codex-computer-use-mcp 0.3.3 → 0.4.0

package/README.md

@@ -1,95 +1,45 @@
 # Codex Computer Use MCP
 
-Version 0.3.3 exposes the official signed macOS Computer Use capabilities as direct typed tools for Pi and MCP clients. The calling agent chooses every tool and argument itself.
+Expose OpenAI's official signed macOS Computer Use tools directly to Pi and MCP clients. The calling agent chooses each method and its arguments. This package runs no nested model and generates no action plan.
 
-The primary path has:
-
-- no nested model call;
-- no model-generated action plan;
-- no subagent;
-- no prompt sent to Codex;
-- no separate model-token usage.
-
-It does use OpenAI's signed `codex app-server` as the official host for the bundled Computer Use MCP client. The current official `mcpServer/tool/call` API requires a loaded thread identifier, so the bridge creates an empty, in-memory, zero-turn context (`ephemeral: true`, `turns: []`, `path: null`). It never calls `turn/start` and fails closed if any `turn/*` or `item/*` model activity appears.
-
-> **Independent project.** This is not an OpenAI product and is not endorsed by OpenAI. The app-server API is marked experimental and ChatGPT's reviewed component locations may change.
-
-## Direct tools
-
-Pi registers namespaced tools to avoid collisions with Pi's built-ins. The MCP server exposes the upstream method names.
-
-| Pi tool | MCP method | No-permissions | Purpose |
-|---|---|---:|---|
-| `computer_use_list_apps` | `list_apps` | yes | List running and recently used apps |
-| `computer_use_get_app_state` | `get_app_state` | yes | Read the key-window screenshot and accessibility tree |
-| `computer_use_click` | `click` | yes | Click an element or screenshot coordinates |
-| `computer_use_perform_secondary_action` | `perform_secondary_action` | yes | Invoke a named accessibility action |
-| `computer_use_set_value` | `set_value` | yes | Assign an accessibility value |
-| `computer_use_select_text` | `select_text` | yes | Select text or place the cursor |
-| `computer_use_scroll` | `scroll` | yes | Scroll an element |
-| `computer_use_drag` | `drag` | yes | Drag between screenshot coordinates |
-| `computer_use_press_key` | `press_key` | yes | Send a key or key combination |
-| `computer_use_type_text` | `type_text` | yes | Type literal text |
-
-The MCP façade preserves the official signed helper's tool descriptions, input schemas, and annotations exactly. The Pi façade preserves its descriptions and input schemas; Pi's tool API does not expose MCP annotations. In particular, all ten MCP methods have `destructiveHint: false`; the wrapper does not conflate changing UI state with destructive behavior or add argument restrictions absent from the official schemas.
-
-Pi registers and activates all ten definitions together in every fresh session, while preserving active tools owned by Pi and other extensions. This prevents interaction methods from being absent or loaded through an incompatible provider binding.
-
-As the official contract specifies, Pi—not a nested planner—calls `computer_use_get_app_state` once per assistant turn before interacting with an app, then chooses and executes actions itself. The adapter retains one verified app-server runtime and signed Computer Use client for that inspection-action pair, so the action reuses the official active-app session established by `get_app_state`. It closes and verifies the retained process tree after the action, when a new inspection supersedes it, or on Pi session shutdown.
-
-## Authorization policy: durable no-permissions
-
-`no-permissions` has one precise meaning here: **the wrapper asks no permission questions and exposes all ten official actions**. It is the only mode and the durable default. There is no safe/full selector, config file, environment override, slash command, CLI switch, per-call elevation, app allowlist, intent classifier, task schema, per-action confirmation, special-case app policy, or method gate.
-
-The app-server runtime uses the official Full access combination: `approvalPolicy: "never"` and `sandbox: "danger-full-access"`. In the pinned Codex host, that maps to a disabled permission profile and automatically accepts empty-schema MCP approval elicitations. Normal Computer Use app-access checks therefore proceed without a per-app prompt, just as they do in Codex Full access. The bridge does not edit the service's persistent per-bundle approval file. If app-server emits an elicitation instead of resolving it under Full access, the bridge still forwards it faithfully to the invoking client; unsupported clients return `cancel`, never a fabricated `accept` or `decline`.
-
-No-permissions leaves the official and transport requirements unchanged:
-
-- macOS Screen Recording, Accessibility, and TCC controls remain authoritative;
-- the adapter still selects and verifies the official signed components required for the supported transport;
-- the wrapper verifies compatibility with the upstream ten-tool contract.
-
-The current release also retains behavior from the earlier background-computer-use wrapper. This includes canonical app resolution, per-user/per-app coordination, focus completion telemetry, process cleanup, and metadata-only audit. These provide compatibility, lifecycle management, and observability. They do not provide extra authorization or a sandbox. Do not use them as a foundation for more wrapper safeguards.
-
-## Why the signed app-server is required
-
-Calling the signed `SkyComputerUseClient mcp` binary directly from an ordinary Pi/Node parent successfully initializes and lists all ten schemas, but real calls are rejected with:
-
-```text
-Computer Use server error -10000: Sender process is not authenticated
-```
-
-OpenAI's app-server exposes a documented `mcpServer/tool/call` endpoint. That endpoint calls a configured MCP tool directly; no model turn is required. Running it from the signed app-bundled binary preserves the official responsible-process/authentication chain without injection, re-signing, TCC changes, private socket emulation, or credential extraction.
-
-See [`ARCHITECTURE.md`](ARCHITECTURE.md) for source links and the full restriction inventory.
+OpenAI does not produce or endorse this independent project. It relies on an experimental app-server API and installed ChatGPT components that may change.
 
 ## Requirements
 
-- macOS
+- macOS with an unlocked user session
 - Node.js 22 or newer
-- Pi 0.80.7 or newer
-- official ChatGPT macOS app at `/Applications/ChatGPT.app`
-- official Computer Use component installed by ChatGPT under `~/.codex/computer-use/`
-
-The bridge follows ChatGPT's current launcher contract for `SkyComputerUseClient` under that per-user component directory. It does not honor `HOME`, `CODEX_HOME`, or an arbitrary path override when resolving the production client. The former exact app-in-plugin layout remains a strict compatibility candidate only when the current component is absent. Every selected client must be at a canonical reviewed path, pass strict code-signature verification, and carry OpenAI Team ID `2DC432GLL2`.
+- the official ChatGPT macOS app at `/Applications/ChatGPT.app`
+- the Computer Use component installed by ChatGPT under `~/.codex/computer-use/`
+- Pi 0.80.7 or newer when using the Pi integration
 
-The direct bridge starts app-server with a new private `CODEX_HOME` containing no account credentials and only one configured MCP server: official Computer Use. It does not inherit the user's Codex MCP servers, plugins, history, memories, API keys, or auth file. It selects a non-websocket dummy model provider bound to unreachable loopback, disables plugin/remote-control features, and never starts a turn; this prevents app-server model prewarm or Responses API traffic.
+macOS Screen Recording, Accessibility and TCC controls still apply.
 
-### Locked-screen limitation
+## Pi
 
-Version 0.3.3 supports direct local calls in an unlocked macOS session. It does not support window or accessibility actions after the Mac locks.
+Install from npm:
 
-OpenAI's [locked Computer Use](https://developers.openai.com/codex/app/computer-use#use-computer-use-while-your-mac-is-locked) is limited to active, trusted ChatGPT turns started from a connected device. It does not authorize other apps or local processes to unlock the Mac. This package uses local zero-turn dispatch, so targeted calls can fail with official error `-10005` while the Mac is locked. Support for locked local use remains a follow-up and is not part of version 0.3.3.
-
-## Pi integration
+```bash
+pi install npm:codex-computer-use-mcp
+```
 
-Install the exact release from npm:
+The extension registers and activates these tools:
 
-```bash
-pi install npm:codex-computer-use-mcp@0.3.3
+```text
+computer_use_list_apps
+computer_use_get_app_state
+computer_use_click
+computer_use_perform_secondary_action
+computer_use_set_value
+computer_use_select_text
+computer_use_scroll
+computer_use_drag
+computer_use_press_key
+computer_use_type_text
 ```
 
-To evaluate a source checkout instead:
+Use `/computer-use-status` to inspect the installed component and transport status.
+
+To run a source checkout:
 
 ```bash
 npm ci
@@ -97,30 +47,22 @@ npm run build
 pi -ne -e /absolute/path/to/codex-computer-use-mcp/integrations/pi/index.ts
 ```
 
-Command:
-
-```text
-/computer-use-status
-```
-
-The native Pi adapter is the primary product path. It registers and activates all ten typed tools directly, and routes the required `get_app_state` and following action through one retained signed-client session. It exposes no mode-changing command or wrapper-generated approval UI. Official app-access approval elicitations are resolved by Codex Full access before they reach Pi. Any elicitation that app-server does emit is shown through Pi's UI, and only the user's choice is returned to the service.
+## MCP
 
-## MCP server
-
-Running the binary without arguments starts a stdio MCP server exposing the same ten direct methods plus `computer_use_status`:
+Running the package binary starts a stdio MCP server with the same ten methods and `computer_use_status`:
 
 ```bash
-node dist/mcp-server.js
+npx codex-computer-use-mcp
 ```
 
-For Pi's generic MCP gateway, keep `directTools: false` so this powerful surface remains intentional:
+Example Pi MCP configuration:
 
 ```json
 {
   "mcpServers": {
     "computer-use": {
-      "command": "node",
-      "args": ["/absolute/path/to/codex-computer-use-mcp/dist/mcp-server.js"],
+      "command": "npx",
+      "args": ["codex-computer-use-mcp"],
       "lifecycle": "lazy",
       "requestTimeoutMs": 180000,
       "directTools": false
@@ -129,34 +71,15 @@ For Pi's generic MCP gateway, keep `directTools: false` so this powerful surface
 }
 ```
 
-The generic MCP server exposes the same no-permissions behavior: official Codex Full access, no wrapper permission gate, and all ten methods. App-access approvals are resolved inside the official host. Any standard form or URL elicitation that app-server emits is forwarded as an MCP `elicitation/create` request. The upstream client response is returned unchanged; unsupported or headless clients cancel rather than fabricate a decision.
-
-## Execution and privacy
+## Behaviour
 
-For the current released implementation, each call:
+The adapter has one mode. All ten official methods are available without wrapper permission prompts. It adds no app allowlist, action gate, intent classifier, selector rewrite or focus policy. App-server uses Codex Full access. The adapter forwards any elicitation that the official host still emits.
 
-1. validates typed arguments;
-2. applies the single durable no-permissions policy with no mode or prompt branch;
-3. resolves a target to a canonical installed bundle ID;
-4. acquires a fixed per-user/per-app kernel lock shared across all supported clients and state roots;
-5. starts global focus telemetry;
-6. verifies fixed OpenAI-signed broker/client binaries;
-7. starts a credential-free isolated app-server process tree with model transport disabled;
-8. requires explicit `ephemeral: true`, `turns: []`, and `path: null` attestation;
-9. verifies the exact upstream ten-tool inventory and schemas;
-10. issues exactly one `mcpServer/tool/call`;
-11. rejects any model-turn notification, including during teardown;
-12. combines partial-preserving ancestry enumeration with private-working-directory ownership recovery, then freezes, terminates, and verifies the app-server plus separately grouped or reparented helpers; finally it removes temporary state, releases the lock, and writes a content-safe audit with separate broker/lease cleanup evidence.
+Production calls require verified OpenAI-signed app-server and Computer Use binaries with Team ID `2DC432GLL2`. The adapter uses an isolated, credential-free app-server context. It rejects any model-turn activity. Calls after `get_app_state` reuse the signed session, preserving element identifiers and official app state.
 
-Focus telemetry is legacy completion behavior from the earlier background-computer-use wrapper. It does not provide an official Codex access control or a preventive macOS sandbox. The current release reports the call as failed if the target becomes frontmost. An individual official action may already have completed. Do not use this telemetry as a reason to add further defensive policy.
+Audit records contain bounded metadata. They exclude arguments, app content, screenshots, prompts and credentials. MCP and CLI state defaults to `~/.direct-computer-use`. Pi state defaults to `direct-computer-use` under the Pi agent directory. Set `CODEX_COMPUTER_USE_HOME` to override either default.
 
-Tool results may contain visible target-app text or screenshots because that is the purpose of Computer Use. They return only to the invoking Pi/MCP client. Audits never retain arguments, typed values, screenshots, app-state payloads, result text, prompts, credentials, or tokens—only bounded metadata such as method, canonical/hashed app identity, byte counts, content types, outcome, focus, broker version, and zero-turn evidence.
-
-## State and migration
-
-Audit state defaults to `~/.direct-computer-use`; override with `CODEX_COMPUTER_USE_HOME`. Permission policy is not read from that agent-writable path: no-permissions is compiled as the only interface. Legacy `config.json` files are ignored.
-
-See [`MIGRATION.md`](MIGRATION.md) for version 0.1 migration, source acceptance, rollback, and conflict avoidance.
+Pi limits returned text to 50KB or 2,000 lines. When text exceeds that limit, the complete text is written to a mode-0600 file in a private directory under `/tmp`. Images are returned directly and are never spilled to disk.
 
 ## Development
 
@@ -166,14 +89,8 @@ npm run check
 npm run check:pi
 npm test
 npm run build
-npm audit --omit=dev
-npm pack --dry-run
 ```
 
-Registry dependency tarballs are exact-pinned with integrity and the package includes `npm-shrinkwrap.json`.
-
-See [`CHANGELOG.md`](CHANGELOG.md), [`PROOF.md`](PROOF.md), [`SECURITY.md`](SECURITY.md), and [`CONTRIBUTING.md`](CONTRIBUTING.md). Agent contributors must also follow [`AGENTS.md`](AGENTS.md). It records the maintainer's thin-adapter intent and review standard.
-
 ## License
 
 MIT

package/SECURITY.md

@@ -1,69 +1,11 @@
 # Security policy
 
-## Reporting a vulnerability
-
-Do not open a public issue for a concrete vulnerability in the supported production path. This includes realistic paths to untrusted component execution, unauthorized wrapper dispatch, credential or result-content exposure, or materially false completion reporting.
-
-Use GitHub private vulnerability reporting. Include the affected commit and version, a small non-sensitive reproduction, and the expected and observed behavior. Provide evidence that the path is realistically reachable. State whether an official action completed before failure. Speculative hardening ideas without a reachable material effect are not vulnerability reports.
-
-Never include credentials, tokens, customer/private content, sensitive screenshots, raw app-state payloads, elicitation contents, or private audit files.
-
-## Architecture boundary
-
-Raw Pi/Node invocation of the signed Computer Use MCP helper is not an authenticated responsible-process path for real calls. The bridge therefore uses the official signed app-server `mcpServer/tool/call` API.
-
-The API requires a loaded thread ID. The bridge creates an empty, pathless, ephemeral context solely to own the MCP runtime and requires the response to explicitly attest `ephemeral: true`, `path: null`, and `turns: []` before dispatch. It never calls `turn/start`; any `turn/*` or `item/*` event—including one received during teardown—is a fatal architecture violation. The temporary `CODEX_HOME` contains no auth file, API key, user MCPs, plugins, history, memories, or account configuration. A non-websocket dummy model provider points at unreachable loopback, and plugin/remote-control features are disabled, preventing app-server model prewarm and Responses API traffic.
-
-This is direct tool dispatch—not model orchestration.
-
-## Authority and non-goals
-
-This package is a thin adapter to official Codex Computer Use. Codex and macOS remain authoritative for tool behavior, app access, and platform permissions. The wrapper must not add permission policy, risk classification, app allowlists, action gates, content inspection, or speculative defence-in-depth.
-
-The earlier background-computer-use wrapper provided canonical app resolution, same-app locking, focus completion telemetry, and metadata-only audit. The current release retains these legacy behaviors. They do not provide independent security or authorization boundaries. Do not expand them because a hypothetical safeguard is possible. A maintainer must explicitly approve their removal or material simplification because this changes the release contract.
-
-## Current adapter invariants
-
-These invariants describe the supported transport, zero-model-turn architecture, current released behavior, process lifecycle, and privacy contract. They are not a general security framework or a mandate to add safeguards.
-
-1. Only the fixed app-bundled Codex path and reviewed official Computer Use layouts are allowed in production. The current client is resolved from the OS account home under `~/.codex/computer-use/`; `HOME`, `CODEX_HOME`, arbitrary paths, and symlinked layouts are not accepted. The former exact plugin-bundle layout is considered only when the current component is absent.
-2. Both binaries pass strict code-signature verification and OpenAI Team ID `2DC432GLL2` checks before dispatch. A present current-layout client that fails verification never falls back.
-3. The helper's exact ten method names and input schemas match the pinned expected inventory before every call; release tests also verify its descriptions and annotations.
-4. `no-permissions` is the only wrapper policy: all ten methods are exposed and no wrapper permission prompt is opened.
-5. There is no config file, environment override, command, tool argument, per-call branch, or alternate safe/full route that an agent can select.
-6. App-server uses the official Full access combination, `approvalPolicy: "never"` plus `sandbox: "danger-full-access"`. The pinned Codex host automatically accepts empty-schema MCP approval elicitations, so normal first-party app-access checks proceed without prompts. The wrapper does not synthesize this response or edit persistent per-app approvals. Any elicitation app-server emits is forwarded faithfully; an unavailable client cancels.
-7. As current legacy wrapper behavior, target selectors resolve to canonical installed bundle IDs before dispatch.
-8. As current legacy wrapper coordination, same-app work is excluded across native Pi, generic MCP, and custom state roots with one fixed per-user kernel `lockf` lease namespace.
-9. As current legacy completion telemetry, target focus events, periodic samples, watcher health, queued ASN resolution, and final state are checked. This is post-action reporting, not a preventive OS sandbox or an official Codex access control.
-10. One direct request emits one official `mcpServer/tool/call`; no model turn, subagent, shell, web, plugin, prompt, or reachable model transport is available.
-11. App-server and helper share one private broker-session working directory. One-shot calls close it immediately; Pi retains it only across the required `get_app_state` and following action, then closes it after the action, before replacement inspection, or on session shutdown. Cleanup combines strict ancestry enumeration (preserving partial results) with working-directory ownership recovery, freezes processes to a stable set, kills every owned process, awaits stdio closure, and verifies exit. This still finds a helper reparented by an early app-server exit; enumeration/freeze/exit uncertainty is fatal.
-12. Protocol JSONL is bounded before an unterminated line can exceed 8 MB in memory.
-13. Per-call `CODEX_HOME` and work directories are mode-private and recursively removed.
-14. Only validated text/image result blocks cross to the invoking client. No full-result spill file is written.
-15. Audits contain metadata only, including separate `brokerCleanupVerified` and `appLeaseReleased` evidence. A retained Pi inspection truthfully records broker cleanup as pending (`false`); the paired action does not return if final retained-session cleanup fails. Lease-release failure changes the audited outcome before surfacing. Arguments, values, screenshots, app-state text, result content, prompts, approvals, credentials, and tokens are forbidden.
-16. Policy rejections are audited; audit failure is fatal once a secure state path exists.
-17. Runtime and development dependency tarballs are exact-pinned with integrity in `npm-shrinkwrap.json`.
-
-## Permission semantics
-
-### No-permissions
-
-All ten official methods and arbitrary resolvable app targets are available without wrapper permission prompts. The name means “ask no permission,” not “disable tools.” This is broad authorization. It does not imply that actions are reversible or that focus detection can prevent an already dispatched action.
-
-The mode is compiled as the sole policy. Agent-writable audit state and legacy configuration files cannot change it, and there is no CLI/slash/tool/environment mode selector.
-
-## Elicitations
-
-The bridge starts app-server with `approvalPolicy: "never"` and `sandbox: "danger-full-access"`. This is Codex's Full access policy, not a wrapper-side approximation. Codex 0.144.2 maps the sandbox value to a disabled permission profile and automatically accepts empty-schema MCP approval elicitations before they are emitted to the client. That covers normal Computer Use app-access prompts without mutating the service's persistent approval file.
-
-If app-server emits a form, OpenAI-form, or URL elicitation, Pi renders it and stdio MCP forwards supported standard modes through `elicitation/create`. The wrapper preserves the user/client response. Missing UI or an unsupported client produces `cancel`, never a fabricated decision.
-
-## Visible content
+## Supported versions
 
-Computer Use returns the official app-state text and screenshots to the invoking client. The wrapper does not inspect, classify, redact, or use that content to narrow the actions authorized by the user's request, and it never writes the content to its audit.
+Only the latest release is supported.
 
-## Supported versions
+## Reporting a vulnerability
 
-Only the latest approved release is supported. Version 0.3.3 supports direct local calls in an unlocked macOS session. Targeted local calls while the Mac is locked are not supported.
+Use GitHub private vulnerability reporting for a concrete vulnerability in the supported production path. Include the affected version or commit, expected and observed behaviour, and a small non-sensitive reproduction.
 
-App-server is experimental and bundle paths or schemas can change. Drift fails closed until reviewed.
+Do not include credentials, tokens, private content, screenshots, raw app-state payloads, elicitation contents or audit files. Do not open a public issue before the report has been assessed.

package/dist/audit.d.ts

@@ -1,13 +1,9 @@
-import type { PermissionMode } from "./config.ts";
 import type { DirectMethod } from "./tools.ts";
 export interface AuditRecord {
     timestamp: string;
     runId: string;
     method: DirectMethod | "invalid_request";
-    permissionMode: PermissionMode;
     app: string | null;
-    mutating: boolean;
-    authorization: "no_permissions_unrestricted" | "none";
     inputBytes: number;
     outcome: string;
     durationMs: number;
@@ -17,10 +13,8 @@ export interface AuditRecord {
     modelTurnsStarted: number;
     ephemeralThread: boolean | null;
     elicitationRequests: number;
-    backgroundPreserved: boolean | null;
     brokerCleanupVerified: boolean;
-    appLeaseReleased: boolean;
     resultContentTypes: string[];
     resultBytes: number;
 }
-export declare function appendAudit(stateDir: string, record: AuditRecord, fileName?: string): Promise<string>;
+export declare function appendAudit(stateDir: string, record: AuditRecord): Promise<void>;

package/dist/audit.js

@@ -8,35 +8,27 @@ async function ensurePrivateDirectory(directory) {
             throw new Error("Audit state path must be a non-symlink directory");
     }
     catch (error) {
-        if (error?.code !== "ENOENT")
+        if (!(error instanceof Error) || !("code" in error) || error.code !== "ENOENT")
             throw error;
         await mkdir(directory, { recursive: true, mode: 0o700 });
-        const info = await lstat(directory);
-        if (info.isSymbolicLink() || !info.isDirectory())
-            throw new Error("Audit state path must be a non-symlink directory");
     }
     await chmod(directory, 0o700);
 }
-export async function appendAudit(stateDir, record, fileName = "direct-computer-use.jsonl") {
-    if (path.basename(fileName) !== fileName)
-        throw new Error("Audit filename must not contain a path");
+export async function appendAudit(stateDir, record) {
     await ensurePrivateDirectory(stateDir);
     const auditDir = path.join(stateDir, "audit");
     await ensurePrivateDirectory(auditDir);
-    const auditPath = path.join(auditDir, fileName);
+    const auditPath = path.join(auditDir, "direct-computer-use.jsonl");
     const flags = constants.O_APPEND | constants.O_CREAT | constants.O_WRONLY | constants.O_NOFOLLOW;
     const handle = await open(auditPath, flags, 0o600);
     try {
-        const info = await handle.stat();
-        if (!info.isFile())
+        if (!(await handle.stat()).isFile())
             throw new Error("Audit target must be a regular file");
         await handle.chmod(0o600);
         await handle.writeFile(`${JSON.stringify(record)}\n`, "utf8");
-        await handle.sync();
     }
     finally {
         await handle.close();
     }
-    return auditPath;
 }
 //# sourceMappingURL=audit.js.map

package/dist/audit.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit.js","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,IAAI,MAAM,WAAW,CAAC;AA4B7B,KAAK,UAAU,sBAAsB,CAAC,SAAiB;IACtD,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACvH,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACrB,IAAI,KAAK,EAAE,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAC;QAC1C,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACvH,CAAC;IACD,MAAM,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAChC,QAAgB,EAChB,MAAmB,EACnB,QAAQ,GAAG,2BAA2B;IAEtC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IACpG,MAAM,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC9C,MAAM,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC;IACjG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IACnD,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QAC3E,MAAM,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC9D,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IACrB,CAAC;YAAS,CAAC;QACV,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC"}
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,IAAI,MAAM,WAAW,CAAC;AAsB7B,KAAK,UAAU,sBAAsB,CAAC,SAAiB;IACtD,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACvH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAC;QAC5F,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,QAAgB,EAAE,MAAmB;IACtE,MAAM,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC9C,MAAM,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,2BAA2B,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC;IACjG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IACnD,IAAI,CAAC;QACJ,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QAC5F,MAAM,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC/D,CAAC;YAAS,CAAC;QACV,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;AACF,CAAC"}

package/dist/direct-broker.d.ts

@@ -1,27 +1,25 @@
-import { type DirectMethod, type DirectToolArguments } from "./tools.ts";
-export declare const CODEX_PATH = "/Applications/ChatGPT.app/Contents/Resources/codex";
-export declare const COMPUTER_USE_PLUGIN_ROOT = "/Applications/ChatGPT.app/Contents/Resources/plugins/openai-bundled/plugins/computer-use";
-export declare const COMPUTER_USE_CLIENT_PATH: string;
-export declare const LEGACY_COMPUTER_USE_CLIENT_PATH: string;
-export interface DirectBrokerElicitationRequest extends Record<string, unknown> {
-    mode?: string;
-    message?: string;
-    requestedSchema?: unknown;
-    url?: string;
-    elicitationId?: string;
-}
+import { z } from "zod";
+import type { DirectMethod, DirectToolArguments, JsonObject, JsonValue } from "./tools.ts";
+declare const elicitationRequestSchema: z.ZodObject<{
+    mode: z.ZodOptional<z.ZodString>;
+    message: z.ZodOptional<z.ZodString>;
+    requestedSchema: z.ZodOptional<z.ZodJSONSchema>;
+    url: z.ZodOptional<z.ZodString>;
+    elicitationId: z.ZodOptional<z.ZodString>;
+    _meta: z.ZodOptional<z.ZodJSONSchema>;
+}, z.core.$catchall<z.ZodJSONSchema>>;
+export type DirectBrokerElicitationRequest = z.infer<typeof elicitationRequestSchema>;
 export interface DirectBrokerElicitationResponse {
     action: "accept" | "decline" | "cancel";
-    content?: unknown;
-    _meta?: unknown;
+    content?: JsonValue;
+    _meta?: JsonValue;
 }
 export interface DirectBrokerResult {
-    content: Array<Record<string, unknown>>;
-    structuredContent?: unknown;
+    content: JsonObject[];
+    structuredContent?: JsonValue;
     isError: boolean;
     brokerVersion: string;
     clientBuild: string;
-    durationMs: number;
     elicitationRequests: number;
     modelTurnsStarted: 0;
     ephemeralThread: true;
@@ -40,13 +38,8 @@ export interface DirectBrokerOptions {
     skipSignatureVerification?: boolean;
     /** Test-only process-enumerator override. */
     processEnumeratorCommand?: string;
-    /** Test-only working-directory process-enumerator override. */
-    cwdEnumeratorCommand?: string;
     onSpawn?: (pid: number) => void;
 }
-export declare class BrokerVerificationError extends Error {
-    constructor(message: string);
-}
 export declare class DirectBrokerCallError extends Error {
     readonly cleanupVerified: boolean;
     readonly directCalls: number;
@@ -66,8 +59,8 @@ export declare class DirectBrokerCallError extends Error {
 }
 interface CommandResult {
     status: number | null;
-    stdout?: string | Buffer;
-    stderr?: string | Buffer;
+    stdout?: string;
+    stderr?: string;
 }
 type RunSync = (command: string, args: string[]) => CommandResult;
 export interface OfficialComputerUseClient {
@@ -91,14 +84,9 @@ export declare function verifyOfficialDirectBroker(options?: ResolveOfficialComp
 };
 export declare function buildDirectAppServerArgs(mcpCwd?: string, clientPath?: string): string[];
 export interface OfficialDirectToolSession {
-    call(method: DirectMethod, args: DirectToolArguments, options?: Pick<DirectBrokerOptions, "timeoutMs" | "signal" | "onElicitation" | "supportsOpenAiFormElicitation">): Promise<DirectBrokerResult>;
+    call(method: DirectMethod, args: DirectToolArguments, options?: Pick<DirectBrokerOptions, "timeoutMs" | "signal" | "onElicitation">): Promise<DirectBrokerResult>;
     close(): Promise<void>;
 }
-/**
- * Start one verified app-server runtime and retain its signed Computer Use MCP
- * client across calls. Pi uses this for the required get_app_state -> action
- * sequence; one-shot callers continue to use callOfficialDirectTool below.
- */
 export declare function createOfficialDirectToolSession(options?: DirectBrokerOptions): Promise<OfficialDirectToolSession>;
 export declare function callOfficialDirectTool(method: DirectMethod, args: DirectToolArguments, options?: DirectBrokerOptions): Promise<DirectBrokerResult>;
 export {};