feat(desktop): Computer Use for macOS, Windows, and Linux

apps/desktop/scripts/electron-launcher.mjs

@@ -228,6 +228,14 @@ function patchMainBundleInfoPlist(appBundlePath, iconPath, executableName) {
   setPlistString(infoPlistPath, "CFBundleIdentifier", APP_BUNDLE_ID);
   setPlistString(infoPlistPath, "CFBundleExecutable", executableName);
   setPlistString(infoPlistPath, "CFBundleIconFile", "icon.icns");
+  // Without this key macOS denies every Apple Event with errAEEventNotPermitted
+  // (-1743) and never shows the Automation prompt, so Codex Computer Use and any
+  // other MCP server we spawn silently fail to drive other apps.
+  setPlistString(
+    infoPlistPath,
+    "NSAppleEventsUsageDescription",
+    "This app needs to control other apps to run Computer Use automations you approve.",
+  );
   setPlistJson(infoPlistPath, "CFBundleURLTypes", [
     {
       CFBundleURLName: APP_BUNDLE_ID,

apps/desktop/src/computerUse/permissions.test.ts

@@ -0,0 +1,99 @@
+// @effect-diagnostics nodeBuiltinImport:off - Fixture reads of Chrome Secure Preferences stay synchronous.
+import * as NodeFS from "node:fs";
+import * as NodeOS from "node:os";
+import * as NodePath from "node:path";
+import { assert, describe, it } from "@effect/vitest";
+import { vi } from "vite-plus/test";
+
+vi.mock("electron", () => ({
+  systemPreferences: {
+    isTrustedAccessibilityClient: vi.fn(() => false),
+    getMediaAccessStatus: vi.fn(() => "denied"),
+  },
+  shell: {
+    openExternal: vi.fn(async () => undefined),
+  },
+}));
+
+import * as Electron from "electron";
+
+import { openComputerUsePrivacySettings, readComputerUsePermissions } from "./permissions.ts";
+
+describe("computerUse permissions", () => {
+  it("reports accessibility and screen recording on darwin", () => {
+    const previous = process.platform;
+    Object.defineProperty(process, "platform", { value: "darwin" });
+    try {
+      const state = readComputerUsePermissions();
+      assert.equal(state.platform, "darwin");
+      assert.deepEqual(
+        state.permissions.map((permission) => permission.kind),
+        ["accessibility", "screenRecording"],
+      );
+      assert.equal(state.permissions[0]?.status, "denied");
+      assert.equal(state.permissions[1]?.status, "denied");
+    } finally {
+      Object.defineProperty(process, "platform", { value: previous });
+    }
+  });
+
+  it("marks privacy permissions not required off macOS", () => {
+    const previous = process.platform;
+    Object.defineProperty(process, "platform", { value: "linux" });
+    try {
+      const state = readComputerUsePermissions();
+      assert.equal(state.platform, "linux");
+      assert.isTrue(state.permissions.every((permission) => permission.status === "notRequired"));
+    } finally {
+      Object.defineProperty(process, "platform", { value: previous });
+    }
+  });
+
+  it("opens the Accessibility privacy pane and prompts trust", async () => {
+    const previous = process.platform;
+    Object.defineProperty(process, "platform", { value: "darwin" });
+    try {
+      const opened = await openComputerUsePrivacySettings("accessibility");
+      assert.isTrue(opened);
+      assert.equal(
+        vi.mocked(Electron.systemPreferences.isTrustedAccessibilityClient).mock.calls.at(-1)?.[0],
+        true,
+      );
+      assert.equal(
+        vi.mocked(Electron.shell.openExternal).mock.calls.at(-1)?.[0],
+        "x-apple.systempreferences:com.apple.preference.security?Privacy_Accessibility",
+      );
+    } finally {
+      Object.defineProperty(process, "platform", { value: previous });
+    }
+  });
+
+  it("detects an unpacked extension from Secure Preferences without state", () => {
+    const previous = process.platform;
+    Object.defineProperty(process, "platform", { value: "darwin" });
+    const home = NodeOS.homedir();
+    const securePath = NodePath.join(
+      home,
+      "Library/Application Support/Google/Chrome/Default/Secure Preferences",
+    );
+    try {
+      if (!NodeFS.existsSync(securePath)) return;
+      const raw = NodeFS.readFileSync(securePath, "utf8");
+      const parsed = JSON.parse(raw) as {
+        extensions?: { settings?: Record<string, unknown> };
+      };
+      const hasExtension = Boolean(parsed.extensions?.settings?.kgdolgnijopbghhomnblabjkmjhnoage);
+      const state = readComputerUsePermissions();
+      if (hasExtension) {
+        assert.deepEqual(state.chromeExtension, {
+          status: "installed",
+          detail: "Browser extension installed",
+        });
+      } else {
+        assert.isTrue(["missing", "unknown"].includes(state.chromeExtension.status));
+      }
+    } finally {
+      Object.defineProperty(process, "platform", { value: previous });
+    }
+  });
+});