chainlesschain 0.162.158 → 0.162.159

package/src/lib/computer-use/authorization.js

@@ -0,0 +1,173 @@
+/**
+ * Computer-use authorization (gap-2026-07-11 P1#6) — the trust core shared by
+ * the computer-use MCP server. GUI control is the highest-privilege surface an
+ * agent can hold (it can click "OK" on anything), so it is:
+ *   - OFF unless explicitly enabled (`cc mcp computer-use` / --enable);
+ *   - capability-gated: each verb (screenshot/click/type/scroll/clipboard/
+ *     app-launch/window-list) can be individually withheld;
+ *   - per-app scoped: an allowlist confines control to named apps, and a
+ *     high-risk denylist (terminals, IDEs, file managers, system settings,
+ *     password managers) always requires confirmation even when allowed.
+ *
+ * Pure + dependency-free so it is exhaustively unit-tested; the server and the
+ * OS backend consume its verdicts.
+ */
+
+export const COMPUTER_USE_CAPABILITIES = [
+  "screenshot",
+  "window_list",
+  "app_launch",
+  "click",
+  "type",
+  "scroll",
+  "clipboard_read",
+  "clipboard_write",
+];
+
+// Read-only observation is lower risk than input injection; the tool-priority
+// guidance (MCP/API > shell > browser action > computer use) lives here so the
+// server can surface it and the model prefers cheaper, auditable paths.
+export const TOOL_PRIORITY = [
+  "mcp/api",
+  "shell",
+  "browser action",
+  "computer use",
+];
+
+// Apps where an unattended click/type is disproportionately dangerous — a
+// terminal runs commands, a password manager reveals secrets, system settings
+// change the machine. Matched case-insensitively as a substring of the app /
+// window identifier. Confirmation is forced even inside the allowlist.
+export const HIGH_RISK_APP_PATTERNS = [
+  "terminal",
+  "powershell",
+  "cmd.exe",
+  "conhost",
+  "windows terminal",
+  "iterm",
+  "code", // VS Code / VSCodium
+  "jetbrains",
+  "intellij",
+  "explorer.exe",
+  "finder",
+  "nautilus",
+  "settings",
+  "control panel",
+  "regedit",
+  "keychain",
+  "1password",
+  "bitwarden",
+  "lastpass",
+  "keepass",
+];
+
+/**
+ * @param {object} config computer-use config subtree
+ *   { enabled, capabilities?: string[], appAllowlist?: string[],
+ *     highRiskPatterns?: string[], confirmAll?: boolean }
+ */
+export function createAuthorizer(config = {}) {
+  const enabled = config.enabled === true;
+  const caps = new Set(
+    Array.isArray(config.capabilities) && config.capabilities.length > 0
+      ? config.capabilities
+      : COMPUTER_USE_CAPABILITIES,
+  );
+  const allowlist = Array.isArray(config.appAllowlist)
+    ? config.appAllowlist.map((a) => String(a).toLowerCase())
+    : null; // null = no app restriction (any app), [] = deny every app
+  const highRisk = (
+    Array.isArray(config.highRiskPatterns)
+      ? config.highRiskPatterns
+      : HIGH_RISK_APP_PATTERNS
+  ).map((p) => String(p).toLowerCase());
+  const confirmAll = config.confirmAll === true;
+
+  const INPUT_VERBS = new Set([
+    "click",
+    "type",
+    "scroll",
+    "app_launch",
+    "clipboard_write",
+  ]);
+
+  function isHighRiskApp(app) {
+    const a = String(app || "").toLowerCase();
+    if (!a) return false;
+    return highRisk.some((p) => a.includes(p));
+  }
+
+  /**
+   * @returns {{ allowed:boolean, requiresConfirmation:boolean, reason?:string }}
+   */
+  function authorize(capability, context = {}) {
+    if (!enabled) {
+      return {
+        allowed: false,
+        requiresConfirmation: false,
+        reason:
+          "computer-use is disabled — enable it explicitly (cc mcp computer-use --enable)",
+      };
+    }
+    if (!COMPUTER_USE_CAPABILITIES.includes(capability)) {
+      return {
+        allowed: false,
+        requiresConfirmation: false,
+        reason: `unknown capability: ${capability}`,
+      };
+    }
+    if (!caps.has(capability)) {
+      return {
+        allowed: false,
+        requiresConfirmation: false,
+        reason: `capability "${capability}" is not enabled for this session`,
+      };
+    }
+
+    const app = context.app || context.window || null;
+
+    // App allowlist applies to app-targeted verbs (input + launch). Pure
+    // observation (screenshot / window_list / clipboard_read) is not app-scoped.
+    if (allowlist && (INPUT_VERBS.has(capability) || app)) {
+      const target = String(app || context.target || "").toLowerCase();
+      if (!target) {
+        return {
+          allowed: false,
+          requiresConfirmation: false,
+          reason: `capability "${capability}" needs a target app while an allowlist is configured`,
+        };
+      }
+      const ok = allowlist.some(
+        (a) => target.includes(a) || a.includes(target),
+      );
+      if (!ok) {
+        return {
+          allowed: false,
+          requiresConfirmation: false,
+          reason: `app "${app || context.target}" is not in the computer-use allowlist`,
+        };
+      }
+    }
+
+    // High-risk apps and input verbs (or confirmAll) require confirmation.
+    const highRiskApp = isHighRiskApp(app);
+    const requiresConfirmation =
+      confirmAll || highRiskApp || INPUT_VERBS.has(capability);
+    return {
+      allowed: true,
+      requiresConfirmation,
+      reason: highRiskApp
+        ? `high-risk app (${app}) — confirmation required`
+        : requiresConfirmation
+          ? `${capability} injects input — confirmation required`
+          : undefined,
+    };
+  }
+
+  return {
+    enabled,
+    capabilities: [...caps],
+    authorize,
+    isHighRiskApp,
+  };
+}

package/src/lib/computer-use/computer-use-server.js

@@ -0,0 +1,276 @@
+/**
+ * Computer-use MCP server (gap-2026-07-11 P1#6) — exposes GUI control verbs to
+ * an MCP client, gated by the authorization core (authorization.js) and driven
+ * by an OS backend (control-backend.js). Streamable-HTTP MCP, same transport
+ * shape as `cc mcp serve`: POST JSON-RPC → application/json.
+ *
+ * Every tools/call runs through the authorizer first. A verb the authorizer
+ * marks `requiresConfirmation` is refused unless the caller supplied
+ * `confirm: true` in the tool args (the MCP client's approval surface / the
+ * agent's confirm flow owns the human check) — an unattended agent can never
+ * silently click a high-risk app.
+ */
+
+import http from "node:http";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import {
+  createAuthorizer,
+  COMPUTER_USE_CAPABILITIES,
+  TOOL_PRIORITY,
+} from "./authorization.js";
+import { createWindowsBackend } from "./control-backend.js";
+
+const rpcResult = (id, result) =>
+  JSON.stringify({ jsonrpc: "2.0", id, result });
+const rpcError = (id, code, message) =>
+  JSON.stringify({ jsonrpc: "2.0", id, error: { code, message } });
+const ok = (data) => ({
+  content: [{ type: "text", text: JSON.stringify(data) }],
+});
+const fail = (msg) => ({
+  content: [{ type: "text", text: msg }],
+  isError: true,
+});
+
+function bearerMatches(authHeader, token) {
+  const m = /^Bearer\s+(.+)$/.exec(String(authHeader || ""));
+  if (!m) return false;
+  const a = Buffer.from(m[1]);
+  const b = Buffer.from(token);
+  return a.length === b.length && timingSafeEqual(a, b);
+}
+
+const TOOL_SCHEMAS = {
+  computer_screenshot: {
+    description: "Capture the screen to a PNG (read-only observation).",
+    inputSchema: { type: "object", properties: {} },
+  },
+  computer_window_list: {
+    description: "List visible windows (pid, app, title).",
+    inputSchema: { type: "object", properties: {} },
+  },
+  computer_clipboard_read: {
+    description: "Read the system clipboard text.",
+    inputSchema: { type: "object", properties: {} },
+  },
+  computer_clipboard_write: {
+    description: "Write text to the system clipboard.",
+    inputSchema: {
+      type: "object",
+      properties: { text: { type: "string" } },
+      required: ["text"],
+    },
+  },
+  computer_click: {
+    description:
+      "Click at screen coordinates (input injection; requires confirm:true for high-risk apps).",
+    inputSchema: {
+      type: "object",
+      properties: {
+        x: { type: "number" },
+        y: { type: "number" },
+        app: { type: "string" },
+        confirm: { type: "boolean" },
+      },
+      required: ["x", "y"],
+    },
+  },
+  computer_type: {
+    description: "Type text into the focused window (input injection).",
+    inputSchema: {
+      type: "object",
+      properties: {
+        text: { type: "string" },
+        app: { type: "string" },
+        confirm: { type: "boolean" },
+      },
+      required: ["text"],
+    },
+  },
+  computer_scroll: {
+    description: "Scroll by N notches (positive up, negative down).",
+    inputSchema: {
+      type: "object",
+      properties: {
+        amount: { type: "number" },
+        app: { type: "string" },
+        confirm: { type: "boolean" },
+      },
+      required: ["amount"],
+    },
+  },
+  computer_app_launch: {
+    description: "Launch an application by path/name.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        app: { type: "string" },
+        args: { type: "array", items: { type: "string" } },
+        confirm: { type: "boolean" },
+      },
+      required: ["app"],
+    },
+  },
+};
+
+const TOOL_CAPABILITY = {
+  computer_screenshot: "screenshot",
+  computer_window_list: "window_list",
+  computer_clipboard_read: "clipboard_read",
+  computer_clipboard_write: "clipboard_write",
+  computer_click: "click",
+  computer_type: "type",
+  computer_scroll: "scroll",
+  computer_app_launch: "app_launch",
+};
+
+/**
+ * Execute one tool call through authorize → confirm-gate → backend.
+ * Pure orchestration (no HTTP) so it is unit-tested directly.
+ */
+export function handleToolCall(name, args = {}, { authorizer, backend }) {
+  const capability = TOOL_CAPABILITY[name];
+  if (!capability) return fail(`unknown tool: ${name}`);
+
+  const context = { app: args.app || null, target: args.app || null };
+  const verdict = authorizer.authorize(capability, context);
+  if (!verdict.allowed) return fail(`[computer-use denied] ${verdict.reason}`);
+  if (verdict.requiresConfirmation && args.confirm !== true) {
+    return fail(
+      `[computer-use needs confirmation] ${verdict.reason || capability} — re-call with confirm:true after the user approves`,
+    );
+  }
+
+  let result;
+  switch (name) {
+    case "computer_screenshot":
+      result = backend.screenshot(
+        args.path ||
+          join(tmpdir(), `cc-screenshot-${randomBytes(4).toString("hex")}.png`),
+      );
+      break;
+    case "computer_window_list":
+      result = backend.windowList();
+      break;
+    case "computer_clipboard_read":
+      result = backend.clipboardRead();
+      break;
+    case "computer_clipboard_write":
+      result = backend.clipboardWrite(args.text);
+      break;
+    case "computer_click":
+      result = backend.click(args.x, args.y);
+      break;
+    case "computer_type":
+      result = backend.type(args.text);
+      break;
+    case "computer_scroll":
+      result = backend.scroll(args.amount);
+      break;
+    case "computer_app_launch":
+      result = backend.appLaunch(args.app, args.args || []);
+      break;
+    default:
+      return fail(`unhandled tool: ${name}`);
+  }
+  return result.ok ? ok(result) : fail(result.error || `${name} failed`);
+}
+
+export function availableTools(authorizer) {
+  return Object.entries(TOOL_SCHEMAS)
+    .filter(([name]) => authorizer.capabilities.includes(TOOL_CAPABILITY[name]))
+    .map(([name, t]) => ({
+      name,
+      description: t.description,
+      inputSchema: t.inputSchema,
+    }));
+}
+
+export function startComputerUseServer(opts = {}) {
+  const authorizer = createAuthorizer({
+    enabled: true, // starting the server IS the explicit opt-in
+    ...opts.config,
+  });
+  const backend = opts.backend || createWindowsBackend();
+  const token =
+    opts.token === false ? null : opts.token || randomBytes(16).toString("hex");
+
+  const server = http.createServer((req, res) => {
+    const send = (status, body) => {
+      res.writeHead(status, { "Content-Type": "application/json" });
+      res.end(body);
+    };
+    if (req.method !== "POST")
+      return send(405, rpcError(null, -32600, "POST only"));
+    if (token && !bearerMatches(req.headers.authorization, token)) {
+      return send(401, rpcError(null, -32001, "unauthorized"));
+    }
+    let raw = "";
+    let bytes = 0;
+    let aborted = false;
+    req.on("data", (c) => {
+      if (aborted) return;
+      bytes += c.length;
+      if (bytes > 1024 * 1024) {
+        aborted = true;
+        send(413, rpcError(null, -32600, "request too large"));
+        req.destroy();
+      } else raw += c;
+    });
+    req.on("end", () => {
+      if (aborted) return;
+      let msg;
+      try {
+        msg = JSON.parse(raw);
+      } catch {
+        return send(400, rpcError(null, -32700, "parse error"));
+      }
+      const { id, method, params } = msg || {};
+      if (method === "initialize") {
+        return send(
+          200,
+          rpcResult(id, {
+            protocolVersion: params?.protocolVersion || "2025-03-26",
+            capabilities: { tools: {} },
+            serverInfo: { name: "cc-computer-use", version: "1.0.0" },
+            instructions: `Tool priority (prefer the cheapest, most auditable): ${TOOL_PRIORITY.join(" > ")}. Input verbs need confirm:true.`,
+          }),
+        );
+      }
+      if (method === "notifications/initialized") {
+        res.writeHead(202);
+        return res.end();
+      }
+      if (method === "tools/list") {
+        return send(200, rpcResult(id, { tools: availableTools(authorizer) }));
+      }
+      if (method === "tools/call") {
+        const result = handleToolCall(params?.name, params?.arguments || {}, {
+          authorizer,
+          backend,
+        });
+        return send(200, rpcResult(id, result));
+      }
+      return send(200, rpcError(id, -32601, `unknown method: ${method}`));
+    });
+  });
+
+  return new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(opts.port || 0, "127.0.0.1", () => {
+      const port = server.address().port;
+      resolve({
+        server,
+        port,
+        token,
+        url: `http://127.0.0.1:${port}`,
+        capabilities: authorizer.capabilities,
+        stop: () => new Promise((r) => server.close(() => r())),
+      });
+    });
+  });
+}
+
+export { COMPUTER_USE_CAPABILITIES };

package/src/lib/computer-use/control-backend.js

@@ -0,0 +1,150 @@
+/**
+ * Computer-use OS control backend. The default backend drives Windows via
+ * PowerShell + .NET (System.Windows.Forms / System.Drawing) with zero npm
+ * deps; every primitive is a small injectable `runPowerShell` call so the
+ * server logic is testable without a display. POSIX support is a documented
+ * gap (returns an unsupported error) — the Windows-first host matches the
+ * project's U-Key/hardware posture.
+ */
+
+import { spawnSync } from "node:child_process";
+
+export const _deps = { spawnSync, platform: () => process.platform };
+
+/** Run a PowerShell script, returning { ok, stdout, stderr }. */
+function runPowerShell(script, deps = _deps) {
+  const res = deps.spawnSync(
+    "powershell.exe",
+    ["-NoProfile", "-NonInteractive", "-Command", script],
+    { encoding: "utf-8", windowsHide: true, maxBuffer: 16 * 1024 * 1024 },
+  );
+  if (res.error) return { ok: false, stdout: "", stderr: res.error.message };
+  return {
+    ok: res.status === 0,
+    stdout: String(res.stdout || ""),
+    stderr: String(res.stderr || ""),
+  };
+}
+
+// PowerShell script fragments kept as constants so tests can assert the backend
+// dispatches the right one per verb without a real display.
+export const PS = {
+  screenshot: (outPath) => `
+Add-Type -AssemblyName System.Windows.Forms,System.Drawing
+$b = [System.Windows.Forms.SystemInformation]::VirtualScreen
+$bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height)
+$g = [System.Drawing.Graphics]::FromImage($bmp)
+$g.CopyFromScreen($b.X, $b.Y, 0, 0, $bmp.Size)
+$bmp.Save(${JSON.stringify(outPath)}, [System.Drawing.Imaging.ImageFormat]::Png)
+Write-Output "$($b.Width)x$($b.Height)"`,
+  windowList: `
+Get-Process | Where-Object { $_.MainWindowTitle } |
+  Select-Object -Property Id, ProcessName, MainWindowTitle |
+  ConvertTo-Json -Compress`,
+  clipboardRead: `Get-Clipboard -Raw`,
+  clipboardWrite: (text) =>
+    `Set-Clipboard -Value ${JSON.stringify(String(text))}`,
+  click: (x, y) => `
+Add-Type -AssemblyName System.Windows.Forms
+[System.Windows.Forms.Cursor]::Position = New-Object System.Drawing.Point(${Number(x)}, ${Number(y)})
+Add-Type -MemberDefinition '[DllImport("user32.dll")] public static extern void mouse_event(int f,int dx,int dy,int d,int e);' -Name U -Namespace W
+[W.U]::mouse_event(0x02,0,0,0,0); [W.U]::mouse_event(0x04,0,0,0,0)`,
+  type: (text) => `
+Add-Type -AssemblyName System.Windows.Forms
+[System.Windows.Forms.SendKeys]::SendWait(${JSON.stringify(escapeSendKeys(String(text)))})`,
+  scroll: (amount) => `
+Add-Type -MemberDefinition '[DllImport("user32.dll")] public static extern void mouse_event(int f,int dx,int dy,int d,int e);' -Name S -Namespace W
+[W.S]::mouse_event(0x0800,0,0,${Number(amount) * 120},0)`,
+};
+
+/** SendKeys treats +^%~(){}[] as control chars — escape literals in braces. */
+export function escapeSendKeys(text) {
+  return text.replace(/[+^%~(){}\[\]]/g, (ch) => `{${ch}}`);
+}
+
+export function createWindowsBackend(deps = _deps) {
+  const ps = (script) => runPowerShell(script, deps);
+  const unsupported = (verb) => ({
+    ok: false,
+    error: `computer-use ${verb} is only implemented on Windows in this build`,
+  });
+  const guard = (verb, fn) =>
+    deps.platform() === "win32" ? fn() : unsupported(verb);
+
+  return {
+    platform: deps.platform(),
+    screenshot(outPath) {
+      return guard("screenshot", () => {
+        const r = ps(PS.screenshot(outPath));
+        return r.ok
+          ? { ok: true, path: outPath, size: r.stdout.trim() }
+          : { ok: false, error: r.stderr || "screenshot failed" };
+      });
+    },
+    windowList() {
+      return guard("window_list", () => {
+        const r = ps(PS.windowList);
+        if (!r.ok)
+          return { ok: false, error: r.stderr || "window list failed" };
+        try {
+          const parsed = r.stdout.trim() ? JSON.parse(r.stdout) : [];
+          const rows = Array.isArray(parsed) ? parsed : [parsed];
+          return {
+            ok: true,
+            windows: rows.map((w) => ({
+              pid: w.Id,
+              app: w.ProcessName,
+              title: w.MainWindowTitle,
+            })),
+          };
+        } catch {
+          return { ok: false, error: "could not parse window list" };
+        }
+      });
+    },
+    clipboardRead() {
+      return guard("clipboard_read", () => {
+        const r = ps(PS.clipboardRead);
+        return r.ok
+          ? { ok: true, text: r.stdout.replace(/\r?\n$/, "") }
+          : { ok: false, error: r.stderr || "clipboard read failed" };
+      });
+    },
+    clipboardWrite(text) {
+      return guard("clipboard_write", () => {
+        const r = ps(PS.clipboardWrite(text));
+        return r.ok ? { ok: true } : { ok: false, error: r.stderr };
+      });
+    },
+    click(x, y) {
+      return guard("click", () => {
+        const r = ps(PS.click(x, y));
+        return r.ok ? { ok: true, x, y } : { ok: false, error: r.stderr };
+      });
+    },
+    type(text) {
+      return guard("type", () => {
+        const r = ps(PS.type(text));
+        return r.ok ? { ok: true } : { ok: false, error: r.stderr };
+      });
+    },
+    scroll(amount) {
+      return guard("scroll", () => {
+        const r = ps(PS.scroll(amount));
+        return r.ok ? { ok: true } : { ok: false, error: r.stderr };
+      });
+    },
+    appLaunch(app, args = []) {
+      return guard("app_launch", () => {
+        const res = deps.spawnSync(app, args, {
+          windowsHide: false,
+          detached: true,
+          stdio: "ignore",
+        });
+        return res.error
+          ? { ok: false, error: res.error.message }
+          : { ok: true, app };
+      });
+    },
+  };
+}