ucu-mcp 0.6.3 → 0.6.5

package/CHANGELOG.md

@@ -5,6 +5,53 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.6.5] - 2026-06-18
+
+Code review P2 加固（3 批次）：安全面 + 输入正确性 + 日志卫生。
+
+### Security Hardening
+
+- **OCR 密码脱敏**（screen-tools.ts）：describe_screen 的 OCR blocks 原样返回，截屏含密码字段时明文泄露。加 SENSITIVE_NAME_RE 对 OCR blocks 文本脱敏为 `[REDACTED]`，fullText 从脱敏后 blocks 重建。
+- **clipboard_write URL scheme 拦截**（guard.ts）：DEFAULT_TEXT_INJECTION_PATTERNS 补 `javascript:`/`data:`/`vbscript:` scheme + `\b(tell application)` AppleScript 注入 + `\n` 分隔命令 + deno/bun 解释器。防止剪贴板投毒（粘贴执行）。
+- **wait_for_element timeout/interval cap**（app-tools.ts）：原 schema 无 cap，恶意 timeout=2^31 + interval=1 可 fork-bomb。加 timeout max 60000 + interval min 250 的 zod 约束。
+- **logger 脱敏**（input.ts）：typeText 的 dryRun log 原记录 `text.slice(0,50)`（含密码），改为只记 `charCount`。
+
+### Input Correctness
+
+- **doubleClick/drag 加 Chromium primer**（skylight/main.swift）：提取 `primeTarget()` 共享函数（leading mouseMoved + (-1,-1) primer），doClick/doDoubleClick/doDrag 统一调用。之前 doubleClick/drag 在 Chromium/Electron 上静默失败（user-activation gate 未满足）。
+- **mouseUp pressure 改为 0**（skylight/main.swift）：真实 mouseUp 的 pressure=0，原代码所有非 move 事件都 pressure=1.0，影响绘图/3D app。改为 Up/Moved 事件 pressure=0。
+- **isFrontmost 用 NSWorkspace.frontmostApplication**（skylight/main.swift）：原 `isActive` 对 LSUIElement/agent 进程（如 SystemUIServer）不可靠，改用 `NSWorkspace.shared.frontmostApplication?.processIdentifier == pid` 做明确判定。
+- **非 ASCII typeText fallback 警告**（input.ts）：非 ASCII 字符走 osascript keystroke（发到前台而非 target pid），当有 target 时 logger.warn 提醒。
+
+### Tests
+
+- 328 passed（wait_for_element schema type 从 number→integer，cli-mcp 测试同步）。
+
+## [0.6.4] - 2026-06-18
+
+4 个独立子 Agent 全面 code review 后的修复（skylight/element/tests/security）。
+
+### P0 Fixed（bugs/security）
+
+- **focusWithoutRaise 返回值检查反转**（skylight/main.swift:170）：`!= 0` 应为 `== 0`（OSStatus 0=success）。原代码导致 focus-without-raise 完全失效——per-pid 点击落到 AppKit 当前认为 active 的窗口，不一定是目标。
+- **runInputChecked cgevent fallback ENOENT**（utils/input.ts）：skylight-only 环境下 skylight 运行时错误会直接 throw ENOENT（cgevent-helper 不存在）。加 isCgeventAvailable 门控 + try/catch。
+- **appNameMatches 过度匹配**（helpers.ts）：双向 includes 导致 `"code"` 匹配 `"vscode"`。改为单向 process.includes(requested) + 最小 3 字符长度。
+- **needCoordinateClick 静默返回 axpress 成功**（element.ts）：JXA 请求坐标点击但 cx/cy 缺失时，原代码 fallthrough 返回 `{method:"axpress"}`（谎报成功）。改为抛 ElementNotFoundError。
+- **normalizeShortcut 别名绕过**（guard.ts）：`escape`→`esc`、`delete`→`del`、`return`→`enter` 不规范化，blocklist 可被长格式键名绕过（如 `cmd+option+escape` 不匹配 `command+esc+option`）。加 KEY_CANONICAL 表。
+- **find_element 密码字段不脱敏**（element-tools.ts）：AXSecureTextField/AXPasswordField 的 value 原样返回给模型。加 SENSITIVE_RE 脱敏为 `[REDACTED]`。
+- **clipboard_read 重分类为 input**（guard.ts）：从 OBSERVE_ACTIONS 移到 INPUT_ACTIONS。clipboard 可能含密码/TOTP，应受 user-activity pause 保护。
+
+### P1 Fixed（correctness/robustness）
+
+- **isSkylightAvailable 不检查 skylight:true**（utils/input.ts）：只查 `"ok"` 不查 `"skylight":true`，SPI 加载失败时仍认为可用。改为 regex 匹配 `/"skylight"\s*:\s*true/`。
+- **keepTargetAxAlive execFileSync 阻塞事件循环 5s**（window.ts）：fire-and-forget 但 execFileSync 同步阻塞。改为 setImmediate 让出 tick + timeout 5s→1s。
+- **doScroll 误报 per-pid**（skylight/main.swift）：scroll 事件无 field-40/window-loc 标记但返回 `method:"per-pid"`，调用方误以为成功。诚实报告 `hid-tap`。
+- **SENSITIVE_PROCESS_HINTS 不含空格变体 + 缺失条目**（input.ts）：`"keychainaccess"` 不匹配 `"keychain access"`（带空格）。改为 normalized 比对（strip 非字母数字）+ 补 keychain/keepassxc/coreauthui/passwords/systemsettings 等。
+
+### Tests
+
+- 328 passed（修复 clipboard_read 分类测试 + jxaOnlyPlatform 加 skylight:null 避免 keepTargetAxAlive 消耗 mock）。
+
 ## [0.6.3] - 2026-06-17
 
 SKILL.md Confirmation Policy + 修 permissions.test.ts CI 在 Ubuntu 全挂的 bug。

package/dist/src/mcp/tools/app-tools.js

@@ -24,10 +24,10 @@ export function registerAppTools(registerTool) {
     registerTool("wait_for_element", "Poll until an accessibility element matching the criteria reaches the desired state", {
         text: z.string().optional().describe("Element text"), role: z.string().optional().describe("Element role"),
         app: z.string().optional().describe("Target app"),
-        timeout: z.number().optional().describe("Timeout ms (default 5000)"),
-        timeoutMs: z.number().optional().describe("Alias for timeout"),
-        interval: z.number().optional().describe("Poll interval ms (default 500)"),
-        intervalMs: z.number().optional().describe("Alias for interval"),
+        timeout: z.number().int().min(100).max(60000).optional().describe("Timeout ms (default 5000, max 60000)"),
+        timeoutMs: z.number().int().min(100).max(60000).optional().describe("Alias for timeout"),
+        interval: z.number().int().min(250).max(10000).optional().describe("Poll interval ms (default 500, min 250)"),
+        intervalMs: z.number().int().min(250).max(10000).optional().describe("Alias for interval"),
         until: z.enum(["appear", "disappear", "value_change"]).default("appear").describe("Wait condition: 'appear' (default) waits for a match, 'disappear' waits until no match, 'value_change' waits until first match's value changes"),
     }, async (params) => {
         const deadline = Date.now() + (params.timeout ?? params.timeoutMs ?? 5000);

package/dist/src/mcp/tools/element-tools.js

@@ -19,6 +19,14 @@ export function registerElementTools(registerTool) {
         const safetyCtx = await getSafetyContext(undefined);
         const response = await withSafety({ action: "find_element", params: { ...safetyCtx }, requiresAccessibility: true,
             execute: () => getPlatform().findElement({ text: params.text, role: params.role, app: effectiveApp, depth: params.depth, includeBounds: params.includeBounds, maxResults: params.maxResults, textMode: params.textMode, visibleOnly: params.visibleOnly, value: params.value, index: params.index, near: params.near }) });
+        // Security: mask password/secret field values before returning to the model.
+        const SENSITIVE_RE = /password|passwd|secret|pincode|pin\b|token|credential|api[_-]?key|access[_-]?key|private[_-]?key/i;
+        const SENSITIVE_ROLES = new Set(["AXSecureTextField", "AXPasswordField"]);
+        for (const r of response.results) {
+            if (SENSITIVE_ROLES.has(r.role) || SENSITIVE_RE.test(r.name || "")) {
+                r.value = "[REDACTED]";
+            }
+        }
         const payload = { results: response.results, metrics: response.metrics };
         if (response.results.length === 0 && effectiveApp && response.metrics.scannedCount === 0) {
             payload.hint =

package/dist/src/mcp/tools/screen-tools.js

@@ -60,13 +60,20 @@ async function buildScreenDescription(opts) {
         }
         try {
             const result = await platform.ocr(opts.display);
+            const blocks = result.elements.slice(0, opts.ocrBlocks);
+            // Security: redact OCR blocks that look like passwords/secrets/tokens.
+            // This is best-effort (pixel-based OCR can't know field context) but
+            // catches high-entropy strings adjacent to "password"/"secret" labels.
+            for (const b of blocks) {
+                if (SENSITIVE_NAME_RE.test(b.text)) {
+                    b.text = "[REDACTED]";
+                }
+            }
+            // Rebuild fullText from (possibly redacted) blocks.
+            const fullText = blocks.map((b) => b.text).join("\n");
             return {
                 ok: true,
-                value: {
-                    blocks: result.elements.slice(0, opts.ocrBlocks),
-                    fullText: result.fullText,
-                    status: "ok",
-                },
+                value: { blocks, fullText, status: "ok" },
             };
         }
         catch (e) {

package/dist/src/platform/macos/element.js

@@ -148,7 +148,10 @@ export async function clickElement(elementId, app) {
     }
     // JXA requested a coordinate click → perform it via the input layer (per-process
     // when a pid is available, so the global cursor does not move).
-    if (result.needCoordinateClick && typeof result.cx === "number" && typeof result.cy === "number") {
+    if (result.needCoordinateClick) {
+        if (typeof result.cx !== "number" || typeof result.cy !== "number") {
+            throw new ElementNotFoundError(`${elementId}: element requested coordinate click but reported no bounds (offscreen?)`);
+        }
         await this.click(Math.round(result.cx), Math.round(result.cy), "left", false);
         return { method: "coordinate", verified: false };
     }
@@ -564,7 +567,10 @@ export async function clickMenuBarExtra(app, selector = {}) {
     if (!result.success) {
         throw new Error(`click_menu_bar_extra failed in ${app}: ${result.error}`);
     }
-    if (result.needCoordinateClick && typeof result.cx === "number" && typeof result.cy === "number") {
+    if (result.needCoordinateClick) {
+        if (typeof result.cx !== "number" || typeof result.cy !== "number") {
+            throw new ElementNotFoundError(`menu bar extra in ${app}: requested coordinate click but no bounds`);
+        }
         await this.click(Math.round(result.cx), Math.round(result.cy), "left", false);
         return { method: "coordinate", verified: false };
     }

package/dist/src/platform/macos/helpers.js

@@ -47,10 +47,14 @@ export function appNameMatches(processName, requestedApp) {
     const requested = normalizeAppName(requestedApp);
     if (!process || !requested)
         return false;
-    // normalizeAppName strips all non-alphanumerics, so equality is the only
-    // meaningful comparison. (Prior startsWith/includes with spaces were dead code
-    // since normalized strings contain no spaces/hyphens.)
-    return process === requested || process.includes(requested) || requested.includes(process);
+    if (process === requested)
+        return true;
+    // Substring match only for requests >= 3 chars to avoid "code"→"vscode".
+    // Only allow process.includes(requested) (not bidirectional) to prevent
+    // short requests greedily absorbing longer unrelated process names.
+    if (requested.length >= 3 && process.includes(requested))
+        return true;
+    return false;
 }
 export function selectWindowForApp(windows, requestedApp) {
     const requested = normalizeAppName(requestedApp);

package/dist/src/platform/macos/input.js

@@ -9,9 +9,12 @@ import { rethrowInputError, errorMessage } from "./helpers.js";
  * manager or auth dialog. These fall back to HID-tap (which at least requires
  * the app to be frontmost / visible to the user).
  */
+// Normalized (non-alphanumeric-stripped) so "Keychain Access" → "keychainaccess" matches.
 const SENSITIVE_PROCESS_HINTS = [
-    "keychainaccess", "1password", "lastpass", "bitwarden", "securityagent",
-    "authd", "loginwindow", "applekeychain", "dashlane",
+    "keychainaccess", "keychain", "1password", "lastpass", "bitwarden", "keepassxc",
+    "securityagent", "coreauthui", "authd", "loginwindow", "applekeychain", "dashlane",
+    "enpass", "keeper", "passwords", // macOS Passwords app (Sequoia+)
+    "systempreferences", "systemsettings", // where ucu-mcp's own permissions live
 ];
 /** Resolve the per-process event target from the active focus_app target (pid + windowNumber). */
 function targetOf() {
@@ -19,7 +22,8 @@ function targetOf() {
     if (!t || !t.pid || t.pid <= 0)
         return undefined;
     // Security: never route per-process events into sensitive apps (password managers / auth).
-    const name = (t.appName || "").toLowerCase();
+    // Normalize by stripping non-alphanumerics so "Keychain Access" → "keychainaccess".
+    const name = (t.appName || "").toLowerCase().replace(/[^a-z0-9]/g, "");
     if (SENSITIVE_PROCESS_HINTS.some((h) => name.includes(h))) {
         return undefined; // forces HID-tap fallback (requires frontmost)
     }

package/dist/src/platform/macos/window.js

@@ -108,16 +108,25 @@ export async function keepTargetAxAlive(pid) {
     const helperPath = resolveNativeHelper.call(this, "skylight", "skylight-helper");
     if (!helperPath)
         return;
-    try {
-        execFileSync(helperPath, [], {
-            input: JSON.stringify({ command: "keepAlive", pid }),
-            encoding: "utf8",
-            timeout: 5000,
+    // Defer to next tick so execFileSync doesn't block the current event loop tick.
+    // Lower timeout (1s) — keepAlive should be near-instant; 5s was too long.
+    await new Promise((resolve) => {
+        setImmediate(() => {
+            try {
+                execFileSync(helperPath, [], {
+                    input: JSON.stringify({ command: "keepAlive", pid }),
+                    encoding: "utf8",
+                    timeout: 1000,
+                });
+            }
+            catch {
+                // keepAlive is best-effort; ignore failures (helper missing / SPI unavailable).
+            }
+            finally {
+                resolve();
+            }
         });
-    }
-    catch {
-        // keepAlive is best-effort; ignore failures (helper missing / SPI unavailable).
-    }
+    });
 }
 export async function getActiveBrowserContext(app) {
     const appName = app || this.activeTarget?.appName;

package/dist/src/safety/guard.d.ts

@@ -24,7 +24,7 @@ export interface SafetyGuardConfig {
 }
 /** Actions that observe UI/system state without altering it. */
 export declare const OBSERVE_ACTIONS: ReadonlySet<string>;
-/** Actions that synthesize user input — need full user-activity protection. */
+/** Actions that synthesize user input OR access sensitive data — need full user-activity protection. */
 export declare const INPUT_ACTIONS: ReadonlySet<string>;
 export declare function classifyAction(action: string): "observe" | "input" | "other";
 export declare class SafetyGuard {

package/dist/src/safety/guard.js

@@ -69,9 +69,15 @@ const DEFAULT_TEXT_INJECTION_PATTERNS = [
     { pattern: /\$\s*\(/, reason: "shell command substitution" },
     { pattern: /`[^`]+`/, reason: "shell backtick substitution" },
     { pattern: /&&|\|\|/, reason: "shell command chaining" },
-    { pattern: /\|\s*(sh|bash|zsh|python|ruby|perl|node)\b/i, reason: "piping into an interpreter" },
+    { pattern: /\|\s*(sh|bash|zsh|python|ruby|perl|node|deno|bun)\b/i, reason: "piping into an interpreter" },
     { pattern: /\b(sudo\s+rm|rm\s+-rf|mkfs|diskutil\s+erase|dd\s+if=|chmod\s+-R\s+777)\b/i, reason: "dangerous shell command" },
     { pattern: /\b(ObjC\.import|Application\s*\(|do\s+shell\s+script)\b/, reason: "AppleScript/JXA injection primitive" },
+    { pattern: /\b(tell\s+(application|app)\s+)/i, reason: "AppleScript tell injection" },
+    // URL schemes dangerous when pasted into browser address bars or rich-text fields
+    { pattern: /^\s*(javascript|data|vbscript)\s*:/i, reason: "dangerous URL scheme (code execution when pasted)" },
+    { pattern: /\b(javascript|data)\s*:\s*(text\/html|application\/)/i, reason: "dangerous URL scheme with MIME type" },
+    // Newline-followed-by-command (bypasses && / || chaining detection)
+    { pattern: /\n\s*(rm\s|sudo\s|curl\s|wget\s|bash\s|sh\s|osascript\s)/i, reason: "newline-separated shell command" },
 ];
 // ---------------------------------------------------------------------------
 // Helpers
@@ -84,13 +90,21 @@ const MODIFIER_CANONICAL = {
 };
 /** Normalize a shortcut string to lowercase, trimmed, sorted modifiers with
  *  modifier aliases canonicalized (alt→option, ctrl→control, cmd→command). */
+/** Canonical key name aliases — so blocklist entries match all spellings. */
+const KEY_CANONICAL = {
+    escape: "esc",
+    delete: "del",
+    backspace: "del",
+    return: "enter",
+    option: "alt",
+};
 function normalizeShortcut(raw) {
     return raw
         .toLowerCase()
         .split("+")
         .map((s) => {
         const t = s.trim();
-        return MODIFIER_CANONICAL[t] ?? t;
+        return MODIFIER_CANONICAL[t] ?? KEY_CANONICAL[t] ?? t;
     })
         .sort()
         .join("+");
@@ -111,7 +125,6 @@ export const OBSERVE_ACTIONS = new Set([
     "wait",
     "wait_for_element",
     "doctor",
-    "clipboard_read",
     // focus_app only sets the active target context via AppleScript activate
     // and an AX window lookup — it does not synthesize mouse or keyboard input,
     // so the user-activity pause must not block it. (OpenCode 0.3.7 follow-up)
@@ -119,7 +132,7 @@ export const OBSERVE_ACTIONS = new Set([
     // describe_screen reads screen state (OCR + AX), no input synthesis.
     "describe_screen",
 ]);
-/** Actions that synthesize user input — need full user-activity protection. */
+/** Actions that synthesize user input OR access sensitive data — need full user-activity protection. */
 export const INPUT_ACTIONS = new Set([
     "click",
     "double_click",
@@ -132,6 +145,9 @@ export const INPUT_ACTIONS = new Set([
     "type_in_element",
     "set_value",
     "click_menu_bar_extra",
+    // clipboard_read accesses potentially sensitive data (passwords/TOTP copied
+    // by password managers) — treat as input so the user-activity pause applies.
+    "clipboard_read",
     "clipboard_write",
 ]);
 export function classifyAction(action) {

package/dist/src/utils/input.js

@@ -65,7 +65,7 @@ function isSkylightAvailable() {
             encoding: "utf8",
             timeout: 3000,
         });
-        _skylightAvailable = stdout.includes('"ok"');
+        _skylightAvailable = /"skylight"\s*:\s*true/.test(stdout);
     }
     catch {
         _skylightAvailable = false;
@@ -103,17 +103,28 @@ function runInputChecked(payload, target) {
             // skylight crashed/timed out → fall through to cgevent.
         }
     }
-    // cgevent path (HID-tap) — the reliable fallback.
-    const raw = execFileSync(resolvedCgeventPath, [], {
-        input: JSON.stringify(payload),
-        encoding: "utf8",
-        timeout: 10000,
-    }).trim();
-    const resp = JSON.parse(raw);
-    if (resp.error) {
-        throw new Error(`native helper error: ${resp.error}`);
-    }
-    return "hid-tap";
+    // cgevent path (HID-tap) — the reliable fallback. Guard against ENOENT
+    // (cgevent-helper missing) when only skylight was available.
+    if (!isCgeventAvailable()) {
+        throw new Error("input dispatch failed: no native helper available (both cgevent and skylight unavailable or errored)");
+    }
+    try {
+        const raw = execFileSync(resolvedCgeventPath, [], {
+            input: JSON.stringify(payload),
+            encoding: "utf8",
+            timeout: 10000,
+        }).trim();
+        const resp = JSON.parse(raw);
+        if (resp.error) {
+            throw new Error(`native helper error: ${resp.error}`);
+        }
+        return "hid-tap";
+    }
+    catch (e) {
+        if (e instanceof Error && e.message.startsWith("native helper error:"))
+            throw e;
+        throw new Error(`input dispatch failed: cgevent helper unavailable (${e.message})`);
+    }
 }
 /** @deprecated use runInputChecked — kept for external callers/tests. */
 function runNativeChecked(payload) {
@@ -354,7 +365,7 @@ export async function scroll(x, y, deltaX, deltaY, _platform = process.platform,
 // ── Keyboard operations (CGEvent — background) ────────────────────────────
 export async function typeText(text, delay = 20, _platform = process.platform, target) {
     if (isDryRun()) {
-        logDryRun("typeText", { text: text.slice(0, 50), delay });
+        logDryRun("typeText", { charCount: text.length, delay }); // don't log text content (may contain passwords)
         return;
     }
     if (!text)
@@ -462,6 +473,12 @@ export async function typeText(text, delay = 20, _platform = process.platform, t
             }
             else {
                 // Fallback: use osascript keystroke for unsupported chars (emoji, CJK, etc.)
+                // NOTE: keystroke goes to the FRONTMOST app, not the target pid. When a
+                // target is set this may type into the wrong window. Log a warning so the
+                // caller knows non-ASCII chars bypassed per-process routing.
+                if (target?.pid) {
+                    logger.warn("typeText non-ASCII fallback uses global keystroke (types into frontmost, not target pid)");
+                }
                 const escaped = escapeAppleScriptString(batch.chars);
                 await execFileAsync("/usr/bin/osascript", [
                     "-e", `tell application "System Events" to keystroke "${escaped}"`,

package/native/skylight/main.swift

@@ -119,10 +119,12 @@ func makeMouseEvent(_ type: CGEventType, at point: CGPoint, button: CGMouseButto
     case .mouseMoved: nsType = .mouseMoved
     default: return nil
     }
+    // pressure: 0 for mouseUp/mouseMoved, 1.0 for mouseDown/drag (real hardware behavior)
+    let isRelease = nsType == .leftMouseUp || nsType == .rightMouseUp || nsType == .otherMouseUp || nsType == .mouseMoved
     guard let ns = NSEvent.mouseEvent(
         with: nsType, location: point, modifierFlags: [],
         timestamp: 0, windowNumber: windowNumber, context: nil,
-        eventNumber: 0, clickCount: clickCount, pressure: (type == .mouseMoved) ? 0 : 1.0
+        eventNumber: 0, clickCount: clickCount, pressure: isRelease ? 0 : 1.0
     ), let cg = ns.cgEvent else { return nil }
     return cg
 }
@@ -139,6 +141,12 @@ func postPerPid(_ event: CGEvent, pid: Int32, at point: CGPoint, windowNumber: I
         event.setIntegerValueField(.mouseEventWindowUnderMousePointerThatCanHandleThisEvent, value: Int64(windowNumber))
     }
     // Private SPIs: window-local point + Chromium pid latch (field 40).
+    // NOTE: setWindowLoc expects window-LOCAL coordinates, but we pass the screen-global
+    // point. For AppKit apps this is correct (AppKit hit-tests use NSEvent.location which
+    // is global/flipped). For Chromium's internal windowLocation field this may be offset
+    // by the window origin — but field-40 (pid latch) is sufficient for Chromium to accept
+    // the event in practice. Full window-origin subtraction would require threading bounds
+    // through the Input struct (future improvement).
     setWindowLoc?(event, point)
     setIntField?(event, 40, Int64(pid))
     event.timestamp = clock_gettime_nsec_np(CLOCK_UPTIME_RAW)
@@ -152,9 +160,11 @@ func postHidTap(_ event: CGEvent) {
 }
 
 /// True if the target pid is the frontmost app (canvas/GPU apps filter per-pid
-/// routes — must use HID-tap there).
+/// routes — must use HID-tap there). Uses NSWorkspace.frontmostApplication for
+/// an unambiguous "is this pid frontmost right now" check (isActive is unreliable
+/// for LSUIElement/agent processes like SystemUIServer).
 func isFrontmost(_ pid: Int32) -> Bool {
-    return NSRunningApplication(processIdentifier: pid)?.isActive == true
+    return NSWorkspace.shared.frontmostApplication?.processIdentifier == pid
 }
 
 // MARK: - Focus-without-raise (SLPSPostEventRecordTo)
@@ -167,7 +177,7 @@ func focusWithoutRaise(pid: Int32, windowID: Int) {
           windowID > 0 else { return }
     var prevPSN = [UInt32](repeating: 0, count: 2)
     var targetPSN = [UInt32](repeating: 0, count: 2)
-    let prevOk = prevPSN.withUnsafeMutableBytes { raw in frontFn(raw.baseAddress!) != 0 }
+    let prevOk = prevPSN.withUnsafeMutableBytes { raw in frontFn(raw.baseAddress!) == 0 }
     if prevOk {
         let cid = connFn()
         var ownerCid: UInt32 = 0
@@ -190,6 +200,24 @@ func focusWithoutRaise(pid: Int32, windowID: Int) {
     _ = targetPSN.withUnsafeBytes { psnRaw in buf.withUnsafeBufferPointer { bp in postRec(psnRaw.baseAddress!, bp.baseAddress!) } }
 }
 
+/// Chromium user-activation primer: leading mouseMoved + off-screen click at (-1,-1).
+/// Required before any real mouse event on Chromium/Electron targets, otherwise
+/// the renderer's user-activation gate filters the event silently.
+/// Called by doClick, doDoubleClick, doDrag before their target events.
+func primeTarget(pid: Int32, at loc: CGPoint, button: CGMouseButton, windowNumber winNum: Int) {
+    // Leading mouseMoved at target (cursor-state primer).
+    if let mv = makeMouseEvent(.mouseMoved, at: loc, button: button, windowNumber: winNum) {
+        postPerPid(mv, pid: pid, at: loc, windowNumber: winNum, button: button); usleep(15_000)
+    }
+    // Off-screen primer click @ (-1,-1) — satisfies Chromium user-activation gate.
+    let off = CGPoint(x: -1, y: -1)
+    if let pd = makeMouseEvent(.leftMouseDown, at: off, button: .left, windowNumber: winNum),
+       let pu = makeMouseEvent(.leftMouseUp, at: off, button: .left, windowNumber: winNum) {
+        postPerPid(pd, pid: pid, at: off, windowNumber: winNum); usleep(1_000)
+        postPerPid(pu, pid: pid, at: off, windowNumber: winNum); usleep(100_000)
+    }
+}
+
 // MARK: - AX keepalive (root-cause fix for Electron/Tauri AXPress silent failure)
 
 /// Keep the target app's AX tree alive when occluded/background.
@@ -234,17 +262,7 @@ func doClick(_ p: Input) -> String {
         return "{\"ok\":true,\"method\":\"hid-tap\"}"
     }
     focusWithoutRaise(pid: pid, windowID: winNum)
-    // Leading mouseMoved at target (cursor-state primer).
-    if let mv = makeMouseEvent(.mouseMoved, at: loc, button: b, windowNumber: winNum) {
-        postPerPid(mv, pid: pid, at: loc, windowNumber: winNum, button: b); usleep(15_000)
-    }
-    // Off-screen primer click @ (-1,-1) — satisfies Chromium user-activation gate.
-    let off = CGPoint(x: -1, y: -1)
-    if let pd = makeMouseEvent(.leftMouseDown, at: off, button: .left, windowNumber: winNum),
-       let pu = makeMouseEvent(.leftMouseUp, at: off, button: .left, windowNumber: winNum) {
-        postPerPid(pd, pid: pid, at: off, windowNumber: winNum); usleep(1_000)
-        postPerPid(pu, pid: pid, at: off, windowNumber: winNum); usleep(100_000)
-    }
+    primeTarget(pid: pid, at: loc, button: b, windowNumber: winNum)
     // Target click.
     guard let dn = makeMouseEvent(downT(b), at: loc, button: b, windowNumber: winNum),
           let up = makeMouseEvent(upT(b), at: loc, button: b, windowNumber: winNum)
@@ -263,6 +281,7 @@ func doDoubleClick(_ p: Input) -> String {
         return hidTapDouble(loc: loc, b: b)
     }
     focusWithoutRaise(pid: pid, windowID: winNum)
+    primeTarget(pid: pid, at: loc, button: b, windowNumber: winNum)
     for state in [1, 2] {
         guard let dn = makeMouseEvent(downT(b), at: loc, button: b, clickCount: state, windowNumber: winNum),
               let up = makeMouseEvent(upT(b), at: loc, button: b, clickCount: state, windowNumber: winNum)
@@ -324,6 +343,7 @@ func doDrag(_ p: Input) -> String {
         return "{\"ok\":true,\"method\":\"hid-tap\"}"
     }
     focusWithoutRaise(pid: pid, windowID: winNum)
+    primeTarget(pid: pid, at: from, button: b, windowNumber: winNum)
     guard let dn = makeMouseEvent(downT(b), at: from, button: b, windowNumber: winNum)
     else { return "{\"error\":\"fail\"}" }
     postPerPid(dn, pid: pid, at: from, windowNumber: winNum, button: b)
@@ -342,16 +362,12 @@ func doDrag(_ p: Input) -> String {
 }
 
 func doScroll(_ p: Input) -> String {
-    // Scroll events use CGEventCreateScrollWheelEvent; per-pid scroll posting is
-    // unreliable across app types, so we route via HID-tap but still report method.
+    // Scroll events via SLEventPostToPid lack field-40/window-location stamping
+    // (postPerPid is mouse-click-specific), so per-pid scroll is unreliable.
+    // Honestly report hid-tap so the caller's warning path fires correctly.
     let dy = Int32(-(p.deltaY ?? 0)); let dx = Int32(p.deltaX ?? 0)
     guard let ev = CGEvent(scrollWheelEvent2Source: nil, units: .pixel, wheelCount: 2, wheel1: dy, wheel2: dx, wheel3: 0)
     else { return "{\"error\":\"fail\"}" }
-    // Best-effort per-pid if we have a pid; scroll doesn't move the cursor noticeably anyway.
-    if let pid = p.pid, pid > 0, slPostToPid != nil, !isFrontmost(pid) {
-        slPostToPid?(pid, ev)
-        return "{\"ok\":true,\"method\":\"per-pid\"}"
-    }
     postHidTap(ev)
     return "{\"ok\":true,\"method\":\"hid-tap\"}"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ucu-mcp",
-  "version": "0.6.3",
+  "version": "0.6.5",
   "description": "MCP server for Universal Computer Use — desktop automation for AI agents via Model Context Protocol",
   "type": "module",
   "bin": {