feat(computer-use): enable computer use by default, governed by a permission-group restriction

Merged
WA
2d ago
+247-368

Summary

  • Computer use is on by default: removes the mothership-computer-use feature flag (registry entry, MSHIP_COMPUTER_USE fallback, layout/provider wiring, client gates)
  • Each device still opts in under Settings → Desktop → Computer Use (Accessibility, Screen Recording, per-app approval)
  • New Computer Use permission-group restriction (disableComputerUse → computer_use.use) lets enterprise admins withhold it; the rule also follows Chat (hideCopilot), matching how narrower capabilities subsume their module
  • desktop.computer.execute declares computer_use.use, so the funnel refuses withheld actions before claiming them; the chat payload only advertises computer use when the owner's group allows it
  • Removes the /api/desktop/computer/availability route: the client now reports device state only and the server decides, dropping a blocking request from every desktop chat send
  • Settings hides the device controls when the member's group withholds computer use; the activity chip stays so an in-flight action can still be stopped
  • Docs: enterprise access-control table, desktop README; regenerated OpenAPI + CLI artifacts

Type of Change

  • New feature

Testing

  • bunx vitest run on lib/computer-use, lib/permission-groups, lib/desktop, lib/core/config/feature-flags, settings/desktop, components/computer-use, lib/mothership/chat/payload, ee/access-requests (all green)
  • New refusal tests (authorize + settings) fail with the gate removed
  • check:permission-group-enforcement (40 capabilities enforced), check:application-graph, check:api-validation:strict, check:client-boundary, check:openapi, check:cli-api, check:test-patterns, check:comment-hygiene; full gate in CI

Checklist

  • Code follows project style guidelines
  • Self-reviewed my changes
  • Tests added/updated and passing (new tests pass the test-audit authoring gate)
  • No new warnings introduced
  • I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)