codex-computer-use-mcp 0.1.0 → 0.2.0

package/README.md

@@ -1,192 +1,170 @@
 # Codex Computer Use MCP
 
-A local MCP server that lets compatible agents use the official, signed Computer Use broker bundled with the OpenAI ChatGPT macOS app.
+Version 0.2.0 exposes the official signed macOS Computer Use capabilities as direct typed tools for Pi and MCP clients. The calling agent chooses every tool and argument itself.
 
-It exposes all ten typed Computer Use methods while preserving:
+The primary path has:
 
-- official OpenAI code-signing checks;
-- first-party app approvals and sensitive-action prompts;
-- macOS Screen Recording and Accessibility permissions;
-- a deliberately list-only safe default;
-- explicit acknowledgement before broad full-permissions mode;
-- per-app kernel locks;
-- foreground/focus telemetry with fail-closed background guarantees;
-- output schemas, call budgets, timeout and process-group cleanup;
-- sanitized, mode-`0600` metadata audits.
+- no nested model call;
+- no model-generated action plan;
+- no subagent;
+- no prompt sent to Codex;
+- no separate model-token usage.
 
-> **Independent project.** This is not an OpenAI product and is not endorsed by OpenAI. It depends on implementation details in the macOS ChatGPT app and may need updates when that app changes.
+It does use OpenAI's signed `codex app-server` as the official host for the bundled Computer Use MCP client. The current official `mcpServer/tool/call` API requires a loaded thread identifier, so the bridge creates an empty, in-memory, zero-turn context (`ephemeral: true`, `turns: []`, `path: null`). It never calls `turn/start` and fails closed if any `turn/*` or `item/*` model activity appears.
 
-## Important authorization model
+> **Independent project.** This is not an OpenAI product and is not endorsed by OpenAI. The app-server API is marked experimental and fixed ChatGPT bundle paths may change.
 
-The official Computer Use client authenticates its signed parent process. Putting an unsigned local MCP proxy between app-bundled Codex and that client breaks the official sender-authentication boundary. Therefore wrapper checks of a nested model's target and arguments can only observe events **after** the signed client has dispatched them.
+## Direct tools
 
-This project does not pretend that post-dispatch observation is a preventive sandbox:
+Pi registers namespaced tools to avoid collisions with Pi's built-ins. The MCP server exposes the upstream method names.
 
-- **Safe mode permits only `list`.** No target app or mutation is dispatched.
-- **Full-permissions mode broadly authorizes the wrapper to use official Computer Use.** It retains first-party OpenAI/macOS controls and detects target, method, argument, call-budget, focus, and cleanup drift, but detection cannot undo an action already dispatched.
+| Pi tool | MCP method | No-permissions | Purpose |
+|---|---|---:|---|
+| `computer_use_list_apps` | `list_apps` | yes | List apps known to official Computer Use |
+| `computer_use_get_app_state` | `get_app_state` | yes | Read accessibility state and imagery for one app |
+| `computer_use_click` | `click` | yes | Click an element or screenshot coordinates |
+| `computer_use_perform_secondary_action` | `perform_secondary_action` | yes | Invoke a named accessibility action |
+| `computer_use_set_value` | `set_value` | yes | Assign an accessibility value |
+| `computer_use_select_text` | `select_text` | yes | Select text or place the cursor |
+| `computer_use_scroll` | `scroll` | yes | Scroll an element |
+| `computer_use_drag` | `drag` | yes | Drag between screenshot coordinates |
+| `computer_use_press_key` | `press_key` | yes | Send a key or key combination |
+| `computer_use_type_text` | `type_text` | yes | Type literal text |
 
-Do not enable full-permissions if you need the wrapper itself to provide a preventive per-app security boundary.
+Pi—not a nested planner—must call `computer_use_get_app_state`, choose a current element identifier or coordinates, execute one action, and inspect again when needed.
 
-## Requirements
+## Authorization policy: durable no-permissions
 
-- macOS
-- Node.js 22 or newer
-- the official ChatGPT macOS app at `/Applications/ChatGPT.app`
-- a Codex account/session available to the app-bundled Codex CLI
-- required first-party OpenAI app approvals and macOS privacy permissions, completed in their official UI
+`no-permissions` has one precise meaning here: **the wrapper asks no permission questions and exposes all ten official actions**. It is the only mode and the durable default. There is no safe/full selector, config file, environment override, slash command, CLI switch, per-call elevation, app allowlist, intent classifier, task schema, per-action confirmation, special-case app policy, or method gate.
 
-The server never extracts credentials, re-signs or injects into an app, changes TCC permissions, forges sender authentication, or self-accepts first-party approvals.
+The app-server runtime is also created with `approvalPolicy: "never"`. The client does not advertise an elicitation UI. If the official downstream service unexpectedly requests elicitation, the bridge silently declines it; it never opens a prompt and never self-accepts. Any persistent first-party access required by Computer Use must therefore already be configured in the official ChatGPT app.
 
-## Install
+No-permissions does **not** bypass:
 
-### From npm (after a release is published)
+- first-party OpenAI app approvals or sensitive-action prompts;
+- macOS Screen Recording, Accessibility, or TCC controls;
+- strict OpenAI Team ID and code-signature checks;
+- exact upstream ten-tool schema verification;
+- canonical app identity resolution and per-user/per-app kernel locks shared across Pi and MCP state roots;
+- focus telemetry, timeouts, verified process-tree cleanup, or private audit logging.
 
-```bash
-npm install -g codex-computer-use-mcp
-codex-computer-use-mcp --status
-```
+## Why the signed app-server is required
 
-### From source
+Calling the signed `SkyComputerUseClient mcp` binary directly from an ordinary Pi/Node parent successfully initializes and lists all ten schemas, but real calls are rejected with:
 
-```bash
-git clone https://github.com/tmustier/codex-computer-use-mcp.git
-cd codex-computer-use-mcp
-npm ci
-npm test
-npm run build
-node dist/mcp-server.js --status
+```text
+Computer Use server error -10000: Sender process is not authenticated
 ```
 
-Running `codex-computer-use-mcp` with no arguments starts the stdio MCP server.
-
-## Tools
-
-### `background_computer_use`
+OpenAI's app-server exposes a documented `mcpServer/tool/call` endpoint. That endpoint calls a configured MCP tool directly; no model turn is required. Running it from the signed app-bundled binary preserves the official responsible-process/authentication chain without injection, re-signing, TCC changes, private socket emulation, or credential extraction.
 
-| Mode | Purpose | Permission mode |
-|---|---|---|
-| `list` | List apps visible to official Computer Use | Safe or full |
-| `inspect` | Read one app | Full only |
-| `act` | Perform a concrete app task | Full only |
-| `dictionary_lookup` | Constrained local Apple Dictionary workflow | Full only |
+See [`ARCHITECTURE.md`](ARCHITECTURE.md) for source links and the full restriction inventory.
 
-Optional fields include `cleanup`, `cleanup_instructions`, and `required_capabilities`. The latter can require observed successful use of official methods:
+## Requirements
 
-`list_apps`, `get_app_state`, `click`, `perform_secondary_action`, `set_value`, `select_text`, `scroll`, `drag`, `press_key`, `type_text`.
+- macOS
+- Node.js 22 or newer
+- official ChatGPT macOS app at `/Applications/ChatGPT.app`
+- official Computer Use component installed and its first-party permissions configured
 
-### `background_computer_use_status`
+The direct bridge starts app-server with a new private `CODEX_HOME` containing no account credentials and only one configured MCP server: official Computer Use. It does not inherit the user's Codex MCP servers, plugins, history, memories, API keys, or auth file. It selects a non-websocket dummy model provider bound to unreachable loopback, disables plugin/remote-control features, and never starts a turn; this prevents app-server model prewarm or Responses API traffic.
 
-Returns the permission mode, state/audit locations, broker verification and version, model, approval boundary, and supported methods.
+### Locked-screen limitation
 
-## Permission modes
+Version 0.2.0 supports direct local calls in an unlocked macOS session. It does not support window or accessibility actions after the Mac locks.
 
-### Safe mode (default)
+OpenAI's [locked Computer Use](https://developers.openai.com/codex/app/computer-use#use-computer-use-while-your-mac-is-locked) is limited to active, trusted ChatGPT turns started from a connected device. It does not authorize other apps or local processes to unlock the Mac. This package uses local zero-turn dispatch, so targeted calls can fail with official error `-10005` while the Mac is locked. Support for locked local use remains a follow-up and is not part of version 0.2.0.
 
-Safe mode is intentionally list-only. Targeted requests are rejected and audited before a Codex worker starts.
+## Pi integration
 
-### Full-permissions mode
+Install the exact release from npm:
 
-This broadly authorizes targeted official Computer Use operations. It does **not** bypass official OpenAI approvals, sensitive-action prompts, macOS privacy controls, signing checks, focus monitoring, locks, call budgets, timeout cleanup, or audit logging.
+```bash
+pi install npm:codex-computer-use-mcp@0.2.0
+```
 
-Enable it only with explicit acknowledgement:
+To evaluate a source checkout instead:
 
 ```bash
-codex-computer-use-mcp --configure full-permissions --acknowledge-full-permissions
+npm ci
+npm run build
+pi -ne -e /absolute/path/to/codex-computer-use-mcp/integrations/pi/index.ts
 ```
 
-Return to safe mode:
+Command:
 
-```bash
-codex-computer-use-mcp --configure safe
+```text
+/computer-use-status
 ```
 
-State defaults to `~/.codex-computer-use-mcp`. Override it with `CODEX_COMPUTER_USE_HOME`. Configuration is mode `0600` and audited; an audit failure rolls a mode change back.
+The native Pi adapter is the primary product path. It always registers all ten typed tools directly. It exposes no mode-changing command and no approval UI.
 
-## MCP client configuration
+## MCP server
 
-### Pi native adapter
+Running the binary without arguments starts a stdio MCP server exposing the same ten direct methods plus `computer_use_status`:
 
 ```bash
-pi install npm:codex-computer-use-mcp@0.1.0
+node dist/mcp-server.js
 ```
 
-This registers `background_computer_use`, `/background-computer-use-status`, and `/background-computer-use-mode`.
-
-### Pi MCP gateway
-
-Alternatively add this to `~/.pi/agent/mcp.json`. `directTools: false` keeps the capability intentional instead of injecting it into every turn:
+For Pi's generic MCP gateway, keep `directTools: false` so this powerful surface remains intentional:
 
 ```json
 {
   "mcpServers": {
-    "codex-computer-use": {
-      "command": "npx",
-      "args": ["-y", "codex-computer-use-mcp@0.1.0"],
+    "computer-use": {
+      "command": "node",
+      "args": ["/absolute/path/to/codex-computer-use-mcp/dist/mcp-server.js"],
       "lifecycle": "lazy",
-      "requestTimeoutMs": 360000,
+      "requestTimeoutMs": 180000,
       "directTools": false
     }
   }
 }
 ```
 
-See [`integrations/pi/`](integrations/pi/). Do not load both Pi adapters under the same tool name.
-
-### Claude Desktop
-
-```json
-{
-  "mcpServers": {
-    "codex-computer-use": {
-      "command": "npx",
-      "args": ["-y", "codex-computer-use-mcp@0.1.0"]
-    }
-  }
-}
-```
-
-For a source checkout, replace `npx` and its arguments with `node` and the absolute path to `dist/mcp-server.js`.
-
-## How it works
+The generic MCP server exposes the same no-permissions behavior: no wrapper approval UI and all ten methods. Unexpected downstream elicitations are silently declined; configure persistent first-party app access only in official ChatGPT Computer Use settings.
 
-```text
-MCP client
-  → this local server
-  → ChatGPT.app's signed app-bundled Codex CLI
-  → signed SkyComputerUseClient
-  → official Computer Use service
-  → target macOS app
-```
+## Security and privacy
 
-The nested Codex turn is pinned to `gpt-5.6-sol`; reasoning is `low` for list, `high` for inspect/Dictionary, and `xhigh` for act. It receives a mode-specific tool allowlist, runs with shell/web/remote plugins disabled, and emits a constrained result schema. Streamed events are checked against the requested target, method set, argument constraints, and call budget. These checks are detection and fail-closed completion criteria, not pre-dispatch mediation.
+Each call:
 
-Target apps are background-launched with `open -g`. The server samples frontmost state and consumes global focus notifications. If the target becomes frontmost, completion fails. Unrelated user focus changes are recorded but do not invalidate the operation.
+1. validates typed arguments;
+2. applies the single durable no-permissions policy with no mode or prompt branch;
+3. resolves a target to a canonical installed bundle ID;
+4. acquires a fixed per-user/per-app kernel lock shared across all supported clients and state roots;
+5. starts global focus telemetry;
+6. verifies fixed OpenAI-signed broker/client binaries;
+7. starts a credential-free isolated app-server process tree with model transport disabled;
+8. requires explicit `ephemeral: true`, `turns: []`, and `path: null` attestation;
+9. verifies the exact upstream ten-tool inventory and schemas;
+10. issues exactly one `mcpServer/tool/call`;
+11. rejects any model-turn notification, including during teardown;
+12. combines partial-preserving ancestry enumeration with private-working-directory ownership recovery, then freezes, terminates, and verifies the app-server plus separately grouped or reparented helpers; finally it removes temporary state, releases the lock, and writes a content-safe audit with separate broker/lease cleanup evidence.
 
-## Usage, privacy, and audits
+Focus checks are detection/completion criteria, not a preventive macOS sandbox. If the target becomes frontmost, the call is reported as failed even though an individual official action may already have completed.
 
-Each operation starts a separate Codex turn and consumes separate Codex plan/API usage. Results report token usage.
+Tool results may contain visible target-app text or screenshots because that is the purpose of Computer Use. They return only to the invoking Pi/MCP client. Audits never retain arguments, typed values, screenshots, app-state payloads, result text, prompts, credentials, or tokens—only bounded metadata such as method, canonical/hashed app identity, byte counts, content types, outcome, focus, broker version, and zero-turn evidence.
 
-Audits include timestamps, operation/mode, canonical or hashed app identity, byte counts, outcome, methods, usage, and cleanup/focus results. They do **not** include task text, typed content, screenshots, app-state payloads, or model output. Policy-rejected requests are also audited once a secure state directory is available.
+## State and migration
 
-## Known limitations
+Audit state defaults to `~/.direct-computer-use`; override with `CODEX_COMPUTER_USE_HOME`. Permission policy is not read from that agent-writable path: no-permissions is compiled as the only interface. Legacy `config.json` files are ignored.
 
-- The integration targets fixed bundle paths inside the ChatGPT macOS app.
-- App updates may change bundled paths, CLI flags, plugin schemas, or signing layout.
-- First-party approvals may need completion in an official interactive OpenAI session.
-- Browser-host Computer Use is not exposed; this project targets native macOS apps.
-- In full-permissions mode, a target/method/focus/cleanup failure is detected after streamed events; mutations may already have occurred. Inspect and restore manually before retrying.
-- Secure config-path failures may prevent audit creation because the server refuses to write through an untrusted path.
+See [`MIGRATION.md`](MIGRATION.md) for version 0.1 migration, source acceptance, rollback, and conflict avoidance.
 
 ## Development
 
 ```bash
 npm ci
 npm run check
+npm run check:pi
 npm test
 npm run build
+npm audit --omit=dev
+npm pack --dry-run
 ```
 
-Runtime dependencies are exact-pinned and the published graph is bound by `npm-shrinkwrap.json`.
+Registry dependency tarballs are exact-pinned with integrity and the package includes `npm-shrinkwrap.json`.
 
 See [`PROOF.md`](PROOF.md), [`SECURITY.md`](SECURITY.md), and [`CONTRIBUTING.md`](CONTRIBUTING.md).
 

package/SECURITY.md

@@ -2,37 +2,58 @@
 
 ## Reporting a vulnerability
 
-Do not open a public issue for a vulnerability that could weaken code-signing checks, safe-mode dispatch restrictions, approval boundaries, focus guarantees, audit integrity, or cleanup behavior.
+Do not open a public issue for a vulnerability that could weaken signing, schema verification, permission-mode dispatch, first-party approval handling, app identity, locking, focus telemetry, cleanup, or audit integrity.
 
-Use GitHub's private vulnerability reporting. Include affected versions, the smallest non-sensitive reproduction, expected versus observed behavior, and whether app state changed or cleanup was unverified.
+Use GitHub private vulnerability reporting. Include the affected commit/version, the smallest non-sensitive reproduction, expected versus observed behavior, and whether an official action completed before failure.
 
-Never include credentials, tokens, private/customer content, sensitive screenshots, raw app-state payloads, or private audit files.
+Never include credentials, tokens, customer/private content, sensitive screenshots, raw app-state payloads, elicitation contents, or private audit files.
 
-## Authorization model
+## Architecture boundary
 
-The signed official client authenticates its parent. An unsigned wrapper cannot synchronously proxy each Computer Use call without breaking that official sender-authentication chain. Streamed target, method, argument, call-budget, focus, and cleanup checks therefore occur after dispatch.
+Raw Pi/Node invocation of the signed Computer Use MCP helper is not an authenticated responsible-process path for real calls. The bridge therefore uses the official signed app-server `mcpServer/tool/call` API.
 
-For that reason:
+The API requires a loaded thread ID. The bridge creates an empty, pathless, ephemeral context solely to own the MCP runtime and requires the response to explicitly attest `ephemeral: true`, `path: null`, and `turns: []` before dispatch. It never calls `turn/start`; any `turn/*` or `item/*` event—including one received during teardown—is a fatal architecture violation. The temporary `CODEX_HOME` contains no auth file, API key, user MCPs, plugins, history, memories, or account configuration. A non-websocket dummy model provider points at unreachable loopback, and plugin/remote-control features are disabled, preventing app-server model prewarm and Responses API traffic.
 
-- safe mode is list-only and rejects targeted work before starting Codex;
-- full-permissions mode is broad wrapper authorization, not a preventive per-app sandbox;
-- post-dispatch validation can fail completion and surface cleanup risk, but cannot undo a mutation;
-- official OpenAI app approvals, sensitive-action prompts, and macOS privacy controls remain authoritative.
+This is direct tool dispatch—not model orchestration.
 
 ## Security invariants
 
-1. Only the fixed OpenAI app-bundled Codex and Computer Use client paths may broker a run.
-2. Both binaries must pass strict code-signing verification and OpenAI Team ID checks.
-3. First-party OpenAI and macOS approvals are never self-accepted.
-4. Safe mode dispatches only `list_apps`; every targeted mode fails before worker launch.
-5. Full-permissions mode requires explicit acknowledgement and never claims preventive target isolation.
-6. The target app must not become frontmost; watcher health, queued events, in-flight samples, and final state are checked.
-7. Streamed calls must match the mode allowlist, requested target aliases, argument constraints, and call budget before completion is trusted.
-8. Same-app work remains kernel-excluded.
-9. Timeout and cancellation terminate the full worker process group and retain available partial metadata.
-10. Audits remain private and content-safe; policy rejections are audited, and audit failure is fatal once a secure state path exists.
-11. Runtime dependencies are exact-pinned and published with `npm-shrinkwrap.json`.
+1. Only fixed app-bundled Codex and Computer Use client paths are allowed in production.
+2. Both binaries pass strict code-signature verification and OpenAI Team ID `2DC432GLL2` checks before dispatch.
+3. The helper's exact ten method names and input schemas match the pinned expected inventory before every call.
+4. `no-permissions` is the only wrapper policy: all ten methods are exposed and no wrapper permission prompt is opened.
+5. There is no config file, environment override, command, tool argument, per-call branch, or alternate safe/full route that an agent can select.
+6. App-server uses `approvalPolicy: "never"`; elicitation capability is disabled and unexpected first-party requests are silently declined, never prompted or self-accepted. Persistent official app access remains authoritative and must be configured outside this wrapper.
+7. Target selectors resolve to canonical installed bundle IDs before dispatch.
+8. Same-app work is excluded across native Pi, generic MCP, and custom state roots with one fixed per-user kernel `lockf` lease namespace.
+9. Target focus events, periodic samples, watcher health, queued ASN resolution, and final state are checked. This is post-action detection, not a preventive OS sandbox.
+10. One direct request emits one official `mcpServer/tool/call`; no model turn, subagent, shell, web, plugin, prompt, or reachable model transport is available.
+11. App-server and helper share one private per-call working directory. Cleanup combines strict ancestry enumeration (preserving partial results) with working-directory ownership recovery, freezes processes to a stable set, kills every owned process, awaits stdio closure, and verifies exit. This still finds a helper reparented by an early app-server exit; enumeration/freeze/exit uncertainty is fatal.
+12. Protocol JSONL is bounded before an unterminated line can exceed 8 MB in memory.
+13. Per-call `CODEX_HOME` and work directories are mode-private and recursively removed.
+14. Only validated text/image result blocks cross to the invoking client. No full-result spill file is written.
+15. Audits contain metadata only, including separate `brokerCleanupVerified` and `appLeaseReleased` evidence; lease-release failure changes the audited outcome before surfacing. Arguments, values, screenshots, app-state text, result content, prompts, approvals, credentials, and tokens are forbidden.
+16. Policy rejections are audited; audit failure is fatal once a secure state path exists.
+17. Runtime and development dependency tarballs are exact-pinned with integrity in `npm-shrinkwrap.json`.
+
+## Permission semantics
+
+### No-permissions
+
+All ten official methods and arbitrary resolvable app targets are available without wrapper permission prompts. The name means “ask no permission,” not “disable tools.” This is broad authorization. It does not imply that actions are reversible or that focus detection can prevent an already dispatched action. App-state reads can expose visible sensitive information to the calling model.
+
+The mode is compiled as the sole policy. Agent-writable audit state and legacy configuration files cannot change it, and there is no CLI/slash/tool/environment mode selector.
+
+## Elicitations
+
+Neither Pi nor stdio MCP advertises or renders an approval UI. The bridge starts app-server with `approvalPolicy: "never"`. An unexpected downstream elicitation is counted, silently declined, and never self-accepted. Persistent first-party app access belongs in official ChatGPT Computer Use settings.
+
+## Visible-content warning
+
+Computer Use is designed to return app state and screenshots. Do not point it at apps containing credentials, payment data, private messages, or customer secrets unless the user explicitly requires that context and accepts model exposure. Audit safety does not make target-app content non-sensitive.
 
 ## Supported versions
 
-Only the latest release is supported. Compatibility is evaluated against current ChatGPT macOS releases rather than guaranteed indefinitely.
+Only the latest approved release is supported. Version 0.2.0 supports direct local calls in an unlocked macOS session. Targeted local calls while the Mac is locked are not supported.
+
+App-server is experimental and bundle paths or schemas can change. Drift fails closed until reviewed.

package/dist/audit.d.ts

@@ -1,25 +1,26 @@
+import type { PermissionMode } from "./config.ts";
+import type { DirectMethod } from "./tools.ts";
 export interface AuditRecord {
     timestamp: string;
     runId: string;
-    operation: string;
-    permissionMode: "safe" | "full-permissions";
+    method: DirectMethod | "invalid_request";
+    permissionMode: PermissionMode;
     app: string | null;
     mutating: boolean;
-    cleanupRequested: boolean;
-    userConfirmed: boolean;
-    authorization: "none" | "full_permissions_config";
+    authorization: "no_permissions_unrestricted" | "none";
     inputBytes: number;
     outcome: string;
     durationMs: number;
-    model: string;
-    usage: {
-        input: number;
-        cachedInput: number;
-        output: number;
-    };
-    computerUseCalls: number;
-    computerUseMethods: string[];
+    brokerVersion: string | null;
+    clientBuild: string | null;
+    directCalls: number;
+    modelTurnsStarted: number;
+    ephemeralThread: boolean | null;
+    approvalRequests: number;
     backgroundPreserved: boolean | null;
-    cleanupVerified: boolean | null;
+    brokerCleanupVerified: boolean;
+    appLeaseReleased: boolean;
+    resultContentTypes: string[];
+    resultBytes: number;
 }
 export declare function appendAudit(stateDir: string, record: AuditRecord, fileName?: string): Promise<string>;

package/dist/audit.js

@@ -17,7 +17,7 @@ async function ensurePrivateDirectory(directory) {
     }
     await chmod(directory, 0o700);
 }
-export async function appendAudit(stateDir, record, fileName = "background-computer-use.jsonl") {
+export async function appendAudit(stateDir, record, fileName = "direct-computer-use.jsonl") {
     if (path.basename(fileName) !== fileName)
         throw new Error("Audit filename must not contain a path");
     await ensurePrivateDirectory(stateDir);

package/dist/audit.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit.js","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,IAAI,MAAM,WAAW,CAAC;AAuB7B,KAAK,UAAU,sBAAsB,CAAC,SAAiB;IACtD,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACvH,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACrB,IAAI,KAAK,EAAE,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAC;QAC1C,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACvH,CAAC;IACD,MAAM,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAChC,QAAgB,EAChB,MAAmB,EACnB,QAAQ,GAAG,+BAA+B;IAE1C,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IACpG,MAAM,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC9C,MAAM,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC;IACjG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IACnD,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QAC3E,MAAM,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC9D,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IACrB,CAAC;YAAS,CAAC;QACV,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC"}
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,IAAI,MAAM,WAAW,CAAC;AA4B7B,KAAK,UAAU,sBAAsB,CAAC,SAAiB;IACtD,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACvH,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACrB,IAAI,KAAK,EAAE,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAC;QAC1C,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACvH,CAAC;IACD,MAAM,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAChC,QAAgB,EAChB,MAAmB,EACnB,QAAQ,GAAG,2BAA2B;IAEtC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IACpG,MAAM,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC9C,MAAM,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC;IACjG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IACnD,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QAC3E,MAAM,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC9D,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IACrB,CAAC;YAAS,CAAC;QACV,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC"}

package/dist/config.d.ts

@@ -1,12 +1,12 @@
-import type { PermissionMode } from "./policy.ts";
+export type PermissionMode = "no-permissions";
 export interface ExtensionConfig {
-    version: 1;
+    version: 2;
     permissionMode: PermissionMode;
 }
+/**
+ * The direct interface has one durable policy: no wrapper permission prompts and
+ * no wrapper method restrictions. There is intentionally no file, environment,
+ * command, tool argument, or per-call override that can select another mode.
+ */
 export declare const DEFAULT_CONFIG: ExtensionConfig;
-export declare class ConfigError extends Error {
-    constructor(message: string);
-}
-export declare function configPath(stateDir: string): string;
-export declare function loadConfig(stateDir: string): Promise<ExtensionConfig>;
-export declare function saveConfig(stateDir: string, config: ExtensionConfig): Promise<string>;
+export declare function loadConfig(): Promise<ExtensionConfig>;

package/dist/config.js

@@ -1,105 +1,10 @@
-import { constants } from "node:fs";
-import { chmod, lstat, mkdir, open, rename, rm } from "node:fs/promises";
-import path from "node:path";
-export const DEFAULT_CONFIG = { version: 1, permissionMode: "safe" };
-export class ConfigError extends Error {
-    constructor(message) {
-        super(message);
-        this.name = "ConfigError";
-    }
-}
-export function configPath(stateDir) {
-    return path.join(stateDir, "config.json");
-}
-function parseConfig(value) {
-    if (!value || typeof value !== "object" || Array.isArray(value))
-        throw new ConfigError("Computer Use config must be an object");
-    const record = value;
-    if (Object.keys(record).some((key) => !["version", "permissionMode"].includes(key))) {
-        throw new ConfigError("Computer Use config contains unknown keys");
-    }
-    if (record.version !== 1)
-        throw new ConfigError("Unsupported Computer Use config version");
-    if (record.permissionMode !== "safe" && record.permissionMode !== "full-permissions") {
-        throw new ConfigError("permissionMode must be safe or full-permissions");
-    }
-    return { version: 1, permissionMode: record.permissionMode };
-}
-async function inspectStateDirectory(stateDir, create) {
-    try {
-        const info = await lstat(stateDir);
-        if (info.isSymbolicLink() || !info.isDirectory())
-            throw new ConfigError("Computer Use state must be a non-symlink directory");
-        if ((info.mode & 0o022) !== 0)
-            throw new ConfigError("Computer Use state directory must not be group/world writable");
-        return true;
-    }
-    catch (error) {
-        if (error?.code !== "ENOENT")
-            throw error;
-        if (!create)
-            return false;
-        await mkdir(stateDir, { recursive: true, mode: 0o700 });
-        const info = await lstat(stateDir);
-        if (info.isSymbolicLink() || !info.isDirectory())
-            throw new ConfigError("Computer Use state must be a non-symlink directory");
-        await chmod(stateDir, 0o700);
-        return true;
-    }
-}
-export async function loadConfig(stateDir) {
-    if (!(await inspectStateDirectory(stateDir, false)))
-        return { ...DEFAULT_CONFIG };
-    const file = configPath(stateDir);
-    let handle;
-    try {
-        handle = await open(file, constants.O_RDONLY | constants.O_NOFOLLOW);
-        const info = await handle.stat();
-        if (!info.isFile())
-            throw new ConfigError("Computer Use config must be a regular non-symlink file");
-        if ((info.mode & 0o777) !== 0o600)
-            throw new ConfigError("Computer Use config must have mode 0600");
-        return parseConfig(JSON.parse(await handle.readFile("utf8")));
-    }
-    catch (error) {
-        if (error?.code === "ENOENT")
-            return { ...DEFAULT_CONFIG };
-        if (error instanceof ConfigError)
-            throw error;
-        throw new ConfigError("Could not read the Computer Use config");
-    }
-    finally {
-        await handle?.close().catch(() => undefined);
-    }
-}
-export async function saveConfig(stateDir, config) {
-    const validated = parseConfig(config);
-    await inspectStateDirectory(stateDir, true);
-    await chmod(stateDir, 0o700);
-    const destination = configPath(stateDir);
-    const temporary = path.join(stateDir, `.config.${process.pid}.${Date.now()}.tmp`);
-    let handle;
-    try {
-        const flags = constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW;
-        handle = await open(temporary, flags, 0o600);
-        await handle.chmod(0o600);
-        await handle.writeFile(`${JSON.stringify(validated, null, 2)}\n`, "utf8");
-        await handle.sync();
-        await handle.close();
-        handle = undefined;
-        await rename(temporary, destination);
-        const directory = await open(stateDir, constants.O_RDONLY | constants.O_NOFOLLOW);
-        try {
-            await directory.sync();
-        }
-        finally {
-            await directory.close();
-        }
-        return destination;
-    }
-    finally {
-        await handle?.close().catch(() => undefined);
-        await rm(temporary, { force: true });
-    }
+/**
+ * The direct interface has one durable policy: no wrapper permission prompts and
+ * no wrapper method restrictions. There is intentionally no file, environment,
+ * command, tool argument, or per-call override that can select another mode.
+ */
+export const DEFAULT_CONFIG = { version: 2, permissionMode: "no-permissions" };
+export async function loadConfig() {
+    return { ...DEFAULT_CONFIG };
 }
 //# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,IAAI,MAAM,WAAW,CAAC;AAQ7B,MAAM,CAAC,MAAM,cAAc,GAAoB,EAAE,OAAO,EAAE,CAAC,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC;AAEtF,MAAM,OAAO,WAAY,SAAQ,KAAK;IACrC,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC3B,CAAC;CACD;AAED,MAAM,UAAU,UAAU,CAAC,QAAgB;IAC1C,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IAClC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,WAAW,CAAC,uCAAuC,CAAC,CAAC;IAChI,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QACrF,MAAM,IAAI,WAAW,CAAC,2CAA2C,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC;QAAE,MAAM,IAAI,WAAW,CAAC,yCAAyC,CAAC,CAAC;IAC3F,IAAI,MAAM,CAAC,cAAc,KAAK,MAAM,IAAI,MAAM,CAAC,cAAc,KAAK,kBAAkB,EAAE,CAAC;QACtF,MAAM,IAAI,WAAW,CAAC,iDAAiD,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC;AAC9D,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,QAAgB,EAAE,MAAe;IACrE,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YAAE,MAAM,IAAI,WAAW,CAAC,oDAAoD,CAAC,CAAC;QAC9H,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,WAAW,CAAC,+DAA+D,CAAC,CAAC;QACtH,OAAO,IAAI,CAAC;IACb,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACrB,IAAI,KAAK,EAAE,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAC;QAC1C,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACxD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YAAE,MAAM,IAAI,WAAW,CAAC,oDAAoD,CAAC,CAAC;QAC9H,MAAM,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC7B,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,QAAgB;IAChD,IAAI,CAAC,CAAC,MAAM,qBAAqB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,GAAG,cAAc,EAAE,CAAC;IAClF,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,MAAoD,CAAC;IACzD,IAAI,CAAC;QACJ,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;QACrE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YAAE,MAAM,IAAI,WAAW,CAAC,wDAAwD,CAAC,CAAC;QACpG,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,KAAK;YAAE,MAAM,IAAI,WAAW,CAAC,yCAAyC,CAAC,CAAC;QACpG,OAAO,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACrB,IAAI,KAAK,EAAE,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,GAAG,cAAc,EAAE,CAAC;QAC3D,IAAI,KAAK,YAAY,WAAW;YAAE,MAAM,KAAK,CAAC;QAC9C,MAAM,IAAI,WAAW,CAAC,wCAAwC,CAAC,CAAC;IACjE,CAAC;YAAS,CAAC;QACV,MAAM,MAAM,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC9C,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,QAAgB,EAAE,MAAuB;IACzE,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,qBAAqB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC5C,MAAM,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC7B,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAClF,IAAI,MAAoD,CAAC;IACzD,IAAI,CAAC;QACJ,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,UAAU,CAAC;QAC/F,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAC7C,MAAM,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1E,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,GAAG,SAAS,CAAC;QACnB,MAAM,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QACrC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;QAClF,IAAI,CAAC;YACJ,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC;QACxB,CAAC;gBAAS,CAAC;YACV,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;QACzB,CAAC;QACD,OAAO,WAAW,CAAC;IACpB,CAAC;YAAS,CAAC;QACV,MAAM,MAAM,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC7C,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;AACF,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAOA;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAoB,EAAE,OAAO,EAAE,CAAC,EAAE,cAAc,EAAE,gBAAgB,EAAE,CAAC;AAEhG,MAAM,CAAC,KAAK,UAAU,UAAU;IAC/B,OAAO,EAAE,GAAG,cAAc,EAAE,CAAC;AAC9B,CAAC"}