'and JPEG-compressed so a single screenshot stays well under context — ' +
-    'override `maxDim` / `format` / `quality` only when you genuinely need full ' +
-    'resolution. macOS will prompt for Screen Recording permission on first use.',
-  inputSchema: z.object({
-    region: regionSchema
-      .optional()
-      .describe(
-        'Crop to a rectangle in screen-pixel coordinates (top-left origin). Omit for full screen.',
-      ),
-    maxDim: z
-      .number()
-      .int()
-      .min(256)
-      .max(3840)
-      .optional()
-      .describe(
-        `Resize so the longest edge is <= this many pixels. Default ${DEFAULT_MAX_DIM}. ` +
-          'Lower = smaller payload + less context cost; raise only when you need pixel detail.',
-      ),
-    format: z
-      .enum(['jpeg', 'png'])
-      .optional()
-      .describe(
-        `Output format. Default "${DEFAULT_FORMAT}" (much smaller). Pick "png" only when ` +
-          'you need lossless (rare — JPEG is fine for UI screenshots).',
-      ),
-    quality: z
-      .number()
-      .int()
-      .min(40)
-      .max(100)
-      .optional()
-      .describe(
-        `JPEG quality (1-100). Default ${DEFAULT_JPEG_QUALITY}. Ignored for PNG output.`,
-      ),
-  }),
-  permission: { action: 'prompt' },
-  // Capture + resize round-trips through temp files under os.tmpdir()
-  // (which is /var/folders/... on macOS, not /tmp). Budget covers the two
-  // 15s child stages plus encode/cleanup.
-  isolation: {
-    capabilities: {
-      subprocess: true,
-      commands: ['screencapture', 'sips'],
-      fs: { read: [`${os.tmpdir()}/**`], write: [`${os.tmpdir()}/**`] },
-      net: { mode: 'none' },
-      timeMs: 45_000,
-    },
-  },
-  async handler({ region, maxDim, format, quality }, ctx) {
-    ensureDarwin('computer_screenshot');
-    const fmt = format ?? DEFAULT_FORMAT;
-    const dim = maxDim ?? DEFAULT_MAX_DIM;
-    const q = quality ?? DEFAULT_JPEG_QUALITY;
-
-    // Always capture as PNG first (preserves color depth + no double
-    // compression), then let `sips` resize and convert in one pass.
-    // `-x` silences the camera-shutter sound.
-    // A random suffix guarantees uniqueness even for two captures in the
-    // same process within the same millisecond (pid+Date.now() alone can
-    // collide and cross-corrupt the temp files).
-    const uniq = randomUUID();
-    const captureTmp = path.join(
-      os.tmpdir(),
-      `moxxy-screencap-${process.pid}-${Date.now()}-${uniq}.png`,
-    );
-    const captureArgs = ['-x', '-t', 'png'];
-    if (region) {
-      captureArgs.push('-R', `${region.x},${region.y},${region.width},${region.height}`);
-    }
-    captureArgs.push(captureTmp);
-    // Guarantee the original PNG (potentially several MB for a Retina full
-    // screen) is removed on EVERY exit path — success, throw, or a spawn
-    // reject (e.g. `sips` not on PATH) / mid-capture timeout that may have
-    // left a partial file. Without this, those failure paths leak the temp
-    // file in os.tmpdir() permanently and accumulate over repeated failures.
-    const outExt = fmt === 'jpeg' ? 'jpg' : 'png';
-    const outTmp = path.join(os.tmpdir(), `moxxy-screencap-${process.pid}-${uniq}-out.${outExt}`);
-    return withTemporaryFiles([captureTmp, outTmp], async () => {
-      const cap = await runProcess('screencapture', captureArgs, {
-        ...(ctx.signal ? { signal: ctx.signal } : {}),
-        timeoutMs: 15_000,
-      });
-      if (cap.exitCode !== 0) {
-        const cause = procFailureCause(cap, 15_000);
-        throw new MoxxyError({
-          code: 'TOOL_ERROR',
-          message: cause
-            ? `screencapture ${cause}`
-            : `screencapture failed (exit ${cap.exitCode}): ${cap.stderr.trim() || '(no stderr — likely Screen Recording permission missing — grant in System Settings → Privacy & Security)'}`,
-          context: { tool: 'computer_screenshot', exitCode: cap.exitCode, timedOut: cap.timedOut ? 1 : 0 },
-        });
-      }
-
-      // Resize + format-convert in one sips call. `-Z N` fits within N
-      // on the longest edge while preserving aspect ratio. Output ext
-      // picks the format; format options apply when JPEG.
-      const sipsArgs = [
-        '-Z',
-        String(dim),
-        '--setProperty',
-        'format',
-        fmt,
-      ];
-      if (fmt === 'jpeg') {
-        sipsArgs.push('--setProperty', 'formatOptions', String(q));
-      }
-      sipsArgs.push(captureTmp, '--out', outTmp);
-      const sip = await runProcess('sips', sipsArgs, {
-        ...(ctx.signal ? { signal: ctx.signal } : {}),
-        timeoutMs: 15_000,
-      });
-      if (sip.exitCode !== 0) {
-        const cause = procFailureCause(sip, 15_000);
-        throw new MoxxyError({
-          code: 'TOOL_ERROR',
-          message: cause
-            ? `sips resize/convert ${cause}`
-            : `sips resize/convert failed (exit ${sip.exitCode}): ${sip.stderr.trim() || '(no error message)'}`,
-          context: { tool: 'computer_screenshot', exitCode: sip.exitCode, timedOut: sip.timedOut ? 1 : 0 },
-        });
-      }
-
-      const bytes = await fs.readFile(outTmp);
-      if (bytes.length > MAX_BYTES) {
-        throw new MoxxyError({
-          code: 'TOOL_ERROR',
-          message:
-            `screenshot exceeded ${MAX_BYTES} bytes after compression (got ${bytes.length}). ` +
-            `Lower maxDim (currently ${dim}) or quality (currently ${q}), or pass a smaller region.`,
-          context: { tool: 'computer_screenshot', byteLength: bytes.length },
-        });
-      }
-      // Preserve the image-shaped output consumed by the SDK projection.
-      return {
-        mediaType: fmt === 'jpeg' ? ('image/jpeg' as const) : ('image/png' as const),
-        base64: bytes.toString('base64'),
-        byteLength: bytes.length,
-        maxDim: dim,
-        format: fmt,
-        ...(fmt === 'jpeg' ? { quality: q } : {}),
-      };
-    });
-  },
-});

package/src/tools/type.ts

@@ -1,68 +0,0 @@
-import { defineTool, MoxxyError, z } from '@moxxy/sdk';
-import { ensureDarwin, procFailureCause, runProcess } from '../shell.js';
-
-export const typeTool = defineTool({
-  name: 'computer_type',
-  description:
-    'Type a string into whatever has keyboard focus. Use AFTER clicking the ' +
-    'target field. Macros (cmd+C, etc.) belong in computer_key, not here — this ' +
-    'tool sends each character literally. Requires Accessibility permission.',
-  inputSchema: z.object({
-    text: z
-      .string()
-      .max(4000)
-      .describe(
-        'The literal text to type. Newlines and tabs are typed as-is. ' +
-          'Pre-existing focus is the target — click first if needed.',
-      ),
-  }),
-  permission: { action: 'prompt' },
-  isolation: {
-    capabilities: {
-      subprocess: true,
-      commands: ['osascript'],
-      net: { mode: 'none' },
-      timeMs: 40_000,
-    },
-  },
-  async handler({ text }, ctx) {
-    ensureDarwin('computer_type');
-    if (text.length === 0) return { ok: true, length: 0 };
-    // Serialize the text to an AppleScript string literal ourselves and
-    // pass it inline via `osascript -e`, so we never have to escape
-    // AppleScript quote rules at the shell layer.
-    const literal = toAppleScriptString(text);
-    const directScript = `tell application "System Events" to keystroke ${literal}`;
-    const proc = await runProcess('osascript', ['-e', directScript], {
-      ...(ctx.signal ? { signal: ctx.signal } : {}),
-      timeoutMs: 30_000,
-    });
-    if (proc.exitCode !== 0) {
-      const cause = procFailureCause(proc, 30_000);
-      throw new MoxxyError({
-        code: 'TOOL_ERROR',
-        message: cause
-          ? `type ${cause}`
-          : `type failed (exit ${proc.exitCode}): ${proc.stderr.trim() || '(check Accessibility permission)'}`,
-        context: { tool: 'computer_type', exitCode: proc.exitCode, timedOut: proc.timedOut ? 1 : 0 },
-      });
-    }
-    return { ok: true, length: text.length };
-  },
-});
-
-/**
- * Serialize an arbitrary JS string into a valid AppleScript string
- * literal. AppleScript string syntax: `"..."` with `\"` and `\\` as
- * the only escapes; newlines are written as `" & return & "`.
- */
-export function toAppleScriptString(s: string): string {
-  // Split on newlines to use `return` (AppleScript's CR constant) so
-  // a multi-line type call sends actual Enter keystrokes rather than a
-  // literal `\n` in one keystroke (which keystroke would refuse).
-  const parts = s.split('\n').map((line) => {
-    const escaped = line.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
-    return `"${escaped}"`;
-  });
-  return parts.join(' & return & ');
-}

package/src/tools.test.ts

@@ -1,94 +0,0 @@
-import { MoxxyError } from '@moxxy/sdk';
-import { describe, expect, it } from 'vitest';
-import {
-  applescriptTool,
-  clickTool,
-  clipboardTool,
-  keyTool,
-  openTool,
-  screenshotTool,
-  typeTool,
-} from './index.js';
-
-/** Minimal ToolContext stub — only `signal` is read by these handlers. */
-const fakeCtx = { signal: new AbortController().signal } as never;
-
-describe('@moxxy/plugin-computer-control schemas', () => {
-  it('screenshot accepts an optional region', () => {
-    expect(screenshotTool.inputSchema.safeParse({}).success).toBe(true);
-    expect(
-      screenshotTool.inputSchema.safeParse({ region: { x: 0, y: 0, width: 100, height: 100 } })
-        .success,
-    ).toBe(true);
-  });
-
-  it('click requires x and y, count 1-3 only', () => {
-    expect(clickTool.inputSchema.safeParse({ x: 100, y: 200 }).success).toBe(true);
-    expect(clickTool.inputSchema.safeParse({ x: 100, y: 200, count: 2 }).success).toBe(true);
-    expect(clickTool.inputSchema.safeParse({ x: 100, y: 200, count: 5 }).success).toBe(false);
-    expect(clickTool.inputSchema.safeParse({ x: -1, y: 0 }).success).toBe(false);
-  });
-
-  it('type rejects oversize payloads', () => {
-    expect(typeTool.inputSchema.safeParse({ text: 'hello' }).success).toBe(true);
-    expect(typeTool.inputSchema.safeParse({ text: 'a'.repeat(5000) }).success).toBe(false);
-  });
-
-  it('key allows known modifier names and rejects unknown ones', () => {
-    expect(keyTool.inputSchema.safeParse({ key: 'tab' }).success).toBe(true);
-    expect(
-      keyTool.inputSchema.safeParse({ key: 'a', modifiers: ['cmd', 'shift'] }).success,
-    ).toBe(true);
-    expect(
-      keyTool.inputSchema.safeParse({ key: 'a', modifiers: ['windows'] }).success,
-    ).toBe(false);
-  });
-
-  it('open requires target or app at runtime (not enforced by zod)', () => {
-    // Both optional at schema level — runtime guard does the validation.
-    expect(openTool.inputSchema.safeParse({ app: 'Safari' }).success).toBe(true);
-    expect(openTool.inputSchema.safeParse({ target: '/tmp' }).success).toBe(true);
-    expect(openTool.inputSchema.safeParse({}).success).toBe(true);
-  });
-
-  it('clipboard requires action enum', () => {
-    expect(clipboardTool.inputSchema.safeParse({ action: 'read' }).success).toBe(true);
-    expect(clipboardTool.inputSchema.safeParse({ action: 'write', text: 'x' }).success).toBe(true);
-    expect(clipboardTool.inputSchema.safeParse({ action: 'paste' }).success).toBe(false);
-  });
-
-  it('applescript needs a non-empty script', () => {
-    expect(applescriptTool.inputSchema.safeParse({ script: 'return 1' }).success).toBe(true);
-    expect(applescriptTool.inputSchema.safeParse({ script: '' }).success).toBe(false);
-  });
-
-  it('open rejects a target/app beginning with "-" (argument-injection guard, darwin only)', async () => {
-    // The guard runs after ensureDarwin, so on non-darwin hosts ensureDarwin
-    // throws first — assert that path too so the test is meaningful everywhere.
-    if (process.platform === 'darwin') {
-      await expect(openTool.handler({ target: '-g' }, fakeCtx)).rejects.toThrow(
-        /must not begin with '-'/,
-      );
-      await expect(openTool.handler({ app: '-n' }, fakeCtx)).rejects.toThrow(
-        /must not begin with '-'/,
-      );
-    } else {
-      await expect(openTool.handler({ target: '-g' }, fakeCtx)).rejects.toBeInstanceOf(MoxxyError);
-    }
-  });
-
-  it('every tool is permission:prompt — never auto-allowed', () => {
-    const all = [
-      screenshotTool,
-      clickTool,
-      typeTool,
-      keyTool,
-      openTool,
-      clipboardTool,
-      applescriptTool,
-    ];
-    for (const tool of all) {
-      expect(tool.permission?.action).toBe('prompt');
-    }
-  });
-});

package/src/windows/action-contracts.test.ts

@@ -1,13 +0,0 @@
-import { expect, it } from 'vitest';
-import { actionSchema, actionStatusSchema, actionResultSchema } from './contracts.js';
-
-it('only permits explicit observed UIA actions and bounded receipt waiting', () => {
-  const target={windowId:'w',observationId:'o',elementId:'e'};
-  expect(actionSchema.safeParse({...target,action:'toggle'}).success).toBe(true);
-  expect(actionSchema.safeParse({...target,action:'eval'}).success).toBe(false);
-  expect(actionSchema.safeParse({...target,action:'invoke',fallback:'click'}).success).toBe(false);
-  expect(actionStatusSchema.parse({actionId:'a'})).toEqual({actionId:'a',waitMs:0});
-  expect(actionStatusSchema.safeParse({actionId:'a',waitMs:1001}).success).toBe(false);
-  expect(actionResultSchema.safeParse({actionId:'a',status:'pending',verificationRequired:true}).success).toBe(true);
-  expect(actionResultSchema.safeParse({actionId:'a',status:'pending',verificationRequired:false}).success).toBe(false);
-});

package/src/windows/artifact.test.ts

@@ -1,16 +0,0 @@
-import { createHash } from 'node:crypto';
-import { expect, it } from 'vitest';
-import { validateHelperArtifact } from './artifact.js';
-
-it('validates PE architecture, protocol and exact executable digest before launch', () => {
-  // Synthetic file header tests the parser, not native execution.
-  const bytes = Buffer.alloc(256);
-  bytes.write('MZ'); bytes.writeUInt32LE(128, 60); bytes.write('PE\0\0', 128); bytes.writeUInt16LE(0x8664, 132);
-  const manifest = { protocolVersion: 4, architecture: 'x64', sha256: createHash('sha256').update(bytes).digest('hex') };
-  expect(() => validateHelperArtifact(bytes, manifest)).not.toThrow();
-  expect(() => validateHelperArtifact(bytes, { ...manifest, protocolVersion: 1 })).toThrow();
-  expect(() => validateHelperArtifact(bytes, { ...manifest, sha256: '0'.repeat(64) })).toThrow();
-  bytes.writeUInt16LE(0xAA64, 132);
-  expect(() => validateHelperArtifact(bytes, { ...manifest, sha256: createHash('sha256').update(bytes).digest('hex') })).toThrow(/x64/);
-  expect(() => validateHelperArtifact(Buffer.alloc(2), manifest)).toThrow();
-});

package/src/windows/artifact.ts

@@ -1,57 +0,0 @@
-import { createHash } from 'node:crypto';
-import { constants } from 'node:fs';
-import { lstat, open } from 'node:fs/promises';
-import type { FileHandle } from 'node:fs/promises';
-import { z } from 'zod';
-import { PROTOCOL_VERSION } from './contracts.js';
-
-const manifestSchema = z.object({ protocolVersion: z.literal(PROTOCOL_VERSION), architecture: z.literal('x64'), sha256: z.string().regex(/^[a-f0-9]{64}$/) }).strict();
-
-export function validateHelperArtifact(bytes: Buffer, manifest: unknown): void {
-  const expected = manifestSchema.parse(manifest);
-  if (bytes.length < 64 || bytes.toString('ascii', 0, 2) !== 'MZ') throw new Error('Invalid Computer Use executable');
-  const offset = bytes.readUInt32LE(60);
-  if (offset > bytes.length - 6 || bytes.toString('ascii', offset, offset + 4) !== 'PE\0\0' || bytes.readUInt16LE(offset + 4) !== 0x8664) {
-    throw new Error('Computer Use requires a Windows x64 executable');
-  }
-  if (createHash('sha256').update(bytes).digest('hex') !== expected.sha256) throw new Error('Computer Use executable checksum mismatch');
-}
-
-// POSIX-only; Node leaves it undefined on Windows.
-const O_NOFOLLOW = constants.O_NOFOLLOW ?? 0;
-
-/**
- * Read a regular file no larger than `limit`, checking the open handle rather
- * than the path so the bytes that are validated are the bytes that were
- * measured. A `stat` followed by `readFile` can be repointed in between, which
- * would let an oversized file through the size guard.
- */
-async function readBounded(file: string, limit: number): Promise<Buffer> {
-  if (O_NOFOLLOW === 0 && (await lstat(file)).isSymbolicLink()) {
-    throw new Error('Computer Use artifact exceeds size limit');
-  }
-  let handle: FileHandle | undefined;
-  try {
-    handle = await open(file, constants.O_RDONLY | O_NOFOLLOW);
-    const info = await handle.stat();
-    if (!info.isFile() || info.size > limit) throw new Error('Computer Use artifact exceeds size limit');
-    return await handle.readFile();
-  } catch (error) {
-    // O_NOFOLLOW reports a symlink as ELOOP.
-    if ((error as NodeJS.ErrnoException).code === 'ELOOP') {
-      throw new Error('Computer Use artifact exceeds size limit');
-    }
-    throw error;
-  } finally {
-    await handle?.close();
-  }
-}
-
-export async function verifyHelperArtifact(executable: string): Promise<void> {
-  const manifestPath = executable + '.json';
-  const [bytes, manifest] = await Promise.all([
-    readBounded(executable, 32_000_000),
-    readBounded(manifestPath, 4096),
-  ]);
-  validateHelperArtifact(bytes, JSON.parse(manifest.toString('utf8')));
-}