computer-mcp 0.2.1: everything a person can delegate — send port, screen lending, password fields fail closed

[GLouv]

computer-mcp 0.2.1 — «everything a person can delegate»

Everything since 0.1.0, built on a clean macOS 15 runner (the «Fremmed Mac» workflow). Nothing here is published; merging does not publish — udgiv-npm.yml now requires the udgivelse environment, and the npm tag it needs doesn't exist yet either (see below).

What it adds

• Password fields are refused on every write path — computer_type (checked before every character, including a Tab into a password field halfway through), computer_set_value, and blackout in screenshots. An AX lookup that fails is treated as secure (fail closed).
• Consent shows the whole action (up to 4,000 characters, wrapped in the menu bar icon); anything longer is not asked. Consent goes through the icon with Touch ID in the foreground too; the dialog is only a fallback when the icon is not running.
• computer_ask_user works in background mode — the question waits in the icon («Take me there», «Done»); Done is a signal, never a consent.
• Send port: in listed chat and mail apps and recognised web chats/webmail, Send (pressed, clicked, several languages, nameless buttons) and Return in chat asks for that one message, showing the recipient and text read from the screen by the server. The Send control must sit next to the text field in the conversation's window; if anything cannot be read, nothing is sent. What would be sent is re-checked under the lock.
• Screen lending: computer_request_screen — the person lends one agent the screen with Touch ID for at most 15 minutes; each step waits while the person uses keyboard or mouse; «Take the screen back now» ends it and stops a running step (paste stops before Cmd+V and restores the clipboard). CMCP_BACKGROUND set locks it out.
• computer_permissions names the rules in your client that walk around the gate (shell, sudo, osascript, interpreters, browser/computer automation). SECURITY.md says plainly what the gate is and is not.
• The door (computer_open), macOS 15 builds, honest foreground claims, fail-closed per-app lock.

How it was checked (updated 2/10 — supersedes the earlier «every finding fixed» claim)

review-security found 11 findings (F1–F11) in this PR's code. Gustav's decision (2/10): fix F1 and F5, accept F2–F4 and F6–F11 as known risk for 0.2.1.

• F1 (Critical — fixed, verified): an ownership-match exception in knapErFarlig reopened the exact fail-open gap the gate exists to close. The exception is gone — found:false now always asks, no exceptions (46e3cdc). A follow-up mutation-coverage gap from the dedup that fix required was also found and fixed (2ba02e6, b184854).
• F5 (Important — fixed, verified): computer_press's danger-check failed open on a dry-run timeout or a missing would_press (read as "harmless" instead of "unknown") — the exact asymmetry already fixed for clicks in F1, just on the other branch. Now fails closed like the click path, mutation-proven both ways (test/knap-ord.mjs cases 11–12, mutants Q27–Q28).
• Accepted as known risk for 0.2.1 (Gustav, 2/10): F2 (nameless AXLink/AXStaticText web-link click bypass, Important), F3 (click can land on a different/covering app's element when found:true, Important), F4, F6–F11 (Suggestion-severity).
• A second, independent gap found by this session's review AND a sibling chat's Astra+Opus panel (2/10): the "no agent took the screen" claim (used in docs copy) is not fully measured — test/parallel.mjs explicitly filters com.apple.finder out of its per-agent screen-ownership check, so a Finder self-activation (a known, previously-logged macOS quirk) passes that check silently even when Finder did take the foreground. Not fixed; disclosed.
• Fremmed Mac CI was red on 7 consecutive pushes (f22496a → 46e3cdc) before the F1 coverage gap was found and fixed (b184854, confirmed green). Three more commits (release-script fixes, unrelated to tested code paths) and this F5 fix followed; see commit history for the exact frozen SHA this PR merges at.
• Earlier in this PR's life: five review rounds by two independent models (Astra, Fable) on the pre-regression code, final verdicts GODKENDT from both.

Known limitations (unmeasured, stated in README/SECURITY)

• Send port against real messaging apps (layout-dependent binding; Slack/Teams may be refused rather than asked).
• Web chats are recognised by page title; a chat on an unlisted site is not.
• Touch ID and the human-input pause are unmeasured on real hardware; exclusivity between two servers is enforced by the icon but not measured live.
• The "no agent took the screen" guarantee does not cover Finder (see above).
• F2–F4, F6–F11 from review-security (see above) — accepted as known risk for 0.2.1.

🤖 Generated with Claude Code