dsh-plugin-lcu 0.2.9 → 0.3.4

package/lib/app.js

@@ -0,0 +1,284 @@
+/**
+ * The ChatGPT application, and the runtime it carries.
+ *
+ * The computer-use provider is the original one inside the application: this
+ * module locates it, checks the pieces it needs are present and not writable by
+ * anyone else, and builds the environment the runtime expects. Nothing here
+ * launches a third-party wrapper — the launcher is
+ * `.../@oai/cua-repl/bin/cua-repl.mjs` inside the application itself.
+ *
+ * The environment is not guesswork. Every variable below is one the original
+ * launcher sets, and each is named in a comment for the thing it selects.
+ *
+ * @module dsh-plugin-lcu/app
+ */
+import { accessSync, constants, existsSync, readFileSync, statSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { diag } from "./diag.js";
+/** The default installation the original app uses. */
+const DEFAULT_APP = '/Applications/ChatGPT.app';
+/**
+ * The Sky service module this plugin loads instead of the application's own.
+ *
+ * It forwards to the application unchanged and adds the turn-ended hook the
+ * runtime has no handler for. See its own header for why that hook matters and
+ * what it deliberately leaves out.
+ */
+export function skyServicePath() {
+    return join(dirname(fileURLToPath(import.meta.url)), '..', 'helper', 'sky-service.mjs');
+}
+/** A failure that names the application as its source. */
+export class AppError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'AppError';
+    }
+}
+function exists(path) {
+    try {
+        return statSync(path).isFile();
+    }
+    catch {
+        return false;
+    }
+}
+function isDirectory(path) {
+    try {
+        return statSync(path).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+/** Read a plist string without depending on `plutil`. */
+function plistValue(plist, key) {
+    try {
+        const text = readFileSync(plist, 'utf8');
+        const match = new RegExp(`<key>${key}</key>\\s*<string>([^<]*)</string>`).exec(text);
+        return match?.[1];
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Refuse a file another account could replace.
+ *
+ * The runtime is executed from inside the application, so a world-writable file
+ * in that tree is a way for someone else to choose what this session runs. This
+ * is the cheap half of what the original installer checks; it is not a
+ * signature verification.
+ *
+ * @param path - the file to inspect.
+ * @returns whether the file is a regular file owned by this account or root and writable by neither others nor group.
+ */
+export function isPrivateFile(path) {
+    try {
+        const info = statSync(path);
+        if (!info.isFile())
+            return false;
+        // Group or other write is enough for another account to choose what runs.
+        if ((info.mode & 0o022) !== 0)
+            return false;
+        const me = typeof process.getuid === 'function' ? process.getuid() : undefined;
+        return info.uid === 0 || me === undefined || info.uid === me;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Locate the application and the runtime inside it.
+ *
+ * @param appPath - the application to use; defaults to the standard install.
+ * @returns the paths and both versions.
+ * @throws AppError when the application or a required piece is missing.
+ */
+export function resolveApp(appPath = DEFAULT_APP) {
+    const app = resolve(appPath);
+    if (!isDirectory(app) || !app.endsWith('.app')) {
+        throw new AppError(`not an application bundle: ${app}`);
+    }
+    const resources = join(app, 'Contents', 'Resources');
+    const runtime = join(resources, 'cua_node');
+    if (!isDirectory(runtime)) {
+        throw new AppError(`the application has no computer-use runtime: ${runtime}`);
+    }
+    for (const [label, path] of [
+        ['runtime node', join(runtime, 'bin/node')],
+        ['runtime module directory', join(runtime, 'lib/node_modules/@oai/cua-repl/bin/cua-repl.mjs')],
+        ['Sky service', join(runtime, 'lib/node_modules/@oai/sky/Codex Computer Use.app')],
+        ['Codex CLI', join(resources, 'codex-cli/bin/codex')],
+    ]) {
+        if (!exists(path) && !isDirectory(path)) {
+            throw new AppError(`the application is missing its ${label}: ${path}`);
+        }
+        if (exists(path) && !isPrivateFile(path)) {
+            throw new AppError(`the application's ${label} is writable by another account: ${path}`);
+        }
+    }
+    const manifest = join(runtime, 'manifest.json');
+    let runtimeVersion = 'unknown';
+    try {
+        const parsed = JSON.parse(readFileSync(manifest, 'utf8'));
+        if (typeof parsed.runtime_archive_version === 'string')
+            runtimeVersion = parsed.runtime_archive_version;
+    }
+    catch {
+        // A missing manifest is not fatal: the paths above are what actually matter.
+    }
+    return {
+        app,
+        resources,
+        runtime,
+        version: plistValue(join(app, 'Contents', 'Info.plist'), 'CFBundleShortVersionString') ?? 'unknown',
+        runtimeVersion,
+    };
+}
+/**
+ * Build the environment the runtime expects.
+ *
+ * Every entry mirrors the original launcher. The ones that matter most:
+ * `CUA_REPL_NODE_REPL_PATH`/`NODE_REPL_NODE_PATH` select the application's own
+ * node, `NODE_REPL_NODE_MODULE_DIRS` and `NODE_REPL_TRUSTED_CODE_PATHS` let it
+ * load its modules, `CUA_REPL_ENABLED_SURFACES` chooses the API surface,
+ * `SKY_CUA_SERVICE_PATH` is the signed helper the macOS native pipe launches,
+ * and `NODE_REPL_REQUEST_META` supplies the identity the runtime uses when a
+ * call carries none of its own.
+ *
+ * `NODE_REPL_TRUSTED_SERVICES` selects the `sky` service. It names this plugin's
+ * wrapper rather than the application's own module, because the runtime has no
+ * turn-ended handler of its own and a turn that never ends is a turn whose
+ * per-application Stop is never released.
+ *
+ * @param paths - the resolved application paths.
+ * @param options - surface selection and the identity fallback.
+ * @returns the child environment.
+ */
+export function buildEnvironment(paths, options) {
+    const separator = ':';
+    const moduleDir = join(paths.runtime, 'lib/node_modules');
+    const codexHome = process.env.CODEX_HOME ?? join(homedir(), '.codex');
+    const existingPath = process.env.PATH ?? '/usr/bin:/bin';
+    const env = {
+        ...process.env,
+        // The original runtime selects and trusts CODEX_HOME verbatim.
+        CODEX_HOME: codexHome,
+        PATH: `${join(paths.runtime, 'bin')}${separator}${existingPath}`,
+        CUA_REPL_NODE_REPL_PATH: join(paths.runtime, 'bin/node_repl'),
+        NODE_REPL_NODE_PATH: join(paths.runtime, 'bin/node'),
+        NODE_REPL_NODE_MODULE_DIRS: [moduleDir, process.env.NODE_REPL_NODE_MODULE_DIRS].filter(Boolean).join(separator),
+        NODE_REPL_TRUSTED_CODE_PATHS: [
+            codexHome, moduleDir, join(paths.resources, 'plugins'), process.env.NODE_REPL_TRUSTED_CODE_PATHS,
+        ].filter(Boolean).join(separator),
+        // The original launcher picks both its API and its instructions from this.
+        CUA_REPL_ENABLED_SURFACES: options.chrome ? 'browser,computer' : 'computer',
+        CUA_REPL_BROWSER_ENV: 'codex-app',
+        CODEX_CLI_PATH: join(paths.resources, 'codex-cli/bin/codex'),
+        // The signed helper the macOS native pipe transport launches.
+        SKY_CUA_SERVICE_PATH: join(moduleDir, '@oai/sky/Codex Computer Use.app'),
+        NODE_REPL_NATIVE_PIPE_CONNECT_TIMEOUT_MS: '1000',
+        BROWSER_USE_AVAILABLE_BACKENDS: 'chrome',
+        BROWSER_USE_TINYSKY_ENABLED: '1',
+        BROWSER_USE_CODEX_APP_BUILD_FLAVOR: 'prod',
+        BROWSER_USE_CODEX_APP_VERSION: paths.version,
+        NODE_REPL_DISABLE_ANALYTICS: '1',
+        BROWSER_USE_DISABLE_AMBIENT_NETWORK: '1',
+        // The application's own service and the signed client its turn cleanup goes
+        // through. The wrapper reads these two; they name the application's files,
+        // not ours.
+        DSH_SKY_SERVICE_PATH: join(moduleDir, '@oai/sky/dist/project/cua/sky_js/src/service.js'),
+        DSH_SKY_CLIENT_PATH: join(moduleDir, '@oai/sky/dist/project/cua/sky_js/src/targets/mac/client.js'),
+    };
+    // Load our Sky service in place of the application's. The map has to keep the
+    // runtime's other defaults, so `browser` is restated when that surface is on.
+    const wrapper = skyServicePath();
+    if (existsSync(wrapper)) {
+        const services = {};
+        if (options.chrome)
+            services.browser = '@oai/browser-desktop/service';
+        services.sky = wrapper;
+        env.NODE_REPL_TRUSTED_SERVICES = JSON.stringify(services);
+        // A trusted service is only loaded from a trusted code path, so the wrapper's
+        // own directory has to be one.
+        env.NODE_REPL_TRUSTED_CODE_PATHS = [dirname(wrapper), env.NODE_REPL_TRUSTED_CODE_PATHS]
+            .filter(Boolean)
+            .join(separator);
+        diag(`environment: sky service -> ${wrapper}`);
+    }
+    else {
+        diag(`environment: no wrapper at ${wrapper}; the application's own Sky service will be used`);
+    }
+    if (options.audio) {
+        env.SKY_ENABLE_AUDIO = '1';
+        env.NODE_REPL_ENABLE_AUDIO = '1';
+    }
+    // Supplied metadata keeps precedence, as the original runtime intends; this is
+    // only the identity used when a call arrives with none of its own.
+    if (env.NODE_REPL_REQUEST_META === undefined) {
+        const identity = options.identity ?? `dsh-${String(process.pid)}-${Date.now().toString(36)}`;
+        env.NODE_REPL_REQUEST_META = JSON.stringify({
+            'x-codex-turn-metadata': { session_id: identity, turn_id: `${identity}-connection` },
+        });
+    }
+    return env;
+}
+/**
+ * The full plan for one connection.
+ *
+ * @param options - the application, surfaces and override.
+ * @returns the command, its arguments, the environment and the paths.
+ */
+export function planLaunch(options) {
+    const paths = resolveApp(options.appPath ?? DEFAULT_APP);
+    const env = buildEnvironment(paths, {
+        chrome: options.chrome,
+        audio: options.audio,
+        ...(options.identity === undefined ? {} : { identity: options.identity }),
+    });
+    if (options.command !== undefined && options.command !== '') {
+        diag(`launch: explicit command ${options.command}`);
+        return { command: options.command, args: options.chrome ? ['--chrome'] : [], env, paths };
+    }
+    const launcher = join(paths.runtime, 'lib/node_modules/@oai/cua-repl/bin/cua-repl.mjs');
+    diag(`launch: app=${paths.app} version=${paths.version} runtime=${paths.runtimeVersion} launcher=${launcher}`);
+    return { command: env.NODE_REPL_NODE_PATH ?? join(paths.runtime, 'bin/node'), args: [launcher], env, paths };
+}
+/**
+ * A fingerprint of the application generation the runtime is run from.
+ *
+ * The runtime is executed from files the application replaces when it updates, so
+ * a session that is already connected can end up running a mix of two
+ * generations. Both versions are read from the bundle and both timestamps are
+ * part of the answer, because an update replaces the whole bundle and a
+ * same-version reinstall is still a different set of files.
+ *
+ * @param paths - the resolved application paths.
+ * @returns a value that changes exactly when the files underneath change.
+ */
+export function generationOf(paths) {
+    const stamps = [];
+    for (const file of [join(paths.runtime, 'manifest.json'), join(paths.app, 'Contents', 'Info.plist')]) {
+        try {
+            const info = statSync(file);
+            stamps.push(`${String(info.mtimeMs)}:${String(info.size)}`);
+        }
+        catch {
+            stamps.push('missing');
+        }
+    }
+    return `${paths.version}|${paths.runtimeVersion}|${stamps.join('|')}`;
+}
+/** Whether the application can be executed by this account. */
+export function appIsRunnable(paths) {
+    try {
+        accessSync(join(paths.runtime, 'bin/node'), constants.X_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=app.js.map

package/lib/app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AACnF,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAExC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC,sDAAsD;AACtD,MAAM,WAAW,GAAG,2BAA2B,CAAA;AAE/C;;;;;;GAMG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAA;AACzF,CAAC;AAED,0DAA0D;AAC1D,MAAM,OAAO,QAAS,SAAQ,KAAK;IACjC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,UAAU,CAAA;IACxB,CAAC;CACF;AAqBD,SAAS,MAAM,CAAC,IAAY;IAC1B,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAA;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAA;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,yDAAyD;AACzD,SAAS,UAAU,CAAC,KAAa,EAAE,GAAW;IAC5C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QACxC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,QAAQ,GAAG,oCAAoC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACpF,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAA;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;QAC3B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YAAE,OAAO,KAAK,CAAA;QAChC,0EAA0E;QAC1E,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAA;QAC3C,MAAM,EAAE,GAAG,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;QAC9E,OAAO,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,KAAK,EAAE,CAAA;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,UAAkB,WAAW;IACtD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC5B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,QAAQ,CAAC,8BAA8B,GAAG,EAAE,CAAC,CAAA;IACzD,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,WAAW,CAAC,CAAA;IACpD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAA;IAC3C,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,QAAQ,CAAC,gDAAgD,OAAO,EAAE,CAAC,CAAA;IAC/E,CAAC;IAED,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI;QAC1B,CAAC,cAAc,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAC3C,CAAC,0BAA0B,EAAE,IAAI,CAAC,OAAO,EAAE,iDAAiD,CAAC,CAAC;QAC9F,CAAC,aAAa,EAAE,IAAI,CAAC,OAAO,EAAE,kDAAkD,CAAC,CAAC;QAClF,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,EAAE,qBAAqB,CAAC,CAAC;KAC7C,EAAE,CAAC;QACX,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,QAAQ,CAAC,kCAAkC,KAAK,KAAK,IAAI,EAAE,CAAC,CAAA;QACxE,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,QAAQ,CAAC,qBAAqB,KAAK,oCAAoC,IAAI,EAAE,CAAC,CAAA;QAC1F,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,CAAA;IAC/C,IAAI,cAAc,GAAG,SAAS,CAAA;IAC9B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAA0C,CAAA;QAClG,IAAI,OAAO,MAAM,CAAC,uBAAuB,KAAK,QAAQ;YAAE,cAAc,GAAG,MAAM,CAAC,uBAAuB,CAAA;IACzG,CAAC;IAAC,MAAM,CAAC;QACP,6EAA6E;IAC/E,CAAC;IAED,OAAO;QACL,GAAG;QACH,SAAS;QACT,OAAO;QACP,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,YAAY,CAAC,EAAE,4BAA4B,CAAC,IAAI,SAAS;QACnG,cAAc;KACf,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,KAAe,EACf,OAA0F;IAE1F,MAAM,SAAS,GAAG,GAAG,CAAA;IACrB,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAA;IACzD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAA;IACrE,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,eAAe,CAAA;IAExD,MAAM,GAAG,GAAsB;QAC7B,GAAG,OAAO,CAAC,GAAG;QACd,+DAA+D;QAC/D,UAAU,EAAE,SAAS;QACrB,IAAI,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,SAAS,GAAG,YAAY,EAAE;QAChE,uBAAuB,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,eAAe,CAAC;QAC7D,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC;QACpD,0BAA0B,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;QAC/G,4BAA4B,EAAE;YAC5B,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,4BAA4B;SACjG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;QACjC,2EAA2E;QAC3E,yBAAyB,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,UAAU;QAC3E,oBAAoB,EAAE,WAAW;QACjC,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,qBAAqB,CAAC;QAC5D,8DAA8D;QAC9D,oBAAoB,EAAE,IAAI,CAAC,SAAS,EAAE,iCAAiC,CAAC;QACxE,wCAAwC,EAAE,MAAM;QAChD,8BAA8B,EAAE,QAAQ;QACxC,2BAA2B,EAAE,GAAG;QAChC,kCAAkC,EAAE,MAAM;QAC1C,6BAA6B,EAAE,KAAK,CAAC,OAAO;QAC5C,2BAA2B,EAAE,GAAG;QAChC,mCAAmC,EAAE,GAAG;QACxC,4EAA4E;QAC5E,2EAA2E;QAC3E,YAAY;QACZ,oBAAoB,EAAE,IAAI,CAAC,SAAS,EAAE,iDAAiD,CAAC;QACxF,mBAAmB,EAAE,IAAI,CAAC,SAAS,EAAE,4DAA4D,CAAC;KACnG,CAAA;IAED,8EAA8E;IAC9E,8EAA8E;IAC9E,MAAM,OAAO,GAAG,cAAc,EAAE,CAAA;IAChC,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,MAAM,QAAQ,GAA2B,EAAE,CAAA;QAC3C,IAAI,OAAO,CAAC,MAAM;YAAE,QAAQ,CAAC,OAAO,GAAG,8BAA8B,CAAA;QACrE,QAAQ,CAAC,GAAG,GAAG,OAAO,CAAA;QACtB,GAAG,CAAC,0BAA0B,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;QACzD,8EAA8E;QAC9E,+BAA+B;QAC/B,GAAG,CAAC,4BAA4B,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,4BAA4B,CAAC;aACpF,MAAM,CAAC,OAAO,CAAC;aACf,IAAI,CAAC,SAAS,CAAC,CAAA;QAClB,IAAI,CAAC,+BAA+B,OAAO,EAAE,CAAC,CAAA;IAChD,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,8BAA8B,OAAO,kDAAkD,CAAC,CAAA;IAC/F,CAAC;IAED,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,GAAG,CAAC,gBAAgB,GAAG,GAAG,CAAA;QAC1B,GAAG,CAAC,sBAAsB,GAAG,GAAG,CAAA;IAClC,CAAC;IAED,+EAA+E;IAC/E,mEAAmE;IACnE,IAAI,GAAG,CAAC,sBAAsB,KAAK,SAAS,EAAE,CAAC;QAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAA;QAC5F,GAAG,CAAC,sBAAsB,GAAG,IAAI,CAAC,SAAS,CAAC;YAC1C,uBAAuB,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,QAAQ,aAAa,EAAE;SACrF,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,OAO1B;IACC,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,IAAI,WAAW,CAAC,CAAA;IACxD,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,EAAE;QAClC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;KAC1E,CAAC,CAAA;IAEF,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,KAAK,EAAE,EAAE,CAAC;QAC5D,IAAI,CAAC,4BAA4B,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;QACnD,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAA;IAC3F,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,iDAAiD,CAAC,CAAA;IACvF,IAAI,CAAC,eAAe,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,OAAO,YAAY,KAAK,CAAC,cAAc,aAAa,QAAQ,EAAE,CAAC,CAAA;IAC9G,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,mBAAmB,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAA;AAC9G,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,YAAY,CAAC,KAAe;IAC1C,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC;QACrG,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;YAC3B,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACxB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,cAAc,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAA;AACvE,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,aAAa,CAAC,KAAe;IAC3C,IAAI,CAAC;QACH,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,CAAA;QAC3D,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC"}

package/lib/approval.js

@@ -1,16 +1,16 @@
 /**
- * LCU approval shapes.
+ * Approval shapes.
  *
- * LCU's original runtime asks the host before it touches an app, and the request
+ * The runtime asks the host before it touches an app, and the request
  * is a specific `elicitation/create` form. This ports the recognition and
- * mapping rules from LCU's own shared client so a DSH host presents exactly the
+ * mapping rules from the runtime's shared client so a DSH host presents exactly the
  * choices the runtime offered — no more (granting an unoffered persistence scope
  * would let the agent keep desktop access the runtime meant to bound) and no
  * fewer (dropping `always` would nag the user every turn).
  *
  * @module dsh-plugin-lcu/approval
  */
-/** Persistence scopes the runtime can offer, in the order LCU presents them. */
+/** Persistence scopes the runtime can offer, in the order it presents them. */
 const PERSISTENCE = [
     ['session', 'Allow for this session'],
     ['always', 'Always allow'],
@@ -101,6 +101,47 @@ export function approvalValueForLabel(approval, label) {
         return 'cancel';
     return approval.choices.find((choice) => choice.label === label)?.value ?? 'cancel';
 }
+/**
+ * Normalize the pre-approved application bundle identifiers.
+ *
+ * Matching is case-insensitive because a bundle identifier's case is an
+ * implementation detail of the application's Info.plist, and a user reading it
+ * out of a log should not have to reproduce it exactly. Entries are otherwise
+ * kept verbatim: nothing here widens what a match admits.
+ *
+ * @param raw - configured identifiers, possibly absent or malformed.
+ * @returns the normalized set.
+ */
+export function normalizeApps(raw) {
+    const apps = new Set();
+    for (const entry of raw ?? []) {
+        if (typeof entry !== 'string')
+            continue;
+        const value = entry.trim().toLowerCase();
+        // An empty entry would match nothing but reads like a grant; drop it.
+        if (value === '')
+            continue;
+        apps.add(value);
+    }
+    return apps;
+}
+/**
+ * Whether the user has already decided about this application.
+ *
+ * This is what makes an unattended run possible: without it the runtime asks
+ * before it first uses each application, and an unanswered question is a refusal.
+ * It is checked only after the agent-host guard, so a list can never authorize
+ * the application the agent itself is running in.
+ *
+ * @param approval - the application approval the runtime sent.
+ * @param allowedApps - normalized pre-approved identifiers.
+ * @returns whether the application may be admitted without asking.
+ */
+export function isPreApprovedApp(approval, allowedApps) {
+    if (allowedApps.size === 0)
+        return false;
+    return allowedApps.has(approval.resource.trim().toLowerCase());
+}
 /** The exact origin a browser-site approval names, when it names one. */
 export function originApprovalOrigin(request) {
     const meta = asObject(request._meta) ?? asObject(request.meta);

package/lib/approval.js.map

@@ -1 +1 @@
-{"version":3,"file":"approval.js","sourceRoot":"","sources":["../src/approval.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAiBH,gFAAgF;AAChF,MAAM,WAAW,GAAyD;IACxE,CAAC,SAAS,EAAE,wBAAwB,CAAC;IACrC,CAAC,QAAQ,EAAE,cAAc,CAAC;CAC3B,CAAA;AAED,kDAAkD;AAClD,MAAM,gBAAgB,GAAG,uBAAuB,CAAA;AAIhD,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAoB,EAAE,CACpD,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAa,CAAC,CAAC,CAAC,SAAS,CAAA;AAElG;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAA8B;IAC9D,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IACpC,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,eAAe,CAAC,CAAA;IAChD,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;IAC/C,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,GAAG,CAAA;IAC5C,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,SAAS,CAAA;IAC7C,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,OAAO,KAAK,EAAE;QAAE,OAAO,SAAS,CAAA;IACnF,IAAI,MAAM,EAAE,IAAI,KAAK,QAAQ,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IAC3E,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IAC1D,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAA;IAChC,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC;QAAE,OAAO,SAAS,CAAA;IACnG,IAAI,IAAI,EAAE,mBAAmB,KAAK,eAAe;QAAE,OAAO,SAAS,CAAA;IACnE,IAAI,IAAI,EAAE,YAAY,KAAK,cAAc;QAAE,OAAO,SAAS,CAAA;IAC3D,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,SAAS,CAAA;IAE3D,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAmB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IACvF,MAAM,OAAO,GAAqB,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAA;IAC1E,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC;QACzC,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;IAC1D,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAA;IACpD,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,CAAA;AAC7D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CACvC,OAA8B,EAC9B,KAAa;IAEb,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAA;IAC3C,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;IACvD,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;IACnD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;IACrD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,KAAK,KAAK,CAAC,CAAA;IACzE,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;IACzC,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,CAAA;IAC9D,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9C,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAA;IACrE,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;AAC7B,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAA2B,EAAE,KAAyB;IAC1F,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAA;IACxC,OAAO,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,KAAK,KAAK,CAAC,EAAE,KAAK,IAAI,QAAQ,CAAA;AACrF,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,oBAAoB,CAAC,OAA8B;IACjE,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAE,OAAgB,CAAC,IAAI,CAAC,CAAA;IACxE,IAAI,IAAI,EAAE,SAAS,KAAK,gBAAgB,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAA;IAC7F,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAChC,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAA;QAC3E,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAA;QAChD,OAAO,GAAG,CAAC,MAAM,CAAA;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,mBAAmB,CACjC,OAA8B,EAC9B,cAAmC;IAEnC,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAA;IAC5C,OAAO,MAAM,KAAK,SAAS,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;AAC3D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAyB;IACxD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAA;IAClC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;YAC1B,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;gBAAE,SAAQ;YACnE,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK;gBAAE,SAAQ;YAClC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,SAAQ;QACV,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC"}
+{"version":3,"file":"approval.js","sourceRoot":"","sources":["../src/approval.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAiBH,+EAA+E;AAC/E,MAAM,WAAW,GAAyD;IACxE,CAAC,SAAS,EAAE,wBAAwB,CAAC;IACrC,CAAC,QAAQ,EAAE,cAAc,CAAC;CAC3B,CAAA;AAED,kDAAkD;AAClD,MAAM,gBAAgB,GAAG,uBAAuB,CAAA;AAIhD,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAoB,EAAE,CACpD,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAa,CAAC,CAAC,CAAC,SAAS,CAAA;AAElG;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAA8B;IAC9D,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IACpC,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,eAAe,CAAC,CAAA;IAChD,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;IAC/C,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,GAAG,CAAA;IAC5C,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,SAAS,CAAA;IAC7C,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,OAAO,KAAK,EAAE;QAAE,OAAO,SAAS,CAAA;IACnF,IAAI,MAAM,EAAE,IAAI,KAAK,QAAQ,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IAC3E,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IAC1D,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAA;IAChC,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC;QAAE,OAAO,SAAS,CAAA;IACnG,IAAI,IAAI,EAAE,mBAAmB,KAAK,eAAe;QAAE,OAAO,SAAS,CAAA;IACnE,IAAI,IAAI,EAAE,YAAY,KAAK,cAAc;QAAE,OAAO,SAAS,CAAA;IAC3D,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,SAAS,CAAA;IAE3D,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAmB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IACvF,MAAM,OAAO,GAAqB,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAA;IAC1E,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC;QACzC,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;IAC1D,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAA;IACpD,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,CAAA;AAC7D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CACvC,OAA8B,EAC9B,KAAa;IAEb,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAA;IAC3C,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;IACvD,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;IACnD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;IACrD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,KAAK,KAAK,CAAC,CAAA;IACzE,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;IACzC,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,CAAA;IAC9D,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9C,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAA;IACrE,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;AAC7B,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAA2B,EAAE,KAAyB;IAC1F,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAA;IACxC,OAAO,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,KAAK,KAAK,CAAC,EAAE,KAAK,IAAI,QAAQ,CAAA;AACrF,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,GAAkC;IAC9D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,KAAK,MAAM,KAAK,IAAI,GAAG,IAAI,EAAE,EAAE,CAAC;QAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAQ;QACvC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QACxC,sEAAsE;QACtE,IAAI,KAAK,KAAK,EAAE;YAAE,SAAQ;QAC1B,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IACjB,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAA2B,EAC3B,WAAgC;IAEhC,IAAI,WAAW,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACxC,OAAO,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAA;AAChE,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,oBAAoB,CAAC,OAA8B;IACjE,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAE,OAAgB,CAAC,IAAI,CAAC,CAAA;IACxE,IAAI,IAAI,EAAE,SAAS,KAAK,gBAAgB,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAA;IAC7F,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAChC,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAA;QAC3E,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAA;QAChD,OAAO,GAAG,CAAC,MAAM,CAAA;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,mBAAmB,CACjC,OAA8B,EAC9B,cAAmC;IAEnC,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAA;IAC5C,OAAO,MAAM,KAAK,SAAS,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;AAC3D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAyB;IACxD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAA;IAClC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;YAC1B,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;gBAAE,SAAQ;YACnE,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK;gBAAE,SAAQ;YAClC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,SAAQ;QACV,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC"}

package/lib/connection.js

@@ -1,14 +1,14 @@
 /**
- * The LCU MCP client.
+ * The runtime MCP client.
  *
  * Why not `@modelcontextprotocol/sdk` or the host's `@modelcontextprotocol/client`:
  * the harness's own MCP bridge declares `capabilities: {}` and therefore cannot
- * answer elicitation, which is how LCU asks for per-app approval; and pulling a
+ * answer elicitation, which is how the runtime asks for per-app approval; and pulling a
  * second SDK into a profile plugin would pin a version the host does not own.
  * MCP over stdio is newline-delimited JSON-RPC, so the wire is small enough to
  * own here and keeps this plugin dependency-free at runtime.
  *
- * Contract kept from `amontlabs/lcu`:
+ * Contract taken from the runtime:
  * - declare `capabilities.elicitation` and answer `elicitation/create`
  * - expose only `js` and `js_reset` to the model; `turn_ended` and
  *   `js_add_node_module_dir` are host-only
@@ -22,6 +22,7 @@
 export const MODEL_TOOL_NAMES = ['js', 'js_reset'];
 /** Host-only tools, named so a mistake is loud rather than silent. */
 import { diag } from "./diag.js";
+import { ControlServer } from "./control.js";
 export const HOST_ONLY_TOOL_NAMES = ['turn_ended', 'js_add_node_module_dir'];
 /**
  * Build the `_meta` the original runtime reads its session and turn from.
@@ -50,10 +51,10 @@ export function turnMetadataFor(sessionId, turnId, callId) {
 }
 /** MCP protocol revision this client asks for; the server negotiates. */
 const PROTOCOL_VERSION = '2025-06-18';
-/** LCU's own approval timeout: effectively "never expire a pending approval". */
+/** The runtime's own approval timeout: effectively "never expire a pending approval". */
 const NO_APPROVAL_TIMEOUT_MS = 2 ** 31 - 1;
 const DEFAULT_CALL_TIMEOUT_MS = 120_000;
-/** The original host's control channel is bounded; 45 s matches LCU's own client. */
+/** The original host's control channel is bounded; 45 s matches its own client. */
 const CONTROL_TIMEOUT_MS = 45_000;
 const CONTROL_RESPONSE_LIMIT = 1024 * 1024;
 const DEFAULT_TURN_END_TIMEOUT_MS = 120_000;
@@ -83,7 +84,7 @@ export class LcuError extends Error {
  *
  * The runtime reports its own cleanup timeout as an ordinary error result with a
  * recognizable detail. Missing it would let a stalled cleanup look like a
- * healthy turn, which is exactly what LCU's contract asks a host not to do.
+ * healthy turn, which is exactly what the runtime's contract asks a host not to do.
  *
  * @param result - the failed call's result.
  * @returns the classified error, or `undefined` when the call succeeded.
@@ -104,7 +105,7 @@ export function classifyTurnEndFailure(result) {
 /**
  * Answer one elicitation, failing closed on every unexpected shape.
  *
- * LCU requires this exact discipline: a host that cannot present the request,
+ * The runtime requires this exact discipline: a host that cannot present the request,
  * a handler that throws, or an answer that is not one of the three actions must
  * all end as `cancel`, because anything else would silently grant desktop access.
  *
@@ -136,9 +137,9 @@ export async function resolveElicitation(handler, request, activeCalls = new Set
     return { action: 'cancel' };
 }
 /**
- * One long-lived connection to the `lcu` MCP server.
+ * One long-lived connection to the runtime's MCP server.
  *
- * The connection is per Agent/Session: LCU carries a persistent JavaScript
+ * The connection is per Agent/Session: the runtime carries a persistent JavaScript
  * session on its side, and its approvals are scoped to a real host session and
  * turn, so sharing one connection across agents would interleave both.
  */
@@ -155,6 +156,10 @@ export class LcuConnection {
     #activeCalls = new Set();
     #controlDirectory;
     #controlSocketPath;
+    /** Serves the path the child is told about, and relays to the Sky wrapper. */
+    #controlServer;
+    /** Set once a connection attempt shows nothing is listening. */
+    #controlUnavailable = false;
     constructor(options) {
         this.#options = options;
     }
@@ -177,7 +182,7 @@ export class LcuConnection {
         return this.#tools.filter((tool) => MODEL_TOOL_NAMES.includes(tool.name));
     }
     /**
-     * Spawn `lcu`, complete the MCP handshake, and discover tools.
+     * Spawn the runtime, complete the MCP handshake, and discover tools.
      *
      * @throws {LcuError} when the process cannot start or the handshake fails.
      */
@@ -190,10 +195,16 @@ export class LcuConnection {
         this.#controlSocketPath = undefined;
         if (process.platform === 'darwin') {
             try {
-                const { mkdtempSync, chmodSync } = await import('node:fs');
+                const { mkdtempSync, chmodSync, existsSync } = await import('node:fs');
                 const { tmpdir } = await import('node:os');
                 const { join } = await import('node:path');
-                const directory = mkdtempSync(join(tmpdir(), 'dsh-lcu-'));
+                // `/private/tmp`, not the per-user temporary directory. The wrapper that
+                // connects to this socket runs inside the runtime's JavaScript sandbox,
+                // and that sandbox refuses a Unix socket under `/var/folders/…` with
+                // EPERM — the same boundary that denies its file writes. `/private/tmp`
+                // is on the allowed side, which is why the wrapper this replaces uses it.
+                const base = existsSync('/private/tmp') ? '/private/tmp' : tmpdir();
+                const directory = mkdtempSync(join(base, 'dsh-lcu-'));
                 chmodSync(directory, 0o700);
                 this.#controlDirectory = directory;
                 this.#controlSocketPath = join(directory, 'c.sock');
@@ -203,7 +214,19 @@ export class LcuConnection {
                 this.#controlSocketPath = undefined;
             }
         }
-        const childEnv = { ...process.env, ...this.#options.env };
+        // Serve the socket before the child exists: the wrapper connects to it as soon
+        // as the runtime asks it for anything, and a missing listener looks exactly
+        // like a configuration that has no control channel at all.
+        if (this.#controlSocketPath !== undefined) {
+            try {
+                this.#controlServer = await ControlServer.open(this.#controlSocketPath, (message) => { this.#options.onDiag?.(message); });
+            }
+            catch (error) {
+                this.#controlServer = undefined;
+                this.#options.onDiag?.(`control: could not serve ${this.#controlSocketPath}: ${error instanceof Error ? error.message : String(error)}`);
+            }
+        }
+        const childEnv = this.#options.env ?? { ...process.env };
         if (this.#controlSocketPath === undefined)
             delete childEnv.LCU_MAC_CONTROL_SOCKET;
         else
@@ -283,11 +306,11 @@ export class LcuConnection {
     /**
      * Close the connection and let the runtime tear itself down.
      *
-     * Order matters: the server owns a process tree (the CUA kernel, its trusted
-     * worker, the macOS supervisor and the Sky helper), and LCU's supervisor exits
-     * when its lifetime socket closes. Closing stdin gives the server that
-     * orderly path; signalling first would orphan the tree on a machine that then
-     * keeps reporting computer use as active.
+     * Order matters: the server owns a process tree — the runtime kernel, its
+     * trusted worker and the signed Sky helper the macOS native pipe launches.
+     * Closing stdin gives the server its orderly shutdown path; signalling first
+     * would orphan that tree on a machine that then keeps reporting computer use
+     * as active.
      */
     /**
      * The original runtime reads its session and turn from `_meta`, and its
@@ -305,9 +328,19 @@ export class LcuConnection {
         diag(`call meta: session=${this.sessionId ?? 'none'} turn=${turnId ?? 'none'} sent=${meta === undefined ? 'no' : 'yes'}`);
         return meta === undefined ? {} : { _meta: meta };
     }
-    /** Whether this platform and connection expose the explicit per-app Stop. */
+    /**
+     * Whether the explicit per-app Stop is actually available.
+     *
+     * The socket path alone is not the answer: a configuration that interposes no
+     * lifecycle service sets nothing up to serve it, and reporting a channel that
+     * cannot be reached would turn "this is not supported here" into a connection
+     * error the caller has to interpret.
+     */
     get hasHostControl() {
-        return this.#controlSocketPath !== undefined && !this.#closed;
+        // Not "the path exists": a configuration that installs no wrapper never
+        // connects to it, and reporting a channel nobody serves turns "this is not
+        // supported here" into a connection error the caller has to interpret.
+        return this.#controlServer?.connected === true && !this.#closed && !this.#controlUnavailable;
     }
     /**
      * List the applications the runtime currently holds for one turn.
@@ -383,7 +416,13 @@ export class LcuConnection {
             };
             const timer = setTimeout(() => { finish(new LcuError('turn_ended', 'the Computer Use control request timed out')); }, CONTROL_TIMEOUT_MS);
             const socket = createConnection(socketPath);
-            socket.on('error', (error) => { finish(new LcuError('turn_ended', `control connection failed: ${error.message}`)); });
+            socket.on('error', (error) => {
+                // Nothing listening means this configuration has no control channel,
+                // rather than a channel that refused this particular request.
+                if (error.code === 'ENOENT' || error.code === 'ECONNREFUSED')
+                    this.#controlUnavailable = true;
+                finish(new LcuError('turn_ended', `control connection failed: ${error.message}`));
+            });
             socket.on('connect', () => { socket.write(`${JSON.stringify(request)}\n`); });
             socket.on('data', (chunk) => {
                 buffer += chunk.toString('utf8');
@@ -427,25 +466,33 @@ export class LcuConnection {
     async close() {
         this.#closed = true;
         this.#failAll(new LcuError('spawn', 'connection closed'));
+        await this.#controlServer?.close();
+        this.#controlServer = undefined;
         const child = this.#child;
         this.#child = undefined;
-        if (child === undefined || child.exitCode !== null) {
-            this.#removeControlDirectory();
-            return;
-        }
         try {
-            child.stdin?.end();
+            if (child === undefined || child.exitCode !== null)
+                return;
+            try {
+                child.stdin?.end();
+            }
+            catch {
+                // An already-broken stdin just means we fall through to signalling.
+            }
+            if (await this.#exited(child, 5_000))
+                return;
+            child.kill('SIGTERM');
+            if (await this.#exited(child, 3_000))
+                return;
+            child.kill('SIGKILL');
+            await this.#exited(child, 2_000);
         }
-        catch {
-            // A already-broken stdin just means we fall through to signalling.
+        finally {
+            // Always. A socket in a directory nobody removes is a leak per connection,
+            // and the earlier version left one behind on every path that had to signal
+            // the child rather than have it exit on stdin.
+            this.#removeControlDirectory();
         }
-        if (await this.#exited(child, 5_000))
-            return;
-        child.kill('SIGTERM');
-        if (await this.#exited(child, 3_000))
-            return;
-        child.kill('SIGKILL');
-        await this.#exited(child, 2_000);
     }
     /** Resolve `true` once the child has exited, or `false` after `timeoutMs`. */
     #exited(child, timeoutMs) {