@phnx-labs/computer-cli 0.1.1 → 0.1.4

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 0.1.4
+
+- `computer apps` now surfaces menu-bar / status-item apps. The macOS helper listed only `.regular` (Dock) apps, so an accessory app such as AGI Menu was invisible in discovery and could not be targeted by `--bundle`/`--name` (pid resolution matches against the listing) even though the pid gate would drive it once its bundle id was in the allow list. Listing now includes `.regular` and `.accessory` and omits only background-only (`.prohibited`) processes; the hard floor, exact allow list and peer gates are unchanged. The macOS helper floor is 1.0.2, carrying this discovery fix.
+
+## 0.1.3
+
+- `--host <address>` takes the address grammar shared by every Phoenix CLI (PHNX-4090): `ssh://[user@]host[:port]` or a bare `user@host` is the Windows-helper tunnel target, `vnc://host[:port]` (default 5901) selects the RFB desktop transport, `tcp://host:port` reaches a helper daemon directly. A password in the address, `cdp://`, and any other scheme fail loud; `setup`/`start`/`stop` refuse a `vnc://`/`tcp://` host. `ssh://host:2222` carries the SSH port as `-o Port=2222`.
+- `--vnc <host:port>` and a user-set `COMPUTER_HELPER_VNC` / `COMPUTER_HELPER_TCP` selector still work for one release and print a deprecation line; use `--host vnc://…` / `--host tcp://…`.
+
+## 0.1.2
+
+- Obfuscate application code offline before compiling platform executables, while leaving dependencies untransformed.
+- Keep deterministic build inputs and exclude intermediate bundles from distribution. Embedded JavaScript remains recoverable; this increases inspection effort rather than preventing reverse engineering.
+
 ## 0.1.1
 
 - Fix compiled Windows asset lookup so status and helper discovery work from the installed CLI.
@@ -10,4 +24,3 @@
 - Extract computer automation and native drivers into an independent CLI.
 - Retain local macOS, remote Windows, VNC, autonomous runs and action history.
 - Publish compiled platform packages with a small npm launcher.
-

package/README.md

@@ -14,9 +14,11 @@ On first use, macOS downloads and verifies the signed native helper. macOS still
 
 Windows automation uses the native Windows driver in the interactive desktop session, reached through SSH. VNC provides screenshot and coordinate input for desktops without native Accessibility support. See [command reference](https://github.com/phnx-labs/computer-cli/blob/main/docs/computer.md) and [integration contract](https://github.com/phnx-labs/computer-cli/blob/main/docs/integration.md).
 
-Source lives in the private `phnx-labs/computer-cli` repository. npm ships a small Node launcher and an optional compiled package for your platform: macOS arm64/x64, Linux arm64/x64, or Windows x64. Source files and source maps are excluded. Minification, bytecode and compilation make casual inspection harder; they do not prevent reverse engineering. Keep credentials out of binaries.
+Source lives in the private `phnx-labs/computer-cli` repository. npm ships a small Node launcher and an optional compiled package for your platform: macOS arm64/x64, Linux arm64/x64, or Windows x64. TypeScript, source maps and intermediate bundles are excluded. Before compilation, our application code is obfuscated offline with a pinned tool and fixed seed: identifiers, string lookups and selected control flow are transformed. Dependencies are bundled without that transformation to limit runtime overhead.
 
-Native helpers retain their separate, immutable `computer-mac/v*` and `computer-win/v*` release channels. An ordinary CLI release does not rebuild them.
+Bun executables retain JavaScript alongside bytecode. The transformed code can still be extracted, analyzed and deobfuscated; this build raises inspection effort and does not provide secrecy or an authorization boundary. Bytecode alone is a startup optimization, not source protection. No source is sent to an obfuscation service, and the build adds no debugger interference or runtime network checks. Keep credentials out of binaries.
+
+Native helpers retain their separate, immutable `computer-mac/v*` and `computer-win/v*` release channels. An ordinary CLI release does not rebuild them. This JavaScript hardening does not transform the helpers; the Windows helper is a managed .NET single-file application and remains decompilable.
 
 Development:
 
@@ -30,4 +32,3 @@ bash scripts/release.sh --confirm       # publish the reviewed commit
 ```
 
 Run publishing through an existing npm credential bundle, for example `secrets exec npmjs.com -- bash scripts/release.sh --confirm`. Release requires a clean linked worktree at the reviewed remote main commit. It verifies packed file lists, checks immutable package integrity on retries, and checks a registry installation. Live desktop verification remains part of delivery.
-

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@phnx-labs/computer-cli",
-  "version": "0.1.1",
+  "version": "0.1.4",
   "description": "Native desktop automation over Accessibility, UI Automation and VNC",
   "type": "module",
   "bin": {
@@ -25,20 +25,21 @@
     "test": "bash scripts/test.sh"
   },
   "optionalDependencies": {
-    "@phnx-labs/computer-cli-darwin-arm64": "0.1.1",
-    "@phnx-labs/computer-cli-darwin-x64": "0.1.1",
-    "@phnx-labs/computer-cli-linux-arm64": "0.1.1",
-    "@phnx-labs/computer-cli-linux-x64": "0.1.1",
-    "@phnx-labs/computer-cli-win32-x64": "0.1.1"
+    "@phnx-labs/computer-cli-darwin-arm64": "0.1.4",
+    "@phnx-labs/computer-cli-darwin-x64": "0.1.4",
+    "@phnx-labs/computer-cli-linux-arm64": "0.1.4",
+    "@phnx-labs/computer-cli-linux-x64": "0.1.4",
+    "@phnx-labs/computer-cli-win32-x64": "0.1.4"
   },
   "devDependencies": {
     "@inquirer/prompts": "8.5.2",
-    "@types/node": "26.1.0",
     "@types/bun": "1.3.10",
+    "@types/node": "26.1.0",
+    "bun": "1.4.1",
     "chalk": "5.6.2",
     "commander": "15.0.0",
+    "javascript-obfuscator": "5.7.0",
     "typescript": "6.0.3",
-    "yaml": "2.9.0",
-    "bun": "1.4.1"
+    "yaml": "2.9.0"
   }
 }