@xortex/xcode 3.0.0

package/utils/completionCache.ts

@@ -0,0 +1,166 @@
+import chalk from 'chalk'
+import { mkdir, readFile, writeFile } from 'fs/promises'
+import { homedir } from 'os'
+import { dirname, join } from 'path'
+import { pathToFileURL } from 'url'
+import { color } from '../components/design-system/color.js'
+import { supportsHyperlinks } from '../ink/supports-hyperlinks.js'
+import { logForDebugging } from './debug.js'
+import { isENOENT } from './errors.js'
+import { execFileNoThrow } from './execFileNoThrow.js'
+import { logError } from './log.js'
+import type { ThemeName } from './theme.js'
+
+const EOL = '\n'
+
+type ShellInfo = {
+  name: string
+  rcFile: string
+  cacheFile: string
+  completionLine: string
+  shellFlag: string
+}
+
+function detectShell(): ShellInfo | null {
+  const shell = process.env.SHELL || ''
+  const home = homedir()
+  const claudeDir = join(home, '.claude')
+
+  if (shell.endsWith('/zsh') || shell.endsWith('/zsh.exe')) {
+    const cacheFile = join(claudeDir, 'completion.zsh')
+    return {
+      name: 'zsh',
+      rcFile: join(home, '.zshrc'),
+      cacheFile,
+      completionLine: `[[ -f "${cacheFile}" ]] && source "${cacheFile}"`,
+      shellFlag: 'zsh',
+    }
+  }
+  if (shell.endsWith('/bash') || shell.endsWith('/bash.exe')) {
+    const cacheFile = join(claudeDir, 'completion.bash')
+    return {
+      name: 'bash',
+      rcFile: join(home, '.bashrc'),
+      cacheFile,
+      completionLine: `[ -f "${cacheFile}" ] && source "${cacheFile}"`,
+      shellFlag: 'bash',
+    }
+  }
+  if (shell.endsWith('/fish') || shell.endsWith('/fish.exe')) {
+    const xdg = process.env.XDG_CONFIG_HOME || join(home, '.config')
+    const cacheFile = join(claudeDir, 'completion.fish')
+    return {
+      name: 'fish',
+      rcFile: join(xdg, 'fish', 'config.fish'),
+      cacheFile,
+      completionLine: `[ -f "${cacheFile}" ] && source "${cacheFile}"`,
+      shellFlag: 'fish',
+    }
+  }
+  return null
+}
+
+function formatPathLink(filePath: string): string {
+  if (!supportsHyperlinks()) {
+    return filePath
+  }
+  const fileUrl = pathToFileURL(filePath).href
+  return `\x1b]8;;${fileUrl}\x07${filePath}\x1b]8;;\x07`
+}
+
+/**
+ * Generate and cache the completion script, then add a source line to the
+ * shell's rc file. Returns a user-facing status message.
+ */
+export async function setupShellCompletion(theme: ThemeName): Promise<string> {
+  const shell = detectShell()
+  if (!shell) {
+    return ''
+  }
+
+  // Ensure the cache directory exists
+  try {
+    await mkdir(dirname(shell.cacheFile), { recursive: true })
+  } catch (e: unknown) {
+    logError(e)
+    return `${EOL}${color('warning', theme)(`Could not write ${shell.name} completion cache`)}${EOL}${chalk.dim(`Run manually: claude completion ${shell.shellFlag} > ${shell.cacheFile}`)}${EOL}`
+  }
+
+  // Generate the completion script by writing directly to the cache file.
+  // Using --output avoids piping through stdout where process.exit() can
+  // truncate output before the pipe buffer drains.
+  const claudeBin = process.argv[1] || 'claude'
+  const result = await execFileNoThrow(claudeBin, [
+    'completion',
+    shell.shellFlag,
+    '--output',
+    shell.cacheFile,
+  ])
+  if (result.code !== 0) {
+    return `${EOL}${color('warning', theme)(`Could not generate ${shell.name} shell completions`)}${EOL}${chalk.dim(`Run manually: claude completion ${shell.shellFlag} > ${shell.cacheFile}`)}${EOL}`
+  }
+
+  // Check if rc file already sources completions
+  let existing = ''
+  try {
+    existing = await readFile(shell.rcFile, { encoding: 'utf-8' })
+    if (
+      existing.includes('claude completion') ||
+      existing.includes(shell.cacheFile)
+    ) {
+      return `${EOL}${color('success', theme)(`Shell completions updated for ${shell.name}`)}${EOL}${chalk.dim(`See ${formatPathLink(shell.rcFile)}`)}${EOL}`
+    }
+  } catch (e: unknown) {
+    if (!isENOENT(e)) {
+      logError(e)
+      return `${EOL}${color('warning', theme)(`Could not install ${shell.name} shell completions`)}${EOL}${chalk.dim(`Add this to ${formatPathLink(shell.rcFile)}:`)}${EOL}${chalk.dim(shell.completionLine)}${EOL}`
+    }
+  }
+
+  // Append source line to rc file
+  try {
+    const configDir = dirname(shell.rcFile)
+    await mkdir(configDir, { recursive: true })
+
+    const separator = existing && !existing.endsWith('\n') ? '\n' : ''
+    const content = `${existing}${separator}\n# Claude Code shell completions\n${shell.completionLine}\n`
+    await writeFile(shell.rcFile, content, { encoding: 'utf-8' })
+
+    return `${EOL}${color('success', theme)(`Installed ${shell.name} shell completions`)}${EOL}${chalk.dim(`Added to ${formatPathLink(shell.rcFile)}`)}${EOL}${chalk.dim(`Run: source ${shell.rcFile}`)}${EOL}`
+  } catch (error) {
+    logError(error)
+    return `${EOL}${color('warning', theme)(`Could not install ${shell.name} shell completions`)}${EOL}${chalk.dim(`Add this to ${formatPathLink(shell.rcFile)}:`)}${EOL}${chalk.dim(shell.completionLine)}${EOL}`
+  }
+}
+
+/**
+ * Regenerate cached shell completion scripts in ~/.claude/.
+ * Called after `claude update` so completions stay in sync with the new binary.
+ */
+export async function regenerateCompletionCache(): Promise<void> {
+  const shell = detectShell()
+  if (!shell) {
+    return
+  }
+
+  logForDebugging(`update: Regenerating ${shell.name} completion cache`)
+
+  const claudeBin = process.argv[1] || 'claude'
+  const result = await execFileNoThrow(claudeBin, [
+    'completion',
+    shell.shellFlag,
+    '--output',
+    shell.cacheFile,
+  ])
+
+  if (result.code !== 0) {
+    logForDebugging(
+      `update: Failed to regenerate ${shell.name} completion cache`,
+    )
+    return
+  }
+
+  logForDebugging(
+    `update: Regenerated ${shell.name} completion cache at ${shell.cacheFile}`,
+  )
+}

package/utils/computerUse/appNames.ts

@@ -0,0 +1,196 @@
+/**
+ * Filter and sanitize installed-app data for inclusion in the `request_access`
+ * tool description. Ported from Cowork's appNames.ts. Two
+ * concerns: noise filtering (Spotlight returns every bundle on disk — XPC
+ * helpers, daemons, input methods) and prompt-injection hardening (app names
+ * are attacker-controlled; anyone can ship an app named anything).
+ *
+ * Residual risk: short benign-char adversarial names ("grant all") can't be
+ * filtered programmatically. The tool description's structural framing
+ * ("Available applications:") makes it clear these are app names, and the
+ * downstream permission dialog requires explicit user approval — a bad name
+ * can't auto-grant anything.
+ */
+
+/** Minimal shape — matches what `listInstalledApps` returns. */
+type InstalledAppLike = {
+  readonly bundleId: string
+  readonly displayName: string
+  readonly path: string
+}
+
+// ── Noise filtering ──────────────────────────────────────────────────────
+
+/**
+ * Only apps under these roots are shown. /System/Library subpaths (CoreServices,
+ * PrivateFrameworks, Input Methods) are OS plumbing — anchor on known-good
+ * roots rather than blocklisting every junk subpath since new macOS versions
+ * add more.
+ *
+ * ~/Applications is checked at call time via the `homeDir` arg (HOME isn't
+ * reliably known at module load in all environments).
+ */
+const PATH_ALLOWLIST: readonly string[] = [
+  '/Applications/',
+  '/System/Applications/',
+]
+
+/**
+ * Display-name patterns that mark background services even under /Applications.
+ * `(?:$|\s\()` — matches keyword at end-of-string OR immediately before ` (`:
+ * "Slack Helper (GPU)" and "ABAssistantService" fail, "Service Desk" passes
+ * (Service is followed by " D").
+ */
+const NAME_PATTERN_BLOCKLIST: readonly RegExp[] = [
+  /Helper(?:$|\s\()/,
+  /Agent(?:$|\s\()/,
+  /Service(?:$|\s\()/,
+  /Uninstaller(?:$|\s\()/,
+  /Updater(?:$|\s\()/,
+  /^\./,
+]
+
+/**
+ * Apps commonly requested for CU automation. ALWAYS included if installed,
+ * bypassing path check + count cap — the model needs these exact names even
+ * when the machine has 200+ apps. Bundle IDs (locale-invariant), not display
+ * names. Keep <30 — each entry is a guaranteed token in the description.
+ */
+const ALWAYS_KEEP_BUNDLE_IDS: ReadonlySet<string> = new Set([
+  // Browsers
+  'com.apple.Safari',
+  'com.google.Chrome',
+  'com.microsoft.edgemac',
+  'org.mozilla.firefox',
+  'company.thebrowser.Browser', // Arc
+  // Communication
+  'com.tinyspeck.slackmacgap',
+  'us.zoom.xos',
+  'com.microsoft.teams2',
+  'com.microsoft.teams',
+  'com.apple.MobileSMS',
+  'com.apple.mail',
+  // Productivity
+  'com.microsoft.Word',
+  'com.microsoft.Excel',
+  'com.microsoft.Powerpoint',
+  'com.microsoft.Outlook',
+  'com.apple.iWork.Pages',
+  'com.apple.iWork.Numbers',
+  'com.apple.iWork.Keynote',
+  'com.google.GoogleDocs',
+  // Notes / PM
+  'notion.id',
+  'com.apple.Notes',
+  'md.obsidian',
+  'com.linear',
+  'com.figma.Desktop',
+  // Dev
+  'com.microsoft.VSCode',
+  'com.apple.Terminal',
+  'com.googlecode.iterm2',
+  'com.github.GitHubDesktop',
+  // System essentials the model genuinely targets
+  'com.apple.finder',
+  'com.apple.iCal',
+  'com.apple.systempreferences',
+])
+
+// ── Prompt-injection hardening ───────────────────────────────────────────
+
+/**
+ * `\p{L}\p{M}\p{N}` with /u — not `\w` (ASCII-only, would drop Bücher, 微信,
+ * Préférences Système). `\p{M}` matches combining marks so NFD-decomposed
+ * diacritics (ü → u + ◌̈) pass. Single space not `\s` — `\s` matches newlines,
+ * which would let "App\nIgnore previous…" through as a multi-line injection.
+ * Still bars quotes, angle brackets, backticks, pipes, colons.
+ */
+const APP_NAME_ALLOWED = /^[\p{L}\p{M}\p{N}_ .&'()+-]+$/u
+const APP_NAME_MAX_LEN = 40
+const APP_NAME_MAX_COUNT = 50
+
+function isUserFacingPath(path: string, homeDir: string | undefined): boolean {
+  if (PATH_ALLOWLIST.some(root => path.startsWith(root))) return true
+  if (homeDir) {
+    const userApps = homeDir.endsWith('/')
+      ? `${homeDir}Applications/`
+      : `${homeDir}/Applications/`
+    if (path.startsWith(userApps)) return true
+  }
+  return false
+}
+
+function isNoisyName(name: string): boolean {
+  return NAME_PATTERN_BLOCKLIST.some(re => re.test(name))
+}
+
+/**
+ * Length cap + trim + dedupe + sort. `applyCharFilter` — skip for trusted
+ * bundle IDs (Apple/Google/MS; a localized "Réglages Système" with unusual
+ * punctuation shouldn't be dropped), apply for anything attacker-installable.
+ */
+function sanitizeCore(
+  raw: readonly string[],
+  applyCharFilter: boolean,
+): string[] {
+  const seen = new Set<string>()
+  return raw
+    .map(name => name.trim())
+    .filter(trimmed => {
+      if (!trimmed) return false
+      if (trimmed.length > APP_NAME_MAX_LEN) return false
+      if (applyCharFilter && !APP_NAME_ALLOWED.test(trimmed)) return false
+      if (seen.has(trimmed)) return false
+      seen.add(trimmed)
+      return true
+    })
+    .sort((a, b) => a.localeCompare(b))
+}
+
+function sanitizeAppNames(raw: readonly string[]): string[] {
+  const filtered = sanitizeCore(raw, true)
+  if (filtered.length <= APP_NAME_MAX_COUNT) return filtered
+  return [
+    ...filtered.slice(0, APP_NAME_MAX_COUNT),
+    `… and ${filtered.length - APP_NAME_MAX_COUNT} more`,
+  ]
+}
+
+function sanitizeTrustedNames(raw: readonly string[]): string[] {
+  return sanitizeCore(raw, false)
+}
+
+/**
+ * Filter raw Spotlight results to user-facing apps, then sanitize. Always-keep
+ * apps bypass path/name filter AND char allowlist (trusted vendors, not
+ * attacker-installed); still length-capped, deduped, sorted.
+ */
+export function filterAppsForDescription(
+  installed: readonly InstalledAppLike[],
+  homeDir: string | undefined,
+): string[] {
+  const { alwaysKept, rest } = installed.reduce<{
+    alwaysKept: string[]
+    rest: string[]
+  }>(
+    (acc, app) => {
+      if (ALWAYS_KEEP_BUNDLE_IDS.has(app.bundleId)) {
+        acc.alwaysKept.push(app.displayName)
+      } else if (
+        isUserFacingPath(app.path, homeDir) &&
+        !isNoisyName(app.displayName)
+      ) {
+        acc.rest.push(app.displayName)
+      }
+      return acc
+    },
+    { alwaysKept: [], rest: [] },
+  )
+
+  const sanitizedAlways = sanitizeTrustedNames(alwaysKept)
+  const alwaysSet = new Set(sanitizedAlways)
+  return [
+    ...sanitizedAlways,
+    ...sanitizeAppNames(rest).filter(n => !alwaysSet.has(n)),
+  ]
+}

package/utils/computerUse/cleanup.ts

@@ -0,0 +1,86 @@
+import type { ToolUseContext } from '../../Tool.js'
+
+import { logForDebugging } from '../debug.js'
+import { errorMessage } from '../errors.js'
+import { withResolvers } from '../withResolvers.js'
+import { isLockHeldLocally, releaseComputerUseLock } from './computerUseLock.js'
+import { unregisterEscHotkey } from './escHotkey.js'
+
+// cu.apps.unhide is NOT one of the four @MainActor methods wrapped by
+// drainRunLoop's 30s backstop. On abort paths (where the user hit Ctrl+C
+// because something was slow) a hang here would wedge the abort. Generous
+// timeout — unhide should be ~instant; if it takes 5s something is wrong
+// and proceeding is better than waiting. The Swift call continues in the
+// background regardless; we just stop blocking on it.
+const UNHIDE_TIMEOUT_MS = 5000
+
+/**
+ * Turn-end cleanup for the chicago MCP surface: auto-unhide apps that
+ * `prepareForAction` hid, then release the file-based lock.
+ *
+ * Called from three sites: natural turn end (`stopHooks.ts`), abort during
+ * streaming (`query.ts` aborted_streaming), abort during tool execution
+ * (`query.ts` aborted_tools). All three reach this via dynamic import gated
+ * on `feature('CHICAGO_MCP')`. `executor.js` (which pulls both native
+ * modules) is dynamic-imported below so non-CU turns don't load native
+ * modules just to no-op.
+ *
+ * No-ops cheaply on non-CU turns: both gate checks are zero-syscall.
+ */
+export async function cleanupComputerUseAfterTurn(
+  ctx: Pick<
+    ToolUseContext,
+    'getAppState' | 'setAppState' | 'sendOSNotification'
+  >,
+): Promise<void> {
+  const appState = ctx.getAppState()
+
+  const hidden = appState.computerUseMcpState?.hiddenDuringTurn
+  if (hidden && hidden.size > 0) {
+    const { unhideComputerUseApps } = await import('./executor.js')
+    const unhide = unhideComputerUseApps([...hidden]).catch(err =>
+      logForDebugging(
+        `[Computer Use MCP] auto-unhide failed: ${errorMessage(err)}`,
+      ),
+    )
+    const timeout = withResolvers<void>()
+    const timer = setTimeout(timeout.resolve, UNHIDE_TIMEOUT_MS)
+    await Promise.race([unhide, timeout.promise]).finally(() =>
+      clearTimeout(timer),
+    )
+    ctx.setAppState(prev =>
+      prev.computerUseMcpState?.hiddenDuringTurn === undefined
+        ? prev
+        : {
+            ...prev,
+            computerUseMcpState: {
+              ...prev.computerUseMcpState,
+              hiddenDuringTurn: undefined,
+            },
+          },
+    )
+  }
+
+  // Zero-syscall pre-check so non-CU turns don't touch disk. Release is still
+  // idempotent (returns false if already released or owned by another session).
+  if (!isLockHeldLocally()) return
+
+  // Unregister before lock release so the pump-retain drops as soon as the
+  // CU session ends. Idempotent — no-ops if registration failed at acquire.
+  // Swallow throws so a NAPI unregister error never prevents lock release —
+  // a held lock blocks the next CU session with "in use by another session".
+  try {
+    unregisterEscHotkey()
+  } catch (err) {
+    logForDebugging(
+      `[Computer Use MCP] unregisterEscHotkey failed: ${errorMessage(err)}`,
+    )
+  }
+
+  if (await releaseComputerUseLock()) {
+    ctx.sendOSNotification?.({
+      message: 'Claude is done using your computer',
+      notificationType: 'computer_use_exit',
+    })
+  }
+}

package/utils/computerUse/common.ts

@@ -0,0 +1,61 @@
+import { normalizeNameForMCP } from '../../services/mcp/normalization.js'
+import { env } from '../env.js'
+
+export const COMPUTER_USE_MCP_SERVER_NAME = 'computer-use'
+
+/**
+ * Sentinel bundle ID for the frontmost gate. Claude Code is a terminal — it has
+ * no window. This never matches a real `NSWorkspace.frontmostApplication`, so
+ * the package's "host is frontmost" branch (mouse click-through exemption,
+ * keyboard safety-net) is dead code for us. `prepareForAction`'s "exempt our
+ * own window" is likewise a no-op — there is no window to exempt.
+ */
+export const CLI_HOST_BUNDLE_ID = 'com.anthropic.claude-code.cli-no-window'
+
+/**
+ * Fallback `env.terminal` → bundleId map for when `__CFBundleIdentifier` is
+ * unset. Covers the macOS terminals we can distinguish — Linux entries
+ * (konsole, gnome-terminal, xterm) are deliberately absent since
+ * `createCliExecutor` is darwin-guarded.
+ */
+const TERMINAL_BUNDLE_ID_FALLBACK: Readonly<Record<string, string>> = {
+  'iTerm.app': 'com.googlecode.iterm2',
+  Apple_Terminal: 'com.apple.Terminal',
+  ghostty: 'com.mitchellh.ghostty',
+  kitty: 'net.kovidgoyal.kitty',
+  WarpTerminal: 'dev.warp.Warp-Stable',
+  vscode: 'com.microsoft.VSCode',
+}
+
+/**
+ * Bundle ID of the terminal emulator we're running inside, so `prepareDisplay`
+ * can exempt it from hiding and `captureExcluding` can keep it out of
+ * screenshots. Returns null when undetectable (ssh, cleared env, unknown
+ * terminal) — caller must handle the null case.
+ *
+ * `__CFBundleIdentifier` is set by LaunchServices when a .app bundle spawns a
+ * process and is inherited by children. It's the exact bundleId, no lookup
+ * needed — handles terminals the fallback table doesn't know about. Under
+ * tmux/screen it reflects the terminal that started the SERVER, which may
+ * differ from the attached client. That's harmless here: we exempt A
+ * terminal window, and the screenshots exclude it regardless.
+ */
+export function getTerminalBundleId(): string | null {
+  const cfBundleId = process.env.__CFBundleIdentifier
+  if (cfBundleId) return cfBundleId
+  return TERMINAL_BUNDLE_ID_FALLBACK[env.terminal ?? ''] ?? null
+}
+
+/**
+ * Static capabilities for macOS CLI. `hostBundleId` is not here — it's added
+ * by `executor.ts` per `ComputerExecutor.capabilities`. `buildComputerUseTools`
+ * takes this shape (no `hostBundleId`, no `teachMode`).
+ */
+export const CLI_CU_CAPABILITIES = {
+  screenshotFiltering: 'native' as const,
+  platform: 'darwin' as const,
+}
+
+export function isComputerUseMCPServer(name: string): boolean {
+  return normalizeNameForMCP(name) === COMPUTER_USE_MCP_SERVER_NAME
+}