cmux-cua: gate computer use on machine-join consent (patch at the pin)

Merged
TE
10d ago
+3562-38

Leo's ask this serves: "just have this sort of thing for, I guess, general onboarding of adding remote machines and whatnot and whatever, which includes, I guess, screen sharing potentially."

What

This ships manaflow-ai/cmux-cua#82 (machine-join consent at the cmux-cua execution boundary) as a second patch on the pinned cmux-cua source (e8a8dbfd), so the gate is in the app's Computer Use helper with no cmux-cua release. Once a release that contains #82 exists, the pin bump replaces this patch.

On a machine joined to a cmux team, every tool that reads the screen needs the screen grant and every tool that acts needs control. The check runs on every call and fails closed: a refusal is an MCP tool error {code: "consent_required", surface}. A machine that is not joined behaves as before.

  • scripts/build-cmux-cua.sh now applies a patch series (the existing Codex delivery-mode patch, then scripts/cmux-cua-machine-consent.patch). The build-source cache key hashes the whole series, so cached helper builds rebuild.
  • tests/test_cmux_cua_build_cache_safety.py and tests/test_cmux_cua_compat_contract.py now handle the series. The compat contract applies every patch, in order, to a copy of the pinned source.

scripts/cmux-cua-machine-consent.patch is git diff cmux-cua-native..<#82 head> -- libs (currently 8540ceea13bce96a34468979c8107e648e7a8b57). It is regenerated whenever #82 moves.

scripts/build-cmux-cua.sh builds the helper with --features cmux-host-consent. In this build, consent comes only from the verified cmux app over the helper's socket (#27404); no file or environment variable decides it.

No Swift and no app bundle layout change; only the helper binary's contents do.

Size

About 3,000 changed lines. About 2,900 of them are the patch file, a verbatim copy of #82, which is reviewed in that repo. The build and test changes are about 90 lines.

Risk

The Computer Use helper changes behavior only on a machine joined to a cmux team. A Computer Use process started from an older helper build keeps its old behavior until it exits.

Tests (red/green, Linux, pinned source)

  • Compat contract: the series applies at the pin.
  • RED (pin + delivery patch + only #82's end-to-end test): the joined, screen-only and revoke steps fail (exit 101).
  • GREEN (pin + full series):
    • cmux-cua-core machine_consent tests pass (27);
    • the end-to-end cmux-cua mcp test passes (2);
    • all cmux-cua-core lib tests pass (241);
    • the release build passes;
    • the cmux-host-consent build and its consent tests (35) pass.

šŸ¤– Generated with Claude Code

Agent session: agent session