cmux NEXT: defer Computer Use permission prompts until setup

Merged
TE
10d ago
+237-14

Computer Use no longer asks for Accessibility when its upstream helper starts or updates. The existing setup buttons and agent permission Continue cards request the selected macOS grant through the private app-to-helper control pipe. A click made while the helper starts waits for readiness; turning Computer Use off cancels it.

dont prompt for permissions on launch

The launch audit found notification authorization at the first banner, dictation permissions when dictation starts, and camera/screen-sharing requests at feature actions. iPhone hosting remains opt-in and the device hub waits for sign-in. This change addresses the explicit upstream-helper launch prompt found in that audit.

Overlap: #26060 handles the legacy driver's first-use setup and still includes the upstream helper's launch prompt. This PR changes that upstream prompt and its setup request channel; #25844 handles upstream target protection.

Changelog

Fixed: Computer Use asks for macOS permissions from setup instead of when the app launches.

Validation

  • python3 scripts/cmux-next/check-package-dependency-lists.py and python3 scripts/cmux-next/prepush-gate.py: passed at 2b7d6392bfaf369e276af5abe69c6d8ea9b866d9.
  • scripts/ci/package-test-lane.sh suite Packages/macOS/CmuxComputerUseHelper HelperPermissionTests,HelperSocketProcessTests: fleet job b53ccaf950f0a9a32edf2b55, passed both suites at 2536b17c451bd271b413487081b84afa32dc5d56. Reused for final 2b7d6392bfaf369e276af5abe69c6d8ea9b866d9: helper package tree 0f4bed0d4fd245d3db8192d59f23eebf6743c82a and test-lane script blob 4c8c1de0ebea5e3bf8ea2b94ee5d388c3e36f5a1 are identical at both commits; only the app permission action and its test changed afterward.
  • scripts/ci/package-test-lane.sh suite Packages/macOS/CmuxNext ComputerUsePermissionRequestTests,ComputerUseDeferredPermissionTests,ComputerUseStatusSocketTests: fleet job 170bdf92f35a44199e4add28, passed all three suites at final 2b7d6392bfaf369e276af5abe69c6d8ea9b866d9. App job 55f9f3cd62fc105d0adabcac passed all three suites at 48e96177cedd832472e7158a7b14a02e4cc05677; the final delta declares the direct test dependency required by the static check.
  • Earlier app job 60f350e598d07dd115bfed73 passed all three suites at a21186e84636f23863f25ad64d3de84991b5aad8; final app job adds coverage of the agent Continue card path found in review.
    Review (review-launch-permissions-a211): SHIP at 2b7d6392bfaf369e276af5abe69c6d8ea9b866d9

Hosted check reconciliation

The final static check passes package dependency lists; its only blocking annotation is the existing literal state-root fixture in cmux-tui/crates/acpmux/src/prompt_uploads.rs:345. The same line exists in CI base 10636e04cd4b006d0393d43cd00836779ce5cc87, and this PR does not change that file. Release-notary and its guard wrapper also fail on the base. The intent warning and PR-link job failed on GitHub installation API rate limits.

Observed / Not run

The helper test compiled, then exposed a pipe-read timeout in the test harness; this head reads its acknowledgement without waiting for EOF. Source tracing found the unconditional per-version Accessibility request at helper startup. Tests exercise named grants over the private control pipe, silent setup/status reads, queued/cancelled setup requests, and the agent Continue action. Composite Computer Use requests still advance one grant at a time. A fresh macOS permission-dialog run has not been observed; no screenshots are claimed.

No capture: this changes when the existing setup buttons request macOS grants, with no visual layout change; a fresh macOS permission-dialog run remains unobserved.

Agent session: agent session